Bruno - Scriptmania 👩‍💻🧑‍💻

[helloanoop]

A place to showcase your scripting superpowers ⚡

Bruno offers scripting support to help you to add additional functionality to the tool such as data generation, validation and integration with other tools and systems, including sending intermediate requests, parsing response data, updating environment variables, etc.

Apart from the commonly used libraries, Bruno also supports installing any npm module to use in your scripting workflows.

Scripting is very powerful and can be used to extend the functionality of Bruno in many ways.
Let's use this space to showcase novel and interesting that you have used scripting in Bruno.

This will help others to learn and get inspired to use scripting in their own workflows.

Let the hacking begin!

[helloanoop]

Basic Auth

Bruno already supports GUI to configure Basic Auth in v0.19.0 onwards, sharing this pre-request script that our early adopters used to still make this work before GUI support arrived.

const username = "bruno";
const password = "della";

const authString = `${username}:${password}`;
const encodedAuthString = require('btoa')(authString);

req.setHeader("Authorization", `Basic ${encodedAuthString}`);

[helloanoop]

File Uploads

Bruno v0.19.0 onwards - allows fs access inside scripts. You need to enable this inside bruno.json

{
  "version": "1",
  "name": "bruno-testbench",
  "type": "collection",
  "scripts": {
    "filesystemAccess": {
      "allow": true
    }
  }
}

And the use this in your pre-request scripts

const fs = require('fs');
const path = require('path');

const attachmentFilename = "debug-data.bin";
const attachmentPath = path.join(bru.cwd(), attachmentFilename);
const attachment = fs.readFileSync(attachmentPath, "base64");
const attachmentLength = attachment.length;

req.setHeader("Content-Type", "application/octet-stream");
req.setHeader("Content-Disposition", `attachment; filename="${attachmentFilename}"`);
req.setHeader("Content-Length", attachmentLength);

req.setBody(attachment);

Script Credit: @Rzpeg - #306

[dwiyatci]

Lovely! ♡ This makes it possible for me to send a request to an endpoint that needs both JWT and client cert in my (collection) pre-request script (e.g. for creating a session) by reading the cert/key pair from my local disk:

async function createSession() {
  console.log('create session...');

  const clientCertBaseDir = '/Users/Glenn/my-project/certs';
  const cert = fs.readFileSync(`${clientCertBaseDir}/cert.pem`);
  console.log('cert:', cert.toString('utf8'));
  const key = fs.readFileSync(`${clientCertBaseDir}/key.pem`);
  console.log('key:', key.toString('utf8'));

  const sessionInitUrl = bru.getEnvVar('sessionInitUrl');
  const jwt = bru.getEnvVar('jwt');

  const { data } = await axios.post(
    sessionInitUrl,
    { lang: 'en' },
    {
      headers: { 'content-type': 'application/json', Authorization: `Bearer ${jwt}` },
      httpsAgent: new https.Agent({ cert, key, rejectUnauthorized: false }),
    },
  );
  console.log('session data:', data);

  bru.setEnvVar('sessionId', data.sessionId);
  bru.setVar('sessionExpirationTimestamp', moment().add(data.sessionTimeout, 's').valueOf());
}

[diabolusss]

Great snippet, thank you! It allows me to use the same request, but with different body contents, such as reading a prepared JSON body from a file. @helloanoop, it would be nice to have a flag to pass the body contents to the request from the CLI, something like bru run request.bru --data 'text written payload or path to a file' .

[Rzpeg]

XPath parsing

You can use XPath to query XML data. Install 2 packages in the collection folder:
npm i xpath xmldom

Then you can use the following snippet to work with XML responses:

const xpath = require('xpath');
const dom = require('xmldom').DOMParser;

const doc = new dom().parseFromString(res.body, 'text/xml');
const query = "//*[local-name()='AuthToken']/text()";
const token = xpath.select(query, doc)[0].nodeValue;

bru.setVar("token", token);

[helloanoop]

Cookies

In your login api post-response-script

const cookies = res.getHeader('set-cookie');

if(cookies) {
  bru.setVar("cookie", cookies.join('; '));
}

In your subsequent requests pre-request-script

const cookie = bru.getVar("cookie");

if(cookie) {
  req.setHeader("Cookie", cookie)
}

Cookie support will arrive soon in Bruno by default. Until then, please use this workaround.

[Tanja-4732]

@helloanoop I've already started implementing this; there's now a working PR: see #969

I've yet to implement editing/deleting the cookies tho.

[srikary12]

Thanks @Tanja-4732 for raising the PR. Great work. I couldn't work in the last few weeks due to some personal things. I will be getting back next week :).

[Tanja-4732]

@srikary12 thanks for your appreciation ☺️✨

But I believe that my PR is rather, well, dead, considering that the original creator/lead developer of Bruno just implemented this feature.

I also assumed, that we'd want a collection-wide cookie store, but the lead dev wants it to be apo-wide.

So I don't think my work's going anywhere but the graveyard of state PRs.

---

I didn't think that this feature would be implemented so soon after I began my efforts, but I'm glad that this issue is finally, at least mostly resolved.

[GimpMaster]

It would be great if Bruno showed the cookies that were being sent. It seems to send them but there is no UI showing what was sent.

[open2bonobo]

Create a Header KeyValue Pair: "Cookie" : "key=value;key1=value1"
without cookie:

with cookie:

But dont forget to remove already existin cookie, that could block you from oauth2 login

[pove]

Call a service for every json file in a folder

const axios = require('axios');
const fs = require('fs');
const path = require('path');
const url = bru.getEnvVar("base_url")+'/addpayload/';
const assets = path.join(bru.cwd(), "assets\\jsonfiles");

var files = fs.readdirSync(assets);
var filecontent;

for(const file of files)
{
  filecontent= fs.readFileSync(path.join(assets, file));
  await axios.post(url, JSON.parse(filecontent));
}

[codemonkey33]

A variation to loop through a Json Array from a single file
This gets the url from the current request instead of environment: https://postman-echo.com/get?foo={{bar}}

Json array (looper.json) looks like

[
    { "bar":"sheep1" },
    { "bar":"sheep2" }
]

Script

const axios = require('axios');
const https = require('https');
var url;

const assets = require('./assets/looper.json');
console.log(assets);

for(let i = 0; i < assets.length; i++) {
  let obj = assets[i];
  url = req.url.replace('{{bar}}', obj.bar);
  let preres = await axios.get(url, { httpsAgent: new https.Agent({rejectUnauthorized: false })});
  console.log(preres.data.args.foo);
}

Will be building on this to make a rudimentary file based runner

[mirkogolze]

Using a script for logging in to OAuth2 server and setting the Bearer-Token to the header. Use the script in pre-request scripts.

