@ixiam/n8n-nodes-civicrm 3.0.0 → 3.2.2

package/dist/src/nodes/CiviCrm/CiviCrm.node.js

@@ -57,12 +57,9 @@ class CiviCrm {
             icon: 'file:civicrm.svg',
             group: ['transform'],
             version: 1,
-            description: 'Interact with CiviCRM API v4 (Civi-Go compatible).\n\n' +
-                'Supports Contact, Membership, Group, Relationship, Activity entities, and Custom API Call.\n' +
-                'Includes dynamic mapping of email, phone, address and location types.\n' +
-                'Includes birth_date validation and JSON filters for GET MANY.\n',
+            description: 'Interact with CiviCRM API v4 to manage contacts, memberships, groups, and more.',
             defaults: { name: 'CiviCRM' },
-            subtitle: '={{{"get":"Get","getMany":"Get Many","create":"Create","update":"Update","delete":"Delete"}[$parameter["operation"]] + ": " + {"contact":"Contact","membership":"Membership","group":"Group","relationship":"Relationship","activity":"Activity","customApi":"Custom API Call"}[$parameter["resource"]]}}',
+            subtitle: '={{{"get":"Get","getMany":"Get Many","create":"Create","update":"Update","delete":"Delete","raw":"Raw API Call","getFields":"List Fields","search":"Dynamic Search"}[$parameter["operation"]] + ": " + {"contact":"Contact","membership":"Membership","group":"Group","relationship":"Relationship","activity":"Activity","customApi":"Custom API Call"}[$parameter["resource"]]}}',
             inputs: [n8n_workflow_1.NodeConnectionTypes.Main],
             outputs: [n8n_workflow_1.NodeConnectionTypes.Main],
             // @ts-ignore
@@ -406,6 +403,65 @@ class CiviCrm {
                         },
                     ],
                 },
+                // ======================================================================
+                // CUSTOM API — LIST FIELDS / DYNAMIC SEARCH
+                // ======================================================================
+                {
+                    displayName: 'List Fields (Any Entity)',
+                    name: 'customApiGetFields',
+                    action: 'List fields for any CiviCRM entity',
+                    description: 'Call {Entity}/getFields on any CiviCRM APIv4 entity (Contact, Contribution, Event, Case, custom entities, etc.) and return field metadata (name, type, required, options...) as node output. Run this before a Dynamic Search or Custom API Call for an entity/field you have not verified yet on this installation.',
+                    displayOptions: { show: { resource: ['customApi'], operation: ['getFields'] } },
+                    properties: [
+                        {
+                            displayName: 'Action Context',
+                            name: 'getFieldsAction',
+                            type: 'string',
+                            default: 'get',
+                            description: 'CiviCRM action context passed to getFields (e.g. get, create, update). Affects which fields are reported as required/readonly for that context.',
+                        },
+                    ],
+                },
+                {
+                    displayName: 'Dynamic Search (Any Entity)',
+                    name: 'customApiSearch',
+                    action: 'Run a dynamic search on any CiviCRM entity',
+                    description: 'Run {Entity}/get with a configurable Select and Where for any CiviCRM APIv4 entity, not limited to Contact/Membership/Group/Relationship/Activity. Verify field names first with List Fields (Any Entity).',
+                    displayOptions: { show: { resource: ['customApi'], operation: ['search'] } },
+                    properties: [
+                        {
+                            displayName: 'Select (JSON)',
+                            name: 'searchSelectJson',
+                            type: 'string',
+                            default: '["id"]',
+                            placeholder: '["id","display_name","custom_12"]',
+                            description: 'JSON array of field names to return, verified beforehand via getFields.',
+                        },
+                        {
+                            displayName: 'Where (JSON)',
+                            name: 'searchWhereJson',
+                            type: 'string',
+                            default: '',
+                            placeholder: '[["city","=","Bilbao"]]',
+                            description: "JSON array of [field, operator, value] triples, same pattern as Get Many's Where (JSON).",
+                        },
+                        {
+                            displayName: 'Return All',
+                            name: 'searchReturnAll',
+                            type: 'boolean',
+                            default: false,
+                            description: 'Whether to return all results or only up to a given limit.',
+                        },
+                        {
+                            displayName: 'Limit',
+                            name: 'searchLimit',
+                            type: 'number',
+                            typeOptions: { minValue: 1, maxValue: 1000 },
+                            default: 100,
+                            description: 'Max number of results to return. Defaults to 100.',
+                        },
+                    ],
+                },
             ],
             credentials: [{ name: 'civiCrmApi', required: true }],
             properties: [
@@ -414,6 +470,7 @@ class CiviCrm {
                 //
                 resources_1.resourceProp,
                 resources_1.operationProp,
+                resources_1.customApiOperationProp,
                 //
                 // CONTACT TYPE
                 //
@@ -548,7 +605,15 @@ class CiviCrm {
                     default: 'get',
                     required: true,
                     description: 'CiviCRM API4 action, for example get, getFields, create, update, delete, getOne, etc.',
-                    displayOptions: { show: { resource: ['customApi'] } },
+                    // Also shown for the legacy operation values a customApi node saved
+                    // before `customApiOperationProp` existed may still carry (see that
+                    // prop's comments) - execute() treats all of them as the raw path.
