admin/n8n-enterprise-unlocked
1
0
Fork 0
mirror of https://github.com/Abdulazizzn/n8n-enterprise-unlocked.git synced 2025-12-16 17:46:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(core): Add custom role management service and endpoints (#18717)

Browse Source
This commit is contained in:
Andreas Fitzek
2025-08-29 14:20:32 +02:00
committed by GitHub
parent 3b574306f3
commit 7cfef64799
34 changed files with 3783 additions and 238 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
packages/@n8n/api-types/src/dto/index.ts
View File

@@ -78,6 +78,9 @@ export {
USERS_LIST_SORT_OPTIONS,
} from './user/users-list-filter.dto';
export { UpdateRoleDto } from './roles/update-role.dto';
export { CreateRoleDto } from './roles/create-role.dto';
export { OidcConfigDto } from './oidc/config.dto';
export { CreateDataStoreDto } from './data-store/create-data-store.dto';

362
packages/@n8n/api-types/src/dto/roles/__tests__/create-role.dto.test.ts Normal file
View File

@@ -0,0 +1,362 @@
import { ALL_SCOPES } from '@n8n/permissions';
import { createRoleDtoSchema } from '../create-role.dto';
describe('createRoleDtoSchema', () => {
describe('Valid requests', () => {
test.each([
{
name: 'minimal valid request',
request: {
displayName: 'My Role',
roleType: 'project',
scopes: ['project:read'],
},
},
{
name: 'with description',
request: {
displayName: 'Custom Project Role',
description: 'A role for managing specific project tasks',
roleType: 'project',
scopes: ['project:read', 'project:update'],
},
},
{
name: 'with multiple scopes',
request: {
displayName: 'Full Access Role',
description: 'Complete project access',
roleType: 'project',
scopes: [
'project:create',
'project:read',
'project:update',
'project:delete',
'workflow:create',
'workflow:read',
],
},
},
{
name: 'with wildcard scopes',
request: {
displayName: 'Admin Role',
roleType: 'project',
scopes: ['project:*', 'workflow:*'],
},
},
{
name: 'with global wildcard scope',
request: {
displayName: 'Super Admin',
roleType: 'project',
scopes: ['*'],
},
},
{
name: 'displayName at minimum length',
request: {
displayName: 'My',
roleType: 'project',
scopes: ['project:read'],
},
},
{
name: 'displayName at maximum length',
request: {
displayName: 'A'.repeat(100),
roleType: 'project',
scopes: ['project:read'],
},
},
{
name: 'description at maximum length',
request: {
displayName: 'Test Role',
description: 'A'.repeat(500),
roleType: 'project',
scopes: ['project:read'],
},
},
{
name: 'empty description string',
request: {
displayName: 'Test Role',
description: '',
roleType: 'project',
scopes: ['project:read'],
},
},
{
name: 'with various resource scopes',
request: {
displayName: 'Multi-Resource Role',
roleType: 'project',
scopes: [
'credential:read',
'workflow:execute',
'user:list',
'tag:create',
'variable:update',
],
},
},
{
name: 'with empty scopes array',
request: {
displayName: 'Role with no scopes',
roleType: 'project',
scopes: [],
},
},
{
name: 'with extra fields (should be allowed)',
request: {
displayName: 'Test Role',
roleType: 'project',
scopes: ['project:read'],
extraField: 'this is allowed by default zod behavior',
},
},
])('should validate $name', ({ request }) => {
const result = createRoleDtoSchema.safeParse(request);
expect(result.success).toBe(true);
});
});
describe('Invalid requests', () => {
test.each([
{
name: 'missing displayName',
request: {
roleType: 'project',
scopes: ['project:read'],
},
expectedErrorPath: ['displayName'],
},
{
name: 'displayName too short',
request: {
displayName: 'A',
roleType: 'project',
scopes: ['project:read'],
},
expectedErrorPath: ['displayName'],
},
{
name: 'displayName too long',
request: {
displayName: 'A'.repeat(101),
roleType: 'project',
scopes: ['project:read'],
},
expectedErrorPath: ['displayName'],
},
{
name: 'empty displayName',
request: {
displayName: '',
roleType: 'project',
scopes: ['project:read'],
},
expectedErrorPath: ['displayName'],
},
{
name: 'displayName as number',
request: {
displayName: 123,
roleType: 'project',
scopes: ['project:read'],
},
expectedErrorPath: ['displayName'],
},
{
name: 'description too long',
request: {
displayName: 'Test Role',
description: 'A'.repeat(501),
roleType: 'project',
scopes: ['project:read'],
},
expectedErrorPath: ['description'],
},
{
name: 'description as number',
request: {
displayName: 'Test Role',
description: 123,
roleType: 'project',
scopes: ['project:read'],
},
expectedErrorPath: ['description'],
},
{
name: 'missing roleType',
request: {
displayName: 'Test Role',
scopes: ['project:read'],
},
expectedErrorPath: ['roleType'],
},
{
name: 'invalid roleType',
request: {
displayName: 'Test Role',
roleType: 'invalid',
scopes: ['project:read'],
},
expectedErrorPath: ['roleType'],
},
{
name: 'roleType as number',
request: {
displayName: 'Test Role',
roleType: 123,
scopes: ['project:read'],
},
expectedErrorPath: ['roleType'],
},
{
name: 'missing scopes',
request: {
displayName: 'Test Role',
roleType: 'project',
},
expectedErrorPath: ['scopes'],
},
{
name: 'scopes as string instead of array',
request: {
displayName: 'Test Role',
roleType: 'project',
scopes: 'project:read',
},
expectedErrorPath: ['scopes'],
},
{
name: 'scopes as number',
request: {
displayName: 'Test Role',
roleType: 'project',
scopes: 123,
},
expectedErrorPath: ['scopes'],
},
{
name: 'invalid scope in array',
request: {
displayName: 'Test Role',
roleType: 'project',
scopes: ['project:read', 'invalid:scope'],
},
expectedErrorPath: ['scopes', 1],
},
{
name: 'scope as number in array',
request: {
displayName: 'Test Role',
roleType: 'project',
scopes: ['project:read', 123],
},
expectedErrorPath: ['scopes', 1],
},
{
name: 'scope as object in array',
request: {
displayName: 'Test Role',
roleType: 'project',
scopes: ['project:read', { invalid: 'scope' }],
},
expectedErrorPath: ['scopes', 1],
},
{
name: 'malformed scope format',
request: {
displayName: 'Test Role',
roleType: 'project',
scopes: ['project_read', 'workflow-create'],
},
expectedErrorPath: ['scopes', 0],
},
{
name: 'empty scope string',
request: {
displayName: 'Test Role',
roleType: 'project',
scopes: ['project:read', ''],
},
expectedErrorPath: ['scopes', 1],
},
{
name: 'null in scopes array',
request: {
displayName: 'Test Role',
roleType: 'project',
scopes: ['project:read', null],
},
expectedErrorPath: ['scopes', 1],
},
{
name: 'undefined in scopes array',
request: {
displayName: 'Test Role',
roleType: 'project',
scopes: ['project:read', undefined],
},
expectedErrorPath: ['scopes', 1],
},
])('should fail validation for $name', ({ request, expectedErrorPath }) => {
const result = createRoleDtoSchema.safeParse(request);
expect(result.success).toBe(false);
if (expectedErrorPath) {
expect(result.error?.issues[0].path).toEqual(expectedErrorPath);
}
});
});
describe('Scope validation integration', () => {
test('should validate all valid resource scopes', () => {
const validScopes = ALL_SCOPES;
for (const scope of validScopes) {
const request = {
displayName: 'Test Role',
roleType: 'project' as const,
scopes: [scope],
};
const result = createRoleDtoSchema.safeParse(request);
expect(result.success).toBe(true);
}
});
test('should reject invalid scope formats', () => {
const invalidScopes = [
'invalid-scope',
'project_read',
'workflow-create',
'project:invalid-operation',
'invalid-resource:read',
'project:',
':read',
'project::read',
'**',
'project:**',
];
for (const scope of invalidScopes) {
const request = {
displayName: 'Test Role',
roleType: 'project' as const,
scopes: [scope],
};
const result = createRoleDtoSchema.safeParse(request);
expect(result.success).toBe(false);
}
});
});
});

464
packages/@n8n/api-types/src/dto/roles/__tests__/update-role.dto.test.ts Normal file
View File

@@ -0,0 +1,464 @@
import { ALL_SCOPES } from '@n8n/permissions';
import { updateRoleDtoSchema } from '../update-role.dto';
describe('updateRoleDtoSchema', () => {
describe('Valid requests', () => {
test.each([
{
name: 'empty object (all fields optional)',
request: {},
},
{
name: 'only displayName',
request: {
displayName: 'Updated Role Name',
},
},
{
name: 'only description',
request: {
description: 'Updated role description',
},
},
{
name: 'only scopes',
request: {
scopes: ['project:read', 'workflow:execute'],
},
},
{
name: 'displayName and description',
request: {
displayName: 'Updated Custom Role',
description: 'An updated description for the role',
},
},
{
name: 'displayName and scopes',
request: {
displayName: 'Enhanced Role',
scopes: ['project:*', 'workflow:read'],
},
},
{
name: 'description and scopes',
request: {
description: 'Role with updated permissions',
scopes: ['credential:read', 'user:list'],
},
},
{
name: 'all fields',
request: {
displayName: 'Completely Updated Role',
description: 'A role with all fields updated',
scopes: ['project:create', 'workflow:execute', 'credential:share'],
},
},
{
name: 'displayName at minimum length',
request: {
displayName: 'Up',
},
},
{
name: 'displayName at maximum length',
request: {
displayName: 'B'.repeat(100),
},
},
{
name: 'description at maximum length',
request: {
description: 'C'.repeat(500),
},
},
{
name: 'empty description string',
request: {
description: '',
},
},
{
name: 'single scope',
request: {
scopes: ['project:read'],
},
},
{
name: 'multiple scopes',
request: {
scopes: [
'project:create',
'project:read',
'project:update',
'workflow:execute',
'credential:share',
],
},
},
{
name: 'wildcard scopes',
request: {
scopes: ['project:*', 'workflow:*'],
},
},
{
name: 'global wildcard scope',
request: {
scopes: ['*'],
},
},
{
name: 'empty scopes array',
request: {
scopes: [],
},
},
{
name: 'various resource scopes',
request: {
scopes: [
'credential:read',
'workflow:execute',
'user:list',
'tag:create',
'variable:update',
'folder:move',
],
},
},
{
name: 'with extra fields (should be allowed)',
request: {
displayName: 'Test Role',
extraField: 'this is allowed by default zod behavior',
},
},
{
name: 'with roleType field (ignored but allowed)',
request: {
displayName: 'Test Role',
roleType: 'project',
},
},
])('should validate $name', ({ request }) => {
const result = updateRoleDtoSchema.safeParse(request);
expect(result.success).toBe(true);
});
});
describe('Invalid requests', () => {
test.each([
{
name: 'displayName too short',
request: {
displayName: 'A',
},
expectedErrorPath: ['displayName'],
},
{
name: 'displayName too long',
request: {
displayName: 'A'.repeat(101),
},
expectedErrorPath: ['displayName'],
},
{
name: 'empty displayName',
request: {
displayName: '',
},
expectedErrorPath: ['displayName'],
},
{
name: 'displayName as number',
request: {
displayName: 123,
},
expectedErrorPath: ['displayName'],
},
{
name: 'displayName as boolean',
request: {
displayName: true,
},
expectedErrorPath: ['displayName'],
},
{
name: 'displayName as object',
request: {
displayName: { name: 'test' },
},
expectedErrorPath: ['displayName'],
},
{
name: 'displayName as array',
request: {
displayName: ['test'],
},
expectedErrorPath: ['displayName'],
},
{
name: 'description too long',
request: {
description: 'A'.repeat(501),
},
expectedErrorPath: ['description'],
},
{
name: 'description as number',
request: {
description: 123,
},
expectedErrorPath: ['description'],
},
{
name: 'description as boolean',
request: {
description: false,
},
expectedErrorPath: ['description'],
},
{
name: 'description as object',
request: {
description: { desc: 'test' },
},
expectedErrorPath: ['description'],
},
{
name: 'description as array',
request: {
description: ['test'],
},
expectedErrorPath: ['description'],
},
{
name: 'scopes as string instead of array',
request: {
scopes: 'project:read',
},
expectedErrorPath: ['scopes'],
},
{
name: 'scopes as number',
request: {
scopes: 123,
},
expectedErrorPath: ['scopes'],
},
{
name: 'scopes as boolean',
request: {
scopes: true,
},
expectedErrorPath: ['scopes'],
},
{
name: 'scopes as object',
request: {
scopes: { scope: 'project:read' },
},
expectedErrorPath: ['scopes'],
},
{
name: 'invalid scope in array',
request: {
scopes: ['project:read', 'invalid:scope'],
},
expectedErrorPath: ['scopes', 1],
},
{
name: 'scope as number in array',
request: {
scopes: ['project:read', 123],
},
expectedErrorPath: ['scopes', 1],
},
{
name: 'scope as boolean in array',
request: {
scopes: ['project:read', false],
},
expectedErrorPath: ['scopes', 1],
},
{
name: 'scope as object in array',
request: {
scopes: ['project:read', { scope: 'workflow:read' }],
},
expectedErrorPath: ['scopes', 1],
},
{
name: 'scope as array in array',
request: {
scopes: ['project:read', ['workflow:read']],
},
expectedErrorPath: ['scopes', 1],
},
{
name: 'malformed scope format',
request: {
scopes: ['project_read', 'workflow-create'],
},
expectedErrorPath: ['scopes', 0],
},
{
name: 'empty scope string',
request: {
scopes: ['project:read', ''],
},
expectedErrorPath: ['scopes', 1],
},
{
name: 'null in scopes array',
request: {
scopes: ['project:read', null],
},
expectedErrorPath: ['scopes', 1],
},
{
name: 'undefined in scopes array',
request: {
scopes: ['project:read', undefined],
},
expectedErrorPath: ['scopes', 1],
},
])('should fail validation for $name', ({ request, expectedErrorPath }) => {
const result = updateRoleDtoSchema.safeParse(request);
expect(result.success).toBe(false);
if (expectedErrorPath) {
expect(result.error?.issues[0].path).toEqual(expectedErrorPath);
}
});
});
describe('Scope validation integration', () => {
test('should validate all valid resource scopes', () => {
const validScopes = ALL_SCOPES;
for (const scope of validScopes) {
const request = {
scopes: [scope],
};
const result = updateRoleDtoSchema.safeParse(request);
expect(result.success).toBe(true);
}
});
test('should reject invalid scope formats', () => {
const invalidScopes = [
'invalid-scope',
'project_read',
'workflow-create',
'project:invalid-operation',
'invalid-resource:read',
'project:',
':read',
'project::read',
'**',
'project:**',
];
for (const scope of invalidScopes) {
const request = {
scopes: [scope],
};
const result = updateRoleDtoSchema.safeParse(request);
expect(result.success).toBe(false);
}
});
test('should handle mixed valid and invalid scopes', () => {
const request = {
scopes: ['project:read', 'invalid-scope', 'workflow:execute'],
};
const result = updateRoleDtoSchema.safeParse(request);
expect(result.success).toBe(false);
expect(result.error?.issues[0].path).toEqual(['scopes', 1]);
});
});
describe('Field combination tests', () => {
test('should validate partial updates with different field combinations', () => {
const validCombinations = [
{ displayName: 'New Name' },
{ description: 'New description' },
{ scopes: ['project:read'] },
{ displayName: 'New Name', description: 'New description' },
{ displayName: 'New Name', scopes: ['workflow:execute'] },
{ description: 'New description', scopes: ['credential:share'] },
{
displayName: 'Complete Update',
description: 'Full update description',
scopes: ['*'],
},
];
for (const request of validCombinations) {
const result = updateRoleDtoSchema.safeParse(request);
expect(result.success).toBe(true);
}
});
test('should handle boundary conditions in combinations', () => {
const request = {
displayName: 'AB', // minimum length
description: 'D'.repeat(500), // maximum length
scopes: ['*'], // global wildcard
};
const result = updateRoleDtoSchema.safeParse(request);
expect(result.success).toBe(true);
});
});
describe('Null and undefined handling', () => {
test.each([
{
name: 'null displayName',
request: { displayName: null },
expectedErrorPath: ['displayName'],
},
{
name: 'null description',
request: { description: null },
expectedErrorPath: ['description'],
},
{
name: 'null scopes',
request: { scopes: null },
expectedErrorPath: ['scopes'],
},
{
name: 'undefined displayName',
request: { displayName: undefined },
},
{
name: 'undefined description',
request: { description: undefined },
},
{
name: 'undefined scopes',
request: { scopes: undefined },
},
])('should handle $name correctly', ({ request, expectedErrorPath }) => {
const result = updateRoleDtoSchema.safeParse(request);
if (expectedErrorPath) {
expect(result.success).toBe(false);
expect(result.error?.issues[0].path).toEqual(expectedErrorPath);
} else {
// undefined values should be valid (fields are optional)
expect(result.success).toBe(true);
}
});
});
});

