n8n-nodes-redactor 1.11.1 → 4.1.0

package/README.md

@@ -16,7 +16,7 @@
   <a href="https://www.npmjs.com/package/n8n-nodes-redactor#provenance"><img src="https://img.shields.io/badge/npm-provenance%20signed-brightgreen" alt="npm provenance" /></a>
   <a href="#license"><img src="https://img.shields.io/npm/l/n8n-nodes-redactor" alt="MIT License" /></a>
   <img src="https://img.shields.io/badge/PII%20patterns-216-blue" alt="216 PII patterns" />
-  <img src="https://img.shields.io/badge/n8n-self--hosted-FF6D5A" alt="Self-hosted n8n" />
+  <img src="https://img.shields.io/badge/n8n-Cloud%20%2B%20self--hosted-FF6D5A" alt="n8n Cloud and self-hosted" />
 </p>
 
 ## What you get
@@ -25,7 +25,7 @@
 - **The answer still makes sense.** After the model replies, the node puts the real values back, so your output reads naturally.
 - **Fewer false alarms.** Card numbers are Luhn checked, IBANs checksum verified, NHS numbers mod 11 validated, so random digits are left alone.
 - **Proof for your records.** An optional audit report, and a GDPR Article 30 processing record built from each run.
-- **No new vendor.** Everything runs inside your own n8n. No cloud service, no API key, no runtime dependency.
+- **No new vendor.** Everything runs inside your n8n, on n8n Cloud or self-hosted. No extra service, no API key, no runtime dependency.
 
 ## From install to first result
 
@@ -50,11 +50,11 @@ After Restore, your workflow gets the real values back.
 
 | Environment | Status |
 |---|---|
+| n8n Cloud | Supported from 4.0.0 |
 | Self-hosted n8n 1.x and 2.x | Supported |
-| n8n Cloud | Not available |
-| n8n verified community nodes | Not eligible |
+| n8n verified community nodes | Eligible from 4.0.0. Passes n8n's verification scanner with no findings |
 
-The persistent vault, encrypted vault files and JSONL audit log write to the local disk. n8n Cloud and n8n's verification program do not allow community nodes to use the file system, so this node is self-hosted only by design.
+Version 4.0.0 uses no local disk. The vault lives in workflow storage and audit records go to the Report output. Upgrading from 1.x? Read [docs/MIGRATION.md](https://github.com/mjmirza/n8n-nodes-redactor/blob/master/docs/MIGRATION.md). The 1.x line stays installable with `npm install n8n-nodes-redactor@v1-legacy`.
 
 ## Operations
 
@@ -65,7 +65,7 @@ The persistent vault, encrypted vault files and JSONL audit log write to the loc
 | Detect | Assessing data before deciding | Reports what personal data exists without changing anything |
 | Verify | After redaction | Rescans the output and returns PASS or FAIL with any leaked values |
 | Classify | Governance and routing | Labels data PUBLIC, INTERNAL, CONFIDENTIAL or RESTRICTED |
-| Purge | Erasure requests and cleanup | Deletes vault sessions from memory or disk, supporting GDPR Article 17 |
+| Purge | Erasure requests and cleanup | Deletes vault sessions from memory or workflow storage, supporting GDPR Article 17 |
 | Stats | Debugging | Lists active vault sessions with entry counts and TTL |
 
 The recommended production chain looks like this.
@@ -109,19 +109,33 @@ Data source > Detect > Redact > LLM > Verify > Restore > Output > Purge
 |---|---|
 | Deduplication | The same value gets the same token everywhere, so the model keeps relationships between fields |
 | Field targeting | Allowlist or denylist paths such as `user.email`, `*.phone` or `metadata.*` |
-| Vault | In memory, or file based in `~/.n8n/pii-vault/` so it survives restarts. Sessions expire after 60 minutes by default |
-| Vault encryption | AES-256-GCM with scrypt key derivation, one passphrase per tenant |
+| Vault | Workflow Storage by default, so Restore works in later production runs of the same workflow, or In-Memory. Sessions expire after 60 minutes by default |
+| Vault encryption | AES-256-GCM with scrypt key derivation, one passphrase per tenant, kept in a Redactor Vault credential. See [Vault encryption](#vault-encryption) |
 | Confidence threshold | Each match carries a 0.0 to 1.0 score. Checksum validated patterns score 0.95 |
 | Allow and deny lists | Values to never redact, such as your support address, and values to always redact, such as project codenames |
 | Prompt injection check | 25+ patterns, including instruction overrides, delimiter escapes, encoded payloads and zero width characters. Returns BLOCK, FLAG or CLEAN |
 | Audit report | A second output with hits by category and pattern |
-| Audit log | JSONL with daily rotation and a 100 MB cap, readable by Splunk, ELK and Datadog |
+| Audit log | Turn on Audit Log to get an `audit` record (counts, labels, timing, never values) on the Report output. Send it to any database, sheet or SIEM node |
 | ROPA record | Turn on Include Audit Report, then Include GDPR Art.30 ROPA Record, and fill in the controller details |
 | Presidio | Optional Microsoft Presidio container for names and organisations in free text. See [docs/PRESIDIO_SETUP.md](https://github.com/mjmirza/n8n-nodes-redactor/blob/master/docs/PRESIDIO_SETUP.md). Falls back to built-in patterns when unreachable |
-| Per-tenant profiles | Planned for 2.0.0 as JSON settings in the node |
+| Per-tenant profiles | Turn on Use Tenant Profile and paste JSON. Validated on every run. Fields are listed in [docs/MIGRATION.md](https://github.com/mjmirza/n8n-nodes-redactor/blob/master/docs/MIGRATION.md#tenant-profile-fields) |
 