Folder structure:

|-- myRequest
|   |-- AnyRequest.bru
|-- bruno.json
|-- environments
|   |-- myEnvironment.bru
|-- package-lock.json
|-- package.json
`-- tools
    |-- tools.js

tools.js

const axios = require('axios');
const moment = require('moment');

const tools = {

  log: function(str) {
    let now = moment().format('YYYY-MM-DDTHH:mm:ss.SSS');
    console.log(now + ' ' + str);
  },

  setAuth: function(tokenKey = 'mapperToken') {
    req.setHeader('Authorization', 'Bearer ' + bru.getVar(tokenKey));
    this.log("set Token to Authheader");
  },

  login: async function(tokenUrlKey = 'tokenUrl', clientIdKey = 'clientId', clientSecretKey = 'clientSecret', tokenKey = 'token') {

    let now = moment();
    let collectionVarnameForExpiryTime = 'tokenExpiry_ForToken_' + tokenKey + '_FromURL_' + bru.getEnvVar(tokenUrlKey);
    let expiryTime = !!bru.getVar(collectionVarnameForExpiryTime) ? moment(bru.getVar(collectionVarnameForExpiryTime)) : now;
    let difference = expiryTime.diff(now, 'milliseconds');
    this.log('Token expires in milliseconds: ' + difference);

    let tokenUrl = bru.getEnvVar(tokenUrlKey);
    let clientId = bru.getEnvVar(clientIdKey);
    let clientSecret = bru.getEnvVar(clientSecretKey);

    // if expiring within 10 seconds
    if (difference < 10000 || !bru.getVar(collectionVarnameForExpiryTime) || !bru.getVar('activeToken') || bru.getVar('activeToken') != (clientId + '_' + tokenUrl) ) {
      this.log('Old token belongs to different environment or old token expired, requesting new one...');
      try {

        let resp = await axios({
          method: 'POST',
          url: tokenUrl,
          headers: {
            "Accept": "application/json",
            "Content-Type": "application/x-www-form-urlencoded"
          },
          data: {
            "grant_type": "client_credentials",
            "client_id": encodeURIComponent(clientId),
            "client_secret": encodeURIComponent(clientSecret)
          }
        });
        bru.setVar(tokenKey, resp.data.access_token);
        bru.setVar(collectionVarnameForExpiryTime, moment().add(resp.data.expires_in, 'seconds').format());
        bru.setVar('activeToken', clientId + '_' + tokenUrl);
        this.log('new token set.');

      } catch (error) {
        this.log('login error: ' + error.message);
        console.error(error);
        throw error;
      }
    }
    this.setAuth(tokenKey);
  }
}

module.exports = tools;

Now you can use the defined method in every request. E.G. in pre-requests-scripts. So everytime the token is checked and if it is expired, a new token is requested and stored to the collection variables.

const tools = require('./tools/tools');
await tools.login();

[mirkogolze]

The pre/post request scripts are running in an isolated sandbox (https://www.npmjs.com/package/vm2). For security and isolation only code from inside the collection is allowed.
Another way could be to create a private git repository for the tools and use it as dependency. See https://docs.npmjs.com/cli/v10/configuring-npm/package-json#urls-as-dependencies

[helloanoop]

it would be nice to have the tools directory outside of the collection folder, one level up so many different collections could make use of the same functionality.

You bet :)

@nickheniser @mirkogolze We recently added support for additionalContextRoots. This hasn't made to the documentation yet. Will add it there soon.

{
  "version": "1",
  "name": "payments-api",
  "type": "collection",
  "scripts": {
    "additionalContextRoots": [
      "../scripts"
    ]
  }
}

Checkout #438 and #795

[Frankenleg]

It appears the additionalContextRoots is working for the pre-request script, but not the post-response. My pre-request runs fine with the referenced script, but the post-request gives the following error: Cannot find the module: '../scripts/oauth'

When moving the scripts folder down into the collection, both scripts run fine.
``

[tlaloc911]

@Frankenleg, it doesnt work in post response. It is an unmerged PR that solves this #1397

[adamghill]

I used the tools.js script above, but instead of storing the expiration date in bruno with collectionVarnameForExpiryTime I store the JWT and check if it's expired. Something like this:

isJwtExpired: (token) => {
    if (typeof(token) !== 'string' || !token || !token.includes(".")) {
      throw new Error('Invalid token provided');
    }
  
    const payload = new Buffer(token.split('.')[1], 'base64').toString('ascii');
    const {exp} = JSON.parse(payload);

    const currentTime = new Date().getTime() / 1000;
  
    if (currentTime > exp) {
      tools.log('The JWT is expired')

      return true;
    }
  
    return false;
  },

Thanks for the great starting script!

[helloanoop]

The much awaited collection level scripting is now available in v0.22.0 🚀🚀

[karl-gustav]

How can we use this to auto run the request that gets the accessToken? Do we just need to do it programmatically? Or even better is there a possibility to set a request as a prerequisite to another request? In Insomnia we can set that an env variable is a body property of another request and a expire time for when the request needs to be run again.

[mirkogolze]

Currently there is no way to set dependent requests or run a special request via script. But you could use scripting for checking if the token is expired and request a new one.
E.G. #385 (comment).
You can do the scripting in collection level pre-request-scripts, so you don't need custom scripts.

And feel free to formulate a new feature request as issue or in Discord.

