n8n-nodes-redactor 7.0.0 → 7.0.1

package/README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="https://raw.githubusercontent.com/mjmirza/n8n-nodes-redactor/master/.github/assets/logo.png" alt="Redactor" width="96" />
+  <img src="https://raw.githubusercontent.com/mjmirza/n8n-nodes-redactor/main/.github/assets/logo.png" alt="Redactor" width="96" />
 </p>
 
 <h1 align="center">n8n-nodes-redactor</h1>
@@ -12,7 +12,7 @@
 <p align="center">
   <a href="https://www.npmjs.com/package/n8n-nodes-redactor"><img src="https://img.shields.io/npm/v/n8n-nodes-redactor?label=npm" alt="npm version" /></a>
   <a href="https://www.npmjs.com/package/n8n-nodes-redactor"><img src="https://img.shields.io/npm/dm/n8n-nodes-redactor?label=downloads" alt="npm downloads" /></a>
-  <a href="https://github.com/mjmirza/n8n-nodes-redactor/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/mjmirza/n8n-nodes-redactor/ci.yml?branch=master&label=CI" alt="CI status" /></a>
+  <a href="https://github.com/mjmirza/n8n-nodes-redactor/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/mjmirza/n8n-nodes-redactor/ci.yml?branch=main&label=CI" alt="CI status" /></a>
   <a href="https://www.npmjs.com/package/n8n-nodes-redactor#provenance"><img src="https://img.shields.io/badge/npm-provenance%20signed-brightgreen" alt="npm provenance" /></a>
   <a href="#license"><img src="https://img.shields.io/npm/l/n8n-nodes-redactor" alt="MIT License" /></a>
   <img src="https://img.shields.io/badge/PII%20patterns-218-blue" alt="218 PII patterns" />
@@ -54,7 +54,7 @@ After Restore, your workflow gets the real values back.
 | Self-hosted n8n 1.x and 2.x | Supported |
 | n8n verified community nodes | Eligible from 4.0.0. Passes n8n's verification scanner with no findings |
 
-Version 4.0.0 uses no local disk. The vault lives in workflow storage and audit records go to the Report output. Upgrading from 1.x? Read [docs/MIGRATION.md](https://github.com/mjmirza/n8n-nodes-redactor/blob/master/docs/MIGRATION.md). The 1.x line stays installable with `npm install n8n-nodes-redactor@v1-legacy`.
+Version 4.0.0 uses no local disk. The vault lives in workflow storage and audit records go to the Report output. Upgrading from 1.x? Read [docs/MIGRATION.md](https://github.com/mjmirza/n8n-nodes-redactor/blob/main/docs/MIGRATION.md). The 1.x line stays installable with `npm install n8n-nodes-redactor@v1-legacy`.
 
 ## Operations
 
@@ -121,8 +121,8 @@ Set Verify Output on the Verify node to Items, Stop on FAIL. Verify then passes
 | Audit report | A second output with hits by category and pattern |
 | Audit log | Turn on Audit Log to get an `audit` record (counts, labels, timing, never values) on the Report output. Send it to any database, sheet or SIEM node |
 | ROPA record | Turn on Include Audit Report, then Include GDPR Art.30 ROPA Record, and fill in the controller details |
-| Presidio | Optional Microsoft Presidio container for names and organisations in free text. See [docs/PRESIDIO_SETUP.md](https://github.com/mjmirza/n8n-nodes-redactor/blob/master/docs/PRESIDIO_SETUP.md). When Presidio cannot scan a text the run stops, unless If Presidio Fails is set to continue with patterns only |
-| Per-tenant profiles | Turn on Use Tenant Profile and paste JSON. Validated on every run. Fields are listed in [docs/MIGRATION.md](https://github.com/mjmirza/n8n-nodes-redactor/blob/master/docs/MIGRATION.md#tenant-profile-fields) |
+| Presidio | Optional Microsoft Presidio container for names and organisations in free text. See [docs/PRESIDIO_SETUP.md](https://github.com/mjmirza/n8n-nodes-redactor/blob/main/docs/PRESIDIO_SETUP.md). When Presidio cannot scan a text the run stops, unless If Presidio Fails is set to continue with patterns only |
+| Per-tenant profiles | Turn on Use Tenant Profile and paste JSON. Validated on every run. Fields are listed in [docs/MIGRATION.md](https://github.com/mjmirza/n8n-nodes-redactor/blob/main/docs/MIGRATION.md#tenant-profile-fields) |
 
 This node reduces what reaches a model. It is not legal advice and does not on its own make a workflow GDPR or HIPAA compliant.
 

