n8n-nodes-base 2.36.2 → 2.37.0

package/dist/nodes/Form/utils/utils.js

@@ -37,7 +37,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isFormConnected = exports.validateResponseModeConfiguration = exports.prepareFormFields = exports.handleNewlines = exports.getNodeReference = void 0;
-exports.isFormOAuth2Enabled = isFormOAuth2Enabled;
 exports.sanitizeHtml = sanitizeHtml;
 exports.sanitizeCustomCss = sanitizeCustomCss;
 exports.validateSafeRedirectUrl = validateSafeRedirectUrl;
@@ -46,8 +45,11 @@ exports.prepareFormData = prepareFormData;
 exports.addFormResponseDataToReturnItem = addFormResponseDataToReturnItem;
 exports.prepareFormReturnItem = prepareFormReturnItem;
 exports.renderForm = renderForm;
+exports.getHostNavigationPath = getHostNavigationPath;
+exports.respondIfCredentialsNotReady = respondIfCredentialsNotReady;
 exports.generateFormUserAuthToken = generateFormUserAuthToken;
 exports.verifyFormUserAuthToken = verifyFormUserAuthToken;
+exports.setFormAuthCookie = setFormAuthCookie;
 exports.validateFormPageAuth = validateFormPageAuth;
 exports.formShellSummaryText = formShellSummaryText;
 exports.buildFormShellViewModel = buildFormShellViewModel;
@@ -77,6 +79,9 @@ const interfaces_1 = require("../interfaces");
 const FORM_USER_AUTH_TOKEN_TTL_SECONDS = 60 * 60;
 const getNodeReference = (nodeName) => `$(${JSON.stringify(nodeName)})`;
 exports.getNodeReference = getNodeReference;
+function isOptionalString(value) {
+    return value === undefined || typeof value === 'string';
+}
 function isFormUserAuthClaims(value) {
     if (typeof value !== 'object' || value === null)
         return false;
@@ -86,10 +91,17 @@ function isFormUserAuthClaims(value) {
         typeof c.firstName === 'string' &&
         typeof c.lastName === 'string' &&
         typeof c.nid === 'string' &&
-        typeof c.wid === 'string');
+        typeof c.wid === 'string' &&
+        isOptionalString(c.wfid) &&
+        isOptionalString(c.eid));
 }
-function isFormOAuth2Enabled() {
-    return process.env.N8N_ENV_FEAT_FORM_TRIGGER_OAUTH2 === 'true';
+function userFromFormUserAuthClaims(claims) {
+    return {
+        id: claims.sub,
+        email: claims.email,
+        firstName: claims.firstName,
+        lastName: claims.lastName,
+    };
 }
 function sanitizeHtml(text) {
     return (0, sanitize_html_1.default)(text, {
@@ -231,7 +243,7 @@ function getFieldIdentifier(field, nodeVersion) {
     }
     return field.fieldLabel ?? field.fieldName ?? '';
 }
-function prepareFormData({ formTitle, formDescription, formSubmittedHeader, formSubmittedText, redirectUrl, formFields, testRun, query, instanceId, useResponseData, appendAttribution = true, buttonLabel, customCss, nodeVersion, authToken, shellInner, hasAuthenticatedSubmitter, }) {
+function prepareFormData({ formTitle, formDescription, formSubmittedHeader, formSubmittedText, redirectUrl, formFields, testRun, query, instanceId, useResponseData, appendAttribution = true, buttonLabel, customCss, nodeVersion, authToken, shellInner, hasAuthenticatedSubmitter, hostNavigationPath, }) {
     const utm_campaign = instanceId ? `&utm_campaign=${instanceId}` : '';
     const n8nWebsiteLink = `https://n8n.io/?utm_source=n8n-internal&utm_medium=form-trigger${utm_campaign}`;
     if (formSubmittedText === undefined) {
@@ -255,6 +267,7 @@ function prepareFormData({ formTitle, formDescription, formSubmittedHeader, form
         shellInner: shellInner || undefined,
         // Only set for forms that can be gated, so the rest never ship the client handling.
         hasAuthenticatedSubmitter: hasAuthenticatedSubmitter || undefined,
+        hostNavigationPath: hostNavigationPath || undefined,
     };
     if (redirectUrl) {
         const safeUrl = validateSafeRedirectUrl(redirectUrl);
@@ -487,6 +500,10 @@ function renderForm({ context, res, formTitle, formDescription, formFields, resp
         catch (error) { }
     }
     formFields = (0, exports.prepareFormFields)(formFields);
+    // A follow-up page the shell navigated its frame to is the shell's inner render
+    // just like the flagged page-1 request — it must render the readiness listener
+    // and leave the submit button's enabled state to the shell's connect panel.