[eferro70]

Upload a PDF file

Pre Request script

const fs = require("fs");
const path = require("path");
const FormData = require("form-data");

const cwd = bru.cwd();
const url = bru.getEnvVar("host") + "/api/controlador/documentos";
const attachmentFilename = "doc.pdf";
const attachmentPath = path.join(cwd,'relative/path/to/doc.pdf');
const attachment = fs.readFileSync(attachmentPath);

const formData = new FormData();
formData.append('doc', attachment, { filename: attachmentFilename }); 

req.setBody(formData);

bruno.json

{
  "version": "1",
  "name": "my_collection",
  "type": "collection",
  "scripts": {
    "moduleWhitelist": ["form-data"],
    "filesystemAccess": {
      "allow": true
    }
  }
}

package.json

{
  "name": "my_collection",
  "version": "1.0.0",
  "main": "index.js",
  "dependencies": {
    "form-data": "^4.0.0"
  }
}

Important: run npm install to install extenal package 'form-data'

[jaybhanushali3195]

I get the following error when trying to pass zip file

Error invoking remote method 'send-http-request': VMError: Operation not allowed on contextified object.

This is my script

const fs = require('fs');
const path = require('path');
const FormData = require("form-data");
console.log("hello")
const attachmentFilename = "current_request.bin";
const attachmentPath = path.join(bru.cwd(), attachmentFilename);
const attachment = fs.readFileSync(attachmentPath, "base64");
// const attachmentLength = attachment.length;

const formData = new FormData();
formData.append('doc', attachment, { filename: attachmentFilename }); 
req.setHeader("Content-Type", "application/octet-stream");
req.setHeader("Content-Encoding", "gzip");

req.setBody(formData);

bruno.json

{
    "version": "1",
    "name": "JayTrial",
    "type": "collection",
    "moduleWhitelist": ["form-data"],
    "scripts": {
        "filesystemAccess": {
            "allow": true
        }
    }
}

package.json

{
  "name": "JayTrial",
  "version": "1.0.0",
  "main": "index.js",
  "dependencies": {
    "form-data": "^4.0.0"
  }
}

Any idea how to solve ?

[shawna-donnelly]

Not sure if this is it, but comparing your bruno.json file to the original, your moduleWhitelist is not inside of scripts, like it is in the example.

[kovacsdongo]

and where we have to store the file in the system?

[alexfrancischungath]

I am trying to upload the file using the scripting.But iam getting Error invoking remote method 'send-http-request': TypeError: data should be a string, Buffer or Uint8Array

`const fs = require("fs");
const path = require("path");
const FormData = require("form-data");
const attachmentFilename = "aa.txt";
const attachmentPath = "C:\Users\alexcf\Desktop\Bruno API Testing\file-uploads\aa.pdf";

const attachment = fs.readFileSync(attachmentPath);

const formData = new FormData();
formData.append('doc', attachment, { filename: attachmentFilename });
formData.append("jobProcessName", 'TEST');
formData.append("initiateJob", false);
formData.append("fileName","aa.pdf");
req.setBody(formData);
`
my bruno.json:
{
"version": "1",
"name": "file-uploads",
"type": "collection",
"scripts": {
"filesystemAccess": {
"allow": true
},"moduleWhitelist" : [
"form-data"
]
}
}

my package.json:
{
"name": "file-uploads",
"version": "1.0.0",
"main": "index.js",
"dependencies": {
"form-data": "^4.0.0"
}
}

[alexfrancischungath]

Error invoking remote method 'send-http-request': TypeError: data should be a string, Buffer or Uint8Array

Got the fix.formData.append("initiateJob", 'false'); solved it

[helloanoop]

Logging

In case you'd like to keep. track of request and responses.
You need to create a folder called logs inside your collection root folder

bruno.json

{
  "version": "1",
  "name": "my_collection",
  "type": "collection",
  "scripts": {
    "filesystemAccess": {
      "allow": true
    }
  }
}

Collection Level Post response script

const fs = require('fs');
const path = require('path');
const moment = require('moment');

const safeStringify = function (obj) {
  try {
    return JSON.stringify(obj, null, 2);
  } catch (err) {
    return obj
  }
};

const request = {
  url: req.getUrl(),
  headers: req.getHeaders(),
  method: req.getMethod(),
  body: req.getBody()
};

const response = {
  status: res.getStatus(),
  headers: res.getHeaders(),
  body: res.getBody()
};

const now = moment();
const formattedDate = now.format('YYYYMMDD-HHmmss');
const filename = path.join(bru.cwd(), 'logs', `${formattedDate}.json`);
const content = safeStringify({request, response}, null, 2);

fs.writeFileSync(filename, content);

[viniciusrd10]

When you right click on a folder with more the one requests and try to run all of them it just store the last one.

[sphars]

Need to note that in order to use the filesystem (and most packages), Bruno needs to be in Developer Mode and not Safe Mode in the sandbox settings. This threw me off for good while trying to figure out why fs could not be found.

For versions >= 1.25 of Bruno.

[helloanoop]

Different User Tokens Across Different Envs

Folder Structure

|-- folder
|   |-- auth.bru
|   |-- request.bru
|-- bruno.json
|-- environments
|   |-- dev.bru
|   |-- qa.bru
|-- token-store.js

token-store.js

class TokenStore {
  constructor() {
    this.tokens = {
      dev: null,
      qa: null,
      prod: null
    }
  }

  saveToken(token, env) {
    this.tokens[env] = token;
  }

  populateTokenInRequest(req, env) {
    const token = `Bearer ${this.tokens[env]}`;

    req.setHeader('Authorization', token);
  }
}

return new TokenStore();

Inside your auth post-response script

const tokenStore = require('./token-store');

const body = res.getBody();
const token = body.access_token;

tokenStore.saveToken(token, bru.getEnvName());

Inside your collection level pre-request script

const tokenStore = require('./token-store');

tokenStore.populateTokenInRequest(req, bru.getEnvName());

[CoenraadS]

Automatic Request Chaining to resolve var usages

The following is a setup that will analyze a requests url for any {{}} usages, then search which request in the collection should provide this var if it's not currently set.

bruno.json

{
  "version": "1",
  "name": "Example",
  "type": "collection",
  "scripts": {
    "filesystemAccess": {
      "allow": true
    }
  }
}

Collection.bru

script:pre-request {
  console.log("ResolveVariables.js being called from Collection Pre-Request (see collection.bru)")
  require("./ResolveVariables.js")
}

ResolveVariables.js

// Shoutout to ChatGPT for helping me with regex

const fs = require('fs');
const path = require('path');

const pattern = /\{\{([^\{\}]+)\}\}/g; // Match text between '{{' and '}}'.

