n8n 2.42.2 → 2.43.0

package/dist/credentials/credentials.service.js

@@ -11,6 +11,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CredentialsService = exports.PENDING_AUTHORIZATION_GRACE_MS = void 0;
 const backend_common_1 = require("@n8n/backend-common");
+const backend_services_1 = require("@n8n/backend-services");
 const constants_1 = require("@n8n/constants");
 const db_1 = require("@n8n/db");
 const di_1 = require("@n8n/di");
@@ -22,11 +23,7 @@ const credential_sharing_1 = require("../constants/credential-sharing");
 const credential_types_1 = require("../credential-types");
 const credentials_helper_1 = require("../credentials-helper");
 const credential_not_found_error_1 = require("../errors/credential-not-found.error");
-const bad_request_error_1 = require("../errors/response-errors/bad-request.error");
-const conflict_error_1 = require("../errors/response-errors/conflict.error");
-const forbidden_error_1 = require("../errors/response-errors/forbidden.error");
-const not_found_error_1 = require("../errors/response-errors/not-found.error");
-const event_service_1 = require("../events/event.service");
+const errors_1 = require("@n8n/errors");
 const external_hooks_1 = require("../external-hooks");
 const generic_helpers_1 = require("../generic-helpers");
 const shared_fields_1 = require("../modules/dynamic-credentials.ee/services/shared-fields");
@@ -39,15 +36,30 @@ const policy_enforcement_service_1 = require("../policy/policy-enforcement.servi
 const credentials_tester_service_1 = require("../services/credentials-tester.service");
 const ownership_service_1 = require("../services/ownership.service");
 const project_service_ee_1 = require("../services/project.service.ee");
-const role_service_1 = require("../services/role.service");
 const credential_connection_status_proxy_1 = require("./credential-connection-status-proxy");
 const credential_descriptions_service_1 = require("./credential-descriptions.service");
 const credential_dependency_service_1 = require("./credential-dependency.service");
-const credentials_finder_service_1 = require("./credentials-finder.service");
 const external_secrets_utils_1 = require("./external-secrets.utils");
 const instance_credential_use_registry_1 = require("./instance-credential-use.registry");
 const validation_1 = require("./validation");
 const CUSTOM_AUTH_JSON_REDACTED_VALUE = '***';
+const CLIENT_CREDENTIALS_GRANT_TYPE = 'clientCredentials';
+const CLIENT_CREDENTIALS_TOKEN_FIELDS = [
+    'grantType',
+    'clientId',
+    'clientCredentialType',
+    'clientSecret',
+    'privateKey',
+    'certificate',
+    'accessTokenUrl',
+    'scope',
+    'additionalBodyProperties',
+];
+function comparableCredentialField(value) {
+    if (value === undefined || value === null)
+        return '';
+    return typeof value === 'object' ? JSON.stringify(value) : String(value);
+}
 function parseHttpUrl(value) {
     if (typeof value !== 'string')
         return undefined;
@@ -411,7 +423,7 @@ let CredentialsService = class CredentialsService {
         else {
             const projectOwningCredential = existingCredential.shared?.find((shared) => shared.role === 'credential:owner');
             if (!projectOwningCredential) {
-                throw new not_found_error_1.NotFoundError(`Could not find owner for credential "${existingCredential.id}"`);
+                throw new errors_1.NotFoundError(`Could not find owner for credential "${existingCredential.id}"`);
             }
             await (0, validation_1.validateExternalSecretsPermissions)({
                 user,
@@ -426,16 +438,25 @@ let CredentialsService = class CredentialsService {
         const updateData = this.credentialsRepository.create(mergedData);
         await (0, generic_helpers_1.validateEntity)(updateData);
         if (dataMerge !== 'replace' && !options?.clearOauthTokenData) {
-            if (decryptedData.oauthTokenData) {
+            this.restoreHiddenDcrFields(existingCredential.type, updateData.data, decryptedData);
+            if (decryptedData.oauthTokenData &&
+                !this.reissuesClientCredentialsToken(updateData.data, decryptedData)) {