 This node reduces what reaches a model. It is not legal advice and does not on its own make a workflow GDPR or HIPAA compliant.
 
+## Vault encryption
+
+Workflow Storage keeps sessions with the workflow. To encrypt them, create a **Redactor Vault** credential with a passphrase of at least 12 characters and attach it to both the Redact and the Restore node. n8n stores credentials encrypted and apart from the workflow, so the passphrase never sits next to the data it protects. Give each tenant its own credential.
+
+The older Vault Encryption Passphrase field still works so workflows saved with it keep restoring, but it is saved in plain text inside the workflow. When both are set, the credential wins.
+
+Restore needs the same passphrase that Redact used. If Redact meets a session ID that a different passphrase wrote, it stops with an error instead of overwriting it.
+
+### Concurrent runs
+
+n8n saves workflow storage as one block at the end of each production run and does not merge it. If two runs of the same workflow overlap, the one that finishes last wins. A session created by the other run can be lost, and a session purged by the other run can come back until its TTL expires. The node cannot prevent this from inside n8n. To stay safe, keep the Session TTL short, avoid overlapping runs of a workflow that uses Purge (for example by limiting production concurrency on your instance), or use In-Memory storage when Redact and Restore run in the same execution.
+
+In-Memory sessions are kept per workflow and are never visible to another workflow.
+
 ## For developers
 
 | Area | Detail |

package/dist/credentials/RedactorVaultApi.credentials.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedactorVaultApi = void 0;
+class RedactorVaultApi {
+    constructor() {
+        this.name = 'redactorVaultApi';
+        this.displayName = 'Redactor Vault API';
+        this.icon = { light: 'file:redactorVault.svg', dark: 'file:redactorVault.dark.svg' };
+        this.documentationUrl = 'https://github.com/mjmirza/n8n-nodes-redactor#vault-encryption';
+        this.properties = [
+            {
+                displayName: 'Vault Passphrase',
+                name: 'passphrase',
+                type: 'string',
+                typeOptions: { password: true },
+                default: '',
+                required: true,
+                description: 'Encrypts stored sessions with AES-256-GCM. Use at least 12 characters, and a different passphrase for each tenant. Sessions written with this passphrase cannot be read without it.',
+            },
+        ];
+    }
+}
+exports.RedactorVaultApi = RedactorVaultApi;

package/dist/credentials/redactorVault.dark.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="60" height="60" viewBox="16 15 370 370"><g transform="translate(0,400) scale(0.1,-0.1)"><path fill="#FF6B6B" d="M1880 3520 c-200 -204 -414 -321 -714 -390 l-99 -23 6 -171 c6 -183 24 -288 71 -431 55 -163 163 -360 258 -469 34 -40 34 -40 68 18 145 254 391 434 638 467 416 56 762 -273 883 -841 23 -108 34 -413 17 -485 -17 -70 105 200 146 325 116 350 145 599 146 1221 l0 346 -162 6 c-420 16 -743 151 -1016 424 -68 68 -124 123 -125 122 -1 0 -54 -54 -117 -119z"/><path fill="#FFA42E" d="M703 2628 c6 -546 24 -707 113 -1015 177 -610 573 -1066 1070 -1232 113 -38 115 -38 224 -1 193 64 391 184 472 285 339 421 307 1184 -66 1532 -157 147 -364 176 -528 72 -51 -33 -118 -109 -82 -94 101 42 155 43 241 5 254 -112 199 -491 -85 -601 -265 -103 -614 59 -864 401 -206 281 -312 593 -325 958 l-6 152 -84 0 -85 0 5 -462z"/></g></svg>

