n8n 2.14.2 → 2.16.0

package/dist/modules/otel/otel.constants.d.ts

@@ -0,0 +1,22 @@
+export declare const ATTR: {
+    readonly OTEL_SERVICE_NAME: "service.name";
+    readonly OTEL_SERVICE_VERSION: "service.version";
+    readonly INSTANCE_ID: "n8n.instance.id";
+    readonly INSTANCE_ROLE: "n8n.instance.role";
+    readonly WORKFLOW_ID: "n8n.workflow.id";
+    readonly WORKFLOW_NAME: "n8n.workflow.name";
+    readonly WORKFLOW_NODE_COUNT: "n8n.workflow.node_count";
+    readonly EXECUTION_ID: "n8n.execution.id";
+    readonly EXECUTION_MODE: "n8n.execution.mode";
+    readonly EXECUTION_STATUS: "n8n.execution.status";
+    readonly EXECUTION_IS_RETRY: "n8n.execution.is_retry";
+    readonly EXECUTION_RETRY_OF: "n8n.execution.retry_of";
+    readonly EXECUTION_ERROR_TYPE: "n8n.execution.error_type";
+    readonly NODE_ID: "n8n.node.id";
+    readonly NODE_NAME: "n8n.node.name";
+    readonly NODE_TYPE: "n8n.node.type";
+    readonly NODE_TYPE_VERSION: "n8n.node.type_version";
+    readonly NODE_ITEMS_INPUT: "n8n.node.items.input";
+    readonly NODE_ITEMS_OUTPUT: "n8n.node.items.output";
+    readonly NODE_TERMINATION_REASON: "n8n.node.termination_reason";
+};

package/dist/modules/otel/otel.constants.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ATTR = void 0;
+const semantic_conventions_1 = require("@opentelemetry/semantic-conventions");
+exports.ATTR = {
+    OTEL_SERVICE_NAME: semantic_conventions_1.ATTR_SERVICE_NAME,
+    OTEL_SERVICE_VERSION: semantic_conventions_1.ATTR_SERVICE_VERSION,
+    INSTANCE_ID: 'n8n.instance.id',
+    INSTANCE_ROLE: 'n8n.instance.role',
+    WORKFLOW_ID: 'n8n.workflow.id',
+    WORKFLOW_NAME: 'n8n.workflow.name',
+    WORKFLOW_NODE_COUNT: 'n8n.workflow.node_count',
+    EXECUTION_ID: 'n8n.execution.id',
+    EXECUTION_MODE: 'n8n.execution.mode',
+    EXECUTION_STATUS: 'n8n.execution.status',
+    EXECUTION_IS_RETRY: 'n8n.execution.is_retry',
+    EXECUTION_RETRY_OF: 'n8n.execution.retry_of',
+    EXECUTION_ERROR_TYPE: 'n8n.execution.error_type',
+    NODE_ID: 'n8n.node.id',
+    NODE_NAME: 'n8n.node.name',
+    NODE_TYPE: 'n8n.node.type',
+    NODE_TYPE_VERSION: 'n8n.node.type_version',
+    NODE_ITEMS_INPUT: 'n8n.node.items.input',
+    NODE_ITEMS_OUTPUT: 'n8n.node.items.output',
+    NODE_TERMINATION_REASON: 'n8n.node.termination_reason',
+};
+//# sourceMappingURL=otel.constants.js.map

package/dist/modules/otel/otel.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel.constants.js","sourceRoot":"","sources":["../../../src/modules/otel/otel.constants.ts"],"names":[],"mappings":";;;AAAA,8EAA8F;AAEjF,QAAA,IAAI,GAAG;IACnB,iBAAiB,EAAE,wCAAiB;IACpC,oBAAoB,EAAE,2CAAoB;IAE1C,WAAW,EAAE,iBAAiB;IAC9B,aAAa,EAAE,mBAAmB;IAElC,WAAW,EAAE,iBAAiB;IAC9B,aAAa,EAAE,mBAAmB;IAClC,mBAAmB,EAAE,yBAAyB;IAE9C,YAAY,EAAE,kBAAkB;IAChC,cAAc,EAAE,oBAAoB;IACpC,gBAAgB,EAAE,sBAAsB;IACxC,kBAAkB,EAAE,wBAAwB;IAC5C,kBAAkB,EAAE,wBAAwB;IAC5C,oBAAoB,EAAE,0BAA0B;IAEhD,OAAO,EAAE,aAAa;IACtB,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,eAAe;IAC1B,iBAAiB,EAAE,uBAAuB;IAC1C,gBAAgB,EAAE,sBAAsB;IACxC,iBAAiB,EAAE,uBAAuB;IAC1C,uBAAuB,EAAE,6BAA6B;CAC7C,CAAC"}

