@testsmith/api-spector 0.2.2 → 0.2.3

package/out/main/chunks/{request-collection-Dx0ZqB54.js → request-collection-DMVlm0PA.js}

@@ -23,13 +23,14 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 const undici = require("undici");
 const promises = require("fs/promises");
+const authBuilder = require("./auth-builder-B7-LgcGr.js");
+const vm = require("vm");
 const crypto = require("crypto");
-const path = require("path");
 const dayjs = require("dayjs");
-const vm = require("vm");
 const tv4 = require("tv4");
 const jsonpathPlus = require("jsonpath-plus");
 const xmldom = require("@xmldom/xmldom");
+const path = require("path");
 const Ajv = require("ajv");
 function _interopNamespaceDefault(e) {
   const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
@@ -47,8 +48,8 @@ function _interopNamespaceDefault(e) {
   n.default = e;
   return Object.freeze(n);
 }
-const crypto__namespace = /* @__PURE__ */ _interopNamespaceDefault(crypto);
 const vm__namespace = /* @__PURE__ */ _interopNamespaceDefault(vm);
+const crypto__namespace = /* @__PURE__ */ _interopNamespaceDefault(crypto);
 let globals = {};
 let currentDir = null;
 function globalsPath(dir) {
@@ -77,171 +78,6 @@ function setGlobals(next) {
 function patchGlobals(patch) {
   globals = { ...globals, ...patch };
 }
-const MASTER_KEY_ENV = "API_SPECTOR_MASTER_KEY";
-let secretStore = {};
-let secretStorePath = null;
-async function initSecretStore(userDataPath) {
-  secretStorePath = path.join(userDataPath, "secrets.json");
-  try {
-    const raw = await promises.readFile(secretStorePath, "utf8");
-    secretStore = JSON.parse(raw);
-  } catch {
-    secretStore = {};
-  }
-}
-async function persistSecretStore() {
-  if (!secretStorePath) return;
-  await promises.writeFile(secretStorePath, JSON.stringify(secretStore, null, 2), "utf8");
-}
-function getSafeStorage() {
-  try {
-    const { safeStorage } = require("electron");
-    if (typeof safeStorage?.isEncryptionAvailable === "function") return safeStorage;
-    return null;
-  } catch {
-    return null;
-  }
-}
-function registerSecretHandlers(ipc) {
-  ipc.handle("secret:checkMasterKey", () => {
-    return { set: Boolean(process.env[MASTER_KEY_ENV]) };
-  });
-  ipc.handle("secret:setMasterKey", (_e, value) => {
-    process.env[MASTER_KEY_ENV] = value;
-  });
-  ipc.handle("secret:set", async (_e, ref, value) => {
-    const ss = getSafeStorage();
-    if (!ss || !ss.isEncryptionAvailable()) {
-      throw new Error("OS encryption is not available — set the secret via environment variable instead");
-    }
-    secretStore[ref] = ss.encryptString(value).toString("base64");
-    await persistSecretStore();
-  });
-}
-function decryptSecret(encrypted, salt, iv, password) {
-  const saltBuf = Buffer.from(salt, "base64");
-  const ivBuf = Buffer.from(iv, "base64");
-  const encBuf = Buffer.from(encrypted, "base64");
-  const key = crypto.pbkdf2Sync(password, saltBuf, 1e5, 32, "sha256");
-  const authTag = encBuf.subarray(encBuf.length - 16);
-  const ciphertext = encBuf.subarray(0, encBuf.length - 16);
-  const decipher = crypto.createDecipheriv("aes-256-gcm", key, ivBuf);
-  decipher.setAuthTag(authTag);
-  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
-}
-async function getSecret(ref) {
-  const stored = secretStore[ref];
-  if (stored) {
-    const ss = getSafeStorage();
-    if (ss && ss.isEncryptionAvailable()) {
-      try {
-        return ss.decryptString(Buffer.from(stored, "base64"));
-      } catch {
-      }
-    }
-  }
-  return process.env[ref] ?? null;
-}
-let _fakerCache$1 = null;
-async function getFaker$1() {
-  if (!_fakerCache$1) _fakerCache$1 = await import("@faker-js/faker");
-  return _fakerCache$1.faker;
-}
