n8n-workflow 2.33.2 → 2.34.1

package/dist/esm/trigger-identity.js

@@ -1,4 +1,4 @@
-import { CHAT_TRIGGER_NODE_TYPE, EXECUTE_WORKFLOW_TRIGGER_NODE_TYPE, MANUAL_TRIGGER_NODE_TYPES, MCP_TRIGGER_NODE_TYPE, } from './constants';
+import { CHAT_TRIGGER_NODE_TYPE, EXECUTE_WORKFLOW_TRIGGER_NODE_TYPE, FORM_TRIGGER_NODE_TYPE, MANUAL_TRIGGER_NODE_TYPES, MCP_TRIGGER_NODE_TYPE, WEBHOOK_NODE_TYPE, } from './constants';
 import { toExecutionContextEstablishmentHookParameter } from './execution-context-establishment-hooks';
 const NO_IDENTITY = {
     providesN8nIdentity: false,
@@ -20,13 +20,33 @@ function hasContextEstablishmentHook(parameters) {
  * manual/parent inheritance) and the resolvers' identifiers (e.g. `N8NIdentifier`):
  * when a new trigger or identity source is added there, reflect it here too.
  */
-export function classifyTriggerIdentity(nodeType, parameters) {
+export function classifyTriggerIdentity(nodeType, parameters, options = {}) {
     // Sub-workflows inherit identity from the parent; Chat Hub and MCP-over-n8nOAuth2
     // inject it. All provide both identity families.
     const isSubWorkflowTrigger = nodeType === EXECUTE_WORKFLOW_TRIGGER_NODE_TYPE;
     const isChatHubTrigger = nodeType === CHAT_TRIGGER_NODE_TYPE && parameters?.availableInChat === true;
     const isMcpTrigger = nodeType === MCP_TRIGGER_NODE_TYPE && parameters?.authentication === 'n8nOAuth2';
-    if (isSubWorkflowTrigger || isChatHubTrigger || isMcpTrigger) {
+    // The Webhook node's opt-in "n8n User Auth (OAuth2)" mode injects the caller's
+    // n8n identity the same way the MCP trigger does — sharing the `n8nOAuth2` value.
+    // Unlike the MCP trigger, this mode is gated by an instance flag (the option is
+    // hidden in the editor while it's off), so a caller must opt in with
+    // `isWebhookOAuth2Enabled` for it to count — omitting it fails closed.
+    const isOAuth2Webhook = nodeType === WEBHOOK_NODE_TYPE &&
+        parameters?.authentication === 'n8nOAuth2' &&
+        options.isWebhookOAuth2Enabled === true;
+    // The form trigger only establishes an identity through its OAuth2 flow, so callers
+    // must opt the branch in with the instance's `isFormOAuth2Enabled`. Omitting it fails
+    // closed: without the flag a `n8nUserAuth` form takes the legacy cookie/HMAC path,
+    // which authenticates the submitter but establishes no identity to resolve
+    // credentials with — publish must reject that instead of failing mid-execution.
+    const isFormTrigger = nodeType === FORM_TRIGGER_NODE_TYPE &&
+        parameters?.authentication === 'n8nUserAuth' &&
+        options.isFormOAuth2Enabled === true;
+    if (isSubWorkflowTrigger ||
+        isChatHubTrigger ||
+        isMcpTrigger ||
+        isFormTrigger ||
+        isOAuth2Webhook) {
         return { providesN8nIdentity: true, providesExternalIdentity: true };
     }
     // Manual/chat/MCP triggers run with the n8n user identity.