package/dist/nodes/Redactor/Redactor.node.js

@@ -864,7 +864,7 @@ class Redactor {
         };
     }
     async execute() {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+        var _a, _b, _c, _d, _e, _f, _g, _h;
         const items = this.getInputData();
         const allPaired = items.map((_, i) => ({ item: i }));
         const operation = (0, runtime_1.runSetting)(this, 'operation');
@@ -1012,10 +1012,7 @@ class Redactor {
         }
         let sessionId = '';
         if (operation === 'redact' || operation === 'restore') {
-            sessionId = String((_a = (0, runtime_1.runSetting)(this, 'sessionId')) !== null && _a !== void 0 ? _a : '');
-            if (!sessionId) {
-                throw new n8n_workflow_1.NodeOperationError(this.getNode(), 'Session ID is required');
-            }
+            sessionId = (0, runtime_1.readSessionId)(this, 'sessionId');
         }
         if (operation === 'redact') {
             let mode = (0, runtime_1.runSetting)(this, 'redactionMode', 'token');
@@ -1030,9 +1027,9 @@ class Redactor {
             let sessionTtl = (0, runtime_1.runSetting)(this, 'sessionTtl', 60);
             const includeReport = (0, runtime_1.runSetting)(this, 'includeReport', false);
             const customPatternsRaw = (0, runtime_1.runSetting)(this, 'customPatterns', {});
-            let customPatterns = (_b = customPatternsRaw.patterns) !== null && _b !== void 0 ? _b : [];
+            let customPatterns = (_a = customPatternsRaw.patterns) !== null && _a !== void 0 ? _a : [];
             const fieldRulesRaw = (0, runtime_1.runSetting)(this, 'fieldRules', {});
-            let fieldRules = ((_c = fieldRulesRaw.rules) !== null && _c !== void 0 ? _c : []).map((r) => ({
+            let fieldRules = ((_b = fieldRulesRaw.rules) !== null && _b !== void 0 ? _b : []).map((r) => ({
                 field: r.field,
                 mode: fieldMode === 'allowlist' ? 'include' : 'exclude',
             }));
@@ -1067,12 +1064,12 @@ class Redactor {
                 }
             }
             const allowListRaw = (0, runtime_1.runSetting)(this, 'allowList', {});
-            let allowList = ((_d = allowListRaw.entries) !== null && _d !== void 0 ? _d : []).map((e) => ({
+            let allowList = ((_c = allowListRaw.entries) !== null && _c !== void 0 ? _c : []).map((e) => ({
                 value: e.value,
                 type: (e.type || 'contains'),
             }));
             const denyListRaw = (0, runtime_1.runSetting)(this, 'denyList', {});
-            let denyList = ((_e = denyListRaw.entries) !== null && _e !== void 0 ? _e : []).map((e) => ({
+            let denyList = ((_d = denyListRaw.entries) !== null && _d !== void 0 ? _d : []).map((e) => ({
                 value: e.value,
                 type: (e.type || 'exact'),
             }));
@@ -1159,8 +1156,8 @@ class Redactor {
                 inputIndex: {},
                 lockedSpans: new WeakMap(),
                 keyLocks: new WeakMap(),
-                priorTokens: (0, engine_1.priorTokenMatcher)((_f = vault.getSession(sessionId)) === null || _f === void 0 ? void 0 : _f.entries),
             };
+            ctx.priorTokens = (0, engine_1.priorTokensInInput)(ctx, (_e = vault.getSession(sessionId)) === null || _e === void 0 ? void 0 : _e.entries);
             const allHits = [];
             const returnData = [];
             for (let i = 0; i < items.length; i++) {
@@ -1229,7 +1226,7 @@ class Redactor {
                 if (includeReport && (0, runtime_1.runSetting)(this, 'includeRopa', false)) {
                     const d = (0, runtime_1.runSetting)(this, 'ropa', {});
                     const list = (v) => String(v !== null && v !== void 0 ? v : '').split(',').map((x) => x.trim()).filter(Boolean);
-                    report.ropa = (0, ropa_1.generateRopaRecord)(allHits, (0, classification_1.classifyData)(allHits), items.length, enabledPatterns.length, mode, sessionTtl, !!vaultPassphrase, auditLog, { name: String((_g = d.controllerName) !== null && _g !== void 0 ? _g : ''), contactEmail: String((_h = d.controllerContact) !== null && _h !== void 0 ? _h : ''), dpo: d.dpo ? String(d.dpo) : undefined }, list(d.purposes), String((_j = d.legalBasis) !== null && _j !== void 0 ? _j : 'legitimate_interest'), list(d.dataSubjects), list(d.recipients), []);
+                    report.ropa = (0, ropa_1.generateRopaRecord)(allHits, (0, classification_1.classifyData)(allHits), items.length, enabledPatterns.length, mode, sessionTtl, !!vaultPassphrase, auditLog, { name: String((_f = d.controllerName) !== null && _f !== void 0 ? _f : ''), contactEmail: String((_g = d.controllerContact) !== null && _g !== void 0 ? _g : ''), dpo: d.dpo ? String(d.dpo) : undefined }, list(d.purposes), String((_h = d.legalBasis) !== null && _h !== void 0 ? _h : 'legitimate_interest'), list(d.dataSubjects), list(d.recipients), []);
                     versionRopaSummary(report.ropa, (0, classification_1.classifyData)(allHits).hitCountByLevel, this.getNode().typeVersion);
                 }
                 return [returnData, [{ json: report, pairedItem: allPaired }]];
@@ -1264,10 +1261,7 @@ class Redactor {
         if (operation === 'purge') {
             const purgeScope = (0, runtime_1.runSetting)(this, 'purgeScope', 'all');
             if (purgeScope === 'specific') {
-                const purgeSessionId = (0, runtime_1.runSetting)(this, 'purgeSessionId', '');
-                if (!purgeSessionId) {
-                    throw new n8n_workflow_1.NodeOperationError(this.getNode(), 'Session ID is required for purging a specific session.');
-                }
+                const purgeSessionId = (0, runtime_1.readSessionId)(this, 'purgeSessionId');
                 const purged = vault.purgeSession(purgeSessionId);
                 return [[{
                             json: {