11
packages/@n8n/api-types/src/dto/roles/create-role.dto.ts Normal file
View File

@@ -0,0 +1,11 @@
import { scopeSchema } from '@n8n/permissions';
import { z } from 'zod';
export const createRoleDtoSchema = z.object({
displayName: z.string().min(2).max(100),
description: z.string().max(500).optional(),
roleType: z.enum(['project']),
scopes: z.array(scopeSchema),
});
export type CreateRoleDto = z.infer<typeof createRoleDtoSchema>;

10
packages/@n8n/api-types/src/dto/roles/update-role.dto.ts Normal file
View File

@@ -0,0 +1,10 @@
import { scopeSchema } from '@n8n/permissions';
import { z } from 'zod';
export const updateRoleDtoSchema = z.object({
displayName: z.string().min(2).max(100).optional(),
description: z.string().max(500).optional(),
scopes: z.array(scopeSchema).optional(),
});
export type UpdateRoleDto = z.infer<typeof updateRoleDtoSchema>;

65
packages/@n8n/db/src/constants.ts
View File

@@ -1,21 +1,24 @@
import {
GLOBAL_SCOPE_MAP,
PROJECT_ADMIN_ROLE_SLUG,
PROJECT_EDITOR_ROLE_SLUG,
PROJECT_OWNER_ROLE_SLUG,
PROJECT_SCOPE_MAP,
PROJECT_VIEWER_ROLE_SLUG,
type GlobalRole,
type ProjectRole,
ALL_ROLES,
type GlobalRole,
type Role as RoleDTO,
} from '@n8n/permissions';
import type { Role } from 'entities';
export function buildInRoleToRoleObject(role: GlobalRole): Role {
export function builtInRoleToRoleObject(
role: RoleDTO,
roleType: 'global' | 'project' | 'workflow' | 'credential',
): Role {
return {
slug: role,
displayName: role,
scopes: GLOBAL_SCOPE_MAP[role].map((scope) => {
slug: role.slug,
displayName: role.displayName,
scopes: role.scopes.map((scope) => {
return {
slug: scope,
displayName: scope,
@@ -23,36 +26,36 @@ export function buildInRoleToRoleObject(role: GlobalRole): Role {
};
}),
systemRole: true,
roleType: 'global',
description: `Built-in global role with ${role} permissions.`,
roleType,
description: role.description,
} as Role;
}
export function buildInProjectRoleToRoleObject(role: ProjectRole): Role {
return {
slug: role,
displayName: role,
scopes: PROJECT_SCOPE_MAP[role].map((scope) => {
return {
slug: scope,
displayName: scope,
description: null,
};
}),
systemRole: true,
roleType: 'project',
description: `Built-in project role with ${role} permissions.`,
} as Role;
function toRoleMap(allRoles: Role[]): Record<string, Role> {
return allRoles.reduce(
(acc, role) => {
acc[role.slug] = role;
return acc;
},
{} as Record<string, Role>,
);
}
export const GLOBAL_OWNER_ROLE = buildInRoleToRoleObject('global:owner');
export const GLOBAL_ADMIN_ROLE = buildInRoleToRoleObject('global:admin');
export const GLOBAL_MEMBER_ROLE = buildInRoleToRoleObject('global:member');
export const ALL_BUILTIN_ROLES = toRoleMap([
...ALL_ROLES.global.map((role) => builtInRoleToRoleObject(role, 'global')),
...ALL_ROLES.project.map((role) => builtInRoleToRoleObject(role, 'project')),
...ALL_ROLES.credential.map((role) => builtInRoleToRoleObject(role, 'credential')),
...ALL_ROLES.workflow.map((role) => builtInRoleToRoleObject(role, 'workflow')),
]);
export const PROJECT_OWNER_ROLE = buildInProjectRoleToRoleObject(PROJECT_OWNER_ROLE_SLUG);
export const PROJECT_ADMIN_ROLE = buildInProjectRoleToRoleObject(PROJECT_ADMIN_ROLE_SLUG);
export const PROJECT_EDITOR_ROLE = buildInProjectRoleToRoleObject(PROJECT_EDITOR_ROLE_SLUG);
export const PROJECT_VIEWER_ROLE = buildInProjectRoleToRoleObject(PROJECT_VIEWER_ROLE_SLUG);
export const GLOBAL_OWNER_ROLE = ALL_BUILTIN_ROLES['global:owner'];
export const GLOBAL_ADMIN_ROLE = ALL_BUILTIN_ROLES['global:admin'];
export const GLOBAL_MEMBER_ROLE = ALL_BUILTIN_ROLES['global:member'];
export const PROJECT_OWNER_ROLE = ALL_BUILTIN_ROLES[PROJECT_OWNER_ROLE_SLUG];
export const PROJECT_ADMIN_ROLE = ALL_BUILTIN_ROLES[PROJECT_ADMIN_ROLE_SLUG];
export const PROJECT_EDITOR_ROLE = ALL_BUILTIN_ROLES[PROJECT_EDITOR_ROLE_SLUG];
export const PROJECT_VIEWER_ROLE = ALL_BUILTIN_ROLES[PROJECT_VIEWER_ROLE_SLUG];
export const GLOBAL_ROLES: Record<GlobalRole, Role> = {
'global:owner': GLOBAL_OWNER_ROLE,

73
packages/@n8n/db/src/repositories/role.repository.ts
View File

@@ -1,11 +1,80 @@
import { DatabaseConfig } from '@n8n/config';
import { Service } from '@n8n/di';
import { DataSource, Repository } from '@n8n/typeorm';
import { DataSource, EntityManager, Repository } from '@n8n/typeorm';
import { UserError } from 'n8n-workflow';
import { Role } from '../entities';
@Service()
export class RoleRepository extends Repository<Role> {
constructor(dataSource: DataSource) {
constructor(
dataSource: DataSource,
private readonly databaseConfig: DatabaseConfig,
) {
super(Role, dataSource.manager);
}
async findAll() {
return await this.find({ relations: ['scopes'] });
}
async findBySlug(slug: string) {
return await this.findOne({
where: { slug },
relations: ['scopes'],
});
}
async removeBySlug(slug: string) {
const result = await this.delete({ slug });
if (result.affected !== 1) {
throw new Error(`Failed to delete role "${slug}"`);
}
}
private async updateEntityWithManager(
entityManager: EntityManager,
slug: string,
newData: Partial<Pick<Role, 'description' | 'scopes' | 'displayName'>>,
) {
const role = await entityManager.findOne(Role, {
where: { slug },
relations: ['scopes'],
});
if (!role) {
throw new UserError('Role not found');
}
if (role.systemRole) {
throw new UserError('Cannot update system roles');
}
// Only update fields that are explicitly provided (not undefined)
// This preserves existing scopes when scopes is undefined
if (newData.displayName !== undefined) {
role.displayName = newData.displayName;
}
if (newData.description !== undefined) {
role.description = newData.description;
}
if (newData.scopes !== undefined) {
role.scopes = newData.scopes;
}
return await entityManager.save<Role>(role);
}
async updateRole(
slug: string,
newData: Partial<Pick<Role, 'description' | 'scopes' | 'displayName'>>,
) {
// Do not use transactions for sqlite legacy
if (this.databaseConfig.isLegacySqlite) {
return await this.updateEntityWithManager(this.manager, slug, newData);
}
return await this.manager.transaction(async (transactionManager) => {
return await this.updateEntityWithManager(transactionManager, slug, newData);
});
}
}

6
packages/@n8n/db/src/repositories/scope.repository.ts
View File

@@ -1,5 +1,5 @@
import { Service } from '@n8n/di';
import { DataSource, Repository } from '@n8n/typeorm';
import { DataSource, In, Repository } from '@n8n/typeorm';
import { Scope } from '../entities';
@@ -8,4 +8,8 @@ export class ScopeRepository extends Repository<Scope> {
constructor(dataSource: DataSource) {
super(Scope, dataSource.manager);
}
async findByList(slugs: string[]) {
return await this.findBy({ slug: In(slugs) });
}
}

10
packages/@n8n/db/src/services/auth.roles.service.ts
View File

@@ -85,12 +85,12 @@ export class AuthRolesService {
for (const roleNamespace of Object.keys(ALL_ROLES) as Array<keyof typeof ALL_ROLES>) {
const rolesToUpdate = ALL_ROLES[roleNamespace]
.map((role) => {
const existingRole = existingRolesMap.get(role.role);
const existingRole = existingRolesMap.get(role.slug);
if (!existingRole) {
const newRole = this.roleRepository.create({
slug: role.role,
displayName: role.name,
slug: role.slug,
displayName: role.displayName,
description: role.description ?? null,
roleType: roleNamespace,
systemRole: true,
@@ -100,14 +100,14 @@ export class AuthRolesService {
}
const needsUpdate =
existingRole.displayName !== role.name ||
existingRole.displayName !== role.displayName ||
existingRole.description !== role.description ||
existingRole.roleType !== roleNamespace ||
existingRole.scopes.some((scope) => !role.scopes.includes(scope.slug)) || // DB roles has scope that it should not have
role.scopes.some((scope) => !existingRole.scopes.some((s) => s.slug === scope)); // A role has scope that is not in DB
if (needsUpdate) {
existingRole.displayName = role.name;
existingRole.displayName = role.displayName;
existingRole.description = role.description ?? null;
existingRole.roleType = roleNamespace;
existingRole.scopes = allScopes.filter((scope) => role.scopes.includes(scope.slug));

2
packages/@n8n/permissions/src/__tests__/__snapshots__/scope-information.test.ts.snap
View File

@@ -131,6 +131,8 @@ exports[`Scope Information ensure scopes are defined correctly 1`] = `
"workflowTags:update",
"workflowTags:list",
"workflowTags:*",
"role:manage",
"role:*",
"*",
]
`;

1
packages/@n8n/permissions/src/constants.ee.ts
View File

@@ -29,6 +29,7 @@ export const RESOURCES = {
dataStore: [...DEFAULT_OPERATIONS, 'readRow', 'writeRow', 'listProject'] as const,
execution: ['delete', 'read', 'list', 'get'] as const,
workflowTags: ['update', 'list'] as const,
role: ['manage'] as const,
} as const;
export const API_KEY_RESOURCES = {

2
packages/@n8n/permissions/src/index.ts
View File

@@ -6,7 +6,7 @@ export * from './scope-information';
export * from './roles/role-maps.ee';
export * from './roles/all-roles';
export { projectRoleSchema, teamRoleSchema } from './schemas.ee';
export { projectRoleSchema, teamRoleSchema, roleSchema, Role, scopeSchema } from './schemas.ee';
export { hasScope } from './utilities/has-scope.ee';
export { hasGlobalScope } from './utilities/has-global-scope.ee';