-let _exprContext = null;
-async function buildDynamicVars() {
-  const faker = await getFaker$1();
-  const now = dayjs();
-  _exprContext = { faker, dayjs };
-  return {
-    $uuid: faker.string.uuid(),
-    $timestamp: String(Date.now()),
-    $isoTimestamp: now.toISOString(),
-    $randomInt: String(faker.number.int({ min: 0, max: 1e3 })),
-    $randomFloat: String(faker.number.float({ min: 0, max: 1e3, fractionDigits: 2 })),
-    $randomBoolean: String(faker.datatype.boolean()),
-    $randomEmail: faker.internet.email(),
-    $randomUsername: faker.internet.username(),
-    $randomPassword: faker.internet.password(),
-    $randomFullName: faker.person.fullName(),
-    $randomFirstName: faker.person.firstName(),
-    $randomLastName: faker.person.lastName(),
-    $randomWord: faker.lorem.word(),
-    $randomPhrase: faker.lorem.sentence(),
-    $randomUrl: faker.internet.url(),
-    $randomIp: faker.internet.ip(),
-    $randomHexColor: faker.color.rgb({ format: "hex", casing: "lower" })
-  };
-}
-function interpolate(str, vars) {
-  return str.replace(/\{\{([^}]+)\}\}/g, (match, key) => {
-    const trimmed = key.trim();
-    if (trimmed in vars) return vars[trimmed];
-    if (_exprContext && (trimmed.includes(".") || trimmed.includes("("))) {
-      try {
-        const result = vm__namespace.runInNewContext(trimmed, _exprContext);
-        if (result !== void 0 && result !== null) return String(result);
-      } catch {
-      }
-    }
-    return match;
-  });
-}
-function buildUrl(baseUrl, params, vars) {
-  const templateTokens = /* @__PURE__ */ new Set();
-  baseUrl.replace(/\{\{([^}]+)\}\}/g, (_m, name) => {
-    templateTokens.add(String(name).trim());
-    return "";
-  });
-  const enabled = (params ?? []).filter((p) => p.enabled && p.key);
-  const pathRows = [];
-  const queryRows = [];
-  for (const p of enabled) {
-    const isPath = p.paramType === "path" || templateTokens.has(p.key);
-    if (isPath) pathRows.push(p);
-    else queryRows.push(p);
-  }
-  const mergedVars = pathRows.length ? {
-    ...vars,
-    ...Object.fromEntries(pathRows.map((p) => [p.key, interpolate(p.value, vars)]))
-  } : vars;
-  const url = interpolate(baseUrl, mergedVars);
-  if (!queryRows.length) return url;
-  const sep = url.includes("?") ? "&" : "?";
-  const qs = queryRows.map((p) => `${encodeURIComponent(interpolate(p.key, vars))}=${encodeURIComponent(interpolate(p.value, vars))}`).join("&");
-  return url + sep + qs;
-}
-async function buildEnvVars(environment) {
-  const vars = {};
-  if (!environment) return vars;
-  const masterKey = process.env["API_SPECTOR_MASTER_KEY"];
-  for (const v of environment.variables) {
-    if (!v.enabled) continue;
-    if (v.envRef) {
-      const envValue = process.env[v.envRef];
-      if (envValue !== void 0) vars[v.key] = envValue;
-    } else if (v.secret && v.secretEncrypted && v.secretSalt && v.secretIv) {
-      if (masterKey) {
-        try {
-          vars[v.key] = decryptSecret(v.secretEncrypted, v.secretSalt, v.secretIv, masterKey);
-        } catch {
-        }
-      }
-      if (vars[v.key] === void 0 && process.env[v.key] !== void 0) {
-        vars[v.key] = process.env[v.key];
-      }
-    } else if (v.secret) {
-      if (process.env[v.key] !== void 0) {
-        vars[v.key] = process.env[v.key];
-      }
-    } else {
-      vars[v.key] = v.value;
-    }
-  }
-  return vars;
-}
-function mergeVars(envVars, collectionVars, globals2, localVars = {}, dynamicVars = {}) {
-  return { ...dynamicVars, ...globals2, ...collectionVars, ...envVars, ...localVars };
-}
 function xmlFindAll(node, tag, nth) {
   const results = [];
   const siblings = Array.from(node.childNodes).filter((c) => c.nodeType === 1 && c.tagName === tag);
