n8n-nodes-redactor 4.0.0 → 4.2.0

package/README.md

@@ -110,7 +110,7 @@ Data source > Detect > Redact > LLM > Verify > Restore > Output > Purge
 | Deduplication | The same value gets the same token everywhere, so the model keeps relationships between fields |
 | Field targeting | Allowlist or denylist paths such as `user.email`, `*.phone` or `metadata.*` |
 | Vault | Workflow Storage by default, so Restore works in later production runs of the same workflow, or In-Memory. Sessions expire after 60 minutes by default |
-| Vault encryption | AES-256-GCM with scrypt key derivation, one passphrase per tenant |
+| Vault encryption | AES-256-GCM with scrypt key derivation, one passphrase per tenant, kept in a Redactor Vault credential. See [Vault encryption](#vault-encryption) |
 | Confidence threshold | Each match carries a 0.0 to 1.0 score. Checksum validated patterns score 0.95 |
 | Allow and deny lists | Values to never redact, such as your support address, and values to always redact, such as project codenames |
 | Prompt injection check | 25+ patterns, including instruction overrides, delimiter escapes, encoded payloads and zero width characters. Returns BLOCK, FLAG or CLEAN |
@@ -122,6 +122,20 @@ Data source > Detect > Redact > LLM > Verify > Restore > Output > Purge
 
 This node reduces what reaches a model. It is not legal advice and does not on its own make a workflow GDPR or HIPAA compliant.
 
+## Vault encryption
+
+Workflow Storage keeps sessions with the workflow. To encrypt them, create a **Redactor Vault** credential with a passphrase of at least 12 characters and attach it to both the Redact and the Restore node. n8n stores credentials encrypted and apart from the workflow, so the passphrase never sits next to the data it protects. Give each tenant its own credential.
+
+The older Vault Encryption Passphrase field still works so workflows saved with it keep restoring, but it is saved in plain text inside the workflow. When both are set, the credential wins.
+
+Restore needs the same passphrase that Redact used. If Redact meets a session ID that a different passphrase wrote, it stops with an error instead of overwriting it.
+
+### Concurrent runs
+
+n8n saves workflow storage as one block at the end of each production run and does not merge it. If two runs of the same workflow overlap, the one that finishes last wins. A session created by the other run can be lost, and a session purged by the other run can come back until its TTL expires. The node cannot prevent this from inside n8n. To stay safe, keep the Session TTL short, avoid overlapping runs of a workflow that uses Purge (for example by limiting production concurrency on your instance), or use In-Memory storage when Redact and Restore run in the same execution.
+
+In-Memory sessions are kept per workflow and are never visible to another workflow.
+
 ## For developers
 
 | Area | Detail |

package/dist/credentials/RedactorVaultApi.credentials.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedactorVaultApi = void 0;
+class RedactorVaultApi {
+    constructor() {
+        this.name = 'redactorVaultApi';
+        this.displayName = 'Redactor Vault API';
+        this.icon = { light: 'file:redactorVault.svg', dark: 'file:redactorVault.dark.svg' };
+        this.documentationUrl = 'https://github.com/mjmirza/n8n-nodes-redactor#vault-encryption';
+        this.properties = [
+            {
+                displayName: 'Vault Passphrase',
+                name: 'passphrase',
+                type: 'string',
+                typeOptions: { password: true },
+                default: '',
+                required: true,
+                description: 'Encrypts stored sessions with AES-256-GCM. Use at least 12 characters, and a different passphrase for each tenant. Sessions written with this passphrase cannot be read without it.',
+            },
+        ];
+    }
+}
+exports.RedactorVaultApi = RedactorVaultApi;

package/dist/credentials/redactorVault.dark.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="60" height="60" viewBox="16 15 370 370"><g transform="translate(0,400) scale(0.1,-0.1)"><path fill="#FF6B6B" d="M1880 3520 c-200 -204 -414 -321 -714 -390 l-99 -23 6 -171 c6 -183 24 -288 71 -431 55 -163 163 -360 258 -469 34 -40 34 -40 68 18 145 254 391 434 638 467 416 56 762 -273 883 -841 23 -108 34 -413 17 -485 -17 -70 105 200 146 325 116 350 145 599 146 1221 l0 346 -162 6 c-420 16 -743 151 -1016 424 -68 68 -124 123 -125 122 -1 0 -54 -54 -117 -119z"/><path fill="#FFA42E" d="M703 2628 c6 -546 24 -707 113 -1015 177 -610 573 -1066 1070 -1232 113 -38 115 -38 224 -1 193 64 391 184 472 285 339 421 307 1184 -66 1532 -157 147 -364 176 -528 72 -51 -33 -118 -109 -82 -94 101 42 155 43 241 5 254 -112 199 -491 -85 -601 -265 -103 -614 59 -864 401 -206 281 -312 593 -325 958 l-6 152 -84 0 -85 0 5 -462z"/></g></svg>