23
packages/@n8n/permissions/src/roles/all-roles.ts
View File

@@ -27,18 +27,27 @@ const ROLE_NAMES: Record<AllRoleTypes, string> = {
'workflow:editor': 'Workflow Editor',
};
const mapToRoleObject = <T extends keyof typeof ROLE_NAMES>(roles: Record<T, Scope[]>) =>
const mapToRoleObject = <T extends keyof typeof ROLE_NAMES>(
roles: Record<T, Scope[]>,
roleType: 'global' | 'project' | 'credential' | 'workflow',
) =>
(Object.keys(roles) as T[]).map((role) => ({
role,
name: ROLE_NAMES[role],
slug: role,
displayName: ROLE_NAMES[role],
scopes: getRoleScopes(role),
description: ROLE_NAMES[role],
licensed: false,
systemRole: true,
roleType,
}));
export const ALL_ROLES: AllRolesMap = {
global: mapToRoleObject(GLOBAL_SCOPE_MAP),
project: mapToRoleObject(PROJECT_SCOPE_MAP),
credential: mapToRoleObject(CREDENTIALS_SHARING_SCOPE_MAP),
workflow: mapToRoleObject(WORKFLOW_SHARING_SCOPE_MAP),
global: mapToRoleObject(GLOBAL_SCOPE_MAP, 'global'),
project: mapToRoleObject(PROJECT_SCOPE_MAP, 'project'),
credential: mapToRoleObject(CREDENTIALS_SHARING_SCOPE_MAP, 'credential'),
workflow: mapToRoleObject(WORKFLOW_SHARING_SCOPE_MAP, 'workflow'),
};
export const isBuiltInRole = (role: string): role is AllRoleTypes => {
return Object.prototype.hasOwnProperty.call(ROLE_NAMES, role);
};

1
packages/@n8n/permissions/src/roles/scopes/global-scopes.ee.ts
View File

@@ -80,6 +80,7 @@ export const GLOBAL_OWNER_SCOPES: Scope[] = [
'folder:move',
'oidc:manage',
'dataStore:list',
'role:manage',
];
export const GLOBAL_ADMIN_SCOPES = GLOBAL_OWNER_SCOPES.concat();

19
packages/@n8n/permissions/src/schemas.ee.ts
View File

@@ -1,6 +1,7 @@
import { z } from 'zod';
import { PROJECT_OWNER_ROLE_SLUG } from './constants.ee';
import { ALL_SCOPES } from './scope-information';
export const roleNamespaceSchema = z.enum(['global', 'project', 'credential', 'workflow']);
@@ -25,3 +26,21 @@ export const projectRoleSchema = z.union([personalRoleSchema, teamRoleSchema]);
export const credentialSharingRoleSchema = z.enum(['credential:owner', 'credential:user']);
export const workflowSharingRoleSchema = z.enum(['workflow:owner', 'workflow:editor']);
const ALL_SCOPES_LOOKUP_SET = new Set(ALL_SCOPES as string[]);
export const scopeSchema = z.string().refine((val) => ALL_SCOPES_LOOKUP_SET.has(val), {
message: 'Invalid scope',
});
export const roleSchema = z.object({
slug: z.string().min(1),
displayName: z.string().min(1),
description: z.string().nullable(),
systemRole: z.boolean(),
roleType: roleNamespaceSchema,
licensed: z.boolean(),
scopes: z.array(scopeSchema),
});
export type Role = z.infer<typeof roleSchema>;

17
packages/@n8n/permissions/src/types.ee.ts
View File

@@ -6,6 +6,7 @@ import type {
credentialSharingRoleSchema,
globalRoleSchema,
projectRoleSchema,
Role,
roleNamespaceSchema,
teamRoleSchema,
workflowSharingRoleSchema,
@@ -63,19 +64,11 @@ export type CustomRole = string;
/** Union of all possible role types in the system */
export type AllRoleTypes = GlobalRole | ProjectRole | WorkflowSharingRole | CredentialSharingRole;
type RoleObject<T extends AllRoleTypes> = {
role: T;
name: string;
description?: string | null;
scopes: Scope[];
licensed: boolean;
};
export type AllRolesMap = {
global: Array<RoleObject<GlobalRole>>;
project: Array<RoleObject<ProjectRole>>;
credential: Array<RoleObject<CredentialSharingRole>>;
workflow: Array<RoleObject<WorkflowSharingRole>>;
global: Role[];
project: Role[];
credential: Role[];
workflow: Role[];
};
export type DbScope = {

2
packages/@n8n/permissions/src/utilities/__tests__/get-resource-permissions.test.ts
View File

@@ -34,6 +34,7 @@ describe('permissions', () => {
folder: {},
insights: {},
dataStore: {},
role: {},
});
});
it('getResourcePermissions', () => {
@@ -134,6 +135,7 @@ describe('permissions', () => {
dataStore: {},
execution: {},
workflowTags: {},
role: {},
};
expect(getResourcePermissions(scopes)).toEqual(permissionRecord);

46
packages/cli/src/controllers/role.controller.ts
View File

@@ -1,4 +1,15 @@
import { Get, RestController } from '@n8n/decorators';
import { CreateRoleDto, UpdateRoleDto } from '@n8n/api-types';
import {
Body,
Delete,
Get,
GlobalScope,
Param,
Patch,
Post,
RestController,
} from '@n8n/decorators';
import { Role as RoleDTO } from '@n8n/permissions';
import { RoleService } from '@/services/role.service';
@@ -7,7 +18,36 @@ export class RoleController {
constructor(private readonly roleService: RoleService) {}
@Get('/')
getAllRoles() {
return this.roleService.getAllRoles();
async getAllRoles(): Promise<Record<string, RoleDTO[]>> {
const allRoles = await this.roleService.getAllRoles();
return {
global: allRoles.filter((r) => r.roleType === 'global'),
project: allRoles.filter((r) => r.roleType === 'project'),
credential: allRoles.filter((r) => r.roleType === 'credential'),
workflow: allRoles.filter((r) => r.roleType === 'workflow'),
};
}
@Get('/:slug')
async getRoleBySlug(@Param('slug') slug: string): Promise<RoleDTO> {
return await this.roleService.getRole(slug);
}
@Patch('/:slug')
@GlobalScope('role:manage')
async updateRole(@Param('slug') slug: string, @Body body: UpdateRoleDto): Promise<RoleDTO> {
return await this.roleService.updateCustomRole(slug, body);
}
@Delete('/:slug')
@GlobalScope('role:manage')
async deleteRole(@Param('slug') slug: string): Promise<RoleDTO> {
return await this.roleService.removeCustomRole(slug);
}
@Post('/')
@GlobalScope('role:manage')
async createRole(@Body body: CreateRoleDto): Promise<RoleDTO> {
return await this.roleService.createCustomRole(body);
}
}

127
packages/cli/src/services/role.service.ts
View File

@@ -1,4 +1,4 @@
import type {
import {
CredentialsEntity,
SharedCredentials,
SharedWorkflow,
@@ -6,25 +6,122 @@ import type {
ListQueryDb,
ScopesField,
ProjectRelation,
RoleRepository,
Role,
Scope as DBScope,
ScopeRepository,
} from '@n8n/db';
import { Service } from '@n8n/di';
import type { CustomRole, ProjectRole, Scope } from '@n8n/permissions';
import { ALL_ROLES, combineScopes, getAuthPrincipalScopes, getRoleScopes } from '@n8n/permissions';
import { UnexpectedError } from 'n8n-workflow';
import type { CustomRole, ProjectRole, Scope, Role as RoleDTO } from '@n8n/permissions';
import {
combineScopes,
getAuthPrincipalScopes,
getRoleScopes,
isBuiltInRole,
} from '@n8n/permissions';
import { UnexpectedError, UserError } from 'n8n-workflow';
import { License } from '@/license';
import { CreateRoleDto, UpdateRoleDto } from '@n8n/api-types';
import { NotFoundError } from '@/errors/response-errors/not-found.error';
import { BadRequestError } from '@/errors/response-errors/bad-request.error';
@Service()
export class RoleService {
constructor(private readonly license: License) {}
constructor(
private readonly license: License,
private readonly roleRepository: RoleRepository,
private readonly scopeRepository: ScopeRepository,
) {}
getAllRoles() {
Object.values(ALL_ROLES).forEach((entries) => {
entries.forEach((entry) => {
entry.licensed = this.isRoleLicensed(entry.role);
private dbRoleToRoleDTO(role: Role): RoleDTO {
return {
...role,
scopes: role.scopes.map((s) => s.slug),
licensed: this.isRoleLicensed(role.slug),
};
}
async getAllRoles(): Promise<RoleDTO[]> {
const roles = await this.roleRepository.findAll();
return roles.map((r) => this.dbRoleToRoleDTO(r));
}
async getRole(slug: string): Promise<RoleDTO> {
const role = await this.roleRepository.findBySlug(slug);
if (role) {
return this.dbRoleToRoleDTO(role);
}
throw new NotFoundError('Role not found');
}
async removeCustomRole(slug: string) {
const role = await this.roleRepository.findBySlug(slug);
if (!role) {
throw new NotFoundError('Role not found');
}
if (role.systemRole) {
throw new BadRequestError('Cannot delete system roles');
}
await this.roleRepository.removeBySlug(slug);
return this.dbRoleToRoleDTO(role);
}
private async resolveScopes(scopeSlugs: string[] | undefined): Promise<DBScope[] | undefined> {
if (!scopeSlugs) {
return undefined;
}
if (scopeSlugs.length === 0) {
return [];
}
const scopes = await this.scopeRepository.findByList(scopeSlugs);
if (scopes.length !== scopeSlugs.length) {
const invalidScopes = scopeSlugs.filter((slug) => !scopes.some((s) => s.slug === slug));
throw new Error(`The following scopes are invalid: ${invalidScopes.join(', ')}`);
}
return scopes;
}
async updateCustomRole(slug: string, newData: UpdateRoleDto) {
const { displayName, description, scopes: scopeSlugs } = newData;
try {
const updatedRole = await this.roleRepository.updateRole(slug, {
displayName,
description,
scopes: await this.resolveScopes(scopeSlugs),
});
});
return ALL_ROLES;
return this.dbRoleToRoleDTO(updatedRole);
} catch (error) {
if (error instanceof UserError && error.message === 'Role not found') {
throw new NotFoundError('Role not found');
}
if (error instanceof UserError && error.message === 'Cannot update system roles') {
throw new BadRequestError('Cannot update system roles');
}
throw error;
}
}
async createCustomRole(newRole: CreateRoleDto) {
const role = new Role();
role.displayName = newRole.displayName;
if (newRole.description) {
role.description = newRole.description;
}
const scopes = await this.resolveScopes(newRole.scopes);
if (scopes === undefined) throw new BadRequestError('Scopes are required');
role.scopes = scopes;
role.systemRole = false;
role.roleType = newRole.roleType;
role.slug = `${newRole.roleType}:${newRole.displayName.toLowerCase().replace(/[^a-z0-9]+/g, '-')}-${Math.random().toString(36).substring(2, 8)}`;
const createdRole = await this.roleRepository.save(role);
return this.dbRoleToRoleDTO(createdRole);
}
addScopes(
@@ -114,6 +211,14 @@ export class RoleService {
isRoleLicensed(role: ProjectRole | CustomRole) {
// TODO: move this info into FrontendSettings
if (!isBuiltInRole(role)) {
// This is a custom role, there for we need to check if
// custom roles are licensed
// TODO: add license check for custom roles
return true;
}
switch (role) {
case 'project:admin':
return this.license.isProjectRoleAdminLicensed();

629
packages/cli/test/integration/controllers/role.controller.test.ts Normal file
View File

