Convert static renderer imports to lazy dynamic imports; make auth init async by jackkav · Pull Request #9993 · Kong/insomnia

jackkav · 2026-05-30T03:23:05Z

Stacked on #9992 — merge that first. This PR contains only the diff on top of it.

Summary

Converts upfront static import statements to lazy await import() in the Electron renderer. Heavy or Node-touching modules are no longer evaluated at bundle parse time — they load on first use.

Also fixes a latent race condition in the auth session provider where getLoginUrl() could be called before the session keypair had finished generating.

Lazy imports converted:

session.ts → crypt.decryptAES
network.ts → set-cookie-util.addSetCookiesToToughCookieJar
auth-session-provider.client.ts → sealedbox.keyPair / sealedbox.open
codemirror/lint/json-lint.ts → jsonlint-mod-fixed
preview-mode-dropdown, request-actions-dropdown, mock-response-pane, generate-code-modal, import-export → common/har exports
invite-form → ./encryption

Async auth:

getLoginUrl() is now async — waits for keypair init before returning the URL
All callers (auth.authorize, auth.login, root.tsx, organization-select) updated to await it
auth.authorize updated to use useEffect + useState to handle the async URL

Other:

script-security-policy: resolves requireInterceptor via window.bridge at call time instead of at module load — avoids importing a main-process module in the renderer
code-editor: replaces deep-equal package with an inline JSON.stringify comparison for the lint option equality check
base-imports: removes unused javascript-async-lint import; global → globalThis
entry.client: initPlugins() → plugins.reloadPlugins()

Test plan

Login flow: clicking "Copy URL" in auth.authorize shows a valid URL
Login flow: getLoginUrl() callers in root.tsx and organization-select still open the browser correctly
Vault key reset still works end-to-end (keypair generation → auth box decode)
HAR export still works from request-actions dropdown and generate-code modal
Script pre/post-request hooks: require() interceptor still blocks disallowed modules
JSON linting in CodeEditor still highlights syntax errors

…it async Avoids upfront module evaluation cost for heavy or Node-touching modules in the renderer. Modules like `crypt`, `sealedbox`, `har`, `jsonlint`, and `@grpc` are only loaded on first use rather than at bundle parse time. - session.ts: lazy-import crypt (decryptAES) - network.ts: lazy-import set-cookie-util - auth-session-provider: deferred keypair init, lazy sealedbox import; fixes race where getLoginUrl() could be called before keypair was generated - auth.authorize/login/root/organization-select: await getLoginUrl() now that it is async - script-security-policy: resolve requireInterceptor via window.bridge at call time instead of at module load (avoids main-process import in renderer) - codemirror: replace deep-equal with inline JSON.stringify comparison; lazy-import jsonlint; remove unused javascript-async-lint import - har exports (preview-mode-dropdown, request-actions, mock-response-pane, generate-code-modal, import-export): lazy-import from common/har - invite-form: lazy-import encryption module - entry.client: switch initPlugins() to plugins.reloadPlugins()

github-actions · 2026-05-30T03:28:15Z

⚠️ Circular References Report

Generated at: 2026-05-30T18:53:36.832Z
Status: ⚠️ WARNING

Summary

Metric	Base (`pr/safe-utilities-cleanup`)	PR	Change
Total Circular References	12	17	+5 (+41.67%)

⚠️ New Circular References Added (5)

