Lovely! ♡ This makes it possible for me to send a request to an endpoint that needs both JWT and client cert in my (collection) pre-request script (e.g. for creating a session) by reading the cert/key pair from my local disk:

async function createSession() {
  console.log('create session...');

  const clientCertBaseDir = '/Users/Glenn/my-project/certs';
  const cert = fs.readFileSync(`${clientCertBaseDir}/cert.pem`);
  console.log('cert:', cert.toString('utf8'));
  const key = fs.readFileSync(`${clientCertBaseDir}/key.pem`);
  console.log('key:', key.toString('utf8'));

  const sessionInitUrl = bru.getEnvVar('sessionInitUrl');
  const jwt = bru.getEnvVar('jwt');

  const { data } = await axios.post(
    sessionInitUrl,
    { lang: 'en' },
    {
      headers: { 'content-type': 'application/json', Authorization: `Bearer ${jwt}` },
      httpsAgent: new https.Agent({ cert, key, rejectUnauthorized: false }),
    },
  );
  console.log('session data:', data);

  bru.setEnvVar('sessionId', data.sessionId);
  bru.setVar('sessionExpirationTimestamp', moment().add(data.sessionTimeout, 's').valueOf());
}

Great snippet, thank you! It allows me to use the same request, but with different body contents, such as reading a prepared JSON body from a file. @helloanoop, it would be nice to have a flag to pass the body contents to the request from the CLI, something like bru run request.bru --data 'text written payload or path to a file' .

@helloanoop I've already started implementing this; there's now a working PR: see #969

I've yet to implement editing/deleting the cookies tho.

Thanks @Tanja-4732 for raising the PR. Great work. I couldn't work in the last few weeks due to some personal things. I will be getting back next week :).

@srikary12 thanks for your appreciation ☺️✨

But I believe that my PR is rather, well, dead, considering that the original creator/lead developer of Bruno just implemented this feature.

I also assumed, that we'd want a collection-wide cookie store, but the lead dev wants it to be apo-wide.

So I don't think my work's going anywhere but the graveyard of state PRs.

I didn't think that this feature would be implemented so soon after I began my efforts, but I'm glad that this issue is finally, at least mostly resolved.

It would be great if Bruno showed the cookies that were being sent. It seems to send them but there is no UI showing what was sent.

Create a Header KeyValue Pair: "Cookie" : "key=value;key1=value1"
without cookie:

with cookie:

But dont forget to remove already existin cookie, that could block you from oauth2 login

A variation to loop through a Json Array from a single file
This gets the url from the current request instead of environment: https://postman-echo.com/get?foo={{bar}}

Json array (looper.json) looks like

[
    { "bar":"sheep1" },
    { "bar":"sheep2" }
]

Script

const axios = require('axios');
const https = require('https');
var url;

const assets = require('./assets/looper.json');
console.log(assets);

for(let i = 0; i < assets.length; i++) {
  let obj = assets[i];
  url = req.url.replace('{{bar}}', obj.bar);
  let preres = await axios.get(url, { httpsAgent: new https.Agent({rejectUnauthorized: false })});
  console.log(preres.data.args.foo);
}

Will be building on this to make a rudimentary file based runner

The pre/post request scripts are running in an isolated sandbox (https://www.npmjs.com/package/vm2). For security and isolation only code from inside the collection is allowed.
Another way could be to create a private git repository for the tools and use it as dependency. See https://docs.npmjs.com/cli/v10/configuring-npm/package-json#urls-as-dependencies

it would be nice to have the tools directory outside of the collection folder, one level up so many different collections could make use of the same functionality.

You bet :)

@nickheniser @mirkogolze We recently added support for additionalContextRoots. This hasn't made to the documentation yet. Will add it there soon.

{
  "version": "1",
  "name": "payments-api",
  "type": "collection",
  "scripts": {
    "additionalContextRoots": [
      "../scripts"
    ]
  }
}

Checkout #438 and #795

It appears the additionalContextRoots is working for the pre-request script, but not the post-response. My pre-request runs fine with the referenced script, but the post-request gives the following error: Cannot find the module: '../scripts/oauth'

When moving the scripts folder down into the collection, both scripts run fine.
``

@Frankenleg, it doesnt work in post response. It is an unmerged PR that solves this #1397

I used the tools.js script above, but instead of storing the expiration date in bruno with collectionVarnameForExpiryTime I store the JWT and check if it's expired. Something like this:

isJwtExpired: (token) => {
    if (typeof(token) !== 'string' || !token || !token.includes(".")) {
      throw new Error('Invalid token provided');
    }
  
    const payload = new Buffer(token.split('.')[1], 'base64').toString('ascii');
    const {exp} = JSON.parse(payload);

    const currentTime = new Date().getTime() / 1000;
  
    if (currentTime > exp) {
      tools.log('The JWT is expired')

      return true;
    }
  
    return false;
  },

Thanks for the great starting script!