/** @type {Map<String, String>} */
let varRequestMap = null;

let match;
while ((match = pattern.exec(req.url)) !== null) {
    const varKey = match[1];
    const varValue = bru.getVar(varKey);

    if (varValue) {
        console.log(varKey + ": " + varValue);
    }
    else {
        console.log(varKey + " is not defined.");
        if (!varRequestMap) {
            varRequestMap = BuildDependencyMap();
        }

        const dependsOnRequest = varRequestMap.get(varKey);
        if (dependsOnRequest) {
            console.log("Enqueuing: " + dependsOnRequest)
            bru.setNextRequest(dependsOnRequest)
        }
        else {
            console.log("Could not determine which request should provide: " + varKey)
        }
    }
}

function BuildDependencyMap() {
    const varRequestMap = new Map();
    console.log("Building dependency map")

    const directoryPath = bru.cwd();

    const files = fs.readdirSync(directoryPath);
    const bruFiles = files.filter(file => path.extname(file) === '.bru' && path.basename(file) !== "collection.bru");

    const setVarPattern = /bru\.setVar\(['"]([^'"]+)['"]/g; // Match all first parameters of bru.SetVar, in double or single quotes
    const namePattern = /name:\s*([^\n\r]+)/;
    bruFiles.forEach(file => {
        const filePath = path.join(directoryPath, file);

        const data = fs.readFileSync(filePath, 'utf8');
        console.log(`Analyzing ${file}`);
        const name = data.match(namePattern)[1];
        console.log("Name: " + name);
        const matches = [...data.matchAll(setVarPattern)];
        const parameters = matches.map(match => match[1]);
        if (parameters.length > 0) {
            console.log(`${file} provides the following vars:`)
            console.log(parameters)
            parameters.forEach(parameter => varRequestMap.set(parameter, name));
        }
    });

    return varRequestMap;
}

[bsteimer]

Hi @CoenraadS, I'm wondering if this still works.

The request which should provide the variable won't get called.

[daniavander]

hello guys

I wrote a pre request script:

`if (!bru.getEnvVar("ACCESS_TOKEN") || Date.now() >= bru.getEnvVar("ACCESS_TOKEN_EXPIRES"))
{
    req.setMethod({
        url: 'https://login.microsoftonline.com/' + bru.getEnvVar("AZURE_TENANT_ID") + '/oauth2/v2.0/token',
        method: 'POST',
        header: 'Content-Type: multipart/form-data',
        body: {
            mode: 'formdata',
            formdata: [ 
                {key: "grant_type", value: "client_credentials", disabled: false},
                {key: "client_id", value: bru.getEnvVar("AZURE_CLIENT_ID"), disabled: false},
                {key: "client_secret", value: bru.getEnvVar("AZURE_CLIENT_SECRET"), disabled: false},
                {key: "scope", value: bru.getVar("AZURE_TARGET_SCOPE"), disabled: false},
            ]
        }
    }, function (err, res) {
        if (err)
        {
            console.log(err);
        }
        else
        {
            let json = res.json();
            bru.setVar("ACCESS_TOKEN", json.access_token);
            bru.setVar("ACCESS_TOKEN_EXPIRES", Date.now() + json.expires_in * 1000);
        }
    });
}`

I use environment variable

but i get an error:
Error invoking remote method 'send-http-request': TypeError: (config.method || this.defaults.method || "get").toLowerCase is not a function

What does this error mean? And have anybody an idea to solve i?

thanks

[mirkogolze]

Did you try that out with an normal request configured at the UI? When it is working as normal request. It should be possible to do with scripts too. Do you have any proxy configuration? Looks not so.

[daniavander]

It will work with simple get
v1: simple - set auth to bearer, and copy token from webapp console network tab

v2: pre csript - in my pre script request i set the auth to bearer token: {{ACCESS_TOKEN}}
my scope: api://ó..../.default

in postman i can login with this credentials

[daniavander]

Can i sendRequest without axios?

[daniavander]

i did it finally:
const axios = require('axios');

const tokenUrl = 'https://login.microsoftonline.com/' + bru.getEnvVar('AZURE_TENANT_ID') + '/oauth2/v2.0/token';
const clientId = bru.getEnvVar('AZURE_CLIENT_ID');
const clientSecret = bru.getEnvVar('AZURE_CLIENT_SECRET');
const scope = bru.getEnvVar('AZURE_TARGET_SCOPE');

const axiosInstance = axios.create({
baseURL: tokenUrl,
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
});

const data = {
grant_type: 'client_credentials',
client_id: clientId,
client_secret: clientSecret,
scope: scope,
};

axiosInstance.post('', data)
.then(response => {
const accessToken = response.data.access_token;
console.log('Authentication successful!');
console.log('Access token:', accessToken);

// Use the access token for subsequent API requests

bru.setEnvVar('ACCESS_TOKEN', accessToken);
})
.catch(error => {
console.error('Authentication failed:', error);
});

[didaskein]

Hello @daniavander thank you for your script it help me a lot to create a new one ;-)

The script detect the expiration of the token (we have the expiration in the JWT token), we can detect the switch of environment and we can force the recreation of the token on each request if needed (set to true the flag in the post execution to clear the variable)

First on order to be able to run the script :

1. Disable SSL check on localhost
   

2. Switch in developper mode
   

3. In bruno.json add :
   

 "scripts": {
    "moduleWhitelist": ["node-fetch", "axios"],
    "filesystemAccess": {
      "allow": true
    }
  }

