← All changes | includes/core/class-settings.php +356 -98 1.28.0 → 2.7.0 View file →

		@@ -48,8 +48,83 @@
48	48	const DEFAULT_GEMINI_MODEL = 'gemini-3.5-flash';
49	49	const DEFAULT_OPENROUTER_MODEL = 'openai/gpt-4o-mini';
50	50
51	51	/**
	52	+ * Canonical default author-archive templates.
	53	+ *
	54	+ * Same single-source-of-truth rule as the model constants above: the
	55	+ * defaults array, the REST endpoint, the get-settings ability and
	56	+ * Author_Archives_Manager all read these instead of repeating the literal,
	57	+ * which had already drifted — the title default hardcoded an en dash while
	58	+ * the feature resolves %separator% from Site Identity (#318).
	59	+ *
	60	+ * @since 1.29.1
	61	+ */
	62	+ /**
	63	+ * AI providers this plugin supports.
	64	+ *
	65	+ * Single source of truth for the REST enum, the connection test's dispatch
	66	+ * and sanitize_setting(), so the three cannot disagree about what is legal.
	67	+ *
	68	+ * @since 2.2.0
	69	+ * @var string[]
	70	+ */
	71	+ public const SUPPORTED_AI_PROVIDERS = ['openai', 'claude', 'gemini', 'openrouter'];
	72	+
	73	+ /**
	74	+ * The stored value meaning "the user has not chosen a provider yet".
	75	+ *
	76	+ * A fresh install ships with no provider selected: picking one is the
	77	+ * user's call, and pre-selecting OpenAI made the settings screen open with
	78	+ * a warning about a missing key for a provider nobody had asked for (#572).
	79	+ * Every write path accepts this alongside SUPPORTED_AI_PROVIDERS.
	80	+ *
	81	+ * @since 2.1.3
	82	+ */
	83	+ public const AI_PROVIDER_NONE = '';
	84	+
	85	+ /**
	86	+ * One-time marker for {@see Settings::retire_seeded_ai_provider()}.
	87	+ */
	88	+ private const PROVIDER_MIGRATION_OPTION = 'thinkrank_ai_provider_migration';
	89	+ private const PROVIDER_MIGRATION_VERSION = '1';
	90	+
	91	+ /**
	92	+ * Legal values for the `ai_provider` setting, including "not chosen".
	93	+ *
	94	+ * @since 2.1.3
	95	+ * @return string[]
	96	+ */
	97	+ public static function selectable_ai_providers(): array {
	98	+ return array_merge([self::AI_PROVIDER_NONE], self::SUPPORTED_AI_PROVIDERS);
	99	+ }
	100	+
	101	+ const DEFAULT_AUTHOR_ARCHIVES_TITLE = '%author_name% %separator% %site_title% %page%';
	102	+ const DEFAULT_AUTHOR_ARCHIVES_META_DESC = 'Articles written by %author_name% on %site_title%';
	103	+
	104	+ /**
	105	+ * String settings where a stored empty string is a real value, not "unset".
	106	+ *
	107	+ * get() normally treats '' the same as a missing option and returns the
	108	+ * default, which is right for most keys — a blank API key or model name is
	109	+ * never what the user meant. For these template fields it is the opposite:
	110	+ * clearing the box means "render no template", and the consumers already
	111	+ * branch on an empty value. Without the opt-out the save appeared to
	112	+ * succeed and the default reappeared on the next request (#316).
	113	+ *
	114	+ * @since 1.29.1
	115	+ * @var string[]
	116	+ */
	117	+ private const EMPTY_IS_A_VALUE = [
	118	+ 'author_archives_title',
	119	+ 'author_archives_meta_desc',
	120	+ // '' is the "no provider chosen" state, not "fall back to the default".
	121	+ // Without this, deselecting a provider would be undone by any caller
	122	+ // that passes its own fallback to get() (#572).
