tests/auth/oauth1/fixtures/collections/bru/OAuth1 RSA-SHA1 Body 200.bru (1)

20-49: Consider centralizing the PEM test key to reduce duplication.

If this same RSA key appears in other OAuth1 RSA fixtures, pulling it from a shared fixture source would lower copy/paste drift.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/auth/oauth1/fixtures/collections/bru/OAuth1` RSA-SHA1 Body 200.bru
around lines 20 - 49, The RSA PEM private_key block in the OAuth1 RSA-SHA1
fixture is duplicated; extract the PEM into a single shared fixture (e.g., a
shared "rsa_private_key" fixture) and replace the inline private_key value in
OAuth1 RSA-SHA1 Body 200.bru with a reference to that shared fixture; update any
other OAuth1 RSA fixtures to reference the same shared symbol so all tests
consume the centralized key and eliminate copy/paste drift.

tests/auth/oauth1/fixtures/collections/yml/OAuth1 HMAC-SHA1 Body JSON 200.yml (1)

11-14: Use clearly fake credential literals to reduce secret-scanner noise.

These are test fixtures, but current values can still trip generic secret detectors and create noisy security reports.

Suggested placeholder cleanup

-    consumerKey: consumer_key_1
-    consumerSecret: consumer_secret_1
-    accessToken: access_token_1
-    tokenSecret: token_secret_1
+    consumerKey: oauth1-test-id
+    consumerSecret: oauth1-test-secret
+    accessToken: oauth1-test-token
+    tokenSecret: oauth1-test-token-secret

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/auth/oauth1/fixtures/collections/yml/OAuth1` HMAC-SHA1 Body JSON
200.yml around lines 11 - 14, Replace the realistic-looking credential values in
the fixture by using clearly fake placeholder literals for the keys consumerKey,
consumerSecret, accessToken, and tokenSecret (for example values like
"fake_consumer_key", "fake_consumer_secret", "fake_access_token",
"fake_token_secret") so the test remains meaningful but won't trigger secret
scanners; update the corresponding entries in the OAuth1 HMAC-SHA1 Body JSON
fixture to use those fake placeholders.

tests/auth/oauth1/fixtures/collections/bru/OAuth1 PLAINTEXT Query Params 200.bru (1)

29-32: Consider adding email assertion for parity with other 200 fixtures.

The HMAC-SHA1 200.bru fixture includes an assertion for res.body.resource.email. Adding it here would maintain consistency:

assert {
  res.status: eq 200
  res.body.resource.name: eq oauth1-test-resource
  res.body.resource.email: eq oauth1@example.com
}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/auth/oauth1/fixtures/collections/bru/OAuth1` PLAINTEXT Query Params
200.bru around lines 29 - 32, Add an email assertion to the existing response
assertions: inside the assert block that currently checks res.status and
res.body.resource.name (the assertions referencing res.status and
res.body.resource.name: eq oauth1-test-resource), add a line asserting
res.body.resource.email: eq oauth1@example.com so this PLAINTEXT fixture matches
the parity of the HMAC-SHA1 200.bru fixture.

tests/auth/oauth1/fixtures/collections/yml/OAuth1 HMAC-SHA256 Body 200.yml (1)

22-30: Missing email assertion for consistency.

Other 200 fixtures (e.g., OAuth1 HMAC-SHA1 200.bru, OAuth1 RSA-SHA256 200.yml) include an assertion for res.body.resource.email. Consider adding it here for consistency:

    - expression: res.body.resource.email
      operator: eq
      value: oauth1@example.com

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/auth/oauth1/fixtures/collections/yml/OAuth1` HMAC-SHA256 Body 200.yml
around lines 22 - 30, The 200 fixture is missing the email assertion for
consistency with other OAuth1 200 fixtures; add an assertion entry under
runtime.assertions that checks res.body.resource.email equals oauth1@example.com
by inserting an assertion with expression: res.body.resource.email, operator:
eq, and value: oauth1@example.com (matching the existing assertion style used
for res.body.resource.name).

tests/auth/oauth1/fixtures/collections/yml/OAuth1 RSA-SHA1 Body 200.yml (1)

53-61: Consider adding email assertion for consistency.

Other OAuth1 200 fixtures (e.g., HMAC-SHA1, RSA-SHA1) include an assertion for res.body.resource.email. This fixture only checks resource.name. Adding the email check would improve consistency across your test suite.

