Repository navigation
test: enhance test coverage for field encryption [INS-4133] - #10763
Open
bobqiu-kong wants to merge 22 commits into
Open
bobqiu-kong wants to merge 22 commits into
bobqiu-kong wants to merge 22 commits into
Conversation
bobqiu-kong
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
bobqiu-kong
force-pushed
the
test/ins-4133-encrypt-sensitive-data
branch
from
November 12, 2026 07:51
9146734 to
e2dc1c5
Compare
bobqiu-kong
marked this pull request as ready for review
November 12, 2026 07:51
|
❌ KSAI Review: Failed The review did not complete ( Run report (federated) · 0 paid runs · cost not recoverable from a partial log
|
The design of the field-level encryption of the local NeDB files: the sensitive fields, the approaches that were compared, the serialization hooks, the key lifecycle, the user-facing error handling, the migration and the implementation plan. Documentation only. Part 1 of 11 of the field encryption stack (INS-2368), which replaces #10666. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
AES-256-GCM value encryption with the enc:insomnia:v1: format, the walk over encrypted field paths, and the NeDB serialization hooks with their failure report. Pure functions with no Electron or model dependency; the path table is injected. Part 2 of 11 of the field encryption stack (INS-2368), which replaces #10666. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
An encrypted() mark on the Zod schema fields, the derivation of the encrypted paths from the schemas, the marks on the models already on Zod, and temporary encryptedFields arrays for the five models that are still plain interfaces. A snapshot test makes every change of the encrypted set visible in review. Part 3 of 11 of the field encryption stack (INS-2368), which replaces #10666. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…INS-2368] createNedbDatabase().init() takes a fieldEncryptionKey and attaches the hooks to the datastores that have encrypted fields. init() now waits for every datastore to load and rejects with the names of the ones that failed instead of hanging, and the failure report is reconciled after the load. Part 4 of 11 of the field encryption stack (INS-2368), which replaces #10666. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
INS-2368] setItemDurable (temp file, fsync, rename), getItemStrict (null only when the file does not exist) and isSameFile. The key file must never be lost or mistaken for missing, which the existing buffered setItem / defaulting getItem cannot promise. Existing methods and callers are unchanged. Part 5 of 11 of the field encryption stack (INS-2368), which replaces #10666. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…S-2368] The local key is generated on the first launch, protected with the asynchronous safeStorage API, written durably and verified before any datastore is encrypted, and loaded into mainDatabase.init(). When it cannot be used the database opens without encryption (degraded mode) and the key file is never replaced. The renderer cannot reach the key file through the storage IPC handlers. Part 6 of 11 of the field encryption stack (INS-2368), which replaces #10666. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ad failures [INS-2368] The main process side of the user-facing errors: the failure report can be refreshed and reset, a controller and a FieldEncryptionIpcHandler expose getStatus / resetFailedFields / resetKey / dismiss to the renderer, the key reset sets the key file aside after a native confirmation and relaunches, and a datastore that fails to load shows a native error box instead of a hang. Part 7 of 11 of the field encryption stack (INS-2368), which replaces #10666. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…NS-2368] FieldEncryptionIssueModal, mounted with the other modals, asks the main process for the status once and offers the choices of the two situations: some fields cannot be decrypted, or the local key is not available. The renderer reaches the handler through the fieldEncryption trigger in ui/ipc.ts. Part 8 of 11 of the field encryption stack (INS-2368), which replaces #10666. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…nces [INS-2368] A Local Encryption Key section in Preferences > General with Copy Key (base64 of the JWK) and Export Key (JWK JSON file), each behind a confirmation. Two more fieldEncryption handler methods, isKeyAvailable and getKey, and one helper in insomnia-data that builds both forms. Part 9 of 11 of the field encryption stack (INS-2368), which replaces #10666. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…MNIA_ENCRYPTION_KEY [INS-2368] inso accepts the key in both forms the app hands out and decrypts the NeDB datastores through the shared hooks. Without a key it warns how many encrypted values it found, a wrong key is an error that names the fields and never the values, and the key is hidden in --printOptions and not read from .insorc. Part 10 of 11 of the field encryption stack (INS-2368), which replaces #10666. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…S-2368] Tests only. The first launch with the key is the migration: on the plaintext insomnia-legacy-db fixture all sensitive fields are encrypted, the data is intact, and an interruption at any point is safe. One test on real NeDB files, one on the real mainDatabase.init(), and one Playwright smoke test on the real app. Part 11 of 11 of the field encryption stack (INS-2368), which replaces #10666. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…S-2368] Tests only. The first launch with the key is the migration: on the plaintext insomnia-legacy-db fixture all sensitive fields are encrypted, the data is intact, and an interruption at any point is safe. One test on real NeDB files, one on the real mainDatabase.init(), and one Playwright smoke test on the real app. Part 11 of 11 of the field encryption stack (INS-2368), which replaces #10666. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- Implemented `inso-cli.ts` to run the locally built `inso` CLI, enabling command execution through Electron. - Created `client-certificate.ts` model to define the structure for client certificates including cert, key, and optional passphrase. - Developed `certificates.page.ts` to manage the UI interactions for adding and managing client certificates. - Added `export.page.ts` for handling export functionalities and selecting export formats. - Introduced tests for field encryption scenarios, ensuring sensitive data remains encrypted while being accessible in the app. - Implemented various test cases for Bearer token handling, legacy database migration, and ensuring encrypted data survives application restarts. - Added UI tests for verifying that client certificates added through the UI are stored securely and correctly.
