postman-runtime 7.41.1 → 7.42.0

package/lib/requester/core.js

@@ -456,6 +456,7 @@ module.exports = {
         options.agents = defaultOpts.agents;
         options.extraCA = defaultOpts.extendedRootCA;
         options.ignoreProxyEnvironmentVariables = defaultOpts.ignoreProxyEnvironmentVariables;
+        options.agentIdleTimeout = defaultOpts.agentIdleTimeout;
 
         // Disable encoding of URL in postman-request in order to use pre-encoded URL object returned from
         // toNodeUrl() function of postman-url-encoder

package/lib/requester/requester-pool.js

@@ -25,6 +25,7 @@ RequesterPool = function (options, callback) {
         strictSSL: _.get(options, 'requester.strictSSL'),
         maxResponseSize: _.get(options, 'requester.maxResponseSize'),
         protocolVersion: _.get(options, 'requester.protocolVersion'),
+        agentIdleTimeout: _.get(options, 'requester.agentIdleTimeout', 60 * 1000), // 60 seconds
         // @todo drop support in v8
         useWhatWGUrlParser: _.get(options, 'requester.useWhatWGUrlParser', false),
         insecureHTTPParser: _.get(options, 'requester.insecureHTTPParser'),

package/lib/runner/extensions/event.command.js

@@ -21,6 +21,8 @@ var _ = require('lodash'),
     EXECUTION_COOKIES_EVENT_BASE = 'execution.cookies.',
     EXECUTION_SKIP_REQUEST_EVENT_BASE = 'execution.skipRequest.',
 
+    EXECUTION_VAULT_BASE = 'execution.vault.',
+
     COOKIES_EVENT_STORE_ACTION = 'store',
     COOKIE_STORE_PUT_METHOD = 'putCookie',
     COOKIE_STORE_UPDATE_METHOD = 'updateCookie',
@@ -240,8 +242,17 @@ module.exports = {
 
                 packageResolver = _.get(this, 'options.script.packageResolver'),
 
+                vaultSecrets = payload.context.vaultSecrets,
+                allowVaultAccess = _.get(vaultSecrets, '_.allowScriptAccess'),
+
                 events;
 
+            // Explicitly enable tracking for vault secrets here as this will
+            // not be sent to sandbox who otherwise takes care of mutation tracking
+            if (allowVaultAccess) {
+                vaultSecrets.enableTracking({ autoCompact: true });
+            }
+
             // @todo: find a better place to code this so that event is not aware of such options
             if (abortOnFailure) {
                 abortOnError = true;
@@ -387,6 +398,22 @@ module.exports = {
                         }
                     }.bind(this));
 
+                this.host.on(EXECUTION_VAULT_BASE + executionId, function (id, cmd, ...args) {
+                    // Ensure error is string
+                    // TODO identify why error objects are not being serialized correctly
+                    const dispatch = (e, r) => { this.host.dispatch(EXECUTION_VAULT_BASE + executionId, id, e, r); };
+
+                    if (!allowVaultAccess) {
+                        return dispatch('Vault access denied');
+                    }
+
+                    if (!['get', 'set', 'unset'].includes(cmd)) {
+                        return dispatch(`Invalid vault command: ${cmd}`);
+                    }
+
+                    dispatch(null, vaultSecrets[cmd](...args));
+                }.bind(this));
+
                 this.host.on(EXECUTION_REQUEST_EVENT_BASE + executionId,
                     function (scriptCursor, id, requestId, request) {
                         // remove files in request body if any
@@ -458,11 +485,7 @@ module.exports = {
                             // @todo: Expose this as a property in Collection SDK's Script
                             timeout: payload.scriptTimeout,
                             cursor: scriptCursor,
-                            context: {
-                                ..._.pick(payload.context, SAFE_CONTEXT_VARIABLES),
-                                vaultSecrets: _.get(payload.context.vaultSecrets, '_.allowScriptAccess') ?
-                                    payload.context.vaultSecrets : undefined
-                            },
+                            context: _.pick(payload.context, SAFE_CONTEXT_VARIABLES),
                             resolvedPackages: resolvedPackages,
 
                             // legacy options
@@ -479,6 +502,7 @@ module.exports = {
                             this.host.removeAllListeners(EXECUTION_COOKIES_EVENT_BASE + executionId);
                             this.host.removeAllListeners(EXECUTION_ERROR_EVENT_BASE + executionId);
                             this.host.removeAllListeners(EXECUTION_SKIP_REQUEST_EVENT_BASE + executionId);
+                            this.host.removeAllListeners(EXECUTION_VAULT_BASE + executionId);
 
