Rendering purpose is not set during oauth2 token refresh for plugins
- Dominant language
- TypeScript
- Stars
- 40k
- Forks
- 2.4k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 61
Description
### Expected Behavior
The plugin receives the rendering purpose even during oauth2 token refresh and is able to render secrets accordingly
```
{"type":"oauth2","grantType":"client_credentials","accessTokenUrl":"https://example.edu","clientId":"","credentialsInBody":"true","clientSecret":"{% keepass 'keepassxc', '', '', 'https://example.edu', 'password' %}"}
```
is rendered to
```
{"type":"oauth2","grantType":"client_credentials","accessTokenUrl":"https://example.edu","clientId":"","credentialsInBody":"true","clientSecret":"mypass"}
```
### Actual Behavior
The client secret in oauth2 token refresh when using a plugin is rendered wrong, as it is rendered without the `RenderPurpose` set to `send`. A security aware plugin that only wants to render an actual secret when going over the wire, can therefore not be used for client secret.
```
{"type":"oauth2","grantType":"client_credentials","accessTokenUrl":"https://example.edu","clientId":"","credentialsInBody":"true","clientSecret":"{% keepass 'keepassxc', '', '', 'https://example.edu', 'password' %}"}
```
is rendered to
```
{"type":"oauth2","grantType":"client_credentials","accessTokenUrl":"https://example.edu","clientId":"","credentialsInBody":"true","clientSecret":"KeepassXC - password of https://example.edu"}
```
### Reproduction Steps
* Install plugin insomnia-plugin-keepass (this is not a plugin bug)
* In Oauth2 use Keepass tag in client secret
### Is there an existing issue for this?
- [X] I have searched the [issue tracker](https://www.github.com/Kong/insomnia/issues) for this problem.
### Additional Information
Possible quickfix solution is to add optional parameter for RenderPurpose to `use-nunjucks.ts` and `o-auth-2-auth.tsx`
https://github.com/dansailer/insomnia/pull/1/files
### Insomnia Version
2022.3.0
### What operating system are you using?
macOS
### Operating System Version
Windows 10 and macOS 12.3.1
### Installation method
homebrew (MacOS), Installer exe (Windows)
### Last Known Working Insomnia version
_No response_
Contributor guide
Research direction
Start with use-nunjucks.ts and o-auth-2-auth.tsx, the entry points named in the issue, and trace how the OAuth2 client secret is rendered during token refresh. Confirm that the plugin receives RenderPurpose.send and that the example Keepass tag produces the actual secret when sent over the wire.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100