n8n-node-authorization 1.0.0

package/README.md

@@ -0,0 +1,108 @@
+# Somepharm Authorization — n8n custom node
+
+Replaces Access Edit + Authorization (Microsoft SQL) + If Authorization with one
+node and two outputs. This is a private self-hosted node package, not a Code node
+snippet or a package already published to npm. Plain CommonJS source is shipped
+in `dist`; no TypeScript build is needed.
+
+## Install
+
+Extract the ZIP. Copy its `n8n-node-authorization-1.0.0.tgz` to the n8n server/container
+(for example, `/tmp/n8n-node-authorization-1.0.0.tgz`). Run as the operating-system user
+that runs n8n, using the actual n8n user directory if different:
+
+```sh
+mkdir -p ~/.n8n/nodes
+cd ~/.n8n/nodes
+npm install /tmp/n8n-node-authorization-1.0.0.tgz --omit=dev
+```
+
+Restart n8n and search for **Somepharm Authorization**. Dependencies require npm
+registry access at installation. Community nodes must be enabled by the instance
+administrator. This package requires Node.js 20+; also meet your n8n version's
+own Node.js requirement.
+
+For Docker/Kubernetes, the usual directory is `/home/node/.n8n/nodes` for the
+`node` user. Install into persistent storage or provision the package during
+your deployment; an installation into a pod's temporary filesystem disappears
+when that pod is replaced. Ensure every n8n instance that loads or executes the
+workflow (including workers) has the same package. Do not install it in task
+runner containers. No deployment changes have been made for you.
+
+## Configure your replacement
+
+| Setting | Your value |
+| --- | --- |
+| Microsoft SQL credential | Select existing **Dev** credential |
+| User Reference | `{{ $('Authentication').item.json.REF_USER }}` in expression mode |
+| Company Reference | `MKT_2012_SOMEPH` |
+| Table Name | `COMMANDES` |
+| Table Selector | `1` |
+| Access | Read / Consultation (1) |
+
+The default user expression is `$json.REF_USER`. For your supplied workflow,
+change it to the Authentication expression above or paste the example node from
+`examples/replacement-node.json` after installing the package. Re-select **Dev**
+if the credential reference does not resolve on a different instance. That file
+contains a credential reference, no password. The Authentication node must have
+executed and have valid item linking to the input. Only use `.first()` instead
+of `.item` if all input items intentionally share one authenticated identity.
+
+Connect the predecessor of **Access Edit** to this node. Connect output 0
+(**Authorized**) to the old IF true branch; connect output 1 (**Denied**) to its
+false branch. Then remove the three old nodes.
+
+Use a trusted Authentication result for REF_USER, and configure company/table/
+access from trusted workflow settings. The node checks authorization only; it
+does not authenticate an arbitrary REF_USER supplied by an end user. Keep
+**Settings > On Error = Stop Workflow** and **Always Output Data = off** so an
+execution failure or empty branch cannot enter the protected operation.
+
+## Behavior
+
+- Root administrators (`ROOT_ADMIN = 'OUI'`) are authorized.
+- Administrators of the requested company are authorized.
+- Otherwise the user's company, table, selector and selected permission must match.
+- One access code per check: 1 consultation, 2 validation, 4 ajout, 8 modification,
+  16 suppression. Combined masks such as 9 are rejected, not interpreted as flags.
+- Authorized items have numeric `D_Result: 1` and `authorized: true`.
+- Denied items have numeric `D_Result: 0` and `authorized: false`.
+- Incoming JSON and binary data are retained. Existing D_Result/authorized fields
+  are replaced. Each item links back to its original input index.
+- Missing/invalid parameters, SQL errors and malformed SQL responses throw errors.
+  A database outage is not an authorization denial or an authorization grant.
+- Parameters use varchar(50) and smallint, matching the supplied SQL. Strings
+  longer than 50 characters are rejected rather than truncated. The permissions
+  database name is fixed as DROITSMK_LA in the source.
+- Queries are parameterized. No input value is interpolated into SQL text.
+- One execution-local connection pool; one read-only SQL query per input item.
+  The pool closes after execution. Credential timeouts, TLS, port and domain are
+  honored. The SQL account needs SELECT access to the referenced tables/view.
+- Company admin/root behavior matches the supplied rules for valid inputs. No
+  extra active-user, expiry, or deny-override policy is introduced.
+
+## Develop and test
+
+```sh
+npm ci
+npm test
+python3 test/permissions.py
+npm pack
+```
+
+Tests cover output routing, item pairing, binary preservation, bound parameters,
+invalid inputs, database failures, credential mapping, and permission rules.
+The permission matrix uses SQLite with only the database qualifiers removed;
+it verifies relational logic, not SQL Server connectivity or its collation.
+
+Validated locally with Node.js 24, n8n-workflow 2.16.0 and mssql 12.7.2. A live
+n8n editor/loader and your SQL Server were not available. Verify in your Dev
+instance with a root admin, company admin, authorized user and denied user before
+connecting the node to a production operation.
+
+## References
+
+- n8n Microsoft SQL credential definition:
+  https://github.com/n8n-io/n8n/blob/master/packages/nodes-base/credentials/MicrosoftSql.credentials.ts
+- SQL driver's parameters, pooling and configuration:
+  https://github.com/tediousjs/node-mssql

