Bruno - Scriptmania 👩‍💻🧑‍💻

[helloanoop]

A place to showcase your scripting superpowers ⚡

Bruno offers scripting support to help you to add additional functionality to the tool such as data generation, validation and integration with other tools and systems, including sending intermediate requests, parsing response data, updating environment variables, etc.

Apart from the commonly used libraries, Bruno also supports installing any npm module to use in your scripting workflows.

Scripting is very powerful and can be used to extend the functionality of Bruno in many ways.
Let's use this space to showcase novel and interesting that you have used scripting in Bruno.

This will help others to learn and get inspired to use scripting in their own workflows.

Let the hacking begin!

[helloanoop]

Basic Auth

Bruno already supports GUI to configure Basic Auth in v0.19.0 onwards, sharing this pre-request script that our early adopters used to still make this work before GUI support arrived.

const username = "bruno";
const password = "della";

const authString = `${username}:${password}`;
const encodedAuthString = require('btoa')(authString);

req.setHeader("Authorization", `Basic ${encodedAuthString}`);

[helloanoop]

File Uploads

Bruno v0.19.0 onwards - allows fs access inside scripts. You need to enable this inside bruno.json

{
  "version": "1",
  "name": "bruno-testbench",
  "type": "collection",
  "scripts": {
    "filesystemAccess": {
      "allow": true
    }
  }
}

And the use this in your pre-request scripts

const fs = require('fs');
const path = require('path');

const attachmentFilename = "debug-data.bin";
const attachmentPath = path.join(bru.cwd(), attachmentFilename);
const attachment = fs.readFileSync(attachmentPath, "base64");
const attachmentLength = attachment.length;

req.setHeader("Content-Type", "application/octet-stream");
req.setHeader("Content-Disposition", `attachment; filename="${attachmentFilename}"`);
req.setHeader("Content-Length", attachmentLength);

req.setBody(attachment);

Script Credit: @Rzpeg - #306

[dwiyatci]

Lovely! ♡ This makes it possible for me to send a request to an endpoint that needs both JWT and client cert in my (collection) pre-request script (e.g. for creating a session) by reading the cert/key pair from my local disk:

async function createSession() {
  console.log('create session...');

  const clientCertBaseDir = '/Users/Glenn/my-project/certs';
  const cert = fs.readFileSync(`${clientCertBaseDir}/cert.pem`);
  console.log('cert:', cert.toString('utf8'));
  const key = fs.readFileSync(`${clientCertBaseDir}/key.pem`);
  console.log('key:', key.toString('utf8'));

  const sessionInitUrl = bru.getEnvVar('sessionInitUrl');
  const jwt = bru.getEnvVar('jwt');

  const { data } = await axios.post(
    sessionInitUrl,
    { lang: 'en' },
    {
      headers: { 'content-type': 'application/json', Authorization: `Bearer ${jwt}` },
      httpsAgent: new https.Agent({ cert, key, rejectUnauthorized: false }),
    },
  );
  console.log('session data:', data);

  bru.setEnvVar('sessionId', data.sessionId);
  bru.setVar('sessionExpirationTimestamp', moment().add(data.sessionTimeout, 's').valueOf());
}

[Rzpeg]

XPath parsing

You can use XPath to query XML data. Install 2 packages in the collection folder:
npm i xpath xmldom

Then you can use the following snippet to work with XML responses:

const xpath = require('xpath');
const dom = require('xmldom').DOMParser;

const doc = new dom().parseFromString(res.body, 'text/xml');
const query = "//*[local-name()='AuthToken']/text()";
const token = xpath.select(query, doc)[0].nodeValue;

bru.setVar("token", token);

[helloanoop]

Cookies

In your login api post-response-script

const cookies = res.getHeader('set-cookie');

if(cookies) {
  bru.setVar("cookie", cookies.join('; '));
}

In your subsequent requests pre-request-script

const cookie = bru.getVar("cookie");

if(cookie) {
  req.setHeader("Cookie", cookie)
}

Cookie support will arrive soon in Bruno by default. Until then, please use this workaround.

[Tanja-4732]

I'll work on cookies in my fork since you seem to be working on auto-save.

I hope to have some progress by the end of the week; will (hopefully) open a draft-PR until then

[Tanja-4732]

@helloanoop I've already started implementing this; there's now a working PR: see #969

I've yet to implement editing/deleting the cookies tho.

[srikary12]

Thanks @Tanja-4732 for raising the PR. Great work. I couldn't work in the last few weeks due to some personal things. I will be getting back next week :).

[Tanja-4732]

@srikary12 thanks for your appreciation ☺️✨

But I believe that my PR is rather, well, dead, considering that the original creator/lead developer of Bruno just implemented this feature.

