@atom8n/n8n 2.2.0

package/dist/credentials/credentials-finder.service.d.ts

@@ -0,0 +1,51 @@
+import type { SharedCredentials, User } from '@n8n/db';
+import { CredentialsEntity, CredentialsRepository, SharedCredentialsRepository } from '@n8n/db';
+import type { CredentialSharingRole, ProjectRole, Scope } from '@n8n/permissions';
+import type { EntityManager } from '@n8n/typeorm';
+import { RoleService } from '../services/role.service';
+export declare class CredentialsFinderService {
+    private readonly sharedCredentialsRepository;
+    private readonly credentialsRepository;
+    private readonly roleService;
+    constructor(sharedCredentialsRepository: SharedCredentialsRepository, credentialsRepository: CredentialsRepository, roleService: RoleService);
+    private fetchGlobalCredentials;
+    hasGlobalReadOnlyAccess(scopes: Scope[]): boolean;
+    findGlobalCredentialById(credentialId: string, relations?: {
+        shared: {
+            project: {
+                projectRelations: {
+                    user: boolean;
+                };
+            };
+        };
+    }): Promise<CredentialsEntity | null>;
+    findCredentialById(credentialId: string): Promise<CredentialsEntity | null>;
+    private mergeAndDeduplicateCredentials;
+    findCredentialsForUser(user: User, scopes: Scope[]): Promise<CredentialsEntity[]>;
+    findCredentialForUser(credentialsId: string, user: User, scopes: Scope[]): Promise<CredentialsEntity | null>;
+    findAllCredentialsForUser(user: User, scopes: Scope[], trx?: EntityManager, options?: {
+        includeGlobalCredentials?: boolean;
+    }): Promise<{
+        projectId: string;
+        name: string;
+        data: string;
+        type: string;
+        shared: SharedCredentials[];
+        isManaged: boolean;
+        isGlobal: boolean;
+        isResolvable: boolean;
+        resolvableAllowFallback: boolean;
+        resolverId: string | null;
+        id: string;
+        generateId(): void;
+        createdAt: Date;
+        updatedAt: Date;
+        setUpdateDate(): void;
+    }[]>;
+    getCredentialIdsByUserAndRole(userIds: string[], options: {
+        scopes: Scope[];
+    } | {
+        projectRoles: ProjectRole[];
+        credentialRoles: CredentialSharingRole[];
+    }, trx?: EntityManager): Promise<string[]>;
+}

package/dist/credentials/credentials-finder.service.js

@@ -0,0 +1,173 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialsFinderService = void 0;
+const db_1 = require("@n8n/db");
+const di_1 = require("@n8n/di");
+const permissions_1 = require("@n8n/permissions");
+const typeorm_1 = require("@n8n/typeorm");
+const role_service_1 = require("../services/role.service");
+let CredentialsFinderService = class CredentialsFinderService {
+    constructor(sharedCredentialsRepository, credentialsRepository, roleService) {
+        this.sharedCredentialsRepository = sharedCredentialsRepository;
+        this.credentialsRepository = credentialsRepository;
+        this.roleService = roleService;
+    }
+    async fetchGlobalCredentials(trx) {
+        const em = trx ?? this.credentialsRepository.manager;
+        return await em.find(db_1.CredentialsEntity, {
+            where: { isGlobal: true },
+            relations: { shared: true },
+        });
+    }
+    hasGlobalReadOnlyAccess(scopes) {
+        return scopes.length === 1 && scopes[0] === 'credential:read';
+    }
+    async findGlobalCredentialById(credentialId, relations) {
+        return await this.credentialsRepository.findOne({
+            where: {
+                id: credentialId,
+                isGlobal: true,
+            },
+            relations,
+        });
+    }
+    async findCredentialById(credentialId) {
+        return await this.credentialsRepository.findOne({ where: { id: credentialId } });
+    }
+    mergeAndDeduplicateCredentials(credentials, globalCredentials, mapGlobalCredential) {
+        const credentialIds = new Set(credentials.map((c) => c.id));
+        const newGlobalCreds = globalCredentials
+            .filter((gc) => !credentialIds.has(gc.id))
+            .map(mapGlobalCredential)
+            .filter((mapped) => mapped !== null);
+        return [...credentials, ...newGlobalCreds];
+    }
+    async findCredentialsForUser(user, scopes) {
+        let where = { isGlobal: false };