package/dist/nodes/SomepharmAuthorization/SomepharmAuthorization.node.js

@@ -0,0 +1,80 @@
+'use strict';
+const sql = require('mssql');
+const { NodeOperationError } = require('n8n-workflow');
+const { validateInput, connectionConfig, checkAuthorization } = require('./authorization');
+
+class SomepharmAuthorization {
+  constructor() {
+    this.description = {
+      displayName: 'Somepharm Authorization',
+      name: 'somepharmAuthorization',
+      icon: 'file:authorization.svg',
+      group: ['transform'],
+      version: 1,
+      description: 'Check Somepharm permissions and route items to Authorized or Denied',
+      defaults: { name: 'Somepharm Authorization', color: '#005baa' },
+      inputs: ['main'],
+      outputs: ['main', 'main'],
+      outputNames: ['Authorized', 'Denied'],
+      credentials: [{ name: 'microsoftSql', required: true }],
+      properties: [
+        { displayName: 'User Reference', name: 'refUser', type: 'string', required: true,
+          default: '={{ $json.REF_USER }}', description: 'Authenticated user reference. Use a trusted authentication result.' },
+        { displayName: 'Company Reference', name: 'refSociete', type: 'string', required: true,
+          default: 'MKT_2012_SOMEPH' },
+        { displayName: 'Table Name', name: 'tableName', type: 'string', required: true,
+          default: 'COMMANDES' },
+        { displayName: 'Table Selector', name: 'tableSelecteur', type: 'number', required: true,
+          default: 1, typeOptions: { minValue: -32768, maxValue: 32767, numberPrecision: 0 } },
+        { displayName: 'Access', name: 'access', type: 'options', required: true, default: 1,
+          options: [
+            { name: 'Read / Consultation (1)', value: 1 },
+            { name: 'Validate / Validation (2)', value: 2 },
+            { name: 'Create / Ajout (4)', value: 4 },
+            { name: 'Update / Modification (8)', value: 8 },
+            { name: 'Delete / Suppression (16)', value: 16 },
+          ] },
+      ],
+    };
+  }
+
+  async execute() {
+    const items = this.getInputData();
+    if (items.length === 0) return [[], []];
+    const outputs = [[], []];
+    let pool;
+    let itemIndex = 0;
+    try {
+      // Validate every item before making a connection. Values/expressions are per item.
+      const values = items.map((_, index) => {
+        itemIndex = index;
+        return validateInput(Object.fromEntries(
+          ['refUser', 'refSociete', 'tableName', 'tableSelecteur', 'access']
+            .map((name) => [name, this.getNodeParameter(name, index)]),
+        ));
+      });
+      itemIndex = 0;
+      const credentials = await this.getCredentials('microsoftSql');
+      // Execution-local pool avoids sharing another execution's credentials or close lifecycle.
+      pool = new sql.ConnectionPool(connectionConfig(credentials));
+      pool.on('error', () => { /* Requests report their errors through the catch below. */ });
+      await pool.connect();
+      for (itemIndex = 0; itemIndex < items.length; itemIndex++) {
+        const decision = await checkAuthorization(pool, sql, values[itemIndex]);
+        const output = {
+          json: { ...items[itemIndex].json, D_Result: decision, authorized: decision === 1 },
+          pairedItem: { item: itemIndex },
+        };
+        if (items[itemIndex].binary) output.binary = items[itemIndex].binary;
+        outputs[decision === 1 ? 0 : 1].push(output);
+      }
+      return outputs;
+    } catch (error) {
+      // Never convert infrastructure errors into successful authorization results.
+      throw new NodeOperationError(this.getNode(), error, { itemIndex });
+    } finally {
+      if (pool) await pool.close().catch(() => {});
+    }
+  }
+}
+module.exports = { SomepharmAuthorization };