package/dist/credentials/redactorVault.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="60" height="60" viewBox="16 15 370 370"><g transform="translate(0,400) scale(0.1,-0.1)"><path fill="#FF5757" d="M1880 3520 c-200 -204 -414 -321 -714 -390 l-99 -23 6 -171 c6 -183 24 -288 71 -431 55 -163 163 -360 258 -469 34 -40 34 -40 68 18 145 254 391 434 638 467 416 56 762 -273 883 -841 23 -108 34 -413 17 -485 -17 -70 105 200 146 325 116 350 145 599 146 1221 l0 346 -162 6 c-420 16 -743 151 -1016 424 -68 68 -124 123 -125 122 -1 0 -54 -54 -117 -119z"/><path fill="#F79410" d="M703 2628 c6 -546 24 -707 113 -1015 177 -610 573 -1066 1070 -1232 113 -38 115 -38 224 -1 193 64 391 184 472 285 339 421 307 1184 -66 1532 -157 147 -364 176 -528 72 -51 -33 -118 -109 -82 -94 101 42 155 43 241 5 254 -112 199 -491 -85 -601 -265 -103 -614 59 -864 401 -206 281 -312 593 -325 958 l-6 152 -84 0 -85 0 5 -462z"/></g></svg>

package/dist/nodes/Redactor/Redactor.node.js

@@ -9,7 +9,9 @@ const classification_1 = require("./classification");
 const injection_1 = require("./injection");
 const audit_1 = require("./audit");
 const presidio_1 = require("./presidio");
+const profiles_1 = require("./profiles");
 const ropa_1 = require("./ropa");
+const runtime_1 = require("./runtime");
 const RECOMMENDED_PATTERNS = [
     'email', 'phone', 'phoneDE', 'phoneUK', 'phoneAT', 'phoneCH', 'phoneFR',
     'phoneNL', 'phoneES', 'phoneIT', 'phoneAU', 'phoneIN', 'phoneBR',
@@ -56,8 +58,34 @@ class Redactor {
                 name: 'Redactor',
             },
             inputs: [n8n_workflow_1.NodeConnectionTypes.Main],
-            outputs: `={{((parameters) => parameters["includeReport"] ? [{ type: "main", displayName: "Data" }, { type: "main", displayName: "Report" }] : [{ type: "main", displayName: "Data" }])($parameter)}}`,
+            credentials: [
+                {
+                    name: 'redactorVaultApi',
+                    required: false,
+                    testedBy: 'redactorVaultPassphrase',
+                    displayOptions: {
+                        show: {
+                            operation: ['redact', 'restore', 'stats', 'purge'],
+                            vaultStorage: ['workflow', 'file'],
+                        },
+                    },
+                },
+            ],
+            outputs: `={{((parameters) => (parameters["includeReport"] || parameters["auditLog"]) ? [{ type: "main", displayName: "Data" }, { type: "main", displayName: "Report" }] : [{ type: "main", displayName: "Data" }])($parameter)}}`,
             properties: [
+                {
+                    displayName: 'Resource',
+                    name: 'resource',
+                    type: 'options',
+                    noDataExpression: true,
+                    options: [
+                        {
+                            name: 'Data',
+                            value: 'data',
+                        },
+                    ],
+                    default: 'data',
+                },
                 {
                     displayName: 'Operation',
                     name: 'operation',
@@ -500,7 +528,7 @@ class Redactor {
                         },
                     },
                     default: false,
-                    description: 'Whether to write a persistent JSONL audit log of all redaction activity to ~/.n8n/pii-audit/. Self-hosted n8n only. Supports GDPR Art.30, HIPAA, SOX and PCI DSS record-keeping.',
+                    description: 'Whether to add an audit record (counts, labels, severity, timing, no PII values) to the Report output. Store it with any node, for example a database or a file. Supports GDPR Art.30, HIPAA, SOX and PCI DSS record-keeping.',
                 },
                 {
                     displayName: 'Enhanced NLP Detection (Optional)',
@@ -561,31 +589,17 @@ class Redactor {
                         },
                     },
                     options: [
-                        {
-                            name: 'File-Based (Recommended, Persistent)',
-                            value: 'file',
-                        },
                         {
                             name: 'In-Memory (Fast, Lost on Restart)',
                             value: 'memory',
                         },
-                    ],
-                    default: 'file',
-                    description: 'File-based (recommended): Persists to disk, survives restarts, no memory bloat. Stored in ~/.n8n/pii-vault/. In-memory: Faster but lost on restart, capped at 1000 sessions to prevent memory bloat.',
-                },
-                {
-                    displayName: 'Vault Directory',
-                    name: 'vaultDir',
-                    type: 'string',
-                    displayOptions: {
