n8n 2.45.1 → 2.45.3

package/dist/modules/type-availability-policies/type-availability-policy-snapshot.js

@@ -0,0 +1,138 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TypeAvailabilityPolicySnapshot = exports.FINGERPRINT_POLL_INTERVAL_MS = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const constants_1 = require("@n8n/constants");
+const decorators_1 = require("@n8n/decorators");
+const di_1 = require("@n8n/di");
+const publisher_service_1 = require("../../scaling/pubsub/publisher.service");
+const type_availability_policy_attachment_repository_1 = require("./database/repositories/type-availability-policy-attachment.repository");
+const type_availability_policy_scope_repository_1 = require("./database/repositories/type-availability-policy-scope.repository");
+const effective_policy_1 = require("./effective-policy");
+exports.FINGERPRINT_POLL_INTERVAL_MS = 30 * constants_1.Time.seconds.toMilliseconds;
+function scopeKey(kind, projectId) {
+    return `${kind}:${projectId ?? 'instance'}`;
+}
+function sameFingerprint(a, b) {
+    return (a.count === b.count && a.versionSum === b.versionSum && a.newestCreatedAt === b.newestCreatedAt);
+}
+let TypeAvailabilityPolicySnapshot = class TypeAvailabilityPolicySnapshot {
+    constructor(scopeRepository, attachmentRepository, publisher, logger) {
+        this.scopeRepository = scopeRepository;
+        this.attachmentRepository = attachmentRepository;
+        this.publisher = publisher;
+        this.logger = logger;
+        this.loaded = null;
+        this.queue = Promise.resolve();
+        this.pending = null;
+        this.polling = false;
+        this.logger = this.logger.scoped('policy');
+    }
+    read(kind, projectId) {
+        if (!this.loaded)
+            return null;
+        return this.loaded.scopes.get(scopeKey(kind, projectId)) ?? (0, effective_policy_1.unconfiguredScope)(kind, projectId);
+    }
+    projectScopes(kind) {
+        if (!this.loaded)
+            return null;
+        return [...this.loaded.scopes.values()].filter((scope) => scope.kind === kind && scope.projectId !== null);
+    }
+    async start() {
+        await this.reloadAndLog();
+        this.pollTimer ??= setInterval(async () => await this.poll(), exports.FINGERPRINT_POLL_INTERVAL_MS);
+        this.pollTimer.unref();
+    }
+    stop() {
+        clearInterval(this.pollTimer);
+        this.pollTimer = undefined;
+    }
+    async refreshAfterWrite() {
+        await this.reloadAndLog();
+        void this.publisher
+            .publishCommand({ command: 'reload-type-availability-policies' })
+            .catch((error) => {
+            this.logger.warn('Failed to tell other processes to reload type availability policies', {
+                error,
+            });
+        });
+    }
+    async handleReloadRequest() {
+        await this.reloadAndLog();
+    }
+    async reload() {
+        this.pending ??= this.queue.then(async () => {
+            this.pending = null;
+            await this.load();
+        });
+        const pending = this.pending;
+        this.queue = pending.catch(() => { });
+        await pending;
+    }
+    async reloadAndLog() {
+        try {
+            await this.reload();
+        }
+        catch (error) {
+            this.logger.error('Failed to load type availability policies', { error });
+        }
+    }
+    async load() {
+        const fingerprint = await this.scopeRepository.readFingerprint({});
+        const scopes = await this.scopeRepository.findAllScopes({});
+        const attachmentsByScope = await this.attachmentRepository.listAttachmentsForScopes(scopes.map((scope) => scope.id), {});
+        const byKey = new Map();
+        for (const scope of scopes) {
+            byKey.set(scopeKey(scope.kind, scope.projectId), (0, effective_policy_1.toEffectivePolicy)(scope, attachmentsByScope.get(scope.id) ?? []));
+        }
+        this.loaded = { scopes: byKey, fingerprint };
+    }
+    async poll() {
