n8n 1.56.2 → 1.58.0

package/dist/security-audit/risk-reporters/nodes-risk-reporter.js

@@ -0,0 +1,138 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodesRiskReporter = void 0;
+const path = __importStar(require("path"));
+const fast_glob_1 = __importDefault(require("fast-glob"));
+const typedi_1 = require("typedi");
+const load_nodes_and_credentials_1 = require("../../load-nodes-and-credentials");
+const utils_1 = require("../../security-audit/utils");
+const constants_1 = require("../../security-audit/constants");
+const community_packages_service_1 = require("../../services/community-packages.service");
+const config_1 = require("@n8n/config");
+let NodesRiskReporter = class NodesRiskReporter {
+    constructor(loadNodesAndCredentials, communityPackagesService, globalConfig) {
+        this.loadNodesAndCredentials = loadNodesAndCredentials;
+        this.communityPackagesService = communityPackagesService;
+        this.globalConfig = globalConfig;
+    }
+    async report(workflows) {
+        const officialRiskyNodes = (0, utils_1.getNodeTypes)(workflows, (node) => constants_1.OFFICIAL_RISKY_NODE_TYPES.has(node.type));
+        const [communityNodes, customNodes] = await Promise.all([
+            this.getCommunityNodeDetails(),
+            this.getCustomNodeDetails(),
+        ]);
+        const issues = [officialRiskyNodes, communityNodes, customNodes];
+        if (issues.every((i) => i.length === 0))
+            return null;
+        const report = {
+            risk: constants_1.NODES_REPORT.RISK,
+            sections: [],
+        };
+        const sentenceStart = (length) => (length > 1 ? 'These nodes are' : 'This node is');
+        if (officialRiskyNodes.length > 0) {
+            report.sections.push({
+                title: constants_1.NODES_REPORT.SECTIONS.OFFICIAL_RISKY_NODES,
+                description: [
+                    sentenceStart(officialRiskyNodes.length),
+                    "part of n8n's official nodes and may be used to fetch and run any arbitrary code in the host system. This may lead to exploits such as remote code execution.",
+                ].join(' '),
+                recommendation: `Consider reviewing the parameters in these nodes, replacing them with app nodes where possible, and not loading unneeded node types with the NODES_EXCLUDE environment variable. See: ${constants_1.ENV_VARS_DOCS_URL}`,
+                location: officialRiskyNodes,
+            });
+        }
+        if (communityNodes.length > 0) {
+            report.sections.push({
+                title: constants_1.NODES_REPORT.SECTIONS.COMMUNITY_NODES,
+                description: [
+                    sentenceStart(communityNodes.length),
+                    `sourced from the n8n community. Community nodes are not vetted by the n8n team and have full access to the host system. See: ${constants_1.COMMUNITY_NODES_RISKS_URL}`,
+                ].join(' '),
+                recommendation: 'Consider reviewing the source code in any community nodes installed in this n8n instance, and uninstalling any community nodes no longer in use.',
+                location: communityNodes,
+            });
+        }
+        if (customNodes.length > 0) {
+            report.sections.push({
+                title: constants_1.NODES_REPORT.SECTIONS.CUSTOM_NODES,
+                description: [
+                    sentenceStart(communityNodes.length),
+                    'unpublished and located in the host system. Custom nodes are not vetted by the n8n team and have full access to the host system.',
+                ].join(' '),
+                recommendation: 'Consider reviewing the source code in any custom node installed in this n8n instance, and removing any custom nodes no longer in use.',
+                location: customNodes,
+            });
+        }
+        return report;
+    }
+    async getCommunityNodeDetails() {
+        if (!this.globalConfig.nodes.communityPackages.enabled)
+            return [];
+        const installedPackages = await this.communityPackagesService.getAllInstalledPackages();