Click to expand/collapse

insomnia/src/common/render.ts -> insomnia/src/templating/index.ts -> insomnia/src/plugins/index.ts -> insomnia/src/plugins/misc.ts -> insomnia/src/plugins/renderer-bridge.ts -> insomnia/src/plugins/invoke-method.ts -> insomnia/src/plugins/context/data.ts -> insomnia/src/main/har.ts
insomnia/src/network/network.ts -> insomnia/src/common/render.ts -> insomnia/src/templating/index.ts -> insomnia/src/plugins/index.ts -> insomnia/src/plugins/misc.ts -> insomnia/src/plugins/renderer-bridge.ts -> insomnia/src/plugins/invoke-method.ts -> insomnia/src/plugins/context/data.ts -> insomnia/src/main/har.ts -> insomnia/src/main/network/get-auth-header.ts -> insomnia/src/main/network/o-auth-2/get-token.ts
insomnia/src/plugins/index.ts -> insomnia/src/plugins/misc.ts -> insomnia/src/plugins/renderer-bridge.ts -> insomnia/src/plugins/invoke-method.ts
insomnia/src/plugins/index.ts -> insomnia/src/plugins/misc.ts -> insomnia/src/plugins/renderer-bridge.ts -> insomnia/src/plugins/invoke-method.ts -> insomnia/src/plugins/context/data.ts -> insomnia/src/main/har.ts
insomnia/src/plugins/misc.ts -> insomnia/src/plugins/renderer-bridge.ts -> insomnia/src/plugins/bridge-types.ts

Click to view all circular references in PR (17)

insomnia-inso/src/db/models/types.ts -> insomnia-inso/src/db/types.ts
insomnia/src/common/render.ts -> insomnia/src/templating/index.ts -> insomnia/src/plugins/index.ts -> insomnia/src/plugins/misc.ts -> insomnia/src/plugins/renderer-bridge.ts -> insomnia/src/plugins/invoke-method.ts -> insomnia/src/plugins/context/data.ts -> insomnia/src/main/har.ts
insomnia/src/network/network.ts -> insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/collection.ts -> insomnia-scripting-environment/src/objects/response.ts
insomnia/src/network/network.ts -> insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/insomnia.ts -> insomnia-scripting-environment/src/objects/interfaces.ts
insomnia/src/network/network.ts -> insomnia/src/common/render.ts
insomnia/src/network/network.ts -> insomnia/src/common/render.ts -> insomnia/src/templating/index.ts -> insomnia/src/plugins/index.ts -> insomnia/src/plugins/context/app.ts -> insomnia/src/templating/types.ts -> insomnia/src/plugins/context/network.ts
insomnia/src/network/network.ts -> insomnia/src/common/render.ts -> insomnia/src/templating/index.ts -> insomnia/src/plugins/index.ts -> insomnia/src/plugins/misc.ts -> insomnia/src/plugins/renderer-bridge.ts -> insomnia/src/plugins/invoke-method.ts -> insomnia/src/plugins/context/data.ts -> insomnia/src/main/har.ts -> insomnia/src/main/network/get-auth-header.ts -> insomnia/src/main/network/o-auth-2/get-token.ts
insomnia/src/plugins/index.ts -> insomnia/src/plugins/context/app.ts -> insomnia/src/templating/types.ts -> insomnia/src/plugins/context/store.ts
insomnia/src/plugins/index.ts -> insomnia/src/plugins/misc.ts
insomnia/src/plugins/index.ts -> insomnia/src/plugins/misc.ts -> insomnia/src/plugins/renderer-bridge.ts -> insomnia/src/plugins/invoke-method.ts
insomnia/src/plugins/index.ts -> insomnia/src/plugins/misc.ts -> insomnia/src/plugins/renderer-bridge.ts -> insomnia/src/plugins/invoke-method.ts -> insomnia/src/plugins/context/data.ts -> insomnia/src/main/har.ts
insomnia/src/plugins/misc.ts -> insomnia/src/plugins/renderer-bridge.ts -> insomnia/src/plugins/bridge-types.ts
insomnia/src/templating/types.ts -> insomnia/src/plugins/context/network.ts
insomnia/src/ui/components/settings/import-export.tsx -> insomnia/src/ui/components/modals/export-requests-modal.tsx
insomnia/src/ui/components/tabs/tab-list.tsx -> insomnia/src/ui/components/tabs/tab.tsx
insomnia/src/ui/components/templating/tag-editor-arg-sub-form.tsx -> insomnia/src/ui/components/templating/external-vault/external-vault-form.tsx
insomnia/src/ui/components/viewers/response-viewer.tsx -> insomnia/src/ui/components/viewers/response-multipart-viewer.tsx

