Kong Insomnia Stream, 10 May 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Insomnia Stream 2022 05 10

Description

A weekly stream focused on Insomnia's open source community.

Join us on the #stream channel over on the Insomnia community slack: https://chat.insomnia.rest

3:21 What is the Insomnia Stream?
7:12 OAuth 2 Credentials Bug https://github.com/Kong/insomnia/issues/4715
28:35 Single quotes encoding in URLs https://github.com/Kong/insomnia/issues/4703
44:47 Unresponsive loading plugins https://github.com/Kong/insomnia/issues/4701
50:09 OAS3 example lint error https://github.com/Kong/insomnia/issues/4683

A

B

Hi everyone, oh wow, my head is bigger than you. There we go about the same.

B

um Welcome to insomnia stream, I'm dimitri, my name is wills and we work on the insomnia team uh trying to bring you the best rest, client, graphql, client, grpc client you ever did see. I want to talk about what the stream is super quick, um I'm inside and okay. Thank you. So this is a planning document that we have that's open to the public. You can come see it, I'm going to put it up on the screen here. Let's see, let's see chat.insomnia.rest.

B

So if you come to chat.insomnia.rest you'll see these things and what this is is a planning document that describes what the stream is, what it's for, who it's for, how we schedule it, how we plan it? um What we do to run it um everything even like details. You might not find interesting, like oh yeah, this okay see oops I'm on the wrong window, zoom everything in super huge, I would say perhaps the hardest thing about doing.

B

This is remembering just how large things need to be zoomed in okay um so anyway, uh the purpose of I want to go to this portion here like what are the priorities. So the first priority that we have here is anybody that comes and we've had. People come on the stream, anybody that comes on and has any questions or would like to look at any any pr's or issues or something like that. That's the first priority for us.

B

The second priority is things that have this insomnia stream github label and the third priority is insomnia, github issues. Today we decided we would uh go a little bit out of order and triage some of the unanswered. uh um You know open tickets that have been filed. We have a decent number of them and I think it's a good thing to to do. I mean this is a definitely like for the interest of the public, I think so um yeah. I guess the way to do that. Issues is open, okay and then also unverified.

B

We want to look at and we're going to sort them by least commented and then we're going to start. um Okay, sound good wills.

C

Yeah, do we want to look at? I don't know if there's a way to also sort by newest um but or for yeah. I.

B

Don't know work by comment: okay, we could sort by newest and then uh and then just without comments, comments, yeah, okay, so I'll open these three and like, let's, let's start from there.

C

I know it's super frustrating to have like old issues that are not answered either, um but just to.

D

C

Yeah make sure we get the the latest things that people are having issues with today. So.

B

All right, so here we are um when we have hey colin how's it going.

D

B

Good, did you hear what we're what we're doing today.

D

Nope I haven't heard anything.

B

All right so this will this will be cool, we're going through issues. um So if anyone that doesn't know colin well, you want to introduce yourself who are you.

D

uh I'm colin, I do devops. I guess, though, that's always a controversial thing to say, because now we have to nitpick over what a devops is, but yeah largely. I write.

B

Glue code, which fits admin but better that's what I tell people yeah.

D

I'd say it's almost closer to release engineering, but.

B

Yeah yeah yeah. um Well, I mean like sre, wasn't a thing until pretty recently in terms of the the global scheme of things, so I don't know yeah all right. Well, what we're doing is we're uh we're going through issues and we're trying to triage the ones that haven't the I'm. Looking for, like some adjective for this, the the unspoken four or something you know, the ones that haven't been responded to at all so lost.

D

B

Lost children yeah I like that. That's pretty good.

C

Peter pan's peter.

B

So, okay, uh so here's one when using auth, uh let me see if I can make it a little bigger. You could get rid of that side pane. But okay anyway, when using oauth, 2 authentication with client credentials, users can switch between as basic auth header and in request body, okay. So the first thing we need to do for sure pull up insomnia. I probably don't have the very latest one installed because I usually keep it like one version behind, so I can test regressions. If such a thing occurs.

B

um Let's just like delete this. I don't even know or care so yeah like, let's just create a new request, collection, sure, sorry, didn't click um all right, so they're saying when using oauth, 2 authentication, okay, so first of all we have to do the we have to make a new request and then we do um oauth 2 authentication. So here we go.

C

B

A

C

Credentials yep.

A

Okay uh I'll say.

C

That's the yep okay.

B

C

Users, you got it you're an oauth expert. Now.

B

I've used it twice.

B

Oh just kidding, I've used it three times as uh when switching between as basic auth header and in request body. So this seems like a incomplete sentence. To me I don't know okay, but as basic yeah. There.

C

It is the in the advanced settings, the credentials options.