+        return installedPackages.reduce((acc, pkg) => {
+            pkg.installedNodes.forEach((node) => acc.push({
+                kind: 'community',
+                nodeType: node.type,
+                packageUrl: [constants_1.NPM_PACKAGE_URL, pkg.packageName].join('/'),
+            }));
+            return acc;
+        }, []);
+    }
+    async getCustomNodeDetails() {
+        const customNodeTypes = [];
+        for (const customDir of this.loadNodesAndCredentials.getCustomDirectories()) {
+            const customNodeFiles = await (0, fast_glob_1.default)('**/*.node.js', { cwd: customDir, absolute: true });
+            for (const nodeFile of customNodeFiles) {
+                const [fileName] = path.parse(nodeFile).name.split('.');
+                customNodeTypes.push({
+                    kind: 'custom',
+                    nodeType: ['CUSTOM', fileName].join('.'),
+                    filePath: nodeFile,
+                });
+            }
+        }
+        return customNodeTypes;
+    }
+};
+exports.NodesRiskReporter = NodesRiskReporter;
+exports.NodesRiskReporter = NodesRiskReporter = __decorate([
+    (0, typedi_1.Service)(),
+    __metadata("design:paramtypes", [load_nodes_and_credentials_1.LoadNodesAndCredentials,
+        community_packages_service_1.CommunityPackagesService,
+        config_1.GlobalConfig])
+], NodesRiskReporter);
+//# sourceMappingURL=nodes-risk-reporter.js.map

package/dist/security-audit/risk-reporters/nodes-risk-reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodes-risk-reporter.js","sourceRoot":"","sources":["../../../src/security-audit/risk-reporters/nodes-risk-reporter.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAC7B,0DAA6B;AAC7B,mCAAiC;AACjC,6EAAuE;AACvE,kDAAsD;AACtD,0DAMoC;AAGpC,sFAAiF;AACjF,wCAA2C;AAGpC,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC7B,YACkB,uBAAgD,EAChD,wBAAkD,EAClD,YAA0B;QAF1B,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,iBAAY,GAAZ,YAAY,CAAc;IACzC,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,SAA2B;QACvC,MAAM,kBAAkB,GAAG,IAAA,oBAAY,EAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3D,qCAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CACxC,CAAC;QAEF,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvD,IAAI,CAAC,uBAAuB,EAAE;YAC9B,IAAI,CAAC,oBAAoB,EAAE;SAC3B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,CAAC,kBAAkB,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;QAEjE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAErD,MAAM,MAAM,GAAwB;YACnC,IAAI,EAAE,wBAAY,CAAC,IAAI;YACvB,QAAQ,EAAE,EAAE;SACZ,CAAC;QAEF,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QAE5F,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,wBAAY,CAAC,QAAQ,CAAC,oBAAoB;gBACjD,WAAW,EAAE;oBACZ,aAAa,CAAC,kBAAkB,CAAC,MAAM,CAAC;oBACxC,+JAA+J;iBAC/J,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,cAAc,EAAE,yLAAyL,6BAAiB,EAAE;gBAC5N,QAAQ,EAAE,kBAAkB;aAC5B,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,wBAAY,CAAC,QAAQ,CAAC,eAAe;gBAC5C,WAAW,EAAE;oBACZ,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC;oBACpC,gIAAgI,qCAAyB,EAAE;iBAC3J,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,cAAc,EACb,kJAAkJ;gBACnJ,QAAQ,EAAE,cAAc;aACxB,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,wBAAY,CAAC,QAAQ,CAAC,YAAY;gBACzC,WAAW,EAAE;oBACZ,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC;oBACpC,kIAAkI;iBAClI,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,cAAc,EACb,uIAAuI;gBACxI,QAAQ,EAAE,WAAW;aACrB,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,uBAAuB;QACpC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QAElE,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,EAAE,CAAC;QAExF,OAAO,iBAAiB,CAAC,MAAM,CAA8B,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACzE,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACnC,GAAG,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,UAAU,EAAE,CAAC,2BAAe,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aACxD,CAAC,CACF,CAAC;YAEF,OAAO,GAAG,