Merge pull request #42 from t3rr11/bugfix/fix-various-bugs-from-user-testing

FIX/FEAT: Fixing a bunch of bugs found during user testing

Author: t3rr11

apps/backend/package.json

@@ -24,6 +24,7 @@
   "devDependencies": {
     "@types/node": "^25.6.0",
     "@types/node-fetch": "^2.6.13",
+    "selfsigned": "^5.5.0",
     "tsx": "^4.21.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.4"

apps/backend/src/controllers/collection.controller.ts

@@ -1,7 +1,7 @@
 import { FastifyPluginAsync } from 'fastify';
 import { CollectionService } from '../services/collection.service';
 import { OpenApiService } from '../services/openapi.service';
-import type { AuthConfig } from '../models/proxy';
+import type { AuthConfig, BodyType, FormDataEntry } from '../models/proxy';
 import type { SyncApplyBody } from '../models/openapi-sync';
 
 interface Options {
@@ -45,13 +45,13 @@ const collectionController: FastifyPluginAsync<Options> = async (server, opts) =
 
   server.post<{
     Params: { id: string };
-    Body: { name: string; method: string; url: string; headers?: Record<string, string>; body?: string; auth?: AuthConfig; folderId?: string };
+    Body: { name: string; method: string; url: string; headers?: Record<string, string>; body?: string; bodyType?: BodyType; formDataEntries?: FormDataEntry[]; auth?: AuthConfig; folderId?: string };
   }>('/collections/:id/requests', async (request, reply) => {
-    const { name, method, url, headers, body, auth, folderId } = request.body;
+    const { name, method, url, headers, body, bodyType, formDataEntries, auth, folderId } = request.body;
     if (!name || !method || !url) {
       return reply.code(400).send({ error: 'Name, method, and URL are required' });
     }
-    const saved = await collectionService.addRequest(request.params.id, { name, method, url, headers, body, auth, folderId });
+    const saved = await collectionService.addRequest(request.params.id, { name, method, url, headers, body, bodyType, formDataEntries, auth, folderId });
     return reply.code(201).send(saved);
   });
 

apps/backend/src/controllers/oauth.controller.ts

@@ -88,16 +88,16 @@ const oauthController: FastifyPluginAsync<Options> = async (server, opts) => {
     return reply.code(204).send();
   });
 
-  server.post<{ Body: { configId: string; code: string; codeVerifier?: string; redirectUri: string } }>(
+  server.post<{ Body: { configId: string; code: string; codeVerifier?: string; redirectUri: string; insecureTls?: boolean } }>(
     '/oauth/token',
     async (request, reply) => {
-      const { configId, code, codeVerifier, redirectUri } = request.body;
+      const { configId, code, codeVerifier, redirectUri, insecureTls } = request.body;
       if (!configId || !code || !redirectUri) {
         return reply.code(400).send({ error: 'Missing required fields: configId, code, redirectUri' });
       }
 
       try {
-        const result = await oauthService.exchangeToken({ configId, code, codeVerifier, redirectUri });
+        const result = await oauthService.exchangeToken({ configId, code, codeVerifier, redirectUri, insecureTls });
         return reply.code(200).send(result);
       } catch (error) {
         if (axios.isAxiosError(error)) {
@@ -111,16 +111,16 @@ const oauthController: FastifyPluginAsync<Options> = async (server, opts) => {
     },
   );
 
-  server.post<{ Body: { configId: string; refreshToken: string } }>(
+  server.post<{ Body: { configId: string; refreshToken: string; insecureTls?: boolean } }>(
     '/oauth/refresh',
     async (request, reply) => {
-      const { configId, refreshToken } = request.body;
+      const { configId, refreshToken, insecureTls } = request.body;
       if (!configId || !refreshToken) {
         return reply.code(400).send({ error: 'Missing required fields: configId, refreshToken' });
       }
 
       try {
-        const result = await oauthService.refreshToken({ configId, refreshToken });
+        const result = await oauthService.refreshToken({ configId, refreshToken, insecureTls });
         return reply.code(200).send(result);
       } catch (error) {
         if (axios.isAxiosError(error)) {
@@ -134,16 +134,16 @@ const oauthController: FastifyPluginAsync<Options> = async (server, opts) => {
     },
   );
 
-  server.post<{ Body: { configId: string; token: string; tokenTypeHint?: string } }>(
+  server.post<{ Body: { configId: string; token: string; tokenTypeHint?: string; insecureTls?: boolean } }>(
     '/oauth/revoke',
     async (request, reply) => {
-      const { configId, token, tokenTypeHint } = request.body;
+      const { configId, token, tokenTypeHint, insecureTls } = request.body;
       if (!configId || !token) {
         return reply.code(400).send({ error: 'Missing required fields: configId, token' });
       }
 
       try {
-        const result = await oauthService.revokeToken({ configId, token, tokenTypeHint });
+        const result = await oauthService.revokeToken({ configId, token, tokenTypeHint, insecureTls });
         return reply.code(200).send(result);
       } catch (error) {
         if (axios.isAxiosError(error)) {
@@ -157,14 +157,14 @@ const oauthController: FastifyPluginAsync<Options> = async (server, opts) => {
     },
   );
 
