feat: migrate models to insomnia-data - p8#9751
Draft
Conversation
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
| return database.docCreate<SocketIORequest>(type, patch); | ||
| }; | ||
|
|
||
| export const getById = (_id: string) => database.findOne<SocketIORequest>(type, { _id }); |
Contributor
There was a problem hiding this comment.
getById calls database.findOne with a user-supplied _id but performs no authorization check; validate that the requester is allowed to access the returned SocketIORequest before returning it.
Details
✨ AI Reasoning
These service functions accept identifiers (or parent identifiers) and call the database directly without verifying the caller's right to access the returned resource. The service is the lowest visible layer here, so it must enforce ownership/authorization. Each function below fetches resources by ID or parentId with no access control.
🔧 How do I fix it?
Implement server-side access control check(s) to verify that the currently authenticated user is authorized to access the specific object or resource ID being requested.
Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
| }); | ||
| } | ||
|
|
||
| export const getById = (_id: string) => database.findOne<WebSocketRequest>(type, { _id }); |
Contributor
There was a problem hiding this comment.
getById calls database.findOne with a provided _id but performs no authorization check; verify caller is allowed to access this WebSocketRequest before returning it.
Details
✨ AI Reasoning
This service method takes an _id and returns a WebSocketRequest via database.findOne without any verification that the requester has access to that specific request. The service must enforce authorization to prevent unauthorized access by guessing IDs.
🔧 How do I fix it?
Implement server-side access control check(s) to verify that the currently authenticated user is authorized to access the specific object or resource ID being requested.
Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
✨ Circular References ReportGenerated at: 2026-03-27T08:13:32.215Z Summary
✨ Circular References Removed (7)Click to expand/collapseClick to view all circular references in PR (64)Click to view all circular references in base branch (71)Analysis✨ Great Job! This PR removes 7 circular references. Keep up the good work! This report was generated automatically by comparing against the |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR continues the ongoing migration of realtime request/response/payload models (WebSocket + Socket.IO) from the app-side ~/models/* layer into insomnia-data, updating renderer and main-process call sites to use the new insomnia-data model/type exports and services.* CRUD APIs.
Changes:
- Move WebSocket/Socket.IO request/response/payload model definitions into
packages/insomnia/src/insomnia-data/src/models/*. - Add/adjust
insomnia-datanode service implementations for the migrated models, and switch many call sites frommodels.*CRUD toservices.*. - Update type-guards/usages across UI, routes, network, plugins, import/export, and response/request helper utilities to reference the migrated modules.
Reviewed changes
Copilot reviewed 62 out of 62 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| packages/insomnia/src/utils/try-interpolate.ts | Switch Socket.IO/WebSocket request types to insomnia-data exports. |
| packages/insomnia/src/ui/sync-utils.ts | Switch Socket.IO/WebSocket request types to insomnia-data exports. |
| packages/insomnia/src/ui/hooks/use-request.ts | Switch Socket.IO request/payload types to insomnia-data exports. |
| packages/insomnia/src/ui/hooks/use-insomnia-tab.ts | Use insomnia-data model type-guards for WS/Socket.IO. |
| packages/insomnia/src/ui/hooks/use-close-connection.ts | Use models.*Request.is*RequestId instead of removed app model modules. |
| packages/insomnia/src/ui/components/websockets/websocket-request-pane.tsx | Migrate WebSocket payload CRUD to services.webSocketPayload. |
| packages/insomnia/src/ui/components/websockets/realtime-response-pane.tsx | Use insomnia-data Socket.IO/WebSocket response types + type-guards. |
| packages/insomnia/src/ui/components/websockets/disconnect-button.tsx | Use insomnia-data model id type-guards for close actions. |
| packages/insomnia/src/ui/components/websockets/action-bar.tsx | Switch WS/Socket.IO request types to insomnia-data exports. |
| packages/insomnia/src/ui/components/tags/method-tag.tsx | Use insomnia-data model type-guards to render WS/IO method tags. |
| packages/insomnia/src/ui/components/tabs/tab-list.tsx | Use insomnia-data WS/IO type-guards when updating tabs. |
