fix: remove request from saved responses

[nealrichardson]

NEWS summary:

request is now removed when saving httr2_response objects. In earlier versions of httr2, requests were not included in responses, but in httr2 1.0.0, they were added in order to improve error messages. If you recorded any responses with httr2 >= 1.0 and httptest2 prior to this version, you may have leaked auth secrets: this would happen if your requests included auth information (as in an Authentication header), and the response was saved in a .R file, not simplified to .json or other response-body-only formats. Please inspect your recorded responses and invalidate any tokens that were exposed.

cc @jmaspons

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 99.50%. Comparing base (cff21ee) to head (2b8159d).

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #38   +/-   ##
=======================================
  Coverage   99.50%   99.50%           
=======================================
  Files          14       14           
  Lines         400      401    +1     
=======================================
+ Hits          398      399    +1     
  Misses          2        2           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[jmaspons]

Should update vignette too

httptest2/vignettes/redacting.Rmd

Line 19 in 96b61db

By default, the `capture_requests()` context evaluates the `redact_cookies()` function on a response object before writing it to disk. `redact_cookies()` redacts the `Set-Cookie` response header, which may contain auth credentials. Many APIs don't return anything in the HTTP response that leaks auth secrets, and while you send secrets in your request, the `httr2_request` object isn't saved in the mocks, only the `httr2_response`.

[nealrichardson]

Well, it's true now, right? The request isn't saved in the mocks (anymore).

[jmaspons]

Yes, you are right