B

Oh okay, okay, they're, saying.

C

I think they're just saying you can't toggle it. There is a toggle for it.

B

Whether or not to send request, could you do you know what this is? Could you give us a primer on what this is real, quick, yeah.

C

So this my understanding of what should happen um based on this. This ux is, if it's, if you select as basic auth header, then the if you uh get rid of the tool tip first um and scroll up a little bit um that uh yeah, so that client secret basically is is the credential or maybe the client id and the client secret.

C

Both um forget the exact how it's encoded, um but basically, if you select as basic auth header, then it's going to be those credentials are going to be sent in the in a header in the authorization header with like a prefix basic and then there's going to be some encoding of the clan id client secret. um It might just be client secret. I can't exactly remember, but then, if you select as request body or in request body.

A

C

Yeah it's encoded somewhere in the somehow somewhere in the body, and then that may also be standard um like.

B

C

The post request, um I can't remember the example.

B

Where would it go like as plain text.

C

I think it's I think it's in the rfc like as a standard like there's some json body that gets sensed. Okay, I will look up. I will look that up while uh you want, if you want to try to repro.

B

Whoa, this looks bad, then it says: they're saying requests are always sent in the request body, regardless of setting.

A

B

No, that doesn't seem like a good thing. Okay, it's creating a request. Oh oh, they have all the steps here we just should. We should have read us right ahead. Okay, retrieve a token, this should work so far switch potential credentials to in request body, as many oauth providers will not return a token when the body contains credentials.

B

This must fail to get a token to proceed. With this use case, I'm gonna have to read that three times. I think many auth providers will not return a token when the body contains credentials. That's this in request body thing, so they don't okay, so yeah, they're saying this is the in request. Body thing is not something that it's.

C

Not used, which is not used, which is why it's not the default yeah.

B

Yeah, this must fail to get a token to proceed with this use case.

C

So it looks like after you toggle it and then try to toggle it back to use the header. It doesn't actually use the header.

B

C

That's what that's what it looks like to me.

B

uh So we can verify, I could just yeah, we will um insomnia smoke test, so uh we have like uh what do we have here? We have some serve, I think is gonna run.

B

I think that's what we do to get the oauth thing going: okay, let's try.

C

Yeah again, like I'm, not exactly sure if this, um if this key click server will accept client credentials.

B

Well, at least we can see what it sends, because I mean whether or not we can. We can enter exactly uh the thing. So then I want to go. uh Where is that on disk? Okay? Okay? So let's go to the smoke test. We have an oauth thingamajin, um okay, too many too many cooks in this kitchen over here, okay server, maybe no fixtures is probably in fixtures there. It is oh auth yeah.

B

I bet you that's what it is I'll just copy it, because that's I've been a fan of the copy feature lately, find it easy um look, look how easy that was. Okay, um client credentials! That sounds like a start.

B

Let's go look here: okay, advanced options as basic auth header is this. Is this one of those oauth like it's like a separate request that it sends and we're not gonna see it.

C

B

I don't know: okay.

C

Maybe maybe because that that's kind of what this.

B

Okay, let's try anyway, see what it returns. So, let's look at the timeline here. um The timeline shows us um okay, authorization bearer so.

C

That's it that's, actually not technically correct either it's not supposed to use the bearer. It's supposed to use basic.

C

But it's also it's weird that it's sending an oidc client credential thing, but maybe that's maybe that's the url that you configured.

B

Yeah, that's this. I think this is not the the okay. So where can I get to the um there's like a place where I can no, but I can't see it unless there's an error, I think maybe okay well yeah.

A

B

One way or the other, let's try to flip it, okay. So what we observed anyway is that it appears to have sent it as a header and it did not send anything. There is no body like, let's, let's add a body here just for funsies. Oh.

C

uh It did it didn't, show you, it didn't, show it actually sending the token uh request. So so.

A

B

Is I know what's happening, I know, what's.

C

Happening so so, this is preparing the request to send. If you look in the timelines preparing the request to send to your local host port 4010 at the top.

B

C

um Right with that oitc client credential, that's the actual request that you're sending at the very very top of your insomnia window.

B

This thing, but.

C

Not that yeah, if you expand the uh the oauth section above the timeline, we can look at the. If you go up to the top, you can see that access token url is also port 4010. But it's oic token that's the token endpoint in on your authorization, server and oauth, and so it's hitting that endpoint to get the bearer token that it included on the client credential request.

B

So it's hidden.

C

B

C

Yeah, so it's actually, I don't know if you can see in the terminal like what happened yeah. I.

B

Can't but we can change that out.

B

I think there's logging on that. Let's see server index cookies oidc get oauth routes. It was like token. We wanted to see the token endpoint yeah character. um Let's see, I wait id token.