| packages/insomnia/src/ui/components/socket-io/event-tab-pane.tsx | Switch Socket.IO request types to insomnia-data exports. |
| packages/insomnia/src/ui/components/socket-io/body-tab-pane.tsx | Switch Socket.IO request/payload types to insomnia-data exports. |
| packages/insomnia/src/ui/components/rendered-query-string.tsx | Switch WS/Socket.IO request types to insomnia-data exports. |
| packages/insomnia/src/ui/components/modals/request-settings-modal.tsx | Use insomnia-data WS/IO model type-guards in settings UI. |
| packages/insomnia/src/ui/components/modals/request-render-error-modal.tsx | Switch WS/Socket.IO request types to insomnia-data exports. |
| packages/insomnia/src/ui/components/modals/export-requests-modal.tsx | Use insomnia-data WS/IO type-guards for labeling/filtering. |
| packages/insomnia/src/ui/components/editors/mock-response-extractor.tsx | Use consolidated models.socketIOResponse.isSocketIOResponse. |
| packages/insomnia/src/ui/components/dropdowns/response-history-dropdown.tsx | Use models.*Response.is*Response guards; types from insomnia-data. |
| packages/insomnia/src/ui/components/dropdowns/request-actions-dropdown.tsx | Switch WS/Socket.IO request types to insomnia-data exports. |
| packages/insomnia/src/ui/components/command-palette.tsx | Use insomnia-data WS request type-guard for UI labeling. |
| packages/insomnia/src/templating/types.ts | Switch WS/Socket.IO request types to insomnia-data exports. |
| packages/insomnia/src/routes/organization.$organizationId.project.$projectId.workspace.$workspaceId.tsx | Switch WS/Socket.IO request types to insomnia-data exports. |
| packages/insomnia/src/routes/organization.$organizationId.project.$projectId.workspace.$workspaceId.test.test-suite.$testSuiteId.tsx | Use insomnia-data WS request type-guard for test suite UI. |
| packages/insomnia/src/routes/organization.$organizationId.project.$projectId.workspace.$workspaceId.debug.tsx | Use insomnia-data WS/IO type-guards for realtime request logic/UI. |
| packages/insomnia/src/routes/organization.$organizationId.project.$projectId.workspace.$workspaceId.debug.request.new.tsx | Create WS/Socket.IO requests via services.*Request.create. |
| packages/insomnia/src/routes/organization.$organizationId.project.$projectId.workspace.$workspaceId.debug.request.$requestId.update.tsx | Use insomnia-data WS request type-guard for URL-change handling. |
| packages/insomnia/src/routes/organization.$organizationId.project.$projectId.workspace.$workspaceId.debug.request.$requestId.update-payload.tsx | Use services.socketIOPayload.updateOrCreateByParentId. |
| packages/insomnia/src/routes/organization.$organizationId.project.$projectId.workspace.$workspaceId.debug.request.$requestId.tsx | Use services for WS/IO response/payload retrieval in loader. |
| packages/insomnia/src/routes/organization.$organizationId.project.$projectId.workspace.$workspaceId.debug.request.$requestId.response.delete.tsx | Use services for WS/IO response operations; id guards from insomnia-data models. |
| packages/insomnia/src/routes/organization.$organizationId.project.$projectId.workspace.$workspaceId.debug.request.$requestId.connect.tsx | Use insomnia-data WS id guard + Socket.IO request type-guard. |
| packages/insomnia/src/routes/commands.tsx | Switch WS request type import to insomnia-data. |
| packages/insomnia/src/plugins/index.ts | Switch WS/Socket.IO request types to insomnia-data exports. |
| packages/insomnia/src/network/network.ts | Switch WS/Socket.IO request types to insomnia-data exports. |
| packages/insomnia/src/models/websocket-request.ts | Remove app-side WebSocket request model (migrated). |
| packages/insomnia/src/models/socket-io-request.ts | Remove app-side Socket.IO request model (migrated). |
| packages/insomnia/src/models/request-version.ts | Use insomnia-data WS/IO type-guards when snapshotting. |
| packages/insomnia/src/models/index.ts | Re-export migrated WS/IO models from insomnia-data models. |
| packages/insomnia/src/models/helpers/response-operations.ts | Use migrated WS/IO response guards/types; request-id guards from insomnia-data models. |
| packages/insomnia/src/models/helpers/request-operations.ts | Route WS/IO CRUD through services.*Request instead of app models. |
| packages/insomnia/src/main/network/websocket.ts | Use services.webSocketRequest/webSocketResponse for DB operations. |
| packages/insomnia/src/main/network/socket-io.ts | Use services.socketIORequest/socketIOResponse for DB operations. |
| packages/insomnia/src/insomnia-data/src/models/websocket-response.ts | Add WebSocketResponse model definition in insomnia-data. |
| packages/insomnia/src/insomnia-data/src/models/websocket-request.ts | Add WebSocketRequest model definition in insomnia-data. |