package/dist/credentials/redactorVault.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="60" height="60" viewBox="16 15 370 370"><g transform="translate(0,400) scale(0.1,-0.1)"><path fill="#FF5757" d="M1880 3520 c-200 -204 -414 -321 -714 -390 l-99 -23 6 -171 c6 -183 24 -288 71 -431 55 -163 163 -360 258 -469 34 -40 34 -40 68 18 145 254 391 434 638 467 416 56 762 -273 883 -841 23 -108 34 -413 17 -485 -17 -70 105 200 146 325 116 350 145 599 146 1221 l0 346 -162 6 c-420 16 -743 151 -1016 424 -68 68 -124 123 -125 122 -1 0 -54 -54 -117 -119z"/><path fill="#F79410" d="M703 2628 c6 -546 24 -707 113 -1015 177 -610 573 -1066 1070 -1232 113 -38 115 -38 224 -1 193 64 391 184 472 285 339 421 307 1184 -66 1532 -157 147 -364 176 -528 72 -51 -33 -118 -109 -82 -94 101 42 155 43 241 5 254 -112 199 -491 -85 -601 -265 -103 -614 59 -864 401 -206 281 -312 593 -325 958 l-6 152 -84 0 -85 0 5 -462z"/></g></svg>

package/dist/nodes/Redactor/Redactor.node.js

@@ -11,6 +11,7 @@ const audit_1 = require("./audit");
 const presidio_1 = require("./presidio");
 const profiles_1 = require("./profiles");
 const ropa_1 = require("./ropa");
+const runtime_1 = require("./runtime");
 const RECOMMENDED_PATTERNS = [
     'email', 'phone', 'phoneDE', 'phoneUK', 'phoneAT', 'phoneCH', 'phoneFR',
     'phoneNL', 'phoneES', 'phoneIT', 'phoneAU', 'phoneIN', 'phoneBR',
@@ -57,6 +58,19 @@ class Redactor {
                 name: 'Redactor',
             },
             inputs: [n8n_workflow_1.NodeConnectionTypes.Main],
+            credentials: [
+                {
+                    name: 'redactorVaultApi',
+                    required: false,
+                    testedBy: 'redactorVaultPassphrase',
+                    displayOptions: {
+                        show: {
+                            operation: ['redact', 'restore', 'stats', 'purge'],
+                            vaultStorage: ['workflow', 'file'],
+                        },
+                    },
+                },
+            ],
             outputs: `={{((parameters) => (parameters["includeReport"] || parameters["auditLog"]) ? [{ type: "main", displayName: "Data" }, { type: "main", displayName: "Report" }] : [{ type: "main", displayName: "Data" }])($parameter)}}`,
             properties: [
                 {
@@ -601,7 +615,7 @@ class Redactor {
                         },
                     },
                     default: '',
-                    description: 'Encrypt stored sessions at rest with AES-256-GCM. Leave empty for no encryption. When set, sessions cannot be read without this passphrase. Each tenant should use a different passphrase for complete isolation.',
+                    description: 'Deprecated. This field is saved in plain text inside the workflow. Attach a Redactor Vault credential instead, which n8n stores encrypted and which takes priority. Kept so workflows saved with it still restore.',
                 },
                 {
                     displayName: 'Session TTL (Minutes)',
@@ -739,6 +753,18 @@ class Redactor {
                 },
             ],
         };
+        this.methods = {
+            credentialTest: {
+                async redactorVaultPassphrase(credential) {
+                    var _a, _b;
+                    const passphrase = String((_b = (_a = credential.data) === null || _a === void 0 ? void 0 : _a.passphrase) !== null && _b !== void 0 ? _b : '');
+                    if (passphrase.length < 12) {
+                        return { status: 'Error', message: 'Use a passphrase of at least 12 characters.' };
+                    }
+                    return { status: 'OK', message: 'Passphrase accepted.' };
+                },
+            },
+        };
     }
     async execute() {
         var _a, _b, _c, _d, _e, _f, _g;
@@ -761,6 +787,7 @@ class Redactor {
                 fieldRules: [],
                 fieldMode: 'all',
                 skipSemantic: operation === 'verify',
+                scanNumbers: true,
             };
             const allHits = [];
             for (let i = 0; i < items.length; i++) {
@@ -859,14 +886,9 @@ class Redactor {
                     }]];
         }
         const vaultStorage = this.getNodeParameter('vaultStorage', 0, 'workflow');
-        let vaultPassphrase = '';
-        try {
-            vaultPassphrase = this.getNodeParameter('vaultPassphrase', 0, '');
-        }
-        catch { }
-        const vault = (0, vault_1.createVault)(vaultStorage, vaultStorage === 'memory' ? undefined : this.getWorkflowStaticData('global'), vaultPassphrase || undefined);
+        const vaultPassphrase = vaultStorage === 'memory' ? '' : await (0, runtime_1.resolvePassphrase)(this);
+        const vault = (0, vault_1.createVault)(vaultStorage, vaultStorage === 'memory' ? undefined : this.getWorkflowStaticData('global'), vaultPassphrase || undefined, (0, runtime_1.workflowNamespace)(this));
         if (operation === 'stats') {
-            vault.cleanup();
             const sessions = vault.listSessions();
             const totalEntries = sessions.reduce((sum, s) => sum + s.entryCount, 0);
             return [[
@@ -991,7 +1013,16 @@ class Redactor {
                 if (profile.auditLog !== undefined)
                     auditLog = profile.auditLog;
             }
-            vault.getOrCreateSession(sessionId, sessionTtl * 60 * 1000);
+            (0, runtime_1.assertUserRegexes)(this, customPatterns, [
+                { name: 'Allow list', entries: allowList },
+                { name: 'Deny list', entries: denyList },