I also assumed, that we'd want a collection-wide cookie store, but the lead dev wants it to be apo-wide.

So I don't think my work's going anywhere but the graveyard of state PRs.

---

I didn't think that this feature would be implemented so soon after I began my efforts, but I'm glad that this issue is finally, at least mostly resolved.

[GimpMaster]

It would be great if Bruno showed the cookies that were being sent. It seems to send them but there is no UI showing what was sent.

[pove]

Call a service for every json file in a folder

const axios = require('axios');
const fs = require('fs');
const path = require('path');
const url = bru.getEnvVar("base_url")+'/addpayload/';
const assets = path.join(bru.cwd(), "assets\\jsonfiles");

var files = fs.readdirSync(assets);
var filecontent;

for(const file of files)
{
  filecontent= fs.readFileSync(path.join(assets, file));
  await axios.post(url, JSON.parse(filecontent));
}

[codemonkey33]

A variation to loop through a Json Array from a single file
This gets the url from the current request instead of environment: https://postman-echo.com/get?foo={{bar}}

Json array (looper.json) looks like

[
    { "bar":"sheep1" },
    { "bar":"sheep2" }
]

Script

const axios = require('axios');
const https = require('https');
var url;

const assets = require('./assets/looper.json');
console.log(assets);

for(let i = 0; i < assets.length; i++) {
  let obj = assets[i];
  url = req.url.replace('{{bar}}', obj.bar);
  let preres = await axios.get(url, { httpsAgent: new https.Agent({rejectUnauthorized: false })});
  console.log(preres.data.args.foo);
}

Will be building on this to make a rudimentary file based runner

[mirkogolze]

Using a script for logging in to OAuth2 server and setting the Bearer-Token to the header. Use the script in pre-request scripts.

Folder structure:

|-- myRequest
|   |-- AnyRequest.bru
|-- bruno.json
|-- environments
|   |-- myEnvironment.bru
|-- package-lock.json
|-- package.json
`-- tools
    |-- tools.js

tools.js

const axios = require('axios');
const moment = require('moment');

const tools = {

  log: function(str) {
    let now = moment().format('YYYY-MM-DDTHH:mm:ss.SSS');
    console.log(now + ' ' + str);
  },

  setAuth: function(tokenKey = 'mapperToken') {
    req.setHeader('Authorization', 'Bearer ' + bru.getVar(tokenKey));
    this.log("set Token to Authheader");
  },

  login: async function(tokenUrlKey = 'tokenUrl', clientIdKey = 'clientId', clientSecretKey = 'clientSecret', tokenKey = 'token') {

    let now = moment();
    let collectionVarnameForExpiryTime = 'tokenExpiry_ForToken_' + tokenKey + '_FromURL_' + bru.getEnvVar(tokenUrlKey);
    let expiryTime = !!bru.getVar(collectionVarnameForExpiryTime) ? moment(bru.getVar(collectionVarnameForExpiryTime)) : now;
    let difference = expiryTime.diff(now, 'milliseconds');
    this.log('Token expires in milliseconds: ' + difference);

    let tokenUrl = bru.getEnvVar(tokenUrlKey);
    let clientId = bru.getEnvVar(clientIdKey);
    let clientSecret = bru.getEnvVar(clientSecretKey);

    // if expiring within 10 seconds
    if (difference < 10000 || !bru.getVar(collectionVarnameForExpiryTime) || !bru.getVar('activeToken') || bru.getVar('activeToken') != (clientId + '_' + tokenUrl) ) {
      this.log('Old token belongs to different environment or old token expired, requesting new one...');
      try {

        let resp = await axios({
          method: 'POST',
          url: tokenUrl,
          headers: {
            "Accept": "application/json",
            "Content-Type": "application/x-www-form-urlencoded"
          },
          data: {
            "grant_type": "client_credentials",
            "client_id": encodeURIComponent(clientId),
            "client_secret": encodeURIComponent(clientSecret)
          }
        });
        bru.setVar(tokenKey, resp.data.access_token);
        bru.setVar(collectionVarnameForExpiryTime, moment().add(resp.data.expires_in, 'seconds').format());
        bru.setVar('activeToken', clientId + '_' + tokenUrl);
        this.log('new token set.');

      } catch (error) {
        this.log('login error: ' + error.message);
        console.error(error);
        throw error;
      }
    }
    this.setAuth(tokenKey);
  }
}

module.exports = tools;

Now you can use the defined method in every request. E.G. in pre-requests-scripts. So everytime the token is checked and if it is expired, a new token is requested and stored to the collection variables.

const tools = require('./tools/tools');
await tools.login();

[nickheniser]

oof, i should have realized this. Thanks!

Another question, it would be nice to have the tools directory outside of the collection folder, one level up so many different collections could make use of the same functionality. When I tried this it seems bruno can't find the file.

const tools = require('../tools/tools');

Does anyone know why?