@@ -600,156 +436,6 @@ async function runScript(code, ctx, timeoutMs = 5e3) {
     updatedLocalVars: localVarsCopy
   };
 }
-async function buildAuthHeaders(auth, vars) {
-  const headers = {};
-  if (auth.type === "bearer") {
-    let token = auth.token ?? "";
-    if (!token && auth.tokenSecretRef) token = await getSecret(auth.tokenSecretRef) ?? "";
-    token = interpolate(token, vars);
-    if (token) headers["Authorization"] = `Bearer ${token}`;
-  }
-  if (auth.type === "basic") {
-    let password = auth.password ?? "";
-    if (!password && auth.passwordSecretRef) password = await getSecret(auth.passwordSecretRef) ?? "";
-    password = interpolate(password, vars);
-    const username = interpolate(auth.username ?? "", vars);
-    headers["Authorization"] = `Basic ${Buffer.from(`${username}:${password}`).toString("base64")}`;
-  }
-  if (auth.type === "apikey" && auth.apiKeyIn === "header") {
-    let value = auth.apiKeyValue ?? "";
-    if (!value && auth.apiKeySecretRef) value = await getSecret(auth.apiKeySecretRef) ?? "";
-    value = interpolate(value, vars);
-    headers[auth.apiKeyName ?? "X-API-Key"] = value;
-  }
-  if (auth.type === "oauth2") {
-    const now = Date.now();
-    if (auth.oauth2CachedToken && auth.oauth2TokenExpiry && auth.oauth2TokenExpiry > now + 5e3) {
-      headers["Authorization"] = `Bearer ${auth.oauth2CachedToken}`;
-    }
-  }
-  return headers;
-}
-async function buildApiKeyParam(auth, vars) {
-  if (auth.type !== "apikey" || auth.apiKeyIn !== "query") return null;
-  let value = auth.apiKeyValue ?? "";
-  if (!value && auth.apiKeySecretRef) value = await getSecret(auth.apiKeySecretRef) ?? "";
-  value = interpolate(value, vars);
-  return { key: auth.apiKeyName ?? "apikey", value };
-}
-function parseDigestChallenge(wwwAuth) {
-  const extract = (key) => {
-    const m = new RegExp(`${key}="([^"]*)"`, "i").exec(wwwAuth);
-    return m ? m[1] : "";
-  };
-  const extractUnquoted = (key) => {
-    const m = new RegExp(`${key}=([^,\\s]+)`, "i").exec(wwwAuth);
-    return m ? m[1] : "";
-  };
-  return {
-    realm: extract("realm"),
-    nonce: extract("nonce"),
-    qop: extract("qop") || extractUnquoted("qop") || void 0,
-    algorithm: extract("algorithm") || extractUnquoted("algorithm") || "MD5",
-    opaque: extract("opaque") || void 0
-  };
-}
-function md5(s) {
-  return crypto.createHash("md5").update(s).digest("hex");
-}
-function buildDigestAuthHeader(challenge, username, password, method, uri) {
-  const { realm, nonce, qop, algorithm, opaque } = challenge;
-  const algo = (algorithm ?? "MD5").toUpperCase();
-  const ha1 = algo === "MD5-SESS" ? md5(`${md5(`${username}:${realm}:${password}`)}:${nonce}:`) : md5(`${username}:${realm}:${password}`);
-  const ha2 = md5(`${method}:${uri}`);
-  let response;
-  let nc;
-  let cnonce;
-  if (qop === "auth" || qop === "auth-int") {
-    nc = "00000001";
-    cnonce = crypto.randomBytes(8).toString("hex");
-    response = md5(`${ha1}:${nonce}:${nc}:${cnonce}:${qop}:${ha2}`);
-  } else {
-    response = md5(`${ha1}:${nonce}:${ha2}`);
-  }
-  let header = `Digest username="${username}", realm="${realm}", nonce="${nonce}", uri="${uri}", response="${response}"`;
-  if (qop) header += `, qop=${qop}`;
-  if (nc) header += `, nc=${nc}`;
-  if (cnonce) header += `, cnonce="${cnonce}"`;
-  if (opaque) header += `, opaque="${opaque}"`;
-  if (algo !== "MD5") header += `, algorithm=${algo}`;
-  return header;
-}
-async function performDigestAuth(url, method, auth, vars, fetchFn) {
-  const probeResp = await fetchFn(url, { method, headers: {} });
-  if (probeResp.status !== 401) return null;
-  const wwwAuth = probeResp.headers.get("www-authenticate") ?? "";