💡 Suggested addition

 runtime:
   assertions:
     - expression: res.status
       operator: eq
       value: '200'
     - expression: res.body.resource.name
       operator: eq
       value: oauth1-test-resource
+    - expression: res.body.resource.email
+      operator: eq
+      value: oauth1@example.com

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/auth/oauth1/fixtures/collections/yml/OAuth1` RSA-SHA1 Body 200.yml
around lines 53 - 61, This fixture's runtime assertions only check
res.body.resource.name but should also assert res.body.resource.email for
consistency with other OAuth1 200 fixtures; update the assertions array in the
YAML (the block containing the expressions "res.body.resource.name" and
"res.status") to add a new assertion whose expression is
"res.body.resource.email", operator "eq", and value matching the expected test
email used elsewhere in OAuth1 fixtures (use the same email literal used by
HMAC-SHA1/RSA-SHA1 fixtures) so the test verifies both name and email.

tests/auth/oauth1/fixtures/collections/yml/OAuth1 RSA-SHA1 200.yml (1)

9-17: Missing consumerSecret field for schema consistency.

The OAuth1 RSA-SHA1 Body 200.yml fixture explicitly includes consumerSecret: '' while this file omits it entirely. For consistency across fixtures (and to ensure the YAML schema is exercised uniformly), consider adding the field.

💡 Suggested addition

   auth:
     type: oauth1
     consumerKey: consumer_key_1
+    consumerSecret: ''
     accessToken: access_token_1

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/auth/oauth1/fixtures/collections/yml/OAuth1` RSA-SHA1 200.yml around
lines 9 - 17, Add the missing consumerSecret field to the auth block so the
fixture matches the schema used by other OAuth1 RSA-SHA1 fixtures; update the
auth map by adding consumerSecret: '' alongside consumerKey, accessToken,
tokenSecret, signatureMethod, version, addParamsTo, and includeBodyHash to
ensure consistent schema coverage.

tests/auth/oauth1/fixtures/collections/yml/OAuth1 PLAINTEXT Query Params 200.yml (1)

20-28: Consider adding email assertion for consistency.

Most other OAuth1 200 fixtures include assertions for both resource.name and resource.email. This fixture only checks resource.name. Adding the email assertion would maintain test consistency.

💡 Suggested addition

 runtime:
   assertions:
     - expression: res.status
       operator: eq
       value: '200'
     - expression: res.body.resource.name
       operator: eq
       value: oauth1-test-resource
+    - expression: res.body.resource.email
+      operator: eq
+      value: oauth1@example.com

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/auth/oauth1/fixtures/collections/yml/OAuth1` PLAINTEXT Query Params
200.yml around lines 20 - 28, The fixture is missing an assertion for
resource.email; update the runtime.assertions array in the OAuth1 PLAINTEXT
Query Params 200.yml fixture (alongside the existing assertions that check
res.status and res.body.resource.name) by adding an assertion that checks
expression "res.body.resource.email" with operator "eq" and the expected email
value used across other OAuth1 200 fixtures (e.g., "oauth1-test@example.com"),
placing it after the resource.name assertion for consistency.

tests/auth/oauth1/fixtures/collections/yml/OAuth1 RSA-SHA512 200.yml (1)

20-48: PEM keys in test fixtures are properly scoped, but add secret-scan allowlist if CI scanning is implemented.

The inline PEM keys across the OAuth1 test fixtures are correctly limited to test code only and are intentional for testing the privateKey.type: text path. No current secret-scan configuration exists in the repository, so there's no immediate risk. However, when secret scanning (e.g., gitleaks, checkov) is added to CI, create a narrowly scoped allowlist for tests/auth/oauth1/fixtures/collections/ to prevent false positives on these test PEM blocks.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/auth/oauth1/fixtures/collections/yml/OAuth1` RSA-SHA512 200.yml around
lines 20 - 48, This fixture contains an inline PEM private key (the multi-line
"-----BEGIN PRIVATE KEY-----" value in the OAuth1 RSA-SHA512 200.yml fixture)
used only for tests; add a narrowly scoped secret-scan allowlist entry in your
CI secret-scanning config (e.g., gitleaks/checkov rules) that whitelists this
fixture directory or filename pattern and/or the specific YAML "value" field
pattern to suppress false positives, ensuring the rule is limited to
tests/auth/oauth1 fixtures and does not broadly exempt other files.

packages/bruno-cli/src/runner/prepare-request.js (1)

152-170: Extract OAuth1 config mapping into one helper to avoid drift.

