n8n/dist/services/project.service.ee.js

n8n Workflow Automation Tool

"use strict";
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
    return c > 3 && r && Object.defineProperty(target, key, r), r;
};
var __metadata = (this && this.__metadata) || function (k, v) {
    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.ProjectService = exports.UnlicensedProjectRoleError = exports.TeamProjectOverQuotaError = void 0;
const backend_common_1 = require("@n8n/backend-common");
const constants_1 = require("@n8n/constants");
const db_1 = require("@n8n/db");
const di_1 = require("@n8n/di");
const permissions_1 = require("@n8n/permissions");
const typeorm_1 = require("@n8n/typeorm");
const n8n_workflow_1 = require("n8n-workflow");
const bad_request_error_1 = require("../errors/response-errors/bad-request.error");
const forbidden_error_1 = require("../errors/response-errors/forbidden.error");
const not_found_error_1 = require("../errors/response-errors/not-found.error");
const ownership_service_1 = require("./ownership.service");
const role_service_1 = require("./role.service");
class TeamProjectOverQuotaError extends n8n_workflow_1.UserError {
    constructor(limit) {
        super(`Attempted to create a new project but quota is already exhausted. You may have a maximum of ${limit} team projects.`);
    }
}
exports.TeamProjectOverQuotaError = TeamProjectOverQuotaError;
class UnlicensedProjectRoleError extends n8n_workflow_1.UserError {
    constructor(role) {
        super(`Your instance is not licensed to use role "${role}".`);
    }
}
exports.UnlicensedProjectRoleError = UnlicensedProjectRoleError;
class ProjectNotFoundError extends not_found_error_1.NotFoundError {
    constructor(projectId) {
        super(`Could not find project with ID: ${projectId}`);
    }
    static isDefinedAndNotNull(value, projectId) {
        if (value === undefined || value === null) {
            throw new ProjectNotFoundError(projectId);
        }
    }
}
let ProjectService = class ProjectService {
    constructor(sharedWorkflowRepository, projectRepository, projectRelationRepository, roleService, sharedCredentialsRepository, licenseState, moduleRegistry, ownershipService, logger) {
        this.sharedWorkflowRepository = sharedWorkflowRepository;
        this.projectRepository = projectRepository;
        this.projectRelationRepository = projectRelationRepository;
        this.roleService = roleService;
        this.sharedCredentialsRepository = sharedCredentialsRepository;
        this.licenseState = licenseState;
        this.moduleRegistry = moduleRegistry;
        this.ownershipService = ownershipService;
        this.logger = logger;
    }
    get workflowService() {
        return import('../workflows/workflow.service.js').then(({ WorkflowService }) => di_1.Container.get(WorkflowService));
    }
    get credentialsService() {
        return import('../credentials/credentials.service.js').then(({ CredentialsService }) => di_1.Container.get(CredentialsService));
    }
    get folderService() {
        return import('../services/folder.service.js').then(({ FolderService }) => di_1.Container.get(FolderService));
    }
    get dataTableService() {
        return import('../modules/data-table/data-table.service.js').then(({ DataTableService }) => di_1.Container.get(DataTableService));
    }
    get secretsProvidersConnectionsService() {
        return import('../modules/external-secrets.ee/secrets-providers-connections.service.ee.js').then(({ SecretsProvidersConnectionsService }) => di_1.Container.get(SecretsProvidersConnectionsService));
    }
    get agentRepository() {
        return import('../modules/agents/repositories/agent.repository.js').then(({ AgentRepository }) => di_1.Container.get(AgentRepository));
    }
    get agentKnowledgeService() {
        return import('../modules/agents/agent-knowledge.service.js').then(({ AgentKnowledgeService }) => di_1.Container.get(AgentKnowledgeService));
    }
    get agentExecutionService() {
        return import('../modules/agents/agent-execution.service.js').then(({ AgentExecutionService }) => di_1.Container.get(AgentExecutionService));
    }
    get connectionStatusProxy() {
        return import('../credentials/credential-connection-status-proxy.js').then(({ CredentialConnectionStatusProxy }) => di_1.Container.get(CredentialConnectionStatusProxy));
    }
    async deleteProject(user, projectId, { migrateToProject } = {}) {
        const workflowService = await this.workflowService;
        const credentialsService = await this.credentialsService;
        if (projectId === migrateToProject) {
            throw new bad_request_error_1.BadRequestError('Request to delete a project failed because the project to delete and the project to migrate to are the same project');
        }
        const project = await this.getProjectWithScope(user, projectId, ['project:delete']);
