ROBOTSTXT/robotstxt-manager
Watch
9
0
Fork
You've already forked robotstxt-manager
 0
Code Issues Pull requests Projects Releases 25 Packages Wiki Activity Actions

v1.4.0

Browse source
This commit is contained in:
Javier Casares 2026-08-17 16:07:31 +00:00
commit 21df13f02a
5 changed files with 76 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

39
includes/class-robotstxt-manager-core-client.php
View file

@ -361,6 +361,45 @@ class Robotstxt_Manager_Core_Client {
return $rows;
}
/**
* Exchanges the account API key for a short-lived download token
* (Core 1.9.0+ `POST /me/download-token`).
*
* @param string $slug Plugin slug the token may download.
*
* @return string Token string, or '' when unavailable (older Core, no
* key, inactive subscription, or transport error —
* callers fall back to the API-key flow).
*/
public function exchange_download_token( string $slug ): string {
if ( ! $this->has_api_key() ) {
return '';
}
$response = wp_remote_post(
$this->store_url . '/wp-json/' . self::REST_NAMESPACE . '/me/download-token',
array(
'headers' => array(
'Authorization' => 'Bearer ' . $this->api_key,
'Accept' => 'application/json',
'Content-Type' => 'application/json',
),
'body' => (string) wp_json_encode( array( 'slug' => $slug ) ),
'timeout' => self::TIMEOUT,
)
);
if ( is_wp_error( $response ) || 200 !== (int) wp_remote_retrieve_response_code( $response ) ) {
return '';
}
$data = json_decode( wp_remote_retrieve_body( $response ), true );
$token = is_array( $data ) ? ( $data['token'] ?? '' ) : '';
return is_string( $token ) ? $token : '';
}
/**
* Clears the cached subscriptions response (key change, manual refresh).
*

17
includes/class-robotstxt-manager-updater.php
View file

@ -300,11 +300,20 @@ class Robotstxt_Manager_Updater {
);
if ( 'premium' === $type ) {
$api_key_raw = get_option( 'robotstxt_manager_api_key', '' );
$api_key = is_string( $api_key_raw ) ? Robotstxt_Manager_Encryption::decrypt( $api_key_raw ) : '';
// Preferred: a short-lived download token (Core 1.9.0+) — keeps the
// long-lived API key out of the update transient and access logs.
$token = $client->exchange_download_token( $slug );
if ( '' !== $api_key ) {
$args['api_key'] = $api_key;
if ( '' !== $token ) {
$args['token'] = $token;
} else {
// Fallback (older Core): the API key itself.
$api_key_raw = get_option( 'robotstxt_manager_api_key', '' );
$api_key = is_string( $api_key_raw ) ? Robotstxt_Manager_Encryption::decrypt( $api_key_raw ) : '';
if ( '' !== $api_key ) {
$args['api_key'] = $api_key;
}
}
}