+                    displayOptions: {
+                        show: {
+                            resource: ['customApi'],
+                            operation: ['raw', 'get', 'getMany', 'create', 'update', 'delete'],
+                        },
+                    },
                 },
                 {
                     displayName: 'Params (JSON)',
@@ -559,7 +624,88 @@ class CiviCrm {
                     },
                     default: '{\n  "limit": 25\n}',
                     description: 'Raw API4 params JSON passed as-is to CiviCRM. It must be a valid JSON object (no trailing commas).',
-                    displayOptions: { show: { resource: ['customApi'] } },
+                    displayOptions: {
+                        show: {
+                            resource: ['customApi'],
+                            operation: ['raw', 'get', 'getMany', 'create', 'update', 'delete'],
+                        },
+                    },
+                },
+                //
+                // CUSTOM API — LIST FIELDS (ANY ENTITY)
+                //
+                {
+                    displayName: 'Action Context',
+                    name: 'getFieldsAction',
+                    type: 'string',
+                    default: 'get',
+                    description: 'CiviCRM action context passed to getFields (e.g. get, create, update). Affects which fields are reported as required/readonly for that context.',
+                    displayOptions: { show: { resource: ['customApi'], operation: ['getFields'] } },
+                },
+                //
+                // CUSTOM API — DYNAMIC SEARCH (ANY ENTITY)
+                //
+                {
+                    displayName: 'Select (JSON)',
+                    name: 'searchSelectJson',
+                    type: 'string',
+                    default: '["id"]',
+                    placeholder: '["id","display_name","custom_12"]',
+                    description: 'JSON array of field names to return, verified beforehand via getFields.',
+                    displayOptions: { show: { resource: ['customApi'], operation: ['search'] } },
+                },
+                {
+                    displayName: 'Where (JSON)',
+                    name: 'searchWhereJson',
+                    type: 'string',
+                    default: '',
+                    placeholder: '[["city","=","Bilbao"]]',
+                    description: "JSON array of [field, operator, value] triples, same pattern as Get Many's Where (JSON).",
+                    displayOptions: { show: { resource: ['customApi'], operation: ['search'] } },
+                },
+                {
+                    displayName: 'Return All',
+                    name: 'searchReturnAll',
+                    type: 'boolean',
+                    default: false,
+                    description: 'Whether to return all results or only up to a given limit.',
+                    displayOptions: { show: { resource: ['customApi'], operation: ['search'] } },
+                },
+                {
+                    displayName: 'Limit',
+                    name: 'searchLimit',
+                    type: 'number',
+                    typeOptions: { minValue: 1, maxValue: 1000 },
+                    default: 100,
+                    description: 'Max number of results to return. Defaults to 100.',
+                    displayOptions: {
+                        show: { resource: ['customApi'], operation: ['search'], searchReturnAll: [false] },
+                    },
+                },
+                //
+                // RUNTIME BEARER TOKEN (per-execution JWT, e.g. Authx JWT of the real
+                // logged-in CiviCRM user - see GenericFunctions.civicrmApiRequest)
+                //
+                {
+                    displayName: 'Runtime Bearer Token (Optional)',
+                    name: 'runtimeBearerToken',
+                    type: 'string',
+                    typeOptions: { password: true },
+                    default: '',
+                    description: 'A JWT already issued for a specific real user (e.g. a CiviCRM Authx JWT minted by ' +
+                        'Drupal for the logged-in contact), usually set by expression such as ' +
+                        '={{ $json.user_jwt }}. If set, it is used exactly as given as the ' +
+                        '"Authorization: Bearer" header for this call, bypassing this node\'s ' +
+                        "credential-based JWT auto-resolve and API key entirely. If the CiviCRM response " +
+                        'is empty or an error with this token, it is returned/thrown as-is - the node does ' +
+                        'NOT retry with the credential\'s API key, because an empty result is what a correct ' +
+                        "permission check looks like when this user lacks access, not a failure to compensate " +
+                        'for. Leave empty to use the credential (JWT auto-resolve or API key) as before.',
+                    displayOptions: {
+                        show: {
+                            operation: ['get', 'getMany', 'getFields', 'search', 'raw'],