How can we use this to auto run the request that gets the accessToken? Do we just need to do it programmatically? Or even better is there a possibility to set a request as a prerequisite to another request? In Insomnia we can set that an env variable is a body property of another request and a expire time for when the request needs to be run again.

Currently there is no way to set dependent requests or run a special request via script. But you could use scripting for checking if the token is expired and request a new one.
E.G. #385 (comment).
You can do the scripting in collection level pre-request-scripts, so you don't need custom scripts.

And feel free to formulate a new feature request as issue or in Discord.

I get the following error when trying to pass zip file

Error invoking remote method 'send-http-request': VMError: Operation not allowed on contextified object.

This is my script

const fs = require('fs');
const path = require('path');
const FormData = require("form-data");
console.log("hello")
const attachmentFilename = "current_request.bin";
const attachmentPath = path.join(bru.cwd(), attachmentFilename);
const attachment = fs.readFileSync(attachmentPath, "base64");
// const attachmentLength = attachment.length;

const formData = new FormData();
formData.append('doc', attachment, { filename: attachmentFilename }); 
req.setHeader("Content-Type", "application/octet-stream");
req.setHeader("Content-Encoding", "gzip");

req.setBody(formData);

bruno.json

{
    "version": "1",
    "name": "JayTrial",
    "type": "collection",
    "moduleWhitelist": ["form-data"],
    "scripts": {
        "filesystemAccess": {
            "allow": true
        }
    }
}

package.json

{
  "name": "JayTrial",
  "version": "1.0.0",
  "main": "index.js",
  "dependencies": {
    "form-data": "^4.0.0"
  }
}

Any idea how to solve ?

Not sure if this is it, but comparing your bruno.json file to the original, your moduleWhitelist is not inside of scripts, like it is in the example.

and where we have to store the file in the system?

I am trying to upload the file using the scripting.But iam getting Error invoking remote method 'send-http-request': TypeError: data should be a string, Buffer or Uint8Array

`const fs = require("fs");
const path = require("path");
const FormData = require("form-data");
const attachmentFilename = "aa.txt";
const attachmentPath = "C:\Users\alexcf\Desktop\Bruno API Testing\file-uploads\aa.pdf";

const attachment = fs.readFileSync(attachmentPath);

const formData = new FormData();
formData.append('doc', attachment, { filename: attachmentFilename });
formData.append("jobProcessName", 'TEST');
formData.append("initiateJob", false);
formData.append("fileName","aa.pdf");
req.setBody(formData);
`
my bruno.json:
{
"version": "1",
"name": "file-uploads",
"type": "collection",
"scripts": {
"filesystemAccess": {
"allow": true
},"moduleWhitelist" : [
"form-data"
]
}
}

my package.json:
{
"name": "file-uploads",
"version": "1.0.0",
"main": "index.js",
"dependencies": {
"form-data": "^4.0.0"
}
}

Error invoking remote method 'send-http-request': TypeError: data should be a string, Buffer or Uint8Array

Got the fix.formData.append("initiateJob", 'false'); solved it

When you right click on a folder with more the one requests and try to run all of them it just store the last one.

Need to note that in order to use the filesystem (and most packages), Bruno needs to be in Developer Mode and not Safe Mode in the sandbox settings. This threw me off for good while trying to figure out why fs could not be found.

For versions >= 1.25 of Bruno.

Hi @CoenraadS, I'm wondering if this still works.

The request which should provide the variable won't get called.

I write to this format:

const axios = require('axios');

const tokenUrl = 'https://login.microsoftonline.com/' + bru.getEnvVar('AZURE_TENANT_ID') + '/oauth2/v2.0/token';
const clientId = bru.getEnvVar('AZURE_CLIENT_ID');
const clientSecret = bru.getEnvVar('AZURE_CLIENT_SECRET');
const scope = bru.getEnvVar('AZURE_TARGET_SCOPE');


try {
    let resp = await axios({
        method: 'POST',
        url: tokenUrl,
        headers: {
            'Content-Type': 'multipart/form-data',
        },
        data: {
            grant_type: 'client_credentials',
            client_id: clientId,
            client_secret: clientSecret,
            scope: scope
        },
    });

    bru.setVar('ACCESS_TOKEN2', resp.data.access_token);
    bru.setVar('activeToken', clientId + '_' + tokenUrl);
} catch (error) {
    throw error;
}

but i get : Error invoking remote method 'send-http-request': AxiosError: Request failed with status code 400

i would like to login to azure ad webapp with bearer token

It is working in postman, but i can not make it to the correct form to bruno

Did you try that out with an normal request configured at the UI? When it is working as normal request. It should be possible to do with scripts too. Do you have any proxy configuration? Looks not so.

