postman-runtime 7.45.0 → 7.46.0

package/lib/authorizer/digest.js

@@ -136,13 +136,33 @@ _extractField = function (string, regexp) {
  * there can be more than one header with the same key. So need to loop over and check each one.
  *
  * @param {VariableList} headers -
+ * @param {String} selectedAlgorithm - The user opted algorithm (MD5, SHA-256 etc)
  * @private
  */
-function _getDigestAuthHeader (headers) {
-    return headers.find(function (property) {
+function _getDigestAuthHeader (headers, selectedAlgorithm) {
+    const digestAuthHeaders = headers.filter(function (property) {
         return (property.key.toLowerCase() === WWW_AUTHENTICATE) &&
         (_.startsWith(String(property.value).toLowerCase(), DIGEST_PREFIX.toLowerCase()));
     });
+
+    let headerWithMatchingOptedAlgorithm;
+
+    if (selectedAlgorithm) {
+        const targetAlgorithm = selectedAlgorithm.toLowerCase();
+
+        headerWithMatchingOptedAlgorithm = digestAuthHeaders.find(function (header) {
+            const headerValue = String(header.value).toLowerCase();
+
+            if (!headerValue.includes('algorithm=')) {
+                // This is an MD5 header. Ref: https://datatracker.ietf.org/doc/html/rfc7616
+                return targetAlgorithm === 'md5';
+            }
+
+            return headerValue.includes(`algorithm=${targetAlgorithm}`);
+        });
+    }
+
+    return headerWithMatchingOptedAlgorithm || digestAuthHeaders[0];
 }
 
 /**
@@ -314,6 +334,7 @@ module.exports = {
 
         var code,
             nonceCount,
+            algorithm,
             realm,
             nonce,
             qop,
@@ -323,7 +344,9 @@ module.exports = {
 
         code = response.code;
         nonceCount = auth.get('nonceCount');
-        authHeader = _getDigestAuthHeader(response.headers);
+        algorithm = auth.get('algorithm');
+
+        authHeader = _getDigestAuthHeader(response.headers, algorithm);
 
         // If code is forbidden or unauthorized, and an auth header exists,
         // we can extract the realm & the nonce, and replay the request.

package/lib/requester/requester.js

@@ -471,7 +471,7 @@ class Requester extends EventEmitter {
                 header: responseHeaders,
                 stream: resBody,
                 responseTime: responseTime,
-                downloadedBytes: history.execution.data[0].response.downloadedBytes
+                downloadedBytes: history.execution.data.at(-1).response.downloadedBytes
             });
 
             onComplete(RESPONSE_END, response, history);

package/lib/runner/extensions/event.command.js

@@ -15,7 +15,9 @@ var _ = require('lodash'),
         'request', 'response'],
 
     EXECUTION_REQUEST_EVENT_BASE = 'execution.request.',
+    EXECUTION_RUN_REQUEST_EVENT_BASE = 'execution.run_collection_request.',
     EXECUTION_RESPONSE_EVENT_BASE = 'execution.response.',
+    EXECUTION_RUN_REQUEST_RESPONSE_EVENT_BASE = 'execution.run_collection_request_response.',
     EXECUTION_ASSERTION_EVENT_BASE = 'execution.assertion.',
     EXECUTION_ERROR_EVENT_BASE = 'execution.error.',
     EXECUTION_COOKIES_EVENT_BASE = 'execution.cookies.',
@@ -32,6 +34,8 @@ var _ = require('lodash'),
     REQUEST_BODY_MODE_FILE = 'file',
     REQUEST_BODY_MODE_FORMDATA = 'formdata',
 
+    runNestedRequest = require('../nested-request'),
+
     getCookieDomain, // fn
     postProcessContext, // fn
     sanitizeFiles; // fn
@@ -287,17 +291,26 @@ module.exports = {
                     assertionFailed = [],
                     asyncScriptError,
 
+                    isNestedRequest = this.state.nestedRequest !== undefined,
+
+                    rootItemId = isNestedRequest ? this.state.nestedRequest.rootItemId : item.id,
+
                     // create copy of cursor so we don't leak script ids outside `event.command`
                     // and across scripts
-                    scriptCursor = _.clone(cursor);
+
+                    // in the case of nested requests, we want to make sure any exceptions, consoles etc
+                    // are tagged to the parent request's scripts
+                    scriptCursor = _.clone(isNestedRequest ? this.state.nestedRequest.rootCursor : cursor);
 
                 // store the execution id in script
                 script._lastExecutionId = executionId; // please don't use it anywhere else!
 