@@ -0,0 +1,629 @@
import type { CreateRoleDto, UpdateRoleDto } from '@n8n/api-types';
import { mockInstance } from '@n8n/backend-test-utils';
import type { Role } from '@n8n/permissions';
import { RoleService } from '@/services/role.service';
import { cleanupRolesAndScopes } from '../shared/db/roles';
import { createMember, createOwner } from '../shared/db/users';
import type { SuperAgentTest } from '../shared/types';
import { setupTestServer } from '../shared/utils';
describe('RoleController', () => {
const roleService = mockInstance(RoleService);
const testServer = setupTestServer({ endpointGroups: ['role'] });
let ownerAgent: SuperAgentTest;
let memberAgent: SuperAgentTest;
beforeAll(async () => {
const owner = await createOwner();
const member = await createMember();
ownerAgent = testServer.authAgentFor(owner);
memberAgent = testServer.authAgentFor(member);
});
beforeEach(() => {
jest.clearAllMocks();
});
afterEach(async () => {
await cleanupRolesAndScopes();
});
describe('GET /roles', () => {
it('should require authentication', async () => {
//
// ACT & ASSERT
//
await testServer.authlessAgent.get('/roles').expect(401);
});
it('should return roles grouped by category for authenticated users', async () => {
//
// ARRANGE
//
const mockRoles: Role[] = [
{
slug: 'global:admin',
displayName: 'Global Admin',
description: 'Global administrator',
systemRole: true,
roleType: 'global',
scopes: ['user:manage', 'workflow:create'],
licensed: true,
},
{
slug: 'project:editor',
displayName: 'Project Editor',
description: 'Project editor role',
systemRole: true,
roleType: 'project',
scopes: ['workflow:create', 'workflow:edit'],
licensed: true,
},
{
slug: 'credential:owner',
displayName: 'Credential Owner',
description: 'Credential owner',
systemRole: true,
roleType: 'credential',
scopes: ['credential:read', 'credential:write'],
licensed: true,
},
{
slug: 'workflow:editor',
displayName: 'Workflow Editor',
description: 'Workflow editor',
systemRole: true,
roleType: 'workflow',
scopes: ['workflow:read', 'workflow:edit'],
licensed: true,
},
];
roleService.getAllRoles.mockResolvedValue(mockRoles);
//
// ACT
//
const response = await memberAgent.get('/roles').expect(200);
//
// ASSERT
//
expect(response.body).toEqual({
data: {
global: [mockRoles[0]], // global:admin
project: [mockRoles[1]], // project:editor
credential: [mockRoles[2]], // credential:owner
workflow: [mockRoles[3]], // workflow:editor
},
});
expect(roleService.getAllRoles).toHaveBeenCalledTimes(1);
});
it('should return empty categories when no roles exist', async () => {
//
// ARRANGE
//
roleService.getAllRoles.mockResolvedValue([]);
//
// ACT
//
const response = await memberAgent.get('/roles').expect(200);
//
// ASSERT
//
expect(response.body).toEqual({
data: {
global: [],
project: [],
credential: [],
workflow: [],
},
});
});
it('should handle service errors gracefully', async () => {
//
// ARRANGE
//
roleService.getAllRoles.mockRejectedValue(new Error('Database connection failed'));
//
// ACT & ASSERT
//
await memberAgent.get('/roles').expect(500);
});
it('should allow both owner and member access', async () => {
//
// ARRANGE
//
const mockRoles: Role[] = [
{
slug: 'project:admin',
displayName: 'Project Admin',
description: 'Project administrator',
systemRole: true,
roleType: 'project',
scopes: ['project:manage'],
licensed: true,
},
];
roleService.getAllRoles.mockResolvedValue(mockRoles);
//
// ACT & ASSERT
//
await ownerAgent.get('/roles').expect(200);
await memberAgent.get('/roles').expect(200);
expect(roleService.getAllRoles).toHaveBeenCalledTimes(2);
});
});
describe('GET /roles/:slug', () => {
it('should require authentication', async () => {
//
// ACT & ASSERT
//
await testServer.authlessAgent.get('/roles/project:admin').expect(401);
});
it('should return specific role when it exists', async () => {
//
// ARRANGE
//
const roleSlug = 'project:admin';
const mockRole: Role = {
slug: roleSlug,
displayName: 'Project Admin',
description: 'Project administrator role',
systemRole: true,
roleType: 'project',
scopes: ['project:manage', 'workflow:create'],
licensed: true,
};
roleService.getRole.mockResolvedValue(mockRole);
//
// ACT
//
const response = await memberAgent.get(`/roles/${roleSlug}`).expect(200);
//
// ASSERT
//
expect(response.body).toEqual({ data: mockRole });
expect(roleService.getRole).toHaveBeenCalledTimes(1);
// Note: Parameter extraction verification skipped due to test framework limitations
});
it('should handle service errors gracefully', async () => {
//
// ARRANGE
//
const roleSlug = 'project:admin';
roleService.getRole.mockRejectedValue(new Error('Database connection failed'));
//
// ACT & ASSERT
//
await memberAgent.get(`/roles/${roleSlug}`).expect(500);
});
it('should work with URL-encoded slugs', async () => {
//
// ARRANGE
//
const roleSlug = 'project:custom-role';
const encodedSlug = encodeURIComponent(roleSlug);
const mockRole: Role = {
slug: roleSlug,
displayName: 'Custom Role',
description: 'A custom project role',
systemRole: false,
roleType: 'project',
scopes: ['workflow:read'],
licensed: true,
};
roleService.getRole.mockResolvedValue(mockRole);
//
// ACT
//
const response = await memberAgent.get(`/roles/${encodedSlug}`).expect(200);
//
// ASSERT
//
expect(response.body).toEqual({ data: mockRole });
// Parameter verification skipped - test framework issue
});
});
describe('POST /roles', () => {
it('should require authentication', async () => {
//
// ACT & ASSERT
//
await testServer.authlessAgent
.post('/roles')
.send({
displayName: 'Test Role',
roleType: 'project',
scopes: ['workflow:read'],
})
.expect(401);
});
it('should require role:manage permission', async () => {
//
// ACT & ASSERT
//
await memberAgent
.post('/roles')
.send({
displayName: 'Test Role',
roleType: 'project',
scopes: ['workflow:read'],
})
.expect(403);
});
it('should create custom role with valid data as owner', async () => {
//
// ARRANGE
//
const createRoleDto: CreateRoleDto = {
displayName: 'Custom Project Role',
description: 'A custom role for project management',
roleType: 'project',
scopes: ['workflow:read', 'workflow:create'],
};
const mockCreatedRole: Role = {
slug: 'project:custom-project-role',
displayName: createRoleDto.displayName,
description: createRoleDto.description ?? null,
systemRole: false,
roleType: createRoleDto.roleType,
scopes: createRoleDto.scopes,
licensed: true,
};
roleService.createCustomRole.mockResolvedValue(mockCreatedRole);
//
// ACT
//
const response = await ownerAgent.post('/roles').send(createRoleDto).expect(200);
//
// ASSERT
//
expect(response.body).toEqual({ data: mockCreatedRole });
// Parameter verification skipped - test framework issue
expect(roleService.createCustomRole).toHaveBeenCalledTimes(1);
});
it('should create role without description', async () => {
//
// ARRANGE
//
const createRoleDto: CreateRoleDto = {
displayName: 'Simple Role',
roleType: 'project',
scopes: ['workflow:read'],
};
const mockCreatedRole = {
slug: 'project:simple-role',
displayName: createRoleDto.displayName,
description: null,
systemRole: false,
roleType: createRoleDto.roleType,
scopes: createRoleDto.scopes,
licensed: true,
};
roleService.createCustomRole.mockResolvedValue(mockCreatedRole);
//
// ACT
//
const response = await ownerAgent.post('/roles').send(createRoleDto).expect(200);
//
// ASSERT
//
expect(response.body).toEqual({ data: mockCreatedRole });
});
it('should handle service errors gracefully', async () => {
//
// ARRANGE
//
const createRoleDto: CreateRoleDto = {
displayName: 'Test Role',
roleType: 'project',
scopes: ['workflow:read'],
};
roleService.createCustomRole.mockRejectedValue(new Error('Database connection failed'));
//
// ACT & ASSERT
//
await ownerAgent.post('/roles').send(createRoleDto).expect(500);
});
});
describe('PATCH /roles/:slug', () => {
it('should require authentication', async () => {
//
// ACT & ASSERT
//
await testServer.authlessAgent
.patch('/roles/project:test-role')
.send({ displayName: 'Updated Role' })
.expect(401);
});
it('should require role:manage permission', async () => {
//
// ACT & ASSERT
//
await memberAgent
.patch('/roles/project:test-role')
.send({ displayName: 'Updated Role' })
.expect(403);
});
it('should update custom role with valid data as owner', async () => {
//
// ARRANGE
//
const roleSlug = 'project:test-role';
const updateRoleDto: UpdateRoleDto = {
displayName: 'Updated Role Name',
description: 'Updated description',
scopes: ['workflow:read', 'workflow:edit'],
};
const mockUpdatedRole: Role = {
slug: roleSlug,
displayName: updateRoleDto.displayName!,
description: updateRoleDto.description ?? null,
systemRole: false,
roleType: 'project',
scopes: updateRoleDto.scopes!,
licensed: true,
};
roleService.updateCustomRole.mockResolvedValue(mockUpdatedRole);
//
// ACT
//
const response = await ownerAgent.patch(`/roles/${roleSlug}`).send(updateRoleDto).expect(200);
//
// ASSERT
//
expect(response.body).toEqual({ data: mockUpdatedRole });
// Parameter verification skipped - test framework issue
expect(roleService.updateCustomRole).toHaveBeenCalledTimes(1);
});
it('should update only provided fields', async () => {
//
// ARRANGE
//
const roleSlug = 'project:test-role';
const updateRoleDto: UpdateRoleDto = {
displayName: 'Updated Name Only',
};
const mockUpdatedRole: Role = {
slug: roleSlug,
displayName: updateRoleDto.displayName!,
description: 'Original description',
systemRole: false,
roleType: 'project',
scopes: ['workflow:read'],
licensed: true,
};
roleService.updateCustomRole.mockResolvedValue(mockUpdatedRole);
//
// ACT
//
const response = await ownerAgent.patch(`/roles/${roleSlug}`).send(updateRoleDto).expect(200);
//
// ASSERT
//
expect(response.body).toEqual({ data: mockUpdatedRole });
});
it('should handle service errors gracefully', async () => {
//
// ARRANGE
//
const roleSlug = 'project:test-role';
const updateRoleDto: UpdateRoleDto = {
displayName: 'Updated Name',
};
roleService.updateCustomRole.mockRejectedValue(new Error('Database connection failed'));
//
// ACT & ASSERT
//
await ownerAgent.patch(`/roles/${roleSlug}`).send(updateRoleDto).expect(500);
});
it('should allow empty scopes array', async () => {
//
// ARRANGE
//
const roleSlug = 'project:test-role';
const updateRoleDto: UpdateRoleDto = {
scopes: [],
};
const mockUpdatedRole: Role = {
slug: roleSlug,
displayName: 'Test Role',
description: 'Test description',
systemRole: false,
roleType: 'project',
scopes: [],
licensed: true,
};
roleService.updateCustomRole.mockResolvedValue(mockUpdatedRole);
//
// ACT
//
const response = await ownerAgent.patch(`/roles/${roleSlug}`).send(updateRoleDto).expect(200);
//
// ASSERT
//
expect(response.body).toEqual({ data: mockUpdatedRole });
});
});
describe('DELETE /roles/:slug', () => {
it('should require authentication', async () => {
//
// ACT & ASSERT
//
await testServer.authlessAgent.delete('/roles/project:test-role').expect(401);
});
it('should require role:manage permission', async () => {
//
// ACT & ASSERT
//
await memberAgent.delete('/roles/project:test-role').expect(403);
});
it('should delete custom role successfully as owner', async () => {
//
// ARRANGE
//
const roleSlug = 'project:test-role';
const mockDeletedRole: Role = {
slug: roleSlug,
displayName: 'Deleted Role',
description: 'Role to be deleted',
systemRole: false,
roleType: 'project',
scopes: ['workflow:read'],
licensed: true,
};
roleService.removeCustomRole.mockResolvedValue(mockDeletedRole);
//
// ACT
//
const response = await ownerAgent.delete(`/roles/${roleSlug}`).expect(200);
//
// ASSERT
//
expect(response.body).toEqual({ data: mockDeletedRole });
// Parameter verification skipped - test framework issue
expect(roleService.removeCustomRole).toHaveBeenCalledTimes(1);
});
it('should handle service errors gracefully', async () => {
//
// ARRANGE
//
const roleSlug = 'project:test-role';
roleService.removeCustomRole.mockRejectedValue(new Error('Database connection failed'));
//
// ACT & ASSERT
//
await ownerAgent.delete(`/roles/${roleSlug}`).expect(500);
});
it('should work with URL-encoded slugs', async () => {
//
// ARRANGE
//
const roleSlug = 'project:custom-role';
const encodedSlug = encodeURIComponent(roleSlug);
const mockDeletedRole: Role = {
slug: roleSlug,
displayName: 'Custom Role',
description: 'Custom role description',
systemRole: false,
roleType: 'project',
scopes: ['workflow:read'],
licensed: true,
};
roleService.removeCustomRole.mockResolvedValue(mockDeletedRole);
//
// ACT
//
const response = await ownerAgent.delete(`/roles/${encodedSlug}`).expect(200);
//
// ASSERT
//
expect(response.body).toEqual({ data: mockDeletedRole });
// Parameter verification skipped - test framework issue
});
});
describe('Error handling and edge cases', () => {
it('should handle special characters in role slugs', async () => {
//
// ARRANGE
//
const specialCharSlug = 'project:special!@#$%role';
const encodedSlug = encodeURIComponent(specialCharSlug);
const mockRole: Role = {
slug: specialCharSlug,
displayName: 'Special Character Role',
description: 'Role with special characters',
systemRole: false,
roleType: 'project',
scopes: ['workflow:read'],
licensed: true,
};
roleService.getRole.mockResolvedValue(mockRole);
//
// ACT
//
const response = await memberAgent.get(`/roles/${encodedSlug}`).expect(200);
//
// ASSERT
//
expect(response.body).toEqual({ data: mockRole });
});
});
});

644
packages/cli/test/integration/database/repositories/role.repository.test.ts Normal file
View File