4. Set in the Collection ... / Settings/Auth Bearer Token = {{ACCESS_TOKEN}}
   

5. Set in the Collection ... / Settings/Script PreRequest & PostResponse
   

PreRequest :

const axios = require('axios');
const moment = require('moment');
const atob = require('atob');

const tokenUrl = 'https://login.microsoftonline.com/' + bru.getEnvVar('AZURE_TENANT_ID') + '/oauth2/v2.0/token';
const clientId = bru.getEnvVar('AZURE_CLIENT_ID');
const clientSecret = bru.getEnvVar('AZURE_CLIENT_SECRET');
const scope = bru.getEnvVar('AZURE_TARGET_SCOPE');
const axiosInstance = axios.create({ baseURL: tokenUrl,  headers: { 'Content-Type': 'application/x-www-form-urlencoded'} });

const data = {
                grant_type: 'client_credentials',
                client_id: clientId,
                client_secret: clientSecret,
                scope: scope,
             };

const authenticateClient = async (config) => {
  console.log('===> Start authenticateClient');
    
  var accessToken =  bru.getVar('ACCESS_TOKEN')
  var lastEnvUsed =  bru.getVar('LAST_ENV_USED')
  var needToGenerateANewToken = false;
  var currentEnv = bru.getEnvName();
  //console.log(`===> Start authenticateClient accessToken:${accessToken} lastEnvUsed:${lastEnvUsed} currentEnv:${currentEnv}`);
  
  if(accessToken == null || lastEnvUsed == null || lastEnvUsed != currentEnv) {
		 console.warn('===> We need to generate a new token (empty token or new env) !');
	   needToGenerateANewToken = true;
  }
  
  if(needToGenerateANewToken == false){
    
    var tokens = accessToken.split(".");
    var expirationDateInSeconds = JSON.parse(atob(tokens[1])).exp;
    var nowInSeconds = moment().unix();
    
    console.log(`===> Check expiration : expirationDateInSeconds:${expirationDateInSeconds} vs now:${nowInSeconds}`);
    
    if(nowInSeconds > expirationDateInSeconds){
      console.warn(`===> We need to generate a new token ((expirationDateInSeconds:${expirationDateInSeconds} > now:${nowInSeconds})`);
      needToGenerateANewToken = true;
    }
  }
  
  //console.log('===> needToGenerateANewToken: ', needToGenerateANewToken);
   if(!needToGenerateANewToken){
     console.info('===> We can use the previous Token !');
     return;
   }

  //We need to generate a new Token
  console.info('===> We need to get a new Token !');
  await axiosInstance.post('', data)
      .then(response => {
        const accessToken = response.data.access_token;
        const accessTokenExpiry   = response.data.expires_in;  

        //console.log('Authentication successful!', accessToken);
        //console.log('Access token expire in:', accessTokenExpiry, ' seconds');

        // Use the access token for subsequent API requests
        bru.setVar('ACCESS_TOKEN', accessToken);
        bru.setVar('LAST_ENV_USED', currentEnv);
        console.info('New token generated successfully.');
      })

      .catch(error => {
        console.error('Authentication failed:', error);
      });
}

await authenticateClient();

PostResponse :

//If we need to force delete after each query
if(false)  {
 bru.deleteVar("ACCESS_TOKEN", null);
 bru.deleteVar("LAST_ENV_USED", null); 
 console.info('Delete all variables to force a new token generation on next call.');
}

7. On the child Query set Auth / Inherit
   

8. Show the Debug screen to see the logs
   

9. Variable to Set in the environment :

• AZURE_CLIENT_ID = 123456-c953-4eed-aa49-6149cb721bd3
• AZURE_TARGET_SCOPE = api://123456-8786-4d01-8a25-661c6d08af19/.default
• AZURE_TENANT_ID = 123456-85c1-4151-82e4-e8a3200f1630
• AZURE_CLIENT_SECRET = ******************************

10. Test the Call
    

[tsteckenborn]

Attached is another variant for OAuth2 Client Credentials handling in the collection.

YouTube Video explaining it:

Coding:

const axios = require('axios');
const btoa = require('btoa');
const moment = require('moment');

const calculateTokenExpiryInMilliseconds = (tokenExpiryVarName) => {
  const currentTime = moment()
  const expiryTime = moment(bru.getVar(tokenExpiryVarName)) || currentTime
  return expiryTime.diff(currentTime, 'milliseconds')
}

const authenticateClient = async (config) => {
  const {
    tokenEndpointVarName,
    clientIdVarName,
    clientSecretVarName,
    bearerTokenVarName
  } = config;

  if (!bearerTokenVarName) {
    throw new Error('Missing environment variable name for storing the bearer token');
  }

  const expiryDifferenceInMilliseconds = calculateTokenExpiryInMilliseconds(`expiryFor_${bearerTokenVarName}`)

  const oneMinuteInMilliseconds = 60000

  if (expiryDifferenceInMilliseconds >= oneMinuteInMilliseconds &&
    bru.getVar('lastRequestedEnvironmentName') === bru.getEnvName()) {
    console.log('Taking already existing token.')
    return
  }
  console.log('Requesting new token.')

  const envVariables = {
    [tokenEndpointVarName]: bru.getEnvVar(tokenEndpointVarName),
    [clientIdVarName]: bru.getEnvVar(clientIdVarName),
    [clientSecretVarName]: bru.getEnvVar(clientSecretVarName)
  }

  const missingVariables = Object.entries(envVariables).filter(([key, value]) => !value).map(([key]) => key)

  if (missingVariables.length > 0) {
    throw new Error(`Missing required environment variables: ${missingVariables.join(', ')}`)
  }

  try {
    const tokenData = (await axios.post(envVariables[tokenEndpointVarName], { grant_type: "client_credentials" }, { headers: { "Authorization": `Basic ${btoa(`${envVariables[clientIdVarName]}:${envVariables[clientSecretVarName]}`)}`, "Content-Type": "application/x-www-form-urlencoded" } })).data

    bru.setVar(bearerTokenVarName, tokenData.access_token)
    bru.setVar(`expiryFor_${bearerTokenVarName}`, moment().add(tokenData.expires_in, 'seconds').format())
    bru.setVar('lastRequestedEnvironmentName', bru.getEnvName())

  } catch (error) {
    throw error
  }

}

await authenticateClient({
  tokenEndpointVarName: 'tokenUrl',
  clientIdVarName: 'clientId',
  clientSecretVarName: 'clientSecret',
  bearerTokenVarName: 'bearerToken2'
})

[tsteckenborn]

Attached is a variant for OAuth2 Authorization Code handling in the collection.

