![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 2 weeks ago
Last modified 2 days ago
#65551 new defect (bug)
Connectors: Preserve stored AI provider API key when validation is indeterminate
| Reported by: | khokansardar | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | Awaiting Review |
| Component: | Editor | Version: | 7.0 |
| Severity: | normal | Keywords: | has-patch has-unit-tests needs-testing |
| Cc: | Focuses: | rest-api |
Description
When saving connector settings via the REST API, _wp_connectors_rest_settings_dispatch() validates each updated AI provider API key with _wp_connectors_is_ai_api_key_valid().
That helper returns three states: true (valid), false (invalid), and null (could not be determined — e.g. the provider endpoint was temporarily unreachable and threw an exception).
The dispatch logic discards the key on anything that is not strictly true:
if ( true !== _wp_connectors_is_ai_api_key_valid( $value, $connector_id ) ) {
update_option( $setting_name, '' ); // wipes a valid key
}
As a result, a transient provider outage during a settings save permanently deletes a
user's previously valid API key. "Could not verify" is treated identically to "invalid".
Fix: only discard the key on an explicit false. A null (indeterminate) result preserves
the stored key.
Steps to reproduce:
- Connect an AI provider with a valid API key.
- Re-save connector settings while the provider's validation endpoint is unreachable.
- Observe the stored key is reset to an empty string.
Attachments (2)
Change History (4)
This ticket was mentioned in PR #12345 on WordPress/wordpress-develop by @khokansardar.
2 weeks ago
#1
#2
@
2 days ago
Tested in WordPress Playground.
I was able to reproduce the reported issue. I saved a valid OpenAI API key, then triggered a validation failure and re-saved the connector settings. After the failed validation, the previously saved API key was no longer present in the connector settings, indicating that it had been cleared instead of being preserved.
This matches the behavior described in the ticket, where an indeterminate validation result is treated the same as an invalid key.
## Summary
_wp_connectors_rest_settings_dispatch()discarded a stored AI provider API key whenever validation did not return strictlytrue. Since_wp_connectors_is_ai_api_key_valid()returnsnullwhen a key cannot be verified (e.g. the provider is temporarily unreachable), a transient outage during a settings save permanently wiped a valid key.This changes the check to only discard on an explicit
falseresult. Any other result preserves the stored key.## Changes
src/wp-includes/connectors.php: discard the key only on an explicitfalsefrom_wp_connectors_is_ai_api_key_valid().tests/phpunit/tests/connectors/wpConnectorsRestSettingsDispatch.php: new coverage for the dispatch handler — indeterminate preserves, invalid discards, valid preserved + masked, GET is a no-op.## Testing
phpunit --group connectors→ 85 tests, 219 assertions, passing.test_indeterminate_validation_preserves_key, confirming the new test guards the regression.Trac ticket: https://core.trac.wordpress.org/ticket/65551
## Use of AI Tools
AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 4.8
Used for: Ticket analysis and tests cases. All changes were reviewed, validated against the codebase, and are taken responsibility for by me.