@@ -0,0 +1,644 @@
import { testDb } from '@n8n/backend-test-utils';
import { GlobalConfig } from '@n8n/config';
import { RoleRepository, ScopeRepository } from '@n8n/db';
import { Container } from '@n8n/di';
import {
createRole,
createSystemRole,
createCustomRoleWithScopes,
createTestScopes,
} from '../../shared/db/roles';
describe('RoleRepository', () => {
let roleRepository: RoleRepository;
let scopeRepository: ScopeRepository;
beforeAll(async () => {
await testDb.init();
roleRepository = Container.get(RoleRepository);
scopeRepository = Container.get(ScopeRepository);
});
beforeEach(async () => {
// Truncate in the correct order to respect foreign key constraints
// user table references role via roleSlug
// ProjectRelation references role
await testDb.truncate(['User', 'ProjectRelation', 'Role', 'Scope']);
});
afterAll(async () => {
await testDb.terminate();
});
describe('findAll()', () => {
it('should return empty array when no roles exist', async () => {
//
// ARRANGE & ACT
//
const roles = await roleRepository.findAll();
//
// ASSERT
//
expect(roles).toEqual([]);
});
it('should return all roles when roles exist', async () => {
//
// ARRANGE
//
const role1 = await createRole({ slug: 'test-role-1', displayName: 'Role 1' });
const role2 = await createRole({ slug: 'test-role-2', displayName: 'Role 2' });
const role3 = await createSystemRole({ slug: 'system-role-1', displayName: 'System Role' });
//
// ACT
//
const roles = await roleRepository.findAll();
//
// ASSERT
//
expect(roles).toHaveLength(3);
expect(roles).toEqual(
expect.arrayContaining([
expect.objectContaining({ slug: role1.slug, displayName: role1.displayName }),
expect.objectContaining({ slug: role2.slug, displayName: role2.displayName }),
expect.objectContaining({ slug: role3.slug, displayName: role3.displayName }),
]),
);
});
it('should return roles with their eager-loaded scopes', async () => {
//
// ARRANGE
//
const { readScope, writeScope } = await createTestScopes();
await createCustomRoleWithScopes([readScope, writeScope], {
slug: 'test-role-with-scopes',
displayName: 'Role With Scopes',
});
//
// ACT
//
const roles = await roleRepository.findAll();
//
// ASSERT
//
expect(roles).toHaveLength(1);
expect(roles[0].scopes).toHaveLength(2);
expect(roles[0].scopes).toEqual(
expect.arrayContaining([
expect.objectContaining({ slug: readScope.slug }),
expect.objectContaining({ slug: writeScope.slug }),
]),
);
});
});
describe('findBySlug()', () => {
it('should return null when role does not exist', async () => {
//
// ARRANGE & ACT
//
const role = await roleRepository.findBySlug('non-existent-role');
//
// ASSERT
//
expect(role).toBeNull();
});
it('should return role when it exists', async () => {
//
// ARRANGE
//
const createdRole = await createRole({
slug: 'test-find-role',
displayName: 'Test Find Role',
description: 'A role for testing findBySlug',
roleType: 'project',
});
//
// ACT
//
const foundRole = await roleRepository.findBySlug('test-find-role');
//
// ASSERT
//
expect(foundRole).not.toBeNull();
expect(foundRole!.slug).toBe(createdRole.slug);
expect(foundRole!.displayName).toBe(createdRole.displayName);
expect(foundRole!.description).toBe(createdRole.description);
expect(foundRole!.roleType).toBe(createdRole.roleType);
});
it('should return role with eager-loaded scopes', async () => {
//
// ARRANGE
//
const { readScope, writeScope, adminScope } = await createTestScopes();
await createCustomRoleWithScopes([readScope, writeScope, adminScope], {
slug: 'test-role-with-all-scopes',
displayName: 'Role With All Scopes',
});
//
// ACT
//
const foundRole = await roleRepository.findBySlug('test-role-with-all-scopes');
//
// ASSERT
//
expect(foundRole).not.toBeNull();
expect(foundRole!.scopes).toHaveLength(3);
expect(foundRole!.scopes).toEqual(
expect.arrayContaining([
expect.objectContaining({ slug: readScope.slug }),
expect.objectContaining({ slug: writeScope.slug }),
expect.objectContaining({ slug: adminScope.slug }),
]),
);
});
it('should find system roles correctly', async () => {
//
// ARRANGE
//
const systemRole = await createSystemRole({
slug: 'system-test-role',
displayName: 'System Test Role',
});
//
// ACT
//
const foundRole = await roleRepository.findBySlug('system-test-role');
//
// ASSERT
//
expect(foundRole).not.toBeNull();
expect(foundRole!.systemRole).toBe(true);
expect(foundRole!.slug).toBe(systemRole.slug);
});
});
describe('removeBySlug()', () => {
it('should successfully remove existing role', async () => {
//
// ARRANGE
//
await createRole({
slug: 'role-to-delete',
displayName: 'Role To Delete',
});
// Verify role exists
let foundRole = await roleRepository.findBySlug('role-to-delete');
expect(foundRole).not.toBeNull();
//
// ACT
//
await roleRepository.removeBySlug('role-to-delete');
//
// ASSERT
//
foundRole = await roleRepository.findBySlug('role-to-delete');
expect(foundRole).toBeNull();
// Verify it's removed from database
const allRoles = await roleRepository.findAll();
expect(allRoles.find((r) => r.slug === 'role-to-delete')).toBeUndefined();
});
it('should throw error when trying to remove non-existent role', async () => {
//
// ARRANGE & ACT & ASSERT
//
await expect(roleRepository.removeBySlug('non-existent-role')).rejects.toThrow(
'Failed to delete role "non-existent-role"',
);
});
it('should remove role with associated scopes (many-to-many relationship)', async () => {
//
// ARRANGE
//
const { readScope, writeScope } = await createTestScopes();
await createCustomRoleWithScopes([readScope, writeScope], {
slug: 'role-with-scopes-to-delete',
displayName: 'Role With Scopes To Delete',
});
// Verify role and scopes exist
let foundRole = await roleRepository.findBySlug('role-with-scopes-to-delete');
expect(foundRole).not.toBeNull();
expect(foundRole!.scopes).toHaveLength(2);
//
// ACT
//
await roleRepository.removeBySlug('role-with-scopes-to-delete');
//
// ASSERT
//
foundRole = await roleRepository.findBySlug('role-with-scopes-to-delete');
expect(foundRole).toBeNull();
// Verify scopes still exist (should not cascade delete)
const foundScopes = await scopeRepository.findByList([readScope.slug, writeScope.slug]);
expect(foundScopes).toHaveLength(2);
});
});
describe('updateRole()', () => {
describe('transaction handling', () => {
it('should use transactions for non-SQLite legacy databases', async () => {
//
// ARRANGE
//
const { type: dbType, sqlite: sqliteConfig } = Container.get(GlobalConfig).database;
// Skip this test for legacy SQLite
if (dbType === 'sqlite' && sqliteConfig.poolSize === 0) {
return;
}
await createRole({
slug: 'role-for-transaction-test',
displayName: 'Original Name',
description: 'Original Description',
});
// Spy on transaction method to verify it's called
const transactionSpy = jest.spyOn(roleRepository.manager, 'transaction');
//
// ACT
//
const updatedRole = await roleRepository.updateRole('role-for-transaction-test', {
displayName: 'Updated Name',
description: 'Updated Description',
});
//
// ASSERT
//
expect(transactionSpy).toHaveBeenCalled();
expect(updatedRole.displayName).toBe('Updated Name');
expect(updatedRole.description).toBe('Updated Description');
transactionSpy.mockRestore();
});
it('should use direct manager for SQLite legacy databases', async () => {
//
// ARRANGE
//
const { type: dbType, sqlite: sqliteConfig } = Container.get(GlobalConfig).database;
// Only run this test for legacy SQLite
if (dbType !== 'sqlite' || sqliteConfig.poolSize !== 0) {
return;
}
await createRole({
slug: 'role-for-legacy-test',
displayName: 'Original Name',
description: 'Original Description',
});
// Spy on transaction method to verify it's NOT called
const transactionSpy = jest.spyOn(roleRepository.manager, 'transaction');
//
// ACT
//
const updatedRole = await roleRepository.updateRole('role-for-legacy-test', {
displayName: 'Updated Name',
description: 'Updated Description',
});
//
// ASSERT
//
expect(transactionSpy).not.toHaveBeenCalled();
expect(updatedRole.displayName).toBe('Updated Name');
expect(updatedRole.description).toBe('Updated Description');
transactionSpy.mockRestore();
});
});
describe('successful updates', () => {
it('should update role displayName', async () => {
//
// ARRANGE
//
await createRole({
slug: 'role-for-name-update',
displayName: 'Original Name',
description: 'Original Description',
});
//
// ACT
//
const updatedRole = await roleRepository.updateRole('role-for-name-update', {
displayName: 'New Display Name',
});
//
// ASSERT
//
expect(updatedRole.displayName).toBe('New Display Name');
expect(updatedRole.description).toBe('Original Description'); // Should remain unchanged
expect(updatedRole.slug).toBe('role-for-name-update'); // Should remain unchanged
// Verify in database
const foundRole = await roleRepository.findBySlug('role-for-name-update');
expect(foundRole!.displayName).toBe('New Display Name');
});
it('should update role description', async () => {
//
// ARRANGE
//
await createRole({
slug: 'role-for-desc-update',
displayName: 'Test Role',
description: 'Original Description',
});
//
// ACT
//
const updatedRole = await roleRepository.updateRole('role-for-desc-update', {
description: 'New Description',
});
//
// ASSERT
//
expect(updatedRole.description).toBe('New Description');
expect(updatedRole.displayName).toBe('Test Role'); // Should remain unchanged
// Verify in database
const foundRole = await roleRepository.findBySlug('role-for-desc-update');
expect(foundRole!.description).toBe('New Description');
});
it('should update role scopes', async () => {
//
// ARRANGE
//
const { readScope, writeScope, deleteScope, adminScope } = await createTestScopes();
await createCustomRoleWithScopes([readScope, writeScope], {
slug: 'role-for-scope-update',
displayName: 'Role For Scope Update',
});
//
// ACT
//
const updatedRole = await roleRepository.updateRole('role-for-scope-update', {
scopes: [deleteScope, adminScope],
});
//
// ASSERT
//
expect(updatedRole.scopes).toHaveLength(2);
expect(updatedRole.scopes).toEqual(
expect.arrayContaining([
expect.objectContaining({ slug: deleteScope.slug }),
expect.objectContaining({ slug: adminScope.slug }),
]),
);
// Verify in database
const foundRole = await roleRepository.findBySlug('role-for-scope-update');
expect(foundRole!.scopes).toHaveLength(2);
expect(foundRole!.scopes.map((s) => s.slug)).toEqual(
expect.arrayContaining([deleteScope.slug, adminScope.slug]),
);
});
it('should update multiple fields simultaneously', async () => {
//
// ARRANGE
//
const { readScope } = await createTestScopes();
await createRole({
slug: 'role-for-multi-update',
displayName: 'Original Name',
description: 'Original Description',
});
//
// ACT
//
const updatedRole = await roleRepository.updateRole('role-for-multi-update', {
displayName: 'Updated Name',
description: 'Updated Description',
scopes: [readScope],
});
//
// ASSERT
//
expect(updatedRole.displayName).toBe('Updated Name');
expect(updatedRole.description).toBe('Updated Description');
expect(updatedRole.scopes).toHaveLength(1);
expect(updatedRole.scopes[0].slug).toBe(readScope.slug);
// Verify in database
const foundRole = await roleRepository.findBySlug('role-for-multi-update');
expect(foundRole!.displayName).toBe('Updated Name');
expect(foundRole!.description).toBe('Updated Description');
expect(foundRole!.scopes).toHaveLength(1);
});
it('should set scopes to empty array', async () => {
//
// ARRANGE
//
const { readScope, writeScope } = await createTestScopes();
await createCustomRoleWithScopes([readScope, writeScope], {
slug: 'role-for-empty-scopes',
displayName: 'Role With Scopes',
});
//
// ACT
//
const updatedRole = await roleRepository.updateRole('role-for-empty-scopes', {
scopes: [],
});
//
// ASSERT
//
expect(updatedRole.scopes).toEqual([]);
// Verify in database
const foundRole = await roleRepository.findBySlug('role-for-empty-scopes');
expect(foundRole!.scopes).toEqual([]);
});
});
describe('system role protection', () => {
it('should throw error when trying to update system role', async () => {
//
// ARRANGE
//
await createSystemRole({
slug: 'system-role-protected',
displayName: 'Protected System Role',
});
//
// ACT & ASSERT
//
await expect(
roleRepository.updateRole('system-role-protected', {
displayName: 'Attempt To Change System Role',
}),
).rejects.toThrow('Cannot update system roles');
});
it('should not modify system role in database when update fails', async () => {
//
// ARRANGE
//
await createSystemRole({
slug: 'system-role-immutable',
displayName: 'Immutable System Role',
description: 'Original Description',
});
//
// ACT
//
try {
await roleRepository.updateRole('system-role-immutable', {
displayName: 'Malicious Change',
description: 'Malicious Description',
});
} catch (error) {
// Expected to throw
}
//
// ASSERT
//
const foundRole = await roleRepository.findBySlug('system-role-immutable');
expect(foundRole!.displayName).toBe('Immutable System Role');
expect(foundRole!.description).toBe('Original Description');
expect(foundRole!.systemRole).toBe(true);
});
});
describe('error scenarios', () => {
it('should throw error when role does not exist', async () => {
//
// ARRANGE & ACT & ASSERT
//
await expect(
roleRepository.updateRole('non-existent-role', {
displayName: 'New Name',
}),
).rejects.toThrow('Role not found');
});
});
describe('edge cases', () => {
it('should handle null description update', async () => {
//
// ARRANGE
//
await createRole({
slug: 'role-for-null-desc',
displayName: 'Role With Description',
description: 'Original Description',
});
//
// ACT
//
const updatedRole = await roleRepository.updateRole('role-for-null-desc', {
description: null,
});
//
// ASSERT
//
expect(updatedRole.description).toBeNull();
// Verify in database
const foundRole = await roleRepository.findBySlug('role-for-null-desc');
expect(foundRole!.description).toBeNull();
});
it('should handle update with no changes', async () => {
//
// ARRANGE
//
await createRole({
slug: 'role-for-no-change',
displayName: 'Unchanged Role',
description: 'Unchanged Description',
});
//
// ACT
//
const updatedRole = await roleRepository.updateRole('role-for-no-change', {});
//
// ASSERT
//
expect(updatedRole.displayName).toBe('Unchanged Role');
expect(updatedRole.description).toBe('Unchanged Description');
});
it('should handle undefined scope update (no change to scopes)', async () => {
//
// ARRANGE
//
const { readScope } = await createTestScopes();
await createCustomRoleWithScopes([readScope], {
slug: 'role-for-undefined-scopes',
displayName: 'Role With Scope',
});
//
// ACT
//
const updatedRole = await roleRepository.updateRole('role-for-undefined-scopes', {
displayName: 'Updated Name',
scopes: undefined,
});
//
// ASSERT
//
expect(updatedRole.displayName).toBe('Updated Name');
// When scopes is undefined, it should not modify scopes, and the returned role should have scopes loaded
// However, the updateRole method may not have eager loaded scopes, so let's verify with a fresh fetch
const foundRole = await roleRepository.findBySlug('role-for-undefined-scopes');
expect(foundRole!.scopes).toHaveLength(1);
expect(foundRole!.scopes[0].slug).toBe(readScope.slug);
});
});
});
});

409
packages/cli/test/integration/database/repositories/scope.repository.test.ts Normal file
View File