	123	+ 'ai_provider',
	124	+ ];
	125	+
	126	+ /**
52	127	* Shared singleton instance
53	128	*
54	129	* @var Settings|null
55	130	*/
		@@ -98,9 +173,9 @@
98	173	* @var array
99	174	*/
100	175	private array $defaults = [
101	176	// AI Settings
102		- 'ai_provider' => 'openai',
	177	+ 'ai_provider' => self::AI_PROVIDER_NONE,
103	178	'openai_api_key' => '',
104	179	'openai_model' => self::DEFAULT_OPENAI_MODEL,
105	180	'claude_api_key' => '',
106	181	'claude_model' => self::DEFAULT_CLAUDE_MODEL, // Recommended default (best speed/quality balance)
		@@ -156,43 +231,14 @@
156	231	'seo_score_threshold' => 70,
157	232	'enable_meta_generation' => true,
158	233	'enable_schema_markup' => true,
159	234
160		- // Auto AI Optimization (on-publish metadata fill; #248 P1)
161		- 'auto_ai_meta_enabled' => false,
162		- 'auto_ai_meta_post_types' => ['post'],
163		-
164		- // Brand Visibility v2. The brand profile drives question generation
165		- // and mention detection; per-platform keys let this feature query
166		- // several assistants without changing the site-wide AI provider.
167		- 'bv_brand_name' => '',
168		- 'bv_variants' => [],
169		- 'bv_location' => '',
170		- 'bv_category' => '',
171		- 'bv_description' => '',
172		- 'bv_competitors' => [],
173		- 'bv_queries' => [],
174		- 'bv_platforms' => ['chatgpt'],
175		- 'bv_samples' => 1,
176		- 'bv_key_chatgpt' => '',
177		- 'bv_key_gemini' => '',
178		- 'bv_key_claude' => '',
179		- 'bv_key_perplexity' => '',
180		- // Empty = use the platform's default model (see Brand_Visibility_Providers).
181		- 'bv_model_chatgpt' => '',
182		- 'bv_model_gemini' => '',
183		- 'bv_model_claude' => '',
184		- 'bv_model_perplexity' => '',
185		-
186		- // AI Brand Visibility (BYO-key checks; #248 P1)
187		- 'brand_visibility_queries' => [],
188		-
189	235	// Author Archives Settings
190	236	'author_archives_enabled' => true,
191	237	'author_archives_index' => true,
192	238	'author_archives_show_empty' => false,
193		- 'author_archives_title' => '%author_name% – %site_title% %page%',
194		- 'author_archives_meta_desc' => 'Articles written by %author_name% on %site_title%',
	239	+ 'author_archives_title' => self::DEFAULT_AUTHOR_ARCHIVES_TITLE,
	240	+ 'author_archives_meta_desc' => self::DEFAULT_AUTHOR_ARCHIVES_META_DESC,
195	241
196	242	// UI Settings
197	243	'show_welcome_message' => true,
198	244	'dashboard_widgets' => ['seo_score', 'ai_usage', 'recent_briefs'],
		@@ -203,8 +249,16 @@
203	249	'retry_attempts' => 3,
204	250	// Exposes the standalone Migration admin page for re-running SEO data
205	251	// imports after setup. Hidden by default; opt-in for advanced/support use.
206	252	'enable_migration_tools' => false,
	253	+ // Exposes ThinkRank's own export / restore. Off by default, like the
	254	+ // migration toggle above: both are occasional, admin-only tools, and a
	255	+ // menu item nobody asked for is a menu item in the way. Your data is
	256	+ // never locked in — the switch is one click away in
	257	+ // Settings > Import / Export, and turning it on immediately restores
	258	+ // the screen and the menu item. Off hides the export card and, unless
	259	+ // migration tools are on, the Import / Export menu item with it.
	260	+ 'enable_import_export' => false,
207	261
208	262	// Privacy Settings
209	263	'data_retention_days' => 90,
210	264	'anonymize_logs' => true,
		@@ -213,16 +267,8 @@
213	267	// Integration Settings
214	268	'google_analytics_id' => '',
215	269	'search_console_property' => '',
216	270
217		- // GA4 Tracking Settings
218		- 'ga4_measurement_id' => '',
219		- 'ga4_auto_inject' => false,
220		- 'ga4_anonymize_ip' => false,
221		- 'ga4_exclude_admin' => false,
222		- 'ga4_tracking_verified' => false,
223		- 'ga4_last_verification' => '',
224		-
225	271	// SEO Analytics Settings
226	272	'seo_analytics_enabled' => false,
227	273	'seo_analytics_setup_completed' => false,
228	274	'seo_analytics_google_analytics_property_id' => '',
		@@ -271,11 +317,102 @@
271	317	* @return void
272	318	*/
273	319	public function init(): void {
274	320	add_action('admin_init', [$this, 'register_settings']);
	321	+ // Admin-only: a front-end pageview can never need this migration, and
	322	+ // the marker is a non-autoloaded option, so hooking it unconditionally
	323	+ // bought one dedicated query on every request for the life of the
	324	+ // install (#588).