package/dist/modules/otel/otel.module.d.ts

@@ -0,0 +1,5 @@
+import type { ModuleInterface } from '@n8n/decorators';
+export declare class OtelModule implements ModuleInterface {
+    init(): Promise<void>;
+    shutdown(): Promise<void>;
+}

package/dist/modules/otel/otel.module.js

@@ -0,0 +1,80 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OtelModule = void 0;
+const decorators_1 = require("@n8n/decorators");
+const di_1 = require("@n8n/di");
+let OtelModule = class OtelModule {
+    async init() {
+        const { OtelConfig } = await Promise.resolve().then(() => __importStar(require('./otel.config')));
+        const config = di_1.Container.get(OtelConfig);
+        if (!config.enabled)
+            return;
+        const { OtelService } = await Promise.resolve().then(() => __importStar(require('./otel.service')));
+        di_1.Container.get(OtelService).init();
+        await Promise.resolve().then(() => __importStar(require('./n8n-instrumentation')));
+    }
+    async shutdown() {
+        const { OtelConfig } = await Promise.resolve().then(() => __importStar(require('./otel.config')));
+        const config = di_1.Container.get(OtelConfig);
+        if (!config.enabled)
+            return;
+        const { OtelService } = await Promise.resolve().then(() => __importStar(require('./otel.service')));
+        await di_1.Container.get(OtelService).shutdown();
+    }
+};
+exports.OtelModule = OtelModule;
+__decorate([
+    (0, decorators_1.OnShutdown)(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], OtelModule.prototype, "shutdown", null);
+exports.OtelModule = OtelModule = __decorate([
+    (0, decorators_1.BackendModule)({
+        name: 'otel',
+        instanceTypes: ['main', 'worker', 'webhook'],
+    })
+], OtelModule);
+//# sourceMappingURL=otel.module.js.map

package/dist/modules/otel/otel.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel.module.js","sourceRoot":"","sources":["../../../src/modules/otel/otel.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,gDAA4D;AAC5D,gCAAoC;AAM7B,IAAM,UAAU,GAAhB,MAAM,UAAU;IACtB,KAAK,CAAC,IAAI;QACT,MAAM,EAAE,UAAU,EAAE,GAAG,wDAAa,eAAe,GAAC,CAAC;QACrD,MAAM,MAAM,GAAG,cAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QAE5B,MAAM,EAAE,WAAW,EAAE,GAAG,wDAAa,gBAAgB,GAAC,CAAC;QACvD,cAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;QAGlC,wDAAa,uBAAuB,GAAC,CAAC;IACvC,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ;QACb,MAAM,EAAE,UAAU,EAAE,GAAG,wDAAa,eAAe,GAAC,CAAC;QACrD,MAAM,MAAM,GAAG,cAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QAE5B,MAAM,EAAE,WAAW,EAAE,GAAG,wDAAa,gBAAgB,GAAC,CAAC;QACvD,MAAM,cAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7C,CAAC;CACD,CAAA;AAtBY,gCAAU;AAchB;IADL,IAAA,uBAAU,GAAE;;;;0CAQZ;qBArBW,UAAU;IAJtB,IAAA,0BAAa,EAAC;QACd,IAAI,EAAE,MAAM;QACZ,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;KAC5C,CAAC;GACW,UAAU,CAsBtB"}

package/dist/modules/otel/otel.service.d.ts

@@ -0,0 +1,18 @@
+import { Logger } from '@n8n/backend-common';
+import { InstanceSettings } from 'n8n-core';
+import { OtelConfig } from './otel.config';
+export declare class OtelService {
+    private readonly config;
+    private readonly instanceSettings;
+    private readonly logger;
+    private static isDiagnosticsLoggerConfigured;
+    private sdk?;
+    private hasLoggedStartupConnectivityFailure;
+    constructor(config: OtelConfig, instanceSettings: InstanceSettings, logger: Logger);
+    init(): void;
+    shutdown(): Promise<void>;
+    parseOtlpHeaders(headersToSplit: string): Record<string, string>;
+    private configureDiagnosticsLogger;
+    private buildOtlpTracesUrl;
+    private checkEndpointReachability;
+}