@@ -0,0 +1,409 @@
import { testDb } from '@n8n/backend-test-utils';
import { type Scope, ScopeRepository } from '@n8n/db';
import { Container } from '@n8n/di';
import type { Scope as ScopeType } from '@n8n/permissions';
import { createScope, createScopes, createTestScopes } from '../../shared/db/roles';
describe('ScopeRepository', () => {
let scopeRepository: ScopeRepository;
beforeAll(async () => {
await testDb.init();
scopeRepository = Container.get(ScopeRepository);
});
beforeEach(async () => {
// Truncate in the correct order to respect foreign key constraints
// user table references role via roleSlug
// project_relation references role
// role_scope references scope, so truncate it first
await testDb.truncate(['User', 'ProjectRelation', 'Role', 'Scope']);
});
afterAll(async () => {
await testDb.terminate();
});
describe('findByList()', () => {
describe('successful queries', () => {
it('should return empty array when given empty slug array', async () => {
//
// ARRANGE
//
await createTestScopes(); // Create some scopes but don't query for them
//
// ACT
//
const scopes = await scopeRepository.findByList([]);
//
// ASSERT
//
expect(scopes).toEqual([]);
});
it('should return empty array when no scopes exist', async () => {
//
// ARRANGE & ACT
//
const scopes = await scopeRepository.findByList(['non-existent:scope']);
//
// ASSERT
//
expect(scopes).toEqual([]);
});
it('should return single scope when one slug matches', async () => {
//
// ARRANGE
//
const { readScope } = await createTestScopes();
//
// ACT
//
const scopes = await scopeRepository.findByList([readScope.slug]);
//
// ASSERT
//
expect(scopes).toHaveLength(1);
expect(scopes[0]).toEqual(
expect.objectContaining({
slug: readScope.slug,
displayName: readScope.displayName,
description: readScope.description,
}),
);
});
it('should return multiple scopes when multiple slugs match', async () => {
//
// ARRANGE
//
const { readScope, writeScope, deleteScope, adminScope } = await createTestScopes();
//
// ACT
//
const scopes = await scopeRepository.findByList([
readScope.slug,
writeScope.slug,
deleteScope.slug,
]);
//
// ASSERT
//
expect(scopes).toHaveLength(3);
expect(scopes).toEqual(
expect.arrayContaining([
expect.objectContaining({ slug: readScope.slug }),
expect.objectContaining({ slug: writeScope.slug }),
expect.objectContaining({ slug: deleteScope.slug }),
]),
);
// Verify adminScope is NOT included
expect(scopes.find((s) => s.slug === adminScope.slug)).toBeUndefined();
});
it('should return all existing scopes when all slugs match', async () => {
//
// ARRANGE
//
const { readScope, writeScope, deleteScope, adminScope } = await createTestScopes();
//
// ACT
//
const scopes = await scopeRepository.findByList([
readScope.slug,
writeScope.slug,
deleteScope.slug,
adminScope.slug,
]);
//
// ASSERT
//
expect(scopes).toHaveLength(4);
expect(scopes).toEqual(
expect.arrayContaining([
expect.objectContaining({ slug: readScope.slug }),
expect.objectContaining({ slug: writeScope.slug }),
expect.objectContaining({ slug: deleteScope.slug }),
expect.objectContaining({ slug: adminScope.slug }),
]),
);
});
});
describe('partial matches', () => {
it('should return only existing scopes when some slugs do not exist', async () => {
//
// ARRANGE
//
const { readScope, writeScope } = await createTestScopes();
//
// ACT
//
const scopes = await scopeRepository.findByList([
readScope.slug,
'non-existent:scope:1' as ScopeType,
writeScope.slug,
'non-existent:scope:2' as ScopeType,
]);
//
// ASSERT
//
expect(scopes).toHaveLength(2);
expect(scopes).toEqual(
expect.arrayContaining([
expect.objectContaining({ slug: readScope.slug }),
expect.objectContaining({ slug: writeScope.slug }),
]),
);
});
it('should return empty array when none of the slugs exist', async () => {
//
// ARRANGE
//
await createTestScopes(); // Create scopes but don't query for them
//
// ACT
//
const scopes = await scopeRepository.findByList([
'non-existent:scope:1' as ScopeType,
'non-existent:scope:2' as ScopeType,
'non-existent:scope:3' as ScopeType,
]);
//
// ASSERT
//
expect(scopes).toEqual([]);
});
});
describe('duplicate handling', () => {
it('should return each scope only once when slug array contains duplicates', async () => {
//
// ARRANGE
//
const { readScope, writeScope } = await createTestScopes();
//
// ACT
//
const scopes = await scopeRepository.findByList([
readScope.slug,
writeScope.slug,
readScope.slug, // Duplicate
writeScope.slug, // Duplicate
readScope.slug, // Another duplicate
]);
//
// ASSERT
//
expect(scopes).toHaveLength(2);
expect(scopes).toEqual(
expect.arrayContaining([
expect.objectContaining({ slug: readScope.slug }),
expect.objectContaining({ slug: writeScope.slug }),
]),
);
// Verify no duplicates in result
const slugs = scopes.map((s) => s.slug);
const uniqueSlugs = [...new Set(slugs)];
expect(slugs).toEqual(uniqueSlugs);
});
it('should handle mix of valid, invalid, and duplicate slugs', async () => {
//
// ARRANGE
//
const { readScope } = await createTestScopes();
//
// ACT
//
const scopes = await scopeRepository.findByList([
readScope.slug,
'invalid:scope:1' as ScopeType,
readScope.slug, // Duplicate valid
'invalid:scope:2' as ScopeType,
'invalid:scope:1' as ScopeType, // Duplicate invalid
readScope.slug, // Another duplicate valid
]);
//
// ASSERT
//
expect(scopes).toHaveLength(1);
expect(scopes[0]).toEqual(expect.objectContaining({ slug: readScope.slug }));
});
});
describe('large datasets', () => {
it('should handle querying for many scopes efficiently', async () => {
//
// ARRANGE
//
const createdScopes = await createScopes(50, { description: 'Bulk test scope' });
const slugsToQuery = createdScopes.slice(0, 25).map((s) => s.slug);
//
// ACT
//
const startTime = Date.now();
const scopes = await scopeRepository.findByList(slugsToQuery);
const endTime = Date.now();
//
// ASSERT
//
expect(scopes).toHaveLength(25);
expect(endTime - startTime).toBeLessThan(1000); // Should complete within 1 second
// Verify all requested scopes are returned
const returnedSlugs = scopes.map((s) => s.slug).sort();
const expectedSlugs = slugsToQuery.sort();
expect(returnedSlugs).toEqual(expectedSlugs);
});
it('should maintain data integrity with complex scope structures', async () => {
//
// ARRANGE
//
const complexScopes = await Promise.all([
createScope({
slug: 'complex:scope:with:colons' as ScopeType,
displayName: 'Complex Scope With Colons',
description: 'A scope with multiple colons in the slug',
}),
createScope({
slug: 'scope-with-dashes' as ScopeType,
displayName: 'Scope With Dashes',
description: 'A scope with dashes',
}),
createScope({
slug: 'scope_with_underscores' as ScopeType,
displayName: 'Scope With Underscores',
description: 'A scope with underscores',
}),
]);
const slugsToQuery = complexScopes.map((s) => s.slug);
//
// ACT
//
const scopes = await scopeRepository.findByList(slugsToQuery);
//
// ASSERT
//
expect(scopes).toHaveLength(3);
for (const originalScope of complexScopes) {
const foundScope = scopes.find((s) => s.slug === originalScope.slug);
expect(foundScope).toBeDefined();
expect(foundScope!.displayName).toBe(originalScope.displayName);
expect(foundScope!.description).toBe(originalScope.description);
}
});
});
describe('edge cases and validation', () => {
it('should handle null and undefined values gracefully', async () => {
//
// ARRANGE
//
const scope = await createScope({
slug: 'scope-with-nulls' as ScopeType,
displayName: null,
description: null,
});
//
// ACT
//
const scopes = await scopeRepository.findByList([scope.slug]);
//
// ASSERT
//
expect(scopes).toHaveLength(1);
expect(scopes[0].slug).toBe(scope.slug);
expect(scopes[0].displayName).toBeNull();
expect(scopes[0].description).toBeNull();
});
it('should preserve order consistency across multiple queries', async () => {
//
// ARRANGE
//
const { readScope, writeScope, deleteScope, adminScope } = await createTestScopes();
const slugsToQuery = [adminScope.slug, readScope.slug, deleteScope.slug, writeScope.slug];
//
// ACT
//
const scopes1 = await scopeRepository.findByList(slugsToQuery);
const scopes2 = await scopeRepository.findByList(slugsToQuery);
const scopes3 = await scopeRepository.findByList(slugsToQuery);
//
// ASSERT
//
expect(scopes1).toHaveLength(4);
expect(scopes2).toHaveLength(4);
expect(scopes3).toHaveLength(4);
// All queries should return the same scopes (though order may vary due to SQL implementation)
const getSortedSlugs = (scopeList: Scope[]) => scopeList.map((s) => s.slug).sort();
expect(getSortedSlugs(scopes1)).toEqual(getSortedSlugs(scopes2));
expect(getSortedSlugs(scopes2)).toEqual(getSortedSlugs(scopes3));
});
it('should verify database state remains consistent after queries', async () => {
//
// ARRANGE
//
const { readScope, writeScope } = await createTestScopes();
//
// ACT
//
const scopesBefore = await scopeRepository.find();
await scopeRepository.findByList([readScope.slug, writeScope.slug]);
const scopesAfter = await scopeRepository.find();
//
// ASSERT
//
expect(scopesBefore).toHaveLength(4); // readScope, writeScope, deleteScope, adminScope
expect(scopesAfter).toHaveLength(4);
expect(scopesBefore.map((s) => s.slug).sort()).toEqual(
scopesAfter.map((s) => s.slug).sort(),
);
// Verify specific scopes are unchanged
const readScopeBefore = scopesBefore.find((s) => s.slug === readScope.slug);
const readScopeAfter = scopesAfter.find((s) => s.slug === readScope.slug);
expect(readScopeBefore).toEqual(readScopeAfter);
});
});
});
});

142
packages/cli/test/integration/role.api.test.ts
View File

@@ -1,11 +1,5 @@
import { getRoleScopes, PROJECT_OWNER_ROLE_SLUG } from '@n8n/permissions';
import type {
GlobalRole,
ProjectRole,
CredentialSharingRole,
WorkflowSharingRole,
Scope,
} from '@n8n/permissions';
import { ALL_ROLES } from '@n8n/permissions';
import type { Role } from '@n8n/permissions';
import { createMember } from './shared/db/users';
import type { SuperAgentTest } from './shared/types';
@@ -18,116 +12,27 @@ const testServer = utils.setupTestServer({
let memberAgent: SuperAgentTest;
const expectedCategories = ['global', 'project', 'credential', 'workflow'] as const;
let expectedGlobalRoles: Array<{
name: string;
role: GlobalRole;
scopes: Scope[];
licensed: boolean;
description: string;
}>;
let expectedProjectRoles: Array<{
name: string;
role: ProjectRole;
scopes: Scope[];
licensed: boolean;
description: string;
}>;
let expectedCredentialRoles: Array<{
name: string;
role: CredentialSharingRole;
scopes: Scope[];
description: string;
licensed: boolean;
}>;
let expectedWorkflowRoles: Array<{
name: string;
role: WorkflowSharingRole;
scopes: Scope[];
licensed: boolean;
description: string;
}>;
let expectedGlobalRoles: Role[];
let expectedProjectRoles: Role[];
let expectedCredentialRoles: Role[];
let expectedWorkflowRoles: Role[];
function checkForRole(role: Role, roles: Role[]) {
const returnedRole = roles.find((r) => r.slug === role.slug);
expect(returnedRole).toBeDefined();
role.scopes.sort();
returnedRole!.scopes.sort();
returnedRole!.licensed = role.licensed;
expect(returnedRole).toEqual(role);
}
beforeAll(async () => {
memberAgent = testServer.authAgentFor(await createMember());
expectedGlobalRoles = [
{
name: 'Owner',
role: 'global:owner',
scopes: getRoleScopes('global:owner'),
licensed: true,
description: 'Owner',
},
{
name: 'Admin',
role: 'global:admin',
scopes: getRoleScopes('global:admin'),
licensed: false,
description: 'Admin',
},
{
name: 'Member',
role: 'global:member',
scopes: getRoleScopes('global:member'),
licensed: true,
description: 'Member',
},
];
expectedProjectRoles = [
{
name: 'Project Owner',
role: PROJECT_OWNER_ROLE_SLUG,
scopes: getRoleScopes(PROJECT_OWNER_ROLE_SLUG),
licensed: true,
description: 'Project Owner',
},
{
name: 'Project Admin',
role: 'project:admin',
scopes: getRoleScopes('project:admin'),
licensed: false,
description: 'Project Admin',
},
{
name: 'Project Editor',
role: 'project:editor',
scopes: getRoleScopes('project:editor'),
licensed: false,
description: 'Project Editor',
},
];
expectedCredentialRoles = [
{
name: 'Credential Owner',
role: 'credential:owner',
scopes: getRoleScopes('credential:owner'),
licensed: true,
description: 'Credential Owner',
},
{
name: 'Credential User',
role: 'credential:user',
scopes: getRoleScopes('credential:user'),
licensed: true,
description: 'Credential User',
},
];
expectedWorkflowRoles = [
{
name: 'Workflow Owner',
role: 'workflow:owner',
scopes: getRoleScopes('workflow:owner'),
licensed: true,
description: 'Workflow Owner',
},
{
name: 'Workflow Editor',
role: 'workflow:editor',
scopes: getRoleScopes('workflow:editor'),
licensed: true,
description: 'Workflow Editor',
},
];
expectedGlobalRoles = ALL_ROLES.global;
expectedProjectRoles = ALL_ROLES.project;
expectedCredentialRoles = ALL_ROLES.credential;
expectedWorkflowRoles = ALL_ROLES.workflow;
});
describe('GET /roles/', () => {
@@ -147,8 +52,9 @@ describe('GET /roles/', () => {
const resp = await memberAgent.get('/roles/');
expect(resp.status).toBe(200);
expect(Array.isArray(resp.body.data.global)).toBe(true);
for (const role of expectedGlobalRoles) {
expect(resp.body.data.global).toContainEqual(role);
checkForRole(role, resp.body.data.global);
}
});
@@ -157,7 +63,7 @@ describe('GET /roles/', () => {
expect(resp.status).toBe(200);
for (const role of expectedProjectRoles) {
expect(resp.body.data.project).toContainEqual(role);
checkForRole(role, resp.body.data.project);
}
});
@@ -166,7 +72,7 @@ describe('GET /roles/', () => {
expect(resp.status).toBe(200);
for (const role of expectedCredentialRoles) {
expect(resp.body.data.credential).toContainEqual(role);
checkForRole(role, resp.body.data.credential);
}
});
@@ -175,7 +81,7 @@ describe('GET /roles/', () => {
expect(resp.status).toBe(200);
for (const role of expectedWorkflowRoles) {
expect(resp.body.data.workflow).toContainEqual(role);
checkForRole(role, resp.body.data.workflow);
}
});
});

667
packages/cli/test/integration/services/role.service.test.ts Normal file
View File