[mirkogolze]

The pre/post request scripts are running in an isolated sandbox (https://www.npmjs.com/package/vm2). For security and isolation only code from inside the collection is allowed.
Another way could be to create a private git repository for the tools and use it as dependency. See https://docs.npmjs.com/cli/v10/configuring-npm/package-json#urls-as-dependencies

[helloanoop]

it would be nice to have the tools directory outside of the collection folder, one level up so many different collections could make use of the same functionality.

You bet :)

@nickheniser @mirkogolze We recently added support for additionalContextRoots. This hasn't made to the documentation yet. Will add it there soon.

{
  "version": "1",
  "name": "payments-api",
  "type": "collection",
  "scripts": {
    "additionalContextRoots": [
      "../scripts"
    ]
  }
}

Checkout #438 and #795

[Frankenleg]

It appears the additionalContextRoots is working for the pre-request script, but not the post-response. My pre-request runs fine with the referenced script, but the post-request gives the following error: Cannot find the module: '../scripts/oauth'

When moving the scripts folder down into the collection, both scripts run fine.
``

[tlaloc911]

@Frankenleg, it doesnt work in post response. It is an unmerged PR that solves this #1397

[helloanoop]

The much awaited collection level scripting is now available in v0.22.0 🚀🚀

[karl-gustav]

How can we use this to auto run the request that gets the accessToken? Do we just need to do it programmatically? Or even better is there a possibility to set a request as a prerequisite to another request? In Insomnia we can set that an env variable is a body property of another request and a expire time for when the request needs to be run again.

[mirkogolze]

Currently there is no way to set dependent requests or run a special request via script. But you could use scripting for checking if the token is expired and request a new one.
E.G. #385 (comment).
You can do the scripting in collection level pre-request-scripts, so you don't need custom scripts.

And feel free to formulate a new feature request as issue or in Discord.

[eferro70]

Upload a PDF file

Pre Request script

const fs = require("fs");
const path = require("path");
const FormData = require("form-data");

const cwd = bru.cwd();
const url = bru.getEnvVar("host") + "/api/controlador/documentos";
const attachmentFilename = "doc.pdf";
const attachmentPath = path.join(cwd,'relative/path/to/doc.pdf');
const attachment = fs.readFileSync(attachmentPath);

const formData = new FormData();
formData.append('doc', attachment, { filename: attachmentFilename }); 

req.setBody(formData);

bruno.json

{
  "version": "1",
  "name": "my_collection",
  "type": "collection",
  "scripts": {
    "moduleWhitelist": ["form-data"],
    "filesystemAccess": {
      "allow": true
    }
  }
}

package.json

{
  "name": "my_collection",
  "version": "1.0.0",
  "main": "index.js",
  "dependencies": {
    "form-data": "^4.0.0"
  }
}

Important: run npm install to install extenal package 'form-data'

[jaybhanushali3195]

I get the following error when trying to pass zip file

Error invoking remote method 'send-http-request': VMError: Operation not allowed on contextified object.

This is my script

const fs = require('fs');
const path = require('path');
const FormData = require("form-data");
console.log("hello")
const attachmentFilename = "current_request.bin";
const attachmentPath = path.join(bru.cwd(), attachmentFilename);
const attachment = fs.readFileSync(attachmentPath, "base64");
// const attachmentLength = attachment.length;

const formData = new FormData();
formData.append('doc', attachment, { filename: attachmentFilename }); 
req.setHeader("Content-Type", "application/octet-stream");
req.setHeader("Content-Encoding", "gzip");

req.setBody(formData);

bruno.json

{
    "version": "1",
    "name": "JayTrial",
    "type": "collection",
    "moduleWhitelist": ["form-data"],
    "scripts": {
        "filesystemAccess": {
            "allow": true
        }
    }
}

package.json

{
  "name": "JayTrial",
  "version": "1.0.0",
  "main": "index.js",
  "dependencies": {
    "form-data": "^4.0.0"
  }
}

Any idea how to solve ?

[shawna-donnelly]

Not sure if this is it, but comparing your bruno.json file to the original, your moduleWhitelist is not inside of scripts, like it is in the example.

[kovacsdongo]

and where we have to store the file in the system?