                 updateData.data.oauthTokenData = decryptedData.oauthTokenData;
             }
-            this.restoreHiddenDcrFields(existingCredential.type, updateData.data, decryptedData);
         }
         if (updateData.data) {
             this.validateOAuthCredentialUrls(updateData.type, updateData.data);
         }
         return updateData;
     }
+    reissuesClientCredentialsToken(dataToSave, storedData) {
+        if (dataToSave.grantType !== CLIENT_CREDENTIALS_GRANT_TYPE &&
+            storedData.grantType !== CLIENT_CREDENTIALS_GRANT_TYPE) {
+            return false;
+        }
+        return CLIENT_CREDENTIALS_TOKEN_FIELDS.some((field) => comparableCredentialField(dataToSave[field]) !==
+            comparableCredentialField(storedData[field]));
+    }
     restoreHiddenDcrFields(credentialType, dataToSave, storedData) {
         let properties;
         try {
@@ -463,7 +484,7 @@ let CredentialsService = class CredentialsService {
         newCredentialData.updatedAt = new Date();
         return newCredentialData;
     }
-    async clearOauthTokenData(credential) {
+    async clearOauthTokenData(credential, actor) {
         const decryptedData = await (0, credentials_helper_1.createCredentialsFromCredentialsEntity)(credential).getData();
         delete decryptedData.oauthTokenData;
         delete decryptedData.accountIdentifier;
@@ -473,7 +494,7 @@ let CredentialsService = class CredentialsService {
             type: credential.type,
             data: decryptedData,
         });
-        await this.update(credential.id, newCredentialData, decryptedData);
+        await this.update(credential.id, newCredentialData, actor, decryptedData);
     }
     async decrypt(credential, includeRawData = false) {
         const coreCredential = (0, credentials_helper_1.createCredentialsFromCredentialsEntity)(credential);
@@ -496,11 +517,11 @@ let CredentialsService = class CredentialsService {
             throw error;
         }
     }
-    async update(credentialId, newCredentialData, decryptedCredentialData, options) {
+    async update(credentialId, newCredentialData, actor, decryptedCredentialData, options) {
         await this.credentialDescriptions.stripIfDisabled(newCredentialData);
         await this.externalHooks.run('credentials.update', [newCredentialData]);
         await this.credentialDescriptions.stripIfDisabled(newCredentialData);
-        const cleared = await this.enforceCredentialUpdate(credentialId, newCredentialData.type);
+        const cleared = await this.enforceCredentialUpdate(credentialId, newCredentialData.type, actor);
         if (cleared === null)
             return null;
         const persist = async (transactionManager, ctx) => {
@@ -544,17 +565,17 @@ let CredentialsService = class CredentialsService {
     }
     async updateInstanceCredential(user, credentialId, data, ctx, options = {}) {
         if (!(0, permissions_1.hasGlobalScope)(user, 'credential:manageInstance')) {
-            throw new forbidden_error_1.ForbiddenError('You do not have permission to update provider connections');
+            throw new errors_1.ForbiddenError('You do not have permission to update provider connections');
         }
         const credential = await this.credentialsRepository.findInstanceCredentialById(credentialId, ctx);
         if (!credential) {
-            throw new not_found_error_1.NotFoundError(`Credential with ID "${credentialId}" could not be found.`);
+            throw new errors_1.NotFoundError(`Credential with ID "${credentialId}" could not be found.`);
         }
         const prepared = await this.prepareUpdateData(user, data, credential, {
             operationContext: ctx,
         });
         if (prepared.type !== credential.type) {
-            throw new bad_request_error_1.BadRequestError('Provider connection type cannot be changed. Create a new connection instead.');
+            throw new errors_1.BadRequestError('Provider connection type cannot be changed. Create a new connection instead.');
         }
         const decryptedData = prepared.data;
         const encrypted = options.encryptedData ??