+    const inShell = isHostedInFormShell(context.getRequestObject(), shellInner);
     const data = prepareFormData({
         formTitle,
         formDescription,
@@ -502,8 +519,9 @@ function renderForm({ context, res, formTitle, formDescription, formFields, resp
         customCss,
         nodeVersion: context.getNode().typeVersion,
         authToken,
-        shellInner,
+        shellInner: inShell,
         hasAuthenticatedSubmitter,
+        hostNavigationPath: getHostNavigationPath(context, inShell),
     });
     if (!(0, n8n_core_1.isFormHtmlSandboxingDisabled)()) {
         res.setHeader('Content-Security-Policy', (0, n8n_core_1.getHtmlSandboxCSP)());
@@ -533,10 +551,75 @@ function buildAbsoluteFormUrl(req) {
     const host = headerValue('x-forwarded-host') ?? req.headers.host ?? '';
     return `${protocol}://${host}${req.originalUrl}`;
 }
+/**
+ * True when this render is the hosting shell's frame — either the shell's own
+ * inner render (flagged in the URL) or a follow-up page the shell navigated its
+ * frame to. Only then may the form hand its page navigations to the host.
+ *
+ * A follow-up page is recognised by the `n8nShellHosted` flag the shell appends
+ * to every URL it moves its frame to. Being told outright, rather than inferred
+ * from `Sec-Fetch-*`, keeps delegation working where those headers never arrive
+ * (a proxy that strips them) and keeps a same-origin frame that is *not* the
+ * shell from being treated as one.
+ *
+ * Where those headers do arrive they still have to agree — a same-origin frame —
+ * so a top-level document, or a form embedded on someone else's site, keeps
+ * navigating itself even with the flag in its URL.
+ *
+ * Nothing rests on the flag being unguessable: a frame that sets it on itself
+ * gains only the ability to ask its own parent to move it, and the shell accepts
+ * that ask for this form's own pages alone.
+ */
+function isHostedInFormShell(req, shellInner) {
+    if (shellInner)
+        return true;
+    const secFetchDest = req.headers?.['sec-fetch-dest'];
+    const secFetchSite = req.headers?.['sec-fetch-site'];
+    return (req.query?.n8nShellHosted === '1' &&
+        (secFetchDest === undefined || secFetchDest === 'iframe') &&
+        (secFetchSite === undefined || secFetchSite === 'same-origin'));
+}
+/**
+ * The path prefix this render may ask the hosting shell to navigate to, or
+ * `undefined` when the render isn't in the shell's frame and so keeps navigating
+ * itself.
+ */
+function getHostNavigationPath(context, shellInner) {
+    if (!isHostedInFormShell(context.getRequestObject(), shellInner))
+        return undefined;
+    return getFormWaitingBasePath(context) ?? undefined;
+}
 const isFormConnected = (nodes) => {
     return nodes.some((n) => n.type === n8n_workflow_1.FORM_NODE_TYPE || (n.type === n8n_workflow_1.WAIT_NODE_TYPE && n.parameters?.resume === 'form'));
 };
 exports.isFormConnected = isFormConnected;
+/**
+ * Submit-time credential readiness gate, shared by the trigger's POST and the
+ * Form node's POST. Answers 428 with the missing-credential list when the
+ * submitter's required accounts aren't all connected, 503 when the check itself
+ * fails. Returns true when a response was sent and the submission must not
+ * proceed. A no-op (`undefined` readiness) outside the dynamic-credentials flow.
+ */
+async function respondIfCredentialsNotReady(context, res) {
+    let readiness;
+    try {
+        readiness = await context.checkTriggerCredentialStatus();
+    }
+    catch (error) {
+        // Fail closed. Throwing here is swallowed by the webhook layer, which then
+        // enqueues the execution anyway — exactly the doomed run we're preventing.