+            ]);
+            try {
+                vault.getOrCreateSession(sessionId, sessionTtl * 60 * 1000);
+            }
+            catch (error) {
+                throw new n8n_workflow_1.NodeOperationError(this.getNode(), error.message);
+            }
             const ctx = {
                 enabledPatterns,
                 customPatterns,
@@ -1005,6 +1036,9 @@ class Redactor {
                 presidioUrl: enablePresidio ? presidioUrl : undefined,
                 presidioLanguage: enablePresidio ? presidioLanguage : undefined,
                 presidioRequest: enablePresidio ? presidioRequester : undefined,
+                scanNumbers: true,
+                reservedTokens: (0, engine_1.collectTokenLike)(items.map((it) => it.json)),
+                keyOrigins: new WeakMap(),
             };
             const allHits = [];
             const returnData = [];
@@ -1030,7 +1064,7 @@ class Redactor {
                     for (let i = 0; i < items.length; i++) {
                         const result = (0, injection_1.scanForInjection)(items[i].json);
                         if (result.detected && (!injectionResult || result.score > injectionResult.score)) {
-                            injectionResult = result;
+                            injectionResult = (0, runtime_1.sanitizeInjection)(result);
                         }
                     }
                 }
@@ -1065,7 +1099,7 @@ class Redactor {
             const deleteAfterRestore = this.getNodeParameter('deleteAfterRestore', 0, true);
             const session = vault.getSession(sessionId);
             if (!session) {
-                throw new n8n_workflow_1.NodeOperationError(this.getNode(), `No vault found for session "${sessionId}". Ensure a Redact node ran first with the same Session ID and vault storage type.`, {
+                throw new n8n_workflow_1.NodeOperationError(this.getNode(), `No vault found for session "${sessionId}" that this passphrase can open. Ensure a Redact node ran first with the same Session ID, vault storage type and passphrase.`, {
                     description: 'Testing step by step? Each "Execute step" gets a new execution ID, and n8n saves workflow storage only after production runs of an active workflow. Run the whole workflow, or set the same fixed Session ID (for example "test-1") on both nodes. Restore only works in the workflow that ran Redact.',
                 });
             }
@@ -1087,48 +1121,27 @@ class Redactor {
                 if (!purgeSessionId) {
                     throw new n8n_workflow_1.NodeOperationError(this.getNode(), 'Session ID is required for purging a specific session.');
                 }
-                const session = vault.getSession(purgeSessionId);
-                if (session) {
-                    const entryCount = Object.keys(session.entries).length;
-                    vault.deleteSession(purgeSessionId);
-                    return [[{
-                                json: {
-                                    purged: true,
-                                    sessionId: purgeSessionId,
-                                    entriesDeleted: entryCount,
-                                    message: `Session purged successfully.`,
-                                },
-                                pairedItem: allPaired,
-                            }]];
-                }
-                else {
-                    return [[{
-                                json: {
-                                    purged: false,
-                                    sessionId: purgeSessionId,
-                                    message: `No session found with this ID.`,
-                                },
-                                pairedItem: allPaired,
-                            }]];
-                }
-            }
-            else {
-                const sessions = vault.listSessions();
-                let totalEntries = 0;
-                for (const s of sessions) {
-                    totalEntries += s.entryCount;
-                    vault.deleteSession(s.sessionId);
-                }
+                const purged = vault.purgeSession(purgeSessionId);
                 return [[{
                             json: {
-                                purged: true,
-                                sessionsPurged: sessions.length,
-                                totalEntriesDeleted: totalEntries,
-                                message: `All ${sessions.length} session(s) purged successfully.`,
+                                purged: purged.found,
+                                sessionId: purgeSessionId,
+                                ...(purged.found ? { entriesDeleted: purged.entries } : {}),
+                                message: purged.found ? 'Session purged successfully.' : 'No session found with this ID.',
                             },
                             pairedItem: allPaired,
                         }]];
             }
+            const all = vault.purgeAll();
+            return [[{
+                        json: {
+                            purged: true,
+                            sessionsPurged: all.sessions,
+                            totalEntriesDeleted: all.entries,
+                            message: `All ${all.sessions} session(s) purged successfully.`,
+                        },
+                        pairedItem: allPaired,
+                    }]];
         }
         return [[]];
     }