@ixiam/n8n-nodes-civicrm 3.2.2 → 3.2.3

package/README.md

@@ -76,11 +76,14 @@ Time-bounded tokens for enhanced security. **Contact ID is automatically resolve
 
 > **Note on warnings vs. results:** When JWT auth is enabled but the token can't be obtained (e.g. AuthX disabled or misconfigured on the CiviCRM side), the node still returns data — it silently retries the same request with the API Key. You'll see a **warning in the node's output pane** explaining why JWT wasn't used, but the workflow does not fail and the query results are still shown. This is intentional: JWT failures never break a workflow, they only fall back to API Key auth and surface a non-blocking warning.
 
+> **Troubleshooting "JWT authentication could not be obtained (no token returned by CiviCRM)":** This message covers several distinct failures on the CiviCRM side (Contact lookup by API Key failed, or `AuthxCredential.create` was denied), so it doesn't say which one occurred. The most common cause is a missing permission: the Contact that owns the API Key must have the **"AuthX: Generate new JWT credentials for other users via the API"** permission on their role — see [JWT Setup Requirements](#jwt-setup-requirements) above. To confirm which step is failing, call `Contact.get` (filtered by `api_key`) and `AuthxCredential.create` directly against your CiviCRM instance and check the HTTP status/response of each.
+
 #### JWT Setup Requirements
 
 **CiviCRM Extensions & Settings:**
 - ✓ AuthX extension enabled (CiviCRM 5.48+)
 - ✓ API Key assigned to a Contact record
+- ✓ The Contact's role has the **"AuthX: Generate new JWT credentials for other users via the API"** permission (`generate any authx credential`) — under **Administer → Users and Permissions → Permissions**. Without it, `AuthxCredential.create` returns `403 Authorization failed` and the node silently falls back to API Key auth. Note that having "Administrator"/`administer CiviCRM` does **not** grant this by itself — it must be checked explicitly for the role.
 