+        if (this.polling)
+            return;
+        this.polling = true;
+        try {
+            if (this.loaded) {
+                const fingerprint = await this.scopeRepository.readFingerprint({});
+                if (sameFingerprint(fingerprint, this.loaded.fingerprint))
+                    return;
+                this.logger.info('Type availability policies changed without a reload message');
+            }
+            await this.reload();
+        }
+        catch (error) {
+            this.logger.error('Failed to check type availability policies for changes', { error });
+        }
+        finally {
+            this.polling = false;
+        }
+    }
+};
+exports.TypeAvailabilityPolicySnapshot = TypeAvailabilityPolicySnapshot;
+__decorate([
+    (0, decorators_1.OnShutdown)(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], TypeAvailabilityPolicySnapshot.prototype, "stop", null);
+__decorate([
+    (0, decorators_1.OnPubSubEvent)('reload-type-availability-policies'),
+    (0, decorators_1.OnPubSubEvent)('pubsub-reconnected'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], TypeAvailabilityPolicySnapshot.prototype, "handleReloadRequest", null);
+exports.TypeAvailabilityPolicySnapshot = TypeAvailabilityPolicySnapshot = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [type_availability_policy_scope_repository_1.TypeAvailabilityPolicyScopeRepository, type_availability_policy_attachment_repository_1.TypeAvailabilityPolicyAttachmentRepository, publisher_service_1.Publisher, backend_common_1.Logger])
+], TypeAvailabilityPolicySnapshot);
+//# sourceMappingURL=type-availability-policy-snapshot.js.map

package/dist/modules/type-availability-policies/type-availability-policy-snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"type-availability-policy-snapshot.js","sourceRoot":"","sources":["../../../src/modules/type-availability-policies/type-availability-policy-snapshot.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;AAC7C,8CAAsC;AACtC,gDAA4D;AAC5D,gCAAkC;AAElC,0EAA+D;AAE/D,2IAAoI;AACpI,iIAG2E;AAC3E,yDAK4B;AAGf,QAAA,4BAA4B,GAAG,EAAE,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,CAAC;AAO7E,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAwB;IACvD,OAAO,GAAG,IAAI,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,eAAe,CAAC,CAAmB,EAAE,CAAmB;IAChE,OAAO,CACN,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,eAAe,CAC/F,CAAC;AACH,CAAC;AAUM,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;IAa1C,YACkB,eAAsD,EACtD,oBAAgE,EAChE,SAAoB,EACpB,MAAc;QAHd,oBAAe,GAAf,eAAe,CAAuC;QACtD,yBAAoB,GAApB,oBAAoB,CAA4C;QAChE,cAAS,GAAT,SAAS,CAAW;QACpB,WAAM,GAAN,MAAM,CAAQ;QAhBxB,WAAM,GAAkB,IAAI,CAAC;QAG7B,UAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;QAGzC,YAAO,GAAyB,IAAI,CAAC;QAIrC,YAAO,GAAG,KAAK,CAAC;QAQvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAGD,IAAI,CAAC,IAAY,EAAE,SAAwB;QAC1C,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAE9B,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,IAAI,IAAA,oCAAiB,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChG,CAAC;IAGD,aAAa,CAAC,IAAY;QACzB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAE9B,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAC7C,CAAC,KAAK,EAAmC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAC3F,CAAC;IACH,CAAC;IAGD,KAAK,CAAC,KAAK;QACV,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAE1B,IAAI,CAAC,SAAS,KAAK,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,QAAA,4BAA4B,CAAC,CAAC;QAC5F,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAGD,IAAI;QACH,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC5B,CAAC;IAGD,KAAK,CAAC,iBAAiB;QACtB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAG1B,KAAK,IAAI,CAAC,SAAS;aACjB,cAAc,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;aAChE,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qEAAqE,EAAE;gBACvF,KAAK;aACL,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAIK,AAAN,KAAK,CAAC,mBAAmB;QACxB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