package/dist/modules/otel/otel.service.js

@@ -0,0 +1,120 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var OtelService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OtelService = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const di_1 = require("@n8n/di");
+const api_1 = require("@opentelemetry/api");
+const exporter_trace_otlp_proto_1 = require("@opentelemetry/exporter-trace-otlp-proto");
+const resources_1 = require("@opentelemetry/resources");
+const sdk_node_1 = require("@opentelemetry/sdk-node");
+const sdk_trace_node_1 = require("@opentelemetry/sdk-trace-node");
+const n8n_core_1 = require("n8n-core");
+const constants_1 = require("../../constants");
+const otel_config_1 = require("./otel.config");
+const otel_constants_1 = require("./otel.constants");
+let OtelService = OtelService_1 = class OtelService {
+    constructor(config, instanceSettings, logger) {
+        this.config = config;
+        this.instanceSettings = instanceSettings;
+        this.logger = logger;
+        this.hasLoggedStartupConnectivityFailure = false;
+    }
+    init() {
+        if (!this.config.enabled)
+            return;
+        this.configureDiagnosticsLogger();
+        const otlpTracesUrl = this.buildOtlpTracesUrl(this.config.exporterEndpoint, this.config.exporterTracingPath);
+        const otlpHeaders = this.parseOtlpHeaders(this.config.exporterHeaders);
+        this.sdk = new sdk_node_1.NodeSDK({
+            resource: (0, resources_1.resourceFromAttributes)({
+                [otel_constants_1.ATTR.OTEL_SERVICE_NAME]: this.config.exporterServiceName,
+                [otel_constants_1.ATTR.OTEL_SERVICE_VERSION]: constants_1.N8N_VERSION,
+                [otel_constants_1.ATTR.INSTANCE_ID]: this.instanceSettings.instanceId,
+                [otel_constants_1.ATTR.INSTANCE_ROLE]: this.instanceSettings.instanceType,
+            }),
+            traceExporter: new exporter_trace_otlp_proto_1.OTLPTraceExporter({
+                url: otlpTracesUrl,
+                headers: otlpHeaders,
+            }),
+            sampler: new sdk_trace_node_1.TraceIdRatioBasedSampler(this.config.tracesSampleRate),
+        });
+        this.sdk.start();
+        void this.checkEndpointReachability(otlpTracesUrl);
+    }
+    async shutdown() {
+        await this.sdk?.shutdown();
+    }
+    parseOtlpHeaders(headersToSplit) {
+        const headers = {};
+        for (const pair of headersToSplit.split(',')) {
+            const trimmedPair = pair.trim();
+            if (!trimmedPair)
+                continue;
+            if (!trimmedPair.includes('=')) {
+                this.logger.warn(`Skipping invalid OTEL exporter header "${trimmedPair}": missing "=" separator. Expected format: "key=value".`);
+                continue;
+            }
+            const [key, ...rest] = trimmedPair.split('=');
+            const trimmedKey = key.trim();
+            if (!trimmedKey) {
+                this.logger.warn(`Skipping invalid OTEL exporter header "${trimmedPair}": empty key. Expected format: "key=value".`);
+                continue;
+            }
+            headers[trimmedKey] = rest.join('=').trim();
+        }
+        return headers;
+    }
+    configureDiagnosticsLogger() {
+        if (OtelService_1.isDiagnosticsLoggerConfigured)
+            return;
+        const diagnosticsLogger = {
+            error: (...args) => this.logger.error('OpenTelemetry diagnostics error', { args }),
+            warn: (...args) => this.logger.warn('OpenTelemetry diagnostics warning', { args }),
+            info: (...args) => this.logger.info('OpenTelemetry diagnostics info', { args }),
+            debug: (...args) => this.logger.debug('OpenTelemetry diagnostics debug', { args }),
+            verbose: (...args) => this.logger.debug('OpenTelemetry diagnostics verbose', { args }),
+        };
+        api_1.diag.setLogger(diagnosticsLogger, api_1.DiagLogLevel.WARN);
+        OtelService_1.isDiagnosticsLoggerConfigured = true;
+    }
+    buildOtlpTracesUrl(endpoint, path) {
+        const exporterEndpointWithoutTrailingSlash = endpoint.replace(/\/+$/, '');
+        return `${exporterEndpointWithoutTrailingSlash}${path}`;
+    }
+    async checkEndpointReachability(url) {
+        try {
+            await fetch(url, {
+                method: 'HEAD',
+                signal: AbortSignal.timeout(this.config.startupConnectivityTimeoutMs),
+            });
+        }
+        catch (error) {
+            if (this.hasLoggedStartupConnectivityFailure)
+                return;
+            this.hasLoggedStartupConnectivityFailure = true;
+            this.logger.error('Failed to connect to OpenTelemetry OTLP endpoint during startup', {
+                endpoint: url,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+};
+exports.OtelService = OtelService;
+OtelService.isDiagnosticsLoggerConfigured = false;
+exports.OtelService = OtelService = OtelService_1 = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [otel_config_1.OtelConfig,
+        n8n_core_1.InstanceSettings,
+        backend_common_1.Logger])
+], OtelService);
+//# sourceMappingURL=otel.service.js.map

