Adds support for secret resolution via support of secretResolver. by VShingala · Pull Request #1543 · postmanlabs/postman-runtime

VShingala · 2026-02-04T08:37:43Z

Overview

This PR adds support for the optional secretResolvers interface that can accept various resolvers taking care of the actual resolution of variables of type secrets and their resolution.

codecov · 2026-02-04T08:54:56Z

Codecov Report

❌ Patch coverage is 3.30579% with 117 lines in your changes missing coverage. Please review.
✅ Project coverage is 41.09%. Comparing base (ad947cc) to head (971af12).

Files with missing lines	Patch %	Lines
lib/runner/extensions/item.command.js	1.78%	55 Missing ⚠️
lib/runner/resolve-secrets.js	4.25%	45 Missing ⚠️
lib/runner/extensions/event.command.js	5.55%	17 Missing ⚠️

❌ Your patch check has failed because the patch coverage (3.30%) is below the target coverage (100.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #1543      +/-   ##
===========================================
- Coverage    41.88%   41.09%   -0.79%     
===========================================
  Files           49       50       +1     
  Lines         3794     3876      +82     
  Branches      1087     1115      +28     
===========================================
+ Hits          1589     1593       +4     
- Misses        2082     2160      +78     
  Partials       123      123

Flag	Coverage Δ
unit	`41.09% <3.30%> (-0.79%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

… feature/secret-resolution

appurva21

Are we tracking changes to make scripts work separately?

appurva21 · 2026-02-19T19:31:19Z

lib/runner/index.js

                certificates: options.certificates,
-                proxies: options.proxies
+                proxies: options.proxies,
+                secretResolvers: options.secretResolvers


Needs to be added to README

appurva21 · 2026-02-19T19:34:25Z

lib/runner/index.js

     * @param {String} [options.entrypoint.lookupStrategy=idOrName] strategy to lookup the entrypoint [idOrName, path]
     * @param {Array<String>} [options.entrypoint.path] path to lookup
     * @param {Object} [options.run] Run-specific options, such as options related to the host
+     * @param {Object} [options.secretResolvers] - Object mapping provider names to resolver configs.


I don't think runtime needs to be aware of all kinds of sources and their respective resolvers. Runtime should just accept one resolver, which then can encapsulate all this (including retry and timeout).

Let's follow the same pattern as options.script.packageResolver etc.

Makes sense. Will work on this and update.

appurva21 · 2026-02-19T19:35:00Z

lib/runner/extensions/request.command.js

Why do we have these changes?

Removing them completely now as not needed anymore. previous approach resolved secret here so they were left out.

appurva21 · 2026-02-19T19:47:56Z

lib/runner/extensions/item.command.js

+                    if (err) {
+                        // Secret resolution failed - this is fatal for the current item
+                        // (same pattern as pre-request script skip)
+                        self.triggers.item(err, coords, item, null, { isSecretResolutionFailed: true });


isSecretResolutionFailed why do we need this?

@appurva21 item trigger gets following args (err, coords, item, result, options). Added this to determine that error was because of the secret resolution and not in other place like pre-request, request, or tests. I don't think there's current usage so it can be removed if needed.

Ideally, if we expect from consumer to provide correct codes/errors from secretResolver side, it's not needed since error will have that info but if not then it'd be usefull field.

it's similar to how we pass { isSkipped: true } in case of execution skip.

appurva21 · 2026-02-19T20:02:23Z

lib/runner/resolve-secrets.js

+        return callback();
+    }
+
+    var usedVariables = findUsedVariables(payload.item),


If we just run this logic on used variables, how would we make it work in scripts?

Yes, we'll be resolving all secrets for now. making related changes.

appurva21 · 2026-02-19T20:08:00Z

lib/runner/resolve-secrets.js

+    }
+
+    if (values.members && Array.isArray(values.members)) {
+        values.members.forEach(function (variable) {


There is an each function on values - https://github.com/postmanlabs/postman-collection/blob/b3d052bdfcf304a8243f73618c6aa962ca517115/lib/collection/property-list.js#L412

appurva21 · 2026-02-19T20:09:00Z

lib/runner/resolve-secrets.js

+            }
+        });
+    }
+    else if (Array.isArray(values)) {


This is to handle?

scope can be converted to VariableScope if it is not already one

appurva21 · 2026-02-19T20:15:35Z

package.json

 {
  "name": "postman-runtime",
-  "version": "7.51.1",
+  "version": "7.52.0-beta.2",


Let's revert this

appurva21 · 2026-02-19T20:15:54Z

package.json

    "node-oauth1": "1.3.0",
    "performance-now": "2.1.0",
-    "postman-collection": "5.2.0",
+    "postman-collection": "5.3.0-beta.1",


note: bump to correct version before merge

…esolver function to be single instead of interface

VShingala · 2026-02-20T07:02:53Z

lib/runner/extensions/request.command.js

Removing them completely now as not needed anymore. previous approach resolved secret here so they were left out.

