mirror of
https://github.com/mountain-loop/yaak.git
synced 2026-09-12 22:17:20 -04:00
Gregory SchierandClaude Opus 5
ea3eb5d92d
Some providers need the token request to carry something the plugin does not generate. Entra rejects the exchange without an `Origin` header, Auth0 wants a `realm` body field, and other servers want extra params on the authorize URL. Each of those was a separate request for the same thing: control over what goes out. Adds five key_value lists to the Advanced section, laid out the way Postman and Bruno split the same feature, so the expectation is already set: - Authorization Request Params (query, on the authorize URL) - Token Request Headers / Body Params - Refresh Request Headers / Body Params The design brief called for one list with per-row placement and target selects. The form API has no per-row select — a key_value row is name, value, enabled — and adding a form input type for this was out of scope, so the placement and target dimensions are spent on the list labels instead. The cost is five editors where one would do; the gain is no new plugin API surface, and the labels say plainly where each row lands. Token entries are also sent on refresh, since a server that demands an `Origin` on the exchange demands it on the refresh too, and making users duplicate every row would be the common case. A refresh row of the same name replaces the token row when the two requests genuinely differ. Precedence is one rule everywhere: a custom entry drops every generated entry of that name, then appends. Headers match case-insensitively, form params exactly. Dropping by name rather than substituting in place keeps repeated custom rows, which repeatable headers rely on. Merging happens last, so `Content-Type`, `Accept`, `User-Agent`, and the credential header are all overridable. `redirect_uri` is the one exception, and deliberately: it belongs to the callback flow, not the user, and overriding it points the code at something that is not listening. The third post in the cluster, scope-only-on-authorize, is already fixed and shipped in 2026.7.0 (#579), so nothing here re-solves it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>