| packages/insomnia/src/insomnia-data/src/models/websocket-payload.ts | Add WebSocketPayload model definition in insomnia-data. |
| packages/insomnia/src/insomnia-data/src/models/types.ts | Re-export WS/IO model types from insomnia-data. |
| packages/insomnia/src/insomnia-data/src/models/socket-io-response.ts | Add SocketIOResponse model definition in insomnia-data. |
| packages/insomnia/src/insomnia-data/src/models/socket-io-request.ts | Add SocketIORequest model definition in insomnia-data. |
| packages/insomnia/src/insomnia-data/src/models/socket-io-payload.ts | Add SocketIOPayload model definition in insomnia-data. |
| packages/insomnia/src/insomnia-data/src/models/index.ts | Register new WS/IO models in insomnia-data model registry. |
| packages/insomnia/src/insomnia-data/node-src/services/websocket-response.ts | Refactor service to use insomnia-data model metadata + settings service. |
| packages/insomnia/src/insomnia-data/node-src/services/websocket-request.ts | Add WS request CRUD service implementation. |
| packages/insomnia/src/insomnia-data/node-src/services/websocket-payload.ts | Refactor WS payload service to use insomnia-data model metadata. |
| packages/insomnia/src/insomnia-data/node-src/services/stats.ts | Fix descendant request counting using migrated WS/IO type-guards. |
| packages/insomnia/src/insomnia-data/node-src/services/socket-io-response.ts | Refactor IO response service to use settings service + migrated model metadata. |
| packages/insomnia/src/insomnia-data/node-src/services/socket-io-request.ts | Add IO request CRUD service implementation. |
| packages/insomnia/src/insomnia-data/node-src/services/socket-io-payload.ts | Refactor IO payload service to use insomnia-data model metadata. |
| packages/insomnia/src/insomnia-data/node-src/services/index.ts | Register new WS/IO services in the node services contract. |
| packages/insomnia/src/insomnia-data/node-src/database/database.test.ts | Update tests to create WS/IO requests via services. |
| packages/insomnia/src/common/render.ts | Switch WS/IO request types to insomnia-data exports. |
| packages/insomnia/src/common/insomnia-v5.ts | Switch WS/IO request types to insomnia-data exports. |
| packages/insomnia/src/common/import.ts | Use migrated WS/IO type-guards during resource scanning. |
Comments suppressed due to low confidence (1)
packages/insomnia/src/insomnia-data/node-src/services/websocket-response.ts:4
modelsis imported from~/insomnia-data, but later this file callsmodels.requestVersion.create(...). The insomnia-datamodelsobject doesn’t includerequestVersion, so this will fail (and should be a TS error). Import* as modelsfrom~/models(as done insocket-io-response.ts), or otherwise sourcerequestVersionfrom the app models while keeping the WebSocketResponsetypeconsistent.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 63 out of 63 changed files in this pull request and generated 6 comments.
Comments suppressed due to low confidence (1)
packages/insomnia/src/insomnia-data/node-src/services/socket-io-response.ts:9
- This
socket-io-responseservice pullsmodelsfrom~/models(app layer) just to getsocketIOResponse.type/requestVersion. Forinsomnia-data/node-srcservices, prefer using../../src/modelsfor the response model constants (and importing app models only where strictly necessary). This reduces coupling and makes it easier to fully decouple/migrate models intoinsomnia-data.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+7
to
+12
| export const name = 'SocketIO Payload'; | ||
|
|
||
| export const type = 'SocketIOPayload'; | ||
|
|
||
| export const prefix = 'socket-io-payload'; | ||
|
|
There was a problem hiding this comment.
The model name string is "SocketIO Payload", but the request model uses "Socket.IO Request". Consider using "Socket.IO Payload" here as well to keep UI-facing names consistent.
Comment on lines
+2
to
+9
| import { models } from '~/insomnia-data'; | ||
| import { requestVersion as requestVersionModel } from '~/models'; | ||
| import * as requestOperations from '~/models/helpers/request-operations'; | ||
|
|
||
| import { database as db } from '../../src/database'; | ||
| import * as SettingsService from './settings'; | ||
|
|
||
| const { type } = models.webSocketResponse; |
There was a problem hiding this comment.
websocket-response service imports runtime models from ~/insomnia-data. In node-src services, it’s safer/more direct to import model constants from ../../src/models to avoid pulling in the services proxy module (and reduce circular init risk). This also keeps the node implementation self-contained as migrations continue.