-                // if we can find an id on script or event we add them to the cursor
-                // so logs and errors can be traced back to the script they came from
-                event.id && (scriptCursor.eventId = event.id);
-                event.script.id && (scriptCursor.scriptId = event.script.id);
+                if (!isNestedRequest) {
+                    // if we can find an id on script or event we add them to the cursor
+                    // so logs and errors can be traced back to the script they came from
+                    event.id && (scriptCursor.eventId = event.id);
+                    event.script.id && (scriptCursor.scriptId = event.script.id);
+                }
 
                 // trigger the "beforeScript" callback
                 this.triggers.beforeScript(null, scriptCursor, script, event, item);
@@ -394,11 +407,20 @@ module.exports = {
                         }
                     }.bind(this));
 
+                // Explicitly enable tracking for vault secrets here as this will
+                // not be sent to sandbox who otherwise takes care of mutation tracking
+                // This is important especially when dealing with nested requests, without this, the parent req might
+                // not have a pm.vault.<cmd> call and thus no mutations would bubble up and apply to the parent
+                if (vaultSecrets && vaultSecrets.enableTracking) {
+                    vaultSecrets.enableTracking({ autoCompact: true });
+                }
+
                 this.host.on(EXECUTION_VAULT_BASE + executionId, async function (id, cmd, ...args) {
                     if (hasVaultAccess === undefined) {
                         try {
                             // eslint-disable-next-line require-atomic-updates
-                            hasVaultAccess = Boolean(await vaultSecrets?._?.allowScriptAccess(item.id));
+                            hasVaultAccess = Boolean(this.state.nestedRequest?.hasVaultAccess ||
+                                await vaultSecrets?._?.allowScriptAccess(rootItemId));
                         }
                         catch (_) {
                             // eslint-disable-next-line require-atomic-updates
@@ -406,6 +428,10 @@ module.exports = {
                         }
                     }
 
+                    if (isNestedRequest) {
+                        this.state.nestedRequest.hasVaultAccess = hasVaultAccess;
+                    }
+
                     // Ensure error is string
                     // TODO identify why error objects are not being serialized correctly
                     const dispatch = (e, r) => { this.host.dispatch(EXECUTION_VAULT_BASE + executionId, id, e, r); };
@@ -418,10 +444,6 @@ module.exports = {
                         return dispatch(`Invalid vault command: ${cmd}`);
                     }
 
-                    // Explicitly enable tracking for vault secrets here as this will
-                    // not be sent to sandbox who otherwise takes care of mutation tracking
-                    vaultSecrets.enableTracking({ autoCompact: true });
-
                     dispatch(null, vaultSecrets[cmd](...args));
                 }.bind(this));
 
@@ -480,6 +502,9 @@ module.exports = {
                         }.bind(this));
                     }.bind(this));
 
+                this.host.on(EXECUTION_RUN_REQUEST_EVENT_BASE + executionId,
+                    runNestedRequest({ executionId, isExecutionSkipped, vaultSecrets, item }).bind(this));
+
                 this.host.on(EXECUTION_SKIP_REQUEST_EVENT_BASE + executionId, function () {
                     skippedExecutions.add(executionId);
                     shouldSkipExecution = true;
@@ -499,6 +524,9 @@ module.exports = {
                             context: _.pick(payload.context, SAFE_CONTEXT_VARIABLES),
                             resolvedPackages: resolvedPackages,
 
+                            disabledAPIs: !_.get(this, 'options.script.requestResolver') ?
+                                ['execution.runRequest'] : [],
+
                             // legacy options
                             legacy: {
                                 _itemId: item.id,
@@ -510,6 +538,7 @@ module.exports = {
                             this.host.removeAllListeners(EXECUTION_REQUEST_EVENT_BASE + executionId);
                             this.host.removeAllListeners(EXECUTION_ASSERTION_EVENT_BASE + executionId);
                             this.host.removeAllListeners(EXECUTION_RESPONSE_EVENT_BASE + executionId);
+                            this.host.removeAllListeners(EXECUTION_RUN_REQUEST_RESPONSE_EVENT_BASE + executionId);
                             this.host.removeAllListeners(EXECUTION_COOKIES_EVENT_BASE + executionId);
                             this.host.removeAllListeners(EXECUTION_ERROR_EVENT_BASE + executionId);
                             this.host.removeAllListeners(EXECUTION_SKIP_REQUEST_EVENT_BASE + executionId);
@@ -567,11 +596,13 @@ module.exports = {
                             result && result.request && (result.request = new sdk.Request(result.request));
 