Both branches map the same OAuth1 fields. A shared builder keeps this maintainable and prevents subtle divergence later.

♻️ Suggested refactor

+const buildOAuth1Config = (source, basePath) => {
+  return {
+    consumerKey: get(source, `${basePath}.consumerKey`),
+    consumerSecret: get(source, `${basePath}.consumerSecret`),
+    accessToken: get(source, `${basePath}.accessToken`),
+    tokenSecret: get(source, `${basePath}.tokenSecret`),
+    callbackUrl: get(source, `${basePath}.callbackUrl`),
+    verifier: get(source, `${basePath}.verifier`),
+    signatureMethod: get(source, `${basePath}.signatureMethod`),
+    privateKey: get(source, `${basePath}.privateKey`),
+    privateKeyType: get(source, `${basePath}.privateKeyType`),
+    timestamp: get(source, `${basePath}.timestamp`),
+    nonce: get(source, `${basePath}.nonce`),
+    version: get(source, `${basePath}.version`),
+    realm: get(source, `${basePath}.realm`),
+    addParamsTo: get(source, `${basePath}.addParamsTo`),
+    includeBodyHash: get(source, `${basePath}.includeBodyHash`)
+  };
+};
@@
-    if (collectionAuth.mode === 'oauth1') {
-      axiosRequest.oauth1config = {
-        consumerKey: get(collectionAuth, 'oauth1.consumerKey'),
-        consumerSecret: get(collectionAuth, 'oauth1.consumerSecret'),
-        accessToken: get(collectionAuth, 'oauth1.accessToken'),
-        tokenSecret: get(collectionAuth, 'oauth1.tokenSecret'),
-        callbackUrl: get(collectionAuth, 'oauth1.callbackUrl'),
-        verifier: get(collectionAuth, 'oauth1.verifier'),
-        signatureMethod: get(collectionAuth, 'oauth1.signatureMethod'),
-        privateKey: get(collectionAuth, 'oauth1.privateKey'),
-        privateKeyType: get(collectionAuth, 'oauth1.privateKeyType'),
-        timestamp: get(collectionAuth, 'oauth1.timestamp'),
-        nonce: get(collectionAuth, 'oauth1.nonce'),
-        version: get(collectionAuth, 'oauth1.version'),
-        realm: get(collectionAuth, 'oauth1.realm'),
-        addParamsTo: get(collectionAuth, 'oauth1.addParamsTo'),
-        includeBodyHash: get(collectionAuth, 'oauth1.includeBodyHash')
-      };
-    }
+    if (collectionAuth.mode === 'oauth1') {
+      axiosRequest.oauth1config = buildOAuth1Config(collectionAuth, 'oauth1');
+    }
@@
-    if (request.auth.mode === 'oauth1') {
-      axiosRequest.oauth1config = {
-        consumerKey: get(request, 'auth.oauth1.consumerKey'),
-        consumerSecret: get(request, 'auth.oauth1.consumerSecret'),
-        accessToken: get(request, 'auth.oauth1.accessToken'),
-        tokenSecret: get(request, 'auth.oauth1.tokenSecret'),
-        callbackUrl: get(request, 'auth.oauth1.callbackUrl'),
-        verifier: get(request, 'auth.oauth1.verifier'),
-        signatureMethod: get(request, 'auth.oauth1.signatureMethod'),
-        privateKey: get(request, 'auth.oauth1.privateKey'),
-        privateKeyType: get(request, 'auth.oauth1.privateKeyType'),
-        timestamp: get(request, 'auth.oauth1.timestamp'),
-        nonce: get(request, 'auth.oauth1.nonce'),
-        version: get(request, 'auth.oauth1.version'),
-        realm: get(request, 'auth.oauth1.realm'),
-        addParamsTo: get(request, 'auth.oauth1.addParamsTo'),
-        includeBodyHash: get(request, 'auth.oauth1.includeBodyHash')
-      };
-    }
+    if (request.auth.mode === 'oauth1') {
+      axiosRequest.oauth1config = buildOAuth1Config(request, 'auth.oauth1');
+    }