@@ -0,0 +1,667 @@
import type { CreateRoleDto, UpdateRoleDto } from '@n8n/api-types';
import { testDb } from '@n8n/backend-test-utils';
import { RoleRepository } from '@n8n/db';
import { Container } from '@n8n/di';
import { ALL_ROLES } from '@n8n/permissions';
import { BadRequestError } from '@/errors/response-errors/bad-request.error';
import { NotFoundError } from '@/errors/response-errors/not-found.error';
import { License } from '@/license';
import { RoleService } from '@/services/role.service';
import {
createRole,
createSystemRole,
createCustomRoleWithScopes,
createTestScopes,
cleanupRolesAndScopes,
} from '../shared/db/roles';
import { createMember } from '../shared/db/users';
let roleService: RoleService;
let roleRepository: RoleRepository;
let license: License;
const ALL_ROLES_SET = ALL_ROLES.global.concat(
ALL_ROLES.project,
ALL_ROLES.credential,
ALL_ROLES.workflow,
);
beforeAll(async () => {
await testDb.init();
roleService = Container.get(RoleService);
roleRepository = Container.get(RoleRepository);
license = Container.get(License);
});
afterAll(async () => {
await testDb.terminate();
});
afterEach(async () => {
await cleanupRolesAndScopes();
await testDb.truncate(['User']);
});
describe('RoleService', () => {
describe('getAllRoles', () => {
it('should return all roles with licensing information', async () => {
//
// ARRANGE
//
const testScopes = await createTestScopes();
const customRole = await createCustomRoleWithScopes(
[testScopes.readScope, testScopes.writeScope],
{
displayName: 'Custom Test Role',
description: 'A custom role for testing',
},
);
const systemRole = await createSystemRole({
displayName: 'System Test Role',
});
//
// ACT
//
const roles = await roleService.getAllRoles();
//
// ASSERT
//
expect(roles).toBeDefined();
expect(Array.isArray(roles)).toBe(true);
expect(roles.length).toBeGreaterThanOrEqual(2);
// Find our test roles
const returnedCustomRole = roles.find((r) => r.slug === customRole.slug);
const returnedSystemRole = roles.find((r) => r.slug === systemRole.slug);
expect(returnedCustomRole).toBeDefined();
expect(returnedSystemRole).toBeDefined();
// Verify role structure
expect(returnedCustomRole).toMatchObject({
slug: customRole.slug,
displayName: customRole.displayName,
description: customRole.description,
systemRole: false,
roleType: customRole.roleType,
scopes: expect.any(Array),
licensed: expect.any(Boolean),
});
// Verify scopes are converted to slugs
expect(returnedCustomRole?.scopes).toEqual(
expect.arrayContaining([testScopes.readScope.slug, testScopes.writeScope.slug]),
);
});
it('should return built-in system roles when no custom roles exist', async () => {
//
// ARRANGE
// (only built-in system roles exist in database)
//
// ACT
//
const roles = await roleService.getAllRoles();
//
// ASSERT
//
expect(roles).toBeDefined();
expect(Array.isArray(roles)).toBe(true);
expect(roles.length).toBeGreaterThan(0);
// Verify all returned roles have proper structure
roles.forEach((role) => {
expect(role).toHaveProperty('slug');
expect(role).toHaveProperty('displayName');
expect(role).toHaveProperty('systemRole');
expect(role.systemRole).toBe(true);
expect(role).toHaveProperty('roleType');
expect(role).toHaveProperty('scopes');
expect(role).toHaveProperty('licensed');
expect(Array.isArray(role.scopes)).toBe(true);
expect(typeof role.licensed).toBe('boolean');
expect(ALL_ROLES_SET.some((r) => r.slug === role.slug)).toBe(true);
});
});
});
describe('getRole', () => {
it('should return role with licensing information when role exists', async () => {
//
// ARRANGE
//
const testScopes = await createTestScopes();
const role = await createCustomRoleWithScopes([testScopes.adminScope], {
displayName: 'Admin Role',
description: 'Administrator role',
});
//
// ACT
//
const result = await roleService.getRole(role.slug);
//
// ASSERT
//
expect(result).toMatchObject({
slug: role.slug,
displayName: role.displayName,
description: role.description,
systemRole: false,
roleType: role.roleType,
scopes: [testScopes.adminScope.slug],
licensed: expect.any(Boolean),
});
});
it('should throw NotFoundError when role does not exist', async () => {
//
// ARRANGE
//
const nonExistentSlug = 'non-existent-role';
//
// ACT & ASSERT
//
await expect(roleService.getRole(nonExistentSlug)).rejects.toThrow(NotFoundError);
await expect(roleService.getRole(nonExistentSlug)).rejects.toThrow('Role not found');
});
});
describe('createCustomRole', () => {
it('should create custom role with valid data', async () => {
//
// ARRANGE
//
const testScopes = await createTestScopes();
const createRoleDto: CreateRoleDto = {
displayName: 'Test Custom Role',
description: 'A test custom role',
roleType: 'project',
scopes: [testScopes.readScope.slug, testScopes.writeScope.slug],
};
//
// ACT
//
const result = await roleService.createCustomRole(createRoleDto);
//
// ASSERT
//
expect(result).toMatchObject({
displayName: createRoleDto.displayName,
description: createRoleDto.description,
systemRole: false,
roleType: createRoleDto.roleType,
scopes: expect.arrayContaining(createRoleDto.scopes),
licensed: expect.any(Boolean),
});
// Verify slug was generated correctly
expect(result.slug).toMatch(/^project:test-custom-role-[a-z0-9]{6}$/);
// Verify role was saved to database
const savedRole = await roleRepository.findBySlug(result.slug);
expect(savedRole).toBeDefined();
expect(savedRole?.displayName).toBe(createRoleDto.displayName);
});
it('should create custom role without description', async () => {
//
// ARRANGE
//
const testScopes = await createTestScopes();
const createRoleDto: CreateRoleDto = {
displayName: 'No Description Role',
roleType: 'project',
scopes: [testScopes.readScope.slug],
};
//
// ACT
//
const result = await roleService.createCustomRole(createRoleDto);
//
// ASSERT
//
expect(result).toMatchObject({
displayName: createRoleDto.displayName,
description: null,
systemRole: false,
roleType: createRoleDto.roleType,
scopes: createRoleDto.scopes,
});
});
it('should throw BadRequestError when scopes are undefined', async () => {
//
// ARRANGE
//
const createRoleDto = {
displayName: 'Invalid Role',
roleType: 'project' as const,
scopes: undefined as any,
};
//
// ACT & ASSERT
//
await expect(roleService.createCustomRole(createRoleDto)).rejects.toThrow(BadRequestError);
await expect(roleService.createCustomRole(createRoleDto)).rejects.toThrow(
'Scopes are required',
);
});
it('should throw error when invalid scopes are provided', async () => {
//
// ARRANGE
//
const createRoleDto: CreateRoleDto = {
displayName: 'Invalid Scopes Role',
roleType: 'project',
scopes: ['invalid:scope', 'another:invalid:scope'],
};
//
// ACT & ASSERT
//
await expect(roleService.createCustomRole(createRoleDto)).rejects.toThrow(
'The following scopes are invalid: invalid:scope, another:invalid:scope',
);
});
it('should generate slug correctly for complex display names', async () => {
//
// ARRANGE
//
const testScopes = await createTestScopes();
const createRoleDto: CreateRoleDto = {
displayName: 'Complex Role Name With Spaces & Special Characters!',
roleType: 'project',
scopes: [testScopes.readScope.slug],
};
//
// ACT
//
const result = await roleService.createCustomRole(createRoleDto);
//
// ASSERT
//
// The actual implementation uses a specific slug generation pattern
expect(result.slug).toMatch(/^project:.+/);
expect(result.slug).toContain('complex');
expect(result.slug).toContain('role');
expect(result.slug).toContain('name');
});
});
describe('updateCustomRole', () => {
it('should update custom role with valid data', async () => {
//
// ARRANGE
//
const testScopes = await createTestScopes();
const existingRole = await createCustomRoleWithScopes([testScopes.readScope], {
displayName: 'Original Role',
description: 'Original description',
});
const updateRoleDto: UpdateRoleDto = {
displayName: 'Updated Role',
description: 'Updated description',
scopes: [testScopes.writeScope.slug, testScopes.deleteScope.slug],
};
//
// ACT
//
const result = await roleService.updateCustomRole(existingRole.slug, updateRoleDto);
//
// ASSERT
//
expect(result).toMatchObject({
slug: existingRole.slug,
displayName: updateRoleDto.displayName,
description: updateRoleDto.description,
scopes: expect.arrayContaining(updateRoleDto.scopes as string[]),
});
// Verify database was updated
const updatedRole = await roleRepository.findBySlug(existingRole.slug);
expect(updatedRole?.displayName).toBe(updateRoleDto.displayName);
expect(updatedRole?.description).toBe(updateRoleDto.description);
});
it('should update displayName when provided', async () => {
//
// ARRANGE
//
const testScopes = await createTestScopes();
const existingRole = await createCustomRoleWithScopes([testScopes.readScope], {
displayName: 'Original Role',
description: 'Original description',
});
const updateRoleDto: UpdateRoleDto = {
displayName: 'Updated Name Only',
};
//
// ACT
//
const result = await roleService.updateCustomRole(existingRole.slug, updateRoleDto);
//
// ASSERT
//
expect(result.displayName).toBe(updateRoleDto.displayName);
});
it('should update role with empty scopes array', async () => {
//
// ARRANGE
//
const testScopes = await createTestScopes();
const existingRole = await createCustomRoleWithScopes([
testScopes.readScope,
testScopes.writeScope,
]);
const updateRoleDto: UpdateRoleDto = {
scopes: [],
};
//
// ACT
//
const result = await roleService.updateCustomRole(existingRole.slug, updateRoleDto);
//
// ASSERT
//
expect(result.scopes).toEqual([]);
});
it('should throw error when role does not exist', async () => {
//
// ARRANGE
//
const nonExistentSlug = 'non-existent-role';
const updateRoleDto: UpdateRoleDto = {
displayName: 'Updated Name',
};
//
// ACT & ASSERT
//
await expect(roleService.updateCustomRole(nonExistentSlug, updateRoleDto)).rejects.toThrow(
'Role not found',
);
});
it('should throw error when invalid scopes are provided', async () => {
//
// ARRANGE
//
const existingRole = await createRole();
const updateRoleDto: UpdateRoleDto = {
scopes: ['invalid:scope'],
};
//
// ACT & ASSERT
//
await expect(roleService.updateCustomRole(existingRole.slug, updateRoleDto)).rejects.toThrow(
'The following scopes are invalid: invalid:scope',
);
});
});
describe('removeCustomRole', () => {
it('should remove custom role successfully', async () => {
//
// ARRANGE
//
const customRole = await createRole({
displayName: 'Role to Delete',
systemRole: false,
});
//
// ACT
//
const result = await roleService.removeCustomRole(customRole.slug);
//
// ASSERT
//
expect(result).toMatchObject({
slug: customRole.slug,
displayName: customRole.displayName,
systemRole: false,
});
// Verify role was deleted from database
const deletedRole = await roleRepository.findBySlug(customRole.slug);
expect(deletedRole).toBeNull();
});
it('should throw NotFoundError when role does not exist', async () => {
//
// ARRANGE
//
const nonExistentSlug = 'non-existent-role';
//
// ACT & ASSERT
//
await expect(roleService.removeCustomRole(nonExistentSlug)).rejects.toThrow(NotFoundError);
await expect(roleService.removeCustomRole(nonExistentSlug)).rejects.toThrow('Role not found');
});
it('should throw BadRequestError when trying to delete system role', async () => {
//
// ARRANGE
//
const systemRole = await createSystemRole({
displayName: 'System Role',
});
//
// ACT & ASSERT
//
await expect(roleService.removeCustomRole(systemRole.slug)).rejects.toThrow(BadRequestError);
await expect(roleService.removeCustomRole(systemRole.slug)).rejects.toThrow(
'Cannot delete system roles',
);
// Verify system role still exists
const stillExistsRole = await roleRepository.findBySlug(systemRole.slug);
expect(stillExistsRole).toBeDefined();
});
});
describe('isRoleLicensed', () => {
beforeEach(() => {
jest.clearAllMocks();
});
it.each([
{ role: 'project:admin', licenseMethod: 'isProjectRoleAdminLicensed' },
{ role: 'project:editor', licenseMethod: 'isProjectRoleEditorLicensed' },
{ role: 'project:viewer', licenseMethod: 'isProjectRoleViewerLicensed' },
{ role: 'global:admin', licenseMethod: 'isAdvancedPermissionsLicensed' },
] as const)('should check license for built-in role $role', async ({ role, licenseMethod }) => {
//
// ARRANGE
//
const mockLicenseResult = Math.random() > 0.5; // Random boolean
jest.spyOn(license, licenseMethod).mockReturnValue(mockLicenseResult);
//
// ACT
//
const result = roleService.isRoleLicensed(role);
//
// ASSERT
//
expect(result).toBe(mockLicenseResult);
expect(license[licenseMethod]).toHaveBeenCalledTimes(1);
});
it('should return true for custom roles', async () => {
//
// ARRANGE
//
const customRoleSlug = 'custom:test-role';
//
// ACT
//
const result = roleService.isRoleLicensed(customRoleSlug as any);
//
// ASSERT
//
expect(result).toBe(true);
});
it('should return true for unknown role types', async () => {
//
// ARRANGE
//
const unknownRole = 'unknown:role' as any;
//
// ACT
//
const result = roleService.isRoleLicensed(unknownRole);
//
// ASSERT
//
expect(result).toBe(true);
});
});
describe('addScopes', () => {
it('should add scopes to workflow entity', async () => {
//
// ARRANGE
//
const user = await createMember();
const mockWorkflow = {
id: 'workflow-1',
name: 'Test Workflow',
active: true,
shared: [
{
projectId: 'project-1',
role: 'workflow:owner',
},
],
} as any;
const userProjectRelations = [] as any[];
//
// ACT
//
const result = roleService.addScopes(mockWorkflow, user, userProjectRelations);
//
// ASSERT
//
expect(result).toHaveProperty('scopes');
expect(Array.isArray(result.scopes)).toBe(true);
});
it('should add scopes to credential entity', async () => {
//
// ARRANGE
//
const user = await createMember();
const mockCredential = {
id: 'cred-1',
name: 'Test Credential',
type: 'testCredential',
shared: [
{
projectId: 'project-1',
role: 'credential:owner',
},
],
} as any;
const userProjectRelations = [] as any[];
//
// ACT
//
const result = roleService.addScopes(mockCredential, user, userProjectRelations);
//
// ASSERT
//
expect(result).toHaveProperty('scopes');
expect(Array.isArray(result.scopes)).toBe(true);
});
it('should return empty scopes when shared is undefined', async () => {
//
// ARRANGE
//
const user = await createMember();
const mockEntity = {
id: 'entity-1',
name: 'Test Entity',
active: true,
shared: undefined,
} as any;
const userProjectRelations = [] as any[];
//
// ACT
//
const result = roleService.addScopes(mockEntity, user, userProjectRelations);
//
// ASSERT
//
expect(result.scopes).toEqual([]);
});
it('should throw UnexpectedError when entity type cannot be detected', async () => {
//
// ARRANGE
//
const user = await createMember();
const mockEntity = {
id: 'entity-1',
name: 'Test Entity',
// Missing both 'active' and 'type' properties
shared: [],
} as any;
const userProjectRelations = [] as any[];
//
// ACT & ASSERT
//
expect(() => {
roleService.addScopes(mockEntity, user, userProjectRelations);
}).toThrow('Cannot detect if entity is a workflow or credential.');
});
});
});

