Description
AICPub Publisher Connector connects one WordPress site to the AICPub publishing
service. A WordPress administrator chooses the publishing user, allowed authors
and categories, and whether the connection may publish publicly.
An authorized AICPub user can prepare a draft or request a publication using
the permissions granted to that site. Every content change requires its own
approval. The connector reports the result back to AICPub so the user can
verify what WordPress saved or published.
An AICPub account with access to the service is required. See External service
for the data exchanged during setup and publishing.
Administrator-managed connection
Open Settings > AICPub Publisher Connector. Paste the one-use code and the exact local
policy JSON. The policy lists revision,execution_user_id,allowed_author_ids,
allowed_category_ids,capabilities and html_profile=publisher-post-html-v1. Choose
existing users/categories; arrays must be sorted and unique. site.read and
operation.read are mandatory; draft.create,draft.update,media.upload,
published.update,publication.publish are
separate opt-in grants. The administrator then confirms the returned tenant,
exact site and grants. Pending consent does not enable content operations.
Every content effect additionally needs its own current signed approval attestation.
External service
This connector integrates with AICPub (https://aicpub.com/). An admitted AICPub
account is required for its account-first setup. The default setup service is
https://app.aicpub.com/; an operator may configure a separate test deployment.
Activation alone does not connect an account or start a content transfer.
When a WordPress administrator starts setup, the connector sends the site’s name,
HTTPS REST address, installation/setup identifiers and a temporary setup proof to
the configured service. After account approval, the selected WordPress execution
user ID, allowed author/category IDs or category scope, and granted capabilities
are sent for consent. Setup status and pairing requests use those same service
endpoints. The administrator must approve the account/site and permissions before
the binding becomes active.
For an active binding, authenticated service requests read the permitted site
profile and operation status and deliver only the content/media and actions
covered by the granted policy and current signed approval. Responses can include
permitted author/category information, post/media identifiers, URLs and operation
verification results. Disconnect sends a revocation notice to the configured
service. Unknown write outcomes are inspected; they are not automatically retried.
AICPub privacy information: https://aicpub.com/privacy/
AICPub service terms: https://aicpub.com/terms/
Support: https://aicpub.com/support/
Updating an existing installation
The directory installs under aicpub-publisher-connector. Some earlier private
installations use publisher-connector. If your site uses that older folder,
ask your site administrator to verify the migration and rollback path before
installing the directory version. Changing the folder can stop WordPress from
loading the active connector. Activating it again revokes the existing pairing.
Keep the complete WordPress content-directory and database backup, including
all connector options and any existing legacy key file.
Update an active installation without deactivating, deleting or reactivating the plugin: those
lifecycle actions revoke the connection and require pairing again. Pause and
drain service dispatch before a file-consistent replacement; retain the key and
operation journal. A local upgrade from an observed 0.1.6 source snapshot passed;
an actual connected production-account upgrade remains unverified. Once database-
backed ciphertext is stored, older releases cannot decrypt it. Use a release that
supports the current key format for rollback; never restore stale connection or
operation records to make an older release appear usable.
Operations and lifecycle
POST outcomes are never automatically retried. Executing/unknown operation rows
remain nonexecutable; authenticated GET readback does not repair/delete content.
Disconnect revokes locally first; its service notice is attempted once. Reactivation
requires pairing. Deactivation/uninstall preserve posts,media,installation identity
and operation tombstones while removing active secret material. There is no automatic
content cleanup or tombstone purge. Controlled restore/clone requires revoking the
service epoch before copying/restoring; undetected same-origin database rollback
cannot be detected reliably by this plugin.
Durable fixed-window quotas: authenticated tenant/site requests 120/minute; code
exchange attempts 10/10minutes per installation+admin and 30/10minutes per direct IP.
Quota and nonce state does not rely on WordPress transients/object cache. A 429 is
not permission to retry a business POST; reconcile with authenticated reads.
Native Sodium clears temporary secret buffers. On WordPress sodium_compat,
references are released without calling its unsupported memory-wipe function;
secure physical memory erasure is not claimed for the PHP polyfill.
Explicit result control after connection renewal
The authenticated operation control route accepts the exact original expired
request and original key ID through a current same-tenant/site/installation
binding. The old key ID is audit metadata; old secret material is not used.
Existing executing/completed/cancelled rows must match the full original request
audit fingerprint. Control holds the original execution lock and never writes,
deletes or republishes content. A missing correlated receipt can be repaired
transactionally, or an absent request can receive a nonexecutable tombstone.
Changed content, missing correlation or another installation remain unresolved.
A normal operation request cannot use this route as an execution fallback.
License
The distributed Publisher Connector package is licensed under GPL-2.0-or-later.
See LICENSE for the complete GNU General Public License version 2. This license
applies to the distributed connector files, including its schema copy; it does
not relicense the separate publisher engine, operator workspaces or AICPub service.