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;IACR,CAAC;IAEO,KAAK,CAAC,oBAAoB;QACjC,MAAM,eAAe,GAA6B,EAAE,CAAC;QAErD,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,uBAAuB,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC7E,MAAM,eAAe,GAAG,MAAM,IAAA,mBAAI,EAAC,cAAc,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAEvF,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;gBACxC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACxD,eAAe,CAAC,IAAI,CAAC;oBACpB,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;oBACxC,QAAQ,EAAE,QAAQ;iBAClB,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAED,OAAO,eAAe,CAAC;IACxB,CAAC;CACD,CAAA;AAzGY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,gBAAO,GAAE;qCAGkC,oDAAuB;QACtB,qDAAwB;QACpC,qBAAY;GAJhC,iBAAiB,CAyG7B"}

package/dist/security-audit/security-audit.service.js

@@ -0,0 +1,93 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityAuditService = void 0;
+const typedi_1 = __importStar(require("typedi"));
+const config_1 = __importDefault(require("../config"));
+const workflow_repository_1 = require("../databases/repositories/workflow.repository");
+const constants_1 = require("../security-audit/constants");
+const utils_1 = require("../security-audit/utils");
+let SecurityAuditService = class SecurityAuditService {
+    constructor(workflowRepository) {
+        this.workflowRepository = workflowRepository;
+        this.reporters = {};
+    }
+    async run(categories = constants_1.RISK_CATEGORIES, daysAbandonedWorkflow) {
+        if (categories.length === 0)
+            categories = constants_1.RISK_CATEGORIES;
+        await this.initReporters(categories);
+        const daysFromEnv = config_1.default.getEnv('security.audit.daysAbandonedWorkflow');
+        if (daysAbandonedWorkflow) {
+            config_1.default.set('security.audit.daysAbandonedWorkflow', daysAbandonedWorkflow);
+        }
+        const workflows = await this.workflowRepository.find({
+            select: ['id', 'name', 'active', 'nodes', 'connections'],
+        });
+        const promises = categories.map(async (c) => await this.reporters[c].report(workflows));
+        const reports = (await Promise.all(promises)).filter((r) => r !== null);
+        if (daysAbandonedWorkflow) {
+            config_1.default.set('security.audit.daysAbandonedWorkflow', daysFromEnv);
+        }
+        if (reports.length === 0)
+            return [];
+        return reports.reduce((acc, cur) => {
+            acc[(0, utils_1.toReportTitle)(cur.risk)] = cur;
+            return acc;
+        }, {});
+    }
+    async initReporters(categories) {
+        for (const category of categories) {
+            const className = category.charAt(0).toUpperCase() + category.slice(1) + 'RiskReporter';
+            const toFilename = {
+                CredentialsRiskReporter: 'credentials-risk-reporter',
+                DatabaseRiskReporter: 'database-risk-reporter',
+                FilesystemRiskReporter: 'filesystem-risk-reporter',
+                InstanceRiskReporter: 'instance-risk-reporter',
+                NodesRiskReporter: 'nodes-risk-reporter',
+            };
+            const RiskReporterModule = await Promise.resolve(`${`./risk-reporters/${toFilename[className]}`}`).then(s => __importStar(require(s)));
+            const RiskReporterClass = RiskReporterModule[className];
+            this.reporters[category] = typedi_1.default.get(RiskReporterClass);
+        }
+    }
+};
+exports.SecurityAuditService = SecurityAuditService;
+exports.SecurityAuditService = SecurityAuditService = __decorate([
+    (0, typedi_1.Service)(),
+    __metadata("design:paramtypes", [workflow_repository_1.WorkflowRepository])
+], SecurityAuditService);
+//# sourceMappingURL=security-audit.service.js.map