                             // vault secrets are not sent to sandbox, thus using the scope from run context.
-                            if (hasVaultAccess && vaultSecrets) {
-                                result.vaultSecrets = vaultSecrets;
-
+                            if (vaultSecrets) {
                                 // Prevent mutations from being carry-forwarded to subsequent events
                                 vaultSecrets.disableTracking();
+
+                                if (hasVaultAccess || this.state.nestedRequest?.hasVaultAccess) {
+                                    result.vaultSecrets = vaultSecrets;
+                                }
                             }
 
                             // @note Since postman-sandbox@3.5.2, response object is not included in the execution
@@ -598,6 +629,12 @@ module.exports = {
                             // now that this script is done executing, we trigger the event and move to the next script
                             this.triggers.script(err || null, scriptCursor, result, script, event, item);
 
+                            if (!isNestedRequest) {
+                                // Reset for next invocation if there are subsequent executions of items in a single
+                                // runner via `iterationCount` or multiple `items` passed to a collection.
+                                delete this.state.nestedRequest;
+                            }
+
                             // move to next script and pass on the results for accumulation
                             done(((stopOnScriptError || abortOnError || stopOnFailure) && err) ? err : null, _.assign({
                                 event,

package/lib/runner/extensions/waterfall.command.js

@@ -127,7 +127,9 @@ module.exports = {
             // we procure the coordinates that we have to pick item and data from. the data is
             var coords = payload.static ? payload.coords : this.waterfall.whatnext(payload.coords),
                 item = this.state.items[coords.position],
-                delay;
+                delay,
+                isNestedRequest = this.state.nestedRequest !== undefined,
+                rootRequestCursor = isNestedRequest ? this.state.nestedRequest.rootCursor : coords;
 
             // if there is nothing to process, we bail out from here, even before we enter the iteration cycle
             if (coords.empty) {
@@ -165,7 +167,8 @@ module.exports = {
                 this.queue('item', {
                     item: item,
                     coords: coords,
-                    data: getIterationData(this.state.data, coords.iteration),
+                    data: getIterationData(this.state.data,
+                        isNestedRequest ? rootRequestCursor.iteration : coords.iteration),
                     environment: this.state.environment,
                     globals: this.state.globals,
                     vaultSecrets: this.state.vaultSecrets,

package/lib/runner/index.js

@@ -42,6 +42,9 @@ _.assign(Runner.prototype, {
         var runOptions = _.merge(_.omit(options,
             ['environment', 'globals', 'vaultSecrets', 'data']), this.options.run) || {};
 
+        // Ensure we have a default value for max invokable nested requests
+        !runOptions.maxInvokableNestedRequests && (runOptions.maxInvokableNestedRequests = 5);
+
         // start timeout sanitization
         !runOptions.timeout && (runOptions.timeout = {});
 
@@ -66,6 +69,24 @@ _.assign(Runner.prototype, {
      * @param {Object} [options.globals] -
      * @param {Object} [options.environment] -
      * @param {Object} [options.vaultSecrets] - Vault Secrets
+     * @param {Object} [options.nestedRequest] - State and options used for nested request set by parent request
+     * @param {Number} [options.nestedRequest.rootCursor] - The cursor of the root request that spun up this
+     * nested request runner. This is recursively passed down to keep track of which execution started the chain
+     * and modify cursors for all nested req events for reporters built on top of postman-runtime.
+     * @param {Number} [options.nestedRequest.rootItemId] - The id of the root item that spawned this nested request.
+     * Used by vault to get consent for root request and determine whether vault access check was performed even once
+     * throughout the chain.
+     * @param {Number} [options.nestedRequest.hasVaultAccess] - Mutated and set by any nested or parent request
+     * to indicate whether vault access check has been performed.
+     * @param {Number} [options.nestedRequest.invocationCount] - The number of requests currently accummulated
+     * by the nested request chain.
+     * @param {Object} [options.requester] - Options specific to the requester
+     * @param {Function} [options.script.requestResolver] - Resolver that receives an id from
+     * pm.execution.runRequest and returns the JSON for the request collection.
+     * Should return a postman-collection compatible collection JSON with `item` containing the request to run,
+     * `variable` array containing list of request-specific-collection variables and `event` with scripts to execute.
+     * @param {Number} [options.maxInvokableNestedRequests] - The maximum number of nested requests
+     * that a script can invoke, combined in total and recursively nested
      * @param {Number} [options.iterationCount] -
      * @param {CertificateList} [options.certificates] -
      * @param {ProxyConfigList} [options.proxies] -
@@ -119,6 +140,8 @@ _.assign(Runner.prototype, {
                 environment: options.environment,
                 globals: _.has(options, 'globals') ? options.globals : self.options.globals,
                 vaultSecrets: options.vaultSecrets,
+                // Used for nested request executions
+                nestedRequest: options.nestedRequest,
                 // @todo Move to item level to support Item and ItemGroup variables
                 collectionVariables: collection.variables,
                 localVariables: options.localVariables,