+        context.logger.error('Form submit credential readiness check failed', { error });
+        res.status(503).json({ status: 'credential_readiness_check_failed' });
+        return true;
+    }
+    if (readiness && !readiness.readyToExecute) {
+        // 428, matching the webhook trigger's gate (webhook-helpers.ts) so all
+        // trigger paths answer an unconnected credential the same way.
+        res.status(428).json((0, n8n_workflow_1.buildCredentialConnectionsRequiredResponse)(readiness));
+        return true;
+    }
+    return false;
+}
 /**
  * Generate a form auth token for n8nUserAuth. The token embeds the user info
  * in a signed JWT so the POST handler can authenticate the submission without
@@ -545,10 +628,12 @@ exports.isFormConnected = isFormConnected;
  * cookie is `SameSite=Lax`).
  *
  * The `nid` and `wid` claims bind the token to a specific node + webhook,
- * preventing replay across forms. Signed with HS256 using the instance's
- * hmac signature secret.
+ * preventing replay across forms. `wfid`/`eid` additionally bind it to the
+ * workflow and — for tokens minted while a run is in progress — that run, which
+ * is what lets the same token be accepted as the form page auth cookie. Signed
+ * with HS256 using the instance's hmac signature secret.
  */
-function generateFormUserAuthToken(node, user) {
+function generateFormUserAuthToken(node, user, binding) {
     const secret = di_1.Container.get(n8n_core_1.InstanceSettings).hmacSignatureSecret;
     const payload = {
         sub: user.id,
@@ -557,6 +642,8 @@ function generateFormUserAuthToken(node, user) {
         lastName: user.lastName,
         nid: node.id,
         wid: node.webhookId ?? '',
+        ...(binding.workflowId ? { wfid: binding.workflowId } : {}),
+        ...(binding.executionId ? { eid: binding.executionId } : {}),
     };
     return jsonwebtoken_1.default.sign(payload, secret, {
         algorithm: 'HS256',
@@ -564,11 +651,27 @@ function generateFormUserAuthToken(node, user) {
     });
 }
 /**
- * Verify a form auth token issued by `generateFormUserAuthToken`. Returns the
- * encoded user on success or `null` on any failure (bad format, expired,
- * wrong signature, wrong node). The caller decides how to surface the failure.
+ * Verify a form auth token issued by `generateFormUserAuthToken` and presented
+ * in the `x-auth-token` header. Returns the encoded user on success or `null` on
+ * any failure (bad format, expired, wrong signature, wrong node, wrong
+ * execution). The caller decides how to surface the failure.
+ *
+ * A token carrying an `eid` is only accepted for that execution. Tokens minted
+ * before a run existed carry none and stay valid for the node they name.
  */
-function verifyFormUserAuthToken(token, node) {
+function verifyFormUserAuthToken(token, node, executionId) {
+    const claims = decodeFormUserAuthClaims(token);
+    if (!claims)
+        return null;
+    if (claims.nid !== node.id)
+        return null;
+    if (claims.wid !== (node.webhookId ?? ''))
+        return null;
+    if (claims.eid !== undefined && claims.eid !== executionId)
+        return null;
+    return userFromFormUserAuthClaims(claims);
+}
+function decodeFormUserAuthClaims(token) {
     const secret = di_1.Container.get(n8n_core_1.InstanceSettings).hmacSignatureSecret;
     let claims;
     try {
@@ -577,18 +680,24 @@ function verifyFormUserAuthToken(token, node) {
     catch {
         return null;
     }
-    if (!isFormUserAuthClaims(claims))
+    return isFormUserAuthClaims(claims) ? claims : null;
+}
+/**
+ * Verify a form auth token presented as the form page auth cookie. Unlike the
+ * `x-auth-token` variant this is not bound to a single node: the cookie rides
+ * along a navigation to whichever node serves the next page of the same form,
+ * so it is bound to the workflow (`wfid`) and, once a run exists, to that run
+ * (`eid`). Tokens predating those claims are not accepted here.