-  server.post<{ Body: { configId: string } }>('/oauth/client-credentials', async (request, reply) => {
-    const { configId } = request.body;
+  server.post<{ Body: { configId: string; insecureTls?: boolean } }>('/oauth/client-credentials', async (request, reply) => {
+    const { configId, insecureTls } = request.body;
     if (!configId) {
       return reply.code(400).send({ error: 'Missing required field: configId' });
     }
 
     try {
-      const result = await oauthService.clientCredentials(configId);
+      const result = await oauthService.clientCredentials({ configId, insecureTls });
       return reply.code(200).send(result);
     } catch (error) {
       if (axios.isAxiosError(error)) {
@@ -177,16 +177,16 @@ const oauthController: FastifyPluginAsync<Options> = async (server, opts) => {
     }
   });
 
-  server.post<{ Body: { configId: string; username: string; password: string } }>(
+  server.post<{ Body: { configId: string; username: string; password: string; insecureTls?: boolean } }>(
     '/oauth/password',
     async (request, reply) => {
-      const { configId, username, password } = request.body;
+      const { configId, username, password, insecureTls } = request.body;
       if (!configId || !username || !password) {
         return reply.code(400).send({ error: 'Missing required fields: configId, username, password' });
       }
 
       try {
-        const result = await oauthService.passwordFlow({ configId, username, password });
+        const result = await oauthService.passwordFlow({ configId, username, password, insecureTls });
         return reply.code(200).send(result);
       } catch (error) {
         if (axios.isAxiosError(error)) {

apps/backend/src/dtos/oauth.dto.ts

@@ -21,21 +21,38 @@ export const tokenExchangeSchema = z.object({
   code: z.string().min(1, 'Authorization code is required'),
   codeVerifier: z.string().optional(),
   redirectUri: z.string().min(1, 'Redirect URI is required'),
+  insecureTls: z.boolean().optional(),
 });
 
 export const tokenRefreshSchema = z.object({
   configId: z.string().min(1, 'Config ID is required'),
   refreshToken: z.string().min(1, 'Refresh token is required'),
+  insecureTls: z.boolean().optional(),
 });
 
 export const tokenRevokeSchema = z.object({
   configId: z.string().min(1, 'Config ID is required'),
   token: z.string().min(1, 'Token is required'),
   tokenTypeHint: z.string().optional(),
+  insecureTls: z.boolean().optional(),
+});
+
+export const clientCredentialsSchema = z.object({
+  configId: z.string().min(1, 'Config ID is required'),
+  insecureTls: z.boolean().optional(),
+});
+
+export const passwordFlowSchema = z.object({
+  configId: z.string().min(1, 'Config ID is required'),
+  username: z.string().min(1, 'Username is required'),
+  password: z.string().min(1, 'Password is required'),
+  insecureTls: z.boolean().optional(),
 });
 
 export type CreateOAuthConfigDto = z.infer<typeof createOAuthConfigSchema>;
 export type UpdateOAuthConfigDto = z.infer<typeof updateOAuthConfigSchema>;
 export type TokenExchangeDto = z.infer<typeof tokenExchangeSchema>;
 export type TokenRefreshDto = z.infer<typeof tokenRefreshSchema>;
 export type TokenRevokeDto = z.infer<typeof tokenRevokeSchema>;
+export type ClientCredentialsDto = z.infer<typeof clientCredentialsSchema>;
+export type PasswordFlowDto = z.infer<typeof passwordFlowSchema>;

apps/backend/src/dtos/proxy.dto.ts

@@ -9,6 +9,7 @@ export const proxyRequestSchema = z.object({
   bodyType: z.enum(['json', 'form-data', 'x-www-form-urlencoded']).optional(),
   formDataEntries: z.array(formDataEntrySchema).optional(),
   auth: authConfigSchema.optional(),
+  insecureTls: z.boolean().optional(),
 });
 
 /** Stream request has the same shape as a regular proxy request */

apps/backend/src/models/collection.ts

@@ -19,13 +19,17 @@ export interface Collection {
   id: string;
   name: string;
   description?: string;
+  isSystem?: boolean;
   folders: Folder[];
   requests: SavedRequest[];
   openApiSpec?: OpenApiSpecLink;
   createdAt: number;
   updatedAt: number;
 }
 