+                        },
+                    },
                 },
                 //
                 // DYNAMIC FIELDS
@@ -597,7 +743,7 @@ class CiviCrm {
        EXECUTE
     ============================================================================ */
     async execute() {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t;
         const items = this.getInputData();
         const out = [];
         const resource = this.getNodeParameter('resource', 0);
@@ -605,9 +751,96 @@ class CiviCrm {
         const entity = resource !== 'customApi' ? ENTITY_MAP[resource] : '';
         for (let i = 0; i < items.length; i++) {
             try {
-                // Custom API call: generic passthrough to any API4 entity/action
+                // Per-execution JWT for a specific real user (issue #25 - permissions
+                // by real user via Authx), read once per item so it can come from an
+                // expression like ={{ $json.user_jwt }}. Only threaded into the
+                // read-only operations this parameter is exposed for (get/getMany/
+                // getFields/search/raw Custom API Call) - see civicrmApiRequest for
+                // why an empty result with this token must never fall back to the
+                // credential's API key.
+                const runtimeBearerToken = this.getNodeParameter('runtimeBearerToken', i, '').trim() || undefined;
+                // Custom API resource: raw passthrough, plus first-class List Fields /
+                // Dynamic Search operations for any API4 entity (not just the 5 fixed
+                // resources above).
                 if (resource === 'customApi') {
                     const customEntity = this.getNodeParameter('customEntity', i);
+                    // Any value other than 'getFields'/'search' (including the new
+                    // 'raw' default and every legacy value the shared operationProp
+                    // used to allow here) resolves to the original raw passthrough.
+                    const customOperation = this.getNodeParameter('operation', i, 'raw');
+                    /* --------------------------------------------------------
+                       LIST FIELDS: {Entity}/getFields
+                    -------------------------------------------------------- */
+                    if (customOperation === 'getFields') {
+                        const actionContext = this.getNodeParameter('getFieldsAction', i, 'get');
+                        const res = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${customEntity}/getFields`, { action: actionContext, loadOptions: true }, runtimeBearerToken);
+                        const vals = ((_a = res === null || res === void 0 ? void 0 : res.values) !== null && _a !== void 0 ? _a : []);
+                        if (Array.isArray(vals) && vals.length) {
+                            for (const v of vals) {
+                                out.push({ json: v, pairedItem: { item: i } });
+                            }
+                        }
+                        else {
+                            out.push({ json: (_b = res) !== null && _b !== void 0 ? _b : {}, pairedItem: { item: i } });
+                        }
+                        continue;
+                    }
+                    /* --------------------------------------------------------
+                       DYNAMIC SEARCH: {Entity}/get with configurable select/where
+                    -------------------------------------------------------- */
+                    if (customOperation === 'search') {
+                        const selectJson = this.getNodeParameter('searchSelectJson', i, '["id"]');
+                        const whereJson = this.getNodeParameter('searchWhereJson', i, '');
+                        const returnAll = this.getNodeParameter('searchReturnAll', i, false);
+                        const limit = this.getNodeParameter('searchLimit', i, 100);
+                        let select = ['id'];
+                        if (selectJson) {
+                            try {
+                                select = JSON.parse(selectJson);
+                            }
+                            catch (error) {
+                                throw new Error('Invalid JSON in "Select (JSON)"');
+                            }
+                        }
+                        let where = [];
+                        if (whereJson) {
+                            try {
+                                where = JSON.parse(whereJson);
+                            }
+                            catch (error) {
+                                throw new Error('Invalid JSON in "Where (JSON)"');
+                            }
+                        }
+                        if (returnAll) {
+                            let offset = 0;
+                            const page = 500;
+                            let hasMore = true;
+                            while (hasMore) {
+                                const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${customEntity}/get`, { select, where, limit: page, offset }, runtimeBearerToken);
