mirror of
https://github.com/n8n-io/n8n.git
synced 2026-10-12 02:19:43 +00:00
build: Cli package oxlint migration (#38714)
This commit is contained in:
Matsu
@@ -2196,6 +2196,122 @@
|
||||
"message": "packages/modules/insights/frontend turns '@typescript-eslint/require-await' down to 'warn' for the whole package.",
|
||||
"hash": "b857963c49d1"
|
||||
}
|
||||
],
|
||||
"packages/cli/oxlint.config.mts": [
|
||||
{
|
||||
"rule": "lint-config-layering",
|
||||
"line": 86,
|
||||
"message": "packages/cli turns 'typescript/ban-ts-comment' down to 'off' for the whole package.",
|
||||
"hash": "8ce649f6325e"
|
||||
},
|
||||
{
|
||||
"rule": "lint-config-layering",
|
||||
"line": 87,
|
||||
"message": "packages/cli turns 'import/no-cycle' down to 'warn' for the whole package.",
|
||||
"hash": "d1a323605d82"
|
||||
},
|
||||
{
|
||||
"rule": "lint-config-layering",
|
||||
"line": 88,
|
||||
"message": "packages/cli turns 'no-ex-assign' down to 'warn' for the whole package.",
|
||||
"hash": "8e06c3185fea"
|
||||
},
|
||||
{
|
||||
"rule": "lint-config-layering",
|
||||
"line": 89,
|
||||
"message": "packages/cli turns 'no-case-declarations' down to 'warn' for the whole package.",
|
||||
"hash": "0113294d567c"
|
||||
},
|
||||
{
|
||||
"rule": "lint-config-layering",
|
||||
"line": 90,
|
||||
"message": "packages/cli turns 'no-fallthrough' down to 'warn' for the whole package.",
|
||||
"hash": "1c2c962990dc"
|
||||
},
|
||||
{
|
||||
"rule": "lint-config-layering",
|
||||
"line": 91,
|
||||
"message": "packages/cli turns 'no-unsafe-optional-chaining' down to 'warn' for the whole package.",
|
||||
"hash": "ea7abf87c8e1"
|
||||
},
|
||||
{
|
||||
"rule": "lint-config-layering",
|
||||
"line": 92,
|
||||
"message": "packages/cli turns 'no-async-promise-executor' down to 'warn' for the whole package.",
|
||||
"hash": "439bd5663098"
|
||||
},
|
||||
{
|
||||
"rule": "lint-config-layering",
|
||||
"line": 93,
|
||||
"message": "packages/cli turns 'typescript/prefer-promise-reject-errors' down to 'warn' for the whole package.",
|
||||
"hash": "f66fb711f73c"
|
||||
},
|
||||
{
|
||||
"rule": "lint-config-layering",
|
||||
"line": 94,
|
||||
"message": "packages/cli turns 'typescript/no-explicit-any' down to 'warn' for the whole package.",
|
||||
"hash": "8d04d20abf14"
|
||||
},
|
||||
{
|
||||
"rule": "lint-config-layering",
|
||||
"line": 95,
|
||||
"message": "packages/cli turns 'typescript/no-base-to-string' down to 'warn' for the whole package.",
|
||||
"hash": "150b70a83647"
|
||||
},
|
||||
{
|
||||
"rule": "lint-config-layering",
|
||||
"line": 96,
|
||||
"message": "packages/cli turns 'typescript/no-redundant-type-constituents' down to 'warn' for the whole package.",
|
||||
"hash": "305977256d63"
|
||||
},
|
||||
{
|
||||
"rule": "lint-config-layering",
|
||||
"line": 97,
|
||||
"message": "packages/cli turns 'typescript/no-restricted-types' down to 'warn' for the whole package.",
|
||||
"hash": "c54dd4e9a991"
|
||||
},
|
||||
{
|
||||
"rule": "lint-config-layering",
|
||||
"line": 98,
|
||||
"message": "packages/cli turns 'typescript/no-unsafe-enum-comparison' down to 'warn' for the whole package.",
|
||||
"hash": "24212381cd2c"
|
||||
},
|
||||
{
|
||||
"rule": "lint-config-layering",
|
||||
"line": 99,
|
||||
"message": "packages/cli turns 'typescript/no-unsafe-declaration-merging' down to 'warn' for the whole package.",
|
||||
"hash": "b356b9e9c40f"
|
||||
},
|
||||
{
|
||||
"rule": "lint-config-layering",
|
||||
"line": 100,
|
||||
"message": "packages/cli turns 'typescript/only-throw-error' down to 'warn' for the whole package.",
|
||||
"hash": "1a50fa1c43a1"
|
||||
},
