n8n/dist/public-api/v1/handlers/security-policy/security-policy.handler.js

n8n Workflow Automation Tool

"use strict";
const api_types_1 = require("@n8n/api-types");
const config_1 = require("@n8n/config");
const di_1 = require("@n8n/di");
const bad_request_error_1 = require("../../../../errors/response-errors/bad-request.error");
const conflict_error_1 = require("../../../../errors/response-errors/conflict.error");
const security_settings_service_1 = require("../../../../services/security-settings.service");
const global_middleware_1 = require("../../shared/middlewares/global.middleware");
const toResponse = (settings) => settings;
const securityPolicyHandlers = {
    getSecurityPolicy: [
        (0, global_middleware_1.isLicensed)('feat:personalSpacePolicy'),
        (0, global_middleware_1.apiKeyHasScopeWithGlobalScopeFallback)({ scope: 'securitySettings:manage' }),
        async (_req, res) => {
            const settings = await di_1.Container.get(security_settings_service_1.SecuritySettingsService).getSecuritySettings();
            return res.json(toResponse(settings));
        },
    ],
    updateSecurityPolicy: [
        (0, global_middleware_1.isLicensed)('feat:personalSpacePolicy'),
        (0, global_middleware_1.apiKeyHasScopeWithGlobalScopeFallback)({ scope: 'securitySettings:manage' }),
        async (req, res) => {
            const payload = api_types_1.UpdateSecurityPolicyDto.safeParse(req.body);
            if (!payload.success) {
                throw new bad_request_error_1.BadRequestError(payload.error.errors[0]?.message ?? 'Invalid request body');
            }
            const { securityPolicyManagedByEnv } = di_1.Container.get(config_1.InstanceSettingsLoaderConfig);
            if (securityPolicyManagedByEnv) {
                throw new conflict_error_1.ConflictError('These settings are managed via environment variables and cannot be modified through the API');
            }
            const service = di_1.Container.get(security_settings_service_1.SecuritySettingsService);
            await service.updateSecuritySettings(payload.data, req.user);
            const settings = await service.getSecuritySettings();
            return res.json(toResponse(settings));
        },
    ],
};
module.exports = securityPolicyHandlers;
//# sourceMappingURL=security-policy.handler.js.map