Installation
- In WordPress, open Plugins > Add New Plugin and search for AICPub Publisher
Connector. - Select Install Now, then Activate.
- Open Settings > AICPub Publisher Connector and select Connect to AICPub to begin
connecting your account and site.
If you already have an active private installation, read Updating an existing
installation before installing the directory version.
The connector requires single-site WordPress 7.0 or later, PHP 8.3 or later,
Sodium (native or the WordPress polyfill), mbstring and iconv. Setup and content
operations require the standard WordPress wpdb class with a native mysqli
connection. Database drop-ins that replace or extend wpdb are unsupported and
fail closed. Ask the site administrator to verify these requirements first.
The HTTPS REST address is detected automatically from WordPress. Open Settings >
AICPub Publisher Connector and choose Connect to AICPub. Sign in with an admitted AICPub
account and confirm the account and site. Return to WordPress to choose the
publishing user, available authors, category access and optional public publishing.
Review those permissions in AICPub, then return to WordPress to finish consent.
Your WordPress password stays with WordPress. An account connection does not
approve an article or enable public publishing automatically.
The publishing user must not be an administrator or have site, plugin, theme or
user administration permissions. Use a content-only account, such as an Author
for its own articles or an Editor for the selected authors. Each remote write
rechecks this boundary and runs with only post/media capabilities; unfiltered
HTML and other account capabilities are unavailable during execution. The local
administrator still controls pairing and consent in the WordPress dashboard.
The connector provides no remote plugin/theme installation, user administration,
site configuration, code editing or login endpoint.
If an existing publishing user has administrative permissions, content writes
pause and the dashboard explains how to reconnect with a suitable user. Receipt
reads and existing content/journals remain available. Resolve uncertain prior
operations in AICPub before reconnecting; never resend them as new articles.
For administrator-managed pairing, save the exact HTTPS service address supplied
by your administrator before exchanging a code. The address is never taken from
a pairing code or HTTP headers. Service-address changes require a disconnected/revoked
binding. API/service constants remain optional operator overrides; an API override
must match the site’s actual REST address. No wp-config.php edit is required.
The binding is revoked on a detected site-base or installation change.
Multisite is unsupported. InnoDB and reliable primary-key AUTO_INCREMENT columns
are required; the plugin does not repair a damaged WordPress database.
Activation does not require editing wp-config.php. Fresh installations create a
random 32-byte encryption key in a non-autoloaded WordPress database option.
The plugin never creates executable key files or writes to its plugin directory,
WordPress core or content directories. Independent random database keys protect
peer rate-limit identifiers and local recovery-plan signatures; authentication
cookies, WordPress keys and salts are not used for these purposes.
Secrets use authenticated sodium encryption. PUBLISHER_CONNECTOR_ENCRYPTION_KEY
remains an optional advanced override: base64 encoding of exactly 32 bytes, held
outside the database. Existing legacy encrypted bindings retain their original
configured-key or WordPress-salt decryption path. Existing managed-v1 bindings
continue to read their original private WP_CONTENT_DIR/publisher-connector/managed-key.php
file with descriptor/permission checks. It is never created, rewritten, executed,
relocated or deleted by this version. No automatic key rotation is performed.
Missing/corrupt existing key material fails closed and is never silently replaced.
Back up the database and complete WordPress content directory together. Preserve
all publisher_connector_* options and any legacy managed-key.php across upgrades
and moves. Existing file-backed bindings still require their original key file;
new database-backed bindings require their original key option. Treat database
backups as confidential: database-backed encryption does not protect against a
complete database disclosure because the key and ciphertext share that storage.
The optional separately stored encryption override can provide that separation.
Restore original keys; never replace them to bypass an unresolved connection.
Site clones/moves still require the controlled revoke/re-pair procedure below.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“AICPub Publisher Connector” is open source software. The following people have contributed to this plugin.
Contributors
Translate “AICPub Publisher Connector” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
0.1.9
- Require a non-administrator publishing user and limit remote execution to content capabilities.
- Recheck permissions after pairing and pause writes if the publishing user gains administrative permissions.
- Replace direct mysqli calls with core wpdb operations while retaining session, transaction and no-replay checks.
- Preserve existing installation identity, keys, bindings and operation records during file updates.
- Add a separate permission for updating published posts and keep signed Connector REST responses out of the LiteSpeed cache.
0.1.8
- Store fresh encryption keys in non-autoloaded options; never create PHP key files.
- Preserve read-only compatibility with existing file-backed and legacy ciphertext.
- Separate rate-limit and recovery keys from WordPress authentication material.
- Prepare core table identifiers and reject malformed/non-POST privileged forms.
- Preserve pinned database-session and no-replay safeguards.
0.1.7
- Directory candidate: account-first setup and explicit service disclosure.
- Keep existing installation identity, private key and operation tombstones.
- Reject replaced key files and unsafe storage without mutating permissions.
- Verify form nonces before reading connection actions.
- Use prepared journal identifiers and document necessary native security operations.