+ */
+function verifyFormPageAuthCookie(token, workflowId, executionId) {
+    const claims = decodeFormUserAuthClaims(token);
+    if (!claims)
         return null;
-    if (claims.nid !== node.id)
+    if (!claims.wfid || !workflowId || claims.wfid !== workflowId)
         return null;
-    if (claims.wid !== (node.webhookId ?? ''))
+    if (claims.eid !== undefined && claims.eid !== executionId)
         return null;
-    return {
-        id: claims.sub,
-        email: claims.email,
-        firstName: claims.firstName,
-        lastName: claims.lastName,
-    };
+    return userFromFormUserAuthClaims(claims);
 }
 function trimTrailingSlash(url) {
     return url.endsWith('/') ? url.slice(0, -1) : url;
@@ -598,16 +707,21 @@ function trimTrailingSlash(url) {
 // sandboxed form page. The token is otherwise already embedded in the form HTML
 // (the page sends it back as `x-auth-token` on POST), so this is not a new exposure.
 const FORM_OAUTH_COOKIE_NAME = 'n8n-form-oauth';
-function formOAuthCookieOptions(req, resourceUrl) {
-    // Derive `secure` from the request scheme (honouring x-forwarded-proto, as
-    // buildAbsoluteFormUrl does) rather than config, so the cookie is actually sent
-    // back on the follow-up GET over http in dev while staying Secure over https.
+/**
+ * Derive `secure` from the request scheme (honouring x-forwarded-proto, as
+ * buildAbsoluteFormUrl does) rather than config, so form cookies are actually
+ * sent back over http in dev while staying Secure over https.
+ */
+function isSecureRequest(req) {
     const forwardedProto = req.headers['x-forwarded-proto'];
     const proto = (typeof forwardedProto === 'string' ? forwardedProto.trim() : '') || req.protocol;
+    return proto === 'https';
+}
+function formOAuthCookieOptions(req, resourceUrl) {
     return {
         httpOnly: true,
         sameSite: 'lax', // must be Lax: sent on our own top-level 302 → GET
-        secure: proto === 'https',
+        secure: isSecureRequest(req),
         path: new URL(resourceUrl).pathname, // scope the bearer token to this form
     };
 }
@@ -617,13 +731,137 @@ function setFormOAuthToken(res, req, resourceUrl, token) {
         maxAge: 60_000, // one redirect hop; short by design
     });
 }
+/**
+ * Decode a cookie value, or `null` when it isn't valid percent-encoding. A value
+ * we can't read is treated as no cookie at all — the caller's other checks still
+ * get their turn — rather than throwing out of the request.
+ */
+function decodeCookieValue(value) {
+    try {
+        return decodeURIComponent(value.trim());
+    }
+    catch {
+        return null;
+    }
+}
 function readFormOAuthToken(req) {
     const match = (req.headers.cookie ?? '').match(/(?:^|;\s*)n8n-form-oauth=([^;]+)/);
-    return match ? decodeURIComponent(match[1].trim()) : null;
+    return match ? decodeCookieValue(match[1]) : null;
 }
 function clearFormOAuthToken(res, req, resourceUrl) {
     res.clearCookie(FORM_OAUTH_COOKIE_NAME, formOAuthCookieOptions(req, resourceUrl));
 }
+// Carries the submitter's identity to the follow-up pages of a multi-page form.
+// Those pages are reached by a navigation, which can present neither the
+// `x-auth-token` header nor — from a sandboxed, opaque-origin form document —
+// the `n8n-auth` session cookie.
+//
+// The name carries the token's binding, so forms open in other tabs don't
+// overwrite each other's cookie: pages of a run use the run's id, and the
+// trigger — rendered before any run exists — uses the workflow's. Duplicated in
+// `packages/cli/src/constants.ts` (prefix only); keep both sides in step.
+const FORM_AUTH_COOKIE_PREFIX = 'n8n-form-auth';
+function getFormAuthCookieName(binding) {
+    return binding.executionId
+        ? `${FORM_AUTH_COOKIE_PREFIX}-ex-${binding.executionId}`
+        : `${FORM_AUTH_COOKIE_PREFIX}-wf-${binding.workflowId ?? ''}`;
+}
+/**
+ * Value of the request's cookie with exactly this name, or `null`. Parses the
+ * raw header (the webhook path may bypass cookie-parser) by splitting rather
+ * than a regex, since the name embeds a workflow or execution id.
+ */
+function readCookieValue(req, name) {
+    for (const part of (req.headers.cookie ?? '').split(';')) {
+        const separator = part.indexOf('=');
+        if (separator === -1 || part.slice(0, separator).trim() !== name)
+            continue;
+        return decodeCookieValue(part.slice(separator + 1));
+    }
+    return null;
+}
+/**
+ * Path the form-waiting endpoint is served under, or `null` when it can't be
+ * derived. It is configurable and the instance may sit behind a path prefix, so
+ * derive it rather than assume it: `$execution.resumeFormUrl` is
+ * `<formWaitingBaseUrl>/<executionId>`, and dropping the last segment leaves the
+ * base path.