package/dist/security-audit/security-audit.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-audit.service.js","sourceRoot":"","sources":["../../src/security-audit/security-audit.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iDAA4C;AAE5C,sDAA8B;AAC9B,sFAAkF;AAElF,0DAA6D;AAC7D,kDAAuD;AAIhD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAChC,YAA6B,kBAAsC;QAAtC,uBAAkB,GAAlB,kBAAkB,CAAoB;QAE3D,cAAS,GAEb,EAAE,CAAC;IAJ+D,CAAC;IAMvE,KAAK,CAAC,GAAG,CAAC,aAA8B,2BAAe,EAAE,qBAA8B;QACtF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,UAAU,GAAG,2BAAe,CAAC;QAE1D,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAErC,MAAM,WAAW,GAAG,gBAAM,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;QAE1E,IAAI,qBAAqB,EAAE,CAAC;YAC3B,gBAAM,CAAC,GAAG,CAAC,sCAAsC,EAAE,qBAAqB,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;YACpD,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC;SACxD,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAExF,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAE1F,IAAI,qBAAqB,EAAE,CAAC;YAC3B,gBAAM,CAAC,GAAG,CAAC,sCAAsC,EAAE,WAAW,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEpC,OAAO,OAAO,CAAC,MAAM,CAAa,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC9C,GAAG,CAAC,IAAA,qBAAa,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;YAEnC,OAAO,GAAG,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;IACR,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,UAA2B;QAC9C,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC;YAExF,MAAM,UAAU,GAA2B;gBAC1C,uBAAuB,EAAE,2BAA2B;gBACpD,oBAAoB,EAAE,wBAAwB;gBAC9C,sBAAsB,EAAE,0BAA0B;gBAClD,oBAAoB,EAAE,wBAAwB;gBAC9C,iBAAiB,EAAE,qBAAqB;aACxC,CAAC;YAGF,MAAM,kBAAkB,GAAG,yBAAa,oBAAoB,UAAU,CAAC,SAAS,CAAC,EAAE,uCAAC,CAAC;YAGrF,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,SAAS,CAA6B,CAAC;YAEpF,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,gBAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC7D,CAAC;IACF,CAAC;CACD,CAAA;AA5DY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,gBAAO,GAAE;qCAEwC,wCAAkB;GADvD,oBAAoB,CA4DhC"}

package/dist/security-audit/types.d.ts

@@ -1,4 +1,4 @@
-import type { WorkflowEntity as Workflow } from '../databases/entities/WorkflowEntity';
+import type { WorkflowEntity as Workflow } from '../databases/entities/workflow-entity';
 export declare namespace Risk {
     export type Category = 'database' | 'credentials' | 'nodes' | 'instance' | 'filesystem';
     type CredLocation = {

package/dist/security-audit/utils.d.ts

@@ -1,4 +1,4 @@
-import type { WorkflowEntity as Workflow } from '../databases/entities/WorkflowEntity';
+import type { WorkflowEntity as Workflow } from '../databases/entities/workflow-entity';
 import type { Risk } from '../security-audit/types';
 type Node = Workflow['nodes'][number];
 export declare const toFlaggedNode: ({ node, workflow }: {

package/dist/server.d.ts

@@ -0,0 +1,48 @@
+import { LoadNodesAndCredentials } from './load-nodes-and-credentials';
+import { AbstractServer } from './abstract-server';
+import { PostHogClient } from './posthog';
+import { OrchestrationService } from './services/orchestration.service';
+import './controllers/active-workflows.controller';
+import './controllers/annotation-tags.controller';
+import './controllers/auth.controller';
+import './controllers/binary-data.controller';
+import './controllers/curl.controller';
+import './controllers/ai-assistant.controller';
+import './controllers/dynamic-node-parameters.controller';
+import './controllers/invitation.controller';
+import './controllers/me.controller';
+import './controllers/node-types.controller';
+import './controllers/oauth/oauth1-credential.controller';
+import './controllers/oauth/oauth2-credential.controller';
+import './controllers/orchestration.controller';
+import './controllers/owner.controller';
+import './controllers/password-reset.controller';
+import './controllers/project.controller';
+import './controllers/role.controller';
+import './controllers/tags.controller';
+import './controllers/translation.controller';
+import './controllers/users.controller';
+import './controllers/user-settings.controller';
+import './controllers/workflow-statistics.controller';
+import './credentials/credentials.controller';
+import './eventbus/event-bus.controller';
+import './executions/executions.controller';
