New api

[binarymist]

• The apiKey is now required on ZapClient instantiation only. By default the apiKey is required by Zap
• Support added for promises and legacy callbacks
• Replaced vars with consts
• Generation should be based on develop branch and from the latest minor tag (I.E. 2.7.0) to not include unreleased API endpoints
• Tested on my projects which leverage promises

• Todo future PR: @binarymist:
  • Remove lodash (a1643a2)
  • Update insecure and out of date packages (a1643a2)
  • New readme (46e8b14)
  • Provide release notes (c242bc4)
  • Update node engine in package.json (d236ca3)

Addresses #5044

[thc202]

Was the API generated from develop branch? Ideally it should be from tag 2.7.0 to not include unreleased API endpoints.

[binarymist]

Tested:

• Running Zap with -config api.disablekey=true and instantiating ClientApi with:
  1. Good key: subsequent requests succeed
  2. Bad key: subsequent requests succeed
• Running Zap with -config api.key=<key> and instantiating ClientApi with:
  1. Good key: subsequent requests succeed
  2. Bad key: subsequent requests fail

[binarymist]

API was generated from develop branch, not tag 2.7.0, wasn't aware of this requirement. See (zaproxy/zaproxy#5088 (comment))

[binarymist]

Was the API generated from develop branch? Ideally it should be from tag 2.7.0

8fdfeae

[binarymist]

Thanks for the review @thc202

[binarymist]

Breaking while dog fooding until extensions removed:
16225c9

[binarymist]

How's it going @thc202 @psiinon ? What can I do to help push this through?

[psiinon]

It its ready to review then we can look at it next week :)
Many thanks!

[binarymist]

With the week being nearly over, I thought I'd ask how's progress?

[thc202]

I talked with @psiinon yesterday about this, I'll push the add-ons' APIs shortly (with that it should be good to go?).

[binarymist]

It'd be good if I can do all of that generation as well, to help take load off of you. As the Node API maintainer I'm happy to do all of that each time, so long as I know what to do. I've been recording all my steps so far, so this should just become part of that procedure. Once the additional add-ons are generated -> commited -> pushed (to this PR I guess?), then I can go through all of the API files for a review.

These todo's are all being tracked here

[thc202]

Agreed, but the API generation is currently broken in the zap-extensions repo, that's why I'm suggesting pushing/doing that myself (it will require a newer core version to fix it, 2.8.0?). Yes, it will be pushed to this PR.

[thc202]

@binarymist APIs pushed, PTAL (feel free to squash/fix up, if it looks fine). I'll open PRs to zap-extensions to fix the generation (it will still require a new ZAP jar for proper generation though).

[binarymist]

Roger that @thc202, and thanks! Will try review this weekend.

[binarymist]

I've checked about 2/3 of your files @thc202, and a small collection of mine and I'm not seeing any obvious issues.

There are some tweaks I'd like to make at some stage that are not essential, like changing the line:

out.write("  if ("+safeName(param.toLowerCase())+" && "+safeName(param.toLowerCase())+" !== null) {\n");

where if (start) would be sufficient, the !== null check seems redundant.

Example in ajaxSpider.js and many other files:

if (start && start !== null)

It'd be good to get this PR merged first though and ideally published to NPM. Where should we track these types of changes, I'd like to assign them to me, but I won't see them on this repo.

If you've had a bit of a look through the files, then I guess it's just a couple more items to check off?

[binarymist]

How are we going with this @psiinon @thc202 ?

[thc202]

Good to go once the typo is fixed.

[thc202]

Regarding the planned tweaks, I think it's fine to raise the issues in the main repo.

[binarymist]

Regarding the planned tweaks, I think it's fine to raise the issues in the main repo.

Ok, but someone will need to bug me about them, else I may forget.

[thc202]

Sure.

Thanks for the PR!

[kingthorin]

Ok, but someone will need to bug me about them, else I may forget.

Can do.