[helloanoop]

Logging

In case you'd like to keep. track of request and responses.
You need to create a folder called logs inside your collection root folder

bruno.json

{
  "version": "1",
  "name": "my_collection",
  "type": "collection",
  "scripts": {
    "filesystemAccess": {
      "allow": true
    }
  }
}

Collection Level Post response script

const fs = require('fs');
const path = require('path');
const moment = require('moment');

const safeStringify = function (obj) {
  try {
    return JSON.stringify(obj, null, 2);
  } catch (err) {
    return obj
  }
};

const request = {
  url: req.getUrl(),
  headers: req.getHeaders(),
  method: req.getMethod(),
  body: req.getBody()
};

const response = {
  status: res.getStatus(),
  headers: res.getHeaders(),
  body: res.getBody()
};

const now = moment();
const formattedDate = now.format('YYYYMMDD-HHmmss');
const filename = path.join(bru.cwd(), 'logs', `${formattedDate}.json`);
const content = safeStringify({request, response}, null, 2);

fs.writeFileSync(filename, content);

[helloanoop]

Different User Tokens Across Different Envs

Folder Structure

|-- folder
|   |-- auth.bru
|   |-- request.bru
|-- bruno.json
|-- environments
|   |-- dev.bru
|   |-- qa.bru
|-- token-store.js

token-store.js

class TokenStore {
  constructor() {
    this.tokens = {
      dev: null,
      qa: null,
      prod: null
    }
  }

  saveToken(token, env) {
    this.tokens[env] = token;
  }

  populateTokenInRequest(req, env) {
    const token = `Bearer ${this.tokens[env]}`;

    req.setHeader('Authorization', token);
  }
}

return new TokenStore();

Inside your auth post-response script

const tokenStore = require('./token-store');

const body = res.getBody();
const token = body.access_token;

tokenStore.saveToken(token, bru.getEnvName());

Inside your collection level pre-request script

const tokenStore = require('./token-store');

tokenStore.populateTokenInRequest(req, bru.getEnvName());

[CoenraadS]

Automatic Request Chaining to resolve var usages

The following is a setup that will analyze a requests url for any {{}} usages, then search which request in the collection should provide this var if it's not currently set.

bruno.json

{
  "version": "1",
  "name": "Example",
  "type": "collection",
  "scripts": {
    "filesystemAccess": {
      "allow": true
    }
  }
}

Collection.bru

script:pre-request {
  console.log("ResolveVariables.js being called from Collection Pre-Request (see collection.bru)")
  require("./ResolveVariables.js")
}

ResolveVariables.js

// Shoutout to ChatGPT for helping me with regex

const fs = require('fs');
const path = require('path');

const pattern = /\{\{([^\{\}]+)\}\}/g; // Match text between '{{' and '}}'.

/** @type {Map<String, String>} */
let varRequestMap = null;

let match;
while ((match = pattern.exec(req.url)) !== null) {
    const varKey = match[1];
    const varValue = bru.getVar(varKey);

    if (varValue) {
        console.log(varKey + ": " + varValue);
    }
    else {
        console.log(varKey + " is not defined.");
        if (!varRequestMap) {
            varRequestMap = BuildDependencyMap();
        }

        const dependsOnRequest = varRequestMap.get(varKey);
        if (dependsOnRequest) {
            console.log("Enqueuing: " + dependsOnRequest)
            bru.setNextRequest(dependsOnRequest)
        }
        else {
            console.log("Could not determine which request should provide: " + varKey)
        }
    }
}

function BuildDependencyMap() {
    const varRequestMap = new Map();
    console.log("Building dependency map")

    const directoryPath = bru.cwd();

    const files = fs.readdirSync(directoryPath);
    const bruFiles = files.filter(file => path.extname(file) === '.bru' && path.basename(file) !== "collection.bru");

    const setVarPattern = /bru\.setVar\(['"]([^'"]+)['"]/g; // Match all first parameters of bru.SetVar, in double or single quotes
    const namePattern = /name:\s*([^\n\r]+)/;
    bruFiles.forEach(file => {
        const filePath = path.join(directoryPath, file);

        const data = fs.readFileSync(filePath, 'utf8');
        console.log(`Analyzing ${file}`);
        const name = data.match(namePattern)[1];
        console.log("Name: " + name);
        const matches = [...data.matchAll(setVarPattern)];
        const parameters = matches.map(match => match[1]);
        if (parameters.length > 0) {
            console.log(`${file} provides the following vars:`)
            console.log(parameters)
            parameters.forEach(parameter => varRequestMap.set(parameter, name));
        }
    });

    return varRequestMap;
}

[daniavander]

hello guys

I wrote a pre request script:

