n8n-workflow 2.33.2 → 2.34.1

package/dist/esm/interfaces.d.ts

@@ -91,6 +91,15 @@ export type N8nOAuth2ValidationResult = {
     valid: false;
     reason: OAuth2FailureReason;
 };
+export type N8nOAuth2FlowResult = {
+    valid: true;
+    token: string;
+    user: IUser;
+    metadata?: Record<string, string>;
+} | {
+    valid: false;
+    reason: string;
+};
 export type ProjectSharingData = {
     id: string;
     name: string | null;
@@ -165,7 +174,7 @@ export declare abstract class ICredentialsHelper {
      * validator so the policy is defined in exactly one place.
      */
     abstract isCredentialUsableByNode(credentialType: string, nodeType: string): boolean;
-    abstract authenticate(credentials: ICredentialDataDecryptedObject, typeName: string, requestOptions: IHttpRequestOptions | IRequestOptionsSimplified, workflow: Workflow, node: INode): Promise<IHttpRequestOptions>;
+    abstract authenticate(credentials: ICredentialDataDecryptedObject, typeName: string, requestOptions: IHttpRequestOptions | IRequestOptionsSimplified, workflow?: Workflow, node?: INode): Promise<IHttpRequestOptions>;
     abstract preAuthentication(helpers: IHttpRequestHelper, credentials: ICredentialDataDecryptedObject, typeName: string, node: INode, credentialsExpired: boolean): Promise<ICredentialDataDecryptedObject | undefined>;
     abstract runPreAuthentication(helpers: IHttpRequestHelper, credentials: ICredentialDataDecryptedObject, typeName: string): Promise<ICredentialDataDecryptedObject | undefined>;
     abstract getCredentials(nodeCredentials: INodeCredentialsDetails, type: string): Promise<ICredentials>;
@@ -699,7 +708,7 @@ type CronRecurrenceRule = {
     activated: true;
     index: number;
     intervalSize: number;
-    typeInterval: 'hours' | 'days' | 'weeks' | 'months';
+    typeInterval: 'minutes' | 'hours' | 'days' | 'weeks' | 'months';
 };
 /**
  * @deprecated Remnant of the legacy in-memory scheduling path. `registerCron`
@@ -806,10 +815,14 @@ export type CredentialCheckResult = {
     credentials: CredentialCheckStatus[];
 };
 export type DynamicCredentialCheckProxyProvider = {
-    checkCredentialStatus(workflowId: string, executionContext: IExecutionContext): Promise<CredentialCheckResult>;
+    checkCredentialStatus(workflowId: string, executionContext: {
+        credentials?: string;
+    }): Promise<CredentialCheckResult>;
 };
 export type CredentialCheckProxyFunctions = {
-    checkCredentialStatus?(workflowId: string, executionContext: IExecutionContext): Promise<CredentialCheckResult>;
+    checkCredentialStatus?(workflowId: string, executionContext: {
+        credentials?: string;
+    }): Promise<CredentialCheckResult>;
 };
 export type OauthJweProxyProvider = {
     decryptOAuth2TokenData(tokenData: IDataObject): Promise<IDataObject>;
@@ -850,7 +863,7 @@ export type IExecuteFunctions = ExecuteFunctions.GetNodeParameterFn & BaseExecut
     getRuntimeCredential(alias: string): Promise<IDataObject[string] | undefined>;
     putExecutionToWait(waitTill: Date): Promise<void>;
     sendMessageToUI(message: any): void;
-    sendResponse(response: IExecuteResponsePromiseData): void;
+    sendResponse(response: IExecuteResponsePromiseData): Promise<void>;
     sendChunk(type: ChunkType, itemIndex: number, content?: IDataObject | string): void;
     isStreaming(): boolean;
     /** Returns true if the node is being executed as an AI Agent tool */
@@ -966,7 +979,57 @@ export interface IHookFunctions extends FunctionsBaseWithRequiredKeys<'getMode'
 export interface IWebhookFunctions extends FunctionsBaseWithRequiredKeys<'getMode'> {
     getBodyData(): IDataObject;
     getHeaderData(): IncomingHttpHeaders;
+    /**
+     * Identity pipeline for identity-bearing triggers (Form, MCP).