+                                const vals = ((_c = r === null || r === void 0 ? void 0 : r.values) !== null && _c !== void 0 ? _c : []);
+                                for (const v of vals) {
+                                    out.push({ json: v, pairedItem: { item: i } });
+                                }
+                                if (vals.length < page) {
+                                    hasMore = false;
+                                }
+                                else {
+                                    offset += page;
+                                }
+                            }
+                        }
+                        else {
+                            const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${customEntity}/get`, { select, where, limit }, runtimeBearerToken);
+                            const vals = ((_d = r === null || r === void 0 ? void 0 : r.values) !== null && _d !== void 0 ? _d : []);
+                            for (const v of vals) {
+                                out.push({ json: v, pairedItem: { item: i } });
+                            }
+                        }
+                        continue;
+                    }
+                    /* --------------------------------------------------------
+                       RAW API CALL (original behavior, unchanged)
+                    -------------------------------------------------------- */
                     const action = this.getNodeParameter('customAction', i);
                     const paramsJson = this.getNodeParameter('customParamsJson', i, '');
                     let params = {};
@@ -619,7 +852,7 @@ class CiviCrm {
                             throw new Error('Invalid JSON in "Params (JSON)"');
                         }
                     }
-                    const res = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${customEntity}/${action}`, params);
+                    const res = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${customEntity}/${action}`, params, runtimeBearerToken);
                     // Return the raw API4 response so advanced users can work with values and metadata
                     out.push({
                         json: res,
@@ -668,9 +901,9 @@ class CiviCrm {
                             limit: 1,
                             select: ['id', 'name', 'title', 'subject', 'display_name'],
                         };
-                    const res = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/get`, params);
+                    const res = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/get`, params, runtimeBearerToken);
                     out.push({
-                        json: (_b = (_a = res === null || res === void 0 ? void 0 : res.values) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : {},
+                        json: (_f = (_e = res === null || res === void 0 ? void 0 : res.values) === null || _e === void 0 ? void 0 : _e[0]) !== null && _f !== void 0 ? _f : {},
                         pairedItem: { item: i },
                     });
                     continue;
@@ -726,8 +959,8 @@ class CiviCrm {
                         const page = 500;
                         let hasMore = true;
                         while (hasMore) {
-                            const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/get`, { ...params, limit: page, offset });
-                            const vals = (_c = r === null || r === void 0 ? void 0 : r.values) !== null && _c !== void 0 ? _c : [];
+                            const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/get`, { ...params, limit: page, offset }, runtimeBearerToken);
+                            const vals = (_g = r === null || r === void 0 ? void 0 : r.values) !== null && _g !== void 0 ? _g : [];
                             for (const v of vals) {
                                 out.push({
                                     json: v,
@@ -743,8 +976,8 @@ class CiviCrm {
                         }
                     }
                     else {
-                        const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/get`, { ...params, limit });
-                        const vals = (_d = r === null || r === void 0 ? void 0 : r.values) !== null && _d !== void 0 ? _d : [];
+                        const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/get`, { ...params, limit }, runtimeBearerToken);
+                        const vals = (_h = r === null || r === void 0 ? void 0 : r.values) !== null && _h !== void 0 ? _h : [];
                         for (const v of vals) {
                             out.push({
                                 json: v,
@@ -898,7 +1131,7 @@ class CiviCrm {
                 let contactId = id;
                 if (isCreate) {
                     const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Contact/create', { values });
-                    contactId = (_f = (_e = r === null || r === void 0 ? void 0 : r.values) === null || _e === void 0 ? void 0 : _e[0]) === null || _f === void 0 ? void 0 : _f.id;
