Fix inherited folder auth not applied correctly for OAuth2 requests [INS-2671]

[yaoweiprc]

Close INS-2671

Problem

When a request inherited OAuth2 authentication from a parent folder, Insomnia would incorrectly reuse a cached token belonging to a sibling folder's credentials instead of the folder actually providing the auth.

This manifested when multiple sibling folders each had distinct OAuth2 configurations and requests inside them used inherited auth — all requests would end up sharing the token that was fetched first.

Root Cause

Two separate bugs, both caused by incorrect array traversal direction:

1. Wrong ancestor in getExistingAccessTokenAndRefreshIfExpired (get-token.ts)

db.withAncestors returns ancestors in leaf-to-root order (i.e. [closestFolder, ..., rootFolder]). The token cache lookup used .reverse().find() on this array, which reversed the order to root-to-leaf and therefore found the farthest ancestor with auth instead of the nearest one. This caused the wrong closestAuthId to be used as the token cache key.

2. In-place mutation in getOrInheritHeaders (network.ts)

getOrInheritHeaders called requestGroups.reverse() directly, which mutates the original array in-place. When getOrInheritHeaders and getOrInheritAuthentication were called sequentially (as in render.ts), the second call received an already-reversed array. This masked the bug in getOrInheritAuthentication by accident, but was itself incorrect and fragile.

Fix

• get-token.ts: Removed .reverse() from the ancestor traversal. Since the input is already leaf-to-root, a plain .find() now correctly returns the nearest ancestor with auth.
• network.ts — getOrInheritAuthentication: Removed .reverse() to match the corrected leaf-to-root contract. Added a comment documenting the expected input order.
• network.ts — getOrInheritHeaders: Changed requestGroups.reverse() to [...requestGroups].reverse() to avoid mutating the caller's array.

Related PRs

• https://github.com/Kong/insomnia/pull/8345/changes#diff-cc2479e11623891c8c7a329087ad50c1f140db4b1e753ea94af01e59af95484dR71
• fix: closest folder auth determination logic [INS-638] #8884

[Copilot]

Pull request overview

This PR fixes authentication inheritance so that the closest parent folder’s enabled auth configuration is applied (instead of accidentally preferring higher-level/root folders), and aligns OAuth2 token resolution with the same ancestor ordering.

Changes:

• Update folder-auth selection to use requestGroups in leaf-to-root order (closest-first) rather than reversing before searching.
• Prevent accidental mutation of requestGroups when building inherited headers.
• Document the leaf-to-root ordering contract of withAncestors() and add clarifying comments at key call sites.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
packages/insomnia/src/network/network.ts	Fixes closest-folder auth inheritance logic and avoids mutating requestGroups when inheriting headers.
packages/insomnia/src/main/network/o-auth-2/get-token.ts	Ensures OAuth2 token parent selection uses closest folder auth based on leaf-to-root ordering.
packages/insomnia/src/insomnia-data/node-src/database/database-nedb.ts	Documents that withAncestors() returns results in leaf-to-root order.
packages/insomnia/src/common/render.ts	Adds clarification that requestGroups are leaf-to-root when derived from render ancestors.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

✅ Circular References Report

Generated at: 2026-06-02T10:04:42.126Z
Status: ✅ NO CHANGE

Summary

Metric	Base (develop)	PR	Change
Total Circular References	10	10	0 (0.00%)

Click to view all circular references in PR (10)

insomnia-inso/src/db/models/types.ts -> insomnia-inso/src/db/types.ts
insomnia/src/network/network.ts -> insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/collection.ts -> insomnia-scripting-environment/src/objects/response.ts
insomnia/src/network/network.ts -> insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/insomnia.ts -> insomnia-scripting-environment/src/objects/interfaces.ts
insomnia/src/network/network.ts -> insomnia/src/common/render.ts
insomnia/src/plugins/index.ts -> insomnia/src/plugins/context/store.ts
insomnia/src/plugins/misc.ts -> insomnia/src/plugins/index.ts
insomnia/src/ui/components/settings/import-export.tsx -> insomnia/src/ui/components/modals/export-requests-modal.tsx
insomnia/src/ui/components/tabs/tab-list.tsx -> insomnia/src/ui/components/tabs/tab.tsx
insomnia/src/ui/components/templating/tag-editor-arg-sub-form.tsx -> insomnia/src/ui/components/templating/external-vault/external-vault-form.tsx
insomnia/src/ui/components/viewers/response-viewer.tsx -> insomnia/src/ui/components/viewers/response-multipart-viewer.tsx

Click to view all circular references in base branch (10)

insomnia-inso/src/db/models/types.ts -> insomnia-inso/src/db/types.ts
insomnia/src/network/network.ts -> insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/collection.ts -> insomnia-scripting-environment/src/objects/response.ts
insomnia/src/network/network.ts -> insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/insomnia.ts -> insomnia-scripting-environment/src/objects/interfaces.ts
insomnia/src/network/network.ts -> insomnia/src/common/render.ts
insomnia/src/plugins/index.ts -> insomnia/src/plugins/context/store.ts
insomnia/src/plugins/misc.ts -> insomnia/src/plugins/index.ts
insomnia/src/ui/components/settings/import-export.tsx -> insomnia/src/ui/components/modals/export-requests-modal.tsx
insomnia/src/ui/components/tabs/tab-list.tsx -> insomnia/src/ui/components/tabs/tab.tsx
insomnia/src/ui/components/templating/tag-editor-arg-sub-form.tsx -> insomnia/src/ui/components/templating/external-vault/external-vault-form.tsx
insomnia/src/ui/components/viewers/response-viewer.tsx -> insomnia/src/ui/components/viewers/response-multipart-viewer.tsx

Analysis

✅ No Change: This PR does not introduce or remove any circular references.

---

This report was generated automatically by comparing against the develop branch.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ yaoweiprc
❌ Copilot
_{You have signed the CLA already but the status is still pending? Let us recheck it.}