IAC3B,CAAC;IAGD,KAAK,CAAC,MAAM;QACX,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC3C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAErC,MAAM,OAAO,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,YAAY;QACzB,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,IAAI;QAEjB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC5D,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,wBAAwB,CAClF,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAC/B,EAAE,CACF,CAAC;QAEF,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;QACjD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC5B,KAAK,CAAC,GAAG,CACR,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,EACrC,IAAA,oCAAiB,EAAC,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAChE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC9C,CAAC;IAEO,KAAK,CAAC,IAAI;QACjB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpB,IAAI,CAAC;YACJ,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;gBACnE,IAAI,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;oBAAE,OAAO;gBAElE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wDAAwD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,CAAC;gBAAS,CAAC;YACV,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACtB,CAAC;IACF,CAAC;CACD,CAAA;;AArFA;IADC,IAAA,uBAAU,GAAE;;;;0DAIZ;AAkBK;IAFL,IAAA,0BAAa,EAAC,mCAAmC,CAAC;IAClD,IAAA,0BAAa,EAAC,oBAAoB,CAAC;;;;yEAGnC;yCAtEW,8BAA8B;IAD1C,IAAA,YAAO,GAAE;qCAe0B,iFAAqC,EAChC,2FAA0C,EACrD,6BAAS,EACZ,uBAAM;GAjBpB,8BAA8B,CAoI1C"}

package/dist/modules/type-availability-policies/type-availability-policy.service.d.ts

@@ -1,6 +1,5 @@
 import type { NodeTypeAvailabilityScope } from '@n8n/api-types';
-import { Logger } from '@n8n/backend-common';
-import { CacheService, EventService } from '@n8n/backend-services';
+import { EventService } from '@n8n/backend-services';
 import { TransactionRunner, type OperationContext } from '@n8n/db';
 import { LoadNodesAndCredentials } from '../../load-nodes-and-credentials';
 import { NodeTypes } from '../../node-types';
@@ -9,24 +8,17 @@ import { TypeAvailabilityPolicyScopeRepository } from './database/repositories/t
 import { TypeAvailabilityPolicyRepository } from './database/repositories/type-availability-policy.repository';
 import type { TypeAvailabilityPolicy } from './database/entities/type-availability-policy.entity';
 import type { TypeAvailabilityPolicyScope } from './database/entities/type-availability-policy-scope.entity';
+import { type EffectivePolicy } from './effective-policy';
 import { type ComposedVerdict } from './policy-evaluator';
 import type { PolicyAction, PolicyAttachment, PolicyRule } from './policy-rule.types';
 import { type PolicyRuleWarning } from './policy-rule-lint';
-export declare const LOCAL_READ_MAX_ENTRIES = 512;
+import { TypeAvailabilityPolicySnapshot } from './type-availability-policy-snapshot';
+export type { EffectivePolicy } from './effective-policy';
 export type AttachmentInput = {
     readonly policyId: string;
     readonly priority: number;
     readonly isFloor: boolean;
 };
-export type EffectivePolicy = {
-    readonly scopeId: string | null;
-    readonly kind: string;
-    readonly projectId: string | null;
-    readonly defaultAction: PolicyAction;
-    readonly version: number;
-    readonly rules: readonly PolicyRule[];
-    readonly attachments: readonly PolicyAttachment[];
-};
 export type ScopeAttachments = {
     readonly attachments: readonly PolicyAttachment[];
     readonly version: number;
@@ -51,14 +43,10 @@ export declare class TypeAvailabilityPolicyService {
     private readonly attachmentRepository;
     private readonly transactionRunner;
     private readonly eventService;
-    private readonly cacheService;
+    private readonly snapshot;
     private readonly loadNodesAndCredentials;
     private readonly nodeTypes;
-    private readonly logger;