+        if (!(0, permissions_1.hasGlobalScope)(user, scopes, { mode: 'allOf' })) {
+            const [projectRoles, credentialRoles] = await Promise.all([
+                this.roleService.rolesWithScope('project', scopes),
+                this.roleService.rolesWithScope('credential', scopes),
+            ]);
+            where = {
+                ...where,
+                shared: {
+                    role: (0, typeorm_1.In)(credentialRoles),
+                    project: {
+                        projectRelations: {
+                            role: (0, typeorm_1.In)(projectRoles),
+                            userId: user.id,
+                        },
+                    },
+                },
+            };
+        }
+        const credentials = await this.credentialsRepository.find({
+            where,
+            relations: { shared: true },
+        });
+        if (this.hasGlobalReadOnlyAccess(scopes)) {
+            const globalCredentials = await this.fetchGlobalCredentials();
+            return [...credentials, ...globalCredentials];
+        }
+        return credentials;
+    }
+    async findCredentialForUser(credentialsId, user, scopes) {
+        let where = { credentialsId };
+        if (!(0, permissions_1.hasGlobalScope)(user, scopes, { mode: 'allOf' })) {
+            const [projectRoles, credentialRoles] = await Promise.all([
+                this.roleService.rolesWithScope('project', scopes),
+                this.roleService.rolesWithScope('credential', scopes),
+            ]);
+            where = {
+                ...where,
+                role: (0, typeorm_1.In)(credentialRoles),
+                project: {
+                    projectRelations: {
+                        role: (0, typeorm_1.In)(projectRoles),
+                        userId: user.id,
+                    },
+                },
+            };
+        }
+        const sharedCredential = await this.sharedCredentialsRepository.findOne({
+            where,
+            relations: {
+                credentials: {
+                    shared: { project: { projectRelations: { user: true } } },
+                },
+            },
+        });
+        if (sharedCredential) {
+            return sharedCredential.credentials;
+        }
+        if (this.hasGlobalReadOnlyAccess(scopes)) {
+            return await this.findGlobalCredentialById(credentialsId, {
+                shared: { project: { projectRelations: { user: true } } },
+            });
+        }
+        return null;
+    }
+    async findAllCredentialsForUser(user, scopes, trx, options) {
+        let where = {};
+        if (!(0, permissions_1.hasGlobalScope)(user, scopes, { mode: 'allOf' })) {
+            const [projectRoles, credentialRoles] = await Promise.all([
+                this.roleService.rolesWithScope('project', scopes),
+                this.roleService.rolesWithScope('credential', scopes),
+            ]);
+            where = {
+                role: (0, typeorm_1.In)(credentialRoles),
+                project: {
+                    projectRelations: {
+                        role: (0, typeorm_1.In)(projectRoles),
+                        userId: user.id,
+                    },
+                },
+            };
+        }
+        const sharedCredential = await this.sharedCredentialsRepository.findCredentialsWithOptions(where, trx);
+        let sharedCredentialsList = sharedCredential.map((sc) => ({
+            ...sc.credentials,
+            projectId: sc.projectId,
+        }));
+        if (options?.includeGlobalCredentials) {
+            const globalCredentials = await this.fetchGlobalCredentials(trx);
+            sharedCredentialsList = this.mergeAndDeduplicateCredentials(sharedCredentialsList, globalCredentials, (globalCred) => {
+                const ownerSharing = globalCred.shared?.find((s) => s.role === 'credential:owner');
+                const projectId = ownerSharing?.projectId;
+                if (projectId) {
+                    return { ...globalCred, projectId };
+                }
+                return null;
+            });
+        }
+        return sharedCredentialsList;
+    }
+    async getCredentialIdsByUserAndRole(userIds, options, trx) {
+        const projectRoles = 'scopes' in options