`if (!bru.getEnvVar("ACCESS_TOKEN") || Date.now() >= bru.getEnvVar("ACCESS_TOKEN_EXPIRES"))
{
    req.setMethod({
        url: 'https://login.microsoftonline.com/' + bru.getEnvVar("AZURE_TENANT_ID") + '/oauth2/v2.0/token',
        method: 'POST',
        header: 'Content-Type: multipart/form-data',
        body: {
            mode: 'formdata',
            formdata: [ 
                {key: "grant_type", value: "client_credentials", disabled: false},
                {key: "client_id", value: bru.getEnvVar("AZURE_CLIENT_ID"), disabled: false},
                {key: "client_secret", value: bru.getEnvVar("AZURE_CLIENT_SECRET"), disabled: false},
                {key: "scope", value: bru.getVar("AZURE_TARGET_SCOPE"), disabled: false},
            ]
        }
    }, function (err, res) {
        if (err)
        {
            console.log(err);
        }
        else
        {
            let json = res.json();
            bru.setVar("ACCESS_TOKEN", json.access_token);
            bru.setVar("ACCESS_TOKEN_EXPIRES", Date.now() + json.expires_in * 1000);
        }
    });
}`

I use environment variable

but i get an error:
Error invoking remote method 'send-http-request': TypeError: (config.method || this.defaults.method || "get").toLowerCase is not a function

What does this error mean? And have anybody an idea to solve i?

thanks

[daniavander]

I write to this format:

const axios = require('axios');

const tokenUrl = 'https://login.microsoftonline.com/' + bru.getEnvVar('AZURE_TENANT_ID') + '/oauth2/v2.0/token';
const clientId = bru.getEnvVar('AZURE_CLIENT_ID');
const clientSecret = bru.getEnvVar('AZURE_CLIENT_SECRET');
const scope = bru.getEnvVar('AZURE_TARGET_SCOPE');


try {
    let resp = await axios({
        method: 'POST',
        url: tokenUrl,
        headers: {
            'Content-Type': 'multipart/form-data',
        },
        data: {
            grant_type: 'client_credentials',
            client_id: clientId,
            client_secret: clientSecret,
            scope: scope
        },
    });

    bru.setVar('ACCESS_TOKEN2', resp.data.access_token);
    bru.setVar('activeToken', clientId + '_' + tokenUrl);
} catch (error) {
    throw error;
}

but i get : Error invoking remote method 'send-http-request': AxiosError: Request failed with status code 400

i would like to login to azure ad webapp with bearer token

It is working in postman, but i can not make it to the correct form to bruno

[mirkogolze]

Did you try that out with an normal request configured at the UI? When it is working as normal request. It should be possible to do with scripts too. Do you have any proxy configuration? Looks not so.

[daniavander]

It will work with simple get
v1: simple - set auth to bearer, and copy token from webapp console network tab

v2: pre csript - in my pre script request i set the auth to bearer token: {{ACCESS_TOKEN}}
my scope: api://ó..../.default

in postman i can login with this credentials

[daniavander]

Can i sendRequest without axios?

[daniavander]

i did it finally:
const axios = require('axios');

const tokenUrl = 'https://login.microsoftonline.com/' + bru.getEnvVar('AZURE_TENANT_ID') + '/oauth2/v2.0/token';
const clientId = bru.getEnvVar('AZURE_CLIENT_ID');
const clientSecret = bru.getEnvVar('AZURE_CLIENT_SECRET');
const scope = bru.getEnvVar('AZURE_TARGET_SCOPE');

const axiosInstance = axios.create({
baseURL: tokenUrl,
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
});

const data = {
grant_type: 'client_credentials',
client_id: clientId,
client_secret: clientSecret,
scope: scope,
};

axiosInstance.post('', data)
.then(response => {
const accessToken = response.data.access_token;
console.log('Authentication successful!');
console.log('Access token:', accessToken);

// Use the access token for subsequent API requests

bru.setEnvVar('ACCESS_TOKEN', accessToken);
})
.catch(error => {
console.error('Authentication failed:', error);
});

[tsteckenborn]

Attached is another variant for OAuth2 Client Credentials handling in the collection.

YouTube Video explaining it:

Coding:

const axios = require('axios');
const btoa = require('btoa');
const moment = require('moment');

const calculateTokenExpiryInMilliseconds = (tokenExpiryVarName) => {
  const currentTime = moment()
  const expiryTime = moment(bru.getVar(tokenExpiryVarName)) || currentTime
  return expiryTime.diff(currentTime, 'milliseconds')
}

const authenticateClient = async (config) => {
  const {
    tokenEndpointVarName,
    clientIdVarName,
    clientSecretVarName,
    bearerTokenVarName
  } = config;

  if (!bearerTokenVarName) {
    throw new Error('Missing environment variable name for storing the bearer token');
  }

  const expiryDifferenceInMilliseconds = calculateTokenExpiryInMilliseconds(`expiryFor_${bearerTokenVarName}`)

  const oneMinuteInMilliseconds = 60000

  if (expiryDifferenceInMilliseconds >= oneMinuteInMilliseconds &&
    bru.getVar('lastRequestedEnvironmentName') === bru.getEnvName()) {
    console.log('Taking already existing token.')
    return
  }
  console.log('Requesting new token.')