-  if (!wwwAuth.toLowerCase().startsWith("digest")) return null;
-  const challenge = parseDigestChallenge(wwwAuth);
-  let password = auth.password ?? "";
-  if (!password && auth.passwordSecretRef) password = await getSecret(auth.passwordSecretRef) ?? "";
-  password = interpolate(password, vars);
-  const username = interpolate(auth.username ?? "", vars);
-  let uri = "/";
-  try {
-    uri = new URL(url).pathname + (new URL(url).search ?? "");
-  } catch {
-  }
-  return buildDigestAuthHeader(challenge, username, password, method, uri);
-}
-async function performNtlmRequest(_url, _method, _auth, _vars) {
-  throw new Error(
-    'NTLM auth is not yet implemented. Add "httpntlm" to package.json dependencies and implement performNtlmRequest in auth-builder.ts.'
-  );
-}
-async function fetchOAuth2Token(auth, vars) {
-  const flow = auth.oauth2Flow ?? "client_credentials";
-  if (flow === "authorization_code") {
-    throw new Error("authorization_code flow requires the oauth2:startFlow IPC call from the renderer.");
-  }
-  if (flow === "implicit") {
-    throw new Error("implicit flow cannot be performed server-side — tokens must be obtained via the browser redirect.");
-  }
-  const tokenUrl = interpolate(auth.oauth2TokenUrl ?? "", vars);
-  if (!tokenUrl) throw new Error("OAuth 2.0: tokenUrl is required.");
-  const clientId = interpolate(auth.oauth2ClientId ?? "", vars);
-  let clientSecret = auth.oauth2ClientSecret ?? "";
-  if (!clientSecret && auth.oauth2ClientSecretRef) {
-    clientSecret = await getSecret(auth.oauth2ClientSecretRef) ?? "";
-  }
-  clientSecret = interpolate(clientSecret, vars);
-  const params = new URLSearchParams();
-  params.set("grant_type", flow === "password" ? "password" : "client_credentials");
-  params.set("client_id", clientId);
-  params.set("client_secret", clientSecret);
-  if (auth.oauth2Scopes) params.set("scope", auth.oauth2Scopes);
-  if (flow === "password") {
-    let password = auth.password ?? "";
-    if (!password && auth.passwordSecretRef) password = await getSecret(auth.passwordSecretRef) ?? "";
-    password = interpolate(password, vars);
-    params.set("username", interpolate(auth.username ?? "", vars));
-    params.set("password", password);
-  }
-  const { fetch: nodeFetch } = await import("undici");
-  const resp = await nodeFetch(tokenUrl, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: params.toString()
-  });
-  if (!resp.ok) {
-    const body = await resp.text();
-    throw new Error(`OAuth 2.0 token request failed (${resp.status}): ${body}`);
-  }
-  const json = await resp.json();
-  const accessToken = String(json["access_token"] ?? "");
-  if (!accessToken) throw new Error("OAuth 2.0: token response missing access_token.");
-  const expiresIn = Number(json["expires_in"] ?? 3600);
-  const expiresAt = Date.now() + expiresIn * 1e3;
-  return {
-    accessToken,
-    expiresAt,
-    refreshToken: json["refresh_token"] ? String(json["refresh_token"]) : void 0
-  };
-}
 function buildProxyUri(proxy) {
   const raw = proxy.url.trim();
   if (!raw) throw new Error("Proxy URL is empty");
@@ -972,7 +658,7 @@ function registerRequestHandler(ipc) {
     const start = Date.now();
     const liveGlobals = getGlobals();
     const mergedGlobals = { ...payloadGlobals, ...liveGlobals };
-    const envVars = await buildEnvVars(environment);
+    const envVars = await authBuilder.buildEnvVars(environment);
     let localVars = {};
     const decryptionWarnings = [];
     if (environment) {
@@ -986,14 +672,14 @@ function registerRequestHandler(ipc) {
         }
       }
     }
-    const dynamicVars = await buildDynamicVars();
-    let vars = mergeVars(envVars, collectionVars, mergedGlobals, localVars, dynamicVars);
