n8n 2.1.1 → 2.2.0

package/dist/modules/dynamic-credentials.ee/workflow-status.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-status.controller.js","sourceRoot":"","sources":["../../../src/modules/dynamic-credentials.ee/workflow-status.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gDAAsD;AAGtD,kFAA6E;AAC7E,0GAAoG;AAEpG,0FAAsF;AAEtF,MAAM,kBAAkB,GAAG,mCAAmC,CAAC;AAGxD,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACpC,YACkB,iCAAoE;QAApE,sCAAiC,GAAjC,iCAAiC,CAAmC;IACnF,CAAC;IAYE,AAAN,KAAK,CAAC,yBAAyB,CAAC,GAAY,EAAE,IAAc;QAC3D,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;QAE7D,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,MAAM,IAAI,4CAAoB,EAAE,CAAC;QAClC,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAExC,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,mCAAe,CAAC,mCAAmC,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,IAAI,mCAAe,CAAC,wBAAwB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAAC,iBAAiB,CAC5E,UAAU,EACV,KAAK,CACL,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC;QAE/D,MAAM,eAAe,GAA4B;YAChD,UAAU;YACV,cAAc,EAAE,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/B,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM;gBAC1B,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,YAAY,yBAAyB,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE;aAC3G,CAAC,CAAC;SACH,CAAC;QACF,OAAO,eAAe,CAAC;IACxB,CAAC;CACD,CAAA;AArDY,4DAAwB;AAe9B;IADL,IAAA,gBAAG,EAAC,+BAA+B,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;;;yEAsCxD;mCApDW,wBAAwB;IADpC,IAAA,2BAAc,EAAC,YAAY,CAAC;qCAGyB,wEAAiC;GAF1E,wBAAwB,CAqDpC"}
+{"version":3,"file":"workflow-status.controller.js","sourceRoot":"","sources":["../../../src/modules/dynamic-credentials.ee/workflow-status.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gDAAsD;AAGtD,kFAA6E;AAC7E,0GAAoG;AAEpG,mCAAyC;AACzC,wDAAoD;AACpD,wCAA2C;AAGpC,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACpC,YACkB,iCAAoE,EACpE,UAAsB,EACtB,YAA0B;QAF1B,sCAAiC,GAAjC,iCAAiC,CAAmC;QACpE,eAAU,GAAV,UAAU,CAAY;QACtB,iBAAY,GAAZ,YAAY,CAAc;IACzC,CAAC;IAYE,AAAN,KAAK,CAAC,yBAAyB,CAAC,GAAY,EAAE,IAAc;QAC3D,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAA,sBAAc,EAAC,GAAG,CAAC,CAAC;QAElC,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,IAAI,mCAAe,CAAC,wBAAwB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAAC,iBAAiB,CAC5E,UAAU,EACV,KAAK,CACL,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC;QAE/D,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC;QAElD,MAAM,eAAe,GAA4B;YAChD,UAAU;YACV,cAAc,EAAE,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/B,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM;gBAC1B,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,gBAAgB,EAAE,GAAG,QAAQ,IAAI,QAAQ,gBAAgB,CAAC,CAAC,YAAY,yBAAyB,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE;aAClI,CAAC,CAAC;SACH,CAAC;QACF,OAAO,eAAe,CAAC;IACxB,CAAC;CACD,CAAA;AAhDY,4DAAwB;AAiB9B;IADL,IAAA,gBAAG,EAAC,+BAA+B,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;;;yEA+BxD;mCA/CW,wBAAwB;IADpC,IAAA,2BAAc,EAAC,YAAY,CAAC;qCAGyB,wEAAiC;QACxD,wBAAU;QACR,qBAAY;GAJhC,wBAAwB,CAgDpC"}

package/dist/modules/external-secrets.ee/external-secrets-manager.ee.d.ts

@@ -1,45 +1,36 @@
 import { Logger } from '@n8n/backend-common';
-import { SettingsRepository } from '@n8n/db';
-import { Cipher, type IExternalSecretsManager } from 'n8n-core';
+import { type IExternalSecretsManager } from 'n8n-core';
 import { type IDataObject } from 'n8n-workflow';
-import { ExternalSecretsProviders } from './external-secrets-providers.ee';
-import { ExternalSecretsConfig } from './external-secrets.config';
-import type { ExternalSecretsSettings, SecretsProvider, SecretsProviderSettings } from './types';
 import { EventService } from '../../events/event.service';
-import { License } from '../../license';
 import { Publisher } from '../../scaling/pubsub/publisher.service';
+import { ExternalSecretsProviders } from './external-secrets-providers.ee';
+import { ExternalSecretsConfig } from './external-secrets.config';
+import { ExternalSecretsProviderLifecycle } from './provider-lifecycle.service';
+import { ExternalSecretsProviderRegistry } from './provider-registry.service';
+import { ExternalSecretsRetryManager } from './retry-manager.service';
+import { ExternalSecretsSecretsCache } from './secrets-cache.service';
+import { ExternalSecretsSettingsStore } from './settings-store.service';
+import type { SecretsProvider, SecretsProviderSettings } from './types';
