modified logic and test cases

postmanlabs · Oct 22, 2024 · 98e7f52 · 98e7f52
1 parent d03a680
commit 98e7f52
Show file tree

Hide file tree

Showing 2 changed files with 34 additions and 22 deletions.
diff --git a/lib/runner/extensions/event.command.js b/lib/runner/extensions/event.command.js
@@ -245,8 +245,6 @@ module.exports = {
                 events,
                 isVaultAccessAllowed;
 
-            // Explicitly enable tracking for vault secrets here as this will
-            // not be sent to sandbox who otherwise takes care of mutation tracking
 
             // @todo: find a better place to code this so that event is not aware of such options
             if (abortOnFailure) {
@@ -394,26 +392,32 @@ module.exports = {
                     }.bind(this));
 
                 this.host.on(EXECUTION_VAULT_BASE + executionId, async function (id, cmd, ...args) {
-                    try {
-                        if (typeof isVaultAccessInScriptsAllowed === 'function') {
-                            isVaultAccessAllowed = await isVaultAccessInScriptsAllowed(item.id);
-                        }
-                        else {
-                            isVaultAccessAllowed = isVaultAccessInScriptsAllowed;
+                    let currentIsVaultAccessAllowed = false;
+
+                    if (isVaultAccessAllowed === undefined) {
+                        try {
+                            currentIsVaultAccessAllowed = Boolean(await isVaultAccessInScriptsAllowed(item.id));
                         }
-                        if (isVaultAccessAllowed) {
-                            vaultSecrets.enableTracking({ autoCompact: true });
+                        catch (error) {
+                            currentIsVaultAccessAllowed = false;
                         }
+                        // eslint-disable-next-line require-atomic-updates
+                        isVaultAccessAllowed = currentIsVaultAccessAllowed;
+                    }
+                    else {
+                        currentIsVaultAccessAllowed = isVaultAccessAllowed;
                     }
-                    catch (error) {
-                        console.error(error.message);
-                        isVaultAccessAllowed = false;
+
+                    // Explicitly enable tracking for vault secrets here as this will
+                    // not be sent to sandbox who otherwise takes care of mutation tracking
+                    if (currentIsVaultAccessAllowed) {
+                        vaultSecrets.enableTracking({ autoCompact: true });
                     }
                     // Ensure error is string
                     // TODO identify why error objects are not being serialized correctly
                     const dispatch = (e, r) => { this.host.dispatch(EXECUTION_VAULT_BASE + executionId, id, e, r); };
 
-                    if (!isVaultAccessAllowed) {
+                    if (!currentIsVaultAccessAllowed) {
                         return dispatch('Vault access denied');
                     }
 

diff --git a/test/integration/sanity/vaultSecrets.test.js b/test/integration/sanity/vaultSecrets.test.js
@@ -1061,7 +1061,7 @@ describe('vaultSecrets', function () {
             });
         });
 
-        describe('should handle _allowScriptAccess as a boolean for backward compatibility', function () {
+        describe('should fail if _allowScriptAccess is not a function', function () {
             var testrun;
 
             before(function (done) {
@@ -1083,8 +1083,12 @@ describe('vaultSecrets', function () {
                                 listen: 'prerequest',
                                 script: {
                                     exec: `
-                                        const v = await pm.vault.get('var1');
-                                        console.log(v);
+                                        try {
+                                            const v = await pm.vault.get('var1');
+                                            console.log('Vault value:', v);
+                                        } catch (error) {
+                                            console.error('Vault error:', error.message);
+                                        }
                                     `
                                 }
                             }],
@@ -1097,21 +1101,25 @@ describe('vaultSecrets', function () {
                 });
             });
 
-            it('should allow vault access when _allowScriptAccess is true', function () {
-                var prConsoleArgs = testrun.console.getCall(0).args.slice(2);
+            it('should deny vault access when _allowScriptAccess is not a function', function () {
+                expect(testrun.console.called).to.be.true;
 
-                expect(prConsoleArgs).to.deep.equal(['value1']);
+                var consoleArgs = testrun.console.getCall(0).args.slice(2);
+
+                expect(consoleArgs[0]).to.equal('Vault error:');
+                expect(consoleArgs[1]).to.equal('Vault access denied');
             });
         });
 
-        describe('should handle _allowScriptAccess as undefined for backward compatibility', function () {
+        describe('should handle when _allowScriptAccess function throws', function () {
             var testrun;
 
             before(function (done) {
                 this.run({
                     vaultSecrets: {
                         id: 'vault',
                         prefix: 'vault:',
+                        _allowScriptAccess: function () { throw new Error('Custom error'); },
                         values: [
                             {
                                 key: 'vault:var1',
@@ -1143,7 +1151,7 @@ describe('vaultSecrets', function () {
                 });
             });
 
-            it('should deny vault access when _allowScriptAccess is undefined', function () {
+            it('should deny vault access when _allowScriptAccess function throws', function () {
                 expect(testrun.console.called).to.be.true;
 
                 var consoleArgs = testrun.console.getCall(0).args.slice(2);