-                        show: {
-                            operation: ['redact', 'restore', 'stats', 'purge'],
-                            vaultStorage: ['file'],
+                        {
+                            name: 'Workflow Storage (Recommended, Persistent)',
+                            value: 'workflow',
                         },
-                    },
-                    default: '',
-                    placeholder: '/path/to/vault (default: ~/.n8n/pii-vault/)',
-                    description: 'Custom directory for file-based vault storage',
+                    ],
+                    default: 'workflow',
+                    description: 'Workflow storage keeps sessions with the workflow, so Redact and Restore nodes in the same workflow share them and they survive restarts. n8n saves it after production runs of an active workflow. In-memory is faster but lost on restart and capped at 1000 sessions.',
                 },
                 {
                     displayName: 'Vault Encryption Passphrase',
@@ -597,11 +611,11 @@ class Redactor {
                     displayOptions: {
                         show: {
                             operation: ['redact', 'restore', 'stats', 'purge'],
-                            vaultStorage: ['file'],
+                            vaultStorage: ['workflow', 'file'],
                         },
                     },
                     default: '',
-                    description: 'Encrypt vault files at rest with AES-256-GCM. Leave empty for no encryption. When set, vault files cannot be read without this passphrase. Each tenant should use a different passphrase for complete isolation.',
+                    description: 'Deprecated. This field is saved in plain text inside the workflow. Attach a Redactor Vault credential instead, which n8n stores encrypted and which takes priority. Kept so workflows saved with it still restore.',
                 },
                 {
                     displayName: 'Session TTL (Minutes)',
@@ -615,6 +629,32 @@ class Redactor {
                     default: 60,
                     description: 'Auto-expire vault sessions after this many minutes. Set to 0 for no expiry. Prevents vault from growing unbounded.',
                 },
+                {
+                    displayName: 'Use Tenant Profile',
+                    name: 'useTenantProfile',
+                    type: 'boolean',
+                    displayOptions: {
+                        show: {
+                            operation: ['redact'],
+                        },
+                    },
+                    default: false,
+                    description: 'Whether to apply per-client settings from a JSON profile on top of this node',
+                },
+                {
+                    displayName: 'Tenant Profile (JSON)',
+                    name: 'tenantProfile',
+                    type: 'json',
+                    required: true,
+                    displayOptions: {
+                        show: {
+                            operation: ['redact'],
+                            useTenantProfile: [true],
+                        },
+                    },
+                    default: '{}',
+                    description: 'Optional per-client settings that override this node: enabledPatterns, customPatterns, confidenceThreshold, redactionMode, dedup, fieldMode, fieldRules, allowList, denyList, retentionMinutes, auditLog. Unknown fields are rejected.',
+                },
                 {
                     displayName: 'Purge Scope',
                     name: 'purgeScope',
@@ -713,12 +753,25 @@ class Redactor {
                 },
             ],
         };
+        this.methods = {
+            credentialTest: {
+                async redactorVaultPassphrase(credential) {
+                    var _a, _b;
+                    const passphrase = String((_b = (_a = credential.data) === null || _a === void 0 ? void 0 : _a.passphrase) !== null && _b !== void 0 ? _b : '');
+                    if (passphrase.length < 12) {
+                        return { status: 'Error', message: 'Use a passphrase of at least 12 characters.' };
+                    }
+                    return { status: 'OK', message: 'Passphrase accepted.' };
+                },
+            },
+        };
     }
     async execute() {
         var _a, _b, _c, _d, _e, _f, _g;
         const items = this.getInputData();
         const allPaired = items.map((_, i) => ({ item: i }));
         const operation = this.getNodeParameter('operation', 0);
+        const startTime = Date.now();
         (0, presidio_1.resetCircuitBreaker)();
         if (operation === 'detect' || operation === 'verify') {
