Derive the key the way core derives its salts when the constants are absent

A wp-config.php without salt constants is one core copes with: wp_salt()
generates salts once and keeps them in the database. Every WordPress
test suite runs that way, and so do more live sites than anyone would
like. Treating the absent constants as no key made encryption
unavailable there, and a field marked encrypted then stored nothing --
which is how a Stripe key saved as an empty string. The constants are
still preferred, so a value encrypted under them stays readable; only
when there are none does wp_salt() stand in.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015Kwx2STJ4EaVaJofEJJ9Zo

Author: arraypress

src/Context/EncryptedContext.php

@@ -313,6 +313,15 @@ private static function key(): string {
 			);
 		}
 
+		// No constants at all is how core itself runs when wp-config.php
+		// leaves them out, and how every test suite runs: wp_salt() then
+		// generates salts once and keeps them in the database. Used only
+		// when the constants are absent, so a value encrypted under them
+		// stays readable on a site that has them.
+		if ( '' === $salt && function_exists( 'wp_salt' ) ) {
+			$salt = wp_salt( 'auth' ) . wp_salt( 'secure_auth' ) . wp_salt( 'logged_in' );
+		}
+
 		return '' === $salt ? '' : hash( 'sha256', $salt, true );
 	}
 

tests/stubs.php

@@ -476,6 +476,17 @@ function register_rest_route( $namespace, $route, $args = [], $override = false
 	}
 }
 
+if ( ! function_exists( 'wp_salt' ) ) {
+	/*
+	 * Deterministic within a run, like core's, so the encryption tests can
+	 * round-trip without salt constants in the bootstrap -- which is also
+	 * how the WordPress test suite itself runs.
+	 */
+	function wp_salt( $scheme = 'auth' ) {
+		return 'fk-test-salt-' . $scheme;
+	}
+}
+
 if ( ! function_exists( 'is_user_logged_in' ) ) {
 	function is_user_logged_in() {
 		return true;