-    constructor(policyRepository: TypeAvailabilityPolicyRepository, scopeRepository: TypeAvailabilityPolicyScopeRepository, attachmentRepository: TypeAvailabilityPolicyAttachmentRepository, transactionRunner: TransactionRunner, eventService: EventService, cacheService: CacheService, loadNodesAndCredentials: LoadNodesAndCredentials, nodeTypes: NodeTypes, logger: Logger);
-    private readonly localReads;
-    private invalidations;
-    private readonly repeatDeletes;
+    constructor(policyRepository: TypeAvailabilityPolicyRepository, scopeRepository: TypeAvailabilityPolicyScopeRepository, attachmentRepository: TypeAvailabilityPolicyAttachmentRepository, transactionRunner: TransactionRunner, eventService: EventService, snapshot: TypeAvailabilityPolicySnapshot, loadNodesAndCredentials: LoadNodesAndCredentials, nodeTypes: NodeTypes);
     getEffectivePolicy(kind: string, projectId: string | null, ctx?: OperationContext): Promise<EffectivePolicy>;
     setDefaultAction(kind: string, projectId: string | null, defaultAction: PolicyAction, expectedVersion: number, updatedBy: string): Promise<TypeAvailabilityPolicyScope>;
     private createScopeOrConflict;
@@ -96,11 +84,6 @@ export declare class TypeAvailabilityPolicyService {
     }>;
     private verdictComposer;
     private readComposedScopes;
-    private readEffectivePolicyCached;
-    private readScope;
-    private canPublish;
-    resetLocalCaches(): void;
-    private invalidateScopes;
-    private dropCacheKeys;
+    private readEnforcedScope;
+    private readProjectScopes;
 }
-export {};

package/dist/modules/type-availability-policies/type-availability-policy.service.js

@@ -9,13 +9,10 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TypeAvailabilityPolicyService = exports.LOCAL_READ_MAX_ENTRIES = void 0;
-const backend_common_1 = require("@n8n/backend-common");
+exports.TypeAvailabilityPolicyService = void 0;
 const backend_services_1 = require("@n8n/backend-services");
-const constants_1 = require("@n8n/constants");
 const db_1 = require("@n8n/db");
 const di_1 = require("@n8n/di");
-const lru_cache_1 = require("lru-cache");
 const n8n_workflow_1 = require("n8n-workflow");
 const errors_1 = require("@n8n/errors");
 const load_nodes_and_credentials_1 = require("../../load-nodes-and-credentials");
@@ -23,56 +20,12 @@ const node_types_1 = require("../../node-types");
 const type_availability_policy_attachment_repository_1 = require("./database/repositories/type-availability-policy-attachment.repository");
 const type_availability_policy_scope_repository_1 = require("./database/repositories/type-availability-policy-scope.repository");
 const type_availability_policy_repository_1 = require("./database/repositories/type-availability-policy.repository");
-const constants_2 = require("./constants");
+const constants_1 = require("./constants");
+const effective_policy_1 = require("./effective-policy");
 const package_resolver_1 = require("./package-resolver");
 const policy_evaluator_1 = require("./policy-evaluator");
 const policy_rule_lint_1 = require("./policy-rule-lint");
-const UNCONFIGURED_VERSION = 0;
-const SCOPE_CACHE_TTL_MS = 10 * constants_1.Time.minutes.toMilliseconds;
-const LOCAL_READ_TTL_MS = 1 * constants_1.Time.seconds.toMilliseconds;
-exports.LOCAL_READ_MAX_ENTRIES = 512;
-const INVALIDATION_REPEAT_DELAY_MS = 1 * constants_1.Time.seconds.toMilliseconds;
-const CACHE_CALL_TIMEOUT_MS = 50;
-function scopeCacheKey(kind, projectId) {
-    return `type-availability-policy:scope:${kind}:${projectId ?? 'instance'}`;
-}
-async function withCacheTimeout(call) {
-    call.catch(() => { });
-    let timer;
-    try {
-        return await Promise.race([
-            call,
-            new Promise((_, reject) => {
-                timer = setTimeout(() => reject(new n8n_workflow_1.OperationalError('Policy cache call timed out')), CACHE_CALL_TIMEOUT_MS);
-            }),
-        ]);
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
-const UNCONFIGURED_PROJECT = {
-    scopeId: null,
-    projectId: null,
-    defaultAction: 'allow',
-    version: UNCONFIGURED_VERSION,
