feat: Using global private environment to save secrets[INS-4715]

packages/insomnia-sdk/src/objects/environments.ts

@@ -122,3 +122,38 @@ export class Variables {
         return this.localVars.toObject();
     };
 }
+
+export class Vault extends Environment {
+
+    constructor(name: string, jsonObject: object | undefined, enableVaultInScripts: boolean) {
+        super(name, jsonObject);
+        return new Proxy(this, {
+            // throw error on get or set method call if enableVaultInScripts is false
+            get: (target, prop, receiver) => {
+                if (!enableVaultInScripts) {
+                    throw new Error('Vault is disabled in script');
+                }
+                return Reflect.get(target, prop, receiver);
+            },
+            set: (target, prop, value, receiver) => {
+                if (!enableVaultInScripts) {
+                    throw new Error('Vault is disabled in script');
+                }
+                return Reflect.set(target, prop, value, receiver);
+            },
+        });
+    }
+
+    unset = () => {
+        throw new Error('Vault can not be unset in script');
+    };
+
+    clear = () => {
+        throw new Error('Vault can not be cleared in script');
+    };
+
+    set = () => {
+        throw new Error('Vault can not be set in script');
+    };
+
+}

packages/insomnia-sdk/src/objects/insomnia.ts

@@ -6,7 +6,7 @@ import { filterClientCertificates } from 'insomnia/src/network/certificate';
 
 import { toPreRequestAuth } from './auth';
 import { CookieObject } from './cookies';
-import { Environment, Variables } from './environments';
+import { Environment, Variables, Vault } from './environments';
 import { Execution } from './execution';
 import type { RequestContext } from './interfaces';
 import { transformToSdkProxyOptions } from './proxy-configs';
@@ -28,6 +28,7 @@ export class InsomniaObject {
     public info: RequestInfo;
     public response?: ScriptResponse;
     public execution: Execution;
+    public vault?: Vault;
 
     private clientCertificates: ClientCertificate[];
     private _expect = expect;
@@ -55,6 +56,7 @@ export class InsomniaObject {
             requestInfo: RequestInfo;
             execution: Execution;
             response?: ScriptResponse;
+            vault?: Vault;
         },
     ) {
         this.globals = rawObj.globals;
@@ -66,6 +68,7 @@ export class InsomniaObject {
         this.cookies = rawObj.cookies;
         this.response = rawObj.response;
         this.execution = rawObj.execution;
+        this.vault = rawObj.vault;
 
         this.info = rawObj.requestInfo;
         this.request = rawObj.request;
@@ -150,6 +153,9 @@ export async function initInsomniaObject(
         new Environment(rawObj.iterationData.name, rawObj.iterationData.data) : new Environment('iterationData', {});
     const localVariables = rawObj.transientVariables ?
         new Environment(rawObj.transientVariables.name, rawObj.transientVariables.data) : new Environment('transientVariables', {});
+    const enableVaultInScripts = rawObj.settings?.enableVaultInScripts || false;
+    const vault = rawObj.vault ?
+        new Vault('vault', rawObj.vault, enableVaultInScripts) : new Vault('vault', {}, enableVaultInScripts);
     const cookies = new CookieObject(rawObj.cookieJar);
     // TODO: update follows when post-request script and iterationData are introduced
     const requestInfo = new RequestInfo({
@@ -233,6 +239,7 @@ export async function initInsomniaObject(
         environment,
         baseEnvironment,
         iterationData,
+        vault,
         variables,
         request,
         settings: rawObj.settings,

packages/insomnia-sdk/src/objects/interfaces.ts

@@ -18,6 +18,7 @@ export interface RequestContext {
     timelinePath: string;
     environment: IEnvironment;
     baseEnvironment: IEnvironment;
+    vault?: IEnvironment;
     collectionVariables?: object;
     globals?: object;
     iterationData?: Omit<IEnvironment, 'id'>;

packages/insomnia/package.json

@@ -93,6 +93,7 @@
     "@fortawesome/free-solid-svg-icons": "^6.5.2",
     "@fortawesome/react-fontawesome": "^0.2.0",
     "@getinsomnia/api-client": "0.0.4",
+    "@getinsomnia/srp-js": "1.0.0-alpha.1",
     "@sentry/electron": "^5.1.0",
     "@stoplight/spectral-core": "^1.18.3",
     "@stoplight/spectral-formats": "^1.6.0",

packages/insomnia/src/account/session.ts

@@ -192,6 +192,8 @@ async function _unsetSessionData() {
     symmetricKey: {} as JsonWebKey,
     publicKey: {} as JsonWebKey,
     encPrivateKey: {} as crypt.AESMessage,
+    vaultSalt: '',
+    vaultKey: '',
   });
 }
 

packages/insomnia/src/common/export.tsx

@@ -7,7 +7,7 @@ import YAML from 'yaml';
 
 import { isApiSpec } from '../models/api-spec';
 import { isCookieJar } from '../models/cookie-jar';
-import { type Environment, isEnvironment } from '../models/environment';
+import { type Environment, isEnvironment, maskVaultEnvironmentData } from '../models/environment';
 import { isGrpcRequest } from '../models/grpc-request';
 import * as requestOperations from '../models/helpers/request-operations';
 import { type BaseModel, environment } from '../models/index';
@@ -493,7 +493,7 @@ export const exportMockServerToFile = async (workspace: Workspace) => {
   });
 };
 