B

No, no, I'm just gonna search, slash token. That does not come up reasonably nope. That also doesn't come up so where it is where is it specified? Oh, it's probably like some. Oh it's like built in somewhere, okay, client credentials. We got here.

B

We got mark howdy, mark.

A

B

Cool, so I think I'm not like the most familiar there ever was with this file, but I've poked around um we want to. Is it an.

C

Index somewhere.

B

Well, okay, so what happens? Is it has slash oibc and then it gives us it calls this function which makes the routes. So, let's see.

C

It's not uh if you go back to insomnia and look at the authorization url was it oidc, slash token.

B

Oh wow, okay yeah, um but I don't know why it's called ib token. Here. Okay, we need to find that function. Sorry, let's just go. Let's just take this the most because this is already taking some decent time. Is this whole file that function no up to line 253? Okay, so we want to like log. I don't really care where I want to like indiscriminately log anything that comes through here, so grant.save oidc provider register.

B

Oauth route.

C

uh That's that's uh register resource owner password, something an ropc.

B

Interaction, uid, url, encoded interaction,.

B

Okay, so I don't know okay, allow which of these things are imports. uh Oidc provider configuration okay, so I bet you it's here. If there's, if it's anywhere, if this is a oops, it's a function that we call to there. Okay, ydc config. So can we pass? Let's do this log? Is there like some kind of listen back channel result use? Oh man, this is uh oidc provider. I guess so they have their token endpoint. Here.

B

I just want to log everything.

A

B

Let's try it anyway and see if we can.

B

Pre-Pen listener.

A

B

Code token, I don't know what that is code token well, anywho. um Let's just try it uh oidc.

B

A

B

Did any of these look good excess token issued.

C

uh Yeah I mean I would want to see.

B

Anyway, I don't think it's going to work, but.

C

I mean what yeah, maybe I I would I'm wanting to see like the headers and request body that we send to that endpoint wherever it, wherever.

B

It lives the all right. Let's try it again see what happens here.

B

Okay, it says it's listening, bad request.

B

C

B

Is it invalid? No, I think it's because I I have to clear. I have to start like do this. Do that and then do that yeah! That's.

C

B

Because I restarted it completely um okay, so the timeline is still gonna show us that did we get? uh Did we get our? No? We did not get our console log. Well, anywho, um let's see if we can trigger the behavior, though that they're talking about um so in request body. Oh, I did switch. It.

B

It sends it one way.

C

So maybe maybe this is accepting it, but we we have no way of knowing like if the behavior actually changed or not, because we're not logging or can't see the headers and things.

B

Yep, I grew up through insomnia, datader and found the value. Insomnia request, tv credentials and bodies seems to be toggling correctly. Okay, that's good to know whatever underlying system gets, it doesn't change its behavior. If you duplicate the request, it doesn't copy that doesn't work.

B

The copy will have this behavior, but if you create an all new request and leave the default, it will retrieve this the token successfully. So let's do a really quick uh look-see. It's called what they even told us the name. I think here right credentials and body. Okay, so oops.

B

Essentials and body, okay, here's all the places, credentials and body are sent around um okay. Those are just a bunch of big big funny, guys um client secret. So if credentials and body.

B

P client, secret, okay, same thing here: duplicate code, duplicate code, okay, when this stuff was set up, it was done very quickly. Unfortunately, and a lot of these, uh these, like form elements for the oauth stuff, were just like raw like copy paste, as you can see by like yeah.

B

um This is for oauth to, though this is for like setting the flag. Okay, and here we don't have any tests. Okay, so one of the things we need is a is a test that demonstrates this. So all right, um when did they say they were able to do it.

B

So I think I think this, like you, tell me wills as I'm gonna type here, but this has come up a lot in the past and I think there needs to be somewhere in insomnia. There is a place where you can. Let me make this a little smaller, so I can like actually use it. There is a place where you can see if there's like a problem here, let's, let's like try this, um let's try some kind of like thing this. So you see this response timeline.

B

This shows you we have this. We have access to; it is what I'm trying to demonstrate. Oh yeah, and this this shows.

C

You, the headers and everything.

B

Yes, but you can't see this unless there's an error.

C

Oh, that's dumb.

B

Right, you used to not be able to see it at all I mean it was. It was only because somebody made up somebody made a thing saying hey. I need to see what this error shows us like show us here, and I can't do that.

B

um So we added that feature because it was kind of already there like ready to be because we make the request, like any other request, so we can show it like any other thing, um but I kind of think that what we need to do. Well, it's not going to take too long um response timeline.

B

Where is that in the code? Maybe we can just force it to always show as like a hack to just validate that this behavior this person is talking about is, is really happening. um Yeah. Let's.