-    rules: [],
-    attachments: [],
-};
-function toEffectivePolicy(scope, attachments) {
-    return {
-        scopeId: scope.id,
-        kind: scope.kind,
-        projectId: scope.projectId,
-        defaultAction: scope.defaultAction,
-        version: scope.version,
-        rules: flattenRules(attachments),
-        attachments,
-    };
-}
-function flattenRules(attachments) {
-    return (0, policy_evaluator_1.orderedAttachments)(attachments).flatMap((attachment) => [...attachment.rules]);
-}
+const type_availability_policy_snapshot_1 = require("./type-availability-policy-snapshot");
 function rulesContainDelegate(rules) {
     return rules.some((rule) => rule.action === 'delegate');
 }
@@ -88,7 +41,7 @@ function assertNoDelegateAtProjectScope(projectId, defaultAction, rules = []) {
     }
 }
 function assertNoCredentialOnlyNodeRules(kind, rules) {
-    if (kind !== constants_2.NODE_TYPES_KIND)
+    if (kind !== constants_1.NODE_TYPES_KIND)
         return;
     for (const rule of rules) {
         if (rule.selector.kind === 'name' && (0, n8n_workflow_1.isCredentialOnlyNodeType)(rule.selector.value)) {
@@ -105,7 +58,7 @@ function assertNoCredentialOnlyPackageRules(rules) {
     }
 }
 function assertExtendsSelectorsValid(kind, rules) {
-    if (kind === constants_2.CREDENTIAL_TYPES_KIND)
+    if (kind === constants_1.CREDENTIAL_TYPES_KIND)
         return;
     if (rules.some((rule) => rule.selector.kind === 'extends')) {
         throw new n8n_workflow_1.UserError('An "extends" rule is only valid in a credential type policy');
@@ -127,42 +80,28 @@ function assertNoDuplicateAttachmentSlots(attachments) {
     }
 }
 let TypeAvailabilityPolicyService = class TypeAvailabilityPolicyService {
-    constructor(policyRepository, scopeRepository, attachmentRepository, transactionRunner, eventService, cacheService, loadNodesAndCredentials, nodeTypes, logger) {
+    constructor(policyRepository, scopeRepository, attachmentRepository, transactionRunner, eventService, snapshot, loadNodesAndCredentials, nodeTypes) {
         this.policyRepository = policyRepository;
         this.scopeRepository = scopeRepository;
         this.attachmentRepository = attachmentRepository;
         this.transactionRunner = transactionRunner;
         this.eventService = eventService;
-        this.cacheService = cacheService;
+        this.snapshot = snapshot;
         this.loadNodesAndCredentials = loadNodesAndCredentials;
         this.nodeTypes = nodeTypes;
-        this.logger = logger;
-        this.localReads = new lru_cache_1.LRUCache({ max: exports.LOCAL_READ_MAX_ENTRIES });
-        this.invalidations = 0;
-        this.repeatDeletes = new Set();
-        this.logger = this.logger.scoped('policy');
     }
     async getEffectivePolicy(kind, projectId, ctx = {}) {
         const scope = await this.scopeRepository.findScopeByKindAndProject(kind, projectId, ctx);
-        if (!scope) {
-            return {
-                scopeId: null,
-                kind,
-                projectId,
-                defaultAction: 'allow',
-                version: UNCONFIGURED_VERSION,
-                rules: [],
-                attachments: [],
-            };
-        }
+        if (!scope)
+            return (0, effective_policy_1.unconfiguredScope)(kind, projectId);
         const attachments = await this.attachmentRepository.listAttachmentsForScope(scope.id, ctx);
-        return toEffectivePolicy(scope, attachments);
+        return (0, effective_policy_1.toEffectivePolicy)(scope, attachments);
     }
     async setDefaultAction(kind, projectId, defaultAction, expectedVersion, updatedBy) {
         assertNoDelegateAtProjectScope(projectId, defaultAction);
         const result = await this.transactionRunner.run({}, async (ctx) => {
             const scope = await this.scopeRepository.findScopeByKindAndProject(kind, projectId, ctx, true);
-            const currentVersion = scope?.version ?? UNCONFIGURED_VERSION;