+import './external-secrets/external-secrets.controller.ee';
+import './license/license.controller';
+import './workflows/workflow-history/workflow-history.controller.ee';
+import './workflows/workflows.controller';
+import { EventService } from './events/event.service';
+export declare class Server extends AbstractServer {
+    private readonly loadNodesAndCredentials;
+    private readonly orchestrationService;
+    private readonly postHogClient;
+    private readonly eventService;
+    private endpointPresetCredentials;
+    private presetCredentialsLoaded;
+    private frontendService?;
+    constructor(loadNodesAndCredentials: LoadNodesAndCredentials, orchestrationService: OrchestrationService, postHogClient: PostHogClient, eventService: EventService);
+    start(): Promise<void>;
+    private registerAdditionalControllers;
+    configure(): Promise<void>;
+    protected setupPushServer(): void;
+}

package/dist/server.js

@@ -0,0 +1,322 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Server = void 0;
+const typedi_1 = require("typedi");
+const child_process_1 = require("child_process");
+const path_1 = require("path");
+const promises_1 = require("fs/promises");
+const util_1 = require("util");
+const cookie_parser_1 = __importDefault(require("cookie-parser"));
+const express_1 = __importDefault(require("express"));
+const helmet_1 = __importDefault(require("helmet"));
+const n8n_core_1 = require("n8n-core");
+const config_1 = __importDefault(require("./config"));
+const constants_1 = require("./constants");
+const decorators_1 = require("./decorators");
+const public_api_1 = require("./public-api");
+const credentials_overwrites_1 = require("./credentials-overwrites");
+const load_nodes_and_credentials_1 = require("./load-nodes-and-credentials");
+const ResponseHelper = __importStar(require("./response-helper"));
+const push_1 = require("./push");
+const helpers_ee_1 = require("./ldap/helpers.ee");
+const abstract_server_1 = require("./abstract-server");
+const posthog_1 = require("./posthog");
+const message_event_bus_1 = require("./eventbus/message-event-bus/message-event-bus");
+const helpers_1 = require("./mfa/helpers");
+const orchestration_service_1 = require("./services/orchestration.service");
+const log_streaming_event_relay_1 = require("./events/log-streaming-event-relay");
+require("./controllers/active-workflows.controller");
+require("./controllers/annotation-tags.controller");
+require("./controllers/auth.controller");
+require("./controllers/binary-data.controller");
+require("./controllers/curl.controller");
+require("./controllers/ai-assistant.controller");
+require("./controllers/dynamic-node-parameters.controller");
+require("./controllers/invitation.controller");
+require("./controllers/me.controller");
+require("./controllers/node-types.controller");
+require("./controllers/oauth/oauth1-credential.controller");
+require("./controllers/oauth/oauth2-credential.controller");
+require("./controllers/orchestration.controller");
+require("./controllers/owner.controller");
+require("./controllers/password-reset.controller");
+require("./controllers/project.controller");
+require("./controllers/role.controller");
+require("./controllers/tags.controller");
+require("./controllers/translation.controller");
+require("./controllers/users.controller");
+require("./controllers/user-settings.controller");
+require("./controllers/workflow-statistics.controller");
+require("./credentials/credentials.controller");
+require("./eventbus/event-bus.controller");
+require("./executions/executions.controller");
+require("./external-secrets/external-secrets.controller.ee");
+require("./license/license.controller");
+require("./workflows/workflow-history/workflow-history.controller.ee");
+require("./workflows/workflows.controller");
+const event_service_1 = require("./events/event.service");
+const exec = (0, util_1.promisify)(child_process_1.exec);
+let Server = class Server extends abstract_server_1.AbstractServer {
+    constructor(loadNodesAndCredentials, orchestrationService, postHogClient, eventService) {