+ */
+function getFormWaitingBasePath(context) {
+    try {
+        const resumeFormUrl = context.evaluateExpression('{{ $execution.resumeFormUrl }}');
+        const { pathname } = new URL(resumeFormUrl);
+        return pathname.slice(0, pathname.lastIndexOf('/')) || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Hand the follow-up pages of a multi-page form their own auth token, scoped to
+ * the form-waiting path. Re-set on every page render, so a long form's later
+ * pages get a token that is still within its TTL.
+ */
+function setFormAuthCookie(context, token, binding) {
+    const req = context.getRequestObject();
+    context.getResponseObject().cookie(getFormAuthCookieName(binding), token, {
+        httpOnly: true,
+        // Lax, and only ever sent on a navigation the shell (or the top-level page)
+        // initiates from the real origin.
+        sameSite: 'lax',
+        secure: isSecureRequest(req),
+        // Nothing narrower is derivable when the base path is unknown; the cookie is
+        // httpOnly and expires with the token either way.
+        path: getFormWaitingBasePath(context) ?? '/',
+        maxAge: FORM_USER_AUTH_TOKEN_TTL_SECONDS * 1000,
+    });
+}
+/**
+ * Resolve the submitter from the form page auth cookie, or `null` when it is
+ * absent or doesn't verify for the workflow/execution being served.
+ */
+function readFormAuthCookieUser(context) {
+    const req = context.getRequestObject();
+    const workflowId = context.getWorkflow().id;
+    const executionId = context.getExecutionId();
+    if (!workflowId)
+        return null;
+    // The run's own cookie first; the trigger's workflow-scoped one covers the
+    // first hop into the run, made before the run existed.
+    const candidateNames = [
+        getFormAuthCookieName({ workflowId, executionId }),
+        getFormAuthCookieName({ workflowId }),
+    ];
+    for (const name of candidateNames) {
+        const token = readCookieValue(req, name);
+        if (!token)
+            continue;
+        const user = verifyFormPageAuthCookie(token, workflowId, executionId);
+        if (user)
+            return user;
+    }
+    return null;
+}
+/**
+ * True when the request also carries a session that belongs to someone other
+ * than the form cookie's user — a sign-out and sign-in as a different person in
+ * the same browser. The live session wins: the form cookie is dropped and the
+ * request re-authenticates through the normal path. An unusable session cookie
+ * names nobody, so it leaves the form cookie alone.
+ */
+async function isSessionForDifferentUser(context, formCookieUser) {
+    const req = context.getRequestObject();
+    const match = (req.headers.cookie ?? '').match(/(?:^|;\s*)n8n-auth=([^;]+)/);
+    if (!match)
+        return false;
+    try {
+        const sessionUser = await context.validateCookieAuth(match[1].trim());
+        return sessionUser.id !== formCookieUser.id;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Authenticate an `n8nUserAuth` request via:
  * 1. the `n8n-auth` cookie (sent on top-level GET when the user is logged in), or
@@ -634,9 +872,9 @@ function clearFormOAuthToken(res, req, resourceUrl) {
  * (302 to `/signin` on GET, 401 on POST) and returns `null` — the caller
  * must abort with `noWebhookResponse`.
  */
-async function authenticateFormUserOrRespond(context, oauth2Enabled = false) {
+async function authenticateFormUserOrRespond(context, runOAuth2Flow = false) {
     const req = context.getRequestObject();
-    if (oauth2Enabled) {
+    if (runOAuth2Flow) {
         const res = context.getResponseObject();
         const url = context.getWebhookResourceUrl('default');
         if (!url) {
@@ -757,7 +995,7 @@ async function authenticateFormUserOrRespond(context, oauth2Enabled = false) {
     }
     const formToken = req.headers['x-auth-token'];
     if (typeof formToken === 'string' && formToken) {
-        const user = verifyFormUserAuthToken(formToken, context.getNode());
+        const user = verifyFormUserAuthToken(formToken, context.getNode(), context.getExecutionId());
         if (user)
             return { user, token: null };
     }
@@ -778,12 +1016,27 @@ async function authenticateFormUserOrRespond(context, oauth2Enabled = false) {
  * Multi-step Form/Wait nodes inherit `authentication` from the upstream
  * Form Trigger. This wrapper short-circuits when n8nUserAuth isn't in use.