|
||||
{
|
||||
"rule": "lint-config-layering",
|
||||
"line": 101,
|
||||
"message": "packages/cli turns 'typescript/no-require-imports' down to 'warn' for the whole package.",
|
||||
"hash": "311019e3d1e5"
|
||||
},
|
||||
{
|
||||
"rule": "lint-config-layering",
|
||||
"line": 102,
|
||||
"message": "packages/cli turns 'typescript/array-type' down to 'warn' for the whole package.",
|
||||
"hash": "51a269c524d3"
|
||||
},
|
||||
{
|
||||
"rule": "lint-config-layering",
|
||||
"line": 103,
|
||||
"message": "packages/cli turns 'no-useless-escape' down to 'warn' for the whole package.",
|
||||
"hash": "6a48caa02e63"
|
||||
},
|
||||
{
|
||||
"rule": "lint-config-layering",
|
||||
"line": 104,
|
||||
"message": "packages/cli turns 'typescript/no-duplicate-type-constituents' down to 'warn' for the whole package.",
|
||||
"hash": "9e547bb1eaae"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@@ -20,6 +20,10 @@
|
||||
"types": "./dist/configs/nodes.d.js",
|
||||
"default": "./dist/configs/nodes.js"
|
||||
},
|
||||
"./functional-guardrails": {
|
||||
"types": "./dist/configs/functional-guardrails.d.js",
|
||||
"default": "./dist/configs/functional-guardrails.js"
|
||||
},
|
||||
"./plugin": {
|
||||
"types": "./dist/plugin.d.ts",
|
||||
"default": "./dist/plugin.js"
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
import tseslint from 'typescript-eslint';
|
||||
import { localRulesPlugin } from '../plugin.js';
|
||||
|
||||
/**
|
||||
* Type-aware production guards that Oxlint cannot execute. Keep this config
|
||||
* small so packages can run it beside Oxlint without loading general lint rules.
|
||||
*/
|
||||
export const functionalGuardrailsConfig = tseslint.config({
|
||||
files: ['**/*.ts'],
|
||||
plugins: { 'n8n-local-rules': localRulesPlugin },
|
||||
languageOptions: {
|
||||
parser: tseslint.parser,
|
||||
parserOptions: { projectService: true },
|
||||
},
|
||||
rules: {
|
||||
'n8n-local-rules/no-legacy-cipher-methods': 'error',
|
||||
'n8n-local-rules/no-misplaced-cipher-primitives': 'error',
|
||||
'n8n-local-rules/no-deployment-key-delete': 'error',
|
||||
'n8n-local-rules/no-unsealed-workflow-entity-write': 'error',
|
||||
'n8n-local-rules/no-encryption-guardrail-disable': 'error',
|
||||
'n8n-local-rules/no-guardrail-disable': [
|
||||
'error',
|
||||
{
|
||||
guarded: [
|
||||
{
|
||||
rule: 'no-unsealed-workflow-entity-write',
|
||||
message: 'Route the write through a token-gated `WorkflowRepository` method.',
|
||||
},
|
||||
],
|
||||
},
|
||||
],
|
||||
},
|
||||
});
|
||||
|
||||
export default functionalGuardrailsConfig;
|
||||
@@ -0,0 +1,44 @@
|
||||
import { defineConfig, globalIgnores } from 'eslint/config';
|
||||
import { functionalGuardrailsConfig } from '@n8n/eslint-config/functional-guardrails';
|
||||
import { localRulesPlugin } from '@n8n/eslint-config/plugin';
|
||||
import cliConfig from './eslint.config.mjs';
|
||||
|
||||
const directivePluginConfigs = cliConfig.flatMap(({ plugins }) => {
|
||||
const externalPlugins = Object.fromEntries(
|
||||
Object.entries(plugins ?? {}).filter(([name]) => name !== 'n8n-local-rules'),
|
||||
);
|
||||
|
||||
return Object.keys(externalPlugins).length === 0 ? [] : [{ plugins: externalPlugins }];
|
||||
});
|
||||
|
||||
const dependencyRuleConfigs = cliConfig.flatMap(({ files, ignores, settings, rules }) => {
|
||||
const rule = rules?.['import-x/no-extraneous-dependencies'];
|
||||
if (!rule) return [];
|
||||
|
||||
return [
|
||||
{
|
||||
...(files ? { files } : {}),
|
||||
...(ignores ? { ignores } : {}),
|
||||
...(settings ? { settings } : {}),
|
||||
rules: { 'import-x/no-extraneous-dependencies': rule },