        ProjectNotFoundError.isDefinedAndNotNull(project, projectId);
        let targetProject = null;
        if (migrateToProject) {
            targetProject = await this.getProjectWithScope(user, migrateToProject, [
                'credential:create',
                'workflow:create',
                'dataTable:create',
            ]);
            if (!targetProject) {
                throw new not_found_error_1.NotFoundError(`Could not find project to migrate to. ID: ${targetProject}. You may lack permissions to create workflow, credentials or data tables in the target project.`);
            }
        }
        if (project.type !== 'team') {
            throw new forbidden_error_1.ForbiddenError(`Can't delete project. Project with ID "${projectId}" is not a team project.`);
        }
        const ownedSharedWorkflows = await this.sharedWorkflowRepository.find({
            where: { projectId: project.id, role: 'workflow:owner' },
        });
        if (targetProject) {
            await this.sharedWorkflowRepository.makeOwner(ownedSharedWorkflows.map((sw) => sw.workflowId), targetProject.id);
        }
        else {
            for (const sharedWorkflow of ownedSharedWorkflows) {
                await workflowService.delete(user, sharedWorkflow.workflowId, true);
            }
        }
        const ownedCredentials = await this.sharedCredentialsRepository.find({
            where: { projectId: project.id, role: 'credential:owner' },
            relations: { credentials: true },
        });
        if (targetProject) {
            await this.sharedCredentialsRepository.makeOwner(ownedCredentials.map((sc) => sc.credentialsId), targetProject.id);
        }
        else {
            for (const sharedCredential of ownedCredentials) {
                await credentialsService.delete(user, sharedCredential.credentials.id);
            }
        }
        if (targetProject) {
            const folderService = await this.folderService;
            await folderService.transferAllFoldersToProject(project.id, targetProject.id);
        }
        if (this.moduleRegistry.isActive('data-table')) {
            const dataTableService = await this.dataTableService;
            if (targetProject) {
                await dataTableService.transferDataTablesByProjectId(project.id, targetProject.id);
            }
            else {
                await dataTableService.deleteDataTableByProjectId(project.id);
            }
        }
        if (this.moduleRegistry.isActive('external-secrets')) {
            const secretsProvidersConnectionsService = await this.secretsProvidersConnectionsService;
            await secretsProvidersConnectionsService.cleanupConnectionsForProjectDeletion(project.id);
        }
        if (this.moduleRegistry.isActive('agents')) {
            const [agentRepository, agentKnowledgeService, agentExecutionService] = await Promise.all([
                this.agentRepository,
                this.agentKnowledgeService,
                this.agentExecutionService,
            ]);
            const agents = await agentRepository.findByProjectId(project.id);
            for (const agent of agents) {
                try {
                    await agentKnowledgeService.deleteAllFilesForAgent(project.id, agent.id);
                }
                catch (error) {
                    this.logger.warn('Failed to delete knowledge files on project delete', {
                        agentId: agent.id,
                        projectId: project.id,
                        error: error instanceof Error ? error.message : error,
                    });
                }
                await agentKnowledgeService.destroySandbox(project.id, agent.id);
                await agentExecutionService.deleteExecutionLogsForAgent(agent.id);
            }
        }
        const projectMembers = await this.projectRelationRepository.findBy({ projectId: project.id });
        const memberUserIds = projectMembers.map((pr) => pr.userId);
        await this.projectRepository.remove(project);
        if (memberUserIds.length > 0) {
            const proxy = await this.connectionStatusProxy;
            await proxy.cleanupOrphanedEntriesForUsers(memberUserIds);
        }
    }
    async findProjectsWorkflowIsIn(workflowId) {
        return await this.sharedWorkflowRepository.findProjectIds(workflowId);
    }
    async addUserScopes(user, projects) {
        if (projects.length === 0)
            return [];
        const relations = await this.projectRelationRepository.find({
            where: {
                userId: user.id,
                projectId: (0, typeorm_1.In)(projects.map((p) => p.id)),
            },
            relations: ['role'],
        });
        const relationsByProject = new Map(relations.map((r) => [r.projectId, r]));
        const globalScopes = (0, permissions_1.getAuthPrincipalScopes)(user);
        return projects.map((project) => {