+                    contactId = (_k = (_j = r === null || r === void 0 ? void 0 : r.values) === null || _j === void 0 ? void 0 : _j[0]) === null || _k === void 0 ? void 0 : _k.id;
                     if (!contactId)
                         throw new Error('Failed to create contact.');
                 }
@@ -954,7 +1187,7 @@ class CiviCrm {
                                 limit: 1,
                                 select: ['id'],
                             });
-                            const existingEmailId = (_h = (_g = existingEmail === null || existingEmail === void 0 ? void 0 : existingEmail.values) === null || _g === void 0 ? void 0 : _g[0]) === null || _h === void 0 ? void 0 : _h.id;
+                            const existingEmailId = (_m = (_l = existingEmail === null || existingEmail === void 0 ? void 0 : existingEmail.values) === null || _l === void 0 ? void 0 : _l[0]) === null || _m === void 0 ? void 0 : _m.id;
                             if (existingEmailId) {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Email/update', {
                                     values: {
@@ -997,7 +1230,7 @@ class CiviCrm {
                                 limit: 1,
                                 select: ['id'],
                             });
-                            const existingPhoneId = (_k = (_j = existingPhone === null || existingPhone === void 0 ? void 0 : existingPhone.values) === null || _j === void 0 ? void 0 : _j[0]) === null || _k === void 0 ? void 0 : _k.id;
+                            const existingPhoneId = (_p = (_o = existingPhone === null || existingPhone === void 0 ? void 0 : existingPhone.values) === null || _o === void 0 ? void 0 : _o[0]) === null || _p === void 0 ? void 0 : _p.id;
                             if (existingPhoneId) {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Phone/update', {
                                     values: {
@@ -1040,7 +1273,7 @@ class CiviCrm {
                                 limit: 1,
                                 select: ['id'],
                             });
-                            const existingAddressId = (_m = (_l = existingAddress === null || existingAddress === void 0 ? void 0 : existingAddress.values) === null || _l === void 0 ? void 0 : _l[0]) === null || _m === void 0 ? void 0 : _m.id;
+                            const existingAddressId = (_r = (_q = existingAddress === null || existingAddress === void 0 ? void 0 : existingAddress.values) === null || _q === void 0 ? void 0 : _q[0]) === null || _r === void 0 ? void 0 : _r.id;
                             if (existingAddressId) {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Address/update', {
                                     values: {
@@ -1090,7 +1323,7 @@ class CiviCrm {
                         : {}),
                 });
                 out.push({
-                    json: (_p = (_o = res === null || res === void 0 ? void 0 : res.values) === null || _o === void 0 ? void 0 : _o[0]) !== null && _p !== void 0 ? _p : {},
+                    json: (_t = (_s = res === null || res === void 0 ? void 0 : res.values) === null || _s === void 0 ? void 0 : _s[0]) !== null && _t !== void 0 ? _t : {},
                     pairedItem: { item: i },
                 });
             }

package/dist/src/nodes/CiviCrm/descriptions/resources.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.operationProp = exports.resourceProp = void 0;
+exports.customApiOperationProp = exports.operationProp = exports.resourceProp = void 0;
 //
 // =======================
 // RESOURCE SELECTOR
@@ -27,6 +27,12 @@ exports.resourceProp = {
 // OPERATION SELECTOR
 // =======================
 //
+// Scoped to the 5 fixed resources only (Custom API Call has its own operation
+// dropdown below, `customApiOperationProp`). n8n resolves which of the two
+// same-named `operation` properties to render based on the current `resource`
+// value, since their `displayOptions.show.resource` lists are mutually
+// exclusive - this keeps the fixed-resource CRUD operations completely
+// unchanged while giving Custom API Call room for its own operation set.
 exports.operationProp = {
     displayName: 'Operation',
     name: 'operation',
@@ -34,6 +40,7 @@ exports.operationProp = {
     default: 'getMany',
     noDataExpression: true,
     description: 'The action to perform on the selected resource.',
+    displayOptions: { show: { resource: ['contact', 'membership', 'group', 'relationship', 'activity'] } },
     options: [
         { name: 'Create', value: 'create', description: 'Create a new record' },
         { name: 'Delete', value: 'delete', description: 'Delete a record by ID' },
@@ -42,3 +49,37 @@ exports.operationProp = {
         { name: 'Update', value: 'update', description: 'Update a record by ID' },
     ],
 };
+//
+// =======================
+// CUSTOM API OPERATION SELECTOR
+// =======================
+//
+// Only shown when Resource = "Custom API Call". `raw` preserves the original
+// hand-typed entity/action/params passthrough. `getFields` and `search` are
+// new, structured, discoverable operations for any CiviCRM APIv4 entity (not
+// just the 5 fixed resources) - see CiviCrm.node.ts for how they're executed.
