n8n-nodes-authentication 1.0.0

package/README.md

@@ -0,0 +1,119 @@
+# Somepharm Authentication
+
+Private self-hosted n8n package: `n8n-nodes-authentication`, version 1.0.0.
+Replaces the supplied SQL Authentication check and If Authentication nodes.
+The default canvas name is `Authentication`, so an authorization expression such
+as `$('Authentication').item.json.REF_USER` can reference it directly.
+
+## Settings
+
+Select your existing **Prod** Microsoft SQL credential. Its Database MUST be the
+application database containing `dbo.DECRYPTBYPASSPHRASE_Somepharm`. The user
+lookup is explicitly against `DROITSMK_LA.dbo.T_USERS`.
+
+| Setting | Default expression/value |
+| --- | --- |
+| Timestamp | `{{ $json.formQueryParameters?.randomValue ?? "" }}` |
+| Encrypted Value | `{{ $json.formQueryParameters?.crypt ?? "" }}` |
+| AD Username | `{{ $json.headers?.["x-forwarded-preferred-username"] ?? "" }}` |
+| Maximum Age | 60 minutes |
+
+Place this node immediately after the form trigger, or change the expressions
+to refer to the relevant upstream node. Missing fields evaluate to an empty
+string and are rejected. Custom expressions that themselves throw errors stop
+execution. The account needs access to the decryption function and user table.
+The existing database function is required; this package does not create it or
+contain its passphrase.
+
+## Outputs and wiring
+
+- Output 0 **Authenticated**: `Auth_Result: 1`, `authenticated: true`, and REF_USER.
+- Output 1 **Rejected**: `Auth_Result: 0`, `authenticated: false`, and `REF_USER: ""`.
+
+IMPORTANT: the original IF true output meant rejection. Connect the old IF false
+branch to Authenticated, and the old IF true branch to Rejected.
+Connect Authenticated to Somepharm Authorization; its User Reference can be
+`{{ $json.REF_USER }}`. Connect Rejected to your authentication error response.
+Incoming JSON and binary data are retained, with item pairing preserved. Existing
+REF_USER, Auth_Result and authenticated fields are overwritten. Other incoming
+fields, including any stale authorization fields, are retained: perform a new
+authorization check before accessing protected operations.
+
+Keep On Error = Stop Workflow and Always Output Data = off. Database outages,
+SQL errors, bad node settings and unexpected SQL results stop the execution;
+they are not successful logins and are not sent down the Rejected output.
+
+## Authentication rules
+
+1. randomValue is an integer UNIX timestamp in seconds, between 0 and 2147483647,
+   matching the original SQL int constraint (through January 2038).
+2. crypt is passed as a SQL parameter to the existing decryption function.
+3. Decrypted text must convert to the same integer timestamp.
+4. Timestamp is within the inclusive window [SQL UTC now minus maximum age, now].
+   Future timestamps are rejected. SQL Server supplies the time, not the browser.
+5. AD_USER matches exactly one database row, with a REF_USER length of 4–50.
+
+Changes from the original: values are bound parameters; malformed inputs reject
+without SQL; TRY_CONVERT rejects nonnumeric decrypted text; duplicate AD_USER
+rows reject rather than choosing an arbitrary account. The username limit is
+256 characters and crypt limit is 16384 characters. The code does not impose a
+Base64 format because the supplied custom decryption function is not available.
+If that function throws for malformed tokens, execution stops.
+
+The header must be set/overwritten by a trusted authentication proxy. Prevent
+clients from reaching this endpoint directly and supplying their own identity
+header. This token proves a timestamp, not its binding to a particular user;
+identity relies on the proxy. This preserves the provided scheme and does not
+add replay prevention or single-use tokens.
+
+## Install locally
+
+Extract the ZIP and copy its TGZ to the n8n host. Run as the n8n OS user:
+
+```sh
+mkdir -p ~/.n8n/nodes
+cd ~/.n8n/nodes
+npm install /path/to/n8n-nodes-authentication-1.0.0.tgz --omit=dev
+```
+
+Restart n8n. Install consistently for all main/worker instances and use persistent
+storage for container deployments. Node.js 20+ and npm registry access are needed.
+Meet your installed n8n version's Node.js requirement as well.
+
+## Publish, then install through the UI
+
+This package has NOT been published. The npm name's availability has not been
+checked. From the extracted source folder, after choosing to publish publicly:
+
+```sh
+npm login
+npm pkg delete private
+npm ci
+npm test
+npm publish --dry-run
+npm publish --access public
+```
+
+Publishing exposes the code and database/function names. No passwords are
+included. The example credential is a reference only and is excluded from the
+npm tarball. Public npm publication requires your own account and authentication.
+If another publisher owns the name, choose an available name and update the
+example JSON node type prefix to match.
+
+After publication, use n8n Settings > Community Nodes > Install and enter
+`n8n-nodes-authentication@1.0.0`. Use an Owner/Admin account with community nodes
+enabled. UI installation does not accept the ZIP as a workflow import.
+The included examples/replacement-node.json can be pasted onto the canvas only
+after the custom package is installed. Select your Prod credential if needed.
+
+## Validation and sources
+
+Run `npm ci` and `npm test`. Nine tests use mocked SQL responses and real
+n8n-workflow/mssql modules. They cover input validation, routing, pairing, bound
+parameters, connection failures, malformed responses and cleanup. They do not
+execute T-SQL or the private decryption function. Live n8n loading and SQL Server
+integration were not available. Before production, verify valid/expired/future
+and tampered tokens, unknown/duplicate users, and exact time boundaries in Dev.
+
+- https://learn.microsoft.com/en-us/sql/t-sql/functions/try-convert-transact-sql
+- https://docs.n8n.io/integrations/community-nodes/installation-and-management/gui-installation