                             // Handle async errors as well.
                             // If there was an error running the script itself, that takes precedence
@@ -529,10 +553,16 @@ module.exports = {
                             result && result.globals && (result.globals = new sdk.VariableScope(result.globals));
                             result && result.collectionVariables &&
                                 (result.collectionVariables = new sdk.VariableScope(result.collectionVariables));
-                            result && result.vaultSecrets &&
-                                (result.vaultSecrets = new sdk.VariableScope(result.vaultSecrets));
                             result && result.request && (result.request = new sdk.Request(result.request));
 
+                            // vault secrets are not sent to sandbox, thus using the scope from run context.
+                            if (allowVaultAccess && vaultSecrets) {
+                                result.vaultSecrets = vaultSecrets;
+
+                                // Prevent mutations from being carry-forwarded to subsequent events
+                                vaultSecrets.disableTracking();
+                            }
+
                             // @note Since postman-sandbox@3.5.2, response object is not included in the execution
                             // result.
                             // Refer: https://github.com/postmanlabs/postman-sandbox/pull/512

package/lib/runner/extensions/item.command.js

@@ -152,7 +152,8 @@ module.exports = {
                     item: item,
                     coords: coords,
                     context: ctxTemplate,
-                    trackContext: ['globals', 'environment', 'collectionVariables', 'vaultSecrets'],
+                    // No need to include vaultSecrets here as runtime takes care of tracking internally
+                    trackContext: ['globals', 'environment', 'collectionVariables'],
                     stopOnScriptError: stopOnError,
                     stopOnFailure: stopOnFailure
                 }).done(function (prereqExecutions, prereqExecutionError, shouldSkipExecution) {
@@ -234,7 +235,8 @@ module.exports = {
                             item: item,
                             coords: coords,
                             context: ctxTemplate,
-                            trackContext: ['tests', 'globals', 'environment', 'collectionVariables', 'vaultSecrets'],
+                            // No need to include vaultSecrets here as runtime takes care of tracking internally
+                            trackContext: ['tests', 'globals', 'environment', 'collectionVariables'],
                             stopOnScriptError: stopOnError,
                             abortOnFailure: abortOnFailure,
                             stopOnFailure: stopOnFailure

package/lib/runner/extensions/waterfall.command.js

@@ -80,7 +80,8 @@ module.exports = {
             new VariableScope(state.vaultSecrets);
         state.collectionVariables = VariableScope.isVariableScope(state.collectionVariables) ?
             state.collectionVariables : new VariableScope(state.collectionVariables);
-        state._variables = new VariableScope();
+        state._variables = VariableScope.isVariableScope(state.localVariables) ?
+            state.localVariables : new VariableScope(state.localVariables);
 
         // prepare the vault variable scope
         prepareVaultVariableScope(state.vaultSecrets);

package/lib/runner/index.js

@@ -121,6 +121,7 @@ _.assign(Runner.prototype, {
                 vaultSecrets: options.vaultSecrets,
                 // @todo Move to item level to support Item and ItemGroup variables
                 collectionVariables: collection.variables,
+                localVariables: options.localVariables,
                 certificates: options.certificates,
                 proxies: options.proxies
             }, runOptions)));

package/lib/runner/run.js

@@ -157,6 +157,9 @@ _.assign(Run.prototype, {
 
         // if there is nothing to process, exit
         if (!instruction) {
+            // dispose the host before ending the run
+            this.host && this.host.dispose();
+
             callback(null, this.state.cursor.current());
 
             return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "postman-runtime",
-  "version": "7.41.1",
+  "version": "7.42.0",
   "description": "Underlying library of executing Postman Collections",
   "author": "Postman Inc.",
   "license": "Apache-2.0",
@@ -55,8 +55,8 @@
     "node-oauth1": "1.3.0",
     "performance-now": "2.1.0",
     "postman-collection": "4.5.0",
-    "postman-request": "2.88.1-postman.38",
-    "postman-sandbox": "5.1.1",
+    "postman-request": "2.88.1-postman.40",
+    "postman-sandbox": "5.1.2",
     "postman-url-encoder": "3.0.5",
     "serialised-error": "1.1.3",
     "strip-json-comments": "3.1.1",