 export declare class ExternalSecretsManager implements IExternalSecretsManager {
     private readonly logger;
     private readonly config;
-    private readonly settingsRepo;
-    private readonly license;
-    private readonly secretsProviders;
-    private readonly cipher;
+    private readonly providersFactory;
     private readonly eventService;
     private readonly publisher;
-    private providers;
-    private initializingPromise?;
-    private cachedSettings;
+    private readonly settingsStore;
+    private readonly providerRegistry;
+    private readonly providerLifecycle;
+    private readonly retryManager;
+    private readonly secretsCache;
     initialized: boolean;
-    updateInterval?: NodeJS.Timeout;
-    initRetryTimeouts: Record<string, NodeJS.Timeout>;
-    constructor(logger: Logger, config: ExternalSecretsConfig, settingsRepo: SettingsRepository, license: License, secretsProviders: ExternalSecretsProviders, cipher: Cipher, eventService: EventService, publisher: Publisher);
+    private refreshInterval?;
+    private initializingPromise?;
+    constructor(logger: Logger, config: ExternalSecretsConfig, providersFactory: ExternalSecretsProviders, eventService: EventService, publisher: Publisher, settingsStore: ExternalSecretsSettingsStore, providerRegistry: ExternalSecretsProviderRegistry, providerLifecycle: ExternalSecretsProviderLifecycle, retryManager: ExternalSecretsRetryManager, secretsCache: ExternalSecretsSecretsCache);
     init(): Promise<void>;
     shutdown(): void;
-    reloadAllProviders(backoff?: number): Promise<void>;
-    private broadcastReloadExternalSecretsProviders;
-    getDecryptedSettings(): Promise<ExternalSecretsSettings | null>;
-    private internalInit;
-    private initProvider;
-    private retryInitWithBackoff;
-    updateSecrets(): Promise<void>;
     getProvider(provider: string): SecretsProvider | undefined;
     hasProvider(provider: string): boolean;
     getProviderNames(): string[];
-    getSecret(provider: string, name: string): unknown;
-    hasSecret(provider: string, name: string): boolean;
-    getSecretNames(provider: string): string[];
-    getAllSecretNames(): Record<string, string[]>;
     getProvidersWithSettings(): Array<{
         provider: SecretsProvider;
         settings: SecretsProviderSettings;
@@ -48,16 +39,30 @@ export declare class ExternalSecretsManager implements IExternalSecretsManager {
         provider: SecretsProvider;
         settings: SecretsProviderSettings;
     };
-    reloadProvider(provider: string, backoff?: number): Promise<void>;
-    setProviderSettings(provider: string, data: IDataObject, userId?: string): Promise<void>;
+    updateProvider(provider: string): Promise<void>;
+    getSecret(provider: string, name: string): unknown;
+    hasSecret(provider: string, name: string): boolean;
+    getSecretNames(provider: string): string[];
+    getAllSecretNames(): Record<string, string[]>;
+    setProviderSettings(provider: string, settings: IDataObject, userId?: string): Promise<void>;
     setProviderConnected(provider: string, connected: boolean): Promise<void>;
-    private trackProviderSave;
-    private encryptSecretsSettings;
-    saveAndSetSettings(settings: ExternalSecretsSettings): Promise<void>;
     testProviderSettings(provider: string, data: IDataObject): Promise<{
         success: boolean;
-        testState: 'connected' | 'tested' | 'error';
-        error?: string;
+        testState: string;
+    } | {
+        success: boolean;
+        testState: "error" | "connected" | "tested";
+        error: string | undefined;
     }>;
-    updateProvider(provider: string): Promise<boolean>;
+    reloadAllProviders(): Promise<void>;
+    private addProvider;
+    private connectProvider;
+    private reloadProvider;
+    updateSecrets(): Promise<void>;
+    private startSecretsRefresh;
+    private stopSecretsRefresh;
+    private broadcastReload;
+    private trackProviderSave;
+    private determineTestState;
+    private getCachedSettings;
 }

package/dist/modules/external-secrets.ee/external-secrets-manager.ee.js

@@ -11,31 +11,33 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ExternalSecretsManager = void 0;
 const backend_common_1 = require("@n8n/backend-common");
-const db_1 = require("@n8n/db");
+const constants_1 = require("@n8n/constants");
 const decorators_1 = require("@n8n/decorators");
 const di_1 = require("@n8n/di");
-const n8n_core_1 = require("n8n-core");