package/dist/nodes/SomepharmAuthentication/SomepharmAuthentication.node.js

@@ -0,0 +1,72 @@
+'use strict';
+const sql = require('mssql');
+const { NodeOperationError } = require('n8n-workflow');
+const { connectionConfig } = require('./connection');
+const { validateInput, checkAuthentication } = require('./authentication');
+class SomepharmAuthentication {
+  constructor() {
+    this.description = {
+      displayName: 'Somepharm Authentication', name: 'somepharmAuthentication',
+      icon: 'file:authentication.svg', group: ['transform'], version: 1,
+      description: 'Validate an encrypted timestamp and trusted proxy username using SQL Server',
+      defaults: { name: 'Authentication', color: '#005baa' },
+      inputs: ['main'], outputs: ['main', 'main'], outputNames: ['Authenticated', 'Rejected'],
+      credentials: [{ name: 'microsoftSql', required: true }],
+      properties: [
+        { displayName: 'Timestamp (randomValue)', name: 'timestamp', type: 'string',
+          default: '={{ $json.formQueryParameters?.randomValue ?? "" }}',
+          description: 'UNIX timestamp in seconds; missing or invalid values are rejected' },
+        { displayName: 'Encrypted Value (crypt)', name: 'crypt', type: 'string',
+          default: '={{ $json.formQueryParameters?.crypt ?? "" }}' },
+        { displayName: 'AD Username', name: 'username', type: 'string',
+          default: '={{ $json.headers?.["x-forwarded-preferred-username"] ?? "" }}',
+          description: 'Use only a username set by your trusted authentication proxy' },
+        { displayName: 'Maximum Age (Minutes)', name: 'maxAgeMinutes', type: 'number', default: 60,
+          typeOptions: { minValue: 1, maxValue: 1440, numberPrecision: 0 },
+          description: 'Inclusive validity window checked against SQL Server UTC time; future timestamps are rejected' },
+      ],
+    };
+  }
+  async execute() {
+    const items = this.getInputData();
+    const outputs = [[], []];
+    let pool;
+    let itemIndex = 0;
+    try {
+      for (itemIndex = 0; itemIndex < items.length; itemIndex++) {
+        const maxAgeMinutes = Number(this.getNodeParameter('maxAgeMinutes', itemIndex));
+        if (!Number.isInteger(maxAgeMinutes) || maxAgeMinutes < 1 || maxAgeMinutes > 1440) {
+          throw new Error('Maximum Age must be an integer between 1 and 1440 minutes');
+        }
+        const input = validateInput(Object.fromEntries(['timestamp', 'crypt', 'username']
+          .map(name => [name, this.getNodeParameter(name, itemIndex)])));
+        let decision = { REF_USER: '', Auth_Result: 0 };
+        if (input) {
+          if (!pool) {
+            const credentials = await this.getCredentials('microsoftSql');
+            pool = new sql.ConnectionPool(connectionConfig(credentials));
+            pool.on('error', () => {});
+            await pool.connect();
+          }
+          decision = await checkAuthentication(pool, sql, input, maxAgeMinutes);
+        }
+        const output = {
+          json: { ...items[itemIndex].json, REF_USER: decision.REF_USER,
+            Auth_Result: decision.Auth_Result, authenticated: decision.Auth_Result === 1 },
+          pairedItem: { item: itemIndex },
+        };
+        if (items[itemIndex].binary) output.binary = items[itemIndex].binary;
+        outputs[decision.Auth_Result === 1 ? 0 : 1].push(output);
+      }
+      return outputs;
+    } catch (error) {
+      // Do not include raw SQL driver error text: it may contain token or username values.
+      throw new NodeOperationError(this.getNode(),
+        'Authentication could not be completed. Check node configuration, SQL credentials, connectivity and the decryption function.',
+        { itemIndex });
+    } finally {
+      if (pool) await pool.close().catch(() => {});
+    }
+  }
+}
+module.exports = { SomepharmAuthentication };