+//
+// The option list intentionally also matches every legacy value the old,
+// shared `operationProp` could have stored for a `customApi` resource node
+// saved before this property existed (get/getMany/create/update/delete), so
+// pre-existing saved workflows keep resolving to the `raw` execution path
+// with their `customAction`/`customParamsJson` fields still visible/editable.
+exports.customApiOperationProp = {
+    displayName: 'Operation',
+    name: 'operation',
+    type: 'options',
+    default: 'raw',
+    noDataExpression: true,
+    description: 'The action to perform via the Custom API Call resource.',
+    displayOptions: { show: { resource: ['customApi'] } },
+    options: [
+        { name: 'Raw API Call', value: 'raw', description: 'Hand-typed entity/action/params passthrough to any CiviCRM APIv4 endpoint (advanced/escape hatch)' },
+        { name: 'List Fields', value: 'getFields', description: 'Call {Entity}/getFields and return field metadata for any CiviCRM entity' },
+        { name: 'Dynamic Search', value: 'search', description: 'Run {Entity}/get with a configurable Select and Where for any CiviCRM entity' },
+        { name: 'Get (Legacy)', value: 'get', description: 'Legacy value, resolves to Raw API Call' },
+        { name: 'Get Many (Legacy)', value: 'getMany', description: 'Legacy value, resolves to Raw API Call' },
+        { name: 'Create (Legacy)', value: 'create', description: 'Legacy value, resolves to Raw API Call' },
+        { name: 'Update (Legacy)', value: 'update', description: 'Legacy value, resolves to Raw API Call' },
+        { name: 'Delete (Legacy)', value: 'delete', description: 'Legacy value, resolves to Raw API Call' },
+    ],
+};

package/dist/src/nodes/transport/GenericFunctions.js

@@ -55,17 +55,60 @@ function buildCiviAuthHeaders(credentials, baseUrl, jwtToken) {
 /**
  * Executes a CiviCRM API v4 call with authentication (JWT or API Key).
  * Falls back to API Key if JWT is unavailable, fails, or returns empty results.
+ *
+ * `runtimeBearerToken` (optional) is a per-execution JWT that the caller
+ * already holds for a specific real user (e.g. a CiviCRM Authx JWT minted by
+ * Drupal for the logged-in contact, passed into the node via the "Runtime
+ * Bearer Token" parameter/expression). When provided, it takes absolute
+ * priority: it is sent as-is and none of the credential-based logic below
+ * (JWT auto-resolve via `getServerIssuedJwt`/`resolveContactId`, or the
+ * empty-response/error fallback to the credential's API key) runs at all.
+ * See the early-return block right below for why.
  */
-async function civicrmApiRequest(method, path, body) {
-    var _a, _b, _c;
+async function civicrmApiRequest(method, path, body, runtimeBearerToken) {
+    var _a, _b, _c, _d;
     const credentials = (await this.getCredentials('civiCrmApi'));
     const baseUrl = credentials.baseUrl.replace(/\/$/, '');
     const apiToken = credentials.apiToken;
+    // Runtime bearer token path: used exactly as given, with no fallback.
+    //
+    // This exists for per-user permission enforcement (issue #25): the token
+    // here already belongs to a specific real CiviCRM contact (not the
+    // credential's own contact/API key owner), so an empty or denied response
+    // is a *correct* outcome - it means that real user lacks permission for
+    // the requested data - not a failure to silently "fix" by retrying with a
+    // more privileged identity. That is exactly the behavior the credential-based
+    // path below has (empty JWT response -> retry with the plaintext API key),
+    // and it is exactly what must NOT happen here, so this path never falls
+    // through into that logic.
+    if (runtimeBearerToken) {
+        const headers = {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            Authorization: `Bearer ${runtimeBearerToken}`,
+        };
+        const options = {
+            method,
+            url: `${baseUrl}${path}`,
+            headers,
+            body: {
+                params: JSON.stringify((_a = body.params) !== null && _a !== void 0 ? _a : body),
+            },
+            json: true,
+        };
+        try {
+            // Whatever CiviCRM returns (including an empty `values: []`) is
+            // returned to the caller untouched - no retry, no fallback.