+     *
+     * These let a trigger run a workflow as the *caller* — resolving that user's own
+     * private (per-user) credentials instead of a shared/static credential — by
+     * proving the caller's n8n identity against the internal Authorization Server (AS)
+     * and binding it to the execution. The shape is acquire → verify → bind:
+     *
+     * - Browser-facing triggers (Form) acquire a token interactively:
+     *   `beginN8nOAuth2Flow` → (AS redirect) → `completeN8nOAuth2Flow`.
+     * - Resource-server triggers (MCP) receive a bearer token directly and only
+     *   `validateN8nOAuth2Token` it.
+     * - Either way, `establishTriggerIdentity` binds the verified token to the run.
+     */
+    /**
+     * Starts the interactive authorization-code + PKCE flow against n8n's internal AS
+     * for `resourceUrl` (the trigger's own protected-resource URL). Returns the
+     * `/oauth/authorize` URL to redirect the browser to; the AS identifies the
+     * already-logged-in user from their n8n session (no login prompt for the
+     * first-party trigger client) and redirects back to the trigger URL with a code.
+     * Used on the initial GET of a browser-facing trigger. Pair with
+     * `completeN8nOAuth2Flow`.
+     *
+     * Optional `metadata` is stashed server-side against this flow's one-time `state`
+     * (never sent to the browser) and returned by `completeN8nOAuth2Flow` on success —
+     * a per-flow slot for carrying data (e.g. the original request query) across the bounce.
+     */
+    beginN8nOAuth2Flow(resourceUrl: string, metadata?: Record<string, string>): Promise<string>;
+    /**
+     * Completes the flow started by `beginN8nOAuth2Flow` once the AS redirects back to
+     * the trigger URL with `?code&state`. Consumes the one-time `state`, verifies PKCE,
+     * exchanges the code for an access token **server-side** (the code never reaches the
+     * sandboxed form page), and validates it. Returns the token and resolved user on
+     * success, or a failure reason.
+     */
+    completeN8nOAuth2Flow(code: string, state: string): Promise<N8nOAuth2FlowResult>;
+    /**
+     * Verifies an AS access token against `resourceUrl` (the expected audience) without
+     * running a redirect flow. Used by resource-server triggers (MCP) that receive a
+     * bearer token directly, and by browser triggers on the POST leg to re-check the
+     * token the page presents. Returns validity + resolved user, or a failure reason
+     * (`invalid_token`, `insufficient_scope`, …).
+     */
     validateN8nOAuth2Token(token: string, resourceUrl: string): Promise<N8nOAuth2ValidationResult>;
+    /**
+     * Binds the verified submitter to the current execution: builds an encrypted
+     * credential context from `token`/`resource` and threads it into the execution's
+     * runtime context, so downstream nodes resolve *that user's* per-user credentials.
+     * Call only after the token is validated. The identity persists for the whole
+     * execution (including across a Wait), within the token's validity window.
+     */
     establishTriggerIdentity(token: string, resource: string): Promise<void>;
     /**
      * Checks the status of the triggering identity's resolvable (private) credentials
@@ -978,7 +1041,14 @@ export interface IWebhookFunctions extends FunctionsBaseWithRequiredKeys<'getMod
     checkTriggerCredentialStatus(): Promise<CredentialCheckResult | undefined>;
     getInputConnectionData(connectionType: AINodeConnectionType, itemIndex: number, inputIndex?: number): Promise<unknown>;
     getNodeParameter(parameterName: string, fallbackValue?: any, options?: IGetNodeParameterOptions): NodeParameterValueType | object;
+    /** Always the production endpoint, whichever endpoint the request arrived on. */
     getNodeWebhookUrl: (name: WebhookType) => string | undefined;
+    /**
+     * The endpoint actually being served (`/webhook-test/…` on a test run), which
+     * identifies the webhook as an OAuth protected resource. Minting and verifying a
+     * token both derive the resource from it, so it must track the endpoint served.