 const n8n_workflow_1 = require("n8n-workflow");
-const constants_1 = require("./constants");
-const external_secrets_providers_ee_1 = require("./external-secrets-providers.ee");
-const external_secrets_config_1 = require("./external-secrets.config");
+const not_found_error_1 = require("../../errors/response-errors/not-found.error");
 const event_service_1 = require("../../events/event.service");
-const license_1 = require("../../license");
 const publisher_service_1 = require("../../scaling/pubsub/publisher.service");
+const external_secrets_providers_ee_1 = require("./external-secrets-providers.ee");
+const external_secrets_config_1 = require("./external-secrets.config");
+const provider_lifecycle_service_1 = require("./provider-lifecycle.service");
+const provider_registry_service_1 = require("./provider-registry.service");
+const retry_manager_service_1 = require("./retry-manager.service");
+const secrets_cache_service_1 = require("./secrets-cache.service");
+const settings_store_service_1 = require("./settings-store.service");
 let ExternalSecretsManager = class ExternalSecretsManager {
-    constructor(logger, config, settingsRepo, license, secretsProviders, cipher, eventService, publisher) {
+    constructor(logger, config, providersFactory, eventService, publisher, settingsStore, providerRegistry, providerLifecycle, retryManager, secretsCache) {
         this.logger = logger;
         this.config = config;
-        this.settingsRepo = settingsRepo;
-        this.license = license;
-        this.secretsProviders = secretsProviders;
-        this.cipher = cipher;
+        this.providersFactory = providersFactory;
         this.eventService = eventService;
         this.publisher = publisher;
-        this.providers = {};
-        this.cachedSettings = {};
+        this.settingsStore = settingsStore;
+        this.providerRegistry = providerRegistry;
+        this.providerLifecycle = providerLifecycle;
+        this.retryManager = retryManager;
+        this.secretsCache = secretsCache;
         this.initialized = false;
-        this.initRetryTimeouts = {};
         this.logger = this.logger.scoped('external-secrets');
     }
     async init() {
@@ -43,14 +45,13 @@ let ExternalSecretsManager = class ExternalSecretsManager {
             return;
         this.initializingPromise ??= (async () => {
             try {
-                await this.internalInit();
-                this.updateInterval = setInterval(async () => await this.updateSecrets(), this.config.updateInterval * 1000);
+                await this.reloadAllProviders();
+                this.startSecretsRefresh();
                 this.initialized = true;
+                this.logger.debug('External secrets manager initialized');
             }
             catch (error) {
-                this.logger.error('External secrets manager failed to initialize', {
-                    error: (0, n8n_workflow_1.ensureError)(error),
-                });
+                this.logger.error('External secrets manager failed to initialize', { error });
                 throw error;
             }
             finally {
@@ -58,217 +59,167 @@ let ExternalSecretsManager = class ExternalSecretsManager {
             }
         })();
         await this.initializingPromise;
-        this.logger.debug('External secrets manager initialized');
     }
     shutdown() {
-        if (this.updateInterval)
-            clearInterval(this.updateInterval);
-        Object.values(this.providers).forEach((p) => {
-            void p.disconnect().catch(() => { });
-        });
-        Object.values(this.initRetryTimeouts).forEach((v) => clearTimeout(v));
+        this.stopSecretsRefresh();
+        this.retryManager.cancelAll();
+        void this.providerRegistry.disconnectAll();
         this.initialized = false;
         this.logger.debug('External secrets manager shut down');
     }
-    async reloadAllProviders(backoff) {
-        this.logger.debug('Reloading all external secrets providers');
-        this.cachedSettings = (await this.getDecryptedSettings()) ?? {};
-        const newProviders = new Set(Object.keys(this.cachedSettings));
-        const existingProviders = Object.keys(this.providers);
-        for (const provider of existingProviders) {
-            if (!newProviders.has(provider)) {
-                this.logger.debug(`Removing provider ${provider} - no longer in settings`);
-                try {
-                    await this.providers[provider].disconnect();