+        super('main');
+        this.loadNodesAndCredentials = loadNodesAndCredentials;
+        this.orchestrationService = orchestrationService;
+        this.postHogClient = postHogClient;
+        this.eventService = eventService;
+        this.testWebhooksEnabled = true;
+        this.webhooksEnabled = !this.globalConfig.endpoints.disableProductionWebhooksOnMainProcess;
+    }
+    async start() {
+        if (!this.globalConfig.endpoints.disableUi) {
+            const { FrontendService } = await Promise.resolve().then(() => __importStar(require('./services/frontend.service')));
+            this.frontendService = typedi_1.Container.get(FrontendService);
+        }
+        this.presetCredentialsLoaded = false;
+        this.endpointPresetCredentials = this.globalConfig.credentials.overwrite.endpoint;
+        await super.start();
+        this.logger.debug(`Server ID: ${this.uniqueInstanceId}`);
+        if (constants_1.inDevelopment && process.env.N8N_DEV_RELOAD === 'true') {
+            void this.loadNodesAndCredentials.setupHotReload();
+        }
+        this.eventService.emit('server-started');
+    }
+    async registerAdditionalControllers() {
+        if (!constants_1.inProduction && this.orchestrationService.isMultiMainSetupEnabled) {
+            await Promise.resolve().then(() => __importStar(require('./controllers/debug.controller')));
+        }
+        if ((0, helpers_ee_1.isLdapEnabled)()) {
+            const { LdapService } = await Promise.resolve().then(() => __importStar(require('./ldap/ldap.service.ee')));
+            await Promise.resolve().then(() => __importStar(require('./ldap/ldap.controller.ee')));
+            await typedi_1.Container.get(LdapService).init();
+        }
+        if (this.globalConfig.nodes.communityPackages.enabled) {
+            await Promise.resolve().then(() => __importStar(require('./controllers/community-packages.controller')));
+        }
+        if (constants_1.inE2ETests) {
+            await Promise.resolve().then(() => __importStar(require('./controllers/e2e.controller')));
+        }
+        if ((0, helpers_1.isMfaFeatureEnabled)()) {
+            await Promise.resolve().then(() => __importStar(require('./controllers/mfa.controller')));
+        }
+        if (!this.globalConfig.endpoints.disableUi) {
+            await Promise.resolve().then(() => __importStar(require('./controllers/cta.controller')));
+        }
+        try {
+            const { SamlService } = await Promise.resolve().then(() => __importStar(require('./sso/saml/saml.service.ee')));
+            await typedi_1.Container.get(SamlService).init();
+            await Promise.resolve().then(() => __importStar(require('./sso/saml/routes/saml.controller.ee')));
+        }
+        catch (error) {
+            this.logger.warn(`SAML initialization failed: ${error.message}`);
+        }
+        try {
+            const { SourceControlService } = await Promise.resolve().then(() => __importStar(require('./environments/source-control/source-control.service.ee')));
+            await typedi_1.Container.get(SourceControlService).init();
+            await Promise.resolve().then(() => __importStar(require('./environments/source-control/source-control.controller.ee')));
+            await Promise.resolve().then(() => __importStar(require('./environments/variables/variables.controller.ee')));
+        }
+        catch (error) {
+            this.logger.warn(`Source Control initialization failed: ${error.message}`);
+        }
+    }
+    async configure() {
+        if (this.globalConfig.endpoints.metrics.enable) {
+            const { PrometheusMetricsService } = await Promise.resolve().then(() => __importStar(require('./metrics/prometheus-metrics.service')));
+            await typedi_1.Container.get(PrometheusMetricsService).init(this.app);
+        }
+        const { frontendService } = this;
+        if (frontendService) {
+            frontendService.addToSettings({
+                isNpmAvailable: await exec('npm --version')
