[PR #5963] Add pw.env.setSecret for secure handling of secret variables #5436

New issue

Open

opened 2026-03-17 02:52:57 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:52:57 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/5963
Author: @adarsh-naik-2004
Created: 3/7/2026
Status: 🔄 Open

Base: main ← Head: main

📝 Commits (3)

2dbb4c8 feat(scripting): add pw.env.setSecret to handle secret variables securely
37f7670 chore: revert local sitemap config override
29c824c test(scripting): resolve scoped envs and add setSecret coverage

📊 Changes

8 files changed (+553 additions, -422 deletions)

View changed files

📝 packages/hoppscotch-common/src/types/post-request.d.ts (+9 -0)
📝 packages/hoppscotch-common/src/types/pre-request.d.ts (+4 -0)
📝 packages/hoppscotch-js-sandbox/src/__tests__/utils/shared.spec.ts (+82 -15)
📝 packages/hoppscotch-js-sandbox/src/bootstrap-code/post-request.js (+4 -0)
📝 packages/hoppscotch-js-sandbox/src/bootstrap-code/pre-request.js (+4 -0)
📝 packages/hoppscotch-js-sandbox/src/cage-modules/namespaces/pw-namespace.ts (+7 -0)
📝 packages/hoppscotch-js-sandbox/src/types/index.ts (+3 -0)
📝 packages/hoppscotch-js-sandbox/src/utils/shared.ts (+440 -407)

📄 Description

Closes #5912

This PR introduces the setSecret API method to the scripting sandbox (available in both pw.env and hopp.env namespaces). This allows users to programmatically save and update environment secrets from pre-request and post-request scripts, ensuring sensitive data like OAuth tokens are correctly masked in the UI.

What's changed

Core Engine: Updated setEnv in shared.ts to support an isSecret flag.
Sandbox Bridge: Added envSetSecret to PwNamespaceMethods and EnvMethods type definitions.
Security Layer: Implemented the envSetSecret mapping in pw-namespace.ts to bridge the faraday-cage sandbox with the core engine.
Scripting API: Exposed setSecret in pre-request.js and post-request.js bootstrap code.
DX & Tooling: Added setSecret to Monaco editor type definitions (pre-request.d.ts and post-request.d.ts) to provide autocomplete and resolve linting errors.
Verified pw.env.setSecret() correctly routes variables to the Secrets tab.
Verified standard pw.env.set() still routes to the Variables tab.
Confirmed Monaco editor autocomplete works as expected.

Proof of Functionality

❌ Before (Current Behavior)

Using pw.env.set() for sensitive data results in the variable being stored in plain text under the Variables tab, leaking the secret.
Screenshot 2026-03-07 204625
Screenshot 2026-03-07 204608

✅ After (This PR)

Using the new pw.env.setSecret() API correctly routes the variable to the Secrets tab, ensuring sensitive tokens are masked and stored securely.
Screenshot 2026-03-07 222446
Screenshot 2026-03-07 222522

Notes to reviewers

I have ensured that both the legacy Web Worker sandbox and the new faraday-cage implementation are updated. Unrelated local configuration changes (like the sitemap generator override) were reverted before submission to ensure a clean diff.

Summary by cubic

Adds setSecret to the scripting environment (pw.env and hopp.env) so scripts can save sensitive values as secrets. Secrets are masked and saved to the Secrets tab; existing set behavior is unchanged.

New Features
- New API: pw.env.setSecret(key, value) and hopp.env.setSecret(key, value).
- Core support: setEnv accepts an isSecret flag to mark variables as secrets.
- Sandbox bridge: envSetSecret wired through faraday-cage and legacy bootstrap (pre/post scripts).
- Types/DX: Monaco and d.ts updated; pm.environment/globals/collectionVariables/variables/vault now expose setSecret.
- Tests: Added coverage for creating/upgrading secrets and ensuring set doesn’t remove the secret flag; added scoped env resolve tests.