+     */
+    getWebhookResourceUrl: (name: WebhookType) => string | undefined;
     evaluateExpression(expression: string, itemIndex?: number): NodeParameterValueType;
     getParamsData(): object;
     getQueryData(): object;
@@ -1223,6 +1293,7 @@ export interface INodePropertyTypeOptions {
     password?: boolean;
     copyButton?: boolean;
     redactJsonLeaves?: boolean;
+    resolveCredentialJsonLeaves?: boolean;
     ignoreCredentialExpressionResolveError?: boolean;
     rows?: number;
     showAlpha?: boolean;
@@ -1488,6 +1559,7 @@ export interface INodePropertyOptions {
     inputSchema?: any;
     displayOptions?: IDisplayOptions;
     disabledOptions?: undefined;
+    envFeatureFlag?: Uppercase<string>;
 }
 export interface INodeListSearchItems extends INodePropertyOptions {
     icon?: string;
@@ -2638,6 +2710,13 @@ export interface IWorkflowExecutionDataProcess {
      * apart) and by telemetry.
      */
     source?: WorkflowExecutionSource;
+    /**
+     * When true, a failure in this run must not dispatch the workflow's error
+     * workflow (or its own Error Trigger). Set for runs that are a test of the
+     * workflow rather than a real one, but that still need a production
+     * execution mode for realistic trigger semantics
+     */
+    suppressErrorWorkflow?: boolean;
     telemetryMetadata?: IWorkflowExecutionTelemetryMetadata;
     dirtyNodeNames?: string[];
     triggerToStartFrom?: {
@@ -2669,7 +2748,7 @@ export interface IWorkflowExecutionDataProcess {
         traceparent: string;
         tracestate?: string;
     };
-    /** Encrypted credential context for a manual editor-triggered execution. */
+    /** Encrypted credential context for a triggered execution. */
     encryptedRunnerIdentity?: string;
     /** Parent evaluation TestRun.id, exposed to expressions as `$evaluation.runId`. */
     evaluationRunId?: string;
@@ -2727,6 +2806,14 @@ export interface IWorkflowExecuteAdditionalData {
     executionId?: string;
     restartExecutionId?: string;
     getRuntimeCredential(runExecutionData: IRunExecutionData, alias: string): Promise<IDataObject[string] | undefined>;
+    /**
+     * Backing implementations for the trigger identity pipeline exposed to nodes on
+     * `IWebhookFunctions` (see the docs there). Optional here because they are only
+     * wired in by the CLI webhook layer when the OAuth server is available; the
+     * context methods throw if a node reaches them while unset.
+     */
+    beginN8nOAuth2Flow?: (resourceUrl: string, metadata?: Record<string, string>) => Promise<string>;
+    completeN8nOAuth2Flow?: (code: string, state: string) => Promise<N8nOAuth2FlowResult>;
     validateN8nOAuth2Token?: (token: string, resourceUrl: string) => Promise<N8nOAuth2ValidationResult>;
     establishTriggerIdentity?(token: string, resource: string): Promise<void>;
     checkTriggerCredentialStatus?(): Promise<CredentialCheckResult | undefined>;
@@ -2738,7 +2825,9 @@ export interface IWorkflowExecuteAdditionalData {
     instanceBaseUrl: string;
     setExecutionStatus?: (status: ExecutionStatus) => void;
     sendDataToUI?: (type: string, data: IDataObject | IDataObject[]) => void;
+    formBaseUrl: string;
     formWaitingBaseUrl: string;
+    formTestBaseUrl: string;
     webhookBaseUrl: string;
     webhookWaitingBaseUrl: string;
     webhookTestBaseUrl: string;