package/dist/nodes/Redactor/engine.js

@@ -36,7 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.collectTokenLike = collectTokenLike;
 exports.collectInputText = collectInputText;
 exports.redactValue = redactValue;
-exports.priorTokenMatcher = priorTokenMatcher;
+exports.priorTokensInInput = priorTokensInInput;
 exports.ensureRestorable = ensureRestorable;
 exports.restoreValue = restoreValue;
 exports.restoreFromSession = restoreFromSession;
@@ -1095,8 +1095,29 @@ function lockChild(ctx, container, key, compute) {
     ctx.lastLocked = undefined;
     return out;
 }
-function priorTokenMatcher(entries) {
-    const tokens = Object.keys(entries !== null && entries !== void 0 ? entries : {}).filter((t) => t.length > 0).sort((a, b) => b.length - a.length);
+function priorTokensPresent(input, entries) {
+    const shape = tokenShape(entries);
+    if (shape.byFirst.size === 0)
+        return [];
+    const found = new Set();
+    for (let at = 0; at < input.length; at++) {
+        const lengths = shape.byFirst.get(input.charCodeAt(at));
+        if (!lengths)
+            continue;
+        for (const length of lengths) {
+            if (at + length > input.length)
+                break;
+            const token = input.slice(at, at + length);
+            if (Object.prototype.hasOwnProperty.call(entries, token))
+                found.add(token);
+        }
+    }
+    return [...found].sort((a, b) => b.length - a.length);
+}
+function priorTokensInInput(ctx, entries) {
+    if (!entries || !ctx.inputText)
+        return undefined;
+    const tokens = priorTokensPresent(ctx.inputText, entries);
     return tokens.length > 0 ? new RegExp(tokens.map(escapeRe).join('|'), 'g') : undefined;
 }
 function literalStage(pass) {