-                }
-                catch {
-                    this.logger.warn(`Error disconnecting provider ${provider} during removal`);
-                }
-                delete this.providers[provider];
-            }
-        }
-        for (const provider of newProviders) {
-            await this.reloadProvider(provider, backoff);
-        }
-        await this.updateSecrets();
-        this.logger.debug('External secrets managed reloaded all providers');
+    getProvider(provider) {
+        return this.providerRegistry.get(provider);
     }
-    broadcastReloadExternalSecretsProviders() {
-        void this.publisher.publishCommand({ command: 'reload-external-secrets-providers' });
+    hasProvider(provider) {
+        return this.providerRegistry.has(provider);
     }
-    async getDecryptedSettings() {
-        const encryptedSettings = (await this.settingsRepo.findByKey(constants_1.EXTERNAL_SECRETS_DB_KEY))?.value ?? null;
-        if (encryptedSettings === null) {
-            return null;
-        }
-        const decryptedData = this.cipher.decrypt(encryptedSettings);
-        try {
-            return (0, n8n_workflow_1.jsonParse)(decryptedData);
-        }
-        catch (e) {
-            throw new n8n_workflow_1.UnexpectedError('External Secrets Settings could not be decrypted. The likely reason is that a different "encryptionKey" was used to encrypt the data.');
-        }
+    getProviderNames() {
+        return this.providerRegistry.getNames();
     }
-    async internalInit() {
-        const settings = await this.getDecryptedSettings();
-        if (!settings) {
-            return;
-        }
-        const providers = (await Promise.allSettled(Object.entries(settings).map(async ([name, providerSettings]) => await this.initProvider(name, providerSettings)))).map((i) => (i.status === 'rejected' ? null : i.value));
-        this.providers = Object.fromEntries(providers.filter((p) => p !== null).map((s) => [s.name, s]));
-        this.cachedSettings = settings;
-        await this.updateSecrets();
+    getProvidersWithSettings() {
+        const allProviderClasses = this.providersFactory.getAllProviders();
+        const settings = this.getCachedSettings();
+        return Object.entries(allProviderClasses).map(([name, providerClass]) => ({
+            provider: this.providerRegistry.get(name) ?? new providerClass(),
+            settings: settings[name] ?? {},
+        }));
     }
-    async initProvider(name, providerSettings, currentBackoff = constants_1.EXTERNAL_SECRETS_INITIAL_BACKOFF) {
-        const providerClass = this.secretsProviders.getProvider(name);
-        if (!providerClass) {
-            return null;
-        }
-        const provider = new providerClass();
-        try {
-            await provider.init(providerSettings);
-        }
-        catch (e) {
-            this.logger.error(`Error initializing secrets provider ${provider.displayName} (${provider.name}).`);
-            this.retryInitWithBackoff(name, currentBackoff);
-            return provider;
-        }
-        try {
-            if (providerSettings.connected) {
-                await provider.connect();
-            }
-        }
-        catch (e) {
-            try {
-                await provider.disconnect();
-            }
-            catch {
-                this.logger.warn(`Error disconnecting provider ${provider.displayName} (${provider.name}) after failed connect attempt.`);
-            }
-            this.logger.error(`Error initializing secrets provider ${provider.displayName} (${provider.name}).`);
-            this.retryInitWithBackoff(name, currentBackoff);
-            return provider;
-        }
-        return provider;
+    getProviderWithSettings(provider) {
+        const ProviderClass = this.providersFactory.getProvider(provider);
+        const settings = this.getCachedSettings();
+        return {
+            provider: this.providerRegistry.get(provider) ?? new ProviderClass(),
+            settings: settings[provider] ?? {},
+        };
     }
-    retryInitWithBackoff(name, currentBackoff) {
-        if (name in this.initRetryTimeouts) {
-            clearTimeout(this.initRetryTimeouts[name]);
-            delete this.initRetryTimeouts[name];
+    async updateProvider(provider) {
+        const providerInstance = this.providerRegistry.get(provider);
+        if (!providerInstance) {
+            throw new not_found_error_1.NotFoundError(`Provider "${provider}" not found`);