 **CiviCRM Authentication Configuration**
 

package/dist/src/nodes/CiviCrm/CiviCrm.node.js

@@ -703,7 +703,7 @@ class CiviCrm {
                         'for. Leave empty to use the credential (JWT auto-resolve or API key) as before.',
                     displayOptions: {
                         show: {
-                            operation: ['get', 'getMany', 'getFields', 'search', 'raw'],
+                            operation: ['get', 'getMany', 'getFields', 'search', 'raw', 'create', 'update', 'delete'],
                         },
                     },
                 },
@@ -753,11 +753,16 @@ class CiviCrm {
             try {
                 // Per-execution JWT for a specific real user (issue #25 - permissions
                 // by real user via Authx), read once per item so it can come from an
-                // expression like ={{ $json.user_jwt }}. Only threaded into the
-                // read-only operations this parameter is exposed for (get/getMany/
-                // getFields/search/raw Custom API Call) - see civicrmApiRequest for
-                // why an empty result with this token must never fall back to the
-                // credential's API key.
+                // expression like ={{ $json.user_jwt }}. Threaded into every
+                // operation this parameter is exposed for - get/getMany/getFields/
+                // search/raw Custom API Call, and (issue #30 fix) the fixed-resource
+                // create/update/delete branches for Contact/Membership/Group/
+                // Relationship/Activity below - see civicrmApiRequest for why an
+                // empty result with this token must never fall back to the
+                // credential's API key. Without this, a write always ran as the
+                // client's admin credential regardless of the real logged-in user's
+                // actual CiviCRM permissions, defeating the point of issue #25 for
+                // every write operation.
                 const runtimeBearerToken = this.getNodeParameter('runtimeBearerToken', i, '').trim() || undefined;
                 // Custom API resource: raw passthrough, plus first-class List Fields /
                 // Dynamic Search operations for any API4 entity (not just the 5 fixed
@@ -994,7 +999,7 @@ class CiviCrm {
                     const id = this.getNodeParameter('id', i);
                     const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/delete`, {
                         where: [['id', '=', id]],
-                    });
+                    }, runtimeBearerToken);
                     out.push({
                         json: {
                             success: true,
@@ -1130,7 +1135,7 @@ class CiviCrm {
                 /* CREATE/UPDATE contact */
                 let contactId = id;
                 if (isCreate) {
-                    const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Contact/create', { values });
+                    const r = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/create`, { values }, runtimeBearerToken);
                     contactId = (_k = (_j = r === null || r === void 0 ? void 0 : r.values) === null || _j === void 0 ? void 0 : _j[0]) === null || _k === void 0 ? void 0 : _k.id;
                     if (!contactId)
                         throw new Error('Failed to create contact.');
@@ -1139,7 +1144,7 @@ class CiviCrm {
                     await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', `/civicrm/ajax/api4/${entity}/update`, {
                         values,
                         where: [['id', '=', contactId]],
-                    });
+                    }, runtimeBearerToken);
                 }
                 /* SUBENTITIES */
                 if (resource === 'contact') {
@@ -1149,7 +1154,7 @@ class CiviCrm {
                                 ['contact_id', '=', contactId],
                                 ['is_primary', '=', true],
                             ],
-                        });
+                        }, runtimeBearerToken);
                     }
                     if (isCreate && isPrimaryPhone) {
                         await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Phone/delete', {
@@ -1157,7 +1162,7 @@ class CiviCrm {
                                 ['contact_id', '=', contactId],
                                 ['is_primary', '=', true],
                             ],
-                        });
+                        }, runtimeBearerToken);
                     }
                     if (isCreate && isPrimaryAddress) {
                         await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Address/delete', {
@@ -1165,7 +1170,7 @@ class CiviCrm {
                                 ['contact_id', '=', contactId],
                                 ['is_primary', '=', true],
                             ],
-                        });
+                        }, runtimeBearerToken);
                     }
                     if (Object.keys(emailData).length) {
                         if (isCreate) {
@@ -1176,7 +1181,7 @@ class CiviCrm {
                                     is_primary: isPrimaryEmail,
                                     'location_type_id:name': emailLocationName,
                                 },
-                            });
+                            }, runtimeBearerToken);
                         }
                         else {
                             const existingEmail = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Email/get', {
@@ -1186,7 +1191,7 @@ class CiviCrm {
                                 ],
                                 limit: 1,
                                 select: ['id'],
-                            });
+                            }, runtimeBearerToken);
                             const existingEmailId = (_m = (_l = existingEmail === null || existingEmail === void 0 ? void 0 : existingEmail.values) === null || _l === void 0 ? void 0 : _l[0]) === null || _m === void 0 ? void 0 : _m.id;
                             if (existingEmailId) {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Email/update', {
@@ -1196,7 +1201,7 @@ class CiviCrm {
                                         contact_id: contactId,
                                         is_primary: isPrimaryEmail,
                                     },
-                                });
+                                }, runtimeBearerToken);
                             }
                             else {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Email/create', {
@@ -1206,7 +1211,7 @@ class CiviCrm {
                                         is_primary: isPrimaryEmail,
                                         'location_type_id:name': emailLocationName,
                                     },
-                                });
+                                }, runtimeBearerToken);
                             }
                         }
                     }
@@ -1219,7 +1224,7 @@ class CiviCrm {
                                     is_primary: isPrimaryPhone,
                                     'location_type_id:name': phoneLocationName,
                                 },
-                            });
+                            }, runtimeBearerToken);
                         }
                         else {
                             const existingPhone = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Phone/get', {
@@ -1229,7 +1234,7 @@ class CiviCrm {
                                 ],
                                 limit: 1,
                                 select: ['id'],
-                            });
+                            }, runtimeBearerToken);
                             const existingPhoneId = (_p = (_o = existingPhone === null || existingPhone === void 0 ? void 0 : existingPhone.values) === null || _o === void 0 ? void 0 : _o[0]) === null || _p === void 0 ? void 0 : _p.id;
                             if (existingPhoneId) {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Phone/update', {
@@ -1239,7 +1244,7 @@ class CiviCrm {
                                         contact_id: contactId,
                                         is_primary: isPrimaryPhone,
                                     },
-                                });
+                                }, runtimeBearerToken);
                             }
                             else {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Phone/create', {
@@ -1249,7 +1254,7 @@ class CiviCrm {
                                         is_primary: isPrimaryPhone,
                                         'location_type_id:name': phoneLocationName,
                                     },
-                                });
+                                }, runtimeBearerToken);
                             }
                         }
                     }
@@ -1262,7 +1267,7 @@ class CiviCrm {
                                     is_primary: isPrimaryAddress,
                                     'location_type_id:name': addressLocationName,
                                 },
-                            });
+                            }, runtimeBearerToken);
                         }
                         else {
                             const existingAddress = await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Address/get', {
@@ -1272,7 +1277,7 @@ class CiviCrm {
                                 ],
                                 limit: 1,
                                 select: ['id'],
-                            });
+                            }, runtimeBearerToken);
                             const existingAddressId = (_r = (_q = existingAddress === null || existingAddress === void 0 ? void 0 : existingAddress.values) === null || _q === void 0 ? void 0 : _q[0]) === null || _r === void 0 ? void 0 : _r.id;
                             if (existingAddressId) {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Address/update', {
@@ -1282,7 +1287,7 @@ class CiviCrm {
                                         contact_id: contactId,
                                         is_primary: isPrimaryAddress,
                                     },
-                                });
+                                }, runtimeBearerToken);
                             }
                             else {
                                 await GenericFunctions_1.civicrmApiRequest.call(this, 'POST', '/civicrm/ajax/api4/Address/create', {
@@ -1292,7 +1297,7 @@ class CiviCrm {
                                         is_primary: isPrimaryAddress,
                                         'location_type_id:name': addressLocationName,
                                     },
-                                });
+                                }, runtimeBearerToken);
                             }
                         }
                     }
@@ -1321,7 +1326,7 @@ class CiviCrm {
                             },
                         }
                         : {}),
-                });
+                }, runtimeBearerToken);
                 out.push({
                     json: (_t = (_s = res === null || res === void 0 ? void 0 : res.values) === null || _s === void 0 ? void 0 : _s[0]) !== null && _t !== void 0 ? _t : {},
                     pairedItem: { item: i },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ixiam/n8n-nodes-civicrm",
-  "version": "3.2.2",
+  "version": "3.2.3",
   "description": "Full-featured CiviCRM API v4 integration for n8n",
   "license": "MIT",
   "keywords": [
@@ -70,4 +70,4 @@
     }
   },
   "packageManager": "pnpm@10.24.0+sha512.01ff8ae71b4419903b65c60fb2dc9d34cf8bb6e06d03bde112ef38f7a34d6904c424ba66bea5cdcf12890230bf39f9580473140ed9c946fef328b6e5238a345a"
-}
+}