od() || 'PUT' === $request->get_method();

	foreach ( wp_get_connectors() as $connector_id => $connector_data ) {
		$auth = $connector_data['authentication'];

		if ( 'application_password' === $auth['method'] && ! empty( $auth['setting_name'] ) ) {
			$setting_name = $auth['setting_name'];
			if ( array_key_exists( $setting_name, $data ) && is_array( $data[ $setting_name ] ) ) {
				$password = $data[ $setting_name ]['password'] ?? '';
				if ( is_string( $password ) && '' !== $password ) {
					$data[ $setting_name ]['password'] = str_repeat( "\u{2022}", 16 );
				}
			}
			continue;
		}

		if ( 'api_key' !== $auth['method'] || empty( $auth['setting_name'] ) ) {
			continue;
		}

		$setting_name = $auth['setting_name'];
		if ( ! array_key_exists( $setting_name, $data ) ) {
			continue;
		}

		$value = $data[ $setting_name ];

		// On update, validate AI provider keys before masking.
		// Non-AI connectors accept keys as-is; the service plugin handles its own validation.
		if ( $is_update && is_string( $value ) && '' !== $value && 'ai_provider' === $connector_data['type'] ) {
			if ( true !== _wp_connectors_is_ai_api_key_valid( $value, $connector_id ) ) {
				update_option( $setting_name, '' );
				$data[ $setting_name ] = '';
				continue;
			}
		}

		// Mask the key in the response.
		if ( is_string( $value ) && '' !== $value ) {
			$data[ $setting_name ] = _wp_connectors_mask_api_key( $value );
		}
	}

	$response->set_data( $data );
	return $response;
}
add_filter( 'rest_post_dispatch', '_wp_connectors_rest_settings_dispatch', 10, 3 );

/**
 * Registers default connector settings.
 *
 * @since 7.0.0
 * @access private
 */
function _wp_register_default_connector_settings(): void {
	$registered_settings = get_registered_settings();

	foreach ( wp_get_connectors() as $connector_data ) {
		$auth = $connector_data['authentication'];
		if ( 'api_key' !== $auth['method'] && 'application_password' !== $auth['method'] ) {
			continue;
		}

		if ( empty( $auth['setting_name'] ) || isset( $registered_settings[ $auth['setting_name'] ] ) ) {
			continue;
		}
		$setting_name = $auth['setting_name'];

		if ( ! isset( $connector_data['plugin']['is_active'] ) || ! is_callable( $connector_data['plugin']['is_active'] ) ) {
			continue;
		}

		if ( ! call_user_func( $connector_data['plugin']['is_active'] ) ) {
			continue;
		}

		if ( 'api_key' === $auth['method'] ) {
			register_setting(
				'connectors',
				$setting_name,
				array(
					'type'              => 'string',
					'label'             => sprintf(
						/* translators: %s: Connector name. */
						__( '%s API Key' ),
						$connector_data['name']
					),
					'description'       => sprintf(
						/* translators: %s: Connector name. */
						__( 'API key for the %s connector.' ),
						$connector_data['name']
					),
					'default'           => '',
					'show_in_rest'      => true,
					'sanitize_callback' => 'sanitize_text_field',
				)
			);
		} elseif ( 'application_password' === $auth['method'] ) {
			register_setting(
				'connectors',
				$setting_name,
				array(
					'type'              => 'object',
					'label'             => sprintf(
						/* translators: %s: Connector name. */
						__( '%s Credentials' ),
						$connector_data['name']
					),
					'description'       => sprintf(
						/* translators: %s: Connector name. */
						__( 'Application password credentials for the %s connector.' ),
						$connector_data['name']
					),
					'default'           => array(
						'username' => '',
						'password' => '',
					),
					'show_in_rest'      => array(
						'schema' => array(
							'type'                 => 'object',
							'properties'           => array(
								'username' => array(
									'type' => 'string',
								),
								'password' => array(
									'type' => 'string',
								),
							),
							'additionalProperties' => false,
						),
					),
					'sanitize_callback' => static function ( $value ) use ( $setting_name ) {
						return wp_connectors_sanitize_application_password_credentials( $value, $setting_name );
					},
				)
			);
		}
	}
}
add_action( 'init', '_wp_register_default_connector_settings', 20 );

