@ixiam/n8n-nodes-civicrm 3.2.0 → 3.2.3

package/README.md

@@ -76,11 +76,14 @@ Time-bounded tokens for enhanced security. **Contact ID is automatically resolve
 
 > **Note on warnings vs. results:** When JWT auth is enabled but the token can't be obtained (e.g. AuthX disabled or misconfigured on the CiviCRM side), the node still returns data — it silently retries the same request with the API Key. You'll see a **warning in the node's output pane** explaining why JWT wasn't used, but the workflow does not fail and the query results are still shown. This is intentional: JWT failures never break a workflow, they only fall back to API Key auth and surface a non-blocking warning.
 
+> **Troubleshooting "JWT authentication could not be obtained (no token returned by CiviCRM)":** This message covers several distinct failures on the CiviCRM side (Contact lookup by API Key failed, or `AuthxCredential.create` was denied), so it doesn't say which one occurred. The most common cause is a missing permission: the Contact that owns the API Key must have the **"AuthX: Generate new JWT credentials for other users via the API"** permission on their role — see [JWT Setup Requirements](#jwt-setup-requirements) above. To confirm which step is failing, call `Contact.get` (filtered by `api_key`) and `AuthxCredential.create` directly against your CiviCRM instance and check the HTTP status/response of each.
+
 #### JWT Setup Requirements
 
 **CiviCRM Extensions & Settings:**
 - ✓ AuthX extension enabled (CiviCRM 5.48+)
 - ✓ API Key assigned to a Contact record
+- ✓ The Contact's role has the **"AuthX: Generate new JWT credentials for other users via the API"** permission (`generate any authx credential`) — under **Administer → Users and Permissions → Permissions**. Without it, `AuthxCredential.create` returns `403 Authorization failed` and the node silently falls back to API Key auth. Note that having "Administrator"/`administer CiviCRM` does **not** grant this by itself — it must be checked explicitly for the role.
 