C

Work on better ux to show it more often for.

B

Sure exactly uh graph wait: response timeline: okay, it's response. Debug modal response, debug modal; okay, so we register the modal. We show it here on error, so oauth to error. So, let's just like.

B

um Oauth2 error token const debug button. If token and error- um let's just say, if there's a let's just say, if there's a token okay, so that will probably work. Let's do a new tab here oops. I have to do like this. Okay.

B

um Run, I hope I don't have the bootstrap or something, but let's just try it. So what I'm expecting to see? What I'm expecting to see here is that it will show us the the little guy the little it's gonna look like it's an error, but anyway it'll show us the little guy whether or not there's an error, which means we'll be able to look at the the thing if it starts. Okay, um oh, this is like a whole new thing. uh It's what's in my clipboard.

B

The whole thing is in my clipboard: okay, let's create from clipboard mm-hmm. Is that so um fixtures? Oh off yammel, boom boom boom? Okay, okay, let's try again clipboard oauth testing great uh all right. Let's go to client credentials, token uh oauth, 2 response timeline.

B

We are close, okay, so.

A

C

There there's no header, no authorization, header, no basic auth header, we're sending the secret in the body. It looks like.

A

And we're getting.

C

A successful access token back.

B

C

This is the body, oh.

B

C

Okay, this is, it looks like that's being sent in the body.

B

Even though it shouldn't be so if you go and then we change this.

C

Advanced settings yeah, so that should be.

B

Okay, listen body, I'm going to send a gun and we're going to look it's in the body, but if I switch it back.

C

Wait wait, wait, wait, wait, wait, look in there do we have any kind of time. Do you know if this like sent an actual new request or if this was the same request from before.

A

B

Current time is 10 53, oh, that is that was a little bit ago. Let's try again yeah. It did not send a new one, okay, so yeah and, like I don't know, do that.

B

54-48 yeah, that's my time right now, still.

C

B

Still in the body yeah, okay, but I did.

B

I did it even though so it never. It never sends in the that's weird.

B

So it never sounds. Okay, we reproduced it.

B

We need a feature of an insomnia to enable to in order to be able to actually test it, but that's, I think it's a very reasonable feature.

C

Seems to me, like we've, reproduced something slightly different. It seems to me, like we reproduced that it's never sending a basic auth header, okay,.

A

B

C

B

um Yeah, let's look, requests are always sent in request body regardless of setting okay, so we're we're on the same page, um I'm curious.

B

Yeah well, the point is not to debug this, so I think we we validated that it. It can happen. um I'm gonna, I'm gonna, take note. I'm not gonna write it right now but, like you know, I'm gonna leave this open uh and we end it at 10, 56. yeah. I can just stop it like that.

B

I'm going to take note and push and give this person, I mean the best description, I'll write, a little description just to be friendly, because I don't have to watch 20 minutes of us fussing around, but I think in the last you know 90 seconds here we did the reproduction step, and you know this is confirmed. So this is a verified bug.

B

You agree, yeah yeah, all right, sweet single quotes are being encoded in url all right dated as per what is this? Oh okay? Yes, I've seen this before research.

C

Characters yeah yeah.

B

um Single quotes are delimiter characters, so they should not be encoded. This is even hinted at in the comments here. I wonder what the cause for excluding this character was.

A

B

Oh, I wrote that comment. I think um query string, yeah. Okay, um don't save uh query string. So, oh no, maybe not. Did I write this one nope? Okay. I just remember seeing this done.

B

This is gonna, get rough.

B

Because, like ultimately, the answer to this person's question is going to be because it was um yeah, I I mean like there's not a better like you, can't really make this work best for anyone, except by making it configurable.

B

um So, let's, let's try to. Let's try to reproduce it. Real, quick, so single quotes are delimiter characters. They should not be encoded. This is even hinted at. So how would we test this? We would do like. uh I don't know. um Mockbin.Org.

B

Echo and then, like um you, know, thing equals things.

B

um Why did I do something wrong?

B

Cannot read properties undefined reading trim what huh I don't know what's gonna. That's! That's super weird super weird. Let's go look here: toggle dev tools, type error set default protocol, client credentials. Okay, that would do it yep all right. We forgot to clear that one before okay, um so yeah.

C

A

C

The dev tools- just so you can see it. Oh yeah.

B

So the thing they're ultimately asking about is url encoding. Where can we really see so if we put in like, what's it what's an encoded character, uh a single.

C

B

Well right now: oh I see uh so so single so they're, saying single quote:.

C

Should be, but isn't it.

B

Should be but isn't okay, so then we can do single quote there and timeline. I guess we could look at the timeline. Okay, let's just wait. First, I need to close this locally.