^{Written for commit 29c824c7bf. Summary will update on new commits.}

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/5963 **Author:** [@adarsh-naik-2004](https://github.com/adarsh-naik-2004) **Created:** 3/7/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `main` --- ### 📝 Commits (3) - [`2dbb4c8`](https://github.com/hoppscotch/hoppscotch/commit/2dbb4c8146999c4942373221663824136ae222c1) feat(scripting): add pw.env.setSecret to handle secret variables securely - [`37f7670`](https://github.com/hoppscotch/hoppscotch/commit/37f76704ed195e191b2793ca5a4d4806f31e703b) chore: revert local sitemap config override - [`29c824c`](https://github.com/hoppscotch/hoppscotch/commit/29c824c7bfb603e68d25e912e5e5540d43aea871) test(scripting): resolve scoped envs and add setSecret coverage ### 📊 Changes **8 files changed** (+553 additions, -422 deletions) <details> <summary>View changed files</summary> 📝 `packages/hoppscotch-common/src/types/post-request.d.ts` (+9 -0) 📝 `packages/hoppscotch-common/src/types/pre-request.d.ts` (+4 -0) 📝 `packages/hoppscotch-js-sandbox/src/__tests__/utils/shared.spec.ts` (+82 -15) 📝 `packages/hoppscotch-js-sandbox/src/bootstrap-code/post-request.js` (+4 -0) 📝 `packages/hoppscotch-js-sandbox/src/bootstrap-code/pre-request.js` (+4 -0) 📝 `packages/hoppscotch-js-sandbox/src/cage-modules/namespaces/pw-namespace.ts` (+7 -0) 📝 `packages/hoppscotch-js-sandbox/src/types/index.ts` (+3 -0) 📝 `packages/hoppscotch-js-sandbox/src/utils/shared.ts` (+440 -407) </details> ### 📄 Description Closes #5912 This PR introduces the `setSecret` API method to the scripting sandbox (available in both `pw.env` and `hopp.env` namespaces). This allows users to programmatically save and update environment secrets from pre-request and post-request scripts, ensuring sensitive data like OAuth tokens are correctly masked in the UI. ### What's changed - **Core Engine**: Updated `setEnv` in `shared.ts` to support an `isSecret` flag. - **Sandbox Bridge**: Added `envSetSecret` to `PwNamespaceMethods` and `EnvMethods` type definitions. - **Security Layer**: Implemented the `envSetSecret` mapping in `pw-namespace.ts` to bridge the `faraday-cage` sandbox with the core engine. - **Scripting API**: Exposed `setSecret` in `pre-request.js` and `post-request.js` bootstrap code. - **DX & Tooling**: Added `setSecret` to Monaco editor type definitions (`pre-request.d.ts` and `post-request.d.ts`) to provide autocomplete and resolve linting errors. - [x] Verified `pw.env.setSecret()` correctly routes variables to the **Secrets** tab. - [x] Verified standard `pw.env.set()` still routes to the **Variables** tab. - [x] Confirmed Monaco editor autocomplete works as expected. ### Proof of Functionality #### ❌ Before (Current Behavior) Using `pw.env.set()` for sensitive data results in the variable being stored in plain text under the **Variables** tab, leaking the secret. <img width="1325" height="881" alt="Screenshot 2026-03-07 204625" src="https://github.com/user-attachments/assets/aef774b7-74c1-49e9-9633-3f233f3b2251" /> <img width="1563" height="457" alt="Screenshot 2026-03-07 204608" src="https://github.com/user-attachments/assets/9b4f9de7-6527-42ac-b630-3a6745c17c69" /> #### ✅ After (This PR) Using the new `pw.env.setSecret()` API correctly routes the variable to the **Secrets** tab, ensuring sensitive tokens are masked and stored securely. <img width="1917" height="842" alt="Screenshot 2026-03-07 222446" src="https://github.com/user-attachments/assets/ec01c086-1b88-4f23-a56a-a1e28a9c72ab" /> <img width="1917" height="876" alt="Screenshot 2026-03-07 222522" src="https://github.com/user-attachments/assets/4089bdf5-b5dd-42a0-bb43-f1bf48e618ab" /> ### Notes to reviewers I have ensured that both the legacy Web Worker sandbox and the new `faraday-cage` implementation are updated. Unrelated local configuration changes (like the sitemap generator override) were reverted before submission to ensure a clean diff.  --- ## Summary by cubic Adds setSecret to the scripting environment (`pw.env` and `hopp.env`) so scripts can save sensitive values as secrets. Secrets are masked and saved to the Secrets tab; existing set behavior is unchanged. - New Features - New API: `pw.env.setSecret(key, value)` and `hopp.env.setSecret(key, value)`. - Core support: `setEnv` accepts an `isSecret` flag to mark variables as secrets. - Sandbox bridge: `envSetSecret` wired through `faraday-cage` and legacy bootstrap (pre/post scripts). - Types/DX: Monaco and d.ts updated; `pm.environment/globals/collectionVariables/variables/vault` now expose `setSecret`. - Tests: Added coverage for creating/upgrading secrets and ensuring `set` doesn’t remove the secret flag; added scoped env resolve tests. <sup>Written for commit 29c824c7bfb603e68d25e912e5e5540d43aea871. Summary will update on new commits.</sup>  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>