+            ? await this.roleService.rolesWithScope('project', options.scopes)
+            : options.projectRoles;
+        const credentialRoles = 'scopes' in options
+            ? await this.roleService.rolesWithScope('credential', options.scopes)
+            : options.credentialRoles;
+        const sharings = await this.sharedCredentialsRepository.findCredentialsByRoles(userIds, projectRoles, credentialRoles, trx);
+        return sharings.map((s) => s.credentialsId);
+    }
+};
+exports.CredentialsFinderService = CredentialsFinderService;
+exports.CredentialsFinderService = CredentialsFinderService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [db_1.SharedCredentialsRepository,
+        db_1.CredentialsRepository,
+        role_service_1.RoleService])
+], CredentialsFinderService);
+//# sourceMappingURL=credentials-finder.service.js.map

package/dist/credentials/credentials-finder.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-finder.service.js","sourceRoot":"","sources":["../../src/credentials/credentials-finder.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,gCAAgG;AAChG,gCAAkC;AAClC,kDAAkD;AAKlD,0CAAkC;AAElC,0DAAsD;AAG/C,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACpC,YACkB,2BAAwD,EACxD,qBAA4C,EAC5C,WAAwB;QAFxB,gCAA2B,GAA3B,2BAA2B,CAA6B;QACxD,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,gBAAW,GAAX,WAAW,CAAa;IACvC,CAAC;IAKI,KAAK,CAAC,sBAAsB,CAAC,GAAmB;QACvD,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;QACrD,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,sBAAiB,EAAE;YACvC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;YACzB,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SAC3B,CAAC,CAAC;IACJ,CAAC;IAMD,uBAAuB,CAAC,MAAe;QACtC,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,iBAAiB,CAAC;IAC/D,CAAC;IAKD,KAAK,CAAC,wBAAwB,CAC7B,YAAoB,EACpB,SAA4E;QAE5E,OAAO,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;YAC/C,KAAK,EAAE;gBACN,EAAE,EAAE,YAAY;gBAChB,QAAQ,EAAE,IAAI;aACd;YACD,SAAS;SACT,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAC5C,OAAO,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IAClF,CAAC;IAMO,8BAA8B,CACrC,WAAgB,EAChB,iBAAsC,EACtC,mBAA0D;QAE1D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5D,MAAM,cAAc,GAAG,iBAAiB;aACtC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;aACzC,GAAG,CAAC,mBAAmB,CAAC;aACxB,MAAM,CAAC,CAAC,MAAM,EAAe,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;QAEnD,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,cAAc,CAAC,CAAC;IAC5C,CAAC;IASD,KAAK,CAAC,sBAAsB,CAAC,IAAU,EAAE,MAAe;QACvD,IAAI,KAAK,GAAwC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAErE,IAAI,CAAC,IAAA,4BAAc,EAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;YACtD,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACzD,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC;gBAClD,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,YAAY,EAAE,MAAM,CAAC;aACrD,CAAC,CAAC;YACH,KAAK,GAAG;gBACP,GAAG,KAAK;gBACR,MAAM,EAAE;oBACP,IAAI,EAAE,IAAA,YAAE,EAAC,eAAe,CAAC;oBACzB,OAAO,EAAE;wBACR,gBAAgB,EAAE;4BACjB,IAAI,EAAE,IAAA,YAAE,EAAC,YAAY,CAAC;4BACtB,MAAM,EAAE,IAAI,CAAC,EAAE;yBACf;qBACD;iBACD;aACD,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;YACzD,KAAK;YACL,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SAC3B,CAAC,CAAC;QAGH,IAAI,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC9D,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,iBAAiB,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,WAAW,CAAC;IACpB,CAAC;IAGD,KAAK,CAAC,qBAAqB,CAC1B,aAAqB,EACrB,IAAU,EACV,MAAe;QAEf,IAAI,KAAK,GAAwC,EAAE,aAAa,EAAE,CAAC;QAEnE,IAAI,CAAC,IAAA,4BAAc,EAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;YACtD,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACzD,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC;gBAClD,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,YAAY,EAAE,MAAM,CAAC;aACrD,CAAC,CAAC;YACH,KAAK,GAAG;gBACP,GAAG,KAAK;gBACR,IAAI,EAAE,IAAA,YAAE,EAAC,eAAe,CAAC;gBACzB,OAAO,EAAE;oBACR,gBAAgB,EAAE;wBACjB,IAAI,EAAE,IAAA,YAAE,EAAC,YAAY,CAAC;wBACtB,MAAM,EAAE,IAAI,CAAC,EAAE;qBACf;iBACD;aACD,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC;YACvE,KAAK;YAEL,SAAS,EAAE;gBACV,WAAW,EAAE;oBACZ,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;iBACzD;aACD;SACD,CAAC,CAAC;QAEH,IAAI,gBAAgB,EAAE,CAAC;YACtB,OAAO,gBAAgB,CAAC,WAAW