B

Let's grab these things or like plus, I don't know, plus there so plus is encoded percent to be. Its vote is not um yeah. Thanks for thanks for coming on um robinson said, had fun gotta drop thanks thanks again so yeah I mean uh I don't know.

B

I think, there's there's got to be some kind of product manager around here we can throw under the bus.

C

um Yeah I mean I, I don't know why it was why it happened either, why it's unintentional or if it was intentional.

B

My worry would be if we change this now. After all these years, it will be uh like there's no.

C

B

People's stuff yeah. Well, I mean ultimately it shouldn't matter because your server should be able to handle both. You know, theoretically speaking, that's what the point of encoding is, but um what this person would want. I mean, let's just let's just try it for a second um I'm going to close this. What this person would want would be.

B

Why was it all that logging that was kind of weird um we'll keep the oauth server open? Why not? um Oh, actually, before I do that we're gonna, add a single quote to this list. Okay, so what this person would want make sure we're on the same page I'll, send them this.

B

Video and then we can see if they agree, they would want to see it encoded yeah, I don't know, do we just do we just give people the option, because, like the other thing about a tool like insomnia, is I try to tell people? Sometimes insomnia is a is a descriptive tool, not a prescriptive tool, and what I mean by that is like it doesn't matter. What's right, sometimes you use a tool like insomnia to test something that is known to be wrong.

B

If you want to see what your server is going to like how it's going to respond, if you do something crazy, because you know people do crazy, you know like someone, will come and send some wild requests that, like trying to break your server, but you kind of want to know, what's going to happen if it if that goes down- and you don't want insomnia getting in there- oh, it didn't still didn't. Do it well, what sub delimiters?

B

C

B

It still didn't encode it so maybe they're somewhere else well,.

C

It's a little small, so I can't see, but oh.

B

Sorry there there we go um delimiters character, whitelist, url path, character, whitelist,.

A

B

Oh, that's a white list wait, so why is it wait? A second wait. A second wait, a second. Why is it good.

C

Go back to insomnia.

B

Missing from this list, I added so the plus was encoded.

C

Okay, this is what I can't really see very well.

B

Oh, I'm sorry, uh let me make it bigger than I can.

C

The plus was encoded there and, as the.

B

Plus would be quoted here, but not this google quote yeah open in market, but um interesting single quote included is percent 27.. So, okay, here's here's a question. I would just like to know because I bet you this is happening somewhere in the browser there's like url in code or uh in code uri.

B

um Let's do like and then plus just to see. Okay encode uri component.

B

Yeah, that's probably the reason it's using encode uri component. So uh let's, let's see real quick and then we should move on. um Encode uri component doesn't encode single quotes. This person is no doubt going to be saying something very similar, uh customize settings off- I I don't know so what kind of okay?

B

um If you only want to escape single quotes, you could do okay, yeah.

B

This person was writing php, michael.

C

Yeah these people are just trying to solve the problem, but if you go up to that, first answer: there's like the: uh why are you supposed to use those things comparing this great stream purchasing global blog?

C

B

C

I don't know if this is necessarily the best.

B

We're going down we're going down a rabbit, hole; okay, uh we need to we need to say I.

C

Think I think what what you said earlier um I'll give you credit for it was you know, insomnia is a, would you say, descriptive, prescriptive yeah.

B

It's like we don't care about what's right around here I mean we want to make things to standards, but we also want people to have the option to do crazy to do wild things. I mean crazy is not the right word, but we want people to be able to do uh deliberately destructive, behaviors um and.

C

Imagine if you're trying to send an actual single quote in the uri, your url and insomnia, automatic, auto, magically encodes that and then there's no way to send a single quote in the uri. And you need to test what happens on your server.

B

That's the argument, though, the problem with saying that is that same argument could be made for this plus guy here, like yeah, really, we should be able to make an option for people to not encode any of it.

B

um So I don't think such an option exists. Let's just check.

C

But it seemed like- and this is showing my ignorance a little bit, but um it seems like what you just showed in the browser having the browser that encode your I component, encode the plus sign, but not the single quote. Yeah.

B

Exactly yeah, it seems like at least the.

C

Current behavior of insomnia is like auto magic. In the same way, the browser is.

B

Yep- um and I think that's what's probably happening like if we look uh so I don't see a setting for that. But if we look in the um encode- u r, I component, um oh in fact, right in this file- yeah. uh Well, that's a little different, oh yeah, encode, encode, uri component and replace and and remove the percent signs.