+/** Stable id of the system-managed catch-all collection. */
+export const UNCATEGORIZED_COLLECTION_ID = 'uncategorized';
+
 export interface SavedRequest {
   id: string;
   name: string;

apps/backend/src/models/proxy.ts

@@ -53,6 +53,11 @@ export interface ProxyRequest {
   bodyType?: BodyType;
   formDataEntries?: FormDataEntry[];
   auth?: AuthConfig;
+  /**
+   * When true, ignore TLS certificate errors (e.g. self-signed certs in
+   * chain). Driven by a global user setting on the frontend.
+   */
+  insecureTls?: boolean;
 }
 
 export interface ProxyResponse {

apps/backend/src/services/collection.service.ts

@@ -1,7 +1,8 @@
 import { CollectionRepository } from '../repositories/collection.repository';
 import { AppError } from '../errors/app-error';
 import type { Collection, SavedRequest, Folder } from '../models/collection';
-import type { AuthConfig } from '../models/proxy';
+import { UNCATEGORIZED_COLLECTION_ID } from '../models/collection';
+import type { AuthConfig, BodyType, FormDataEntry } from '../models/proxy';
 
 export interface MoveRequestParams {
   sourceCollectionId: string;
@@ -21,6 +22,28 @@ export interface MoveFolderParams {
 export class CollectionService {
   constructor(private readonly repo: CollectionRepository) {}
 
+  /**
+   * Idempotently ensure the system-managed "Uncategorized" collection exists.
+   * Used as a catch-all when users save a request without picking a collection.
+   */
+  async ensureUncategorizedCollection(): Promise<Collection> {
+    const existing = await this.repo.getById(UNCATEGORIZED_COLLECTION_ID);
+    if (existing) return existing;
+
+    const now = Date.now();
+    const collection: Collection = {
+      id: UNCATEGORIZED_COLLECTION_ID,
+      name: 'Uncategorized',
+      description: 'Saved requests that do not belong to a specific collection.',
+      isSystem: true,
+      folders: [],
+      requests: [],
+      createdAt: now,
+      updatedAt: now,
+    };
+    return this.repo.create(collection);
+  }
+
   async getAll(): Promise<Collection[]> {
     return this.repo.getAll();
   }
@@ -47,6 +70,9 @@ export class CollectionService {
   }
 
   async update(id: string, updates: Partial<Pick<Collection, 'name' | 'description'>>): Promise<Collection> {
+    if (id === UNCATEGORIZED_COLLECTION_ID) {
+      throw AppError.badRequest('The Uncategorized collection cannot be renamed.');
+    }
     const collection = await this.repo.update(id, updates);
     if (!collection) {
       throw AppError.notFound('Collection not found');
@@ -55,6 +81,9 @@ export class CollectionService {
   }
 
   async delete(id: string): Promise<void> {
+    if (id === UNCATEGORIZED_COLLECTION_ID) {
+      throw AppError.badRequest('The Uncategorized collection cannot be deleted.');
+    }
     const deleted = await this.repo.delete(id);
     if (!deleted) {
       throw AppError.notFound('Collection not found');
@@ -69,17 +98,25 @@ export class CollectionService {
       url: string;
       headers?: Record<string, string>;
       body?: string;
+      bodyType?: BodyType;
+      formDataEntries?: FormDataEntry[];
       auth?: AuthConfig;
       folderId?: string;
     },
   ): Promise<SavedRequest> {
+    if (collectionId === UNCATEGORIZED_COLLECTION_ID) {
+      await this.ensureUncategorizedCollection();
+    }
+
     const newRequest: SavedRequest = {
       id: `req-${Date.now()}-${Math.random().toString(36).substring(7)}`,
       name: data.name.trim(),
       method: data.method.toUpperCase(),
       url: data.url.trim(),
       headers: data.headers,
       body: data.body,
+      bodyType: data.bodyType,
+      formDataEntries: data.formDataEntries,
       auth: data.auth,
       folderId: data.folderId,
       collectionId,

apps/backend/src/services/environment.service.ts

@@ -1,8 +1,8 @@
 import { EnvironmentRepository } from '../repositories/environment.repository';
-import { substituteInRequest } from '../utils/variable-substitution';
+import { substituteInAuth, substituteInRequest } from '../utils/variable-substitution';
 import { AppError } from '../errors/app-error';
 import type { Environment, EnvironmentsData } from '../models/environment';
-import type { ProxyRequest } from '../models/proxy';
+import type { AuthConfig, ProxyRequest } from '../models/proxy';
 
 export class EnvironmentService {
   constructor(private readonly repo: EnvironmentRepository) {}
@@ -46,4 +46,9 @@ export class EnvironmentService {
     const active = this.repo.getActive();
     return substituteInRequest(partialRequest, active);
   }
+
+  substituteInAuth(auth: AuthConfig | undefined): AuthConfig | undefined {
+    const active = this.repo.getActive();
+    return substituteInAuth(auth, active);
+  }
 }