,CAAC;QACrC,CAAC;QAGD,IAAI,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,OAAO,MAAM,IAAI,CAAC,wBAAwB,CAAC,aAAa,EAAE;gBACzD,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;aACzD,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;IAGD,KAAK,CAAC,yBAAyB,CAC9B,IAAU,EACV,MAAe,EACf,GAAmB,EACnB,OAAgD;QAEhD,IAAI,KAAK,GAAwC,EAAE,CAAC;QAEpD,IAAI,CAAC,IAAA,4BAAc,EAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;YACtD,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACzD,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC;gBAClD,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,YAAY,EAAE,MAAM,CAAC;aACrD,CAAC,CAAC;YACH,KAAK,GAAG;gBACP,IAAI,EAAE,IAAA,YAAE,EAAC,eAAe,CAAC;gBACzB,OAAO,EAAE;oBACR,gBAAgB,EAAE;wBACjB,IAAI,EAAE,IAAA,YAAE,EAAC,YAAY,CAAC;wBACtB,MAAM,EAAE,IAAI,CAAC,EAAE;qBACf;iBACD;aACD,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,0BAA0B,CACzF,KAAK,EACL,GAAG,CACH,CAAC;QAEF,IAAI,qBAAqB,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACzD,GAAG,EAAE,CAAC,WAAW;YACjB,SAAS,EAAE,EAAE,CAAC,SAAS;SACvB,CAAC,CAAC,CAAC;QAGJ,IAAI,OAAO,EAAE,wBAAwB,EAAE,CAAC;YACvC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;YACjE,qBAAqB,GAAG,IAAI,CAAC,8BAA8B,CAC1D,qBAAqB,EACrB,iBAAiB,EACjB,CAAC,UAAU,EAAE,EAAE;gBAEd,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;gBACnF,MAAM,SAAS,GAAG,YAAY,EAAE,SAAS,CAAC;gBAC1C,IAAI,SAAS,EAAE,CAAC;oBACf,OAAO,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;gBACrC,CAAC;gBAED,OAAO,IAAI,CAAC;YACb,CAAC,CACD,CAAC;QACH,CAAC;QAED,OAAO,qBAAqB,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,6BAA6B,CAClC,OAAiB,EACjB,OAE4E,EAC5E,GAAmB;QAEnB,MAAM,YAAY,GACjB,QAAQ,IAAI,OAAO;YAClB,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC;YAClE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;QACzB,MAAM,eAAe,GACpB,QAAQ,IAAI,OAAO;YAClB,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC;YACrE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QAE5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAC7E,OAAO,EACP,YAAY,EACZ,eAAe,EACf,GAAG,CACH,CAAC;QAEF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC;CACD,CAAA;AA9OY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,YAAO,GAAE;qCAGsC,gCAA2B;QACjC,0BAAqB;QAC/B,0BAAW;GAJ9B,wBAAwB,CA8OpC"}

package/dist/credentials/credentials.controller.d.ts

@@ -0,0 +1,87 @@
+import { CreateCredentialDto, CredentialsGetManyRequestQuery, CredentialsGetOneRequestQuery, GenerateCredentialNameRequestQuery } from '@n8n/api-types';
+import { LicenseState, Logger } from '@n8n/backend-common';
+import { GlobalConfig } from '@n8n/config';
+import { ProjectRelationRepository, SharedCredentialsRepository, AuthenticatedRequest } from '@n8n/db';
+import { CredentialsFinderService } from './credentials-finder.service';
+import { CredentialsService } from './credentials.service';
+import { EnterpriseCredentialsService } from './credentials.service.ee';
+import { EventService } from '../events/event.service';
+import { CredentialRequest } from '../requests';
+import { NamingService } from '../services/naming.service';
+import { UserManagementMailer } from '../user-management/email';
+export declare class CredentialsController {
+    private readonly globalConfig;
+    private readonly credentialsService;
+    private readonly enterpriseCredentialsService;
+    private readonly namingService;
+    private readonly licenseState;
+    private readonly logger;
+    private readonly userManagementMailer;
+    private readonly sharedCredentialsRepository;
+    private readonly projectRelationRepository;
+    private readonly eventService;
+    private readonly credentialsFinderService;
+    constructor(globalConfig: GlobalConfig, credentialsService: CredentialsService, enterpriseCredentialsService: EnterpriseCredentialsService, namingService: NamingService, licenseState: LicenseState, logger: Logger, userManagementMailer: UserManagementMailer, sharedCredentialsRepository: SharedCredentialsRepository, projectRelationRepository: ProjectRelationRepository, eventService: EventService, credentialsFinderService: CredentialsFinderService);
+    getMany(req: CredentialRequest.GetMany, _res: unknown, query: CredentialsGetManyRequestQuery): Promise<import("@n8n/db").CredentialsEntity[]>;
+    getProjectCredentials(req: CredentialRequest.ForWorkflow): Promise<{
+        id: string;