- Added ImportFlow class to handle file imports from the project context menu. - Created import.page.ts to manage the import dialog interactions. feat: add field encryption utilities and fixtures - Introduced field-encryption-fixtures.ts for handling legacy database and encryption key operations. - Implemented functions for copying legacy databases, appending raw documents, and managing encryption keys. feat: create cookie model and page interactions - Defined Cookie type in cookie.ts to represent cookie attributes. - Developed CookiePage class in cookie.page.ts for managing cookie operations, including adding, editing, and deleting cookies. test: add tests for field encryption scenarios - Created decryption-failure-dialog.spec.ts to test handling of decryption failures and affected fields. - Implemented key-export.spec.ts to verify key export functionality and clipboard operations. - Added key-unavailable-dialog.spec.ts to test behavior when the encryption key is unavailable, including resetting the key and handling degraded mode.
- Updated `runInso` function to accept custom environment variables, improving flexibility in test environments. - Enhanced `launchInsomniaElectron` to support preload scripts and additional environment variables for better test isolation. - Introduced a native dialog stub to simulate user interactions with dialogs during tests, allowing for more controlled testing scenarios. - Added comprehensive tests for client certificate mTLS functionality, ensuring encrypted passphrases are handled correctly. - Implemented tests for database load failures, ensuring the application handles corrupted databases gracefully without data loss. - Created tests for decryption failure dialogs, verifying that the application prompts users appropriately when decryption issues occur. - Developed tests for key export functionality, ensuring keys are handled securely and correctly. - Added tests for interrupted migrations, ensuring that mixed encrypted and plaintext values are processed correctly. - Enhanced existing tests to ensure sensitive fields remain encrypted on disk while being displayed as plaintext in the app. - Removed outdated comments and consolidated test cases for clarity and maintainability.
…encryption handling
bobqiu-kong
force-pushed
the
test/ins-4133-encrypt-sensitive-data
branch
from
November 13, 2026 02:31
feefeb7 to
9d748e3
Compare
- Improved the `authFieldEditor` method to handle legacy test IDs during upgrades. - Added an error dialog getter in `LocalEncryptionKeyComponent` for export failures. - Updated `PreferencesComponent` to locate sidebar focus settings by input name. - Introduced `EnabledLabelToggleComponent` for managing toggle button states. - Implemented CA certificate management methods in `CertificatesFlow`. - Added methods for handling CA and client certificate states in `CertificatesPage`. - Enhanced `Tree` class to support legacy row handling during upgrades. - Refactored field encryption tests to utilize new flow methods for error dialog assertions. - Removed obsolete legacy database migration tests and added new upgrade tests for previous releases.
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Automated end-to-end coverage for local database field encryption (INS-2368), tracked by INS-4133. It implements the cases of the test plan that can be driven through
packages/insomnia-test(19 of the plan's 20; case 18, Scratch Pad, is not covered yet) and adds the Page / Flow / fixture support they need.This PR sits on top of the INS-2368 stack (#10749 – #10759) and only touches
packages/insomnia-test. No app code changes.Changes
Specs —
tests/workspace/field-encryption/(30 tests)on-disk-encryptionrequest-sends-real-credentialslegacy-db-migrationclient-certificate-mtlssensitive-fields,ui-created-secretsexport-stays-plaintextsurvives-restartkey-exportinso-encryption-keydecryption-failure-dialogkey-unavailable-dialogdatabase-load-failureinterrupted-migrationinso-plaintext-sourcessensitive-fieldsseeds each model through the app's own database layer (docCreate) and checks, before and after two restarts, that sensitive paths are ciphertext on disk, no secret is left in any.dbfile, non-sensitive paths (client ids, key ids, cookie keys…) stay plaintext, and the app still reads the original values.Framework (
packages/insomnia-test)test/refactor_e2e_tests:AppFlow.restart,PageManager.setWindow,ExportFlow.exportCollection,ImportFlow.importFile,CookieFlow,CertificatesFlow.addClientCertificateand their pages / models / enums.test/e2e-openai-3.2-support:runInsoandInsoFlow.lintSpec.FieldEncryptionFlowwith theLocalEncryptionKeyComponent(Preferences > General) andFieldEncryptionIssueComponent(dialogs A and B);InsoFlow.runCollection;AppFlow.relaunch; raw.dbreaders (readRawDocs,readRawDbText) andcreateDoc/updateDoc; seeding helpers for a degraded key, undecryptable fields and the legacy database (misc/field-encryption-fixtures.ts).userAtStartupfixture: likeuser, but touches no UI during setup, for apps that start behind a blocking dialog. The teardown of relaunched apps moved into a sharedcloseRelaunchedApp;userbehaves as before.misc/native-dialog-stub.cjs, preloaded into the main process with the newpreloadScripts/extraEnvoptions oflaunchInsomniaElectron, answersdialog.showMessageBoxand recordsshell.openPath.CookiePage,CertificatesPage,ExportPage,ImportPage) kept pointing at the closed window afterAppFlow.restart(). They now use getters.Notes for reviewers
npm run build -w insomnia-insofirst. They work on copies of the data directory, because inso rewrites the files it loads.--require, which a packaged app ignores, so that spec only works in dev mode (the default)..insomnia/<Type>/*.ymllayout, not a real sync.Testing
🤖 Generated with Claude Code