  const envVariables = {
    [tokenEndpointVarName]: bru.getEnvVar(tokenEndpointVarName),
    [clientIdVarName]: bru.getEnvVar(clientIdVarName),
    [clientSecretVarName]: bru.getEnvVar(clientSecretVarName)
  }

  const missingVariables = Object.entries(envVariables).filter(([key, value]) => !value).map(([key]) => key)

  if (missingVariables.length > 0) {
    throw new Error(`Missing required environment variables: ${missingVariables.join(', ')}`)
  }

  try {
    const tokenData = (await axios.post(envVariables[tokenEndpointVarName], { grant_type: "client_credentials" }, { headers: { "Authorization": `Basic ${btoa(`${envVariables[clientIdVarName]}:${envVariables[clientSecretVarName]}`)}`, "Content-Type": "application/x-www-form-urlencoded" } })).data

    bru.setVar(bearerTokenVarName, tokenData.access_token)
    bru.setVar(`expiryFor_${bearerTokenVarName}`, moment().add(tokenData.expires_in, 'seconds').format())
    bru.setVar('lastRequestedEnvironmentName', bru.getEnvName())

  } catch (error) {
    throw error
  }

}

await authenticateClient({
  tokenEndpointVarName: 'tokenUrl',
  clientIdVarName: 'clientId',
  clientSecretVarName: 'clientSecret',
  bearerTokenVarName: 'bearerToken2'
})

[tsteckenborn]

Attached is a variant for OAuth2 Authorization Code handling in the collection.

YouTube Video explaining it:

Coding:

const axios = require('axios');
const btoa = require('btoa');
const moment = require('moment');

const calculateTokenExpiryMilliseconds = (tokenExpiryVarName) => {
    const currentTime = moment();
    const expiryTime = moment(bru.getVar(tokenExpiryVarName)) || currentTime;
    return expiryTime.diff(currentTime, 'milliseconds');
};

const exchangeAuthorizationCodeForToken = async (clientId, clientSecret, tokenEndpoint, authorizationCode, redirectUri) => {
    const response = await axios.post(tokenEndpoint, {
        grant_type: 'authorization_code',
        code: authorizationCode,
        redirect_uri: redirectUri
    }, {
        headers: {
            "Authorization": `Basic ${btoa(`${clientId}:${clientSecret}`)}`,
            "Content-Type": "application/x-www-form-urlencoded"
        }
    });
    return response.data;
};

const storeTokenAndExpiry = (tokenData, tokenVarName) => {
    bru.setVar(tokenVarName, tokenData.access_token);
    bru.setVar(`expiryFor_${tokenVarName}`, moment().add(tokenData.expires_in, 'seconds').format());
    console.log('New token stored successfully.');
};

const authenticateClient = async (config) => {

    const {
        tokenEndpointVarName,
        authorizeEndpointVarName,
        clientIdVarName,
        clientSecretVarName,
        bearerTokenVarName,
        authorizationCodeVarName,
        redirectUriVarName
    } = config;

    const expiryDifferenceMs = calculateTokenExpiryMilliseconds(`expiryFor_${bearerTokenVarName}`);

    const oneMinuteInMilliseconds = 60000;

    if (expiryDifferenceMs >= oneMinuteInMilliseconds && bru.getVar(`lastRequestedEnvironmentName`) === bru.getEnvName()) {
        console.log(`Token in variable ${bearerTokenVarName} is still valid.`);
        return;
    }

    const envVariables = {
        [tokenEndpointVarName]: bru.getEnvVar(tokenEndpointVarName),
        [authorizeEndpointVarName]: bru.getEnvVar(authorizeEndpointVarName),
        [clientIdVarName]: bru.getEnvVar(clientIdVarName),
        [clientSecretVarName]: bru.getEnvVar(clientSecretVarName),
        [redirectUriVarName]: bru.getEnvVar(redirectUriVarName),
    };

    const missingVariables = Object.entries(envVariables)
        .filter(([key, value]) => !value)
        .map(([key]) => key);

    if (missingVariables.length > 0) {
        throw new Error(`Missing required environment variables: ${missingVariables.join(', ')}. Please ensure these variables are correctly set in your environment.`);
    }

    const authorizationCode = bru.getEnvVar(authorizationCodeVarName);
    const authorizationCodeUrl = `${envVariables[authorizeEndpointVarName]}?client_id=${envVariables[clientIdVarName]}&response_type=code&redirect_uri=${envVariables[redirectUriVarName]}`;

    if (!authorizationCode) {
        throw new Error(`No authorization code provided. Navigate to the url ${authorizationCodeUrl} and grab the code from the URL.`);
    }

    try {
        const tokenData = await exchangeAuthorizationCodeForToken(
            envVariables[clientIdVarName],
            envVariables[clientSecretVarName],
            envVariables[tokenEndpointVarName],
            authorizationCode,
            envVariables[redirectUriVarName]
        );
        storeTokenAndExpiry(tokenData, bearerTokenVarName);
        bru.setVar(`lastRequestedEnvironmentName`, bru.getEnvName());
    } catch (error) {
        throw new Error(`Error: It seems like on of the input values is incorrect. Most probably the authorization code is invalid. Try to grab a new one from ${authorizationCodeUrl} and store it as part of the environment variable ${authorizationCodeVarName}. The original error is: ${error}`);
    }