@@ -577,10 +598,10 @@ let CredentialsService = class CredentialsService {
             credential: { id: credential.id, type: credential.type },
             storedCredential: { id: credential.id, type: credential.type },
             projectId: null,
-        });
+        }, { kind: 'user', user });
         const updated = await this.credentialsRepository.updateInstanceCredential(credential.id, encrypted, { ...ctx, policyCleared: cleared });
         if (!updated) {
-            throw new not_found_error_1.NotFoundError(`Credential with ID "${credentialId}" could not be found.`);
+            throw new errors_1.NotFoundError(`Credential with ID "${credentialId}" could not be found.`);
         }
         await this.credentialDescriptions.stripIfDisabled(updated);
         return updated;
@@ -603,11 +624,11 @@ let CredentialsService = class CredentialsService {
         ]);
         if (project === null) {
             if (!(await this.projectRepository.existsBy({ id: projectId }))) {
-                throw new not_found_error_1.NotFoundError('Project not found');
+                throw new errors_1.NotFoundError('Project not found');
             }
-            throw new forbidden_error_1.ForbiddenError("You don't have the permissions to save the credential in this project.");
+            throw new errors_1.ForbiddenError("You don't have the permissions to save the credential in this project.");
         }
-        const cleared = await this.enforceCredentialCreate(newCredential.type, project.id);
+        const cleared = await this.enforceCredentialCreate(newCredential.type, project.id, user);
         const result = await this.credentialsRepository.runInTransaction({ policyCleared: cleared }, async (transactionManager, ctx) => {
             const savedCredential = await this.credentialsRepository.createContent(newCredential, ctx);
             savedCredential.data = newCredential.data;
@@ -633,7 +654,7 @@ let CredentialsService = class CredentialsService {
         await this.credentialDescriptions.stripIfDisabled(result);
         return result;
     }
-    async enforceCredentialUpdate(credentialId, newType) {
+    async enforceCredentialUpdate(credentialId, newType, actor) {
         const stored = await this.credentialsRepository.findOneBy({ id: credentialId });
         if (!stored)
             return null;
@@ -642,14 +663,10 @@ let CredentialsService = class CredentialsService {
             credential: { id: credentialId, type: newType ?? stored.type },
             storedCredential: { id: credentialId, type: stored.type },
             projectId: owningProject?.id ?? null,
-        });
+        }, actor);
     }
-    async enforceCredentialCreate(type, projectId) {
-        return await this.policyEnforcementService.enforceCredentialSave({
-            credential: { id: null, type },
-            storedCredential: null,
-            projectId,
-        });
+    async enforceCredentialCreate(type, projectId, user) {
+        return await this.policyEnforcementService.enforceCredentialSave({ credential: { id: null, type }, storedCredential: null, projectId }, { kind: 'user', user });
     }
     async insertProjectCredential(credential, encryptedData, user, projectId, decryptedCredentialData) {
         const newCredential = this.credentialsRepository.create({ ...credential, ...encryptedData });
@@ -662,11 +679,11 @@ let CredentialsService = class CredentialsService {
         ]);
         if (project === null) {
             if (!(await this.projectRepository.existsBy({ id: projectId }))) {
-                throw new not_found_error_1.NotFoundError('Project not found');
+                throw new errors_1.NotFoundError('Project not found');
             }
-            throw new forbidden_error_1.ForbiddenError("You don't have the permissions to save the credential in this project.");
+            throw new errors_1.ForbiddenError("You don't have the permissions to save the credential in this project.");
         }
-        const cleared = await this.enforceCredentialCreate(newCredential.type, project.id);
+        const cleared = await this.enforceCredentialCreate(newCredential.type, project.id, user);
         const saved = await this.transactionRunner.run({ policyCleared: cleared }, async (ctx) => {
             return await this.credentialsRepository.insertProjectCredentialWithOwner(newCredential, project.id, externalSecretProviderIds, ctx);
         });
@@ -703,7 +720,7 @@ let CredentialsService = class CredentialsService {
         if (credential.usageScope === 'instance') {
             const result = await this.credentialsRepository.deleteInstanceCredentialIfUnassigned(credential.id);
             if (result.status === 'assigned') {