+        name: string;
+        type: string;
+        scopes: import("@n8n/permissions").Scope[];
+        isManaged: boolean;
+        isGlobal: boolean;
+    }[]>;
+    generateUniqueName(_req: unknown, _res: unknown, query: GenerateCredentialNameRequestQuery): Promise<{
+        name: string;
+    }>;
+    getOne(req: CredentialRequest.Get, _res: unknown, credentialId: string, query: CredentialsGetOneRequestQuery): Promise<{
+        scopes: import("@n8n/permissions").Scope[];
+        name: string;
+        type: string;
+        isManaged: boolean;
+        isGlobal: boolean;
+        isResolvable: boolean;
+        resolvableAllowFallback: boolean;
+        resolverId: string | null;
+        id: string;
+        generateId(): void;
+        createdAt: Date;
+        updatedAt: Date;
+        setUpdateDate(): void;
+    }>;
+    testCredentials(req: CredentialRequest.Test): Promise<import("n8n-workflow").INodeCredentialTestResult>;
+    createCredentials(req: AuthenticatedRequest, _: Response, payload: CreateCredentialDto): Promise<{
+        scopes: import("@n8n/permissions").Scope[];
+        name: string;
+        data: string;
+        type: string;
+        isManaged: boolean;
+        isGlobal: boolean;
+        isResolvable: boolean;
+        resolvableAllowFallback: boolean;
+        resolverId: string | null;
+        id: string;
+        generateId(): void;
+        createdAt: Date;
+        updatedAt: Date;
+        setUpdateDate(): void;
+    }>;
+    updateCredentials(req: CredentialRequest.Update): Promise<{
+        scopes: import("@n8n/permissions").Scope[];
+        name: string;
+        type: string;
+        isManaged: boolean;
+        isGlobal: boolean;
+        isResolvable: boolean;
+        resolvableAllowFallback: boolean;
+        resolverId: string | null;
+        id: string;
+        generateId(): void;
+        createdAt: Date;
+        updatedAt: Date;
+        setUpdateDate(): void;
+    }>;
+    deleteCredentials(req: CredentialRequest.Delete): Promise<boolean>;
+    shareCredentials(req: CredentialRequest.Share): Promise<void>;
+    transfer(req: CredentialRequest.Transfer): Promise<void>;
+}

package/dist/credentials/credentials.controller.js

@@ -0,0 +1,350 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialsController = void 0;
+const api_types_1 = require("@n8n/api-types");
+const backend_common_1 = require("@n8n/backend-common");
+const config_1 = require("@n8n/config");
+const db_1 = require("@n8n/db");
+const decorators_1 = require("@n8n/decorators");
+const permissions_1 = require("@n8n/permissions");
+const typeorm_1 = require("@n8n/typeorm");
+const n8n_workflow_1 = require("n8n-workflow");
+const zod_1 = require("zod");
+const credentials_finder_service_1 = require("./credentials-finder.service");
+const credentials_service_1 = require("./credentials.service");
+const credentials_service_ee_1 = require("./credentials.service.ee");
+const bad_request_error_1 = require("../errors/response-errors/bad-request.error");
+const forbidden_error_1 = require("../errors/response-errors/forbidden.error");
+const not_found_error_1 = require("../errors/response-errors/not-found.error");
+const event_service_1 = require("../events/event.service");
+const middlewares_1 = require("../middlewares");
+const naming_service_1 = require("../services/naming.service");
+const email_1 = require("../user-management/email");
+const utils = __importStar(require("../utils"));
+let CredentialsController = class CredentialsController {
+    constructor(globalConfig, credentialsService, enterpriseCredentialsService, namingService, licenseState, logger, userManagementMailer, sharedCredentialsRepository, projectRelationRepository, eventService, credentialsFinderService) {
+        this.globalConfig = globalConfig;
+        this.credentialsService = credentialsService;
+        this.enterpriseCredentialsService = enterpriseCredentialsService;
+        this.namingService = namingService;
+        this.licenseState = licenseState;
+        this.logger = logger;
+        this.userManagementMailer = userManagementMailer;
+        this.sharedCredentialsRepository = sharedCredentialsRepository;
+        this.projectRelationRepository = projectRelationRepository;
+        this.eventService = eventService;