package/lib/runner/nested-request.js

@@ -0,0 +1,197 @@
+const _ = require('lodash'),
+    sdk = require('postman-collection'),
+    serialisedError = require('serialised-error'),
+
+    SYNCABLE_CONTEXT_VARIABLE_SCOPES = ['_variables', 'collectionVariables', 'environment', 'globals'],
+    EXECUTION_RUN_REQUEST_RESPONSE_EVENT_BASE = 'execution.run_collection_request_response.';
+
+function runNestedRequest ({ executionId, isExecutionSkipped, vaultSecrets, item }) {
+    // Note: Don't forget to bind this function to the runner to make sure `this` can give you the right options & state
+    return function (cursor, eventId, requestId, requestToRunId, runRequestOptions = {}, runContext = {}) {
+        const self = this,
+            requestResolver = _.get(self, 'options.script.requestResolver'),
+            runRequestRespEvent = EXECUTION_RUN_REQUEST_RESPONSE_EVENT_BASE + eventId,
+            maxInvokableNestedRequests = _.get(self, 'options.maxInvokableNestedRequests');
+
+        function dispatchErrorToListener (err) {
+            const error = serialisedError(err);
+
+            delete error.stack;
+
+            return self.host.dispatch(EXECUTION_RUN_REQUEST_RESPONSE_EVENT_BASE + eventId,
+                requestId, error);
+        }
+
+        // Prepare nested request object for passing down to child request
+        // Have to keep object reference common so any changes made by nested executions is bubbled back to parent exec
+        self.state.nestedRequest = _.defaults(self.state.nestedRequest || {}, {
+            isNestedRequest: true,
+            rootCursor: cursor,
+            rootItemId: item.id,
+            invocationCount: 0
+        });
+
+        self.state.nestedRequest.invocationCount++;
+
+        // No more than maxInvokableNestedRequests runRequest calls per script or any of its nested request scripts
+        if (self.state.nestedRequest.invocationCount > maxInvokableNestedRequests) {
+            return dispatchErrorToListener(new Error('The maximum number of pm.execution.runRequest()' +
+                ' calls have been reached for this request.'));
+        }
+
+        // Should fetch the request from the consumer of postman-runtime & resolve scripts and variables
+        requestResolver(requestToRunId, function (err, collection) {
+            if (err) {
+                return dispatchErrorToListener(err);
+            }
+
+            if (!collection) {
+                return dispatchErrorToListener(new Error('Expected collection json with request item ' +
+                    'to invoke pm.execution.runRequest'));
+            }
+
+            // Prepare variables that have been set inside the parent's pre-req/post-res script
+            // so far and pass them to the runner for this request.
+            // This is important because for nested requests,
+            // variables set by the parent using pm.<variable-form>.set do not reflect
+            // in postman-runtime's scope immediately. They are present inside postman-sandbox
+            // till the parent request's script execution ends.
+            const globals = { values: runContext.globals || [] },
+                localVariables = { values: runContext._variables || [] },
+                environment = { values: runContext.environment || [] },
+                collectionVariables = { values: runContext.collectionVariables || [] };
+
+            const runner = require('.'),
+                variableOverrides = runRequestOptions.variables ?
+                    Object.entries(runRequestOptions.variables)
+                        .map(function ([key, value]) {
+                            return { key, value };
+                        }) :
+                    [],
+                runnableRefRequestCollection = new sdk.Collection(collection),
+                mergedCollectionVariableList = new sdk.VariableList();
+
+            // Merge parent collection's variables with this collection's variables
+            // Why the separate statement? Because we want the referenced request's collection's variables to
+            // take precedence over the parent collection's variables if there are any conflicts.
+            mergedCollectionVariableList.populate(collectionVariables.values);
+            mergedCollectionVariableList.populate(runnableRefRequestCollection.variables.all());
+
+            runnableRefRequestCollection.variables = mergedCollectionVariableList;
+
+            // Merge local variables from parent requests & scope + nestedRequest.options.variables
+            localVariables.values = [...localVariables.values, ...variableOverrides];
+
+            // Why clone? Each runner execution needs to track and mutate its vault variables separately and propagate
+            // it back up and further down. We don't want to accidentally reset mutations between executions by sharing
+            // this scope
+            let clonedVaultSecrets;
+
+            if (vaultSecrets) {
+                clonedVaultSecrets = new sdk.VariableScope({
+                    values: vaultSecrets.values,
+                    prefix: vaultSecrets.prefix
+                });
+
+                clonedVaultSecrets._ = vaultSecrets._;
+            }
+
+            new runner().run(runnableRefRequestCollection,
+                {
+                    ...self.state,
+                    ...self.options,
+                    entrypoint: {
+                        lookupStrategy: 'idOrName',
+                        execute: requestToRunId
+                    },
+                    iterationCount: 1,
+                    globals: globals,
+                    environment: environment,
+                    localVariables: localVariables,
+                    vaultSecrets: clonedVaultSecrets,
+                    abortOnFailure: true,
+                    host: {
+                        // Reuse current run's sandbox host across nested executions
+                        external: true,
+                        instance: self.host
+                    }
+                },
+                function (err, run) {
+                    let exceptionForThisRequest = null,
+                        responseForThisRequest = null,
+                        variableMutationsFromThisExecution = {};
+
+                    if (err) {
+                        return self.host
+                            .dispatch(EXECUTION_RUN_REQUEST_RESPONSE_EVENT_BASE + eventId,
+                                requestId, err);
+                    }
+                    run.start({
+                        script (_err, _cursor, result) {
+                            // This is to sync changes to pm.variables, pm.environment & pm.globals
+                            // that happened inside the nested request's script
+                            // back to parent request's scripts still currently executing.
+
+                            // collectionVariables don't need to be synced between parent and nested
+
+                            // All other global variables defined by syntax like 'a=1'
+                            // are anyway synced as the sandbox's common scope is shared across runs
+                            if (result) {
+                                SYNCABLE_CONTEXT_VARIABLE_SCOPES.forEach(function (type) {
+                                    if (!result[type]) {
+                                        return;
+                                    }
+
+                                    variableMutationsFromThisExecution[type] = [
+                                        ...(variableMutationsFromThisExecution[type] || []),
+                                        result[type].mutations
+                                    ];
+                                });
+
+                                if (clonedVaultSecrets && clonedVaultSecrets.mutations) {
+                                    const mutations = new sdk.MutationTracker(clonedVaultSecrets.mutations);
+
+                                    mutations.applyOn(vaultSecrets);
+                                }
+                            }
+                        },
+                        exception (_, err) {
+                            if (err) {
+                                exceptionForThisRequest = err;
+                            }
+                        },
+                        response (err, _, response) {
+                            if (isExecutionSkipped(executionId)) {
+                                responseForThisRequest = null;
+                                exceptionForThisRequest = null;
+
+                                return;
+                            }
+
+                            if (err) {
+                                exceptionForThisRequest = err;
+                            }
+                            if (response) {
+                                responseForThisRequest = response;
+                            }
+                        },
+                        done (err) {
+                            let error = err || exceptionForThisRequest;
+
+                            if (error) {
+                                error = serialisedError(error);
+                                delete error.stack;
+                            }
+
+                            return self.host.dispatch(runRequestRespEvent,
+                                requestId, error || null,
+                                responseForThisRequest,
+                                { variableMutations: variableMutationsFromThisExecution });
+                        }
+                    });
+                });
+        });
+    };
+}
+
+module.exports = runNestedRequest;

