n8n-workflow 2.36.2 → 2.37.0

package/dist/esm/trigger-identity.js

@@ -20,7 +20,7 @@ function hasContextEstablishmentHook(parameters) {
  * manual/parent inheritance) and the resolvers' identifiers (e.g. `N8NIdentifier`):
  * when a new trigger or identity source is added there, reflect it here too.
  */
-export function classifyTriggerIdentity(nodeType, parameters, options = {}) {
+export function classifyTriggerIdentity(nodeType, parameters) {
     // Sub-workflows inherit identity from the parent; Chat Hub and MCP-over-n8nOAuth2
     // inject it. All provide both identity families.
     const isSubWorkflowTrigger = nodeType === EXECUTE_WORKFLOW_TRIGGER_NODE_TYPE;
@@ -29,14 +29,9 @@ export function classifyTriggerIdentity(nodeType, parameters, options = {}) {
     // The Webhook node's "n8n User Auth (OAuth2)" mode injects the caller's n8n
     // identity the same way the MCP trigger does — sharing the `n8nOAuth2` value.
     const isOAuth2Webhook = nodeType === WEBHOOK_NODE_TYPE && parameters?.authentication === 'n8nOAuth2';
-    // The form trigger only establishes an identity through its OAuth2 flow, so callers
-    // must opt the branch in with the instance's `isFormOAuth2Enabled`. Omitting it fails
-    // closed: without the flag a `n8nUserAuth` form takes the legacy cookie/HMAC path,
-    // which authenticates the submitter but establishes no identity to resolve
-    // credentials with — publish must reject that instead of failing mid-execution.
-    const isFormTrigger = nodeType === FORM_TRIGGER_NODE_TYPE &&
-        parameters?.authentication === 'n8nUserAuth' &&
-        options.isFormOAuth2Enabled === true;
+    // The form trigger establishes the submitter's identity through its OAuth2 flow,
+    // which is what `n8nUserAuth` (typeVersion >= 2.6) now always runs on.
+    const isFormTrigger = nodeType === FORM_TRIGGER_NODE_TYPE && parameters?.authentication === 'n8nUserAuth';
     if (isSubWorkflowTrigger ||
         isChatHubTrigger ||
         isMcpTrigger ||
@@ -44,7 +39,9 @@ export function classifyTriggerIdentity(nodeType, parameters, options = {}) {
         isOAuth2Webhook) {
         return { providesN8nIdentity: true, providesExternalIdentity: true };
     }
-    // Manual/chat/MCP triggers run with the n8n user identity.
+    // Manual triggers run with the executing n8n user's identity (attached from the
+    // session by the manual-run endpoint). Chat and MCP triggers must NOT match here:
+    // outside the branches above they establish no identity at runtime.
     if (MANUAL_TRIGGER_NODE_TYPES.includes(nodeType)) {
         return { providesN8nIdentity: true, providesExternalIdentity: false };
     }