}

await authenticateClient({
    tokenEndpointVarName: 'tokenUrl',
    authorizeEndpointVarName: 'authorizeUrl',
    clientIdVarName: 'clientId',
    clientSecretVarName: 'clientSecret',
    bearerTokenVarName: 'bearerToken',
    authorizationCodeVarName: 'authorizationCode',
    redirectUriVarName: 'redirectUri'
});

[Wingjam]

AWS Cognito Auth

A small implementation of AWS Cognito allowing you to fetch the JWT Token automatically and inject the token in the Authorization header based on insomnia-plugin-aws-cognito-token

Folder structure

|-- folder
|   |-- request.bru
|-- bruno.json
|-- environments
|   |-- dev.bru
|   |-- prod.bru
|-- cognito-auth.js

Coding

cognito-auth.js

const fetch = require('node-fetch')

const username = bru.getEnvVar('username')
const password = bru.getEnvVar('password')

const auth = {
  login: async function () {
    const baseUrl = bru.getEnvVar('base-url')
    const cognitoInfosResponse = await fetch(`${baseUrl}/infos`)
    const { CognitoRegion, CognitoAppClientID } = await cognitoInfosResponse.json()

    const requestBody = {
      AuthFlow: 'USER_PASSWORD_AUTH',
      ClientId: CognitoAppClientID,
      AuthParameters: {
        USERNAME: username,
        PASSWORD: password,
      },
    }

    const request = {
      method: 'post',
      headers: {
        'content-type': 'application/x-amz-json-1.1',
        'x-amz-target': 'AWSCognitoIdentityProviderService.InitiateAuth',
      },
      body: JSON.stringify(requestBody),
    }

    const authResponse = await fetch(`https://cognito-idp.${CognitoRegion}.amazonaws.com`, request)
    const { AuthenticationResult } = await authResponse.json()
    const token = AuthenticationResult.IdToken
    req.setHeader('Authorization', `Bearer ${token}`)
  },
}

module.exports = auth

Inside your pre-request script:

const auth = require('./cognito-auth');
await auth.login();

Next Steps

• Implement caching and refetch token only when expired
• Error handling
• Make it more generic

[KaiElwood]

Do you know if there's a way to make this work with "SRP_AUTH" as opposed to just "USER_PASSWORD_AUTH"? Thanks!

[Wingjam]

As far as I know, the easiest would be to use amazon-cognito-identity-js from AWS Amplify.

i.e.

const AmazonCognitoIdentity = require('amazon-cognito-identity-js');

var authenticationData = {
	Username: 'username',
	Password: 'password',
};
var authenticationDetails = new AmazonCognitoIdentity.AuthenticationDetails(
	authenticationData
);
var poolData = {
	UserPoolId: '...', // Your user pool id here
	ClientId: '...', // Your client id here
};
var userPool = new AmazonCognitoIdentity.CognitoUserPool(poolData);
var userData = {
	Username: 'username',
	Pool: userPool,
};
var cognitoUser = new AmazonCognitoIdentity.CognitoUser(userData);
cognitoUser.authenticateUser(authenticationDetails, {
	onSuccess: function(result) {
		var accessToken = result.getAccessToken().getJwtToken();
                // ...
	},

	onFailure: function(err) {
		alert(err.message || JSON.stringify(err));
	},
});

[codemonkey33]

Simple Loop iteration over a single request

Pre Request

if(bru.getVar("iteration") === undefined){
  console.log("iteration is undefined setting to 0");
  bru.setVar("iteration", 0);
}
console.log("current iteration is " + bru.getVar("iteration"));

Post Response

if(bru.getVar("iteration") < bru.getVar("iterations") -1){
  bru.setVar("iteration", bru.getVar("iteration") + 1);
  bru.setNextRequest("Testloop");
}
console.log("next iteration is " + bru.getVar("iteration"));

Output

iteration is undefined setting to 0
current iteration is 0
Testloop (200 OK) - 629 ms
next iteration is 1
current iteration is 1
Testloop (200 OK) - 537 ms
next iteration is 2
current iteration is 2
Testloop (200 OK) - 515 ms
next iteration is 2

Requires 1.4 onward for bru.setNextRequest()

[shawna-donnelly]

Is there a way to be able to use the package jsonwebtoken? Every other library I have installed has worked well, but I need to sign some information prior to sending it to an api, but if I include jsonwebtoken, I get the error Error invoking remote method 'send-http-request': VMError: Operation not allowed on contextified object. Any idea what I am doing wrong, or is this just not possible?