-const exportGlobalEnvironment = async (workspace: Workspace, selectedFormat: 'json' | 'yaml') => {
+const exportGlobalEnvironment = async (workspace: Workspace, selectedFormat: 'json' | 'yaml', shouldExportPrivateEnvironments: boolean) => {
   const data: Insomnia4Data = {
     _type: 'export',
     __export_format: EXPORT_FORMAT,
@@ -503,11 +503,16 @@ const exportGlobalEnvironment = async (workspace: Workspace, selectedFormat: 'js
   };
 
   const baseEnvironment = await models.environment.getOrCreateForParentId(workspace._id);
-  const subEnvironments = await models.environment.findByParentId(baseEnvironment._id);
+  const subEnvironments = (await models.environment.findByParentId(baseEnvironment._id))
+    .filter(subEnv => shouldExportPrivateEnvironments || !subEnv.isPrivate);
 
   data.resources.push({ ...workspace, _type: 'workspace' });
   data.resources.push({ ...baseEnvironment, _type: 'environment' });
-  subEnvironments.map(environment => data.resources.push({ ...environment, _type: 'environment' }));
+  subEnvironments.map(environment => {
+    // mask vault environment varibale if necessary
+    const maskedEnvironment = maskVaultEnvironmentData(environment);
+    data.resources.push({ ...maskedEnvironment, _type: 'environment' });
+  });
 
   if (selectedFormat === 'yaml') {
     return YAML.stringify(data);
@@ -529,15 +534,25 @@ export const exportGlobalEnvironmentToFile = async (workspace: Workspace) => {
       invariant(selectedFormat, 'expected selected format to be defined');
       invariant(selectedFormat === 'json' || selectedFormat === 'yaml', 'unexpected selected format');
       window.localStorage.setItem('insomnia.lastExportFormat', selectedFormat);
+      // Modal to confirm whether to export private environment or not if necessary
+      const baseEnvironment = await models.environment.getOrCreateForParentId(workspace._id);
+      const subEnvironments = await models.environment.findByParentId(baseEnvironment._id);
+      const showPrivateEnvironmentPrompt = subEnvironments.some(subEnv => subEnv.isPrivate);
+      let shouldExportPrivateEnvironments = false;
+      if (showPrivateEnvironmentPrompt) {
+        shouldExportPrivateEnvironments = await showExportPrivateEnvironmentsModal();
+      }
+
       const fileName = await showSaveExportedFileDialog({
         exportedFileNamePrefix: workspace.name,
         selectedFormat,
       });
       if (!fileName) {
         return;
       }
+
       try {
-        const stringifiedExport = await exportGlobalEnvironment(workspace, selectedFormat);
+        const stringifiedExport = await exportGlobalEnvironment(workspace, selectedFormat, shouldExportPrivateEnvironments);
         writeExportedFileToFileSystem(fileName, stringifiedExport, err => err && console.warn('Export failed', err));
         window.main.trackSegmentEvent({ event: SegmentEvent.dataExport, properties: { type: selectedFormat, scope: 'environment' } });
       } catch (err) {

packages/insomnia/src/common/render.ts

@@ -18,7 +18,7 @@ import { database as db } from './database';
 
 export const KEEP_ON_ERROR = 'keep';
 export const THROW_ON_ERROR = 'throw';
-export type RenderPurpose = 'send' | 'general' | 'no-render';
+export type RenderPurpose = 'send' | 'general' | 'preview' | 'script' | 'no-render';
 export const RENDER_PURPOSE_SEND: RenderPurpose = 'send';
 export const RENDER_PURPOSE_GENERAL: RenderPurpose = 'general';
 export const RENDER_PURPOSE_NO_RENDER: RenderPurpose = 'no-render';
@@ -212,7 +212,7 @@ export async function buildRenderContext(
   }
 
   // Render the context with itself to fill in the rest.
-  const finalRenderContext = renderContext;
+  const finalRenderContext = await templatingUtils.maskOrDecryptContextIfNecessary(renderContext as Record<string, any> & BaseRenderContext);
 
   const keys = _getOrderedEnvironmentKeys(finalRenderContext);
 
@@ -372,7 +372,7 @@ interface BaseRenderContextOptions {
   ignoreUndefinedEnvVariable?: boolean;
 }
 