             const enabledPatterns = (0, patterns_1.getPatternOptions)().map((p) => p.value);
@@ -734,6 +787,7 @@ class Redactor {
                 fieldRules: [],
                 fieldMode: 'all',
                 skipSemantic: operation === 'verify',
+                scanNumbers: true,
             };
             const allHits = [];
             for (let i = 0; i < items.length; i++) {
@@ -759,8 +813,21 @@ class Redactor {
                     includeReport = this.getNodeParameter('includeReport', 0, false);
                 }
                 catch { }
-                if (includeReport) {
-                    return [returnData, [{ json: { ...summary, hits: report.hits }, pairedItem: allPaired }]];
+                let auditLog = false;
+                try {
+                    auditLog = this.getNodeParameter('auditLog', 0, false);
+                }
+                catch { }
+                if (includeReport || auditLog) {
+                    const reportJson = includeReport
+                        ? { ...summary, hits: report.hits }
+                        : {};
+                    if (auditLog) {
+                        reportJson.audit = (0, audit_1.buildAuditEntry)('DETECT', 'token', allHits, items.length, Date.now() - startTime, enabledPatterns.length, false, (0, classification_1.classifyData)(allHits));
+                    }
+                    if (!includeReport)
+                        returnData.push({ json: summary, pairedItem: allPaired });
+                    return [returnData, [{ json: reportJson, pairedItem: allPaired }]];
                 }
                 returnData.push({ json: summary, pairedItem: allPaired });
                 return [returnData];
@@ -818,16 +885,10 @@ class Redactor {
                         pairedItem: allPaired,
                     }]];
         }
-        const vaultStorage = this.getNodeParameter('vaultStorage', 0, 'file');
-        const vaultDir = this.getNodeParameter('vaultDir', 0, '');
-        let vaultPassphrase = '';
-        try {
-            vaultPassphrase = this.getNodeParameter('vaultPassphrase', 0, '');
-        }
-        catch { }
-        const vault = (0, vault_1.createVault)(vaultStorage, vaultDir || undefined, vaultPassphrase || undefined);
+        const vaultStorage = this.getNodeParameter('vaultStorage', 0, 'workflow');
+        const vaultPassphrase = vaultStorage === 'memory' ? '' : await (0, runtime_1.resolvePassphrase)(this);
+        const vault = (0, vault_1.createVault)(vaultStorage, vaultStorage === 'memory' ? undefined : this.getWorkflowStaticData('global'), vaultPassphrase || undefined, (0, runtime_1.workflowNamespace)(this));
         if (operation === 'stats') {
-            vault.cleanup();
             const sessions = vault.listSessions();
             const totalEntries = sessions.reduce((sum, s) => sum + s.entryCount, 0);
             return [[
@@ -857,7 +918,7 @@ class Redactor {
             }
         }
         if (operation === 'redact') {
-            const mode = this.getNodeParameter('redactionMode', 0, 'token');
+            let mode = this.getNodeParameter('redactionMode', 0, 'token');
             const detectionScope = this.getNodeParameter('detectionScope', 0, 'recommended');
             let enabledPatterns;
             if (detectionScope === 'all') {
@@ -869,17 +930,29 @@ class Redactor {
             else {
                 enabledPatterns = this.getNodeParameter('piiTypes', 0);
             }
-            const dedup = this.getNodeParameter('dedup', 0, true);
-            const fieldMode = this.getNodeParameter('fieldMode', 0, 'all');
-            const sessionTtl = this.getNodeParameter('sessionTtl', 0, 60);
+            let dedup = this.getNodeParameter('dedup', 0, true);
+            let fieldMode = this.getNodeParameter('fieldMode', 0, 'all');
+            let sessionTtl = this.getNodeParameter('sessionTtl', 0, 60);
             const includeReport = this.getNodeParameter('includeReport', 0, false);
             const customPatternsRaw = this.getNodeParameter('customPatterns', 0, {});
-            const customPatterns = (_a = customPatternsRaw.patterns) !== null && _a !== void 0 ? _a : [];
+            let customPatterns = (_a = customPatternsRaw.patterns) !== null && _a !== void 0 ? _a : [];
             const fieldRulesRaw = this.getNodeParameter('fieldRules', 0, {});
-            const fieldRules = ((_b = fieldRulesRaw.rules) !== null && _b !== void 0 ? _b : []).map((r) => ({
+            let fieldRules = ((_b = fieldRulesRaw.rules) !== null && _b !== void 0 ? _b : []).map((r) => ({
                 field: r.field,
                 mode: fieldMode === 'allowlist' ? 'include' : 'exclude',
             }));
+            const presidioRequester = async ({ method, url, body, timeout }) => {
+                const response = await this.helpers.httpRequest({