B

uh Encode it offer ignores, do a special encode of ignorance, character, oh ignored characters, so they aren't touched. This first pass surrounds them with a special tag. uh Okay, so we do some. We do some nonsense to to protect the things we want to encode and then we flip it back. Then we do the encoding and then we flip it back. So that's what's going on here, and I bet you this is using that white list thing that we had. We saw above um so yeah. This is doing some temporary wrapping.

B

It removes the encoding character, that's what this is. Does some wrapping with this raw thing and then unwraps. The raw thing replaces them replaces raw with nothing and decodes. Yeah okay um seems like a lot of work yeah. Well, um so I don't know what the motivation find been like this for quite some time, so I don't know what the motivations were.

B

um Oh, it explains it here: okay, well, the code was clear enough. I think so. That's fine! um We.

C

Had a question in the chat also.

B

Oh yeah, um what does it show on the query? Tab? Okay, let's take a look, so uh query tab.

C

You have some oh.

B

Yeah, there's a preview yeah, that's that's way more helpful than what we were looking at before. So it does show you what it's going to really send good point, um but I guess this. This applies to more than just queries right, because, if I did like echo plus was that going to work? What that's a little interesting.

A

B

But it does encode it there. Oh god.

C

You still have your changes right.

B

Oh, I have my change. Oh oh, oh, okay, yeah right right! Let's take that.

A

B

I probably did and then let's just let's just try, this will be a salacious screenshot. um Thank you for pointing that out in the chat. uh Stalin. Is that how you would say it?

B

um I had a friend of mine whose last name was spelled r-o-s-t.

B

And nobody could ever get it right, it's like, they would see it and think. Is it rost? It was ross, but they would say like? Is it roost? um What was? Was he uh getting rosted a lot not for his? If not for the name? No, I don't know, but.

B

So what we see here is that, oh boy, this is the screenshot.

C

Query parameter versus paths yeah.

B

It's it's handled differently, oh boy, oh boy, so something something needs to change. This is like super counterintuitive. I think uh I mean I think we need to make it configurable and we need to expose the list here and, and we can like, I don't feel bad breaking everyone. If we break towards the rfc um and then uh what happens.

B

Stella asks what happens if you import it to fields. um What do you mean here? Fill.

C

Out that form, I guess.

B

C

That's what you mean or if that's not what you mean, let us know and we'll stop doing this, but.

B

Z or let's just do like, I don't know we're going to stop a b c d e, so the yeah it has the same behavior here as it would up here. um Oh.

C

If you import from url.

B

Oh import from url.

B

Like if I do this.

B

B

It unencodes them.

B

And this is a this is a this is a strict. This is a tricky one, because I don't want to.

B

You know insomnia as part of insomnia's brand is to be simple and easy to use, but, like the it's, a genuine question like, is it simpler to see the messy thing, or is it simpler to see the encoded thing, or do we try to like show both and show like here's, the preview and here's the real thing?

B

You know it's like it's hard to know from a product standpoint where the best direction like where to draw the line in the sand for something like this, but all right, I think, we've I think, we've gotten like at least somewhere with it and I'm gonna send this screenshot to show like this is. This is weird. I think this is wills. Do you think this is reasonably or like can be converted into a request to allow people to configure it, and then we absolve ourselves of this whole thing.

C

I think so, and I you know again on the lines of simple and easy to use. I don't know if I'd want to go like specify the character set, that we will encode or not encode and stuff like that. But you know maybe we go that far, but maybe it's a hey. I want the rfc behavior or I want freedom, and I will encode myself.

C

You know something like that. I don't know yeah yeah we'll have to think about it, but okay.

B

um We'll follow up.

C

Yeah, I think it's, it's definitely a uh feature request for sure.

B

So, okay, next one then insomnia, reloads, the plug-ins, just fine, so insomnia gets caught up trying to reload the plug-ins. um This is on the first load, opening the plug-ins um stalin said. I always use import from url to see things easily. So I think if the things are not encoded there, it's fine, okay, yeah yeah. That is the. I guess that is really the function of it in the end of the day is like. I want to see it in a better way.

B

Because yeah, including, is almost like an implementation detail that you don't always really generally don't care that much about, of course, like we said, sometimes you want to test what happens, but.

A

B

Yep, um okay, so insomnia gets caught up, trying to reload the plugins. This is on first load. Opening up the plugin tab in preferences and sounding has become when was this 25 days ago, yikes um in some install insomnia bin for arch or any of them out there, and they all have the same behavior. Okay. I hope this isn't an arch specific thing house, with plugins insomnia, plug and save variables is the one in question causing the issue.

B

So let's use that or even the built in ones really, because I can purge the local install files and then load insomnia. It works because no plug-ins insomnia plug-in repo sync 3 does load, it seems, but only if that's the only plug-in, of course, so to reproduce 2.1.