package/dist/esm/trigger-identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"trigger-identity.js","sourceRoot":"","sources":["../../src/trigger-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,sBAAsB,EACtB,kCAAkC,EAClC,yBAAyB,EACzB,qBAAqB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,4CAA4C,EAAE,MAAM,yCAAyC,CAAC;AAgBvG,MAAM,WAAW,GAAgC;IAChD,mBAAmB,EAAE,KAAK;IAC1B,wBAAwB,EAAE,KAAK;CAC/B,CAAC;AAEF,sFAAsF;AACtF,SAAS,2BAA2B,CAAC,UAAuC;IAC3E,MAAM,UAAU,GAAG,4CAA4C,CAAC,UAAU,CAAC,CAAC;IAC5E,OAAO,CACN,UAAU,KAAK,IAAI;QACnB,UAAU,CAAC,OAAO;QAClB,UAAU,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAC1D,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACtC,QAAgB,EAChB,UAAuC;IAEvC,kFAAkF;IAClF,iDAAiD;IACjD,MAAM,oBAAoB,GAAG,QAAQ,KAAK,kCAAkC,CAAC;IAC7E,MAAM,gBAAgB,GACrB,QAAQ,KAAK,sBAAsB,IAAI,UAAU,EAAE,eAAe,KAAK,IAAI,CAAC;IAC7E,MAAM,YAAY,GACjB,QAAQ,KAAK,qBAAqB,IAAI,UAAU,EAAE,cAAc,KAAK,WAAW,CAAC;IAClF,IAAI,oBAAoB,IAAI,gBAAgB,IAAI,YAAY,EAAE,CAAC;QAC9D,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IAED,2DAA2D;IAC3D,IAAI,yBAAyB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;IACvE,CAAC;IAED,qFAAqF;IACrF,IAAI,2BAA2B,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;IACvE,CAAC;IAED,OAAO,WAAW,CAAC;AACpB,CAAC"}
+{"version":3,"file":"trigger-identity.js","sourceRoot":"","sources":["../../src/trigger-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,sBAAsB,EACtB,kCAAkC,EAClC,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,4CAA4C,EAAE,MAAM,yCAAyC,CAAC;AAgBvG,MAAM,WAAW,GAAgC;IAChD,mBAAmB,EAAE,KAAK;IAC1B,wBAAwB,EAAE,KAAK;CAC/B,CAAC;AAqBF,sFAAsF;AACtF,SAAS,2BAA2B,CAAC,UAAuC;IAC3E,MAAM,UAAU,GAAG,4CAA4C,CAAC,UAAU,CAAC,CAAC;IAC5E,OAAO,CACN,UAAU,KAAK,IAAI;QACnB,UAAU,CAAC,OAAO;QAClB,UAAU,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAC1D,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACtC,QAAgB,EAChB,UAAuC,EACvC,OAAO,GAA2B,EAAE;IAEpC,kFAAkF;IAClF,iDAAiD;IACjD,MAAM,oBAAoB,GAAG,QAAQ,KAAK,kCAAkC,CAAC;IAC7E,MAAM,gBAAgB,GACrB,QAAQ,KAAK,sBAAsB,IAAI,UAAU,EAAE,eAAe,KAAK,IAAI,CAAC;IAC7E,MAAM,YAAY,GACjB,QAAQ,KAAK,qBAAqB,IAAI,UAAU,EAAE,cAAc,KAAK,WAAW,CAAC;IAClF,+EAA+E;IAC/E,kFAAkF;IAClF,gFAAgF;IAChF,qEAAqE;IACrE,uEAAuE;IACvE,MAAM,eAAe,GACpB,QAAQ,KAAK,iBAAiB;QAC9B,UAAU,EAAE,cAAc,KAAK,WAAW;QAC1C,OAAO,CAAC,sBAAsB,KAAK,IAAI,CAAC;IACzC,oFAAoF;IACpF,sFAAsF;IACtF,mFAAmF;IACnF,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,aAAa,GAClB,QAAQ,KAAK,sBAAsB;QACnC,UAAU,EAAE,cAAc,KAAK,aAAa;QAC5C,OAAO,CAAC,mBAAmB,KAAK,IAAI,CAAC;IACtC,IACC,oBAAoB;QACpB,gBAAgB;QAChB,YAAY;QACZ,aAAa;QACb,eAAe,EACd,CAAC;QACF,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IAED,2DAA2D;IAC3D,IAAI,yBAAyB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;IACvE,CAAC;IAED,qFAAqF;IACrF,IAAI,2BAA2B,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;IACvE,CAAC;IAED,OAAO,WAAW,CAAC;AACpB,CAAC"}