fix(importer-postman): stop swapping the API key name and its value

[NgoQuocViet2001]

Summary

The Postman importer assigns API Key auth crosswise, so an imported request sends the secret as the header name and the header name as the secret. Restore the identity mapping and make the fixture non-degenerate so the swap cannot hide again.

Submission

• This PR is a bug fix.
• If this PR is not a bug fix, I linked the feedback item where @gschier explicitly gave me permission to work on it.
• I have read and followed CONTRIBUTING.md.
• I tested this change locally.
• I added or updated tests, or tests are not reasonable for this change.
• I added screenshots or recordings, or this change does not affect the UI.

Detail

pmArrayToObj keys Postman's array by the parameter name:

if (typeof ii.key === "string") {
  o[ii.key] = ii.value;
}

so for a Postman apikey block, a.key is the header/query parameter name and a.value is the secret. importAuth then reverses them:

key: a.value != null ? String(a.value) : undefined,
value: a.key != null ? String(a.key) : undefined,

That is the opposite of what the field means everywhere else. auth-apikey labels key as "Header Name" / "Parameter Name" and value as "API Key" with password: true, and applies them as setHeaders: [{ name: key, value }]. The sibling branches in this same function — basic, bearer, awsv4 — all map straight across; apikey is the only one that crosses.

A collection importing X-API-Key: secret-123 therefore produces a request that sends secret-123: X-API-Key. It fails with 401/403, and because the masking follows the field rather than the content, the secret ends up displayed in the plaintext "Key" box while the harmless header name sits behind the password mask.

Why the tests did not catch it

auth.input.json used the degenerate values key="key" and value="value", so the swapped output read {"key": "value", "value": "key"} — which looks plausible enough to bless. This PR changes them to X-API-Key and secret-123.

Test plan

• Ran the three importer fixtures through convertPostman and compared against their .output.json exactly as tests/index.test.ts does → all three match.
• Checked: restoring only the swap fails auth.input.json with "key": "secret-123" where "key": "X-API-Key" is expected.
• No UI change; the only surface is the imported request's auth fields.

[github-actions]

Thanks for the PR. This appears to match Yaak's contribution policy and is awaiting review by @gschier.

This only means the PR is in scope for review. It does not mean the change has been reviewed or accepted for merge.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge and correctly fixes the reversed API-key name and secret mapping.

Summary

• Maps Postman’s API-key key to Yaak’s parameter name and value to its secret.
• Replaces ambiguous fixture values with distinct header-name and secret values.
• Updates the exact expected importer output to guard against future field swapping.

_{Reviews (1) · Last reviewed commit: "fix(importer-postman): stop swapping the..."}

[gschier]

Nice catch. Thanks for the fix!