            const relation = relationsByProject.get(project.id);
            const projectScopes = relation?.role?.scopes?.map((s) => s.slug) ?? [];
            return Object.assign(project, {
                role: relation?.role?.slug ?? user.role.slug,
                scopes: [
                    ...new Set((0, permissions_1.combineScopes)({
                        global: globalScopes,
                        ...(projectScopes.length ? { project: projectScopes } : {}),
                    })),
                ].sort(),
            });
        });
    }
    async getAccessibleProjects(user) {
        if ((0, permissions_1.hasGlobalScope)(user, 'project:read')) {
            return await this.projectRepository.find();
        }
        return await this.projectRepository.getAccessibleProjects(user.id);
    }
    async getAccessibleProjectsAndCount(user, options) {
        if ((0, permissions_1.hasGlobalScope)(user, 'project:read')) {
            return await this.projectRepository.findAllProjectsAndCount(options);
        }
        return await this.projectRepository.getAccessibleProjectsAndCount(user.id, options);
    }
    async getShareableProjectsAndCount(user, options) {
        if ((0, permissions_1.hasGlobalScope)(user, 'project:read')) {
            return await this.projectRepository.findAllProjectsAndCount(options);
        }
        return await this.projectRepository.getShareableProjectsAndCount(user.id, options);
    }
    async getPersonalProjectOwners(projectIds) {
        return await this.projectRelationRepository.getPersonalProjectOwners(projectIds);
    }
    async createTeamProjectWithEntityManager(adminUser, data, trx, overrides = {}) {
        const limit = this.licenseState.getMaxTeamProjects();
        if (limit !== constants_1.UNLIMITED_LICENSE_QUOTA) {
            const teamProjectCount = await trx.count(db_1.Project, { where: { type: 'team' } });
            if (teamProjectCount >= limit) {
                throw new TeamProjectOverQuotaError(limit);
            }
        }
        const project = await trx.save(db_1.Project, this.projectRepository.create({
            ...data,
            ...overrides,
            type: 'team',
            creatorId: adminUser.id,
        }));
        await this.addUser(project.id, { userId: adminUser.id, role: 'project:admin' }, trx);
        return project;
    }
    async createTeamProject(adminUser, data, overrides = {}) {
        return await this.projectRepository.manager.transaction('SERIALIZABLE', async (trx) => {
            return await this.createTeamProjectWithEntityManager(adminUser, data, trx, overrides);
        });
    }
    async updateProject(projectId, { name, icon, description, customTelemetryTags }) {
        const trimmedTags = customTelemetryTags
            ?.map(({ key, value }) => ({ key: key.trim(), value }))
            .filter(({ key }) => key !== '');
        const result = await this.projectRepository.update({ id: projectId, type: 'team' }, { name, icon, description, customTelemetryTags: trimmedTags });
        if (!result.affected) {
            throw new ProjectNotFoundError(projectId);
        }
        await this.ownershipService.invalidateWorkflowProjectCacheForProject(projectId);
    }
    async getPersonalProject(user) {
        return await this.projectRepository.getPersonalProjectForUser(user.id);
    }
    async getProjectRelationsForUser(user) {
        return await this.projectRelationRepository.find({
            where: { userId: user.id },
            relations: ['project', 'role'],
        });
    }
    async syncProjectRelations(projectId, relations) {
        const project = await this.getTeamProjectWithRelations(projectId);
        this.checkRolesLicensed(project, relations);
        await this.roleService.checkRolesExist(relations.map((r) => r.role), 'project');
        const incomingByUserId = new Map(relations.map((r) => [r.userId, r.role]));
        const removedUserIds = project.projectRelations
            .filter((r) => !incomingByUserId.has(r.userId))
            .map((r) => r.userId);
        const roleChangedUserIds = project.projectRelations
            .filter((r) => {
            const newRole = incomingByUserId.get(r.userId);
            return newRole !== undefined && newRole !== r.role.slug;
        })
            .map((r) => r.userId);
        const affectedUserIds = [...new Set([...removedUserIds, ...roleChangedUserIds])];
        const proxy = await this.connectionStatusProxy;
        await this.projectRelationRepository.manager.transaction(async (em) => {
            await this.pruneRelations(em, project);
            await this.addManyRelations(em, project, relations);
            if (affectedUserIds.length > 0) {
                await proxy.cleanupOrphanedEntriesForUsers(affectedUserIds, em);
            }
        });
        const newRelations = relations.filter((relation) => !project.projectRelations.some((r) => r.userId === relation.userId));