B

Well, I'm close to that no matter this is, uh I need to like have a less ridiculous theme. uh Let's do this.

B

Oops, so what we want to do is we want to take insomnia, plug and save okay, so insomnia plug-in test. I don't know what that is. I think that's like I was testing something out.

B

um What reveal plugins folder.

B

uh Here yeah definitely, I was testing something out. Where is okay.

B

Gets caught up trying to reload the plugins. This is on the first load, opening up the plugins tab in preferences, so plugins.

A

You can, I don't know if you want to try.

C

To repro it with not that non-dev.

A

B

Yep: okay: let's try that in some yeah insomnia, what song is that latourius? Something like that? Oh.

C

I thought you were saying that there's a song lyric with insomnia in it.

B

Okay, insomnia plug-in. Oh that's weird! We must have something wrong. So did you notice what happened there? I installed locally? Oh and it went interesting to the wrong folder. So that sounds like a bug to me, but that's a different problem. Okay,.

C

B

Yeah I mean it's here.

B

What is this thing? I don't know this plug-in. um Let's see, what does it do? um Saves values from responses into variables. It provides an alternative to their request. Chaining. Okay, that's interesting, um so we'll keep this open for. A second reload seems to work. Fine.

C

If you quit and open it back up again just for kicks, uh if I quit the app and open that up again, oh okay,.

B

Oh they're saying it works on first load, but not after that. Is that what they said.

C

I think they said it doesn't work when you load it up and then go to the plugin.

B

Reload, the plugins: this is on first load, opening up the plug. Okay. I think they need the button. So first opening up the thing I clear they are reloading, it works. It works fine, so.

C

Maybe you need more plugins.

B

I don't know, um I don't know too many of them. Actually uh insomnia, plug-in faker that I know oh yeah. They said something about because there's only one plug-in. So let's do reload no problem. Let's do this. Reload doesn't happen. uh Let's quit and reopen.

B

C

The only other thing I can think of now is like architecture um that how they installed it or something.

A

Yeah those teams work fine.

B

Okay, uh no, no re-bro I'll I'll type in more on that later. Okay, let's keep going, we got, we got a good. Ten minutes might be able to do something. uh Here's one insomnia, reporting, oas3, valid os content example.

B

Example properties should match exactly one schema in one of wow. I don't understand uh much of that uh stalin asked. Is there any way to update already installed plugins yeah? That's the mechanism, the thing we were looking at, if you, you know, make a change or you want to update to a new version, then you would click that thing.

C

That reload plugins.

B

That would be yeah. That would be the the method. um Okay. I don't. I don't think I understand any of this. So, let's see if it no warning message, it's okay. I still don't get it okay. What is this about? uh Oas3 valid oas content example.

B

So, let's is that, like a thing in our code base.

C

A

I think it's related.

C

To the next thing that he's about to say in that, oh.

B

Okay: okay, following okay use, the following steps in insomnia's design document: tab: okay, so we'll grab that um I'm gonna, I'm gonna put this well, it's not the end of the world, but just to show people there there's a thing you can do here where you can do uh um details summary um example.

B

We come down to where it ends, and this is actually while we're here. This is jason.

B

Okay and then here.

B

Oh right, I did it right see, you got the thing great.

B

um View related warning related to line 43. Okay: let's do it, let's open insomnia quickly or did it hurt the victimless crime to open it locally.

D

B

43 is there an existing issue for this? No, I am no expert in specs. No one is don't worry, however, from my limited understanding, I see the example at line. 43 is valid. If not, please, let me know what the correct formatting is.

B

Okay, this is a spectral like lint rule thing, so let's go create a new design document and we'll paste the stuff here that we need and then line 43.

B

ah Okay, they were naming a lint rule, so example should match exactly one in the schema in one of.

B

Okay, so to do error response so to do error response. Can I make this smaller? Okay? I wish I could make the screen smaller, but I really shouldn't um yeah.

C

So, just just to walk through it. What we're saying here so in if you scroll up a little bit you I just want to for.

A

C

Watching who have no idea what open api is, this is a way to describe request response how your api works right. If you scroll down a little bit to what we're talking about, you see the paths to do and now we're describing the different responses you can get for this. You see there's a 201, and this is a 409 response. You can see that the content has to be application json and that that json has to match a certain schema.

C

That's defined by the component schema to do error response and then we're providing an example there and that will get rendered with the docs eventually, and if we scroll down here, we see that components to do error response. We see that it has to be one of these things, so an object here, an object. There an object there, so we see that it has to be.

C

uh If you look at each of those one of things, so it says it has to be a string in the not found it has.

B

Been a category not found, and it has to have a not.