         }
-        this.initRetryTimeouts[name] = setTimeout(() => {
-            delete this.initRetryTimeouts[name];
-            if (this.providers[name] && this.providers[name].state !== 'error') {
-                return;
-            }
-            void this.reloadProvider(name, Math.min(currentBackoff * 2, constants_1.EXTERNAL_SECRETS_MAX_BACKOFF));
-        }, currentBackoff);
-    }
-    async updateSecrets() {
-        if (!this.license.isExternalSecretsEnabled()) {
-            return;
+        if (providerInstance.state !== 'connected') {
+            throw new n8n_workflow_1.UnexpectedError(`Provider "${provider}" is not connected`);
         }
-        await Promise.allSettled(Object.entries(this.providers).map(async ([k, p]) => {
-            try {
-                if (this.cachedSettings[k].connected && p.state === 'connected') {
-                    await p.update();
-                }
-            }
-            catch {
-                this.logger.error(`Error updating secrets provider ${p.displayName} (${p.name}).`);
-            }
-        }));
-        this.logger.debug('External secrets manager updated secrets');
-    }
-    getProvider(provider) {
-        return this.providers[provider];
-    }
-    hasProvider(provider) {
-        return provider in this.providers;
-    }
-    getProviderNames() {
-        return Object.keys(this.providers);
+        await providerInstance.update();
+        this.broadcastReload();
+        this.logger.debug(`Updated provider ${provider}`);
     }
     getSecret(provider, name) {
-        return this.getProvider(provider)?.getSecret(name);
+        return this.secretsCache.getSecret(provider, name);
     }
     hasSecret(provider, name) {
-        return this.getProvider(provider)?.hasSecret(name) ?? false;
+        return this.secretsCache.hasSecret(provider, name);
     }
     getSecretNames(provider) {
-        return this.getProvider(provider)?.getSecretNames() ?? [];
+        return this.secretsCache.getSecretNames(provider);
     }
     getAllSecretNames() {
-        return Object.fromEntries(Object.keys(this.providers).map((provider) => [
-            provider,
-            this.getSecretNames(provider) ?? [],
-        ]));
+        return this.secretsCache.getAllSecretNames();
     }
-    getProvidersWithSettings() {
-        return Object.entries(this.secretsProviders.getAllProviders()).map(([k, c]) => ({
-            provider: this.getProvider(k) ?? new c(),
-            settings: this.cachedSettings[k] ?? {},
-        }));
+    async setProviderSettings(provider, settings, userId) {
+        const { isNewProvider } = await this.settingsStore.updateProvider(provider, { settings });
+        await this.reloadProvider(provider);
+        this.broadcastReload();
+        void this.trackProviderSave(provider, isNewProvider, userId);
     }
-    getProviderWithSettings(provider) {
-        const providerConstructor = this.secretsProviders.getProvider(provider);
-        return {
-            provider: this.getProvider(provider) ?? new providerConstructor(),
-            settings: this.cachedSettings[provider] ?? {},
+    async setProviderConnected(provider, connected) {
+        await this.settingsStore.updateProvider(provider, { connected });
+        if (connected) {
+            await this.retryManager.runWithRetry(provider, async () => await this.connectProvider(provider));
+        }
+        else {
+            this.retryManager.cancelRetry(provider);
+            const providerInstance = this.providerRegistry.get(provider);
+            if (providerInstance) {
+                await this.providerLifecycle.disconnect(providerInstance);
+            }
+        }
+        this.broadcastReload();
+    }
+    async testProviderSettings(provider, data) {
+        const testSettings = {
+            connected: true,
+            connectedAt: new Date(),
+            settings: data,
         };
+        const errorState = {
+            success: false,
+            testState: 'error',
+        };
+        const result = await this.providerLifecycle.initialize(provider, testSettings);
+        if (!result.success || !result.provider) {
+            return errorState;
+        }
+        try {
+            const [success, error] = await result.provider.test();
+            const currentSettings = await this.settingsStore.getProvider(provider);
+            const testState = this.determineTestState(success, currentSettings?.connected ?? false);