        return { project, newRelations };
    }
    async addUsersToProject(projectId, relations) {
        const project = await this.getTeamProjectWithRelations(projectId);
        this.checkRolesLicensed(project, relations);
        await this.roleService.checkRolesExist(relations.map((r) => r.role), 'project');
        if (project.type === 'personal') {
            throw new forbidden_error_1.ForbiddenError("Can't add users to personal projects.");
        }
        if (relations.some((r) => r.role === permissions_1.PROJECT_OWNER_ROLE_SLUG)) {
            throw new forbidden_error_1.ForbiddenError("Can't add a personalOwner to a team project.");
        }
        await this.projectRelationRepository.save(relations.map((relation) => ({
            projectId,
            userId: relation.userId,
            role: { slug: relation.role },
        })));
    }
    async addUsersWithConflictSemantics(projectId, relations) {
        const project = await this.getTeamProjectWithRelations(projectId);
        this.checkRolesLicensed(project, relations);
        await this.roleService.checkRolesExist(relations.map((r) => r.role), 'project');
        const existingByUserId = new Map(project.projectRelations.map((r) => [r.userId, r]));
        const added = [];
        const conflicts = [];
        for (const rel of relations) {
            const existing = existingByUserId.get(rel.userId);
            if (!existing)
                continue;
            const current = existing.role?.slug;
            if (current && current !== rel.role && (0, permissions_1.isAssignableProjectRoleSlug)(current)) {
                conflicts.push({ userId: rel.userId, currentRole: current, requestedRole: rel.role });
            }
        }
        const toInsert = relations.filter((rel) => !existingByUserId.has(rel.userId));
        if (toInsert.length > 0) {
            await this.projectRelationRepository.insert(toInsert.map((v) => ({
                projectId: project.id,
                userId: v.userId,
                role: { slug: v.role },
            })));
            added.push(...toInsert);
        }
        return { project, added, conflicts };
    }
    async getTeamProjectWithRelations(projectId) {
        const project = await this.projectRepository.findOne({
            where: { id: projectId, type: 'team' },
            relations: { projectRelations: { role: true } },
        });
        ProjectNotFoundError.isDefinedAndNotNull(project, projectId);
        return project;
    }
    checkRolesLicensed(project, relations) {
        for (const { role, userId } of relations) {
            const existing = project.projectRelations.find((pr) => pr.userId === userId);
            if (existing?.role?.slug !== role && !this.roleService.isRoleLicensed(role)) {
                throw new UnlicensedProjectRoleError(role);
            }
        }
    }
    isUserProjectOwner(project, userId) {
        return project.projectRelations.some((pr) => pr.userId === userId && pr.role.slug === permissions_1.PROJECT_OWNER_ROLE_SLUG);
    }
    async deleteUserFromProject(projectId, userId) {
        const project = await this.getTeamProjectWithRelations(projectId);
        if (this.isUserProjectOwner(project, userId)) {
            throw new forbidden_error_1.ForbiddenError('Project owner cannot be removed from the project');
        }
        const proxy = await this.connectionStatusProxy;
        await this.projectRelationRepository.manager.transaction(async (em) => {
            await em.delete(db_1.ProjectRelation, { projectId: project.id, userId });
            await proxy.cleanupOrphanedEntriesForUsers([userId], em);
        });
    }
    async changeUserRoleInProject(projectId, userId, role) {
        if (role === permissions_1.PROJECT_OWNER_ROLE_SLUG) {
            throw new forbidden_error_1.ForbiddenError('Personal owner cannot be added to a team project.');
        }
        const project = await this.getTeamProjectWithRelations(projectId);
        await this.roleService.checkRolesExist([role], 'project');
        ProjectNotFoundError.isDefinedAndNotNull(project, projectId);
        const projectUserExists = project.projectRelations.some((r) => r.userId === userId);
        if (!projectUserExists) {
            throw new ProjectNotFoundError(projectId);
        }
        const currentRelation = project.projectRelations.find((r) => r.userId === userId);
        const currentRole = currentRelation?.role?.slug;
        if (currentRole !== role && !this.roleService.isRoleLicensed(role)) {
            throw new UnlicensedProjectRoleError(role);
        }
        const proxy = await this.connectionStatusProxy;
        await this.projectRelationRepository.manager.transaction(async (em) => {
            await em.update(db_1.ProjectRelation, { projectId, userId }, { role: { slug: role } });