It will work with simple get
v1: simple - set auth to bearer, and copy token from webapp console network tab

v2: pre csript - in my pre script request i set the auth to bearer token: {{ACCESS_TOKEN}}
my scope: api://ó..../.default

in postman i can login with this credentials

Can i sendRequest without axios?

i did it finally:
const axios = require('axios');

const tokenUrl = 'https://login.microsoftonline.com/' + bru.getEnvVar('AZURE_TENANT_ID') + '/oauth2/v2.0/token';
const clientId = bru.getEnvVar('AZURE_CLIENT_ID');
const clientSecret = bru.getEnvVar('AZURE_CLIENT_SECRET');
const scope = bru.getEnvVar('AZURE_TARGET_SCOPE');

const axiosInstance = axios.create({
baseURL: tokenUrl,
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
});

const data = {
grant_type: 'client_credentials',
client_id: clientId,
client_secret: clientSecret,
scope: scope,
};

axiosInstance.post('', data)
.then(response => {
const accessToken = response.data.access_token;
console.log('Authentication successful!');
console.log('Access token:', accessToken);

// Use the access token for subsequent API requests

bru.setEnvVar('ACCESS_TOKEN', accessToken);
})
.catch(error => {
console.error('Authentication failed:', error);
});

Do you know if there's a way to make this work with "SRP_AUTH" as opposed to just "USER_PASSWORD_AUTH"? Thanks!

As far as I know, the easiest would be to use amazon-cognito-identity-js from AWS Amplify.

i.e.

const AmazonCognitoIdentity = require('amazon-cognito-identity-js');

var authenticationData = {
	Username: 'username',
	Password: 'password',
};
var authenticationDetails = new AmazonCognitoIdentity.AuthenticationDetails(
	authenticationData
);
var poolData = {
	UserPoolId: '...', // Your user pool id here
	ClientId: '...', // Your client id here
};
var userPool = new AmazonCognitoIdentity.CognitoUserPool(poolData);
var userData = {
	Username: 'username',
	Pool: userPool,
};
var cognitoUser = new AmazonCognitoIdentity.CognitoUser(userData);
cognitoUser.authenticateUser(authenticationDetails, {
	onSuccess: function(result) {
		var accessToken = result.getAccessToken().getJwtToken();
                // ...
	},

	onFailure: function(err) {
		alert(err.message || JSON.stringify(err));
	},
});

I have created a cli to solve this, you can create collection presetup to work with aws cognito
https://github.com/rodanr/bruno-init-suite
if you need short video tutorial for setting it up: Setup Bruno Docs with AWS Cognito Auth in Minutes! 🚀 | Step-by-Step Guide | Bruno Init Suite

Did you figure out if this is possible?

I see a similar problem when using the 'jose' package, trying to work around jsonwebtoken not working but this alternative is running into similar problems.

I have the same issue for cose-js library

I had the same issue with the package jsonwebtoken. Then I tried the next best optionaccording to jwt.io: jsrsasign.

Here a small example, because the API is different:

First install the package jsrsasign:

npm install jsrsasign

Then write your pre request script to sign a JWT:

const axios = require("axios");
const rs = require("jsrsasign");

const now = Math.floor(Date.now() / 1000);
if (now < bru.getVar("expiresAt")) {
    return;
}

const privateKey = bru.getProcessEnv("PRIVATE_KEY");

// this might not be necessary for you because I just have a very weird saved private key
const keyDetails = JSON.parse(Buffer.from(privateKey, "base64").toString("utf-8"));
const key = keyDetails.key; // <-- key in PEM here

const jwtToSign = {
    iss: keyDetails.userId,
    sub: keyDetails.userId,
    aud: "https://jwt.io",
    iat: Math.floor(Date.now() / 1000),
    exp: Math.floor(Date.now() / 1000) + 3600,
}

const options = {
    algorithm: "RS256",
    header: {
        alg: "RS256",
        kid: keyDetails.keyId
    }
};

const prvKey = rs.KEYUTIL.getKey(key);
const assertion = rs.jws.JWS.sign(options.algorithm, options.header, jwtToSign, prvKey);

const response = await axios.post("https://jwt.io/oauth/v2/token",
    {
        grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
        scope: "openid profile email",
        assertion: assertion,
    }, {
        headers: {
            "Content-Type": "application/x-www-form-urlencoded",
        }
    })

const expiresAt = Math.floor(Date.now() / 1000) + response.data.expires_in;
bru.setVar("accessToken", response.data.access_token);
bru.setVar("expiresAt", expiresAt);