+    const dynamicVars = await authBuilder.buildDynamicVars();
+    let vars = authBuilder.mergeVars(envVars, collectionVars, mergedGlobals, localVars, dynamicVars);
     let preScriptMeta = { consoleOutput: [] };
     let updatedCollectionVars = { ...collectionVars };
     let updatedEnvVars = { ...envVars };
     let updatedGlobals = { ...mergedGlobals };
     if (req.preRequestScript?.trim()) {
-      const result = await runScript(interpolate(req.preRequestScript, vars), {
+      const result = await runScript(authBuilder.interpolate(req.preRequestScript, vars), {
         envVars: { ...envVars },
         collectionVars: { ...collectionVars },
         globals: { ...mergedGlobals },
@@ -1006,11 +692,11 @@ function registerRequestHandler(ipc) {
       updatedGlobals = result.updatedGlobals;
       patchGlobals(result.updatedGlobals);
       await persistGlobals();
-      vars = mergeVars(updatedEnvVars, updatedCollectionVars, updatedGlobals, localVars, dynamicVars);
+      vars = authBuilder.mergeVars(updatedEnvVars, updatedCollectionVars, updatedGlobals, localVars, dynamicVars);
     }
     let response;
     let sentRequest = { method: req.method, url: "", headers: {} };
-    const resolvedUrl = buildUrl(req.url, req.params, vars);
+    const resolvedUrl = authBuilder.buildUrl(req.url, req.params, vars);
     const secretValues = /* @__PURE__ */ new Set();
     if (environment) {
       for (const v of environment.variables) {
@@ -1047,13 +733,13 @@ function registerRequestHandler(ipc) {
         const tokenMissing = !req.auth.oauth2CachedToken;
         const tokenExpired = req.auth.oauth2TokenExpiry ? req.auth.oauth2TokenExpiry <= now + 5e3 : true;
         if (tokenMissing || tokenExpired) {
-          const result = await fetchOAuth2Token(req.auth, vars);
+          const result = await authBuilder.fetchOAuth2Token(req.auth, vars);
           req.auth.oauth2CachedToken = result.accessToken;
           req.auth.oauth2TokenExpiry = result.expiresAt;
         }
       }
-      const authHeaders = await buildAuthHeaders(req.auth, vars);
-      const apiKeyParam = await buildApiKeyParam(req.auth, vars);
+      const authHeaders = await authBuilder.buildAuthHeaders(req.auth, vars);
+      const apiKeyParam = await authBuilder.buildApiKeyParam(req.auth, vars);
       let finalUrl = resolvedUrl;
       if (apiKeyParam) {
         const sep = finalUrl.includes("?") ? "&" : "?";
@@ -1063,7 +749,7 @@ function registerRequestHandler(ipc) {
         const h = new undici.Headers();
         for (const header of req.headers) {
           if (header.enabled && header.key) {
-            h.set(interpolate(header.key, vars), interpolate(header.value, vars));
+            h.set(authBuilder.interpolate(header.key, vars), authBuilder.interpolate(header.value, vars));
           }
         }
         for (const [k, v] of Object.entries(authHeaders)) h.set(k, v);
@@ -1071,18 +757,18 @@ function registerRequestHandler(ipc) {
       };
       let body;
       if (req.body.mode === "json" && req.body.json) {
-        body = interpolate(req.body.json, vars);
+        body = authBuilder.interpolate(req.body.json, vars);
       } else if (req.body.mode === "form" && req.body.form) {
-        body = req.body.form.filter((p) => p.enabled && p.key).map((p) => `${encodeURIComponent(interpolate(p.key, vars))}=${encodeURIComponent(interpolate(p.value, vars))}`).join("&");
+        body = req.body.form.filter((p) => p.enabled && p.key).map((p) => `${encodeURIComponent(authBuilder.interpolate(p.key, vars))}=${encodeURIComponent(authBuilder.interpolate(p.value, vars))}`).join("&");
       } else if (req.body.mode === "raw" && req.body.raw) {
-        body = interpolate(req.body.raw, vars);