Also applies to: 218-236

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/bruno-cli/src/runner/prepare-request.js` around lines 152 - 170, The
OAuth1 mapping is duplicated; extract a helper (e.g.,
buildOAuth1Config(collectionAuth)) that reads oauth1.* keys using get(...) and
returns the config object, then replace both occurrences (the branch where
collectionAuth.mode === 'oauth1' that assigns axiosRequest.oauth1config and the
similar block around lines 218-236) with a call to that helper so both branches
use the same builder and avoid drift.

packages/bruno-tests/src/auth/oauth1/index.js (2)

244-250: Redundant algoMap mapping.

The map keys and values are identical. You can simplify by using signatureMethod directly.

♻️ Simplify signature verification

     case 'RSA-SHA1':
     case 'RSA-SHA256':
     case 'RSA-SHA512': {
-      const algoMap = { 'RSA-SHA1': 'RSA-SHA1', 'RSA-SHA256': 'RSA-SHA256', 'RSA-SHA512': 'RSA-SHA512' };
-      const verifier = crypto.createVerify(algoMap[signatureMethod]);
+      const verifier = crypto.createVerify(signatureMethod);
       verifier.update(baseString);
       return verifier.verify(TEST_RSA_PUBLIC_KEY, signature, 'base64');
     }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/bruno-tests/src/auth/oauth1/index.js` around lines 244 - 250, The
RSA branch creates an unnecessary algoMap with identical keys/values; simplify
the code by calling crypto.createVerify(signatureMethod) directly, keep the
existing verifier.update(baseString) and return
verifier.verify(TEST_RSA_PUBLIC_KEY, signature, 'base64') so the logic around
signatureMethod, baseString, TEST_RSA_PUBLIC_KEY, and verifier.verify remains
unchanged but without the redundant mapping.

---

557-559: Prefer named exports or consistent module.exports pattern.

The current pattern assigns to module.exports then adds a property. Consider using a single object export for clarity.

♻️ Consolidate exports

-module.exports = router;
-module.exports.TEST_RSA_PRIVATE_KEY = TEST_RSA_PRIVATE_KEY;
+module.exports = router;
+module.exports.TEST_RSA_PRIVATE_KEY = TEST_RSA_PRIVATE_KEY;

Alternatively, use a cleaner pattern:

router.TEST_RSA_PRIVATE_KEY = TEST_RSA_PRIVATE_KEY;
module.exports = router;

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/bruno-tests/src/auth/oauth1/index.js` around lines 557 - 559, The
file currently assigns module.exports = router and then sets
module.exports.TEST_RSA_PRIVATE_KEY separately; fix this by exporting
consistently with a single object or attaching the key to the router before
exporting. Update the code so either router.TEST_RSA_PRIVATE_KEY =
TEST_RSA_PRIVATE_KEY and then module.exports = router, or replace both lines
with module.exports = { router, TEST_RSA_PRIVATE_KEY } (choosing the pattern
used elsewhere), ensuring references to router and TEST_RSA_PRIVATE_KEY remain
valid.

tests/auth/oauth1/oauth1-runner.spec.ts (1)

13-21: Potential race condition when writing PEM file at module load.

If multiple test workers load this module simultaneously, concurrent existsSync/writeFileSync calls could race. Consider using writeFileSync with a flag like { flag: 'wx' } to fail if file exists, or move setup to a fixture/hook.

♻️ Safer file write

 for (const subdir of ['bru', 'yml']) {
   const pemPath = path.join(fixtureBase, subdir, 'test-private-key.pem');
-  if (!fs.existsSync(pemPath)) {
-    fs.writeFileSync(pemPath, TEST_RSA_PRIVATE_KEY);
-  }
+  try {
+    fs.writeFileSync(pemPath, TEST_RSA_PRIVATE_KEY, { flag: 'wx' });
+  } catch (err) {
+    // File already exists, which is fine
+    if (err.code !== 'EEXIST') throw err;
+  }
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/auth/oauth1/oauth1-runner.spec.ts` around lines 13 - 21, The
module-level setup that writes TEST_RSA_PRIVATE_KEY to pemPath can race across
parallel test workers; update the logic around TEST_RSA_PRIVATE_KEY/pemPath to
perform an atomic create-or-ignore instead of existsSync then writeFileSync:
attempt to write using writeFileSync with a failing-when-exists flag (e.g., {
flag: 'wx' }) wrapped in a try/catch that ignores EEXIST, or move the write into
a test fixture/hook that runs single-threaded before tests; ensure you reference
and update the code touching TEST_RSA_PRIVATE_KEY and pemPath in
oauth1-runner.spec.ts so concurrent loads don't clobber each other.

packages/bruno-app/src/components/RequestPane/Auth/OAuth1/index.js (2)

103-105: Use path.basename for cross-platform filename extraction.

