Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Learnt from: bijin-bruno
Repo: usebruno/bruno PR: 6263
File: packages/bruno-requests/src/auth/oauth2-helper.ts:249-249
Timestamp: 2025-12-02T07:24:50.299Z
Learning: In OAuth2 Basic Auth headers for Bruno, clientSecret is optional and can be omitted. When constructing the Authorization header in `packages/bruno-requests/src/auth/oauth2-helper.ts`, use `clientSecret || ''` instead of `clientSecret!` to properly handle cases where only clientId is provided, per community requests.

Learnt from: bijin-bruno
Repo: usebruno/bruno PR: 6263
File: packages/bruno-requests/src/auth/oauth2-helper.ts:249-249
Timestamp: 2025-12-02T07:24:50.299Z
Learning: In OAuth2 Basic Auth headers for Bruno, clientSecret is optional and can be omitted. When constructing the Authorization header in `packages/bruno-requests/src/auth/oauth2-helper.ts`, use `clientSecret || ''` instead of `clientSecret!` to properly handle cases where only clientId is provided, per community requests.

packages/bruno-electron/src/ipc/network/prepare-grpc-request.js (3)

21-63: Token placement logic is duplicated across grant types

For authorization_code, client_credentials, and password, the code to:

• set grpcRequest.oauth2Credentials, and
• place the access token into either the Authorization header or the URL query

is effectively identical, differing only in how credentials are fetched.

You can reduce duplication and potential divergence by extracting a small helper, e.g.:

+const applyOAuth2Token = (grpcRequest, request, {
+  credentials,
+  oauth2Url,
+  credentialsId,
+  debugInfo,
+  tokenPlacement,
+  tokenHeaderPrefix,
+  tokenQueryKey
+}) => {
+  grpcRequest.oauth2Credentials = {
+    credentials,
+    url: oauth2Url,
+    collectionUid: request.collectionUid || grpcRequest.collectionUid,
+    credentialsId,
+    debugInfo,
+    folderUid: request.oauth2Credentials?.folderUid
+  };
+
+  if (tokenPlacement === 'header') {
+    grpcRequest.headers['Authorization'] = `${tokenHeaderPrefix} ${credentials?.access_token}`;
+  } else {
+    try {
+      const url = new URL(grpcRequest.url);
+      url.searchParams.set(tokenQueryKey, credentials?.access_token);
+      grpcRequest.url = url.toString();
+    } catch (error) {
+      console.error('Failed to parse URL for OAuth2 token placement', error, grpcRequest.url, tokenQueryKey);
+    }
+  }
+};

Then each case becomes a focused “fetch credentials” call plus a single applyOAuth2Token(...). This keeps behavior consistent if you tweak token placement in the future.

---

26-26: Use strict equality (===) for tokenPlacement checks

The three checks

if (tokenPlacement == 'header') {

rely on loose equality. tokenPlacement is a configuration value and should be compared strictly to avoid silent coercion and to align with the project’s JS style guidelines.

Suggested change:

-        if (tokenPlacement == 'header') {
+        if (tokenPlacement === 'header') {

Apply the same replacement at Lines 40 and 54.

Also applies to: 40-40, 54-54

---

29-33: Empty catch blocks hide URL parsing problems

All three catch blocks around new URL(grpcRequest.url) are empty:

} catch (error) { }

This will silently swallow misconfigurations or invalid URLs, making it hard to debug why the token is not being added to the URL.

At minimum, log the error (or use the module’s logger if there is one):

-          } catch (error) { }
+          } catch (error) {
+            console.error(
+              'Failed to parse URL for OAuth2 token placement',
+              error,
+              grpcRequest.url,
+              tokenQueryKey
+            );
+          }

Apply a similar change to the two other catch blocks.

Also applies to: 43-47, 57-61

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Learnt from: bijin-bruno
Repo: usebruno/bruno PR: 6263
File: packages/bruno-requests/src/auth/oauth2-helper.ts:249-249
Timestamp: 2025-12-02T07:24:50.311Z
Learning: In OAuth2 Basic Auth headers for Bruno, clientSecret is optional and can be omitted. When constructing the Authorization header in `packages/bruno-requests/src/auth/oauth2-helper.ts`, use `clientSecret || ''` instead of `clientSecret!` to properly handle cases where only clientId is provided, per community requests.

Learnt from: bijin-bruno
Repo: usebruno/bruno PR: 6263
File: packages/bruno-requests/src/auth/oauth2-helper.ts:249-249
Timestamp: 2025-12-02T07:24:50.311Z
Learning: In OAuth2 Basic Auth headers for Bruno, clientSecret is optional and can be omitted. When constructing the Authorization header in `packages/bruno-requests/src/auth/oauth2-helper.ts`, use `clientSecret || ''` instead of `clientSecret!` to properly handle cases where only clientId is provided, per community requests.

packages/bruno-electron/src/ipc/network/prepare-grpc-request.js (1)

30-30: Consider adding JSDoc documentation.