 **CiviCRM Authentication Configuration**
 

package/dist/src/nodes/CiviCrm/CiviCrm.node.js

@@ -703,7 +703,7 @@ class CiviCrm {
                         'for. Leave empty to use the credential (JWT auto-resolve or API key) as before.',
                     displayOptions: {
                         show: {
-                            operation: ['get', 'getMany', 'getFields', 'search', 'raw'],
+                            operation: ['get', 'getMany', 'getFields', 'search', 'raw', 'create', 'update', 'delete'],
                         },
                     },
                 },
@@ -753,11 +753,16 @@ class CiviCrm {
             try {
                 // Per-execution JWT for a specific real user (issue #25 - permissions
                 // by real user via Authx), read once per item so it can come from an
-                // expression like ={{ $json.user_jwt }}. Only threaded into the
-                // read-only operations this parameter is exposed for (get/getMany/
-                // getFields/search/raw Custom API Call) - see civicrmApiRequest for
-                // why an empty result with this token must never fall back to the
-                // credential's API key.
+                // expression like ={{ $json.user_jwt }}. Threaded into every
+                // operation this parameter is exposed for - get/getMany/getFields/
+                // search/raw Custom API Call, and (issue #30 fix) the fixed-resource
+                // create/update/delete branches for Contact/Membership/Group/
+                // Relationship/Activity below - see civicrmApiRequest for why an
+                // empty result with this token must never fall back to the
+                // credential's API key. Without this, a write always ran as the
+                // client's admin credential regardless of the real logged-in user's
+                // actual CiviCRM permissions, defeating the point of issue #25 for
+                // every write operation.
                 const runtimeBearerToken = this.getNodeParameter('runtimeBearerToken', i, '').trim() || undefined;
                 // Custom API resource: raw passthrough, plus first-class List Fields /
                 // Dynamic Search operations for any API4 entity (not just the 5 fixed
@@ -994,7 +999,7 @@ class CiviCrm {
                     const id = this.getNodeParameter('id', i);
                     const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/delete`, {
                         where: [['id', '=', id]],
-                    });
+                    }, runtimeBearerToken);
                     out.push({
                         json: {
                             success: true,
@@ -1130,7 +1135,7 @@ class CiviCrm {
                 /* CREATE/UPDATE contact */
                 let contactId = id;
                 if (isCreate) {
-                    const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Contact/create', { values });
+                    const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/create`, { values }, runtimeBearerToken);
                     contactId = (_k = (_j = r === null || r === void 0 ? void 0 : r.values) === null || _j === void 0 ? void 0 : _j[0]) === null || _k === void 0 ? void 0 : _k.id;
                     if (!contactId)
                         throw new Error('Failed to create contact.');
@@ -1139,7 +1144,7 @@ class CiviCrm {
                     await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/update`, {
                         values,
                         where: [['id', '=', contactId]],
-                    });
+                    }, runtimeBearerToken);
                 }
                 /* SUBENTITIES */
                 if (resource === 'contact') {
@@ -1149,7 +1154,7 @@ class CiviCrm {
                                 ['contact_id', '=', contactId],
                                 ['is_primary', '=', true],
                             ],
-                        });
+                        }, runtimeBearerToken);
                     }
                     if (isCreate && isPrimaryPhone) {
                         await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Phone/delete', {
@@ -1157,7 +1162,7 @@ class CiviCrm {
                                 ['contact_id', '=', contactId],
                                 ['is_primary', '=', true],
                             ],
-                        });
+                        }, runtimeBearerToken);
                     }
                     if (isCreate && isPrimaryAddress) {
                         await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Address/delete', {
@@ -1165,7 +1170,7 @@ class CiviCrm {
                                 ['contact_id', '=', contactId],
                                 ['is_primary', '=', true],
                             ],
-                        });
+                        }, runtimeBearerToken);
                     }
                     if (Object.keys(emailData).length) {
                         if (isCreate) {
@@ -1176,7 +1181,7 @@ class CiviCrm {
                                     is_primary: isPrimaryEmail,
                                     'location_type_id:name': emailLocationName,
                                 },
-                            });
+                            }, runtimeBearerToken);
                         }
                         else {
                             const existingEmail = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Email/get', {
@@ -1186,7 +1191,7 @@ class CiviCrm {
                                 ],
                                 limit: 1,
                                 select: ['id'],
-                            });
+                            }, runtimeBearerToken);
                             const existingEmailId = (_m = (_l = existingEmail === null || existingEmail === void 0 ? void 0 : existingEmail.values) === null || _l === void 0 ? void 0 : _l[0]) === null || _m === void 0 ? void 0 : _m.id;
                             if (existingEmailId) {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Email/update', {
@@ -1196,7 +1201,7 @@ class CiviCrm {
                                         contact_id: contactId,
                                         is_primary: isPrimaryEmail,
                                     },
-                                });
+                                }, runtimeBearerToken);
                             }
                             else {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Email/create', {
@@ -1206,7 +1211,7 @@ class CiviCrm {
                                         is_primary: isPrimaryEmail,
                                         'location_type_id:name': emailLocationName,
                                     },
-                                });
+                                }, runtimeBearerToken);
                             }
                         }
                     }
@@ -1219,7 +1224,7 @@ class CiviCrm {
                                     is_primary: isPrimaryPhone,
                                     'location_type_id:name': phoneLocationName,
                                 },
-                            });
+                            }, runtimeBearerToken);
                         }
                         else {
                             const existingPhone = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Phone/get', {
@@ -1229,7 +1234,7 @@ class CiviCrm {
                                 ],
                                 limit: 1,
                                 select: ['id'],
-                            });
+                            }, runtimeBearerToken);
                             const existingPhoneId = (_p = (_o = existingPhone === null || existingPhone === void 0 ? void 0 : existingPhone.values) === null || _o === void 0 ? void 0 : _o[0]) === null || _p === void 0 ? void 0 : _p.id;
                             if (existingPhoneId) {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Phone/update', {
@@ -1239,7 +1244,7 @@ class CiviCrm {
                                         contact_id: contactId,
                                         is_primary: isPrimaryPhone,
                                     },
-                                });
+                                }, runtimeBearerToken);
                             }
                             else {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Phone/create', {
@@ -1249,7 +1254,7 @@ class CiviCrm {
                                         is_primary: isPrimaryPhone,
                                         'location_type_id:name': phoneLocationName,
                                     },
-                                });
+                                }, runtimeBearerToken);
                             }
                         }
                     }
@@ -1262,7 +1267,7 @@ class CiviCrm {
                                     is_primary: isPrimaryAddress,
                                     'location_type_id:name': addressLocationName,
                                 },
-                            });
+                            }, runtimeBearerToken);
                         }
                         else {
                             const existingAddress = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Address/get', {
@@ -1272,7 +1277,7 @@ class CiviCrm {
                                 ],
                                 limit: 1,
                                 select: ['id'],
-                            });
+                            }, runtimeBearerToken);
                             const existingAddressId = (_r = (_q = existingAddress === null || existingAddress === void 0 ? void 0 : existingAddress.values) === null || _q === void 0 ? void 0 : _q[0]) === null || _r === void 0 ? void 0 : _r.id;
                             if (existingAddressId) {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Address/update', {
@@ -1282,7 +1287,7 @@ class CiviCrm {
                                         contact_id: contactId,
                                         is_primary: isPrimaryAddress,
                                     },
-                                });
+                                }, runtimeBearerToken);
                             }
                             else {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Address/create', {
@@ -1292,7 +1297,7 @@ class CiviCrm {
                                         is_primary: isPrimaryAddress,
                                         'location_type_id:name': addressLocationName,
                                     },
-                                });
+                                }, runtimeBearerToken);
                             }
                         }
                     }
@@ -1321,7 +1326,7 @@ class CiviCrm {
                             },
                         }
                         : {}),
-                });
+                }, runtimeBearerToken);
                 out.push({
                     json: (_t = (_s = res === null || res === void 0 ? void 0 : res.values) === null || _s === void 0 ? void 0 : _s[0]) !== null && _t !== void 0 ? _t : {},
                     pairedItem: { item: i },

