@aiteza/n8n-nodes-aiteza 1.0.1 → 1.1.1

package/dist/credentials/AitezaWebhookApi.credentials.d.ts

@@ -0,0 +1,16 @@
+import type { ICredentialType, INodeProperties } from 'n8n-workflow';
+/**
+ * Shared secret used by the AITEZA Trigger node to authenticate incoming
+ * webhook requests. The caller must send this value as an
+ * "Authorization: Bearer <apiKey>" header.
+ */
+export declare class AitezaWebhookApi implements ICredentialType {
+    name: string;
+    displayName: string;
+    documentationUrl: string;
+    icon: {
+        readonly light: "file:aiteza.svg";
+        readonly dark: "file:aiteza.svg";
+    };
+    properties: INodeProperties[];
+}

package/dist/credentials/AitezaWebhookApi.credentials.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AitezaWebhookApi = void 0;
+/**
+ * Shared secret used by the AITEZA Trigger node to authenticate incoming
+ * webhook requests. The caller must send this value as an
+ * "Authorization: Bearer <apiKey>" header.
+ */
+class AitezaWebhookApi {
+    name = 'aitezaWebhookApi';
+    displayName = 'AITEZA Webhook API Key';
+    documentationUrl = 'https://docs.aiteza.com';
+    icon = { light: 'file:aiteza.svg', dark: 'file:aiteza.svg' };
+    properties = [
+        {
+            displayName: 'API Key',
+            name: 'apiKey',
+            type: 'string',
+            typeOptions: { password: true },
+            default: '',
+            required: true,
+            description: 'The shared secret that incoming webhook requests must send as an "Authorization: Bearer <apiKey>" header.',
+        },
+    ];
+}
+exports.AitezaWebhookApi = AitezaWebhookApi;

package/dist/nodes/Aiteza/AitezaTrigger.node.js

@@ -1,6 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AitezaTrigger = void 0;
+function timingSafeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return diff === 0;
+}
+async function getWebhookApiKey(ctx) {
+    try {
+        const credentials = await ctx.getCredentials('aitezaWebhookApi');
+        return (credentials?.apiKey ?? '').trim();
+    }
+    catch {
+        return '';
+    }
+}
 class AitezaTrigger {
     description = {
         displayName: 'AITEZA Trigger',
@@ -12,7 +30,12 @@ class AitezaTrigger {
         defaults: { name: 'AITEZA Trigger' },
         inputs: [],
         outputs: ['main'],
-        credentials: [],
+        credentials: [
+            {
+                name: 'aitezaWebhookApi',
+                required: false,
+            },
+        ],
         webhooks: [
             {
                 name: 'default',
@@ -71,6 +94,12 @@ class AitezaTrigger {
         const userBearer = user.bearerToken ?? '';
         const authHeader = headers.authorization || headers.Authorization || '';
         const headerToken = authHeader.replace(/^Bearer\s+/i, '');
+        const expectedApiKey = await getWebhookApiKey(this);
+        if (expectedApiKey && !timingSafeEqual(headerToken, expectedApiKey)) {
+            const res = this.getResponseObject();
+            res.status(401).json({ error: 'Unauthorized' });
+            return { noWebhookResponse: true };
+        }
         const authToken = userBearer || headerToken;
         const baseUrl = this.getNodeParameter('baseUrl', '').replace(/\/+$/, '');
         const outputData = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiteza/n8n-nodes-aiteza",
-  "version": "1.0.1",
+  "version": "1.1.1",
   "description": "n8n Community Node for the AITEZA REST API (Datarooms, Files, Chat, Search, Workflows)",
   "keywords": [
     "n8n-community-node-package",
@@ -30,7 +30,8 @@
   "n8n": {
     "n8nNodesApiVersion": 1,
     "credentials": [
-      "dist/credentials/AitezaOAuth2Api.credentials.js"
+      "dist/credentials/AitezaOAuth2Api.credentials.js",
+      "dist/credentials/AitezaWebhookApi.credentials.js"
     ],
     "nodes": [
       "dist/nodes/Aiteza/Aiteza.node.js",