C

Found property right, um which has to be a string: it has to have a conflict property capital c, uh with a string that is type string or it has to be an unauthor uh un ah torized. uh This looks like that's misspelled a little bit, but that's okay, um uh again, capital? U of type string. So um if we go up to the example now.

A

You can see.

C

B

I don't know, looks fine to me.

C

Yeah, so I don't know if it, um if you need, maybe it needs to get wrapped in another object. Somehow.

B

But what would the key be of that wrapping object?

B

So, okay, one one thing we can do is this? Is a spectral rule like out of the box thing, so we can go grab, search for this real, quick and see.

B

um Do they have docs on this.

A

B

Custom rule set ready to use rule set, um create your own rule set. That's fine, where's the don't like our rules. Custom functions.

B

I don't know where's their rules. um Okay, let's look. If we can see it here, rules um docs guides. They have documentation. Let's go to that.

A

B

Stop view docs, maybe okay, okay,.

B

Rule sets mm-hmm there a search on this thing. There we go.

B

Where oh, okay, open api rules there? Okay, let's go back, we are using an old version and oas valid meta media example. That's what it's called.

C

B

Oh, you found it.

C

Yeah I sent you a link.

A

C

This is the oas, open api spec. um That shows you how to do an example uh object. Oh.

B

You need to have a value.

C

Field, you can't just list it raw.

B

Will you and the value is the object, yeah? Okay, that's the answer. Wow we're going to solve! Try.

C

A

C

Value and then make this an object.

A

C

A

B

To do error response? Well, that's a little alarming. Does it not exist?

B

What wait wait? Wait? Wait. Did I just? Is there a syntax error here hold on.

B

B

B

Okay: let's go back to your thing: good call wills: uh where is there an example of an example? Examples: foo? Oh, we need to give it a name.

B

C

I mean in the ammo now.

B

He's missing a.

C

Quote, oh yeah, there you go. I was.

B

C

Good call good call good call.

B

Okay, yeah, we got thank you chat, saving the day. Thank you chat, uh okay, but I think not like yeah. We do need to have a foo something like this. I think.

A

B

Right, no, not right wait. Maybe I was just reading their thing too. Specifically, because does it say foo, foo or bar no examples? Is it examples and it's an array examples and it's an array.

B

B

Wait a second, you sent me examples and they had example.

B

What's going on here example: object.

B

It's in line with schema so schema.

B

I'm really super confused. Now, content.

B

I'm deeply confused okay, request body content, then schema examples. Okay, so maybe it's in the wrong split content.

B

Schema okay: this must be this schema thing must be something different, so examples. So what's the problem here? Examples, property types should be an object. Oh okay, that's fine! Because they're named that's why they have to be named. Okay um value property should max exactly one schema. Okay, let's, let's go verify that another time just for fun, conflict string,.

B

Okay, dude, I don't know, let's look at our own.

B

B

Here examples, foo value, so there's some there's some big long thing value.

C

You have to name it the same as the schema.

B

Where else, no, where else their foo is nowhere else, wait a second. What.

B

No food is nowhere else in that file. Okay, so to do error response like.

A

B

I have no idea.

B

Okay, let's go back; let's do this again, let's just look at it again. Here no should match one. hmm Oh I was so hopeful we would get. We would get one actually crossed off here.

B

I mean we definitely know something was up because it was. They didn't have the value thing before and whatever, but.

C

Yeah, I don't know, I still think there's something so.

A

C

Crafty thing that we need to do and yeah the error.

A

Messages are not.

C

A

B

Let's look at that rule real, quick.

B

B

A

Yeah, I don't know.

A

B

All right: well, we ran out of time. Would you look at that? uh We'll have to look at this. I don't know we'll get we'll get back to it. There I mean at least we can provide some insight that it's something to do with this. However, if it appears to me that what we had written there should be valid, like um I'm gonna, I'm gonna copy this somewhere.

B

Let's just stop that but like if we took this guy, for example, is it going to have the same error?

B

No, but if I put something wrong there, it will so clearly application. Oh, is that really the thing okay hold on? Is it just in the wrong place? I I remember, I said. Oh, I assume that's just something else, but maybe it's supposed to be.

B

uh Oh! No! It is. It is parallel with schema.

B

A

I don't know, I don't know.

B

Okay, well, something.

A

B

Application json examples, foo value.

B

A

B

Maybe you can't have both of those.

C

It might be that the schema is not well defined at this point, um but anyway, I know we're out of time, but it might, it might be a schema now.

B

That's pretty good, I think we like actually really looked into them too, so only another. I think we have 25 per page and we have two pages. So what's 50 minus four.

B

46 46 to go we'll just keep doing this for another 12 streams and we'll be good all right thanks for coming everyone thanks for participating, it's great to have the engagement and stuff um we'll see you next week.