package/lib/runner/run.js

@@ -157,8 +157,14 @@ _.assign(Run.prototype, {
 
         // if there is nothing to process, exit
         if (!instruction) {
-            // dispose the host before ending the run
-            this.host && this.host.dispose();
+            const isNestedRequest = this.state.nestedRequest !== undefined;
+
+            // dispose the host before ending the run for the main container request
+            // - a nested request uses the parent's sandbox host, so only dispose it once the entire nested request
+            // execution chain is complete
+            if (!isNestedRequest && this.host) {
+                this.host.dispose();
+            }
 
             callback(null, this.state.cursor.current());
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "postman-runtime",
-  "version": "7.45.0",
+  "version": "7.46.0",
   "description": "Underlying library of executing Postman Collections",
   "author": "Postman Inc.",
   "license": "Apache-2.0",
@@ -54,10 +54,10 @@
     "node-forge": "1.3.1",
     "node-oauth1": "1.3.0",
     "performance-now": "2.1.0",
-    "postman-collection": "5.1.0",
+    "postman-collection": "5.1.1",
     "postman-request": "2.88.1-postman.43",
-    "postman-sandbox": "6.1.2",
-    "postman-url-encoder": "3.0.7",
+    "postman-sandbox": "6.2.0",
+    "postman-url-encoder": "3.0.8",
     "serialised-error": "1.1.3",
     "strip-json-comments": "3.1.1",
     "uuid": "8.3.2"