+                    method: method,
+                    url,
+                    body,
+                    json: true,
+                    timeout,
+                    returnFullResponse: true,
+                    ignoreHttpStatusErrors: true,
+                });
+                return { statusCode: response.statusCode, body: response.body };
+            };
             let enablePresidio = false;
             let presidioUrl = '';
             let presidioLanguage = 'en';
@@ -893,17 +966,63 @@ class Redactor {
             catch {
             }
             const allowListRaw = this.getNodeParameter('allowList', 0, {});
-            const allowList = ((_c = allowListRaw.entries) !== null && _c !== void 0 ? _c : []).map((e) => ({
+            let allowList = ((_c = allowListRaw.entries) !== null && _c !== void 0 ? _c : []).map((e) => ({
                 value: e.value,
                 type: (e.type || 'contains'),
             }));
             const denyListRaw = this.getNodeParameter('denyList', 0, {});
-            const denyList = ((_d = denyListRaw.entries) !== null && _d !== void 0 ? _d : []).map((e) => ({
+            let denyList = ((_d = denyListRaw.entries) !== null && _d !== void 0 ? _d : []).map((e) => ({
                 value: e.value,
                 type: (e.type || 'exact'),
             }));
-            const confidenceThreshold = this.getNodeParameter('confidenceThreshold', 0, 0);
-            vault.getOrCreateSession(sessionId, sessionTtl * 60 * 1000);
+            let confidenceThreshold = this.getNodeParameter('confidenceThreshold', 0, 0);
+            const hasReportOutput = includeReport || this.getNodeParameter('auditLog', 0, false);
+            let auditLog = this.getNodeParameter('auditLog', 0, false);
+            const useTenantProfile = this.getNodeParameter('useTenantProfile', 0, false);
+            const profileRaw = useTenantProfile ? this.getNodeParameter('tenantProfile', 0, '') : '';
+            if (profileRaw !== '' && profileRaw !== undefined && profileRaw !== null) {
+                let profile;
+                try {
+                    profile = (0, profiles_1.parseTenantProfile)(profileRaw, (0, patterns_1.getPatternOptions)().map((o) => o.value));
+                }
+                catch (error) {
+                    throw new n8n_workflow_1.NodeOperationError(this.getNode(), error.message, {
+                        description: 'Fix the Tenant Profile (JSON) field, or leave it empty to use the node settings.',
+                    });
+                }
+                if (profile.enabledPatterns)
+                    enabledPatterns = profile.enabledPatterns;
+                if (profile.customPatterns)
+                    customPatterns = profile.customPatterns;
+                if (profile.confidenceThreshold !== undefined)
+                    confidenceThreshold = profile.confidenceThreshold;
+                if (profile.redactionMode)
+                    mode = profile.redactionMode;
+                if (profile.dedup !== undefined)
+                    dedup = profile.dedup;
+                if (profile.fieldMode)
+                    fieldMode = profile.fieldMode;
+                if (profile.fieldRules)
+                    fieldRules = profile.fieldRules;
+                if (profile.allowList)
+                    allowList = profile.allowList;
+                if (profile.denyList)
+                    denyList = profile.denyList;
+                if (profile.retentionMinutes !== undefined)
+                    sessionTtl = profile.retentionMinutes;
+                if (profile.auditLog !== undefined)
+                    auditLog = profile.auditLog;
+            }
+            (0, runtime_1.assertUserRegexes)(this, customPatterns, [
+                { name: 'Allow list', entries: allowList },
+                { name: 'Deny list', entries: denyList },
+            ]);
+            try {
+                vault.getOrCreateSession(sessionId, sessionTtl * 60 * 1000);
+            }
+            catch (error) {
+                throw new n8n_workflow_1.NodeOperationError(this.getNode(), error.message);
+            }
             const ctx = {
                 enabledPatterns,
                 customPatterns,
@@ -916,6 +1035,7 @@ class Redactor {
                 confidenceThreshold,
                 presidioUrl: enablePresidio ? presidioUrl : undefined,
                 presidioLanguage: enablePresidio ? presidioLanguage : undefined,
+                presidioRequest: enablePresidio ? presidioRequester : undefined,
             };
             const allHits = [];
             const returnData = [];
@@ -941,23 +1061,16 @@ class Redactor {
                     for (let i = 0; i < items.length; i++) {