package/dist/modules/otel/otel.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel.service.js","sourceRoot":"","sources":["../../../src/modules/otel/otel.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,wDAA6C;AAC7C,gCAAkC;AAElC,4CAAwD;AACxD,wFAA6E;AAC7E,wDAAkE;AAClE,sDAAkD;AAClD,kEAAyE;AACzE,uCAA4C;AAE5C,2CAA0C;AAE1C,+CAA2C;AAC3C,qDAAwC;AAGjC,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAKvB,YACkB,MAAkB,EAClB,gBAAkC,EAClC,MAAc;QAFd,WAAM,GAAN,MAAM,CAAY;QAClB,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,WAAM,GAAN,MAAM,CAAQ;QALxB,wCAAmC,GAAG,KAAK,CAAC;IAMjD,CAAC;IAEJ,IAAI;QACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QAEjC,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAElC,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAC5C,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAC5B,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAC/B,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAEvE,IAAI,CAAC,GAAG,GAAG,IAAI,kBAAO,CAAC;YACtB,QAAQ,EAAE,IAAA,kCAAsB,EAAC;gBAChC,CAAC,qBAAI,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;gBACzD,CAAC,qBAAI,CAAC,oBAAoB,CAAC,EAAE,uBAAW;gBACxC,CAAC,qBAAI,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,UAAU;gBACpD,CAAC,qBAAI,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,YAAY;aACxD,CAAC;YACF,aAAa,EAAE,IAAI,6CAAiB,CAAC;gBACpC,GAAG,EAAE,aAAa;gBAClB,OAAO,EAAE,WAAW;aACpB,CAAC;YACF,OAAO,EAAE,IAAI,yCAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;SACnE,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACjB,KAAK,IAAI,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,QAAQ;QACb,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAED,gBAAgB,CAAC,cAAsB;QACtC,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAChC,IAAI,CAAC,WAAW;gBAAE,SAAS;YAE3B,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC,MAAM,CAAC,IAAI,CACf,0CAA0C,WAAW,yDAAyD,CAC9G,CAAC;gBACF,SAAS;YACV,CAAC;YAED,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9C,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,UAAU,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CACf,0CAA0C,WAAW,6CAA6C,CAClG,CAAC;gBACF,SAAS;YACV,CAAC;YAED,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,0BAA0B;QACjC,IAAI,aAAW,CAAC,6BAA6B;YAAE,OAAO;QAEtD,MAAM,iBAAiB,GAAe;YACrC,KAAK,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,IAAI,EAAE,CAAC;YAC7F,IAAI,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,IAAI,EAAE,CAAC;YAC7F,IAAI,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,IAAI,EAAE,CAAC;YAC1F,KAAK,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,IAAI,EAAE,CAAC;YAC7F,OAAO,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,EAAE,IAAI,EAAE,CAAC;SACjE,CAAC;QACF,UAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,kBAAY,CAAC,IAAI,CAAC,CAAC;QACrD,aAAW,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAClD,CAAC;IAEO,kBAAkB,CAAC,QAAgB,EAAE,IAAY;QACxD,MAAM,oCAAoC,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1E,OAAO,GAAG,oCAAoC,GAAG,IAAI,EAAE,CAAC;IACzD,CAAC;IAEO,KAAK,CAAC,yBAAyB,CAAC,GAAW;QAClD,IAAI,CAAC;YAIJ,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChB,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,4BAA4B,CAAC;aACrE,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,IAAI,CAAC,mCAAmC;gBAAE,OAAO;YACrD,IAAI,CAAC,mCAAmC,GAAG,IAAI,CAAC;YAEhD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iEAAiE,EAAE;gBACpF,QAAQ,EAAE,GAAG;gBACb,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7D,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;;AA7GW,kCAAW;AACR,yCAA6B,GAAG,KAAK,AAAR,CAAS;sBADzC,WAAW;IADvB,IAAA,YAAO,GAAE;qCAOiB,wBAAU;QACA,2BAAgB;QAC1B,uBAAM;GARpB,WAAW,CA8GvB"}