+        this.credentialsFinderService = credentialsFinderService;
+    }
+    async getMany(req, _res, query) {
+        const credentials = await this.credentialsService.getMany(req.user, {
+            listQueryOptions: req.listQueryOptions,
+            includeScopes: query.includeScopes,
+            includeData: query.includeData,
+            onlySharedWithMe: query.onlySharedWithMe,
+            includeGlobal: query.includeGlobal,
+        });
+        credentials.forEach((c) => {
+            delete c.shared;
+        });
+        return credentials;
+    }
+    async getProjectCredentials(req) {
+        const options = zod_1.z
+            .union([zod_1.z.object({ workflowId: zod_1.z.string() }), zod_1.z.object({ projectId: zod_1.z.string() })])
+            .parse(req.query);
+        return await this.credentialsService.getCredentialsAUserCanUseInAWorkflow(req.user, options);
+    }
+    async generateUniqueName(_req, _res, query) {
+        const requestedName = query.name ?? this.globalConfig.credentials.defaultName;
+        return {
+            name: await this.namingService.getUniqueCredentialName(requestedName),
+        };
+    }
+    async getOne(req, _res, credentialId, query) {
+        const { shared, ...credential } = this.licenseState.isSharingLicensed()
+            ? await this.enterpriseCredentialsService.getOneForUser(req.user, credentialId, query.includeData)
+            : await this.credentialsService.getOne(req.user, credentialId, query.includeData);
+        const scopes = await this.credentialsService.getCredentialScopes(req.user, req.params.credentialId);
+        return { ...credential, scopes };
+    }
+    async testCredentials(req) {
+        const { credentials } = req.body;
+        const storedCredential = await this.credentialsFinderService.findCredentialForUser(credentials.id, req.user, ['credential:read']);
+        if (!storedCredential) {
+            throw new forbidden_error_1.ForbiddenError();
+        }
+        const mergedCredentials = (0, n8n_workflow_1.deepCopy)(credentials);
+        const decryptedData = this.credentialsService.decrypt(storedCredential, true);
+        await this.credentialsService.replaceCredentialContentsForSharee(req.user, storedCredential, decryptedData, mergedCredentials);
+        if (mergedCredentials.data) {
+            mergedCredentials.data = this.credentialsService.unredact(mergedCredentials.data, decryptedData);
+        }
+        return await this.credentialsService.test(req.user.id, mergedCredentials);
+    }
+    async createCredentials(req, _, payload) {
+        const newCredential = await this.credentialsService.createUnmanagedCredential(payload, req.user);
+        const project = await this.sharedCredentialsRepository.findCredentialOwningProject(newCredential.id);
+        this.eventService.emit('credentials-created', {
+            user: req.user,
+            credentialType: newCredential.type,
+            credentialId: newCredential.id,
+            publicApi: false,
+            projectId: project?.id,
+            projectType: project?.type,
+            uiContext: payload.uiContext,
+        });
+        return newCredential;
+    }
+    async updateCredentials(req) {
+        const { body, user, params: { credentialId }, } = req;
+        const credential = await this.credentialsFinderService.findCredentialForUser(credentialId, user, ['credential:update']);
+        if (!credential) {
+            this.logger.info('Attempt to update credential blocked due to lack of permissions', {
+                credentialId,
+                userId: user.id,
+            });
+            throw new not_found_error_1.NotFoundError('Credential to be updated not found. You can only update credentials owned by you');
+        }
+        if (credential.isManaged) {
+            throw new bad_request_error_1.BadRequestError('Managed credentials cannot be updated');
+        }
+        const decryptedData = this.credentialsService.decrypt(credential, true);
+        delete body.data?.oauthTokenData;
+        const preparedCredentialData = await this.credentialsService.prepareUpdateData(req.body, decryptedData);
+        const newCredentialData = this.credentialsService.createEncryptedData({
+            id: credential.id,
+            name: preparedCredentialData.name,