                         const result = (0, injection_1.scanForInjection)(items[i].json);
                         if (result.detected && (!injectionResult || result.score > injectionResult.score)) {
-                            injectionResult = result;
+                            injectionResult = (0, runtime_1.sanitizeInjection)(result);
                         }
                     }
                 }
             }
             catch {
             }
-            try {
-                const auditLog = this.getNodeParameter('auditLog', 0, false);
-                if (auditLog) {
-                    const startTime = Date.now();
-                    const classification = (0, classification_1.classifyData)(allHits);
-                    (0, audit_1.writeAuditLog)('REDACT', mode, allHits, items.length, Date.now() - startTime, enabledPatterns.length, !!ctx.presidioUrl, classification, sessionId);
-                }
-            }
-            catch {
-            }
+            const auditEntry = auditLog && hasReportOutput
+                ? (0, audit_1.buildAuditEntry)('REDACT', mode, allHits, items.length, Date.now() - startTime, enabledPatterns.length, !!ctx.presidioUrl, (0, classification_1.classifyData)(allHits), sessionId)
+                : undefined;
             if (injectionResult && injectionResult.detected) {
                 returnData.push({
                     json: {
@@ -966,12 +1079,14 @@ class Redactor {
                     pairedItem: allPaired,
                 });
             }
-            if (includeReport) {
-                const report = (0, engine_1.buildReport)(sessionId, allHits);
-                if (this.getNodeParameter('includeRopa', 0, false)) {
+            if (hasReportOutput) {
+                const report = includeReport ? (0, engine_1.buildReport)(sessionId, allHits) : {};
+                if (auditEntry)
+                    report.audit = auditEntry;
+                if (includeReport && this.getNodeParameter('includeRopa', 0, false)) {
                     const d = this.getNodeParameter('ropa', 0, {});
                     const list = (v) => String(v !== null && v !== void 0 ? v : '').split(',').map((x) => x.trim()).filter(Boolean);
-                    report.ropa = (0, ropa_1.generateRopaRecord)(allHits, (0, classification_1.classifyData)(allHits), items.length, enabledPatterns.length, mode, sessionTtl, !!vaultPassphrase, this.getNodeParameter('auditLog', 0, false), { name: String((_e = d.controllerName) !== null && _e !== void 0 ? _e : ''), contactEmail: String((_f = d.controllerContact) !== null && _f !== void 0 ? _f : ''), dpo: d.dpo ? String(d.dpo) : undefined }, list(d.purposes), String((_g = d.legalBasis) !== null && _g !== void 0 ? _g : 'legitimate_interest'), list(d.dataSubjects), list(d.recipients), []);
+                    report.ropa = (0, ropa_1.generateRopaRecord)(allHits, (0, classification_1.classifyData)(allHits), items.length, enabledPatterns.length, mode, sessionTtl, !!vaultPassphrase, auditLog, { name: String((_e = d.controllerName) !== null && _e !== void 0 ? _e : ''), contactEmail: String((_f = d.controllerContact) !== null && _f !== void 0 ? _f : ''), dpo: d.dpo ? String(d.dpo) : undefined }, list(d.purposes), String((_g = d.legalBasis) !== null && _g !== void 0 ? _g : 'legitimate_interest'), list(d.dataSubjects), list(d.recipients), []);
                 }
                 return [returnData, [{ json: report, pairedItem: allPaired }]];
             }
@@ -981,8 +1096,8 @@ class Redactor {
             const deleteAfterRestore = this.getNodeParameter('deleteAfterRestore', 0, true);
             const session = vault.getSession(sessionId);
             if (!session) {
-                throw new n8n_workflow_1.NodeOperationError(this.getNode(), `No vault found for session "${sessionId}". Ensure a Redact node ran first with the same Session ID and vault storage type.`, {
-                    description: 'Testing step by step? Each "Execute step" gets a new execution ID, so Redact and Restore no longer share a session. Run the whole workflow, or set the same fixed Session ID (for example "test-1") on both nodes.',
+                throw new n8n_workflow_1.NodeOperationError(this.getNode(), `No vault found for session "${sessionId}" that this passphrase can open. Ensure a Redact node ran first with the same Session ID, vault storage type and passphrase.`, {
+                    description: 'Testing step by step? Each "Execute step" gets a new execution ID, and n8n saves workflow storage only after production runs of an active workflow. Run the whole workflow, or set the same fixed Session ID (for example "test-1") on both nodes. Restore only works in the workflow that ran Redact.',
                 });
             }
             const returnData = [];