YouTube Video explaining it:

Coding:

const axios = require('axios');
const btoa = require('btoa');
const moment = require('moment');

const calculateTokenExpiryMilliseconds = (tokenExpiryVarName) => {
    const currentTime = moment();
    const expiryTime = moment(bru.getVar(tokenExpiryVarName)) || currentTime;
    return expiryTime.diff(currentTime, 'milliseconds');
};

const exchangeAuthorizationCodeForToken = async (clientId, clientSecret, tokenEndpoint, authorizationCode, redirectUri) => {
    const response = await axios.post(tokenEndpoint, {
        grant_type: 'authorization_code',
        code: authorizationCode,
        redirect_uri: redirectUri
    }, {
        headers: {
            "Authorization": `Basic ${btoa(`${clientId}:${clientSecret}`)}`,
            "Content-Type": "application/x-www-form-urlencoded"
        }
    });
    return response.data;
};

const storeTokenAndExpiry = (tokenData, tokenVarName) => {
    bru.setVar(tokenVarName, tokenData.access_token);
    bru.setVar(`expiryFor_${tokenVarName}`, moment().add(tokenData.expires_in, 'seconds').format());
    console.log('New token stored successfully.');
};

const authenticateClient = async (config) => {

    const {
        tokenEndpointVarName,
        authorizeEndpointVarName,
        clientIdVarName,
        clientSecretVarName,
        bearerTokenVarName,
        authorizationCodeVarName,
        redirectUriVarName
    } = config;

    const expiryDifferenceMs = calculateTokenExpiryMilliseconds(`expiryFor_${bearerTokenVarName}`);

    const oneMinuteInMilliseconds = 60000;

    if (expiryDifferenceMs >= oneMinuteInMilliseconds && bru.getVar(`lastRequestedEnvironmentName`) === bru.getEnvName()) {
        console.log(`Token in variable ${bearerTokenVarName} is still valid.`);
        return;
    }

    const envVariables = {
        [tokenEndpointVarName]: bru.getEnvVar(tokenEndpointVarName),
        [authorizeEndpointVarName]: bru.getEnvVar(authorizeEndpointVarName),
        [clientIdVarName]: bru.getEnvVar(clientIdVarName),
        [clientSecretVarName]: bru.getEnvVar(clientSecretVarName),
        [redirectUriVarName]: bru.getEnvVar(redirectUriVarName),
    };

    const missingVariables = Object.entries(envVariables)
        .filter(([key, value]) => !value)
        .map(([key]) => key);

    if (missingVariables.length > 0) {
        throw new Error(`Missing required environment variables: ${missingVariables.join(', ')}. Please ensure these variables are correctly set in your environment.`);
    }

    const authorizationCode = bru.getEnvVar(authorizationCodeVarName);
    const authorizationCodeUrl = `${envVariables[authorizeEndpointVarName]}?client_id=${envVariables[clientIdVarName]}&response_type=code&redirect_uri=${envVariables[redirectUriVarName]}`;

    if (!authorizationCode) {
        throw new Error(`No authorization code provided. Navigate to the url ${authorizationCodeUrl} and grab the code from the URL.`);
    }

    try {
        const tokenData = await exchangeAuthorizationCodeForToken(
            envVariables[clientIdVarName],
            envVariables[clientSecretVarName],
            envVariables[tokenEndpointVarName],
            authorizationCode,
            envVariables[redirectUriVarName]
        );
        storeTokenAndExpiry(tokenData, bearerTokenVarName);
        bru.setVar(`lastRequestedEnvironmentName`, bru.getEnvName());
    } catch (error) {
        throw new Error(`Error: It seems like on of the input values is incorrect. Most probably the authorization code is invalid. Try to grab a new one from ${authorizationCodeUrl} and store it as part of the environment variable ${authorizationCodeVarName}. The original error is: ${error}`);
    }


}

await authenticateClient({
    tokenEndpointVarName: 'tokenUrl',
    authorizeEndpointVarName: 'authorizeUrl',
    clientIdVarName: 'clientId',
    clientSecretVarName: 'clientSecret',
    bearerTokenVarName: 'bearerToken',
    authorizationCodeVarName: 'authorizationCode',
    redirectUriVarName: 'redirectUri'
});

[Wingjam]

AWS Cognito Auth

A small implementation of AWS Cognito allowing you to fetch the JWT Token automatically and inject the token in the Authorization header based on insomnia-plugin-aws-cognito-token

Folder structure

|-- folder
|   |-- request.bru
|-- bruno.json
|-- environments
|   |-- dev.bru
|   |-- prod.bru
|-- cognito-auth.js

Coding

cognito-auth.js

const fetch = require('node-fetch')

const username = bru.getEnvVar('username')
const password = bru.getEnvVar('password')

const auth = {
  login: async function () {
    const baseUrl = bru.getEnvVar('base-url')
    const cognitoInfosResponse = await fetch(`${baseUrl}/infos`)
    const { CognitoRegion, CognitoAppClientID } = await cognitoInfosResponse.json()

    const requestBody = {
      AuthFlow: 'USER_PASSWORD_AUTH',
      ClientId: CognitoAppClientID,
      AuthParameters: {
        USERNAME: username,
        PASSWORD: password,
      },
    }

    const request = {
      method: 'post',
      headers: {
        'content-type': 'application/x-amz-json-1.1',
        'x-amz-target': 'AWSCognitoIdentityProviderService.InitiateAuth',
      },
      body: JSON.stringify(requestBody),
    }

    const authResponse = await fetch(`https://cognito-idp.${CognitoRegion}.amazonaws.com`, request)
    const { AuthenticationResult } = await authResponse.json()
    const token = AuthenticationResult.IdToken
    req.setHeader('Authorization', `Bearer ${token}`)
  },
}

module.exports = auth

Inside your pre-request script:

const auth = require('./cognito-auth');
await auth.login();

Next Steps

• Implement caching and refetch token only when expired
• Error handling
• Make it more generic

[KaiElwood]

Do you know if there's a way to make this work with "SRP_AUTH" as opposed to just "USER_PASSWORD_AUTH"? Thanks!