Suggested change
| import { models } from '~/insomnia-data'; | |
| import { requestVersion as requestVersionModel } from '~/models'; | |
| import * as requestOperations from '~/models/helpers/request-operations'; | |
| import { database as db } from '../../src/database'; | |
| import * as SettingsService from './settings'; | |
| const { type } = models.webSocketResponse; | |
| import { webSocketResponse } from '../../src/models'; | |
| import { requestVersion as requestVersionModel } from '~/models'; | |
| import * as requestOperations from '~/models/helpers/request-operations'; | |
| import { database as db } from '../../src/database'; | |
| import * as SettingsService from './settings'; | |
| const { type } = webSocketResponse; |
Comment on lines
+2
to
+6
| import * as models from '~/models'; | ||
|
|
||
| import { database } from '../../src/database'; | ||
|
|
||
| const { type, name } = models.webSocketRequest; |
There was a problem hiding this comment.
websocket-request service is importing * as models from ~/models (the app model barrel). Since this file lives in insomnia-data/node-src, it should rely on insomnia-data's own model definitions (e.g. ../../src/models) to avoid a cross-package dependency and potential circular import issues as more models are migrated.
Suggested change
| import * as models from '~/models'; | |
| import { database } from '../../src/database'; | |
| const { type, name } = models.webSocketRequest; | |
| import { webSocketRequest } from '../../src/models'; | |
| import { database } from '../../src/database'; | |
| const { type, name } = webSocketRequest; |
| const sortKeyIncrement = (nextSortKey - request.metaSortKey) / 2; | ||
| const metaSortKey = request.metaSortKey + sortKeyIncrement; | ||
| return database.duplicate<WebSocketRequest>(request, { | ||
| name, |
There was a problem hiding this comment.
In duplicate(), the object passed to database.duplicate() includes { name, metaSortKey, ...patch }, where name is the model display name ('WebSocket Request'). If the original request has an empty name and the patch doesn’t set name, this will force the duplicated request’s name to 'WebSocket Request', contradicting the comment about leaving it blank so the URL can fill it automatically. Drop the name property here (or default to patch.name ?? request.name) so empty names stay empty unless explicitly set.
Suggested change
| name, |
Comment on lines
+23
to
+51
| // This is duplicated (lol) from models/request.js | ||
| export async function duplicate(request: SocketIORequest, patch: Partial<SocketIORequest> = {}) { | ||
| // Only set name and "(Copy)" if the patch does | ||
| // not define it and the request itself has a name. | ||
| // Otherwise leave it blank so the request URL can | ||
| // fill it in automatically. | ||
| if (!patch.name && request.name) { | ||
| patch.name = `${request.name} (Copy)`; | ||
| } | ||
|
|
||
| // Get sort key of next request | ||
| const q = { | ||
| metaSortKey: { | ||
| $gt: request.metaSortKey, | ||
| }, | ||
| }; | ||
|
|
||
| const [nextRequest] = await database.find<SocketIORequest>(type, q, { | ||
| metaSortKey: 1, | ||
| }); | ||
| const nextSortKey = nextRequest ? nextRequest.metaSortKey : request.metaSortKey + 100; | ||
| // Calculate new sort key | ||
| const sortKeyIncrement = (nextSortKey - request.metaSortKey) / 2; | ||
| const metaSortKey = request.metaSortKey + sortKeyIncrement; | ||
| return database.duplicate<SocketIORequest>(request, { | ||
| name, | ||
| metaSortKey, | ||
| ...patch, | ||
| }); |
There was a problem hiding this comment.
In duplicate(), { name, metaSortKey, ...patch } uses name from models.socketIORequest (the model display name). When neither the original request nor patch provides a name, the duplicate will be named 'Socket.IO Request' instead of remaining blank as the comment describes. Remove the name property from the duplicate patch (or ensure it only sets name when you explicitly want a default).
Comment on lines
+3
to
+8
| export const name = 'SocketIO Response'; | ||
|
|
||
| export const type = 'SocketIOResponse'; | ||
|
|
||
| export const prefix = 'socketIO-res'; | ||
|
|
There was a problem hiding this comment.
The model name string is "SocketIO Response", while the corresponding request model uses "Socket.IO Request". Consider renaming this to "Socket.IO Response" (and similarly for other Socket.IO models) to keep UI-facing names consistent with the Socket.IO branding.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migrate the following models into
insomnia-data:INS-2210