	325	+ if (is_admin()) {
	326	+ add_action('init', [self::class, 'retire_seeded_ai_provider']);
	327	+ }
275	328	}
276	329
277	330	/**
	331	+ * Clear the OpenAI selection that older versions seeded on activation.
	332	+ *
	333	+ * Changing the default only helps installs created after the change. Every
	334	+ * site activated before it still carries `ai_provider = 'openai'` written by
	335	+ * Activator::set_default_options(), and still opens Settings warning about a
	336	+ * missing key for a provider nobody picked — the whole complaint in #572.
	337	+ *
	338	+ * "OpenAI with no OpenAI key" is provably not a user's choice: the settings
	339	+ * form refuses to save a provider without a key, so the only way to reach
	340	+ * that state is the old activation seed. A site that genuinely chose OpenAI
	341	+ * has a key and is left alone, as is any site on another provider.
	342	+ *
	343	+ * Version-gated so it runs once and never fights a user who later clears
	344	+ * their key but keeps the provider selected.
	345	+ *
	346	+ * @since 2.1.3
	347	+ *
	348	+ * @return void
	349	+ */
	350	+ public static function retire_seeded_ai_provider(): void {
	351	+ if (get_option(self::PROVIDER_MIGRATION_OPTION) === self::PROVIDER_MIGRATION_VERSION) {
	352	+ self::promote_migration_marker_to_autoload();
	353	+ return;
	354	+ }
	355	+
	356	+ // Record first: a site that somehow fails the checks below must not
	357	+ // re-test on every request for the rest of its life. Autoloaded on
	358	+ // purpose — it is a short write-once flag that is read on every admin
	359	+ // request, which is exactly what autoload is for; storing it
	360	+ // non-autoloaded bought a dedicated query per request instead (#588).
	361	+ update_option(self::PROVIDER_MIGRATION_OPTION, self::PROVIDER_MIGRATION_VERSION, true);
	362	+
	363	+ if (get_option('thinkrank_ai_provider', null) !== 'openai') {
	364	+ return;
	365	+ }
	366	+
	367	+ // Read the stored option directly rather than through Settings::get().
	368	+ // Only emptiness matters here, and get() adds two things this decision
	369	+ // must not depend on: a per-instance cache that may already be primed,
	370	+ // and decryption that can yield '' for a key that is genuinely present.
	371	+ // The raw option is non-empty whenever a key exists, encrypted or not.
	372	+ if ('' !== (string) get_option('thinkrank_openai_api_key', '')) {
	373	+ // A real choice, backed by a key. Leave it.
	374	+ return;
	375	+ }
	376	+
	377	+ // Write through the shared instance, not a throwaway one: set() refreshes
	378	+ // only the cache of the object it is called on, so a private instance
	379	+ // would leave the registered component serving the old value for the
	380	+ // rest of this request — including to the admin page it localizes.
	381	+ self::instance()->set('ai_provider', self::AI_PROVIDER_NONE);
	382	+ }
	383	+
	384	+ /**
	385	+ * Move a legacy migration marker into the autoloaded set.
	386	+ *
	387	+ * Sites that ran the migration on 2.1.3 wrote the marker with
	388	+ * `autoload = false`, and the version gate above returns before the write
	389	+ * that would correct it — so those installs keep paying a dedicated query
	390	+ * to read a one-byte flag on every admin request, which is the cost #588
	391	+ * was about. Promote it once.
	392	+ *
	393	+ * Free to test: alloptions is loaded from the object cache once per request
	394	+ * regardless, and an autoloaded marker is in it, so the steady state after
	395	+ * the promotion is a cache lookup and nothing else. wp_set_option_autoload()
	396	+ * arrived in WP 6.4 and the plugin supports 6.0, hence the guard.