package/dist/src/nodes/transport/GenericFunctions.js

@@ -116,7 +116,6 @@ async function civicrmApiRequest(method, path, body, runtimeBearerToken) {
                 useJwt = true;
             }
             else {
-                console.warn('[CiviCRM] JWT generation returned no token, falling back to API key');
                 this.addExecutionHints({
                     message: 'JWT authentication could not be obtained (no token returned by CiviCRM). Falling back to API Key authentication.',
                     type: 'warning',
@@ -126,7 +125,6 @@ async function civicrmApiRequest(method, path, body, runtimeBearerToken) {
         }
         catch (error) {
             const errorMsg = getHttpErrorDetails(error);
-            console.warn(`[CiviCRM] JWT generation failed: ${errorMsg}. Falling back to API key.`);
             this.addExecutionHints({
                 message: `JWT authentication failed (${errorMsg}). Falling back to API Key authentication.`,
                 type: 'warning',
@@ -154,7 +152,6 @@ async function civicrmApiRequest(method, path, body, runtimeBearerToken) {
                 return response;
             }
             else {
-                console.warn('[CiviCRM] JWT returned empty response. Retrying with API key (JWT may have limited permissions).');
                 this.addExecutionHints({
                     message: 'The JWT-authenticated request returned no data (JWT may have limited permissions). Retrying with API Key authentication.',
                     type: 'warning',
@@ -165,7 +162,6 @@ async function civicrmApiRequest(method, path, body, runtimeBearerToken) {
         }
         catch (error) {
             const errorMsg = getHttpErrorDetails(error);
-            console.warn('[CiviCRM] JWT request failed. Retrying with API key.');
             this.addExecutionHints({
                 message: `The JWT-authenticated request failed (${errorMsg}). Retrying with API Key authentication.`,
                 type: 'warning',
@@ -186,11 +182,7 @@ async function civicrmApiRequest(method, path, body, runtimeBearerToken) {
         json: true,
     };
     try {
-        const response = await this.helpers.httpRequest.call(this, apiKeyOptions);
-        if (useJwt && jwtToken) {
-            console.log('[CiviCRM] API key request successful (JWT was insufficient, using API key as fallback)');
-        }
-        return response;
+        return await this.helpers.httpRequest.call(this, apiKeyOptions);
     }
     catch (error) {
         throw new n8n_workflow_1.NodeApiError(this.getNode(), error);