-                throw new bad_request_error_1.BadRequestError(`This credential is assigned to credential use "${result.credentialUseIds.join(', ')}" and cannot be deleted`);
+                throw new errors_1.BadRequestError(`This credential is assigned to credential use "${result.credentialUseIds.join(', ')}" and cannot be deleted`);
             }
             if (result.status === 'deleted') {
                 this.emitCredentialDeleted(user, credential, owningProject?.id);
@@ -764,14 +781,14 @@ let CredentialsService = class CredentialsService {
         const data = await this.decrypt(storedCredential, true);
         const testTarget = parseHttpUrl(data.testUrl);
         if (!testTarget) {
-            throw new bad_request_error_1.BadRequestError('The credential has no test URL to probe');
+            throw new errors_1.BadRequestError('The credential has no test URL to probe');
         }
         const storedOrigin = typeof data.serviceOrigin === 'string' ? data.serviceOrigin.trim() : '';
         const serviceOrigin = parseHttpUrl(storedOrigin);
         if (!serviceOrigin ||
             serviceOrigin.origin !== storedOrigin ||
             serviceOrigin.origin !== testTarget.origin) {
-            throw new bad_request_error_1.BadRequestError('The credential test URL is not bound to its service origin');
+            throw new errors_1.BadRequestError('The credential test URL is not bound to its service origin');
         }
         return await this.credentialsTester.probeCredentialAuth(user.id, storedCredential.type, {
             id: storedCredential.id,
@@ -986,7 +1003,7 @@ let CredentialsService = class CredentialsService {
             sharing = await this.getSharing(user, credentialId, ['credential:read']);
         }
         if (!sharing) {
-            throw new not_found_error_1.NotFoundError(`Credential with ID "${credentialId}" could not be found.`);
+            throw new errors_1.NotFoundError(`Credential with ID "${credentialId}" could not be found.`);
         }
         const { credentials: credential } = sharing;
         const { data: _, ...rest } = credential;
@@ -1058,7 +1075,7 @@ let CredentialsService = class CredentialsService {
     }
     async createInstanceCredential(dto, user, ctx, options = {}) {
         if (dto.usageScope !== 'instance') {
-            throw new bad_request_error_1.BadRequestError('Provider connections must use instance usage scope');
+            throw new errors_1.BadRequestError('Provider connections must use instance usage scope');
         }
         return await this.persistInstanceCredential({ ...dto, isManaged: false }, user, ctx, options);
     }
@@ -1079,7 +1096,7 @@ let CredentialsService = class CredentialsService {
         }
         catch (error) {
             if (error instanceof db_1.CredentialIdConflictError) {
-                throw new bad_request_error_1.BadRequestError(`Cannot create credential stub: a credential with id "${opts.id}" already exists`);
+                throw new errors_1.BadRequestError(`Cannot create credential stub: a credential with id "${opts.id}" already exists`);
             }
             throw error;
         }
@@ -1097,7 +1114,7 @@ let CredentialsService = class CredentialsService {
                 const value = data[property.name];
                 const hasDefault = property.default !== undefined && property.default !== null && property.default !== '';
                 if ((value === undefined || value === null || value === '') && !hasDefault) {
-                    throw new bad_request_error_1.BadRequestError(`The field "${property.name}" is mandatory for credentials of type "${type}"`);
+                    throw new errors_1.BadRequestError(`The field "${property.name}" is mandatory for credentials of type "${type}"`);
                 }
             }
         }
@@ -1138,23 +1155,23 @@ let CredentialsService = class CredentialsService {
     }
     ensureEndUserCredentialAllowedInProject(project) {
         if (project?.type === 'personal') {
-            throw new forbidden_error_1.ForbiddenError('End-user credentials are not available in personal projects');
+            throw new errors_1.ForbiddenError('End-user credentials are not available in personal projects');
         }
     }
     async ensureCanManageEndUserCredential(user, projectId) {
         const allowed = projectId !== undefined &&
             (await (0, check_access_1.userHasScopes)(user, ['credential:createEndUser'], false, { projectId }));
         if (!allowed) {
-            throw new forbidden_error_1.ForbiddenError('You do not have permission to manage end-user credentials in this project');
+            throw new errors_1.ForbiddenError('You do not have permission to manage end-user credentials in this project');