	397	+ *
	398	+ * @since 2.2.0
	399	+ *
	400	+ * @return void
	401	+ */
	402	+ private static function promote_migration_marker_to_autoload(): void {
	403	+ if (!function_exists('wp_set_option_autoload') || !function_exists('wp_load_alloptions')) {
	404	+ return;
	405	+ }
	406	+
	407	+ if (array_key_exists(self::PROVIDER_MIGRATION_OPTION, wp_load_alloptions())) {
	408	+ return;
	409	+ }
	410	+
	411	+ wp_set_option_autoload(self::PROVIDER_MIGRATION_OPTION, true);
	412	+ }
	413	+
	414	+ /**
278	415	* Register WordPress settings
279	416	*
280	417	* @return void
281	418	*/
		@@ -286,16 +423,55 @@
286	423	]);
287	424	}
288	425
289	426	/**
	427	+ * Warm the option cache for a batch of setting keys in one query.
	428	+ *
	429	+ * Every `thinkrank_*` option is autoload=off, so WordPress cannot serve
	430	+ * them from `alloptions` and each get() below is its own round-trip. A
	431	+ * caller that reads a known list of keys should prime it first: on a
	432	+ * ~1ms managed-hosting round-trip, sixteen of those on an anonymous
	433	+ * pageview is ~16ms spent on values the page may not use (#393).
	434	+ *
	435	+ * get() memoizes within the request, so only the first read of each key
	436	+ * ever reaches the database — this is what collapses those first reads.
	437	+ * Keys already memoized are left out of the batch.
	438	+ *
	439	+ * wp_prime_option_caches() is WP 6.4+; the plugin supports 6.0, so an
	440	+ * older site simply keeps the previous behaviour.
	441	+ *
	442	+ * @since 2.1.0
	443	+ *
	444	+ * @param string[] $keys Setting keys, without the `thinkrank_` prefix.
	445	+ * @return void
	446	+ */
	447	+ public function prime(array $keys): void {
	448	+ if (!function_exists('wp_prime_option_caches')) {
	449	+ return;
	450	+ }
	451	+
	452	+ $unread = [];
	453	+
	454	+ foreach ($keys as $key) {
	455	+ if (!isset($this->cache[$key])) {
	456	+ $unread[] = 'thinkrank_' . $key;
	457	+ }
	458	+ }
	459	+
	460	+ if (!empty($unread)) {
	461	+ wp_prime_option_caches($unread);
	462	+ }
	463	+ }
	464	+
	465	+ /**
290	466	* Get setting value
291	467	*
292	468	* @param string $key Setting key
293		- * @param mixed $default Default value
	469	+ * @param mixed $fallback Default value
294	470	* @param int $user_id User ID (0 for global, >0 for user-specific)
295	471	* @return mixed Setting value
296	472	*/
297		- public function get(string $key, $default = null, int $user_id = 0) {
	473	+ public function get(string $key, $fallback = null, int $user_id = 0) {
298	474	// Check cache first
299	475	$cache_key = $user_id > 0 ? "user_{$user_id}_{$key}" : $key;
300	476
301	477	if (isset($this->cache[$cache_key])) {
		@@ -325,15 +501,25 @@
325	501	// Empty string exists in DB, this likely means false was stored
326	502	$value = false;
327	503	} else {
328	504	// Option doesn't exist, use default
329		- $value = $default ?? $this->defaults[$key];
	505	+ $value = $fallback ?? $this->defaults[$key];
330	506	}
331	507	}
332	508	} else {
333		- // Non-boolean settings: use default if not found
334		- if (null === $value || '' === $value) {
335		- $value = $default ?? ($this->defaults[$key] ?? null);
	509	+ // Non-boolean settings: use default if not found.
	510	+ //
	511	+ // get_option() above is called with a null default, so null means
	512	+ // "no row" while '' means a value was deliberately stored. For most
	513	+ // keys we collapse the two — an empty string is treated as unset so
	514	+ // the documented default applies. Keys in EMPTY_IS_A_VALUE opt out:
	515	+ // there, clearing the field is a real choice the consumer honours,
	516	+ // and folding it back into the default made the save look like it
	517	+ // silently failed (#316).