package/dist/nodes/SomepharmAuthentication/authentication.js

@@ -0,0 +1,48 @@
+'use strict';
+const AUTHENTICATION_SQL = `
+DECLARE @Decrypted varchar(max);
+SELECT @Decrypted = [dbo].[DECRYPTBYPASSPHRASE_Somepharm](@Crypt);
+DECLARE @TimestampUtc datetime2 = DATEADD(SECOND, @Timestamp, CAST('19700101' AS datetime2));
+DECLARE @NowUtc datetime2 = SYSUTCDATETIME();
+DECLARE @UserCount int;
+DECLARE @RefUser varchar(max);
+SELECT @UserCount = COUNT(*), @RefUser = MIN(CONVERT(varchar(max), U.REF_USER))
+FROM DROITSMK_LA.dbo.T_USERS AS U
+WHERE U.AD_USER = @Username;
+DECLARE @Result smallint = 0;
+IF TRY_CONVERT(int, @Decrypted) = @Timestamp
+   AND @TimestampUtc >= DATEADD(MINUTE, -@MaxAgeMinutes, @NowUtc)
+   AND @TimestampUtc <= @NowUtc
+   AND @UserCount = 1
+   AND LEN(@RefUser) > 3 AND LEN(@RefUser) <= 50
+BEGIN
+    SET @Result = 1;
+END;
+SELECT @Result AS Auth_Result,
+       CASE WHEN @Result = 1 THEN @RefUser ELSE '' END AS REF_USER;`;
+
+function validateInput(raw) {
+  const { timestamp, crypt, username } = raw;
+  if (!['string', 'number'].includes(typeof timestamp) || !/^\d+$/.test(String(timestamp))) return null;
+  const number = Number(timestamp);
+  if (!Number.isSafeInteger(number) || number < 0 || number > 2147483647) return null;
+  if (typeof crypt !== 'string' || !crypt.trim() || crypt.length > 16384 || /[\x00-\x1f\x7f]/.test(crypt)) return null;
+  if (typeof username !== 'string' || !username.trim() || username.length > 256 || /[\x00-\x1f\x7f]/.test(username)) return null;
+  return { timestamp: number, crypt, username };
+}
+async function checkAuthentication(pool, sql, input, maxAgeMinutes) {
+  const request = pool.request();
+  request.input('Timestamp', sql.Int, input.timestamp);
+  request.input('Crypt', sql.VarChar(sql.MAX), input.crypt);
+  request.input('Username', sql.NVarChar(256), input.username);
+  request.input('MaxAgeMinutes', sql.Int, maxAgeMinutes);
+  const result = await request.query(AUTHENTICATION_SQL);
+  const rows = result.recordset;
+  if (!Array.isArray(rows) || rows.length !== 1) throw new Error('Unexpected authentication response');
+  const row = rows[0];
+  if (![0, 1].includes(row.Auth_Result) || typeof row.REF_USER !== 'string' ||
+      (row.Auth_Result === 1 && (row.REF_USER.trimEnd().length <= 3 || row.REF_USER.length > 50)) ||
+      (row.Auth_Result === 0 && row.REF_USER !== '')) throw new Error('Unexpected authentication response');
+  return row;
+}
+module.exports = { AUTHENTICATION_SQL, validateInput, checkAuthentication };

package/dist/nodes/SomepharmAuthentication/authentication.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><path fill="#005baa" d="M32 3 57 13v18c0 15-13 25-25 30C20 56 7 46 7 31V13z"/><path fill="none" stroke="white" stroke-width="6" stroke-linecap="round" stroke-linejoin="round" d="m20 31 8 8 17-18"/></svg>

package/dist/nodes/SomepharmAuthentication/connection.js

@@ -0,0 +1,21 @@
+'use strict';
+function connectionConfig(c) {
+  const config = {
+    server: c.server,
+    database: c.database || 'master',
+    user: c.user,
+    password: c.password,
+    port: c.port ?? 1433,
+    connectionTimeout: c.connectTimeout ?? 15000,
+    requestTimeout: c.requestTimeout ?? 15000,
+    options: {
+      encrypt: c.tls ?? true,
+      trustServerCertificate: c.allowUnauthorizedCerts ?? false,
+      tdsVersion: c.tdsVersion || '7_4',
+    },
+    pool: { min: 0, max: 1 },
+  };
+  if (c.domain) config.domain = c.domain;
+  return config;
+}
+module.exports = { connectionConfig };

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "n8n-nodes-authentication",
+  "version": "1.0.0",
+  "description": "Somepharm SQL Server authentication with two outputs",
+  "license": "UNLICENSED",
+  "keywords": [
+    "n8n-community-node-package"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "node --test test/*.test.js"
+  },
+  "n8n": {
+    "n8nNodesApiVersion": 1,
+    "nodes": [
+      "dist/nodes/SomepharmAuthentication/SomepharmAuthentication.node.js"
+    ]
+  },
+  "dependencies": {
+    "mssql": "12.7.2"
+  },
+  "peerDependencies": {
+    "n8n-workflow": "*"
+  },
+  "devDependencies": {
+    "n8n-workflow": "2.16.0"
+  }
+}