Click to view all circular references in base branch (12)

insomnia-inso/src/db/models/types.ts -> insomnia-inso/src/db/types.ts
insomnia/src/network/network.ts -> insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/collection.ts -> insomnia-scripting-environment/src/objects/response.ts
insomnia/src/network/network.ts -> insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/insomnia.ts -> insomnia-scripting-environment/src/objects/interfaces.ts
insomnia/src/network/network.ts -> insomnia/src/common/render.ts
insomnia/src/network/network.ts -> insomnia/src/common/render.ts -> insomnia/src/templating/index.ts -> insomnia/src/plugins/index.ts -> insomnia/src/plugins/context/app.ts -> insomnia/src/templating/types.ts -> insomnia/src/plugins/context/network.ts
insomnia/src/plugins/index.ts -> insomnia/src/plugins/context/app.ts -> insomnia/src/templating/types.ts -> insomnia/src/plugins/context/store.ts
insomnia/src/plugins/index.ts -> insomnia/src/plugins/misc.ts
insomnia/src/templating/types.ts -> insomnia/src/plugins/context/network.ts
insomnia/src/ui/components/settings/import-export.tsx -> insomnia/src/ui/components/modals/export-requests-modal.tsx
insomnia/src/ui/components/tabs/tab-list.tsx -> insomnia/src/ui/components/tabs/tab.tsx
insomnia/src/ui/components/templating/tag-editor-arg-sub-form.tsx -> insomnia/src/ui/components/templating/external-vault/external-vault-form.tsx
insomnia/src/ui/components/viewers/response-viewer.tsx -> insomnia/src/ui/components/viewers/response-multipart-viewer.tsx

Analysis

⚠️ Warning: This PR introduces 5 new circular references. Consider refactoring to avoid adding circular dependencies.

This report was generated automatically by comparing against the pr/safe-utilities-cleanup branch.

With nodeIntegration:false in the main renderer window, the renderer no longer has access to Node.js APIs. This commit fixes a chain of startup crashes by: - misc.ts: lazy-import getThemes via renderer bridge to avoid pulling plugins/index.ts (which imports node:fs) into the eager bundle - renderer-listeners.ts: lazy-import templating on reload-plugins event to avoid pulling liquid-extension.ts (node:crypto, node:os) eagerly - templating/index.ts: lazy-import liquid-extension and plugins inside getLiquid() so module load doesn't trigger Node.js requires - vite-plugin-electron-node-require.ts: guard require() with typeof check so renderer gets empty stubs instead of ReferenceError crashes - vite.config.ts: define global=globalThis for CJS packages (httpsnippet); add url/querystring browser shims; exclude util/events/url/querystring from Node.js externalization so httpsnippet can construct code snippets - generate-code-modal.tsx: wrap generateCode in try-catch to prevent unhandled rejections from crashing the renderer at startup; also remove an unnecessary warmup of all components from the server config - polyfills/node-url.ts, polyfills/node-querystring.ts: browser-compatible shims for Node.js legacy url and querystring modules

jackkav mentioned this pull request May 30, 2026

security: low-risk renderer decoupling prep #9988

Draft

jackkav added 5 commits May 30, 2026 05:46

feedback

ab037cb

disable node, add har bridge

2e1a7b5

explicit env vars

ef1f111

Move window.env contextBridge exposure to PR #9992

3bd288a

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Convert static renderer imports to lazy dynamic imports; make auth init async#9993

Convert static renderer imports to lazy dynamic imports; make auth init async#9993
jackkav wants to merge 6 commits into
pr/safe-utilities-cleanupfrom
pr/lazy-imports-async-auth

jackkav commented May 30, 2026

Uh oh!

github-actions Bot commented May 30, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

jackkav commented May 30, 2026

Summary

Test plan

Uh oh!

github-actions Bot commented May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Circular References Report

Summary

⚠️ New Circular References Added (5)

Analysis

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented May 30, 2026 •

edited

Loading