VShingala · 2026-02-20T10:59:08Z

lib/runner/extensions/item.command.js

+                    if (err) {
+                        // Secret resolution failed - this is fatal for the current item
+                        // (same pattern as pre-request script skip)
+                        self.triggers.item(err, coords, item, null, { isSecretResolutionFailed: true });


@appurva21 item trigger gets following args (err, coords, item, result, options). Added this to determine that error was because of the secret resolution and not in other place like pre-request, request, or tests. I don't think there's current usage so it can be removed if needed.

Ideally, if we expect from consumer to provide correct codes/errors from secretResolver side, it's not needed since error will have that info but if not then it'd be usefull field.

it's similar to how we pass { isSkipped: true } in case of execution skip.

VShingala · 2026-02-20T12:46:27Z

lib/runner/resolve-secrets.js

+        return callback();
+    }
+
+    var usedVariables = findUsedVariables(payload.item),


Yes, we'll be resolving all secrets for now. making related changes.

VShingala · 2026-02-20T13:02:53Z

package.json

    "node-oauth1": "1.3.0",
    "performance-now": "2.1.0",
-    "postman-collection": "5.2.0",
+    "postman-collection": "git+ssh://git@github.com:postmanlabs/postman-collection.git#feature/secret-resolution",


We'll update this to correct version once we have related PR merged.

PR: postmanlabs/postman-collection#1421

appurva21 · 2026-02-20T23:16:48Z

lib/runner/resolve-secrets.js

+        return callback();
+    }
+
+    secretResolver({ secrets, payload }, function (err, result) {


Do we need to send the payload to secretResolver?

@appurva21 Yes, it's used for context in cases like domain based resolution and such. i.e. If request URL is matching with allowed domain for vault secret, we'd resolved otherwise not.

… instead of payload

VShingala and others added 5 commits January 16, 2026 21:15

Pre-resolve secrets within runtime using secret resolvers

91e8b44

Added secretResolver interface for secret resolution

c4f12d0

Update dependencies

be2e575

Add changelog

5d42846

7.52.0-beta.1

825fa9a

VShingala and others added 3 commits February 13, 2026 16:19

Use proper schema for secrets and renamed type to source

adbdcf8

Merge branch 'develop' of github.com:postmanlabs/postman-runtime into…

342b8e4

… feature/secret-resolution

7.52.0-beta.2

45f8eb3

appurva21 requested changes Feb 19, 2026

View reviewed changes

appurva21 reviewed Feb 19, 2026

View reviewed changes

VShingala added 5 commits February 20, 2026 09:11

update postman-collection version to temp branch

af4420a

added secret support in script via safe flag and changed the secret r…

62aed74

…esolver function to be single instead of interface

add options.secretResolver documentation

4c12ace

added integrtion tests for safe secret access within test scripts

61b024d

revert back the original package.json version

2cb6adf

VShingala commented Feb 20, 2026

View reviewed changes

VShingala changed the title ~~[Draft] Adds support for secret resolution via support of secretResolvers/~~ Adds support for secret resolution via support of secretResolver. Feb 20, 2026

VShingala marked this pull request as ready for review February 20, 2026 14:41

appurva21 reviewed Feb 20, 2026

View reviewed changes

appurva21 and others added 6 commits February 20, 2026 22:54

version bump

5265a09

7.52.0-beta.3

2ff37bd

chore: update dependencies

719f75d

7.52.0-beta.4

09d98c9

Update dependencies

7f03817

rename "safe" to "allowedInScript" and only provide url as second arg…

971af12

… instead of payload

Conversation

VShingala commented Feb 4, 2026

Overview

Uh oh!

codecov bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

appurva21 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov bot commented Feb 4, 2026 •

edited

Loading