+            const currentVersion = scope?.version ?? effective_policy_1.UNCONFIGURED_VERSION;
             if (currentVersion !== expectedVersion) {
                 throw new errors_1.ConflictError(`Policy scope has changed since it was last read (expected version ${expectedVersion}, found ${currentVersion})`);
             }
@@ -176,7 +115,7 @@ let TypeAvailabilityPolicyService = class TypeAvailabilityPolicyService {
             return { before, after };
         });
         if (result.before === null || result.before.version !== result.after.version) {
-            await this.invalidateScopes([{ kind, projectId }]);
+            await this.snapshot.refreshAfterWrite();
         }
         this.eventService.emit('node-type-policy-scope-updated', {
             updatedBy,
@@ -191,7 +130,7 @@ let TypeAvailabilityPolicyService = class TypeAvailabilityPolicyService {
     async createScopeOrConflict(input, ctx) {
         const { scope, created } = await this.scopeRepository.createScopeIfAbsent(input, ctx);
         if (!created) {
-            throw new errors_1.ConflictError(`Policy scope was created concurrently (expected version ${UNCONFIGURED_VERSION}, found ${scope.version})`);
+            throw new errors_1.ConflictError(`Policy scope was created concurrently (expected version ${effective_policy_1.UNCONFIGURED_VERSION}, found ${scope.version})`);
         }
         return scope;
     }
@@ -220,7 +159,7 @@ let TypeAvailabilityPolicyService = class TypeAvailabilityPolicyService {
     async updatePolicyDocument(kind, policyId, rules, expectedVersion, updatedBy) {
         const warnings = this.validateAndLintRules(kind, rules);
         const result = await this.transactionRunner.run({}, async (ctx) => {
-            let invalidated = [];
+            let scopesChanged = false;
             const attachedScopeIds = await this.attachmentRepository.listScopeIdsAttachedToPolicy(policyId, ctx);
             const lockedScopeIds = await this.scopeRepository.lockScopesByIds(attachedScopeIds, ctx);
             if (rulesContainDelegate(rules) &&
@@ -245,11 +184,12 @@ let TypeAvailabilityPolicyService = class TypeAvailabilityPolicyService {
                     throw new errors_1.ConflictError('Policy document was attached to another scope while it was being updated');
                 }
                 await this.scopeRepository.bumpVersions(lockedScopeIds, ctx);
-                invalidated = await this.scopeRepository.findScopeKeysByIds(lockedScopeIds, ctx);
+                scopesChanged = lockedScopeIds.length > 0;
             }
-            return { existing, updated, invalidated };
+            return { existing, updated, scopesChanged };
         });
-        await this.invalidateScopes(result.invalidated);
+        if (result.scopesChanged)
+            await this.snapshot.refreshAfterWrite();
         this.eventService.emit('node-type-policy-document-updated', {
             updatedBy,
             kind: result.existing.kind,
@@ -331,7 +271,7 @@ let TypeAvailabilityPolicyService = class TypeAvailabilityPolicyService {
                 versionAfter: scopeAfter?.version ?? scope.version + 1,
             };
         });
-        await this.invalidateScopes([{ kind: result.kind, projectId: result.projectId }]);
+        await this.snapshot.refreshAfterWrite();
         this.eventService.emit('node-type-policy-attachments-updated', {
             updatedBy,
             kind: result.kind,
@@ -347,7 +287,7 @@ let TypeAvailabilityPolicyService = class TypeAvailabilityPolicyService {
         const warnings = this.validateAndLintRules(kind, input.rules);
         const result = await this.transactionRunner.run({}, async (ctx) => {
             const scope = await this.scopeRepository.findScopeByKindAndProject(kind, projectId, ctx, true);
-            const currentVersion = scope?.version ?? UNCONFIGURED_VERSION;
+            const currentVersion = scope?.version ?? effective_policy_1.UNCONFIGURED_VERSION;
