feat(core, editor): introduce workflow caller policy (#4368)

* ✨ Create env `N8N_WORKFLOW_CALLER_POLICY_DEFAULT_OPTION`

* 👕 Adjust BE settings interface

* 👕 Adjust FE settings interface

* ⚡ Send policy along with settings

* ⚡ Enforce policy

* ✨ Create `SubworkflowOperationError`

* ⚡ Add policy to Vuex store

* ⚡ Add setting to FE

* ⚡ Trim caller IDs on BE

* ⚡ Hide new UI behind `isWorkflowSharingEnabled`

* ✏️ Copy updates

* 👕 Fix lint

packages/cli/src/WorkflowExecuteAdditionalData.ts

@@ -747,9 +747,38 @@ export async function getRunData(
 	workflowData: IWorkflowBase,
 	userId: string,
 	inputData?: INodeExecutionData[],
+	parentWorkflowId?: string,
 ): Promise<IWorkflowExecutionDataProcess> {
 	const mode = 'integrated';
 
+	const policy =
+		workflowData.settings?.callerPolicy ?? config.getEnv('workflows.callerPolicyDefaultOption');
+
+	if (policy === 'none') {
+		throw new SubworkflowOperationError(
+			`Target workflow ID ${workflowData.id} may not be called by other workflows.`,
+			'Please update the settings of the target workflow or ask its owner to do so.',
+		);
+	}
+
+	if (
+		policy === 'workflowsFromAList' &&
+		typeof workflowData.settings?.callerIds === 'string' &&
+		parentWorkflowId !== undefined
+	) {
+		const allowedCallerIds = workflowData.settings.callerIds
+			.split(',')
+			.map((id) => id.trim())
+			.filter((id) => id !== '');
+
+		if (!allowedCallerIds.includes(parentWorkflowId)) {
+			throw new SubworkflowOperationError(
+				`Target workflow ID ${workflowData.id} may only be called by a list of workflows, which does not include current workflow ID ${parentWorkflowId}.`,
+				'Please update the settings of the target workflow or ask its owner to do so.',
+			);
+		}
+	}
+
 	const startingNode = findSubworkflowStart(workflowData.nodes);
 
 	// Always start with empty data if no inputData got supplied