package/dist/nodes/SomepharmAuthorization/authorization.js

@@ -0,0 +1,94 @@
+'use strict';
+
+// These are fixed identifiers; all workflow-supplied values are bound parameters.
+const AUTHORIZATION_SQL = `
+SELECT CAST(CASE WHEN
+  EXISTS (
+    SELECT 1
+    FROM DROITSMK_LA.dbo.T_USERS U
+    LEFT JOIN DROITSMK_LA.dbo.V_USER_SOCIETES US ON U.REF_USER = US.REF_USER
+    LEFT JOIN DROITSMK_LA.dbo.T_SOCIETES S ON US.REF_SOCIETE = S.REF_SOCIETE
+    WHERE U.REF_USER = @REF_USER
+      AND (U.ROOT_ADMIN = 'OUI'
+        OR (S.REF_SOCIETE = @REF_SOCIETE AND US.ADMIN_USER = 'OUI'))
+  ) OR EXISTS (
+    SELECT 1
+    FROM DROITSMK_LA.dbo.T_USERS U
+    INNER JOIN DROITSMK_LA.dbo.USER_TABLES UT ON U.REF_USER = UT.REF_USER
+    INNER JOIN DROITSMK_LA.dbo.T_TABLES T ON UT.TABLE_NAME_ID = T.TABLE_NAME_ID
+    WHERE U.REF_USER = @REF_USER
+      AND T.TABLE_NAME = @TABLE_NAME
+      AND T.TABLE_SELECTEUR = @TABLE_SELECTEUR
+      AND UT.REF_SOCIETE = @REF_SOCIETE
+      AND ((UT.D_CONSULTATION = 1 AND @Access = 1)
+        OR (UT.D_VALIDATION = 1 AND @Access = 2)
+        OR (UT.D_AJOUT = 1 AND @Access = 4)
+        OR (UT.D_MODIFICATION = 1 AND @Access = 8)
+        OR (UT.D_SUPRESSION = 1 AND @Access = 16))
+  ) THEN 1 ELSE 0 END AS smallint) AS D_Result;`;
+
+function text50(value, name) {
+  if (typeof value !== 'string' || value.trim().length === 0 || value.length > 50 ||
+      /[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error(`${name} must be a nonempty string of at most 50 characters without control characters`);
+  }
+  return value;
+}
+function integer(value, name, min, max) {
+  if ((typeof value !== 'number' && typeof value !== 'string') ||
+      (typeof value === 'string' && !/^-?\d+$/.test(value))) {
+    throw new Error(`${name} must be an integer`);
+  }
+  const number = Number(value);
+  if (!Number.isSafeInteger(number) || number < min || number > max) {
+    throw new Error(`${name} must be between ${min} and ${max}`);
+  }
+  return number;
+}
+function validateInput(raw) {
+  const value = {
+    refUser: text50(raw.refUser, 'REF_USER'),
+    refSociete: text50(raw.refSociete, 'REF_SOCIETE'),
+    tableName: text50(raw.tableName, 'TABLE_NAME'),
+    tableSelecteur: integer(raw.tableSelecteur, 'TABLE_SELECTEUR', -32768, 32767),
+    access: integer(raw.access, 'Access', 1, 16),
+  };
+  if (![1, 2, 4, 8, 16].includes(value.access)) {
+    throw new Error('Access must be exactly one of 1, 2, 4, 8, 16; combined masks are not supported');
+  }
+  return value;
+}
+function connectionConfig(c) {
+  const config = {
+    server: c.server,
+    database: c.database || 'master',
+    user: c.user,
+    password: c.password,
+    port: c.port ?? 1433,
+    connectionTimeout: c.connectTimeout ?? 15000,
+    requestTimeout: c.requestTimeout ?? 15000,
+    options: {
+      encrypt: c.tls ?? true,
+      trustServerCertificate: c.allowUnauthorizedCerts ?? false,
+      tdsVersion: c.tdsVersion || '7_4',
+    },
+    pool: { min: 0, max: 1 },
+  };
+  if (c.domain) config.domain = c.domain;
+  return config;
+}
+async function checkAuthorization(pool, sql, value) {
+  const request = pool.request();
+  request.input('REF_USER', sql.VarChar(50), value.refUser);
+  request.input('REF_SOCIETE', sql.VarChar(50), value.refSociete);
+  request.input('TABLE_NAME', sql.VarChar(50), value.tableName);
+  request.input('TABLE_SELECTEUR', sql.SmallInt, value.tableSelecteur);
+  request.input('Access', sql.SmallInt, value.access);
+  const result = await request.query(AUTHORIZATION_SQL);
+  const rows = result.recordset;
+  if (!Array.isArray(rows) || rows.length !== 1 || ![0, 1].includes(rows[0].D_Result)) {
+    throw new Error('Unexpected authorization response from SQL Server');
+  }
+  return rows[0].D_Result;
+}
+module.exports = { AUTHORIZATION_SQL, validateInput, connectionConfig, checkAuthorization };

package/dist/nodes/SomepharmAuthorization/authorization.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><path fill="#005baa" d="M32 3 57 13v18c0 15-13 25-25 30C20 56 7 46 7 31V13z"/><path fill="none" stroke="white" stroke-width="6" stroke-linecap="round" stroke-linejoin="round" d="m20 31 8 8 17-18"/></svg>

package/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "n8n-node-authorization",
+  "version": "1.0.0",
+  "description": "Somepharm SQL Server authorization with authorized and denied outputs",
+  "license": "UNLICENSED",
+  "keywords": ["n8n-community-node-package"],
+  "engines": { "node": ">=20" },
+  "files": ["dist", "README.md"],
+  "scripts": { "test": "node --test test/*.test.js" },
+  "n8n": { "n8nNodesApiVersion": 1, "nodes": ["dist/nodes/SomepharmAuthorization/SomepharmAuthorization.node.js"] },
+  "dependencies": { "mssql": "12.7.2" },
+  "peerDependencies": { "n8n-workflow": "*" },
+  "devDependencies": { "n8n-workflow": "2.16.0" }
+}