Support constants for api keys

[fului]

Allow for constants to be used to override the option to set the api key and account id via settings api.

This would allow sites that use environment variables or secrets managers, so set the constants via env and remove the data from being stored directly in the database, as plain text.

[B-Interactive]

This is just a clarification on what's being stored. The Cloudflare Global API Key is not collected, used or stored by the plugin (the original version did). The security concerns of handling the API Key with the plugin would be considerable, which is why I stepped away from that once I forked it.

Instead, what's stored is a generated API Token with limited scope (assuming the user has defined that limited scope to something like Stream:Edit), and client IP address filtering. In the event this API Token is maliciously obtained, the scope of exploit would be limited to Stream:Edit functions, and then only if executed from a permitted IP address.

In the interest of discussing the scenarios, and the possibility I'm missing something important, I'll step out the scenario as I've imagined it:

In theory, I could provide you with an API Token from my account in clear text, but that remains unusable by you, unless you're able to execute calls from the permitted IP address of my server. If you're able to execute calls from my server (as an unauthorised actor), then I would not be confident that other means of storing the API Token, such as environment variables, or secrets managers, would provide any advantage, because of the access you would have already gained in an unauthorised way.

[fului]

Hi @B-Interactive, I'm new to Cloudflare Stream, so I didn't know about the IP filtering, which probably helps a bit, but I am using the scoped key, which is why I found this plugin.

In my experience, some agencies will use an .env file for all their secrets and then load them via constants, which is why it would be nice to support.

Also, it is not unheard of that a 3rd-party plugin has had a security vulnerability where it was possible to run sql code and then a simple sql like the following would probably reveal a few api keys, as people tend to add api in the options name, myself included.

SELECT option_value FROM wp_options WHERE option_key LIKE %api%

This is not a pressing thing or a dealbreaker, but it would be a nice addition to the plugin and I don't think it would be super hard to implement.

Alternatively, a solution like this one could also be relevant. https://fullstackdigital.io/blog/how-to-safely-store-api-keys-and-access-protected-external-apis-in-wordpress/