+                    .then(() => true)
+                    .catch(() => false),
+                versionCli: constants_1.N8N_VERSION,
+            });
+            await this.externalHooks.run('frontend.settings', [frontendService.getSettings()]);
+        }
+        await this.postHogClient.init();
+        const publicApiEndpoint = this.globalConfig.publicApi.path;
+        if ((0, public_api_1.isApiEnabled)()) {
+            const { apiRouters, apiLatestVersion } = await (0, public_api_1.loadPublicApiVersions)(publicApiEndpoint);
+            this.app.use(...apiRouters);
+            if (frontendService) {
+                frontendService.settings.publicApi.latestVersion = apiLatestVersion;
+            }
+        }
+        this.app.use((req, _, next) => {
+            req.browserId = req.headers['browser-id'];
+            next();
+        });
+        this.app.use((0, cookie_parser_1.default)());
+        const { restEndpoint, app } = this;
+        (0, push_1.setupPushHandler)(restEndpoint, app);
+        const push = typedi_1.Container.get(push_1.Push);
+        if (push.isBidirectional) {
+            const { CollaborationService } = await Promise.resolve().then(() => __importStar(require('./collaboration/collaboration.service')));
+            const collaborationService = typedi_1.Container.get(CollaborationService);
+            collaborationService.init();
+        }
+        else {
+            this.logger.warn('Collaboration features are disabled because push is configured unidirectional. Use N8N_PUSH_BACKEND=websocket environment variable to enable them.');
+        }
+        if (config_1.default.getEnv('executions.mode') === 'queue') {
+            const { ScalingService } = await Promise.resolve().then(() => __importStar(require('./scaling/scaling.service')));
+            await typedi_1.Container.get(ScalingService).setupQueue();
+        }
+        await (0, helpers_1.handleMfaDisable)();
+        await this.registerAdditionalControllers();
+        typedi_1.Container.get(decorators_1.ControllerRegistry).activate(app);
+        const tzDataFile = (0, path_1.resolve)(constants_1.CLI_DIR, 'dist/timezones.json');
+        this.app.get(`/${this.restEndpoint}/options/timezones`, (_, res) => res.sendFile(tzDataFile));
+        if (frontendService) {
+            this.app.get(`/${this.restEndpoint}/settings`, ResponseHelper.send(async (req) => frontendService.getSettings(req.headers['push-ref'])));
+        }
+        const eventBus = typedi_1.Container.get(message_event_bus_1.MessageEventBus);
+        await eventBus.initialize();
+        typedi_1.Container.get(log_streaming_event_relay_1.LogStreamingEventRelay).init();
+        if (this.endpointPresetCredentials !== '') {
+            this.app.post(`/${this.endpointPresetCredentials}`, async (req, res) => {
+                if (!this.presetCredentialsLoaded) {
+                    const body = req.body;
+                    if (req.contentType !== 'application/json') {
+                        ResponseHelper.sendErrorResponse(res, new Error('Body must be a valid JSON, make sure the content-type is application/json'));
+                        return;
+                    }
+                    typedi_1.Container.get(credentials_overwrites_1.CredentialsOverwrites).setData(body);
+                    await frontendService?.generateTypes();
+                    this.presetCredentialsLoaded = true;
+                    ResponseHelper.sendSuccessResponse(res, { success: true }, true, 200);
+                }
+                else {
+                    ResponseHelper.sendErrorResponse(res, new Error('Preset credentials can be set once'));
+                }
+            });
+        }
+        const maxAge = constants_1.Time.days.toMilliseconds;
+        const cacheOptions = constants_1.inE2ETests || constants_1.inDevelopment ? {} : { maxAge };
+        const { staticCacheDir } = typedi_1.Container.get(n8n_core_1.InstanceSettings);
+        if (frontendService) {
+            const serveIcons = async (req, res) => {