[drs9222]

Did you figure out if this is possible?

[eklinger-UofA]

I see a similar problem when using the 'jose' package, trying to work around jsonwebtoken not working but this alternative is running into similar problems.

[orached]

I have the same issue for cose-js library

[masewo]

I had the same issue with the package jsonwebtoken. Then I tried the next best optionaccording to jwt.io: jsrsasign.

Here a small example, because the API is different:

First install the package jsrsasign:

npm install jsrsasign

Then write your pre request script to sign a JWT:

const axios = require("axios");
const rs = require("jsrsasign");

const now = Math.floor(Date.now() / 1000);
if (now < bru.getVar("expiresAt")) {
    return;
}

const privateKey = bru.getProcessEnv("PRIVATE_KEY");

// this might not be necessary for you because I just have a very weird saved private key
const keyDetails = JSON.parse(Buffer.from(privateKey, "base64").toString("utf-8"));
const key = keyDetails.key; // <-- key in PEM here

const jwtToSign = {
    iss: keyDetails.userId,
    sub: keyDetails.userId,
    aud: "https://jwt.io",
    iat: Math.floor(Date.now() / 1000),
    exp: Math.floor(Date.now() / 1000) + 3600,
}

const options = {
    algorithm: "RS256",
    header: {
        alg: "RS256",
        kid: keyDetails.keyId
    }
};

const prvKey = rs.KEYUTIL.getKey(key);
const assertion = rs.jws.JWS.sign(options.algorithm, options.header, jwtToSign, prvKey);

const response = await axios.post("https://jwt.io/oauth/v2/token",
    {
        grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
        scope: "openid profile email",
        assertion: assertion,
    }, {
        headers: {
            "Content-Type": "application/x-www-form-urlencoded",
        }
    })

const expiresAt = Math.floor(Date.now() / 1000) + response.data.expires_in;
bru.setVar("accessToken", response.data.access_token);
bru.setVar("expiresAt", expiresAt);

Good luck! 🍀

[VictorioBerra]

@tsteckenborn @masewo Is there a way to upload custom auth variants? Or is that just a different way of phrasing "pre request" script for the collection/request?

[masewo]

@VictorioBerra Which custom auth variants are you trying to add? As far as I know you cannot integrate them into the UI without building your own version of Bruno. But a lot is solveable by writing custom pre requests scripts.

[VictorioBerra]

Yeah I wanted it in the UI, or rather outside of collections. Since now every collection I want to use OAuth2 Client Creds the spec-compliant way #1987

[d-mok-pvt]

Hey. I'am looking for a way to dynamically generate parameters for my requests.

ive made project level libs directory with class (had to install faker as external lib)
fake.js

const { faker } = require('@faker-js/faker');
const { v4: uuidv4 } = require('uuid');

function fakeUUids(count) {
    let uuids = [];
    for (let i = 1; i <= count; i++) {
      uuids.push(uuidv4());
    }
    return uuids;
}

function fakeNames(count) {
    let names = [];
    for (let i = 0; i < count; i++) {
        names.push(faker.person.firstName());
    }
    return names;
}

function fakeLastNames(count) {
    let lastNames = [];
    for (let i = 0; i < count; i++) {
        lastNames.push(faker.person.lastName());
    }
    return lastNames;
}

function fakePhones(count, mask) {
    let phones = [];
    for (let i = 0; i < count; i++) {
        phones.push(faker.phone.number(mask));
    }
    return phones;
}

module.exports = {
    fakeUUids,
    fakeNames,
    fakeLastNames,
    fakePhones
}

Modified collections bruno.json with

  "scripts": {
    "additionalContextRoots": [
      "../libs"
    ]
  }

Added to collection pre request script

const {fakeUUids} = require('../libs/fake');
const {fakeNames} = require('../libs/fake');
const {fakePhones} = require('../libs/fake');

const uuids = fakeUUids(3);
uuids.forEach((uuid, i) => bru.setVar(`fakeUuid${i}`, uuid));

const names = fakeNames(2);
names.forEach((name, i) => bru.setVar(`fakeName${i}`, name));

const phones = fakePhones(3, '+998#######');
phones.forEach((phone, i) => bru.setVar(`fakePhone${i}`, phone));

And can now access them in query/body parameters like {{fakeUuid1}}, {{fakeName0}}. Often I need more than one value.
If you have better options to do this, ur welcome