package/dist/modules/otel/span-registry.d.ts

@@ -0,0 +1,14 @@
+import type { Span } from '@opentelemetry/api';
+export declare class SpanRegistry {
+    private spans;
+    static workflowKey(executionId: string): string;
+    static nodeKey(executionId: string, nodeId: string): string;
+    addWorkflow(executionId: string, span: Span): void;
+    getWorkflow(executionId: string): Span | undefined;
+    removeWorkflow(executionId: string): Span | undefined;
+    addNode(executionId: string, nodeId: string, span: Span): void;
+    getNode(executionId: string, nodeId: string): Span | undefined;
+    removeNode(executionId: string, nodeId: string): Span | undefined;
+    findUnendedNodeSpans(executionId: string): Span[];
+    cleanup(executionId: string): void;
+}

package/dist/modules/otel/span-registry.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SpanRegistry = void 0;
+class SpanRegistry {
+    constructor() {
+        this.spans = new Map();
+    }
+    static workflowKey(executionId) {
+        return executionId;
+    }
+    static nodeKey(executionId, nodeId) {
+        return `${executionId}:${nodeId}`;
+    }
+    addWorkflow(executionId, span) {
+        this.spans.set(SpanRegistry.workflowKey(executionId), span);
+    }
+    getWorkflow(executionId) {
+        return this.spans.get(SpanRegistry.workflowKey(executionId));
+    }
+    removeWorkflow(executionId) {
+        const key = SpanRegistry.workflowKey(executionId);
+        const span = this.spans.get(key);
+        this.spans.delete(key);
+        return span;
+    }
+    addNode(executionId, nodeId, span) {
+        this.spans.set(SpanRegistry.nodeKey(executionId, nodeId), span);
+    }
+    getNode(executionId, nodeId) {
+        return this.spans.get(SpanRegistry.nodeKey(executionId, nodeId));
+    }
+    removeNode(executionId, nodeId) {
+        const key = SpanRegistry.nodeKey(executionId, nodeId);
+        const span = this.spans.get(key);
+        this.spans.delete(key);
+        return span;
+    }
+    findUnendedNodeSpans(executionId) {
+        const prefix = `${executionId}:`;
+        const dangling = [];
+        for (const [key, span] of this.spans.entries()) {
+            if (key.startsWith(prefix)) {
+                dangling.push(span);
+                this.spans.delete(key);
+            }
+        }
+        return dangling;
+    }
+    cleanup(executionId) {
+        for (const key of this.spans.keys()) {
+            if (key === executionId || key.startsWith(`${executionId}:`)) {
+                this.spans.delete(key);
+            }
+        }
+    }
+}
+exports.SpanRegistry = SpanRegistry;
+//# sourceMappingURL=span-registry.js.map

package/dist/modules/otel/span-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"span-registry.js","sourceRoot":"","sources":["../../../src/modules/otel/span-registry.ts"],"names":[],"mappings":";;;AAEA,MAAa,YAAY;IAAzB;QACS,UAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;IA6DzC,CAAC;IA3DA,MAAM,CAAC,WAAW,CAAC,WAAmB;QACrC,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,WAAmB,EAAE,MAAc;QACjD,OAAO,GAAG,WAAW,IAAI,MAAM,EAAE,CAAC;IACnC,CAAC;IAED,WAAW,CAAC,WAAmB,EAAE,IAAU;QAC1C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7D,CAAC;IAED,WAAW,CAAC,WAAmB;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,cAAc,CAAC,WAAmB;QACjC,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,OAAO,CAAC,WAAmB,EAAE,MAAc,EAAE,IAAU;QACtD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,CAAC,WAAmB,EAAE,MAAc;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,UAAU,CAAC,WAAmB,EAAE,MAAc;QAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,oBAAoB,CAAC,WAAmB;QACvC,MAAM,MAAM,GAAG,GAAG,WAAW,GAAG,CAAC;QACjC,MAAM,QAAQ,GAAW,EAAE,CAAC;QAE5B,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAChD,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;QACF,CAAC;QAED,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,OAAO,CAAC,WAAmB;QAC1B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC,EAAE,CAAC;gBAC9D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;QACF,CAAC;IACF,CAAC;CACD;AA9DD,oCA8DC"}

package/dist/modules/provisioning.ee/provisioning.module.js

@@ -44,6 +44,7 @@ const decorators_1 = require("@n8n/decorators");
 let ProvisioningModule = class ProvisioningModule {
     async init() {
         await Promise.resolve().then(() => __importStar(require('./provisioning.controller.ee')));
+        await Promise.resolve().then(() => __importStar(require('./role-mapping-rule.controller.ee')));
     }
 };
 exports.ProvisioningModule = ProvisioningModule;