package/dist/nodes/Redactor/patterns.js

@@ -484,17 +484,22 @@ function scanLdapDns(text) {
     return spans;
 }
 const isLineBreak = (ch) => ch === '\n' || ch === '\r';
-function connValueEnd(text, from, limit) {
-    var _a;
+const CONN_SPACE = String.raw `(?:[^\S\r\n]|\u0085)`;
+const connSpace = new RegExp(CONN_SPACE);
+const CONN_HOST_KEY = 'Server|Data Source|Host';
+const CONN_PASSWORD_KEY = 'Password|Pwd';
+const CONN_SENSITIVE_KEY = `${CONN_PASSWORD_KEY}|User ID|Uid|User|Access Token|Token|Client Secret|Secret|API Key`;
+const CONN_KEY = `(?:${CONN_HOST_KEY}|${CONN_SENSITIVE_KEY})`;
+const connHostKey = new RegExp(`^(?:${CONN_HOST_KEY})$`, 'i');
+const connPasswordKey = new RegExp(`^(?:${CONN_PASSWORD_KEY})$`, 'i');
+function connValueStart(text, from) {
     let at = from;
-    while (at < limit && /\s/.test(text[at]))
-        at++;
-    if (/["'{]/.test((_a = text[at]) !== null && _a !== void 0 ? _a : ''))
-        at = quotedValueEnd(text, at, limit);
-    while (at < limit && text[at] !== ';')
+    while (at < text.length && connSpace.test(text[at]))
         at++;
     return at;
 }
+const connQuoteAt = (text, at, braceEnd) => { var _a; return /["']/.test((_a = text[at]) !== null && _a !== void 0 ? _a : '') || (text[at] === '{' && at < braceEnd); };
+const connHasValue = (text, at) => at < text.length && text[at] !== ';';
 function quotedValueEnd(text, at, limit) {
     const opener = text[at++];
     const quote = opener === '{' ? '}' : opener;
@@ -507,60 +512,88 @@ function quotedValueEnd(text, at, limit) {
     }
     return at;
 }
-function connSegmentEnd(text, from, limit) {
-    let at = from;
-    while (at < limit && text[at] !== '=' && text[at] !== ';')
-        at++;
-    return text[at] === '=' ? connValueEnd(text, at + 1, limit) : at;
+function lastBraceClose(text, from, limit) {
+    let at = limit;
+    while (at > from) {
+        if (text[--at] !== '}')
+            continue;
+        const end = at + 1;
+        while (at > from && text[at - 1] === '}')
+            at--;
+        if ((end - at) % 2 === 1)
+            return end;
+    }
+    return -1;
 }
-function connLine(text, at) {
-    let lineStart = at;
-    while (lineStart > 0 && !isLineBreak(text[lineStart - 1]))
-        lineStart--;
-    let end = at;
-    while (end < text.length && !isLineBreak(text[end]))
-        end++;
-    return { end, password: lastPasswordSegment(text, lineStart, end), semi: -2 };
+function recordConnKey(chain, key) {
+    if (connPasswordKey.test(key))
+        chain.password = true;
+    if (!connHostKey.test(key))
+        return true;
+    chain.host = true;
+    return false;
 }
-function nextSemi(text, line, from) {
-    if (line.semi !== -1 && line.semi < from) {
-        line.semi = connValueEnd(text, from, line.end);
-        if (line.semi === line.end)
-            line.semi = -1;
+function connChain(text, from, limit, braceEnd) {
+    const chain = { start: from, end: from, host: false, password: false };
+    const line = text.slice(from, limit);
+    const elements = new RegExp(`(?<![A-Za-z])(${CONN_KEY})${CONN_SPACE}*=|[=;]`, 'gi');
+    let sensitive = false;
+    let match;
+    while ((match = elements.exec(line)) !== null) {
+        if (match[0] === ';') {
+            if (sensitive)
+                chain.end = from + match.index;
+            sensitive = false;
+            continue;
+        }
+        const at = connValueStart(line, elements.lastIndex);
+        if (match[1] && connHasValue(line, at))
+            sensitive = recordConnKey(chain, match[1]) || sensitive;
+        if (connQuoteAt(line, at, braceEnd - from))
+            elements.lastIndex = quotedValueEnd(line, at, line.length);
     }
-    return line.semi;
+    if (sensitive)
+        chain.end = limit;
+    return chain;
 }
-function lastPasswordSegment(text, lineStart, lineEnd) {
-    let found = null;
-    let segStart = lineStart;
-    while (segStart <= lineEnd) {
-        const segEnd = connSegmentEnd(text, segStart, lineEnd);
-        const segment = text.slice(segStart, segEnd);
-        const key = /^[ \t]*(?:Password|Pwd)[ \t]*=/i.exec(segment);
-        if (key && key[0].length < segment.length)
-            found = { semi: segStart - 1, end: segEnd };
-        segStart = segEnd + 1;
+function scanConnGrammar(text, odbc) {
+    const spans = [];
+    const starts = new RegExp(`(?<![A-Za-z])${CONN_KEY}${CONN_SPACE}*=`, 'gi');
+    let match;
+    while ((match = starts.exec(text)) !== null) {
+        const start = match.index;
+        let end = starts.lastIndex;
+        while (end < text.length && !isLineBreak(text[end]))
+            end++;
+        const braceEnd = odbc ? lastBraceClose(text, start, end) : -1;
+        const chain = connChain(text, start, end, braceEnd);
+        if (chain.host && chain.password)
+            spans.push({ start: chain.start, end: chain.end });
+        starts.lastIndex = end;
     }
-    return found;
+    return spans;
 }
-function scanConnStrings(text) {
+function mergeConnSpans(ado, odbc) {
     const spans = [];
-    const starts = /(?<![A-Za-z])(?:Server|Data Source|Host)[ \t]*=/gi;
-    let line = { end: -1, password: null, semi: -2 };
-    let m;
-    while ((m = starts.exec(text)) !== null) {
-        const start = m.index;
-        const valueStart = start + m[0].length;
-        if (start > line.end)
-            line = connLine(text, start);
-        const semi = nextSemi(text, line, valueStart);
-        if (semi <= valueStart || !line.password || line.password.semi < semi)
-            continue;
-        spans.push({ start, end: line.password.end });
-        starts.lastIndex = line.password.end;
+    let a = 0;
+    let b = 0;
+    while (a < ado.length || b < odbc.length) {
+        let next;
+        if (b >= odbc.length || (a < ado.length && ado[a].start <= odbc[b].start))
+            next = ado[a++];
+        else
+            next = odbc[b++];
+        const previous = spans[spans.length - 1];
+        if (previous && next.start < previous.end)
+            previous.end = Math.max(previous.end, next.end);
+        else
+            spans.push({ ...next });
     }
     return spans;
 }
+function scanConnStrings(text) {
+    return mergeConnSpans(scanConnGrammar(text, false), scanConnGrammar(text, true));
+}
 const CTX_NAME_WORD = String.raw `\p{L}[\p{L}\p{M}]*(?:['’-]\p{L}[\p{L}\p{M}]*)*`;
 const FULL_NAME_LABELS = String.raw `full\s*name|first\s*name|last\s*name|surname|family\s*name|given\s*name|Vorname|Nachname|Familienname|nom\s*de\s*famille|prenom|nombre|apellido`;
 const TITLED_WORD = String.raw `(?:\p{Lu}{2,}(?:['’-]\p{Lu}+)*|\p{Lu}[\p{Ll}\p{M}]*(?:\p{Lu}[\p{Ll}\p{M}]+)*(?:['’-]\p{Lu}?[\p{Ll}\p{M}]+(?:\p{Lu}[\p{Ll}\p{M}]+)*)*)`;
@@ -1320,8 +1353,8 @@ exports.PII_PATTERNS = [
         name: 'dbConnectionString',
         label: 'DB_CONN_STRING',
         category: 'enterprise',
-        regex: /(?:jdbc|mongodb(?:\+srv)?|postgres(?:ql)?|mysql|redis(?:s)?|mssql|mariadb):\/\/[^\s"']+/gi,
-        description: 'Database connection strings (JDBC, MongoDB, PostgreSQL, MySQL, Redis)',
+        regex: /(?:jdbc|mongodb(?:\+srv)?|postgres(?:ql)?|mysql|redis(?:s)?|amqps?|mssql|mariadb):\/\/[^\s"]+/gi,
+        description: 'Database and broker connection strings (JDBC, MongoDB, PostgreSQL, MySQL, Redis, AMQP)',
     },
     {
         name: 'connStringKV',