+                let { scope, packageName } = req.params;
+                if (scope)
+                    packageName = `@${scope}/${packageName}`;
+                const filePath = this.loadNodesAndCredentials.resolveIcon(packageName, req.originalUrl);
+                if (filePath) {
+                    try {
+                        await (0, promises_1.access)(filePath);
+                        return res.sendFile(filePath, cacheOptions);
+                    }
+                    catch { }
+                }
+                res.sendStatus(404);
+            };
+            this.app.use('/icons/@:scope/:packageName/*/*.(svg|png)', serveIcons);
+            this.app.use('/icons/:packageName/*/*.(svg|png)', serveIcons);
+            const isTLSEnabled = this.globalConfig.protocol === 'https' && !!(this.sslKey && this.sslCert);
+            const isPreviewMode = process.env.N8N_PREVIEW_MODE === 'true';
+            const securityHeadersMiddleware = (0, helmet_1.default)({
+                contentSecurityPolicy: false,
+                xFrameOptions: isPreviewMode || constants_1.inE2ETests || constants_1.inDevelopment ? false : { action: 'sameorigin' },
+                dnsPrefetchControl: false,
+                ieNoOpen: false,
+                xPoweredBy: false,
+                strictTransportSecurity: isTLSEnabled
+                    ? {
+                        maxAge: 180 * constants_1.Time.days.toSeconds,
+                        includeSubDomains: false,
+                        preload: false,
+                    }
+                    : false,
+            });
+            const nonUIRoutes = [
+                'favicon.ico',
+                'assets',
+                'static',
+                'types',
+                'healthz',
+                'metrics',
+                'e2e',
+                this.restEndpoint,
+                this.endpointPresetCredentials,
+                (0, public_api_1.isApiEnabled)() ? '' : publicApiEndpoint,
+                ...this.globalConfig.endpoints.additionalNonUIRoutes.split(':'),
+            ].filter((u) => !!u);
+            const nonUIRoutesRegex = new RegExp(`^/(${nonUIRoutes.join('|')})/?.*$`);
+            const historyApiHandler = (req, res, next) => {
+                const { method, headers: { accept }, } = req;
+                if (method === 'GET' &&
+                    accept &&
+                    (accept.includes('text/html') || accept.includes('*/*')) &&
+                    !nonUIRoutesRegex.test(req.path)) {
+                    res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
+                    securityHeadersMiddleware(req, res, () => {
+                        res.sendFile('index.html', { root: staticCacheDir, maxAge, lastModified: true });
+                    });
+                }
+                else {
+                    next();
+                }
+            };
+            const setCustomCacheHeader = (res) => {
+                if (/^\/types\/(nodes|credentials).json$/.test(res.req.url)) {
+                    res.setHeader('Cache-Control', 'no-cache, must-revalidate');
+                }
+            };
+            this.app.use('/', historyApiHandler, express_1.default.static(staticCacheDir, {
+                ...cacheOptions,
+                setHeaders: setCustomCacheHeader,
+            }), express_1.default.static(constants_1.EDITOR_UI_DIST_DIR, cacheOptions));
+        }
+        else {
+            this.app.use('/', express_1.default.static(staticCacheDir, cacheOptions));
+        }
+    }
+    setupPushServer() {
+        const { restEndpoint, server, app } = this;
+        (0, push_1.setupPushServer)(restEndpoint, server, app);
+    }
+};
+exports.Server = Server;
+exports.Server = Server = __decorate([
+    (0, typedi_1.Service)(),
+    __metadata("design:paramtypes", [load_nodes_and_credentials_1.LoadNodesAndCredentials,
+        orchestration_service_1.OrchestrationService,
+        posthog_1.PostHogClient,
+        event_service_1.EventService])
+], Server);
+//# sourceMappingURL=server.js.map