+            return await this.helpers.httpRequest.call(this, options);
+        }
+        catch (error) {
+            throw new n8n_workflow_1.NodeApiError(this.getNode(), error);
+        }
+    }
     let jwtToken;
     let useJwt = false;
     // Attempt to obtain JWT if enabled
     if ((0, JwtAuth_1.isJwtAuthEnabled)(credentials)) {
-        const ttl = Number((_a = credentials.jwtExpiry) !== null && _a !== void 0 ? _a : 3600);
+        const ttl = Number((_b = credentials.jwtExpiry) !== null && _b !== void 0 ? _b : 3600);
         try {
             // Auto-resolve contact ID is built-in to getServerIssuedJwt
             jwtToken = await (0, JwtAuth_1.getServerIssuedJwt)(this, baseUrl, apiToken, 0, ttl);
@@ -73,7 +116,6 @@ async function civicrmApiRequest(method, path, body) {
                 useJwt = true;
             }
             else {
-                console.warn('[CiviCRM] JWT generation returned no token, falling back to API key');
                 this.addExecutionHints({
                     message: 'JWT authentication could not be obtained (no token returned by CiviCRM). Falling back to API Key authentication.',
                     type: 'warning',
@@ -83,7 +125,6 @@ async function civicrmApiRequest(method, path, body) {
         }
         catch (error) {
             const errorMsg = getHttpErrorDetails(error);
-            console.warn(`[CiviCRM] JWT generation failed: ${errorMsg}. Falling back to API key.`);
             this.addExecutionHints({
                 message: `JWT authentication failed (${errorMsg}). Falling back to API Key authentication.`,
                 type: 'warning',
@@ -99,7 +140,7 @@ async function civicrmApiRequest(method, path, body) {
             url: `${baseUrl}${path}`,
             headers,
             body: {
-                params: JSON.stringify((_b = body.params) !== null && _b !== void 0 ? _b : body),
+                params: JSON.stringify((_c = body.params) !== null && _c !== void 0 ? _c : body),
             },
             json: true,
         };
@@ -111,7 +152,6 @@ async function civicrmApiRequest(method, path, body) {
                 return response;
             }
             else {
-                console.warn('[CiviCRM] JWT returned empty response. Retrying with API key (JWT may have limited permissions).');
                 this.addExecutionHints({
                     message: 'The JWT-authenticated request returned no data (JWT may have limited permissions). Retrying with API Key authentication.',
                     type: 'warning',
@@ -122,7 +162,6 @@ async function civicrmApiRequest(method, path, body) {
         }
         catch (error) {
             const errorMsg = getHttpErrorDetails(error);
-            console.warn('[CiviCRM] JWT request failed. Retrying with API key.');
             this.addExecutionHints({
                 message: `The JWT-authenticated request failed (${errorMsg}). Retrying with API Key authentication.`,
                 type: 'warning',
@@ -138,16 +177,12 @@ async function civicrmApiRequest(method, path, body) {
         url: `${baseUrl}${path}`,
         headers: apiKeyHeaders,
         body: {
-            params: JSON.stringify((_c = body.params) !== null && _c !== void 0 ? _c : body),
+            params: JSON.stringify((_d = body.params) !== null && _d !== void 0 ? _d : body),
         },
         json: true,
     };
     try {
-        const response = await this.helpers.httpRequest.call(this, apiKeyOptions);
-        if (useJwt && jwtToken) {
-            console.log('[CiviCRM] API key request successful (JWT was insufficient, using API key as fallback)');
-        }
-        return response;
+        return await this.helpers.httpRequest.call(this, apiKeyOptions);
     }
     catch (error) {
         throw new n8n_workflow_1.NodeApiError(this.getNode(), error);

package/dist/src/nodes/transport/JwtAuth.js

@@ -8,28 +8,6 @@ const contactIdCache = {}; // Cache resolved contact IDs
 function isJwtAuthEnabled(credentials) {
     return (credentials === null || credentials === void 0 ? void 0 : credentials.enableJwtAuth) === true;
 }
-/**
- * Extracts a readable message from an HTTP error, including the response body
- * (e.g. CiviCRM's "Login not permitted. Must satisfy guard (perm, site_key)."),
- * which the bare `error.message` (e.g. "Request failed with status code 401")
- * does not include.