Manual splitting with / and \\ works but the codebase already imports a path utility. Using path.basename is more robust and consistent with OS-agnostic guidelines.

♻️ Suggested fix

-  const fileName = isFileRef ? privateKeyValue.split('/').pop().split('\\').pop() : '';
+  const fileName = isFileRef ? path.basename(privateKeyValue) : '';

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/bruno-app/src/components/RequestPane/Auth/OAuth1/index.js` around
lines 103 - 105, Replace the manual split logic that derives fileName from
privateKeyValue with a cross-platform basename call: when computing fileName
(currently using privateKeyValue.split('/').pop().split('\\').pop()), import/use
the existing path utility and call path.basename(privateKeyValue) when isFileRef
is true (keep privateKeyValue and isFileRef checks as-is) so filename extraction
is robust across OSes.

---

287-304: Potential double-toggle on checkbox interaction.

The <input> has onChange and the <label> has onClick with e.preventDefault() — but clicking the checkbox directly still triggers onChange. The label's onClick also fires when clicking the checkbox (due to label association), but preventDefault() on the label doesn't prevent the checkbox's native change. This should work correctly, but the pattern is unusual.

A cleaner approach: wrap both in a standard <label> and rely solely on onChange.

♻️ Simplified pattern

-        <div className="flex items-center gap-2">
-          <input
-            type="checkbox"
-            checked={oauth1.includeBodyHash || false}
-            onChange={(e) => handleChange('includeBodyHash', e.target.checked)}
-          />
-          <label
-            className="block cursor-pointer"
-            onClick={(e) => {
-              e.preventDefault(); handleChange('includeBodyHash', !oauth1.includeBodyHash);
-            }}
-          >
-            Include Body Hash
-          </label>
-        </div>
+        <label className="flex items-center gap-2 cursor-pointer">
+          <input
+            type="checkbox"
+            checked={oauth1.includeBodyHash || false}
+            onChange={(e) => handleChange('includeBodyHash', e.target.checked)}
+          />
+          <span>Include Body Hash</span>
+        </label>

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/bruno-app/src/components/RequestPane/Auth/OAuth1/index.js` around
lines 287 - 304, The checkbox currently handles toggling in two places (input
onChange and label onClick) which can double-trigger; simplify by using a single
control: remove the label's onClick and e.preventDefault(), wrap the <input> and
text inside one <label> (or associate via htmlFor/id) and rely only on the
input's onChange to call handleChange('includeBodyHash', e.target.checked);
reference oauth1.includeBodyHash and the handleChange call to locate where to
change this.

tests/auth/oauth1/oauth1.spec.ts (1)

127-134: Consider a more specific checkbox selector.

page.locator('input[type="checkbox"]') could match multiple checkboxes if more are added to the OAuth1 form. Consider scoping it to the "Include Body Hash" row.

♻️ Suggested selector refinement

-      const checkbox = page.locator('input[type="checkbox"]');
-      const bodyHashLabel = page.locator('label').filter({ hasText: 'Include Body Hash' });
+      const bodyHashRow = fieldRow(page, 'Include Body Hash');
+      const checkbox = bodyHashRow.locator('input[type="checkbox"]');

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/auth/oauth1/oauth1.spec.ts` around lines 127 - 134, The selector for
the checkbox is too broad and may match multiple inputs; scope the checkbox
lookup to the "Include Body Hash" row by finding the input relative to the
bodyHashLabel instead of a global input[type="checkbox"]. Replace the standalone
checkbox locator with something like using
bodyHashLabel.locator('input[type="checkbox"]') or
bodyHashLabel.locator('input') (or use a selector that targets the row/container
for the "Include Body Hash" label) so the test uses the checkbox tied to the
bodyHashLabel variable.