  *
+ * A page is reached by navigating to it, which cannot carry an `x-auth-token`
+ * header, so a GET is authenticated from the form page auth cookie first. Every
+ * other request — and any GET whose cookie is missing, doesn't verify, or names
+ * someone other than the session on the same request — falls through to the
+ * session cookie / `x-auth-token` checks, unchanged.
+ *
+ * Form pages never take the OAuth2 branch: the OAuth2 token's audience is the
+ * trigger's URL, which a page's own resource URL is not.
+ *
  * Returns `{ authedUser }` on success, `{ responded: true }` after sending a
  * 302/401 on failure, or `{}` if the trigger doesn't require auth.
  */
 async function validateFormPageAuth(context, triggerAuthentication) {
     if (triggerAuthentication !== 'n8nUserAuth')
         return {};
+    if (context.getRequestObject().method === 'GET') {
+        const cookieUser = readFormAuthCookieUser(context);
+        if (cookieUser && !(await isSessionForDifferentUser(context, cookieUser))) {
+            return { authedUser: cookieUser };
+        }
+    }
     const { user } = (await authenticateFormUserOrRespond(context, false)) ?? {};
     return user ? { authedUser: user } : { responded: true };
 }
@@ -797,7 +1050,7 @@ async function validateFormPageAuth(context, triggerAuthentication) {
  * links — OUTSIDE the author-scriptable iframe DOM (the security win over
  * connecting inside the form). It carries a live session, so it refuses framing.
  */
-function renderFormShell({ res, req, formTitle, resourceUrl, credentials, submitterEmail, }) {
+function renderFormShell({ res, req, formTitle, resourceUrl, credentials, submitterEmail, formWaitingPath, }) {
     // The iframe loads the same form via a real URL (so the form's relative POST
     // works exactly as it does top-level today) flagged as the inner render.
     const inner = new URL(buildAbsoluteFormUrl(req));
@@ -807,6 +1060,8 @@ function renderFormShell({ res, req, formTitle, resourceUrl, credentials, submit
         formTitle,
         iframeSrc: `${inner.pathname}${inner.search}`,
         resourceUrl,
+        // The only paths the shell will move its frame to on the form's request.
+        formWaitingPath,
         ...buildFormShellViewModel(credentials, submitterEmail),
     });
 }
@@ -886,7 +1141,7 @@ async function formWebhook(context, authProperty = interfaces_1.FORM_TRIGGER_AUT
     let oAuth2Token;
     if (node.typeVersion > 1) {
         if (authentication === 'n8nUserAuth') {
-            const { user, token } = (await authenticateFormUserOrRespond(context, isFormOAuth2Enabled())) ?? {};
+            const { user, token } = (await authenticateFormUserOrRespond(context, true)) ?? {};
             if (!user)
                 return { noWebhookResponse: true };
             authedUser = user;
@@ -954,6 +1209,14 @@ async function formWebhook(context, authProperty = interfaces_1.FORM_TRIGGER_AUT
             redirectUrl = undefined;
             responseMode = 'responseNode';
         }
+        // A multi-page form hops to `/form-waiting/<execution>` by navigating, which
+        // carries neither the `x-auth-token` header nor — from the hosting shell's
+        // opaque-origin frame — the `n8n-auth` session cookie. Give the follow-up pages
+        // their own path-scoped token so they can authenticate the same submitter.
+        if (authentication === 'n8nUserAuth' && authedUser && hasNextPage) {
+            const binding = { workflowId: context.getWorkflow().id };
+            setFormAuthCookie(context, generateFormUserAuthToken(node, authedUser, binding), binding);
+        }
         // The inner render is the form loaded inside the hosting-shell iframe. Honor the
         // flag only for iframe navigations (per Sec-Fetch-Dest, absent on older browsers)
         // so a hand-typed URL can't skip the connect UI; the POST gate enforces regardless.