The configureRequest function is exported and has a complex signature with 8 parameters. Adding JSDoc would help consumers understand its purpose and side effects, especially that it mutates grpcRequest in place.

Add documentation like this:

+/**
+ * Configures OAuth2 authentication for a gRPC request by fetching tokens and placing them in headers or URL.
+ * Mutates the grpcRequest object in place by setting oauth2Credentials and adding the access token.
+ *
+ * @param {Object} grpcRequest - The gRPC request object to configure (mutated in place)
+ * @param {Object} request - The original request object with OAuth2 configuration
+ * @param {Object} collection - The collection containing the request
+ * @param {Object} envVars - Environment variables
+ * @param {Object} runtimeVariables - Runtime variables
+ * @param {Object} processEnvVars - Process environment variables
+ * @param {Object} promptVariables - Prompt variables
+ * @param {Object} certsAndProxyConfig - SSL certificates and proxy configuration
+ * @returns {Promise<void>}
+ */
 const configureRequest = async (grpcRequest, request, collection, envVars, runtimeVariables, processEnvVars, promptVariables, certsAndProxyConfig) => {

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Learnt from: bijin-bruno
Repo: usebruno/bruno PR: 6263
File: packages/bruno-requests/src/auth/oauth2-helper.ts:249-249
Timestamp: 2025-12-02T07:24:50.311Z
Learning: In OAuth2 Basic Auth headers for Bruno, clientSecret is optional and can be omitted. When constructing the Authorization header in `packages/bruno-requests/src/auth/oauth2-helper.ts`, use `clientSecret || ''` instead of `clientSecret!` to properly handle cases where only clientId is provided, per community requests.

Learnt from: bijin-bruno
Repo: usebruno/bruno PR: 6263
File: packages/bruno-requests/src/auth/oauth2-helper.ts:249-249
Timestamp: 2025-12-02T07:24:50.311Z
Learning: In OAuth2 Basic Auth headers for Bruno, clientSecret is optional and can be omitted. When constructing the Authorization header in `packages/bruno-requests/src/auth/oauth2-helper.ts`, use `clientSecret || ''` instead of `clientSecret!` to properly handle cases where only clientId is provided, per community requests.

packages/bruno-electron/src/ipc/network/prepare-grpc-request.js (2)

20-23: Remove unnecessary optional chaining.

The url object created by new URL() always has a searchParams property, so the optional chaining on lines 22-23 is redundant. The toString() call on line 23 also doesn't need optional chaining.

Apply this diff:

     try {
       const url = new URL(grpcRequest.url);
-      url?.searchParams?.set(tokenQueryKey, credentials?.access_token);
-      grpcRequest.url = url?.toString();
+      url.searchParams.set(tokenQueryKey, credentials?.access_token);
+      grpcRequest.url = url.toString();
     } catch (error) {
       console.error('Failed to parse URL for OAuth2 token placement:', error);
     }

---

36-55: Add default case for unknown grant types.

The switch statement doesn't handle unknown or undefined grant types. Consider adding a default case to log a warning when an unsupported grant type is encountered, which would aid debugging.

Apply this diff:

       case 'password':
         interpolateVars(requestCopy, envVars, runtimeVariables, processEnvVars, promptVariables);
         ({ credentials, url: oauth2Url, credentialsId, debugInfo } = await getOAuth2TokenUsingPasswordCredentials({ request: requestCopy, collectionUid: collection.uid, certsAndProxyConfig }));
         grpcRequest.oauth2Credentials = { credentials, url: oauth2Url, collectionUid: collection.uid, credentialsId, debugInfo, folderUid: request.oauth2Credentials?.folderUid };
         placeOAuth2Token(grpcRequest, credentials, tokenPlacement, tokenHeaderPrefix, tokenQueryKey);
         break;
+      default:
+        console.warn(`Unsupported OAuth2 grant type for gRPC: ${grantType}`);
+        break;
     }

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Learnt from: bijin-bruno
Repo: usebruno/bruno PR: 6263
File: packages/bruno-requests/src/auth/oauth2-helper.ts:249-249
Timestamp: 2025-12-02T07:24:50.311Z
Learning: In OAuth2 Basic Auth headers for Bruno, clientSecret is optional and can be omitted. When constructing the Authorization header in `packages/bruno-requests/src/auth/oauth2-helper.ts`, use `clientSecret || ''` instead of `clientSecret!` to properly handle cases where only clientId is provided, per community requests.

Learnt from: bijin-bruno
Repo: usebruno/bruno PR: 6263
File: packages/bruno-requests/src/auth/oauth2-helper.ts:249-249
Timestamp: 2025-12-02T07:24:50.311Z
Learning: In OAuth2 Basic Auth headers for Bruno, clientSecret is optional and can be omitted. When constructing the Authorization header in `packages/bruno-requests/src/auth/oauth2-helper.ts`, use `clientSecret || ''` instead of `clientSecret!` to properly handle cases where only clientId is provided, per community requests.