[Wingjam]

As far as I know, the easiest would be to use amazon-cognito-identity-js from AWS Amplify.

i.e.

const AmazonCognitoIdentity = require('amazon-cognito-identity-js');

var authenticationData = {
	Username: 'username',
	Password: 'password',
};
var authenticationDetails = new AmazonCognitoIdentity.AuthenticationDetails(
	authenticationData
);
var poolData = {
	UserPoolId: '...', // Your user pool id here
	ClientId: '...', // Your client id here
};
var userPool = new AmazonCognitoIdentity.CognitoUserPool(poolData);
var userData = {
	Username: 'username',
	Pool: userPool,
};
var cognitoUser = new AmazonCognitoIdentity.CognitoUser(userData);
cognitoUser.authenticateUser(authenticationDetails, {
	onSuccess: function(result) {
		var accessToken = result.getAccessToken().getJwtToken();
                // ...
	},

	onFailure: function(err) {
		alert(err.message || JSON.stringify(err));
	},
});

[rodanr]

I have created a cli to solve this, you can create collection presetup to work with aws cognito
https://github.com/rodanr/bruno-init-suite
if you need short video tutorial for setting it up: Setup Bruno Docs with AWS Cognito Auth in Minutes! 🚀 | Step-by-Step Guide | Bruno Init Suite

[codemonkey33]

Simple Loop iteration over a single request

Pre Request

if(bru.getVar("iteration") === undefined){
  console.log("iteration is undefined setting to 0");
  bru.setVar("iteration", 0);
}
console.log("current iteration is " + bru.getVar("iteration"));

Post Response

if(bru.getVar("iteration") < bru.getVar("iterations") -1){
  bru.setVar("iteration", bru.getVar("iteration") + 1);
  bru.setNextRequest("Testloop");
}
console.log("next iteration is " + bru.getVar("iteration"));

Output

iteration is undefined setting to 0
current iteration is 0
Testloop (200 OK) - 629 ms
next iteration is 1
current iteration is 1
Testloop (200 OK) - 537 ms
next iteration is 2
current iteration is 2
Testloop (200 OK) - 515 ms
next iteration is 2

Requires 1.4 onward for bru.setNextRequest()

[shawna-donnelly]

Is there a way to be able to use the package jsonwebtoken? Every other library I have installed has worked well, but I need to sign some information prior to sending it to an api, but if I include jsonwebtoken, I get the error Error invoking remote method 'send-http-request': VMError: Operation not allowed on contextified object. Any idea what I am doing wrong, or is this just not possible?

[drs9222]

Did you figure out if this is possible?

[eklinger-UofA]

I see a similar problem when using the 'jose' package, trying to work around jsonwebtoken not working but this alternative is running into similar problems.

[orached]

I have the same issue for cose-js library

[masewo]

I had the same issue with the package jsonwebtoken. Then I tried the next best optionaccording to jwt.io: jsrsasign.

Here a small example, because the API is different:

First install the package jsrsasign:

npm install jsrsasign

Then write your pre request script to sign a JWT:

const axios = require("axios");
const rs = require("jsrsasign");

const now = Math.floor(Date.now() / 1000);
if (now < bru.getVar("expiresAt")) {
    return;
}

const privateKey = bru.getProcessEnv("PRIVATE_KEY");

// this might not be necessary for you because I just have a very weird saved private key
const keyDetails = JSON.parse(Buffer.from(privateKey, "base64").toString("utf-8"));
const key = keyDetails.key; // <-- key in PEM here

const jwtToSign = {
    iss: keyDetails.userId,
    sub: keyDetails.userId,
    aud: "https://jwt.io",
    iat: Math.floor(Date.now() / 1000),
    exp: Math.floor(Date.now() / 1000) + 3600,
}

const options = {
    algorithm: "RS256",
    header: {
        alg: "RS256",
        kid: keyDetails.keyId
    }
};

const prvKey = rs.KEYUTIL.getKey(key);
const assertion = rs.jws.JWS.sign(options.algorithm, options.header, jwtToSign, prvKey);

const response = await axios.post("https://jwt.io/oauth/v2/token",
    {
        grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
        scope: "openid profile email",
        assertion: assertion,
    }, {
        headers: {
            "Content-Type": "application/x-www-form-urlencoded",
        }
    })

const expiresAt = Math.floor(Date.now() / 1000) + response.data.expires_in;
bru.setVar("accessToken", response.data.access_token);
bru.setVar("expiresAt", expiresAt);

Good luck! 🍀

[Glazzix]

Hello, I'm facing the same issue with 2 other libraries, and I think I'm not the only one seeing this post : #1784
Do somebody has any solution, other than a workaround using another library ?
I already whitelisted it and allowed access to filesystem.
Thank you

[VictorioBerra]

@tsteckenborn @masewo Is there a way to upload custom auth variants? Or is that just a different way of phrasing "pre request" script for the collection/request?

[masewo]

@VictorioBerra Which custom auth variants are you trying to add? As far as I know you cannot integrate them into the UI without building your own version of Bruno. But a lot is solveable by writing custom pre requests scripts.

[VictorioBerra]

Yeah I wanted it in the UI, or rather outside of collections. Since now every collection I want to use OAuth2 Client Creds the spec-compliant way #1987

[d-mok-pvt]

Hey. I'am looking for a way to dynamically generate parameters for my requests.

ive made project level libs directory with class (had to install faker as external lib)
fake.js

const { faker } = require('@faker-js/faker');
const { v4: uuidv4 } = require('uuid');

function fakeUUids(count) {
    let uuids = [];
    for (let i = 1; i <= count; i++) {
      uuids.push(uuidv4());
    }
    return uuids;
}

function fakeNames(count) {
    let names = [];
    for (let i = 0; i < count; i++) {
        names.push(faker.person.firstName());
    }
    return names;
}

function fakeLastNames(count) {
    let lastNames = [];
    for (let i = 0; i < count; i++) {
        lastNames.push(faker.person.lastName());
    }
    return lastNames;
}

function fakePhones(count, mask) {
    let phones = [];
    for (let i = 0; i < count; i++) {
        phones.push(faker.phone.number(mask));
    }
    return phones;
}

module.exports = {
    fakeUUids,
    fakeNames,
    fakeLastNames,
    fakePhones
}

Modified collections bruno.json with

  "scripts": {
    "additionalContextRoots": [
      "../libs"
    ]
  }

Added to collection pre request script

const {fakeUUids} = require('../libs/fake');
const {fakeNames} = require('../libs/fake');
const {fakePhones} = require('../libs/fake');

const uuids = fakeUUids(3);
uuids.forEach((uuid, i) => bru.setVar(`fakeUuid${i}`, uuid));

const names = fakeNames(2);
names.forEach((name, i) => bru.setVar(`fakeName${i}`, name));

const phones = fakePhones(3, '+998#######');
phones.forEach((phone, i) => bru.setVar(`fakePhone${i}`, phone));

And can now access them in query/body parameters like {{fakeUuid1}}, {{fakeName0}}. Often I need more than one value.
If you have better options to do this, ur welcome

[halfpeaw]

I needed to support MFA via MSAL in my collection. I kept getting errors tyring to use the MSAL js library, but I was able to get it to work via a PowerShell script. I am by no means a JavaScript or PowerShell developer, so it's probably not as elegant as it could be, but I thought I would still share.

