[WIP] Added support for resolving vault secrets on-demand basis #1538
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem Statement
Currently, vault secrets must be pre-loaded as a VariableScope with all values passed upfront via options.vaultSecrets. This requires the consumer (e.g., Postman App, Newman) to:
Know all vault secrets that might be needed before the run starts
Fetch all secrets synchronously before runtime initialization
Handle secret refresh/expiry outside of the runtime flow
Solution
Introduce an on-demand resolution mechanism where:
Runtime detects which vault variables are referenced (e.g., {{vault:secret_key}})
Calls an async resolver function provided by the consumer to fetch those specific secrets
Resolves secrets at the point of need (request resolution, script execution)
Maintains existing domain-based filtering behavior