package/dist/modules/provisioning.ee/provisioning.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"provisioning.module.js","sourceRoot":"","sources":["../../../src/modules/provisioning.ee/provisioning.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,gDAAgD;AAOzC,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC9B,KAAK,CAAC,IAAI;QACT,wDAAa,8BAA8B,GAAC,CAAC;IAC9C,CAAC;CACD,CAAA;AAJY,gDAAkB;6BAAlB,kBAAkB;IAL9B,IAAA,0BAAa,EAAC;QACd,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC;QACpD,aAAa,EAAE,CAAC,MAAM,CAAC;KACvB,CAAC;GACW,kBAAkB,CAI9B"}
+{"version":3,"file":"provisioning.module.js","sourceRoot":"","sources":["../../../src/modules/provisioning.ee/provisioning.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,gDAAgD;AAOzC,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC9B,KAAK,CAAC,IAAI;QACT,wDAAa,8BAA8B,GAAC,CAAC;QAC7C,wDAAa,mCAAmC,GAAC,CAAC;IACnD,CAAC;CACD,CAAA;AALY,gDAAkB;6BAAlB,kBAAkB;IAL9B,IAAA,0BAAa,EAAC;QACd,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC;QACpD,aAAa,EAAE,CAAC,MAAM,CAAC;KACvB,CAAC;GACW,kBAAkB,CAK9B"}

package/dist/modules/provisioning.ee/provisioning.service.ee.d.ts

@@ -1,12 +1,15 @@
 import { ProvisioningConfigDto } from '@n8n/api-types';
 import { Logger } from '@n8n/backend-common';
 import { GlobalConfig } from '@n8n/config';
-import { RoleRepository, SettingsRepository, User, UserRepository, ProjectRepository } from '@n8n/db';
+import { RoleRepository, RoleMappingRuleRepository, SettingsRepository, User, UserRepository, ProjectRepository } from '@n8n/db';
 import { EventService } from '../../events/event.service';
 import { Publisher } from '../../scaling/pubsub/publisher.service';
 import { ProjectService } from '../../services/project.service.ee';
 import { InstanceSettings } from 'n8n-core';
 import { UserService } from '../../services/user.service';
+import { RoleResolverService } from './role-resolver.service.ee';
+import type { RoleResolverContext } from './role-resolver-types';
+export declare function isExpressionMappingFlagEnabled(): boolean;
 export declare class ProvisioningService {
     private readonly eventService;
     private readonly globalConfig;
@@ -19,8 +22,10 @@ export declare class ProvisioningService {
     private readonly logger;
     private readonly publisher;
     private readonly instanceSettings;
+    private readonly roleMappingRuleRepository;
+    private readonly roleResolverService;
     private provisioningConfig;
-    constructor(eventService: EventService, globalConfig: GlobalConfig, settingsRepository: SettingsRepository, projectRepository: ProjectRepository, projectService: ProjectService, roleRepository: RoleRepository, userRepository: UserRepository, userService: UserService, logger: Logger, publisher: Publisher, instanceSettings: InstanceSettings);
+    constructor(eventService: EventService, globalConfig: GlobalConfig, settingsRepository: SettingsRepository, projectRepository: ProjectRepository, projectService: ProjectService, roleRepository: RoleRepository, userRepository: UserRepository, userService: UserService, logger: Logger, publisher: Publisher, instanceSettings: InstanceSettings, roleMappingRuleRepository: RoleMappingRuleRepository, roleResolverService: RoleResolverService);
     init(): Promise<void>;
     getConfig(): Promise<ProvisioningConfigDto>;
     provisionInstanceRoleForUser(user: User, roleSlug: unknown): Promise<void>;
@@ -34,4 +39,10 @@ export declare class ProvisioningService {
     isProvisioningEnabled(): Promise<boolean>;
     private isInstanceRoleProvisioningEnabled;
     private isProjectRolesProvisioningEnabled;
+    isExpressionMappingEnabled(): Promise<boolean>;
+    private buildRoleMappingConfig;
+    private applyExpressionMappedRoles;
+    private applyExpressionMappedInstanceRole;
+    private applyExpressionMappedProjectRoles;
+    provisionExpressionMappedRolesForUser(user: User, context: RoleResolverContext): Promise<void>;
 }