+        body = authBuilder.interpolate(req.body.raw, vars);
       } else if (req.body.mode === "graphql" && req.body.graphql) {
         const gql = req.body.graphql;
-        const gqlBody = { query: interpolate(gql.query, vars) };
+        const gqlBody = { query: authBuilder.interpolate(gql.query, vars) };
         const rawVars = gql.variables?.trim();
         if (rawVars) {
           try {
-            gqlBody.variables = JSON.parse(interpolate(rawVars, vars));
+            gqlBody.variables = JSON.parse(authBuilder.interpolate(rawVars, vars));
           } catch {
           }
         }
@@ -1090,7 +776,7 @@ function registerRequestHandler(ipc) {
         body = JSON.stringify(gqlBody);
       } else if (req.body.mode === "soap" && req.body.soap) {
         const soap = req.body.soap;
-        body = interpolate(soap.envelope, vars);
+        body = authBuilder.interpolate(soap.envelope, vars);
       }
       const methodHasBody = !["GET", "HEAD"].includes(req.method);
       const doFetch = async (overrideHeaders) => {
@@ -1120,7 +806,7 @@ function registerRequestHandler(ipc) {
       };
       let fetchResp;
       if (req.auth.type === "ntlm") {
-        await performNtlmRequest(finalUrl, req.method, req.auth, vars);
+        await authBuilder.performNtlmRequest(finalUrl, req.method, req.auth, vars);
         fetchResp = await doFetch();
       } else if (req.auth.type === "digest") {
         const probeFetch = async (url, init) => {
@@ -1129,7 +815,7 @@ function registerRequestHandler(ipc) {
             dispatcher
           });
         };
-        const digestHeader = await performDigestAuth(finalUrl, req.method, req.auth, vars, probeFetch);
+        const digestHeader = await authBuilder.performDigestAuth(finalUrl, req.method, req.auth, vars, probeFetch);
         const h = buildHeaders();
         if (digestHeader) h.set("Authorization", digestHeader);
         fetchResp = await doFetch(h);
@@ -1176,7 +862,7 @@ function registerRequestHandler(ipc) {
     let postConsole = [];
     let postError;
     if (req.postRequestScript?.trim() && !response.error) {
-      const result = await runScript(interpolate(req.postRequestScript, vars), {
+      const result = await runScript(authBuilder.interpolate(req.postRequestScript, vars), {
         envVars: { ...updatedEnvVars },
         collectionVars: { ...updatedCollectionVars },
         globals: { ...updatedGlobals },
@@ -1291,29 +977,17 @@ function resolveInheritedAuthAndHeaders(requestId, collection) {
   }
   return { auth: inheritedAuth, headers: inheritedHeaders };
 }
-exports.buildAuthHeaders = buildAuthHeaders;
 exports.buildDispatcher = buildDispatcher;
-exports.buildDynamicVars = buildDynamicVars;
-exports.buildEnvVars = buildEnvVars;
 exports.buildSchemaTestResults = buildSchemaTestResults;
-exports.buildUrl = buildUrl;
 exports.collectTagged = collectTagged;
-exports.fetchOAuth2Token = fetchOAuth2Token;
 exports.getAllApplicableHooks = getAllApplicableHooks;
 exports.getGlobals = getGlobals;
-exports.getSecret = getSecret;
-exports.initSecretStore = initSecretStore;
-exports.interpolate = interpolate;
 exports.loadGlobals = loadGlobals;
 exports.maskHeaders = maskHeaders;
 exports.maskPii = maskPii;
-exports.mergeVars = mergeVars;
 exports.patchGlobals = patchGlobals;
-exports.performDigestAuth = performDigestAuth;
-exports.performNtlmRequest = performNtlmRequest;
 exports.persistGlobals = persistGlobals;
 exports.registerRequestHandler = registerRequestHandler;
-exports.registerSecretHandlers = registerSecretHandlers;
 exports.resolveInheritedAuthAndHeaders = resolveInheritedAuthAndHeaders;
 exports.runScript = runScript;
 exports.setGlobals = setGlobals;