Pre request script:

   const fs = require('fs');
   const { execSync } = require('child_process');
   const path = require('path');
  
   try {
      const environment = bru.getEnvVar("Environment").trim();
      console.log(`Using Environment ${environment}`);
       
      // Check if we have a valid token and if it is still valid
      const accessToken = bru.getVar(`ACCESS_TOKEN_${environment}`);
      const tokenExpiry = bru.getVar(`ACCESS_TOKEN_EXPIRY_${environment}`);
      if (!accessToken || !tokenExpiry || Date.now() >= new Date(tokenExpiry)) 
      {
         // Get the directory where the script is running
         const scriptDir = __dirname;
  
         // Resolve the absolute path to the PowerShell script
         const scriptPath = path.join(scriptDir, '..', 'GetToken.ps1');
         // Execute the PowerShell script synchronously
         const output = execSync(`pwsh.exe -ExecutionPolicy Bypass -File "${scriptPath}" -Environment ${environment}`, { encoding: 'utf8' });
         console.log(`PowerShell Output: ${output}`);
  
         // Extract the token using the start and end token flags
         const tokenMatch = output.match(/===TOKEN_START===\s*([\s\S]+?)\s*===TOKEN_END===/);
         const expiryMatch = output.match(/===EXPIRY_START===\s*([\s\S]+?)\s*===EXPIRY_END===/);
  
         if (tokenMatch && expiryMatch) {
            const token = tokenMatch[1].trim();
            const expiry = expiryMatch[1].trim();
  
            // Set the variables in your environment
            bru.setVar(`ACCESS_TOKEN_${environment}`, token);
            bru.setVar(`ACCESS_TOKEN_EXPIRY_${environment}`, expiry);
            req.setHeader('Authorization', 'Bearer ' + token);          
         } else {
           throw new Error("Token or expiry not found in PowerShell script output.");
         }
      } else {
          console.log(`Token is still valid till ${tokenExpiry}, no need to run the PowerShell script.`);
          req.setHeader('Authorization', 'Bearer ' + accessToken);
      }
  } catch (error) {
      console.error(`Error: ${error.message}`);
  }

Power shell script:

param(
    [ValidateSet('prod', 'test', IgnoreCase=$true)]
    [Parameter(Mandatory=$true, HelpMessage="Please enter 'prod' or 'test'")]
    [string]$Environment
)

$clientId = "<guid>" # Some client guid
$authority = "https://login.microsoftonline.com/common"
$redirectUri = "http://localhost/" # configurable in azure

Write-Output "Use the credentials of tenant you wish to retrieve a token for if prompted"

switch ($Environment.ToLower()) {
    'prod' {
        $tenantScopes = "https://prod.fake.com/.default"
    }
    'test' {
        $tenantScopes = "https://test.fake.com/.default"
    }
}

#Check if the MSAL.PS module is installed, if not, install it
try {
    if (-Not (Get-Module -ListAvailable -Name MSAL.PS)) {
        Write-Output "Installing MSAL.PS module"
        Install-Module -Name MSAL.PS -Force -ErrorAction Stop
        Write-Output "MSAL.PS module installed"
    }
    # Import the MSAL.PS module
    Import-Module MSAL.PS -ErrorAction Stop
    Write-Output "MSAL.PS module imported"
} catch {
    Write-Output "Failed to install or import MSAL.PS module"
    Write-Output $_.Exception.Message
    exit 1
}

# Retrieve the token
try {
    $t = Get-MsalToken -ClientId $clientId -Authority $authority -Scopes $tenantScopes -RedirectUri $redirectUri -ErrorAction Stop
    Write-Output "===TOKEN_START==="
    Write-Output $t.AccessToken
    Write-Output "===TOKEN_END==="
    Write-Output "===EXPIRY_START==="
    Write-Output (Get-Date).AddHours(1).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
    Write-Output "===EXPIRY_END==="
    Write-Output "Access token has been written for: $Environment"
} catch {
    Write-Error "Failed to retrieve the access token"
    Write-Error $_.Exception.Message
    exit 1
}

Bruno.json

{
  "version": "1",
  "name": "My_Collection",
  "type": "collection",
  "ignore": [
    "node_modules",
    ".git"
  ],
  "scripts": {
    "moduleWhitelist": [
      "child_process"
    ],
    "filesystemAccess": {
      "allow": true
    }
  }
}

[vsafanov]

Anybody know how to use oracledb module (it works fine when run in node,js ), but not in bruno scripting:

//------------------------------------------------------------

const oracledb = require('oracledb');

oracledb.outFormat = oracledb.OBJECT;

async function run() {

const connection = await oracledb.getConnection ({
user : "user",
password : "pwd",
connectString : "conString"
});

const result = await  connection.execute(
    `SELECT * FROM T1 WHERE TRIALUSERID = 1400`
);

console.log(result.rows);
await connection.close();

}

run();

[CoenraadS]

Tbh I'm not sure it ever worked properly, I think I was overeager about sharing it.. I think there was an issue about it, but on my phone ATM so can't find it easily

…

On Tue, Sep 3, 2024, 4:59 PM Benjamin Steimer ***@***.***> wrote: Hi @CoenraadS <https://github.com/CoenraadS>, I'm wondering if this still works. image.png (view on web) <https://github.com/user-attachments/assets/f6772c08-b03f-4cc1-8182-dde8d56b72ea> The request which should provide the variable won't get called. — Reply to this email directly, view it on GitHub <#385 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABKVVYJXMFZ53CVLE5O4ZCTZUVM5LAVCNFSM6AAAAAA5UAXIUKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTANJSHAYDMMQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[69pmb]

Generate HTML reports

Hey, here a simple tip
I run this command bru run --output results.xml -f junit to generate a report with the junit format
And then I use Xunit Viewer to convert it to a gorgeous HTML report !
Very useful to automate tests in CI and give a tool to quickly review tests

[berlingoqc]

Yeah this is what i do too. Hopefully they could had plugins support for outputter like in newman so we could write them.