package/dist/nodes/Redactor/audit.js

@@ -33,23 +33,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.writeAuditLog = writeAuditLog;
-exports.readAuditLog = readAuditLog;
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const MAX_FILE_SIZE = 104857600;
-const DEFAULT_AUDIT_DIR = path.join(process.env.HOME || '/tmp', '.n8n', 'pii-audit');
-function generateEventId() {
-    const bytes = new Array(16).fill(0).map(() => Math.floor(Math.random() * 256));
-    bytes[6] = (bytes[6] & 0x0f) | 0x40;
-    bytes[8] = (bytes[8] & 0x3f) | 0x80;
-    const hex = bytes.map((b) => b.toString(16).padStart(2, '0')).join('');
-    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-}
-function getLogFilePath(auditDir) {
-    const today = new Date().toISOString().split('T')[0];
-    return path.join(auditDir, `pii-audit-${today}.jsonl`);
-}
+exports.buildAuditEntry = buildAuditEntry;
+const crypto = __importStar(require("crypto"));
 function determineSeverity(classificationLevel, totalHits = 0) {
     if (classificationLevel === 'RESTRICTED' || totalHits >= 50)
         return 'CRITICAL';
@@ -59,87 +44,29 @@ function determineSeverity(classificationLevel, totalHits = 0) {
         return 'MEDIUM';
     return 'LOW';
 }
-function writeAuditLog(action, mode, hits, inputItemCount, processingTimeMs, patternsUsed, presidioEnabled, classification, sessionId, auditDir) {
-    try {
-        const dir = auditDir || DEFAULT_AUDIT_DIR;
-        if (!fs.existsSync(dir)) {
-            fs.mkdirSync(dir, { recursive: true });
-        }
-        const hitsByCategory = {};
-        const hitsByPattern = {};
-        for (const hit of hits) {
-            hitsByCategory[hit.category] = (hitsByCategory[hit.category] || 0) + 1;
-            hitsByPattern[hit.patternLabel] = (hitsByPattern[hit.patternLabel] || 0) + 1;
-        }
-        const entry = {
-            version: '1.0',
-            timestamp: new Date().toISOString(),
-            eventId: generateEventId(),
-            severity: determineSeverity(classification === null || classification === void 0 ? void 0 : classification.level, hits.length),
-            action,
-            mode,
-            status: 'SUCCESS',
-            totalHits: hits.length,
-            hitsByCategory,
-            hitsByPattern,
-            classificationLevel: classification === null || classification === void 0 ? void 0 : classification.level,
-            inputItemCount,
-            processingTimeMs,
-            patternsUsed,
-            presidioEnabled,
-            sessionId,
-        };
-        const logFile = getLogFilePath(dir);
-        try {
-            if (fs.existsSync(logFile)) {
-                const stats = fs.statSync(logFile);
-                if (stats.size >= MAX_FILE_SIZE) {
-                    let seq = 1;
-                    while (fs.existsSync(`${logFile}.${seq}`))
-                        seq++;
-                    fs.renameSync(logFile, `${logFile}.${seq}`);
-                }
-            }
-        }
-        catch {
-        }
-        fs.appendFileSync(logFile, JSON.stringify(entry) + '\n', 'utf-8');
-    }
-    catch {
-    }
-}
-function readAuditLog(startDate, endDate, auditDir) {
-    try {
-        const dir = auditDir || DEFAULT_AUDIT_DIR;
-        if (!fs.existsSync(dir))
-            return [];
-        const files = fs.readdirSync(dir)
-            .filter((f) => f.startsWith('pii-audit-') && f.endsWith('.jsonl'))
-            .sort();
-        const entries = [];
-        for (const file of files) {
-            const fileDate = file.replace('pii-audit-', '').replace('.jsonl', '');
-            if (startDate && fileDate < startDate)
-                continue;
-            if (endDate && fileDate > endDate)
-                continue;
-            try {
-                const content = fs.readFileSync(path.join(dir, file), 'utf-8');
-                const lines = content.split('\n').filter((l) => l.trim().length > 0);
-                for (const line of lines) {
-                    try {
-                        entries.push(JSON.parse(line));
-                    }
-                    catch {
-                    }
-                }
-            }
-            catch {
-            }
-        }
-        return entries;
-    }
-    catch {
-        return [];
+function buildAuditEntry(action, mode, hits, inputItemCount, processingTimeMs, patternsUsed, presidioEnabled, classification, sessionId) {
+    const hitsByCategory = {};
+    const hitsByPattern = {};
+    for (const hit of hits) {
+        hitsByCategory[hit.category] = (hitsByCategory[hit.category] || 0) + 1;
+        hitsByPattern[hit.patternLabel] = (hitsByPattern[hit.patternLabel] || 0) + 1;
     }
+    return {
+        version: '2.0',
+        timestamp: new Date().toISOString(),
+        eventId: crypto.randomUUID(),
+        severity: determineSeverity(classification === null || classification === void 0 ? void 0 : classification.level, hits.length),
+        action,
+        mode,
+        status: 'SUCCESS',
+        totalHits: hits.length,
+        hitsByCategory,
+        hitsByPattern,
+        classificationLevel: classification === null || classification === void 0 ? void 0 : classification.level,
+        inputItemCount,
+        processingTimeMs,
+        patternsUsed,
+        presidioEnabled,
+        sessionId,
+    };
 }