← All changes | src/Settings.php +33 -0 2.0.0 → 2.0.4 View file →

		@@ -115,8 +115,41 @@
115	115	return (int) get_option( 'easyfonts_cache_buster', 0 );
116	116	}
117	117
118	118	/**
	119	+ * Secret key authorising background cache-warming loopback requests.
	120	+ * Generated lazily and stored autoloaded. Lets an unauthenticated self-request
	121	+ * (?easyfonts_probe=KEY) be trusted to perform downloads, without wp-cron.
	122	+ *
	123	+ * @return string
	124	+ */
	125	+ public static function warm_key(): string {
	126	+ $key = (string) get_option( 'easyfonts_warm_key', '' );
	127	+
	128	+ if ( '' === $key ) {
	129	+ $key = wp_generate_password( 40, false, false );
	130	+ update_option( 'easyfonts_warm_key', $key, true );
	131	+ }
	132	+
	133	+ return $key;
	134	+ }
	135	+
	136	+ /**
	137	+ * Cache-safe token authorising the public beacon endpoints.
	138	+ *
	139	+ * REST nonces expire (~24h), so a nonce baked into a page-cached HTML copy
	140	+ * eventually 403s every beacon on exactly the cached, high-traffic sites
	141	+ * this plugin targets. This site-secret-derived token doesn't expire, so
	142	+ * cached pages keep reporting. It grants only what the endpoints already
	143	+ * allowed anonymously (throttled, capped measurement ingest) — no more.
	144	+ *
	145	+ * @return string
	146	+ */
	147	+ public static function beacon_token(): string {
	148	+ return hash_hmac( 'sha256', 'easyfonts-beacon-v1', wp_salt( 'nonce' ) );
	149	+ }
	150	+
	151	+ /**
119	152	* Bump the cache-buster (after re-optimisation / purge).
120	153	*/
121	154	public static function bump_buster(): void {
122	155	update_option( 'easyfonts_cache_buster', time(), false );