package/dist/modules/provisioning.ee/provisioning.service.ee.js

@@ -10,6 +10,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ProvisioningService = void 0;
+exports.isExpressionMappingFlagEnabled = isExpressionMappingFlagEnabled;
 const api_types_1 = require("@n8n/api-types");
 const backend_common_1 = require("@n8n/backend-common");
 const config_1 = require("@n8n/config");
@@ -26,8 +27,12 @@ const zod_1 = require("zod");
 const project_service_ee_1 = require("../../services/project.service.ee");
 const n8n_core_1 = require("n8n-core");
 const user_service_1 = require("../../services/user.service");
+const role_resolver_service_ee_1 = require("./role-resolver.service.ee");
+function isExpressionMappingFlagEnabled() {
+    return process.env.N8N_ENV_FEAT_ROLE_MAPPING_STRATEGY === 'true';
+}
 let ProvisioningService = class ProvisioningService {
-    constructor(eventService, globalConfig, settingsRepository, projectRepository, projectService, roleRepository, userRepository, userService, logger, publisher, instanceSettings) {
+    constructor(eventService, globalConfig, settingsRepository, projectRepository, projectService, roleRepository, userRepository, userService, logger, publisher, instanceSettings, roleMappingRuleRepository, roleResolverService) {
         this.eventService = eventService;
         this.globalConfig = globalConfig;
         this.settingsRepository = settingsRepository;
@@ -39,6 +44,8 @@ let ProvisioningService = class ProvisioningService {
         this.logger = logger;
         this.publisher = publisher;
         this.instanceSettings = instanceSettings;
+        this.roleMappingRuleRepository = roleMappingRuleRepository;
+        this.roleResolverService = roleResolverService;
     }
     async init() {
         this.provisioningConfig = await this.loadConfig();
@@ -197,6 +204,7 @@ let ProvisioningService = class ProvisioningService {
             'scopesName',
             'scopesInstanceRoleClaimName',
             'scopesProjectsRolesClaimName',
+            'scopesUseExpressionMapping',
         ];
         const updatedConfig = {
             ...currentConfig,
@@ -207,6 +215,10 @@ let ProvisioningService = class ProvisioningService {
                 delete updatedConfig[supportedPatchField];
             }
         }
+        if (updatedConfig.scopesUseExpressionMapping &&
+            (updatedConfig.scopesProvisionInstanceRole || updatedConfig.scopesProvisionProjectRoles)) {
+            throw new bad_request_error_1.BadRequestError('Expression-based mapping and direct-claim provisioning cannot both be enabled at the same time.');
+        }
         api_types_1.ProvisioningConfigDto.parse(updatedConfig);
         await this.settingsRepository.upsert({
             key: constants_1.PROVISIONING_PREFERENCES_DB_KEY,
@@ -273,6 +285,135 @@ let ProvisioningService = class ProvisioningService {
         const provisioningConfig = await this.getConfig();
         return provisioningConfig.scopesProvisionProjectRoles;
     }
+    async isExpressionMappingEnabled() {
+        if (!isExpressionMappingFlagEnabled())
+            return false;
+        const provisioningConfig = await this.getConfig();
+        return provisioningConfig.scopesUseExpressionMapping;
+    }
+    async buildRoleMappingConfig() {
+        const dbRules = await this.roleMappingRuleRepository.find({
+            relations: ['role', 'projects'],
+            order: { order: 'ASC' },
+        });
+        const instanceRoleRules = [];
+        const projectRoleRules = [];
+        for (const dbRule of dbRules) {
+            if (dbRule.type === 'instance') {
+                instanceRoleRules.push({
+                    id: dbRule.id,
+                    expression: dbRule.expression,
+                    role: dbRule.role.slug,
+                    enabled: true,
+                });
+            }
+            else {
+                for (const project of dbRule.projects) {
+                    projectRoleRules.push({
+                        id: `${dbRule.id}:${project.id}`,
+                        expression: dbRule.expression,
+                        role: dbRule.role.slug,
+                        projectId: project.id,
+                        enabled: true,
+                    });
+                }
+            }
+        }
+        return { instanceRoleRules, projectRoleRules, fallbackInstanceRole: 'global:member' };
+    }
+    async applyExpressionMappedRoles(user, resolvedRoles) {
+        await this.applyExpressionMappedInstanceRole(user, resolvedRoles.instanceRole);
+        await this.applyExpressionMappedProjectRoles(user.id, resolvedRoles.projectRoles);
+    }
+    async applyExpressionMappedInstanceRole(user, instanceRoleSlug) {
+        let dbRole;
+        try {
+            dbRole = await this.roleRepository.findOneOrFail({ where: { slug: instanceRoleSlug } });
+        }
+        catch {