            await proxy.cleanupOrphanedEntriesForUsers([userId], em);
        });
    }
    async pruneRelations(em, project) {
        await em.delete(db_1.ProjectRelation, { projectId: project.id });
    }
    async addManyRelations(em, project, relations) {
        await em.insert(db_1.ProjectRelation, relations.map((v) => this.projectRelationRepository.create({
            projectId: project.id,
            userId: v.userId,
            role: { slug: v.role },
        })));
    }
    async getProjectWithScope(user, projectId, scopes, entityManager) {
        const em = entityManager ?? this.projectRepository.manager;
        let where = {
            id: projectId,
        };
        if (!(0, permissions_1.hasGlobalScope)(user, scopes, { mode: 'allOf' })) {
            const projectRoles = await this.roleService.rolesWithScope('project', scopes, em);
            where = {
                ...where,
                projectRelations: {
                    role: (0, typeorm_1.In)(projectRoles),
                    userId: user.id,
                },
            };
        }
        return await em.findOne(db_1.Project, {
            where,
        });
    }
    async getProjectIdsWithScope(user, scopes, projectIds) {
        const where = {};
        if (projectIds) {
            where.id = (0, typeorm_1.In)(projectIds);
        }
        if (!(0, permissions_1.hasGlobalScope)(user, scopes, { mode: 'allOf' })) {
            const projectRoles = await this.roleService.rolesWithScope('project', scopes);
            if (!projectIds) {
                where.type = 'team';
            }
            where.projectRelations = {
                role: (0, typeorm_1.In)(projectRoles),
                userId: user.id,
            };
        }
        const projects = await this.projectRepository.find({
            where,
            select: ['id'],
        });
        return projects.map((p) => p.id);
    }
    async findExistingProjectIds(projectIds) {
        if (projectIds.length === 0)
            return new Set();
        const projects = await this.projectRepository.find({
            select: ['id'],
            where: { id: (0, typeorm_1.In)(projectIds) },
        });
        return new Set(projects.map(({ id }) => id));
    }
    async findProjectsByIdsForUser(user, projectIds, scopes) {
        if (projectIds.length === 0) {
            return [];
        }
        const where = {
            id: (0, typeorm_1.In)(projectIds),
        };
        if (!(0, permissions_1.hasGlobalScope)(user, scopes, { mode: 'allOf' })) {
            const projectRoles = await this.roleService.rolesWithScope('project', scopes);
            where.projectRelations = {
                role: (0, typeorm_1.In)(projectRoles),
                userId: user.id,
            };
        }
        return await this.projectRepository.find({
            where,
            order: { createdAt: 'ASC', id: 'ASC' },
        });
    }
    async addUser(projectId, { userId, role }, trx) {
        trx = trx ?? this.projectRelationRepository.manager;
        return await trx.save(db_1.ProjectRelation, {
            projectId,
            userId,
            role: { slug: role },
        });
    }
    async getProject(projectId) {
        return await this.projectRepository.findOneOrFail({
            where: {
                id: projectId,
            },
        });
    }
    async findProject(projectId) {
        return await this.projectRepository.findOne({ where: { id: projectId } });
    }
    async getProjectRelations(projectId) {
        return await this.projectRelationRepository.find({
            where: { projectId },
            relations: { user: true, role: true },
        });
    }
    async getProjectRelationForUserAndProject(userId, projectId) {
        return await this.projectRelationRepository.findOne({
            where: { projectId, userId },
            relations: { user: true, role: true },
        });
    }
    async getUserOwnedOrAdminProjects(userId) {
        return await this.projectRepository.find({
            where: {
                projectRelations: {
                    userId,
                    role: (0, typeorm_1.In)([permissions_1.PROJECT_OWNER_ROLE_SLUG, permissions_1.PROJECT_ADMIN_ROLE_SLUG]),
                },
            },
        });
    }
    async getProjectCounts() {
        return await this.projectRepository.getProjectCounts();
    }
};
exports.ProjectService = ProjectService;
exports.ProjectService = ProjectService = __decorate([
    (0, di_1.Service)(),
    __metadata("design:paramtypes", [db_1.SharedWorkflowRepository, db_1.ProjectRepository, db_1.ProjectRelationRepository, role_service_1.RoleService, db_1.SharedCredentialsRepository, backend_common_1.LicenseState, backend_common_1.ModuleRegistry, ownership_service_1.OwnershipService, backend_common_1.Logger])
], ProjectService);
//# sourceMappingURL=project.service.ee.js.map