	518	+ $empty_is_unset = !in_array($key, self::EMPTY_IS_A_VALUE, true);
	519	+
	520	+ if (null === $value || ($empty_is_unset && '' === $value)) {
	521	+ $value = $fallback ?? ($this->defaults[$key] ?? null);
336	522	}
337	523	}
338	524
339	525	// Cache the value
		@@ -355,10 +541,14 @@
355	541	if (!array_key_exists($key, $this->defaults)) {
356	542	return false;
357	543	}
358	544
	545	+ // Apply the declared per-key sanitizer before anything is stored. This
	546	+ // is the path essentially every caller takes, so skipping it left the
	547	+ // whole sanitize_setting() switch unreachable — max_tokens,
	548	+ // cache_duration and temperature persisted whatever string arrived.
	549	+ $value = $this->sanitize_setting($key, $value);
359	550
360		-
361	551	// Encrypt if needed
362	552	$encrypted_value = $this->maybe_encrypt($key, $value);
363	553
364	554	// Save to WordPress options or user meta
		@@ -384,10 +574,15 @@
384	574	}
385	575
386	576	// Verify value actually saved (update_option returns false when unchanged)
387	577	$saved_value = get_option($option_name, 'NOT_FOUND');
	578	+ // The loose branch is load-bearing: get_option() returns the stored
	579	+ // STRING ('1', '0', '30') while $encrypted_value may be the original
	580	+ // bool/int. On an unchanged re-save update_option() returns false, so
	581	+ // this comparison is the only thing that marks the save successful —
	582	+ // strict-only here made every unchanged-boolean re-save report failure.
388	583	$values_match = ($saved_value === $encrypted_value) ||
389		- ($saved_value == $encrypted_value && $encrypted_value !== 'NOT_FOUND');
	584	+ ($saved_value == $encrypted_value && $encrypted_value !== 'NOT_FOUND'); // phpcs:ignore Universal.Operators.StrictComparisons.LooseEqual -- intentional type-tolerant verify, see above.
390	585
391	586	// Consider it successful if the value was saved correctly
392	587	$result = $result || $values_match;
393	588	}
		@@ -434,8 +629,23 @@
434	629	return $result;
435	630	}
436	631
437	632	/**
	633	+ * Setting keys whose values are encrypted at rest.
	634	+ *
	635	+ * Exposed so callers that must never emit a credential — the data exporter
	636	+ * in particular — can filter against the same list this class encrypts
	637	+ * with, instead of keeping a copy that silently drifts when a key is added.
	638	+ *
	639	+ * @since 2.2.0
	640	+ *
	641	+ * @return string[] Setting keys.
	642	+ */
	643	+ public function get_encrypted_keys(): array {
	644	+ return $this->encrypted_keys;
	645	+ }
	646	+
	647	+ /**
438	648	* Get all settings (optimized with bulk caching)
439	649	*
440	650	* @param int $user_id User ID (0 for global)
441	651	* @return array All settings
		@@ -502,8 +712,44 @@
502	712	return $sanitized;
503	713	}
504	714
505	715	/**
	716	+ * Sanitize a nested array, preserving its shape.
	717	+ *
	718	+ * Scalars keep their type (an int threshold stays an int); strings are
	719	+ * text-sanitized; objects are dropped, since no setting stores one.
	720	+ *
	721	+ * @since 2.2.0
	722	+ * @param array $value Array to sanitize.
	723	+ * @param int $depth Current recursion depth.
	724	+ * @return array
	725	+ */
	726	+ private function sanitize_array_recursive(array $value, int $depth = 0): array {
	727	+ // Settings are configuration, not arbitrary payloads; a cap keeps a
	728	+ // malformed deep structure from recursing without bound.