+            this.logger.warn(`Expression mapping: skipping instance role, slug "${instanceRoleSlug}" not found`, { userId: user.id });
+            return;
+        }
+        if (dbRole.roleType !== 'global') {
+            this.logger.warn(`Expression mapping: skipping instance role, "${instanceRoleSlug}" is not a global role`, { userId: user.id });
+            return;
+        }
+        const globalOwnerRoleSlug = 'global:owner';
+        if (user.role.slug === globalOwnerRoleSlug && dbRole.slug !== globalOwnerRoleSlug) {
+            const otherOwners = await this.userRepository.count({
+                where: { role: { slug: globalOwnerRoleSlug }, id: (0, typeorm_1.Not)(user.id) },
+            });
+            if (otherOwners === 0) {
+                this.logger.warn('Expression mapping: skipping instance role update, cannot demote last owner', { userId: user.id });
+                return;
+            }
+        }
+        if (user.role.slug !== dbRole.slug) {
+            await this.userService.changeUserRole(user, { newRoleName: dbRole.slug });
+            this.eventService.emit('sso-user-instance-role-updated', {
+                userId: user.id,
+                role: dbRole.slug,
+            });
+        }
+    }
+    async applyExpressionMappedProjectRoles(userId, projectRoleMap) {
+        const currentlyAccessibleProjects = await this.projectRepository.find({
+            where: { type: (0, typeorm_1.Not)('personal'), projectRelations: { userId } },
+            relations: ['projectRelations'],
+        });
+        const validMappings = [];
+        if (projectRoleMap.size > 0) {
+            const projectIds = [...projectRoleMap.keys()];
+            const roleSlugs = [...new Set(projectRoleMap.values())];
+            const [existingProjects, existingRoles] = await Promise.all([
+                this.projectRepository.find({
+                    where: { id: (0, typeorm_1.In)(projectIds), type: (0, typeorm_1.Not)('personal') },
+                    select: ['id'],
+                }),
+                this.roleRepository.find({
+                    where: { slug: (0, typeorm_1.In)(roleSlugs), roleType: 'project' },
+                    select: ['displayName', 'slug'],
+                }),
+            ]);
+            const existingProjectIds = new Set(existingProjects.map((p) => p.id));
+            for (const [projectId, roleSlug] of projectRoleMap.entries()) {
+                if (!existingProjectIds.has(projectId)) {
+                    this.logger.warn(`Expression mapping: skipping project ${projectId}, not found or is a personal project`, { userId, projectId, roleSlug });
+                    continue;
+                }
+                const role = existingRoles.find((r) => r.slug === roleSlug);
+                if (!role) {
+                    this.logger.warn(`Expression mapping: skipping role "${roleSlug}", not found or not a project role`, { userId, projectId, roleSlug });
+                    continue;
+                }
+                validMappings.push({ projectId, roleSlug: role.slug });
+            }
+        }
+        const validProjectIds = new Set(validMappings.map((m) => m.projectId));
+        const projectsToRemoveAccessFrom = currentlyAccessibleProjects.filter((p) => !validProjectIds.has(p.id));
+        if (projectsToRemoveAccessFrom.length === 0 && validMappings.length === 0)
+            return;
+        await this.projectRepository.manager.transaction(async (tx) => {
+            for (const project of projectsToRemoveAccessFrom) {
+                await tx.delete(db_1.ProjectRelation, { projectId: project.id, userId });
+            }
+            for (const { projectId, roleSlug } of validMappings) {
+                await this.projectService.addUser(projectId, { userId, role: roleSlug }, tx);
+            }
+        });
+        this.eventService.emit('sso-user-project-access-updated', {
+            projectsAdded: validProjectIds.size,
+            projectsRemoved: projectsToRemoveAccessFrom.length,
+            userId,
+        });
+    }
+    async provisionExpressionMappedRolesForUser(user, context) {
+        if (!(await this.isExpressionMappingEnabled()))
+            return;
+        const config = await this.buildRoleMappingConfig();
+        const resolvedRoles = await this.roleResolverService.resolveRoles(config, context);
+        await this.applyExpressionMappedRoles(user, resolvedRoles);
+    }
 };
 exports.ProvisioningService = ProvisioningService;
 __decorate([
@@ -293,6 +434,8 @@ exports.ProvisioningService = ProvisioningService = __decorate([
         user_service_1.UserService,
         backend_common_1.Logger,
         publisher_service_1.Publisher,
-        n8n_core_1.InstanceSettings])
+        n8n_core_1.InstanceSettings,
+        db_1.RoleMappingRuleRepository,
+        role_resolver_service_ee_1.RoleResolverService])
 ], ProvisioningService);
 //# sourceMappingURL=provisioning.service.ee.js.map