         }
     }
     async createCredential(opts, user, options = {}) {
         if (opts.pendingAuthorization && (opts.isResolvable || opts.usageScope === 'instance')) {
-            throw new bad_request_error_1.BadRequestError('Pending authorization is only supported for project-scoped, non-resolvable credentials');
+            throw new errors_1.BadRequestError('Pending authorization is only supported for project-scoped, non-resolvable credentials');
         }
         if (opts.usageScope === 'instance') {
             if (options.id !== undefined) {
-                throw new bad_request_error_1.BadRequestError('A supplied ID requires project usage scope');
+                throw new errors_1.BadRequestError('A supplied ID requires project usage scope');
             }
             const savedCredential = await this.persistInstanceCredential(opts, user, {});
             const scopes = await this.getCredentialScopes(user, savedCredential.id);
@@ -1184,7 +1201,7 @@ let CredentialsService = class CredentialsService {
         if (isGlobal === true) {
             const canShareGlobally = (0, permissions_1.hasGlobalScope)(user, 'credential:shareGlobally');
             if (!canShareGlobally) {
-                throw new forbidden_error_1.ForbiddenError('You do not have permission to create globally shared credentials');
+                throw new errors_1.ForbiddenError('You do not have permission to create globally shared credentials');
             }
             encryptedCredential.isGlobal = isGlobal;
         }
@@ -1199,7 +1216,7 @@ let CredentialsService = class CredentialsService {
         const persist = options.id === undefined ? this.save.bind(this) : this.insertProjectCredential.bind(this);
         const { shared, ...credential } = await persist(credentialEntity, encryptedCredential, user, targetProjectId, opts.data).catch((error) => {
             if (error instanceof db_1.CredentialIdConflictError) {
-                throw new conflict_error_1.ConflictError('A credential with this ID already exists');
+                throw new errors_1.ConflictError('A credential with this ID already exists');
             }
             throw error;
         });
@@ -1209,13 +1226,13 @@ let CredentialsService = class CredentialsService {
     }
     async persistInstanceCredential(opts, user, ctx, options = {}) {
         if (!(0, permissions_1.hasGlobalScope)(user, 'credential:manageInstance')) {
-            throw new forbidden_error_1.ForbiddenError('You do not have permission to create provider connections');
+            throw new errors_1.ForbiddenError('You do not have permission to create provider connections');
         }
         if (opts.isGlobal === true) {
-            throw new bad_request_error_1.BadRequestError('Provider connections cannot be globally shared');
+            throw new errors_1.BadRequestError('Provider connections cannot be globally shared');
         }
         if (opts.isResolvable === true || opts.isManaged) {
-            throw new bad_request_error_1.BadRequestError('Provider connections cannot be end-user or managed credentials');
+            throw new errors_1.BadRequestError('Provider connections cannot be end-user or managed credentials');
         }
         const data = opts.data;
         this.validateInstanceCredentialData(data);
@@ -1243,7 +1260,7 @@ let CredentialsService = class CredentialsService {
             isResolvable: false,
             usageScope: 'instance',
         });
-        const cleared = await this.enforceCredentialCreate(credentialEntity.type, null);
+        const cleared = await this.enforceCredentialCreate(credentialEntity.type, null, user);
         const savedCredential = await this.credentialsRepository.saveInstanceCredential(credentialEntity, { ...ctx, policyCleared: cleared });
         this.logger.debug('New instance credential created', {
             credentialId: savedCredential.id,
@@ -1254,10 +1271,10 @@ let CredentialsService = class CredentialsService {
     }
     async getValidatedInstanceCredentialHookData(credential, expectedId, expectedType) {
         if ((credential.id ?? null) !== expectedId) {
-            throw new bad_request_error_1.BadRequestError('Provider connection hooks cannot change the credential ID');
+            throw new errors_1.BadRequestError('Provider connection hooks cannot change the credential ID');
         }
         if (credential.type !== expectedType) {
-            throw new bad_request_error_1.BadRequestError('Provider connection hooks cannot change the credential type');
+            throw new errors_1.BadRequestError('Provider connection hooks cannot change the credential type');
         }
         if (credential.isGlobal ||