+            return { success, testState, error };
+        }
+        catch {
+            return errorState;
+        }
+        finally {
+            await result.provider?.disconnect();
+        }
     }
-    async reloadProvider(provider, backoff = constants_1.EXTERNAL_SECRETS_INITIAL_BACKOFF) {
-        if (provider in this.providers) {
-            try {
-                await this.providers[provider].disconnect();
-            }
-            catch {
-                this.logger.warn(`Error disconnecting provider ${provider} during reload`);
-            }
-            delete this.providers[provider];
+    async reloadAllProviders() {
+        this.logger.debug('Reloading all external secrets providers');
+        const newSettings = await this.settingsStore.reload();
+        for (const name of Object.keys(newSettings)) {
+            await this.reloadProvider(name);
+        }
+        await this.secretsCache.refreshAll();
+        this.logger.debug('Reloaded all external secrets providers');
+    }
+    async addProvider(name, config) {
+        const result = await this.providerLifecycle.initialize(name, config);
+        if (!result.success || !result.provider) {
+            this.logger.error(`Failed to initialize provider ${name}`, { error: result.error });
+            return;
         }
-        const newProvider = await this.initProvider(provider, this.cachedSettings[provider], backoff);
-        if (newProvider) {
-            this.providers[provider] = newProvider;
+        this.providerRegistry.add(name, result.provider);
+        if (config.connected) {
+            await this.retryManager.runWithRetry(name, async () => await this.connectProvider(name));
         }
-        this.logger.debug(`External secrets manager reloaded provider ${provider}`);
     }
-    async setProviderSettings(provider, data, userId) {
-        let isNewProvider = false;
-        let settings = await this.getDecryptedSettings();
-        if (!settings) {
-            settings = {};
+    async connectProvider(name) {
+        const provider = this.providerRegistry.get(name);
+        if (!provider) {
+            this.logger.warn(`Cannot connect provider ${name}: not found in registry`);
+            throw new Error(`Provider ${name} not found in registry`);
         }
-        if (!(provider in settings)) {
-            isNewProvider = true;
+        return await this.providerLifecycle.connect(provider);
+    }
+    async reloadProvider(name) {
+        const config = await this.settingsStore.getProvider(name);
+        if (!config) {
+            this.logger.warn(`Cannot reload provider ${name}: settings not found`);
+            return;
         }
-        settings[provider] = {
-            connected: settings[provider]?.connected ?? false,
-            connectedAt: settings[provider]?.connectedAt ?? new Date(),
-            settings: data,
-        };
-        await this.saveAndSetSettings(settings);
-        this.cachedSettings = settings;
-        await this.reloadProvider(provider);
-        await this.updateSecrets();
-        this.broadcastReloadExternalSecretsProviders();
-        void this.trackProviderSave(provider, isNewProvider, userId);
+        this.retryManager.cancelRetry(name);
+        const existingProvider = this.providerRegistry.get(name);
+        if (existingProvider) {
+            await this.providerLifecycle.disconnect(existingProvider);
+            this.providerRegistry.remove(name);
+        }
+        await this.addProvider(name, config);
     }
-    async setProviderConnected(provider, connected) {
-        let settings = await this.getDecryptedSettings();
-        if (!settings) {
-            settings = {};
+    async updateSecrets() {
+        await this.secretsCache.refreshAll();
+    }
+    startSecretsRefresh() {
+        this.refreshInterval = setInterval(async () => await this.secretsCache.refreshAll(), this.config.updateInterval * constants_1.Time.seconds.toMilliseconds);
+        this.logger.debug('Started secrets refresh interval');
+    }
+    stopSecretsRefresh() {
+        if (this.refreshInterval) {
+            clearInterval(this.refreshInterval);
+            this.refreshInterval = undefined;
         }
-        settings[provider] = {
-            connected,
-            connectedAt: connected ? new Date() : (settings[provider]?.connectedAt ?? null),
-            settings: settings[provider]?.settings ?? {},