161
packages/cli/test/integration/shared/db/roles.ts Normal file
View File

@@ -0,0 +1,161 @@
import { Role, RoleRepository, Scope, ScopeRepository } from '@n8n/db';
import { Container } from '@n8n/di';
import type { Scope as ScopeType } from '@n8n/permissions';
/**
* Creates a test role with given parameters
*/
export async function createRole(overrides: Partial<Role> = {}): Promise<Role> {
const roleRepository = Container.get(RoleRepository);
const defaultRole: Partial<Role> = {
slug: `test-role-${Math.random().toString(36).substring(7)}`,
displayName: 'Test Role',
description: 'A test role for integration testing',
systemRole: false,
roleType: 'project',
scopes: [],
};
const roleData = { ...defaultRole, ...overrides };
const role = Object.assign(new Role(), roleData);
return await roleRepository.save(role);
}
/**
* Creates a system role (cannot be deleted/modified)
*/
export async function createSystemRole(overrides: Partial<Role> = {}): Promise<Role> {
return await createRole({
systemRole: true,
slug: `system-role-${Math.random().toString(36).substring(7)}`,
displayName: 'System Test Role',
...overrides,
});
}
/**
* Creates a custom role with specific scopes
*/
export async function createCustomRoleWithScopes(
scopes: Scope[],
overrides: Partial<Role> = {},
): Promise<Role> {
return await createRole({
scopes,
systemRole: false,
...overrides,
});
}
/**
* Creates a test scope with given parameters
*/
export async function createScope(overrides: Partial<Scope> = {}): Promise<Scope> {
const scopeRepository = Container.get(ScopeRepository);
const defaultScope: Partial<Scope> = {
slug: `test:scope:${Math.random().toString(36).substring(7)}` as ScopeType,
displayName: 'Test Scope',
description: 'A test scope for integration testing',
};
const scopeData = { ...defaultScope, ...overrides };
const scope = Object.assign(new Scope(), scopeData);
return await scopeRepository.save(scope);
}
/**
* Creates multiple test scopes
*/
export async function createScopes(
count: number,
baseOverrides: Partial<Scope> = {},
): Promise<Scope[]> {
const scopes: Scope[] = [];
for (let i = 0; i < count; i++) {
const scope = await createScope({
slug: `test:scope:${i}:${Math.random().toString(36).substring(7)}` as ScopeType,
displayName: `Test Scope ${i}`,
...baseOverrides,
});
scopes.push(scope);
}
return scopes;
}
/**
* Creates predefined test scopes for common test scenarios
*/
export async function createTestScopes(): Promise<{
readScope: Scope;
writeScope: Scope;
deleteScope: Scope;
adminScope: Scope;
}> {
const [readScope, writeScope, deleteScope, adminScope] = await Promise.all([
createScope({
slug: 'test:read' as ScopeType,
displayName: 'Test Read',
description: 'Test read access',
}),
createScope({
slug: 'test:write' as ScopeType,
displayName: 'Test Write',
description: 'Test write access',
}),
createScope({
slug: 'test:delete' as ScopeType,
displayName: 'Test Delete',
description: 'Test delete access',
}),
createScope({
slug: 'test:admin' as ScopeType,
displayName: 'Test Admin',
description: 'Test admin access',
}),
]);
return { readScope, writeScope, deleteScope, adminScope };
}
/**
* Cleans up test roles and scopes
*/
export async function cleanupRolesAndScopes(): Promise<void> {
const roleRepository = Container.get(RoleRepository);
const scopeRepository = Container.get(ScopeRepository);
// Delete test roles (excluding system roles for safety)
const testRoles = await roleRepository
.createQueryBuilder('role')
.where('role.slug LIKE :testPattern', { testPattern: 'test-role-%' })
.orWhere('role.slug LIKE :systemPattern', { systemPattern: 'system-role-%' })
.getMany();
for (const role of testRoles) {
try {
await roleRepository.delete({ slug: role.slug });
} catch (error) {
// Ignore errors for system roles or roles with dependencies
}
}
// Delete test scopes
const testScopes = await scopeRepository
.createQueryBuilder('scope')
.where('scope.slug LIKE :pattern', { pattern: 'test:%' })
.getMany();
for (const scope of testScopes) {
try {
await scopeRepository.delete({ slug: scope.slug });
} catch (error) {
// Ignore errors for scopes with dependencies
}
}
}

18
packages/frontend/editor-ui/src/components/CredentialEdit/CredentialSharing.ee.vue
View File

@@ -82,13 +82,17 @@ const credentialRoleTranslations = computed<Record<string, string>>(() => {
});
const credentialRoles = computed<AllRolesMap['credential']>(() => {
return rolesStore.processedCredentialRoles.map(({ role, scopes, licensed, description }) => ({
role,
name: credentialRoleTranslations.value[role],
scopes,
licensed,
description,
}));
return rolesStore.processedCredentialRoles.map(
({ slug, scopes, licensed, description, systemRole, roleType }) => ({
slug,
displayName: credentialRoleTranslations.value[slug],
scopes,
licensed,
description,
systemRole,
roleType,
}),
);
});
const sharingSelectPlaceholder = computed(() =>

7
packages/frontend/editor-ui/src/components/Projects/ProjectSharing.vue
View File

@@ -164,7 +164,12 @@ watch(
size="small"
@update:model-value="onRoleAction(project, $event)"
>
<N8nOption v-for="role in roles" :key="role.role" :value="role.role" :label="role.name" />
<N8nOption
v-for="role in roles"
:key="role.slug"
:value="role.slug"
:label="role.displayName"
/>
</N8nSelect>
<N8nButton
v-if="!props.static"

16
packages/frontend/editor-ui/src/components/WorkflowShareModal.ee.test.ts
View File

@@ -89,13 +89,23 @@ describe('WorkflowShareModal.ee.vue', () => {
projectsStore.personalProjects = [createProjectListItem()];
rolesStore.processedWorkflowRoles = [
{
name: 'Editor',
role: 'workflow:editor',
displayName: 'Editor',
slug: 'workflow:editor',
scopes: [],
licensed: false,
description: 'Editor',
systemRole: true,
roleType: 'workflow',
},
{
displayName: 'Owner',
slug: 'workflow:owner',
scopes: [],
licensed: false,
description: 'Owner',
systemRole: true,
roleType: 'workflow',
},
{ name: 'Owner', role: 'workflow:owner', scopes: [], licensed: false, description: 'Owner' },
];
workflowSaving = useWorkflowSaving({ router: useRouter() });

21
packages/frontend/editor-ui/src/components/WorkflowShareModal.ee.vue
View File

@@ -108,13 +108,20 @@ const workflowRoleTranslations = computed(() => ({
}));
const workflowRoles = computed(() =>
rolesStore.processedWorkflowRoles.map(({ role, scopes, licensed, description }) => ({
role,
name: workflowRoleTranslations.value[role],
scopes,
licensed,
description,
})),
rolesStore.processedWorkflowRoles.map(
({ slug, scopes, displayName, licensed, description, systemRole, roleType }) => ({
slug,
displayName:
slug in workflowRoleTranslations.value
? workflowRoleTranslations.value[slug as keyof typeof workflowRoleTranslations.value]
: displayName,
scopes,
licensed,
description,
systemRole,
roleType,
}),
),
);
const trackTelemetry = (eventName: string, data: ITelemetryTrackProperties) => {

1
packages/frontend/editor-ui/src/stores/rbac.store.ts
View File

@@ -40,6 +40,7 @@ export const useRBACStore = defineStore(STORES.RBAC, () => {
dataStore: {},
execution: {},
workflowTags: {},
role: {},
});
function addGlobalRole(role: Role) {

26
packages/frontend/editor-ui/src/stores/roles.store.test.ts
View File

@@ -17,8 +17,8 @@ describe('roles store', () => {
workflow: [],
project: [
{
name: 'Project Admin',
role: 'project:admin',
displayName: 'Project Admin',
slug: 'project:admin',
description: 'Project Admin',
scopes: [
'workflow:create',
@@ -40,10 +40,12 @@ describe('roles store', () => {
'project:delete',
],
licensed: true,
systemRole: true,
roleType: 'project',
},
{
name: 'Project Owner',
role: 'project:personalOwner',
displayName: 'Project Owner',
slug: 'project:personalOwner',
description: 'Project Owner',
scopes: [
'workflow:create',
@@ -65,10 +67,12 @@ describe('roles store', () => {
'project:read',
],
licensed: true,
roleType: 'project',
systemRole: true,
},
{
name: 'Project Editor',
role: 'project:editor',
displayName: 'Project Editor',
slug: 'project:editor',
description: 'Project Editor',
scopes: [
'workflow:create',
@@ -86,10 +90,12 @@ describe('roles store', () => {
'project:read',
],
licensed: true,
roleType: 'project',
systemRole: true,
},
{
name: 'Project Viewer',
role: 'project:viewer',
displayName: 'Project Viewer',
slug: 'project:viewer',
description: 'Project Viewer',
scopes: [
'credential:list',
@@ -100,11 +106,13 @@ describe('roles store', () => {
'workflow:read',
],
licensed: true,
roleType: 'project',
systemRole: true,
},
],
});
await rolesStore.fetchRoles();
expect(rolesStore.processedProjectRoles.map(({ role }) => role)).toEqual([
expect(rolesStore.processedProjectRoles.map(({ slug }) => slug)).toEqual([
'project:viewer',
'project:editor',
'project:admin',

20
packages/frontend/editor-ui/src/stores/roles.store.ts
View File

@@ -1,4 +1,4 @@
import type { ProjectRole, AllRolesMap } from '@n8n/permissions';
import type { AllRolesMap } from '@n8n/permissions';
import { defineStore } from 'pinia';
import { ref, computed } from 'vue';
import * as rolesApi from '@n8n/rest-api-client/api/roles';
@@ -13,31 +13,27 @@ export const useRolesStore = defineStore('roles', () => {
credential: [],
workflow: [],
});
const projectRoleOrder = ref<ProjectRole[]>([
'project:viewer',
'project:editor',
'project:admin',
]);
const projectRoleOrderMap = computed<Map<ProjectRole, number>>(
const projectRoleOrder = ref<string[]>(['project:viewer', 'project:editor', 'project:admin']);
const projectRoleOrderMap = computed<Map<string, number>>(
() => new Map(projectRoleOrder.value.map((role, idx) => [role, idx])),
);
const processedProjectRoles = computed<AllRolesMap['project']>(() =>
roles.value.project
.filter((role) => projectRoleOrderMap.value.has(role.role))
.filter((role) => projectRoleOrderMap.value.has(role.slug))
.sort(
(a, b) =>
(projectRoleOrderMap.value.get(a.role) ?? 0) -
(projectRoleOrderMap.value.get(b.role) ?? 0),
(projectRoleOrderMap.value.get(a.slug) ?? 0) -
(projectRoleOrderMap.value.get(b.slug) ?? 0),
),
);
const processedCredentialRoles = computed<AllRolesMap['credential']>(() =>
roles.value.credential.filter((role) => role.role !== 'credential:owner'),
roles.value.credential.filter((role) => role.slug !== 'credential:owner'),
);
const processedWorkflowRoles = computed<AllRolesMap['workflow']>(() =>
roles.value.workflow.filter((role) => role.role !== 'workflow:owner'),
roles.value.workflow.filter((role) => role.slug !== 'workflow:owner'),
);
const fetchRoles = async () => {

2
packages/frontend/editor-ui/src/types/projects.types.ts
View File

@@ -11,7 +11,7 @@ type ProjectTypeKeys = typeof ProjectTypes;
export type ProjectType = ProjectTypeKeys[keyof ProjectTypeKeys];
export type ProjectRelation = Pick<IUserResponse, 'id' | 'email' | 'firstName' | 'lastName'> & {
role: ProjectRole;
role: string;
};
export type ProjectRelationPayload = { userId: string; role: ProjectRole };
export type ProjectSharingData = {

14
packages/frontend/editor-ui/src/views/ProjectSettings.vue
View File

@@ -79,10 +79,10 @@ const projects = computed(() =>
const projectRoles = computed(() =>
rolesStore.processedProjectRoles.map((role) => ({
...role,
name: projectRoleTranslations.value[role.role],
displayName: projectRoleTranslations.value[role.slug],
})),
);
const firstLicensedRole = computed(() => projectRoles.value.find((role) => role.licensed)?.role);
const firstLicensedRole = computed(() => projectRoles.value.find((role) => role.licensed)?.slug);
const onAddMember = (userId: string) => {
isDirty.value = true;
@@ -387,19 +387,19 @@ onMounted(() => {
<div :class="$style.buttons">
<N8nSelect
class="mr-2xs"
:model-value="user?.role || projectRoles[0].role"
:model-value="user?.role || projectRoles[0].slug"
size="small"
data-test-id="projects-settings-user-role-select"
@update:model-value="onRoleAction(user.id, $event)"
>
<N8nOption
v-for="role in projectRoles"
:key="role.role"
:value="role.role"
:label="role.name"
:key="role.slug"
:value="role.slug"
:label="role.displayName"
:disabled="!role.licensed"
>
{{ role.name
{{ role.displayName
}}<span
v-if="!role.licensed"
:class="$style.upgrade"