             credential.isManaged ||
@@ -1265,21 +1282,21 @@ let CredentialsService = class CredentialsService {
             credential.resolvableAllowFallback ||
             (credential.resolverId !== undefined && credential.resolverId !== null) ||
             (credential.usageScope !== undefined && credential.usageScope !== 'instance')) {
-            throw new bad_request_error_1.BadRequestError('Provider connection hooks cannot change the credential scope');
+            throw new errors_1.BadRequestError('Provider connection hooks cannot change the credential scope');
         }
         try {
             return await (0, credentials_helper_1.createCredentialsFromCredentialsEntity)(credential).getData();
         }
         catch (error) {
             if (error instanceof n8n_core_1.CredentialDataError) {
-                throw new bad_request_error_1.BadRequestError('Provider connection hooks returned invalid credential data');
+                throw new errors_1.BadRequestError('Provider connection hooks returned invalid credential data');
             }
             throw error;
         }
     }
     validateInstanceCredentialData(data) {
         if ((0, external_secrets_utils_1.getExternalSecretExpressionPaths)(data).length > 0) {
-            throw new bad_request_error_1.BadRequestError('Provider connections cannot reference project-scoped external secrets');
+            throw new errors_1.BadRequestError('Provider connections cannot reference project-scoped external secrets');
         }
     }
     async validateInstanceCredentialUpdate(credential, data, credentialUseIds, ctx = {}) {
@@ -1289,7 +1306,7 @@ let CredentialsService = class CredentialsService {
         for (const credentialUseId of assignedUseIds) {
             const credentialUse = this.instanceCredentialUseRegistry.get(credentialUseId);
             if (!credentialUse.credentialTypes.includes(credential.type)) {
-                throw new bad_request_error_1.BadRequestError(`Credential type "${credential.type}" is not valid for instance credential use "${credentialUseId}"`);
+                throw new errors_1.BadRequestError(`Credential type "${credential.type}" is not valid for instance credential use "${credentialUseId}"`);
             }
             credentialUse.validate?.({ type: credential.type, data });
         }
@@ -1330,6 +1347,6 @@ let CredentialsService = class CredentialsService {
 exports.CredentialsService = CredentialsService;
 exports.CredentialsService = CredentialsService = __decorate([
     (0, di_1.Service)(),
-    __metadata("design:paramtypes", [db_1.CredentialsRepository, credential_dependency_service_1.CredentialDependencyService, db_1.SharedCredentialsRepository, ownership_service_1.OwnershipService, backend_common_1.Logger, n8n_core_1.ErrorReporter, credentials_tester_service_1.CredentialsTester, external_hooks_1.ExternalHooks, credential_types_1.CredentialTypes, db_1.ProjectRepository, project_service_ee_1.ProjectService, role_service_1.RoleService, db_1.UserRepository, credentials_finder_service_1.CredentialsFinderService, credentials_helper_1.CredentialsHelper, external_secrets_config_1.ExternalSecretsConfig, secret_provider_access_check_service_ee_1.SecretsProviderAccessCheckService, credential_connection_status_proxy_1.CredentialConnectionStatusProxy, db_1.InstanceCredentialAssignmentRepository, instance_credential_use_registry_1.InstanceCredentialUseRegistry, db_1.DbLockService, event_service_1.EventService, db_1.TransactionRunner, policy_enforcement_service_1.PolicyEnforcementService, credential_descriptions_service_1.CredentialDescriptionsService])
+    __metadata("design:paramtypes", [db_1.CredentialsRepository, credential_dependency_service_1.CredentialDependencyService, db_1.SharedCredentialsRepository, ownership_service_1.OwnershipService, backend_common_1.Logger, n8n_core_1.ErrorReporter, credentials_tester_service_1.CredentialsTester, external_hooks_1.ExternalHooks, credential_types_1.CredentialTypes, db_1.ProjectRepository, project_service_ee_1.ProjectService, backend_services_1.RoleService, db_1.UserRepository, backend_services_1.CredentialsFinderService, credentials_helper_1.CredentialsHelper, external_secrets_config_1.ExternalSecretsConfig, secret_provider_access_check_service_ee_1.SecretsProviderAccessCheckService, credential_connection_status_proxy_1.CredentialConnectionStatusProxy, db_1.InstanceCredentialAssignmentRepository, instance_credential_use_registry_1.InstanceCredentialUseRegistry, db_1.DbLockService, backend_services_1.EventService, db_1.TransactionRunner, policy_enforcement_service_1.PolicyEnforcementService, credential_descriptions_service_1.CredentialDescriptionsService])
 ], CredentialsService);
 //# sourceMappingURL=credentials.service.js.map