@@ -961,15 +1224,11 @@ async function formWebhook(context, authProperty = interfaces_1.FORM_TRIGGER_AUT
         const shellInner = req.query.n8nShellInner === '1' && (secFetchDest === undefined || secFetchDest === 'iframe');
         // Connect-before-submit: when the workflow needs the submitter's own
         // (private) credentials, establish their identity from the OAuth2 token and
-        // check readiness server-side. As long as the trigger requires any end-user
-        // account — and we're not already rendering the inner iframe — wrap the form
-        // in the hosting shell (form + connect panel). No-op unless OAuth2 form auth
-        // and the dynamic-credentials module are both active.
-        if (authentication === 'n8nUserAuth' &&
-            authedUser &&
-            isFormOAuth2Enabled() &&
-            oAuth2Token &&
-            !shellInner) {
+        // check readiness server-side. If anything is still missing — and we're not
+        // already rendering the inner iframe — wrap the form in the hosting shell
+        // (form + connect panel, submit disabled). No-op unless OAuth2 form auth and
+        // the dynamic-credentials module are both active.
+        if (authentication === 'n8nUserAuth' && authedUser && oAuth2Token && !shellInner) {
             // Must name the endpoint actually being served (test vs production) — the
             // OAuth2 token is bound to that resource, same as in the auth path above.
             const resourceUrl = trimTrailingSlash(context.getWebhookResourceUrl('default') ?? '');
@@ -995,6 +1254,7 @@ async function formWebhook(context, authProperty = interfaces_1.FORM_TRIGGER_AUT
                         resourceUrl,
                         credentials: credentialStatus.credentials,
                         submitterEmail: authedUser?.email,
+                        formWaitingPath: getFormWaitingBasePath(context) ?? undefined,
                     });
                     return { noWebhookResponse: true };
                 }
@@ -1003,15 +1263,9 @@ async function formWebhook(context, authProperty = interfaces_1.FORM_TRIGGER_AUT
         let authToken;
         if (node.typeVersion > 1) {
             if (authentication === 'n8nUserAuth' && authedUser) {
-                if (!isFormOAuth2Enabled()) {
-                    // Cookies aren't sent on POST from the sandboxed form page
-                    // (null origin + SameSite=Lax). Embed an HMAC token so the
-                    // POST handler can re-authenticate the user.
-                    authToken = generateFormUserAuthToken(node, authedUser);
-                }
-                else {
-                    authToken = oAuth2Token;
-                }
+                // Cookies aren't sent on POST from the sandboxed form page (null origin +
+                // SameSite=Lax), so the POST re-authenticates off this token.
+                authToken = oAuth2Token;
             }
             else {
                 authToken = await (0, utils_1.generateFormPostBasicAuthToken)(context, authProperty);
@@ -1043,25 +1297,11 @@ async function formWebhook(context, authProperty = interfaces_1.FORM_TRIGGER_AUT
     // iframe. It also works off the state at render time, so a required credential can
     // be revoked — or the page simply left open — between render and submit. Re-check
     // here, after identity establishment and before the execution is enqueued, so a
-    // stale page can't spawn a run that dies at credential resolution. Scoped to the
-    // trigger: the Wait node shares `formWebhook`, but its form resume continues an
-    // already-running execution.
+    // stale page can't spawn a run that dies at credential resolution. The Form node
+    // runs the same gate on its own POST (Form.node.ts); the Wait node shares
+    // `formWebhook`, so scope this call site to the trigger.
     if (node.type === n8n_workflow_1.FORM_TRIGGER_NODE_TYPE) {
-        let readiness;
-        try {
-            readiness = await context.checkTriggerCredentialStatus();
-        }
-        catch (error) {
-            // Fail closed. Throwing here is swallowed by the webhook layer, which then
-            // enqueues the execution anyway — exactly the doomed run we're preventing.
-            context.logger.error('Form submit credential readiness check failed', { error });
-            res.status(503).json({ status: 'credential_readiness_check_failed' });
-            return { noWebhookResponse: true };
-        }
-        if (readiness && !readiness.readyToExecute) {
-            // 428, matching the webhook trigger's gate (webhook-helpers.ts) so both
-            // trigger paths answer an unconnected credential the same way.
-            res.status(428).json((0, n8n_workflow_1.buildCredentialConnectionsRequiredResponse)(readiness));
+        if (await respondIfCredentialsNotReady(context, res)) {
             return { noWebhookResponse: true };
         }
     }