-        };
-        await this.saveAndSetSettings(settings);
-        this.cachedSettings = settings;
-        await this.reloadProvider(provider);
-        await this.updateSecrets();
-        this.broadcastReloadExternalSecretsProviders();
+    }
+    broadcastReload() {
+        void this.publisher.publishCommand({ command: 'reload-external-secrets-providers' });
     }
     async trackProviderSave(vaultType, isNew, userId) {
         let testResult;
@@ -284,94 +235,34 @@ let ExternalSecretsManager = class ExternalSecretsManager {
             errorMessage: testResult?.[1],
         });
     }
-    encryptSecretsSettings(settings) {
-        return this.cipher.encrypt(settings);
-    }
-    async saveAndSetSettings(settings) {
-        const encryptedSettings = this.encryptSecretsSettings(settings);
-        await this.settingsRepo.upsert({
-            key: constants_1.EXTERNAL_SECRETS_DB_KEY,
-            value: encryptedSettings,
-            loadOnStartup: false,
-        }, ['key']);
-    }
-    async testProviderSettings(provider, data) {
-        let testProvider = null;
-        try {
-            testProvider = await this.initProvider(provider, {
-                connected: true,
-                connectedAt: new Date(),
-                settings: data,
-            });
-            if (!testProvider) {
-                return {
-                    success: false,
-                    testState: 'error',
-                };
-            }
-            const [success, error] = await testProvider.test();
-            let testState = 'error';
-            if (success && this.cachedSettings[provider]?.connected) {
-                testState = 'connected';
-            }
-            else if (success) {
-                testState = 'tested';
-            }
-            return {
-                success,
-                testState,
-                error,
-            };
-        }
-        catch {
-            return {
-                success: false,
-                testState: 'error',
-            };
-        }
-        finally {
-            if (testProvider) {
-                await testProvider.disconnect();
-            }
+    determineTestState(success, isConnected) {
+        if (!success) {
+            return 'error';
         }
+        return isConnected ? 'connected' : 'tested';
     }
-    async updateProvider(provider) {
-        if (!this.license.isExternalSecretsEnabled()) {
-            return false;
-        }
-        if (!this.providers[provider] || this.providers[provider].state !== 'connected') {
-            return false;
-        }
-        try {
-            await this.providers[provider].update();
-            this.broadcastReloadExternalSecretsProviders();
-            this.logger.debug(`External secrets manager updated provider ${provider}`);
-            return true;
-        }
-        catch (error) {
-            this.logger.debug(`External secrets manager failed to update provider ${provider}`, {
-                error: (0, n8n_workflow_1.ensureError)(error),
-            });
-            return false;
-        }
+    getCachedSettings() {
+        return this.settingsStore.getCached();
     }
 };
 exports.ExternalSecretsManager = ExternalSecretsManager;
 __decorate([
     (0, decorators_1.OnPubSubEvent)('reload-external-secrets-providers'),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Number]),
+    __metadata("design:paramtypes", []),
     __metadata("design:returntype", Promise)
 ], ExternalSecretsManager.prototype, "reloadAllProviders", null);
 exports.ExternalSecretsManager = ExternalSecretsManager = __decorate([
     (0, di_1.Service)(),
     __metadata("design:paramtypes", [backend_common_1.Logger,
         external_secrets_config_1.ExternalSecretsConfig,
-        db_1.SettingsRepository,
-        license_1.License,
         external_secrets_providers_ee_1.ExternalSecretsProviders,
-        n8n_core_1.Cipher,
         event_service_1.EventService,
-        publisher_service_1.Publisher])
+        publisher_service_1.Publisher,
+        settings_store_service_1.ExternalSecretsSettingsStore,
+        provider_registry_service_1.ExternalSecretsProviderRegistry,
+        provider_lifecycle_service_1.ExternalSecretsProviderLifecycle,
+        retry_manager_service_1.ExternalSecretsRetryManager,
+        secrets_cache_service_1.ExternalSecretsSecretsCache])
 ], ExternalSecretsManager);
 //# sourceMappingURL=external-secrets-manager.ee.js.map