	729	+ if ($depth > 10) {
	730	+ return [];
	731	+ }
	732	+
	733	+ $sanitized = [];
	734	+ foreach ($value as $item_key => $item) {
	735	+ $key = is_string($item_key) ? sanitize_key($item_key) : $item_key;
	736	+
	737	+ if (is_array($item)) {
	738	+ $sanitized[$key] = $this->sanitize_array_recursive($item, $depth + 1);
	739	+ } elseif (is_object($item)) {
	740	+ continue;
	741	+ } elseif (is_bool($item) || is_int($item) || is_float($item)) {
	742	+ $sanitized[$key] = $item;
	743	+ } else {
	744	+ $sanitized[$key] = sanitize_text_field((string) $item);
	745	+ }
	746	+ }
	747	+
	748	+ return $sanitized;
	749	+ }
	750	+
	751	+ /**
506	752	* Sanitize individual setting
507	753	*
508	754	* @param string $key Setting key
509	755	* @param mixed $value Setting value
		@@ -509,8 +755,19 @@
509	755	* @param mixed $value Setting value
510	756	* @return mixed Sanitized value
511	757	*/
512	758	private function sanitize_setting(string $key, $value) {
	759	+ // Only keys that are declared array-typed may receive an array. For a
	760	+ // scalar key an array/object value is malformed input, and the scalar
	761	+ // sanitizers below would fatal on it, so fall back to the declared
	762	+ // default instead of letting the bad value through.
	763	+ if (is_array($value) || is_object($value)) {
	764	+ if (!is_array($this->defaults[$key] ?? null)) {
	765	+ return $this->defaults[$key] ?? '';
	766	+ }
	767	+ $value = (array) $value;
	768	+ }
	769	+
513	770	switch ($key) {
514	771	case 'openai_api_key':
515	772	case 'claude_api_key':
516	773	case 'gemini_api_key':
		@@ -517,10 +774,17 @@
517	774	case 'openrouter_api_key':
518	775	return sanitize_text_field($value);
519	776
520	777	case 'ai_provider':
521		- return sanitize_key($value);
	778	+ // sanitize_key() maps '' to '', which is AI_PROVIDER_NONE — the
	779	+ // deliberate "no provider chosen" state, so it must survive here
	780	+ // rather than being folded back into the default (#572).
	781	+ $provider = sanitize_key($value);
522	782
	783	+ return in_array($provider, self::selectable_ai_providers(), true)
	784	+ ? $provider
	785	+ : $this->defaults['ai_provider'];
	786	+
523	787	case 'openai_model':
524	788	case 'claude_model':
525	789	case 'gemini_model':
526	790	case 'openrouter_model':
		@@ -542,10 +806,37 @@
542	806	case 'temperature':
543	807	return (float) $value;
544	808
545	809	case 'dashboard_widgets':
	810	+ return is_array($value) ? array_map('sanitize_key', $value) : [];
	811	+
546	812	case 'seo_analytics_alert_thresholds':
547		- return is_array($value) ? array_map('sanitize_key', $value) : [];
	813	+ // A threshold_name => value map where the values are numbers
	814	+ // (e.g. traffic_drop_percentage => 20) as well as strings, so
	815	+ // sanitize each value by its own type rather than forcing every
	816	+ // one through sanitize_key() — that turned ints into strings.
	817	+ if (!is_array($value)) {
	818	+ return [];
	819	+ }
	820	+ $thresholds = [];
	821	+ foreach ($value as $threshold_key => $threshold_value) {
	822	+ if (is_array($threshold_value)) {
	823	+ continue;
	824	+ }
	825	+ if (is_bool($threshold_value)) {
	826	+ // Keep booleans as booleans. is_numeric() is false for
	827	+ // one, so it used to fall to the string arm and a true
	828	+ // came back as "1" — invisible while this ran only on
	829	+ // the register_setting() path, now that set() routes
	830	+ // every write through here it is a type change on save.
	831	+ $thresholds[sanitize_key($threshold_key)] = $threshold_value;
	832	+ continue;
	833	+ }
	834	+ $thresholds[sanitize_key($threshold_key)] = is_numeric($threshold_value)
	835	+ ? $threshold_value + 0
	836	+ : sanitize_text_field((string) $threshold_value);
	837	+ }
	838	+ return $thresholds;
548	839
549	840	case 'google_analytics_property_id':
550	841	case 'seo_analytics_google_analytics_property_id':
551	842	case 'seo_analytics_report_schedule':
		@@ -552,9 +843,12 @@
552	843	return sanitize_text_field($value);
553	844
554	845	case 'robots_txt_content':
555	846	// Multi-line content — sanitize_text_field() collapses newlines
556		- // and would flatten the whole file onto a single line.