package/dist/src/nodes/transport/JwtAuth.js

@@ -8,28 +8,6 @@ const contactIdCache = {}; // Cache resolved contact IDs
 function isJwtAuthEnabled(credentials) {
     return (credentials === null || credentials === void 0 ? void 0 : credentials.enableJwtAuth) === true;
 }
-/**
- * Extracts a readable message from an HTTP error, including the response body
- * (e.g. CiviCRM's "Login not permitted. Must satisfy guard (perm, site_key)."),
- * which the bare `error.message` (e.g. "Request failed with status code 401")
- * does not include.
- */
-function getErrorDetails(error) {
-    var _a, _b, _c;
-    const errorObj = error;
-    const status = (_a = errorObj === null || errorObj === void 0 ? void 0 : errorObj.response) === null || _a === void 0 ? void 0 : _a.status;
-    const data = (_b = errorObj === null || errorObj === void 0 ? void 0 : errorObj.response) === null || _b === void 0 ? void 0 : _b.data;
-    const message = (_c = errorObj === null || errorObj === void 0 ? void 0 : errorObj.message) !== null && _c !== void 0 ? _c : String(error);
-    const body = typeof data === 'string' && data.trim()
-        ? data
-        : data && typeof data === 'object'
-            ? JSON.stringify(data)
-            : undefined;
-    if (body) {
-        return status ? `${message} | HTTP ${status} body: ${body}` : `${message} | body: ${body}`;
-    }
-    return status ? `${message} | HTTP ${status}` : message;
-}
 /**
  * Resolve the current authenticated user's contact ID from Contact/get.
  * Finds the contact that owns the given api_key.
@@ -60,16 +38,13 @@ async function resolveContactId(context, baseUrl, apiToken) {
         });
         const contacts = (response === null || response === void 0 ? void 0 : response.values) || [];
         if (contacts.length === 0) {
-            console.warn('[CiviCRM] Contact/get found no contact with this api_key - JWT auto-resolve will be skipped');
             return undefined;
         }
         const contactId = contacts[0].id;
         contactIdCache[cacheKey] = contactId;
         return contactId;
     }
-    catch (error) {
-        const errorMsg = getErrorDetails(error);
-        console.warn(`[CiviCRM] Failed to auto-resolve contact ID: ${errorMsg}. Will attempt API key fallback.`);
+    catch {
         return undefined;
     }
 }
@@ -116,26 +91,15 @@ async function getServerIssuedJwt(context, baseUrl, apiToken, contactId = 0, ttl
         });
         const cred = ((_b = (_a = response === null || response === void 0 ? void 0 : response.values) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.cred) || '';
         if (!cred.startsWith('Bearer ')) {
-            console.warn('[CiviCRM] Invalid JWT response: missing Bearer token');
             return undefined;
         }
         const token = cred.substring(7); // Remove "Bearer " prefix
         serverIssuedCache[cacheKey] = { token, expiresAt: now + ttl * 1000 };
         return token;
     }
-    catch (error) {
-        const errorMsg = getErrorDetails(error);
-        const isPermissionDenied = errorMsg.includes('Authorization failed') ||
-            errorMsg.includes('403') ||
-            errorMsg.includes('Permission denied') ||
-            errorMsg.includes('Login not permitted') ||
-            errorMsg.includes('Must satisfy guard');
-        if (isPermissionDenied) {
-            // User lacks permissions for JWT. Fall back to API key auth.
-            console.warn(`[CiviCRM JWT] User lacks permissions for AuthxCredential/create (${errorMsg}). Will use API key authentication instead.`);
-            return undefined;
-        }
-        console.warn(`[CiviCRM JWT] Failed to obtain JWT: ${errorMsg}. Falling back to API key.`);
+    catch {
+        // Any failure here (permission denied, network error, malformed response) falls
+        // back to API key auth in the caller -- see GenericFunctions.civicrmApiRequest.
         return undefined;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ixiam/n8n-nodes-civicrm",
-  "version": "3.2.0",
+  "version": "3.2.3",
   "description": "Full-featured CiviCRM API v4 integration for n8n",
   "license": "MIT",
   "keywords": [
@@ -52,7 +52,6 @@
   "devDependencies": {
     "@n8n/node-cli": "^0.23.1",
     "@types/jest": "^30.0.0",
-    "@types/jsonwebtoken": "^9.0.10",
     "@types/node": "^20.11.30",
     "eslint": "9.32.0",
     "jest": "^30.5.1",
@@ -61,9 +60,7 @@
     "ts-jest": "^29.4.12",
     "typescript": "5.9.2"
   },
-  "dependencies": {
-    "jsonwebtoken": "^9.0.3"
-  },
+  "dependencies": {},
   "peerDependencies": {
     "n8n-workflow": "*"
   },
@@ -73,4 +70,4 @@
     }
   },
   "packageManager": "pnpm@10.24.0+sha512.01ff8ae71b4419903b65c60fb2dc9d34cf8bb6e06d03bde112ef38f7a34d6904c424ba66bea5cdcf12890230bf39f9580473140ed9c946fef328b6e5238a345a"
-}
+}