- */
-function getErrorDetails(error) {
-    var _a, _b, _c;
-    const errorObj = error;
-    const status = (_a = errorObj === null || errorObj === void 0 ? void 0 : errorObj.response) === null || _a === void 0 ? void 0 : _a.status;
-    const data = (_b = errorObj === null || errorObj === void 0 ? void 0 : errorObj.response) === null || _b === void 0 ? void 0 : _b.data;
-    const message = (_c = errorObj === null || errorObj === void 0 ? void 0 : errorObj.message) !== null && _c !== void 0 ? _c : String(error);
-    const body = typeof data === 'string' && data.trim()
-        ? data
-        : data && typeof data === 'object'
-            ? JSON.stringify(data)
-            : undefined;
-    if (body) {
-        return status ? `${message} | HTTP ${status} body: ${body}` : `${message} | body: ${body}`;
-    }
-    return status ? `${message} | HTTP ${status}` : message;
-}
 /**
  * Resolve the current authenticated user's contact ID from Contact/get.
  * Finds the contact that owns the given api_key.
@@ -60,16 +38,13 @@ async function resolveContactId(context, baseUrl, apiToken) {
         });
         const contacts = (response === null || response === void 0 ? void 0 : response.values) || [];
         if (contacts.length === 0) {
-            console.warn('[CiviCRM] Contact/get found no contact with this api_key - JWT auto-resolve will be skipped');
             return undefined;
         }
         const contactId = contacts[0].id;
         contactIdCache[cacheKey] = contactId;
         return contactId;
     }
-    catch (error) {
-        const errorMsg = getErrorDetails(error);
-        console.warn(`[CiviCRM] Failed to auto-resolve contact ID: ${errorMsg}. Will attempt API key fallback.`);
+    catch {
         return undefined;
     }
 }
@@ -116,26 +91,15 @@ async function getServerIssuedJwt(context, baseUrl, apiToken, contactId = 0, ttl
         });
         const cred = ((_b = (_a = response === null || response === void 0 ? void 0 : response.values) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.cred) || '';
         if (!cred.startsWith('Bearer ')) {
-            console.warn('[CiviCRM] Invalid JWT response: missing Bearer token');
             return undefined;
         }
         const token = cred.substring(7); // Remove "Bearer " prefix
         serverIssuedCache[cacheKey] = { token, expiresAt: now + ttl * 1000 };
         return token;
     }
-    catch (error) {
-        const errorMsg = getErrorDetails(error);
-        const isPermissionDenied = errorMsg.includes('Authorization failed') ||
-            errorMsg.includes('403') ||
-            errorMsg.includes('Permission denied') ||
-            errorMsg.includes('Login not permitted') ||
-            errorMsg.includes('Must satisfy guard');
-        if (isPermissionDenied) {
-            // User lacks permissions for JWT. Fall back to API key auth.
-            console.warn(`[CiviCRM JWT] User lacks permissions for AuthxCredential/create (${errorMsg}). Will use API key authentication instead.`);
-            return undefined;
-        }
-        console.warn(`[CiviCRM JWT] Failed to obtain JWT: ${errorMsg}. Falling back to API key.`);
+    catch {
+        // Any failure here (permission denied, network error, malformed response) falls
+        // back to API key auth in the caller -- see GenericFunctions.civicrmApiRequest.
         return undefined;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ixiam/n8n-nodes-civicrm",
-  "version": "3.0.0",
+  "version": "3.2.2",
   "description": "Full-featured CiviCRM API v4 integration for n8n",
   "license": "MIT",
   "keywords": [
@@ -21,7 +21,8 @@
     "copy:assets": "mkdir -p dist/src/nodes/CiviCrm dist/credentials && cp src/nodes/CiviCrm/civicrm.svg dist/src/nodes/CiviCrm/ && cp src/nodes/CiviCrm/civicrm.svg dist/credentials/",
     "lint": "n8n-node lint",
     "release": "n8n-node release",
-    "test": "npm run build"
+    "test": "npm run build",
+    "test:unit": "jest"
   },
   "repository": {
     "type": "git",
@@ -50,16 +51,16 @@
   },
   "devDependencies": {
     "@n8n/node-cli": "^0.23.1",
-    "@types/jsonwebtoken": "^9.0.10",
+    "@types/jest": "^30.0.0",
     "@types/node": "^20.11.30",
     "eslint": "9.32.0",
+    "jest": "^30.5.1",
     "prettier": "3.6.2",
     "release-it": "^19.0.6",
+    "ts-jest": "^29.4.12",
     "typescript": "5.9.2"
   },
-  "dependencies": {
-    "jsonwebtoken": "^9.0.3"
-  },
+  "dependencies": {},
   "peerDependencies": {
     "n8n-workflow": "*"
   },