	847	+ // and would flatten the whole file onto a single line. set()
	848	+ // routes every write through here, so a caller that chose
	849	+ // sanitize_textarea_field() itself is otherwise silently
	850	+ // overridden by the default: arm below (#587).
557	851	return sanitize_textarea_field($value);
558	852
559	853	default:
560	854	if (is_bool($value)) {
		@@ -561,9 +855,14 @@
561	855	return (bool) $value;
562	856	} elseif (is_string($value)) {
563	857	return sanitize_text_field($value);
564	858	} elseif (is_array($value)) {
565		- return array_map('sanitize_text_field', $value);
	859	+ // Recurse rather than drop. Skipping nested members was
	860	+ // harmless while this ran only on the register_setting()
	861	+ // path, but set() now routes every write through here, and
	862	+ // structured settings (lists of maps) were being silently
	863	+ // emptied on save.
	864	+ return $this->sanitize_array_recursive($value);
566	865	}
567	866	return $value;
568	867	}
569	868	}
		@@ -585,24 +884,12 @@
585	884	private function maybe_encrypt(string $key, $value) {
586	885	if (!in_array($key, $this->encrypted_keys, true) || !is_string($value) || '' === $value) {
587	886	return $value;
588	887	}
589		- if (!function_exists('sodium_crypto_secretbox')) {
590		- return $value; // sodium unavailable — store as-is
591		- }
592	888
593		- $enc_key = $this->encryption_key();
594		- if ('' === $enc_key) {
595		- return $value;
596		- }
597		-
598		- try {
599		- $nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
600		- $cipher = sodium_crypto_secretbox($value, $nonce, $enc_key);
601		- return self::ENC_PREFIX . base64_encode($nonce . $cipher);
602		- } catch (\Exception $e) {
603		- return $value;
604		- }
	889	+ // Same scheme, same key, same prefix — it just lives in Secret_At_Rest
	890	+ // now so the MCP pairing token can use it too (#396).
	891	+ return Secret_At_Rest::encrypt($value);
605	892	}
606	893
607	894	/**
608	895	* Decrypt a value previously encrypted by maybe_encrypt. Values without the
		@@ -615,27 +902,12 @@
615	902	private function maybe_decrypt(string $key, $value) {
616	903	if (!is_string($value) || strncmp($value, self::ENC_PREFIX, strlen(self::ENC_PREFIX)) !== 0) {
617	904	return $value; // legacy plaintext or non-string
618	905	}
619		- if (!function_exists('sodium_crypto_secretbox_open')) {
620		- return $value;
621		- }
622	906
623		- $enc_key = $this->encryption_key();
624		- if ('' === $enc_key) {
625		- return $value;
626		- }
	907	+ $plain = Secret_At_Rest::decrypt($value);
627	908
628		- $decoded = base64_decode(substr($value, strlen(self::ENC_PREFIX)), true);
629		- if (false === $decoded || strlen($decoded) <= SODIUM_CRYPTO_SECRETBOX_NONCEBYTES) {
630		- return $value;
631		- }
632		-
633		- $nonce = substr($decoded, 0, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
634		- $cipher = substr($decoded, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
635		- $plain = sodium_crypto_secretbox_open($cipher, $nonce, $enc_key);
636		-
637		- if (false === $plain) {
	909	+ if ('' === $plain) {
638	910	// We reach here only when sodium is available and a key was
639	911	// derivable, so this is a genuine failure: the auth salt changed
640	912	// (config rotated, or the site was migrated without wp-config) or
641	913	// the row is corrupt. The value is unrecoverable either way.
		@@ -647,20 +919,6 @@
647	919	return '';
648	920	}
649	921
650	922	return $plain;
651		- }
652		-
653		- /**
654		- * Derive a 32-byte encryption key from the site's auth salt.
655		- *
656		- * @return string Raw 32-byte key, or '' if salts are unavailable.
657		- */
658		- private function encryption_key(): string {
659		- if (!function_exists('wp_salt')) {
660		- return '';
661		- }
662		- // 32 raw bytes from a site-specific secret — SHA-256 output length
663		- // matches SODIUM_CRYPTO_SECRETBOX_KEYBYTES.
664		- return hash('sha256', 'thinkrank-settings|' . wp_salt('auth'), true);
665	923	}
666	924	}