package/dist/esm/trigger-identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"trigger-identity.js","sourceRoot":"","sources":["../../src/trigger-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,sBAAsB,EACtB,kCAAkC,EAClC,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,4CAA4C,EAAE,MAAM,yCAAyC,CAAC;AAgBvG,MAAM,WAAW,GAAgC;IAChD,mBAAmB,EAAE,KAAK;IAC1B,wBAAwB,EAAE,KAAK;CAC/B,CAAC;AAcF,sFAAsF;AACtF,SAAS,2BAA2B,CAAC,UAAuC;IAC3E,MAAM,UAAU,GAAG,4CAA4C,CAAC,UAAU,CAAC,CAAC;IAC5E,OAAO,CACN,UAAU,KAAK,IAAI;QACnB,UAAU,CAAC,OAAO;QAClB,UAAU,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAC1D,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACtC,QAAgB,EAChB,UAAuC,EACvC,OAAO,GAA2B,EAAE;IAEpC,kFAAkF;IAClF,iDAAiD;IACjD,MAAM,oBAAoB,GAAG,QAAQ,KAAK,kCAAkC,CAAC;IAC7E,MAAM,gBAAgB,GACrB,QAAQ,KAAK,sBAAsB,IAAI,UAAU,EAAE,eAAe,KAAK,IAAI,CAAC;IAC7E,MAAM,YAAY,GACjB,QAAQ,KAAK,qBAAqB,IAAI,UAAU,EAAE,cAAc,KAAK,WAAW,CAAC;IAClF,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,eAAe,GACpB,QAAQ,KAAK,iBAAiB,IAAI,UAAU,EAAE,cAAc,KAAK,WAAW,CAAC;IAC9E,oFAAoF;IACpF,sFAAsF;IACtF,mFAAmF;IACnF,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,aAAa,GAClB,QAAQ,KAAK,sBAAsB;QACnC,UAAU,EAAE,cAAc,KAAK,aAAa;QAC5C,OAAO,CAAC,mBAAmB,KAAK,IAAI,CAAC;IACtC,IACC,oBAAoB;QACpB,gBAAgB;QAChB,YAAY;QACZ,aAAa;QACb,eAAe,EACd,CAAC;QACF,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IAED,2DAA2D;IAC3D,IAAI,yBAAyB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;IACvE,CAAC;IAED,qFAAqF;IACrF,IAAI,2BAA2B,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;IACvE,CAAC;IAED,OAAO,WAAW,CAAC;AACpB,CAAC"}
+{"version":3,"file":"trigger-identity.js","sourceRoot":"","sources":["../../src/trigger-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,sBAAsB,EACtB,kCAAkC,EAClC,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,4CAA4C,EAAE,MAAM,yCAAyC,CAAC;AAgBvG,MAAM,WAAW,GAAgC;IAChD,mBAAmB,EAAE,KAAK;IAC1B,wBAAwB,EAAE,KAAK;CAC/B,CAAC;AAEF,sFAAsF;AACtF,SAAS,2BAA2B,CAAC,UAAuC;IAC3E,MAAM,UAAU,GAAG,4CAA4C,CAAC,UAAU,CAAC,CAAC;IAC5E,OAAO,CACN,UAAU,KAAK,IAAI;QACnB,UAAU,CAAC,OAAO;QAClB,UAAU,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAC1D,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACtC,QAAgB,EAChB,UAAuC;IAEvC,kFAAkF;IAClF,iDAAiD;IACjD,MAAM,oBAAoB,GAAG,QAAQ,KAAK,kCAAkC,CAAC;IAC7E,MAAM,gBAAgB,GACrB,QAAQ,KAAK,sBAAsB,IAAI,UAAU,EAAE,eAAe,KAAK,IAAI,CAAC;IAC7E,MAAM,YAAY,GACjB,QAAQ,KAAK,qBAAqB,IAAI,UAAU,EAAE,cAAc,KAAK,WAAW,CAAC;IAClF,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,eAAe,GACpB,QAAQ,KAAK,iBAAiB,IAAI,UAAU,EAAE,cAAc,KAAK,WAAW,CAAC;IAC9E,iFAAiF;IACjF,uEAAuE;IACvE,MAAM,aAAa,GAClB,QAAQ,KAAK,sBAAsB,IAAI,UAAU,EAAE,cAAc,KAAK,aAAa,CAAC;IACrF,IACC,oBAAoB;QACpB,gBAAgB;QAChB,YAAY;QACZ,aAAa;QACb,eAAe,EACd,CAAC;QACF,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IAED,gFAAgF;IAChF,kFAAkF;IAClF,oEAAoE;IACpE,IAAI,yBAAyB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;IACvE,CAAC;IAED,qFAAqF;IACrF,IAAI,2BAA2B,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;IACvE,CAAC;IAED,OAAO,WAAW,CAAC;AACpB,CAAC"}