             if (currentVersion !== expectedVersion) {
                 throw new errors_1.ConflictError(`Policy scope has changed since it was last read (expected version ${expectedVersion}, found ${currentVersion})`);
             }
@@ -420,7 +360,7 @@ let TypeAvailabilityPolicyService = class TypeAvailabilityPolicyService {
                 policyId,
             };
         });
-        await this.invalidateScopes([{ kind, projectId }]);
+        await this.snapshot.refreshAfterWrite();
         this.eventService.emit('node-type-policy-scope-updated', {
             updatedBy,
             kind,
@@ -444,7 +384,7 @@ let TypeAvailabilityPolicyService = class TypeAvailabilityPolicyService {
                 kind,
                 policyId: result.policyId,
                 origin: 'composed-save',
-                before: result.documentBefore ?? { rules: [], version: UNCONFIGURED_VERSION },
+                before: result.documentBefore ?? { rules: [], version: effective_policy_1.UNCONFIGURED_VERSION },
                 after: result.documentAfter,
             });
         }
@@ -487,17 +427,16 @@ let TypeAvailabilityPolicyService = class TypeAvailabilityPolicyService {
         };
     }
     async evaluateComposedTypesForAllProjects(kind, typeNames) {
-        const [instance, scopes] = await Promise.all([
-            this.readEffectivePolicyCached(kind, null),
-            this.scopeRepository.findProjectScopes(kind, {}),
+        const [instance, projects] = await Promise.all([
+            this.readEnforcedScope(kind, null),
+            this.snapshot.projectScopes(kind) ?? this.readProjectScopes(kind),
         ]);
-        const attachmentsByScope = await this.attachmentRepository.listAttachmentsForScopes(scopes.map((scope) => scope.id), {});
         const composeVerdicts = this.verdictComposer(kind, typeNames);
         return {
-            withoutProjectPolicy: composeVerdicts(instance, { ...UNCONFIGURED_PROJECT, kind }),
-            byProject: scopes.map((scope) => ({
-                projectId: scope.projectId,
-                verdicts: composeVerdicts(instance, toEffectivePolicy(scope, attachmentsByScope.get(scope.id) ?? [])),
+            withoutProjectPolicy: composeVerdicts(instance, (0, effective_policy_1.unconfiguredScope)(kind, null)),
+            byProject: projects.map((project) => ({
+                projectId: project.projectId,
+                verdicts: composeVerdicts(instance, project),
             })),
         };
     }
@@ -510,95 +449,27 @@ let TypeAvailabilityPolicyService = class TypeAvailabilityPolicyService {
         }));
     }
     async readComposedScopes(kind, projectId) {
-        if (projectId === null) {
-            return {
-                instance: await this.readEffectivePolicyCached(kind, null),
-                project: { ...UNCONFIGURED_PROJECT, kind },
-            };
-        }
         const [instance, project] = await Promise.all([
-            this.readEffectivePolicyCached(kind, null),
-            this.readEffectivePolicyCached(kind, projectId),
+            this.readEnforcedScope(kind, null),
+            projectId === null ? (0, effective_policy_1.unconfiguredScope)(kind, null) : this.readEnforcedScope(kind, projectId),
         ]);
         return { instance, project };
     }
-    async readEffectivePolicyCached(kind, projectId) {
-        const key = scopeCacheKey(kind, projectId);
-        const shared = this.localReads.get(key);
-        if (shared && shared.expiresAt > Date.now())
-            return await shared.read;
-        const read = this.readScope(kind, projectId, key);
-        read.catch(() => {
-            if (this.localReads.peek(key)?.read === read)
-                this.localReads.delete(key);
-        });
-        this.localReads.set(key, { read, expiresAt: Date.now() + LOCAL_READ_TTL_MS });
-        return await read;
-    }
-    async readScope(kind, projectId, key) {
-        const startedAt = Date.now();
-        const invalidations = this.invalidations;