package/dist/nodes/Redactor/runtime.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.selectedPatterns = selectedPatterns;
 exports.runSetting = runSetting;
+exports.readSessionId = readSessionId;
 exports.resolvePassphrase = resolvePassphrase;
 exports.workflowNamespace = workflowNamespace;
 exports.assertUserRegexes = assertUserRegexes;
@@ -53,6 +54,13 @@ function runSetting(fx, name, fallback) {
     }
     return first;
 }
+function readSessionId(fns, name) {
+    var _a;
+    const sessionId = String((_a = runSetting(fns, name, '')) !== null && _a !== void 0 ? _a : '');
+    if (!sessionId)
+        throw new n8n_workflow_1.NodeOperationError(fns.getNode(), 'Session ID is required');
+    return sessionId;
+}
 async function resolvePassphrase(fns) {
     var _a;
     if ((_a = fns.getNode().credentials) === null || _a === void 0 ? void 0 : _a[VAULT_CREDENTIAL]) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-nodes-redactor",
-  "version": "7.0.0",
+  "version": "7.0.1",
   "description": "Redact, mask and anonymize PII before it reaches an LLM, then restore it. 218 patterns for emails, phones, addresses, IBAN, cards, names, SSN, passport and tax IDs. Reversible encrypted vault, GDPR Art.30 ROPA record, prompt-injection check. Runs on n8n Cloud and self-hosted n8n 2.x.",
   "keywords": [
     "n8n-community-node-package",
@@ -94,6 +94,7 @@
     "@typescript-eslint/parser": "^8.72.1",
     "eslint": "^9.29.0",
     "eslint-plugin-n8n-nodes-base": "^2.0.0",
+    "fast-check": "4.10.2",
     "jest": "^29.7.0",
     "n8n-workflow": "^2.45.4",
     "prettier": "^3.6.2",