+            type: preparedCredentialData.type,
+            data: preparedCredentialData.data,
+        });
+        const isGlobal = body.isGlobal;
+        if (isGlobal !== undefined && isGlobal !== credential.isGlobal) {
+            if (!this.licenseState.isSharingLicensed()) {
+                throw new forbidden_error_1.ForbiddenError('You are not licensed for sharing credentials');
+            }
+            const canShareGlobally = (0, permissions_1.hasGlobalScope)(req.user, 'credential:shareGlobally');
+            if (!canShareGlobally) {
+                throw new forbidden_error_1.ForbiddenError('You do not have permission to change global sharing for credentials');
+            }
+            newCredentialData.isGlobal = isGlobal;
+        }
+        newCredentialData.isResolvable = body.isResolvable ?? credential.isResolvable;
+        const responseData = await this.credentialsService.update(credentialId, newCredentialData);
+        if (responseData === null) {
+            throw new not_found_error_1.NotFoundError(`Credential ID "${credentialId}" could not be found to be updated.`);
+        }
+        const { data, shared, ...rest } = responseData;
+        this.logger.debug('Credential updated', { credentialId });
+        this.eventService.emit('credentials-updated', {
+            user: req.user,
+            credentialType: credential.type,
+            credentialId: credential.id,
+        });
+        const scopes = await this.credentialsService.getCredentialScopes(req.user, credential.id);
+        return { ...rest, scopes };
+    }
+    async deleteCredentials(req) {
+        const { credentialId } = req.params;
+        const credential = await this.credentialsFinderService.findCredentialForUser(credentialId, req.user, ['credential:delete']);
+        if (!credential) {
+            this.logger.info('Attempt to delete credential blocked due to lack of permissions', {
+                credentialId,
+                userId: req.user.id,
+            });
+            throw new not_found_error_1.NotFoundError('Credential to be deleted not found. You can only removed credentials owned by you');
+        }
+        await this.credentialsService.delete(req.user, credential.id);
+        this.eventService.emit('credentials-deleted', {
+            user: req.user,
+            credentialType: credential.type,
+            credentialId: credential.id,
+        });
+        return true;
+    }
+    async shareCredentials(req) {
+        const { credentialId } = req.params;
+        const { shareWithIds } = req.body;
+        if (!Array.isArray(shareWithIds) ||
+            !shareWithIds.every((userId) => typeof userId === 'string')) {
+            throw new bad_request_error_1.BadRequestError('Bad request');
+        }
+        const credential = await this.credentialsFinderService.findCredentialForUser(credentialId, req.user, ['credential:share']);
+        if (!credential) {
+            throw new forbidden_error_1.ForbiddenError();
+        }
+        let amountRemoved = null;
+        let newShareeIds = [];
+        const { manager: dbManager } = this.sharedCredentialsRepository;
+        await dbManager.transaction(async (trx) => {
+            const currentProjectIds = credential.shared
+                .filter((sc) => sc.role === 'credential:user')
+                .map((sc) => sc.projectId);
+            const newProjectIds = shareWithIds;
+            const toShare = utils.rightDiff([currentProjectIds, (id) => id], [newProjectIds, (id) => id]);
+            const toUnshare = utils.rightDiff([newProjectIds, (id) => id], [currentProjectIds, (id) => id]);
+            const deleteResult = await trx.delete(db_1.SharedCredentials, {
+                credentialsId: credentialId,
+                projectId: (0, typeorm_1.In)(toUnshare),
+            });
+            await this.enterpriseCredentialsService.shareWithProjects(req.user, credential.id, toShare, trx);
+            if (deleteResult.affected) {
+                amountRemoved = deleteResult.affected;
+            }
+            newShareeIds = toShare;
+        });
+        this.eventService.emit('credentials-shared', {
+            user: req.user,
+            credentialType: credential.type,
+            credentialId: credential.id,