-interface RenderContextOptions extends BaseRenderContextOptions, Partial<RenderRequest<Request | GrpcRequest | WebSocketRequest>> {
+export interface RenderContextOptions extends BaseRenderContextOptions, Partial<RenderRequest<Request | GrpcRequest | WebSocketRequest>> {
   ancestors?: RenderContextAncestor[];
 }
 export async function getRenderContext(
@@ -533,7 +533,7 @@ export async function getRenderContext(
 interface BaseRenderContext {
   getMeta: () => {};
   getKeysContext: () => {};
-  getPurpose: () => string | undefined;
+  getPurpose: () => RenderPurpose | undefined;
   getExtraInfo: (key: string) => string | null;
   getEnvironmentId: () => string | undefined;
   getGlobalEnvironmentId: () => string | undefined;

packages/insomnia/src/common/settings.ts

@@ -145,4 +145,8 @@ export interface Settings {
   useBulkParametersEditor: boolean;
   validateAuthSSL: boolean;
   validateSSL: boolean;
+  // vault related settings
+  saveVaultKeyLocally: boolean;
+  vaultSecretCacheDuration: number;
+  enableVaultInScripts: boolean;
 }

packages/insomnia/src/main.development.ts

@@ -15,6 +15,7 @@ import { backupIfNewerVersionAvailable } from './main/backup';
 import { ipcMainOn, ipcMainOnce, registerElectronHandlers } from './main/ipc/electron';
 import { registergRPCHandlers } from './main/ipc/grpc';
 import { registerMainHandlers } from './main/ipc/main';
+import { registerSecretStorageHandlers } from './main/ipc/secretStorage';
 import { registerCurlHandlers } from './main/network/curl';
 import { registerWebSocketHandlers } from './main/network/websocket';
 import { watchProxySettings } from './main/proxy';
@@ -64,6 +65,7 @@ app.on('ready', async () => {
   registergRPCHandlers();
   registerWebSocketHandlers();
   registerCurlHandlers();
+  registerSecretStorageHandlers();
 
   /**
  * There's no option that prevents Electron from fetching spellcheck dictionaries from Chromium's CDN and passing a non-resolving URL is the only known way to prevent it from fetching.

packages/insomnia/src/main/ipc/electron.ts

@@ -28,7 +28,12 @@ export type HandleChannels =
   | 'webSocket.open'
   | 'webSocket.readyState'
   | 'writeFile'
-  | 'extractJsonFileFromPostmanDataDumpArchive';
+  | 'extractJsonFileFromPostmanDataDumpArchive'
+  | 'secretStorage.setSecret'
+  | 'secretStorage.getSecret'
+  | 'secretStorage.deleteSecret'
+  | 'secretStorage.encryptString'
+  | 'secretStorage.decryptString';
 
 export const ipcMainHandle = (
   channel: HandleChannels,
@@ -162,6 +167,7 @@ export function registerElectronHandlers() {
         .sort((a, b) => fnOrString(a.templateTag.displayName).localeCompare(fnOrString(b.templateTag.displayName)))
         .map(l => {
           const actions = l.templateTag.args?.[0];
+          const needsEnterprisePlan = l.templateTag.needsEnterprisePlan || false;
           const additionalArgs = l.templateTag.args?.slice(1);
           const hasSubmenu = actions?.options?.length;
           return {
@@ -170,16 +176,18 @@ export function registerElectronHandlers() {
               {
                 click: () => {
                   const tag = `{% ${l.templateTag.name} ${l.templateTag.args?.map(getTemplateValue).join(', ')} %}`;
-                  event.sender.send('context-menu-command', { key, tag });
+                  const displayName = l.templateTag.displayName;
+                  event.sender.send('context-menu-command', { key, tag, needsEnterprisePlan, displayName });
                 },
               } :
               {
                 submenu: actions?.options?.map(action => ({
                   label: fnOrString(action.displayName),
                   click: () => {
                     const additionalTagFields = additionalArgs.length ? ', ' + additionalArgs.map(getTemplateValue).join(', ') : '';
+                    const displayName = action.displayName;
                     const tag = `{% ${l.templateTag.name} '${action.value}'${additionalTagFields} %}`;
-                    event.sender.send('context-menu-command', { key, tag });
+                    event.sender.send('context-menu-command', { key, tag, needsEnterprisePlan, displayName });
                   },
                 })),
               }),

packages/insomnia/src/main/ipc/main.ts

@@ -17,6 +17,7 @@ import type { WebSocketBridgeAPI } from '../network/websocket';
 import { ipcMainHandle, ipcMainOn, ipcMainOnce, type RendererOnChannels } from './electron';
 import extractPostmanDataDumpHandler from './extractPostmanDataDump';
 import type { gRPCBridgeAPI } from './grpc';
+import type { secretStorageBridgeAPI } from './secretStorage';
 
 export interface RendererToMainBridgeAPI {
   loginStateChange: () => void;
@@ -37,6 +38,7 @@ export interface RendererToMainBridgeAPI {
   webSocket: WebSocketBridgeAPI;
   grpc: gRPCBridgeAPI;
   curl: CurlBridgeAPI;
+  secretStorage: secretStorageBridgeAPI;
   trackSegmentEvent: (options: { event: string; properties?: Record<string, unknown> }) => void;
   trackPageView: (options: { name: string }) => void;
   showContextMenu: (options: { key: string; nunjucksTag?: { template: string; range: MarkerRange } }) => void;