@limetech/n8n-nodes-lime 3.10.1 → 3.10.3

package/nodes/lime-crm/transport/commons.ts

@@ -83,7 +83,7 @@ interface LimeAPIArguments {
         [key: string]: unknown;
     };
     json?: boolean;
-    errorMetadata?: Record<string, unknown>;
+    errorMetadata?: JsonObject;
 }
 
 /**
@@ -106,7 +106,7 @@ export async function callLimeApi<T>(
         const { headers: callerHeaders, ...restRequestOptions } =
             options.requestOptions ?? {};
         const response =
-            await nodeContext.helpers.requestWithAuthentication.call(
+            await nodeContext.helpers.httpRequestWithAuthentication.call(
                 nodeContext,
                 LIME_CRM_API_CREDENTIAL_KEY,
                 {
@@ -126,15 +126,16 @@ export async function callLimeApi<T>(
             data: response,
         };
     } catch (error) {
-        const errorBody = error?.cause?.error ?? error?.cause?.body;
+        const apiBody = error.context?.data;
         const errorContext: WorkflowErrorContext = {
-            message: error instanceof Error ? error.message : String(error),
-            status: error?.cause?.status,
-            ...(errorBody != null && { error: errorBody }),
+            message: error.description
+                ? `${error.message}. ${error.description}`
+                : error.message,
+            status: error.httpCode ?? undefined,
             metadata: {
-                ...options.requestOptions,
                 ...options.errorMetadata,
-            } as JsonObject,
+            },
+            ...(apiBody != null && { error: apiBody }),
         };
         return handleWorkflowError(nodeContext.getNode(), errorContext, true);
     }

package/nodes/lime-forms/LimeFormsTrigger.node.ts

@@ -22,8 +22,9 @@ import { ObservableActionType } from './types/enums/ObservableAction';
 import { ObservableType } from './types/enums/ObservableType';
 import { FORMS_API_CREDENTIALS_NAME } from '../../credentials';
 import { getWorkflowUrl } from './utils/workflow';
-import { verifyHmac } from '../crypto';
+import { decryptSecret, encryptSecret, verifyHmac } from '../crypto';
 import { handleWorkflowError } from '../errorHandling';
+import { randomBytes } from 'node:crypto';
 
 const FORMS_OBSERVABLE_WEBHOOK_NAME_PREFIX = 'N8N';
 
@@ -131,22 +132,26 @@ export class LimeFormsTrigger implements INodeType {
             },
 
             async create(this: IHookFunctions): Promise<boolean> {
-                const credentials = await this.getCredentials(
-                    FORMS_API_CREDENTIALS_NAME
-                );
+                const webhookData = this.getWorkflowStaticData('node');
+                // Generate a per-webhook secret, keep an encrypted copy in the
+                // workflow static data and only ever hand the plaintext to Lime
+                // Forms. The secret is decrypted on each incoming request to
+                // validate the signature. See {@link encryptSecret}.
+                const rawSecret = randomBytes(32).toString('hex');
+                webhookData.webhookSecret = encryptSecret(rawSecret);
+
                 const data = {
                     name: `${FORMS_OBSERVABLE_WEBHOOK_NAME_PREFIX}: ${this.getNodeParameter('name')}`,
                     observableType: ObservableType.FORM,
                     observableId: this.getNodeParameter('formId'),
                     action: ObservableActionType.FORM_SUBMITTED,
                     webhookUrl: this.getNodeWebhookUrl('default'),
-                    secret: credentials.webhookSecret as string,
+                    secret: rawSecret,
                     workflowUrl: getWorkflowUrl(
                         this.getNode(),
                         this.getWorkflow().id
                     ),
                 };
-                const webhookData = this.getWorkflowStaticData('node');
 
                 try {
                     const response =
@@ -164,22 +169,41 @@ export class LimeFormsTrigger implements INodeType {
 
                     return true;
                 } catch (error) {
-                    // 409 Indicates duplicate exists
+                    // 409 indicates a duplicate webhook already exists in Lime
+                    // Forms. Its secret was set on an earlier registration and
+                    // is unknown to us, so reusing it would resurrect the
+                    // "signatures do not match" failures. Delete the stale
+                    // webhook and recreate it with the freshly generated secret.
                     if (error?.httpCode == '409') {
-                        Logger.info(
-                            `Webhook ${webhookData.name} already exists in Lime Forms, retrieving existing webhook ID`,
-                            { errorResponse: error.context?.data }
-                        );
                         /**
                          * Error response structure reference:
                          * @see https://github.com/n8n-io/n8n/blob/n8n%401.120.0/packages/core/src/execution-engine/node-execution-context/utils/request-helper-functions.ts#L1280
                          */
                         const errorResponse = error.context?.data?.error;
-                        webhookData.id = errorResponse.id;
-                        webhookData.name = errorResponse.name.replace(
-                            `${FORMS_OBSERVABLE_WEBHOOK_NAME_PREFIX}: `,
-                            ''
+                        Logger.info(
+                            `Webhook ${errorResponse?.name} already exists in Lime Forms, recreating it with a fresh secret`,
+                            { errorResponse: error.context?.data }
+                        );
+
+                        await new LimeFormsRequest<ObservableWebhookSimpleResource>(
+                            this
+                        ).delete(
+                            `/api/v1/observable-webhooks/${errorResponse.id}`
                         );
+
+                        const response =
+                            await new LimeFormsRequest<ObservableWebhookDetailedResource>(
+                                this
+                            ).post('/api/v1/observable-webhooks', data);
+
+                        if (!response.success) {
+                            throw new NodeApiError(this.getNode(), {
+                                message:
+                                    'Failed to create webhook in Lime Forms',
+                            });
+                        }
+
+                        webhookData.id = response.data.id;
                         return true;
                     }
                     throw new NodeApiError(this.getNode(), {
@@ -207,7 +231,7 @@ export class LimeFormsTrigger implements INodeType {
                 }
 
                 delete webhookData.id;
-                delete webhookData.secret;
+                delete webhookData.webhookSecret;
 
                 return true;
             },
@@ -227,9 +251,17 @@ export class LimeFormsTrigger implements INodeType {
                 );
             }
 
-            const webhookSecret = await this.getCredentials(
-                FORMS_API_CREDENTIALS_NAME
-            ).then((c) => c.webhookSecret as string);
+            const webhookData = this.getWorkflowStaticData('node');
+            const encryptedSecret = webhookData.webhookSecret as
+                | string
+                | undefined;
+            if (!encryptedSecret) {
+                throw new NodeOperationError(
+                    this.getNode(),
+                    'Webhook is not registered: missing secret in static data'
+                );
+            }
+            const webhookSecret = decryptSecret(encryptedSecret);
             const isValidSignature = verifyHmac(
                 webhookSecret,
                 Buffer.from(JSON.stringify(body)),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@limetech/n8n-nodes-lime",
-  "version": "3.10.1",
+  "version": "3.10.3",
   "description": "n8n node to connect to Lime CRM",
   "author": {
     "name": "Lime Technologies",