/**
 * Passes stored connector API keys to the WP AI client.
 *
 * @since 7.0.0
 * @access private
 */
function _wp_connectors_pass_default_keys_to_ai_client(): void {
	try {
		$ai_registry = AiClient::defaultRegistry();
		foreach ( wp_get_connectors() as $connector_id => $connector_data ) {
			if ( 'ai_provider' !== $connector_data['type'] ) {
				continue;
			}

			$auth = $connector_data['authentication'];
			if ( 'api_key' !== $auth['method'] || empty( $auth['setting_name'] ) ) {
				continue;
			}

			if ( ! $ai_registry->hasProvider( $connector_id ) ) {
				continue;
			}

			// Skip if the key is already provided via env var or constant.
			$key_source = _wp_connectors_get_api_key_source( $auth['setting_name'], $auth['env_var_name'] ?? '', $auth['constant_name'] ?? '' );
			if ( 'env' === $key_source || 'constant' === $key_source ) {
				continue;
			}

			$api_key = get_option( $auth['setting_name'], '' );
			if ( ! is_string( $api_key ) || '' === $api_key ) {
				continue;
			}

			$ai_registry->setProviderRequestAuthentication(
				$connector_id,
				new ApiKeyRequestAuthentication( $api_key )
			);
		}
	} catch ( Exception $e ) {
		wp_trigger_error( __FUNCTION__, $e->getMessage() );
	}
}
add_action( 'init', '_wp_connectors_pass_default_keys_to_ai_client', 20 );

/**
 * Exposes connector settings to the connectors-wp-admin script module.
 *
 * @since 7.0.0
 * @access private
 *
 * @param array<string, mixed> $data Existing script module data.
 * @return array<string, mixed> Script module data with connectors added.
 */
function _wp_connectors_get_connector_script_module_data( array $data ): array {
	$registry = AiClient::defaultRegistry();

	if ( ! function_exists( 'validate_plugin' ) ) {
		require_once ABSPATH . 'wp-admin/includes/plugin.php';
	}

	$connectors = array();
	foreach ( wp_get_connectors() as $connector_id => $connector_data ) {
		$auth     = $connector_data['authentication'];
		$auth_out = array( 'method' => $auth['method'] );

		if ( 'api_key' === $auth['method'] ) {
			$auth_out['settingName']    = $auth['setting_name'] ?? '';
			$auth_out['credentialsUrl'] = $auth['credentials_url'] ?? null;
			$key_source                 = _wp_connectors_get_api_key_source( $auth['setting_name'] ?? '', $auth['env_var_name'] ?? '', $auth['constant_name'] ?? '' );
			$auth_out['keySource']      = $key_source;

			if ( 'ai_provider' === $connector_data['type'] ) {
				try {
					$auth_out['isConnected'] = $registry->hasProvider( $connector_id ) && $registry->isProviderConfigured( $connector_id );
				} catch ( Exception $e ) {
					$auth_out['isConnected'] = false;
				}
			} else {
				$auth_out['isConnected'] = 'none' !== $key_source;
			}
		} elseif ( 'application_password' === $auth['method'] ) {
			$credentials = wp_connectors_get_application_password_credentials( $auth );

			$auth_out['settingName']    = $auth['setting_name'] ?? '';
			$auth_out['credentialsUrl'] = $auth['credentials_url'] ?? null;
			$auth_out['keySource']      = $credentials['source'];
			$auth_out['isConnected']    = '' !== $credentials['username'] && '' !== $credentials['password'];
		}

		$connector_out = array(
			'name'           => $connector_data['name'],
			'description'    => $connector_data['description'],
			'logoUrl'        => ! empty( $connector_data['logo_url'] ) ? $connector_data['logo_url'] : null,
			'type'           => $connector_data['type'],
			'authentication' => $auth_out,
		);

		if ( ! empty( $connector_data['plugin']['file'] ) ) {
			$file         = $connector_data['plugin']['file'];
			$is_activated = (bool) call_user_func( $connector_data['plugin']['is_active'] );
			$is_installed = $is_activated || 0 === validate_plugin( $file );

			$connector_out['plugin'] = array(
				'file'        => $file,
				'isInstalled' => $is_installed,
				'isActivated' => $is_activated,
			);
		}

		$connectors[ $connector_id ] = $connector_out;
	}
	ksort( $connectors );
	$data['connectors']        = $connectors;
	$data['isFileModDisabled'] = ! wp_is_file_mod_allowed( 'install_plugins' );
	return $data;
}
add_filter( 'script_module_data_options-connectors-wp-admin', '_wp_connectors_get_connector_script_module_data' );