+            userIdSharer: req.user.id,
+            userIdsShareesAdded: newShareeIds,
+            shareesRemoved: amountRemoved,
+        });
+        const projectsRelations = await this.projectRelationRepository.findBy({
+            projectId: (0, typeorm_1.In)(newShareeIds),
+            role: { slug: permissions_1.PROJECT_OWNER_ROLE_SLUG },
+        });
+        await this.userManagementMailer.notifyCredentialsShared({
+            sharer: req.user,
+            newShareeIds: projectsRelations.map((pr) => pr.userId),
+            credentialsName: credential.name,
+        });
+    }
+    async transfer(req) {
+        const body = zod_1.z.object({ destinationProjectId: zod_1.z.string() }).parse(req.body);
+        return await this.enterpriseCredentialsService.transferOne(req.user, req.params.credentialId, body.destinationProjectId);
+    }
+};
+exports.CredentialsController = CredentialsController;
+__decorate([
+    (0, decorators_1.Get)('/', { middlewares: middlewares_1.listQueryMiddleware }),
+    __param(2, decorators_1.Query),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, api_types_1.CredentialsGetManyRequestQuery]),
+    __metadata("design:returntype", Promise)
+], CredentialsController.prototype, "getMany", null);
+__decorate([
+    (0, decorators_1.Get)('/for-workflow'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], CredentialsController.prototype, "getProjectCredentials", null);
+__decorate([
+    (0, decorators_1.Get)('/new'),
+    __param(2, decorators_1.Query),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, api_types_1.GenerateCredentialNameRequestQuery]),
+    __metadata("design:returntype", Promise)
+], CredentialsController.prototype, "generateUniqueName", null);
+__decorate([
+    (0, decorators_1.Get)('/:credentialId'),
+    (0, decorators_1.ProjectScope)('credential:read'),
+    __param(2, (0, decorators_1.Param)('credentialId')),
+    __param(3, decorators_1.Query),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, String, api_types_1.CredentialsGetOneRequestQuery]),
+    __metadata("design:returntype", Promise)
+], CredentialsController.prototype, "getOne", null);
+__decorate([
+    (0, decorators_1.Post)('/test'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], CredentialsController.prototype, "testCredentials", null);
+__decorate([
+    (0, decorators_1.Post)('/'),
+    __param(2, decorators_1.Body),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Response,
+        api_types_1.CreateCredentialDto]),
+    __metadata("design:returntype", Promise)
+], CredentialsController.prototype, "createCredentials", null);
+__decorate([
+    (0, decorators_1.Patch)('/:credentialId'),
+    (0, decorators_1.ProjectScope)('credential:update'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], CredentialsController.prototype, "updateCredentials", null);
+__decorate([
+    (0, decorators_1.Delete)('/:credentialId'),
+    (0, decorators_1.ProjectScope)('credential:delete'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], CredentialsController.prototype, "deleteCredentials", null);
+__decorate([
+    (0, decorators_1.Licensed)('feat:sharing'),
+    (0, decorators_1.Put)('/:credentialId/share'),
+    (0, decorators_1.ProjectScope)('credential:share'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], CredentialsController.prototype, "shareCredentials", null);
+__decorate([
+    (0, decorators_1.Put)('/:credentialId/transfer'),
+    (0, decorators_1.ProjectScope)('credential:move'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], CredentialsController.prototype, "transfer", null);
+exports.CredentialsController = CredentialsController = __decorate([
+    (0, decorators_1.RestController)('/credentials'),
+    __metadata("design:paramtypes", [config_1.GlobalConfig,
+        credentials_service_1.CredentialsService,
+        credentials_service_ee_1.EnterpriseCredentialsService,
+        naming_service_1.NamingService,
+        backend_common_1.LicenseState,
+        backend_common_1.Logger,
+        email_1.UserManagementMailer,
+        db_1.SharedCredentialsRepository,
+        db_1.ProjectRelationRepository,
+        event_service_1.EventService,
+        credentials_finder_service_1.CredentialsFinderService])
+], CredentialsController);
+//# sourceMappingURL=credentials.controller.js.map