-        try {
-            const cached = await withCacheTimeout(this.cacheService.get(key));
-            if (cached)
-                return cached;
-        }
-        catch (error) {
-            this.logger.warn('Failed to read the node type policy cache', { key, error });
-        }
-        const effective = await this.getEffectivePolicy(kind, projectId);
-        if (!this.canPublish(invalidations, startedAt))
-            return effective;
-        try {
-            await withCacheTimeout(this.cacheService.set(key, effective, SCOPE_CACHE_TTL_MS));
-        }
-        catch (error) {
-            this.logger.warn('Failed to write the node type policy cache', { key, error });
-        }
-        return effective;
-    }
-    canPublish(invalidations, startedAt) {
-        if (this.invalidations !== invalidations)
-            return false;
-        return Date.now() - startedAt < INVALIDATION_REPEAT_DELAY_MS;
-    }
-    resetLocalCaches() {
-        this.localReads.clear();
-        this.invalidations += 1;
-        for (const repeat of this.repeatDeletes)
-            clearTimeout(repeat);
-        this.repeatDeletes.clear();
+    async readEnforcedScope(kind, projectId) {
+        return this.snapshot.read(kind, projectId) ?? (await this.getEffectivePolicy(kind, projectId));
     }
-    async invalidateScopes(keys) {
-        if (keys.length === 0)
-            return;
-        const cacheKeys = keys.map(({ kind, projectId }) => scopeCacheKey(kind, projectId));
-        this.invalidations += 1;
-        for (const key of cacheKeys)
-            this.localReads.delete(key);
-        await this.dropCacheKeys(cacheKeys);
-        const repeat = setTimeout(async () => {
-            this.repeatDeletes.delete(repeat);
-            await this.dropCacheKeys(cacheKeys);
-        }, INVALIDATION_REPEAT_DELAY_MS);
-        repeat.unref();
-        this.repeatDeletes.add(repeat);
-    }
-    async dropCacheKeys(cacheKeys) {
-        try {
-            await withCacheTimeout(this.cacheService.deleteMany(cacheKeys));
-        }
-        catch (error) {
-            this.logger.error('Failed to invalidate the node type policy cache', {
-                keys: cacheKeys,
-                error,
-            });
-        }
+    async readProjectScopes(kind) {
+        const scopes = await this.scopeRepository.findProjectScopes(kind, {});
+        const attachmentsByScope = await this.attachmentRepository.listAttachmentsForScopes(scopes.map((scope) => scope.id), {});
+        return scopes.map((scope) => ({
+            ...(0, effective_policy_1.toEffectivePolicy)(scope, attachmentsByScope.get(scope.id) ?? []),
+            projectId: scope.projectId,
+        }));
     }
 };
 exports.TypeAvailabilityPolicyService = TypeAvailabilityPolicyService;
 exports.TypeAvailabilityPolicyService = TypeAvailabilityPolicyService = __decorate([
     (0, di_1.Service)(),
-    __metadata("design:paramtypes", [type_availability_policy_repository_1.TypeAvailabilityPolicyRepository, type_availability_policy_scope_repository_1.TypeAvailabilityPolicyScopeRepository, type_availability_policy_attachment_repository_1.TypeAvailabilityPolicyAttachmentRepository, db_1.TransactionRunner, backend_services_1.EventService, backend_services_1.CacheService, load_nodes_and_credentials_1.LoadNodesAndCredentials, node_types_1.NodeTypes, backend_common_1.Logger])
+    __metadata("design:paramtypes", [type_availability_policy_repository_1.TypeAvailabilityPolicyRepository, type_availability_policy_scope_repository_1.TypeAvailabilityPolicyScopeRepository, type_availability_policy_attachment_repository_1.TypeAvailabilityPolicyAttachmentRepository, db_1.TransactionRunner, backend_services_1.EventService, type_availability_policy_snapshot_1.TypeAvailabilityPolicySnapshot, load_nodes_and_credentials_1.LoadNodesAndCredentials, node_types_1.NodeTypes])
 ], TypeAvailabilityPolicyService);
 //# sourceMappingURL=type-availability-policy.service.js.map