外掛標籤
開發者團隊
原文外掛簡介
Storita Connector exposes safe, read‑only access to your WordPress database over the REST API.
Key features:
– Read‑only queries (SELECT only) with robust validation
– API key authentication (or admin users via WP login)
– Nginx/FastCGI friendly header handling (X-Storita-Key, legacy X-DF-Key, or Authorization)
– Built-in rate limiting (1200 requests per hour per API key by default) and a maximum of 1000 rows per query by default
– Optional table whitelisting (restrict access to specific tables/patterns)
– Excluded tables list (empty by default); passwords, login keys and other secrets are always protected
– Secret redaction: password hashes, WordPress auth keys and salts and the API key are removed from every query result
– Schema explorer and health status endpoints; reading error logs is opt-in and off by default
– Admin settings page with copy‑to‑clipboard helpers
– Google Analytics 4 Integration: Proxy requests to GA4 using the existing Google Site Kit connection (supports standard and real-time reports).
This plugin is designed for integrations and reporting tools that need controlled, secure, read-only database access.
Requires a Storita.ai account. The plugin connects your store to the Storita.ai service (https://storita.ai); without a Storita.ai account the data it exposes has no consumer and the plugin has no purpose.
External services
Storita.ai
This plugin connects your WordPress/WooCommerce store to Storita.ai (https://storita.ai), a store analytics and assistant service. Storita.ai uses the plugin to read your store data so it can answer questions and produce reports about your store.
When data is made available:
– Only after the site owner configures an API key in Settings -> Storita.
– Only in response to requests sent to your site’s REST endpoints under the storita/v1 namespace (the legacy df-db/v1 namespace is still answered), either by the Storita.ai service using the API key in the X-Storita-Key (or legacy X-DF-Key) or Authorization header, or by a logged-in administrator.
– Nothing is sent on activation. The plugin makes no calls to storita.ai itself and does not track visitors.
What data is made available:
– Store profile, products, orders and customers data.
– The database schema (schema explorer) and read-only SQL SELECT query results (POST /query). Queries are SELECT-only and validated; tables the site owner excludes are blocked; credential tables are always blocked; and password hashes, WordPress auth keys and salts and the API key are removed from every result.
– Google Analytics 4 data, proxied through your site’s existing Google Site Kit connection (see below).
– Runtime health information. Log data (/health/logs, /health/logs/tail: debug.log, WooCommerce logs, the PHP error log) is shared only if the site owner turns on “Allow Storita to read error logs” in Settings -> Storita (off by default). Logs may contain personal data.
– The public /status endpoint returns only ok and the time.
The admin Test Connection feature calls only the site’s own REST URL (its own address) and never leaves the site.
Storita.ai legal documents:
– Privacy Notice: https://storita.ai/legal/privacy-notice
– Terms (Data Processing Addendum): https://storita.ai/legal/data-processing-addendum
– Trust Center: https://storita.ai/legal/trust-center
Google Analytics Data API (via Google Site Kit)
Only if Google Site Kit is installed and connected to Google Analytics 4: when the Storita.ai service or an administrator calls /google-analytics/report or /google-analytics/realtime, the plugin forwards the requested report fields (metrics, dimensions, date ranges, filters, ordering and limits) to the Google Analytics Data API (analyticsdata.googleapis.com) using Site Kit’s existing Google connection and the Google Analytics property configured in Site Kit. Google returns aggregated analytics report data. Nothing is sent to Google unless such a request is made, and the plugin sends no visitor data of its own.
Google Terms of Service: https://policies.google.com/terms
Google Privacy Policy: https://policies.google.com/privacy
Google Analytics Terms of Service: https://marketingplatform.google.com/about/analytics/terms/us/
Usage
Base URL: https://your-site.example/wp-json/storita/v1
The legacy base URL https://your-site.example/wp-json/df-db/v1 is still supported.
Authenticate by sending one of the following headers:
– X-Storita-Key: YOUR_API_KEY
– X-DF-Key: YOUR_API_KEY (legacy)
– Authorization: Bearer YOUR_API_KEY
– Authorization: DF-Key YOUR_API_KEY
If you are logged in as an administrator (manage_options), endpoints are accessible without the API key.
Endpoints
1) POST /query
– Body params:
– query (string) – SQL SELECT query to execute
– query_base64 (string, optional) – Base64-encoded SQL (alternative to query)
Example (JSON body):
curl -X POST "https://your-site.example/wp-json/storita/v1/query" \
-H "X-Storita-Key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "SELECT ID, post_title FROM wp_posts WHERE post_status=\"publish\" LIMIT 5"}'
2) GET /schema
– Query param: table (optional) – returns structure for a specific table; omit to list all tables
Examples:
curl -H "X-Storita-Key: YOUR_API_KEY" "https://your-site.example/wp-json/storita/v1/schema"
curl -H "X-Storita-Key: YOUR_API_KEY" "https://your-site.example/wp-json/storita/v1/schema?table=wp_posts"
3) GET /status
– Public health endpoint; no auth required
`
curl “https://your-site.example/wp-json/storita/v1/status”
`
4) POST /google-analytics/report
– Queries Google Analytics 4 using Site Kit authentication.
– Body params: GA4 RunReportRequest JSON (metrics, dimensions, dateRanges, etc.)
Example:
curl -X POST "https://your-site.example/wp-json/storita/v1/google-analytics/report" \
-H "X-Storita-Key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"dateRanges": [{"startDate": "30daysAgo", "endDate": "today"}], "metrics": [{"name": "activeUsers"}]}'
5) GET /health/logs and /health/logs/tail
– Off by default; enable “Allow Storita to read error logs” in Settings → Storita.
Security Controls
Requests per window – Rate limit per API key or IP (default 1200 requests per 3600 seconds).
Rate limit window (seconds) – How long the window lasts.
Maximum rows per query – Adds LIMIT automatically when missing; blocks excessive LIMITs (default 1000; 0 disables).
Excluded tables – Select specific tables to block. Nothing is blocked by default; passwords, login keys, API key secrets and 2FA secrets are always protected.
Allowed tables (optional) – Whitelist tables/patterns (e.g., wp_posts, wp_%). Leave empty to allow all tables unless excluded.
Allow Storita to read error logs – off by default.
Filters
storita_wp_rest_api_query – Filter the final SQL before execution.
Params: string $query, WP_REST_Request $request
storita_wp_rest_api_validate_key – Custom validation strategy for API keys.
Params: ?bool $is_valid, string $provided_key, ?WP_REST_Request $request