|
||||
},
|
||||
];
|
||||
});
|
||||
|
||||
export default defineConfig(
|
||||
globalIgnores([
|
||||
'dist/**',
|
||||
'coverage/**',
|
||||
'eslint.config.mjs',
|
||||
'eslint.guardrails.config.mjs',
|
||||
'oxlint.config.mts',
|
||||
'scripts/**/*.mjs',
|
||||
'vitest.*.ts',
|
||||
]),
|
||||
{
|
||||
plugins: { 'n8n-local-rules': localRulesPlugin },
|
||||
},
|
||||
functionalGuardrailsConfig,
|
||||
...directivePluginConfigs,
|
||||
...dependencyRuleConfigs,
|
||||
);
|
||||
@@ -0,0 +1,432 @@
|
||||
import { defineConfig } from 'oxlint';
|
||||
import { backendConfig } from '@n8n/oxlint-config/backend';
|
||||
import { createRequire } from 'node:module';
|
||||
|
||||
const require = createRequire(import.meta.url);
|
||||
// Single source of truth for project-owned entity transfer decisions
|
||||
const ownershipTransferManifest = require('./src/services/ownership-transfer/ownership-transfer.manifest.json');
|
||||
const acknowledgedProjectOwnedEntities = [
|
||||
...ownershipTransferManifest.transferred,
|
||||
...ownershipTransferManifest.notTransferred,
|
||||
].map(({ name, path }) => ({ name, path }));
|
||||
|
||||
const INSTANCE_AI_LAZY_IMPORT_MESSAGE =
|
||||
'Use an existing lazy loader, or add one near first use. Static runtime imports of this dependency undo the Instance AI idle-memory guardrail.';
|
||||
|
||||
const POLICY_INTERNAL_RESTRICTION = {
|
||||
name: '@n8n/decorators/policy-internal',
|
||||
message:
|
||||
'Only PolicyEnforcementService may mint a policy clearance. Call enforce*/evaluate* instead.',
|
||||
};
|
||||
|
||||
const instanceAiLazyRuntimeImports = [
|
||||
'@joplin/turndown-plugin-gfm',
|
||||
'@mozilla/readability',
|
||||
'linkedom',
|
||||
'pdf-parse',
|
||||
'turndown',
|
||||
].map((name) => ({
|
||||
name,
|
||||
allowTypeImports: true,
|
||||
message: INSTANCE_AI_LAZY_IMPORT_MESSAGE,
|
||||
}));
|
||||
|
||||
const engineV2ModuleOnlyImport = {
|
||||
name: '@n8n/engine',
|
||||
allowTypeImports: true,
|
||||
message:
|
||||
'Only src/modules/engine-v2/** may import @n8n/engine at runtime. Use a type import, or reach the engine through EngineDataPlaneProxyService.',
|
||||
};
|
||||
|
||||
export default defineConfig({
|
||||
extends: [backendConfig],
|
||||
ignorePatterns: ['scripts/**/*.mjs', 'vitest.*.ts', 'coverage/**'],
|
||||
rules: {
|
||||
'n8n-local-rules/no-dynamic-import-template': 'error',
|
||||
'n8n-local-rules/misplaced-n8n-typeorm-import': 'error',
|
||||
// Ratchets: the allowlists below only shrink, so an inline disable is the one way to add a
|
||||
// violation. The narrow ESLint guardrail config owns no-unsealed-workflow-entity-write.
|
||||
'n8n-local-rules/no-guardrail-disable': [
|
||||
'error',
|
||||
{
|
||||
guarded: [
|
||||
{
|
||||
rule: 'misplaced-n8n-typeorm-import',
|
||||
message:
|
||||
'Keep TypeORM in the persistence layer: put the query behind a use-case repository method in @n8n/db.',
|
||||
},
|
||||
{
|
||||
rule: 'no-repository-in-public-api-handler',
|
||||
message: 'Call a service instead of reaching the repository.',
|
||||
},
|
||||
{
|
||||
rule: 'require-public-api-controller',
|
||||
message: 'Migrate to `@PublicApiController`.',
|
||||
},
|
||||
{
|
||||
rule: 'no-unsealed-workflow-entity-write',
|
||||
message: 'Route the write through a token-gated `WorkflowRepository` method.',
|
||||
},
|
||||
],
|
||||
},
|
||||
],
|
||||
'n8n-local-rules/no-type-unsafe-event-emitter': 'error',
|
||||
// Periodic leader-only work must be a @SystemTask() class; hand-rolled
|
||||
// @OnLeaderTakeover timers are reserved for the allowlisted services below.
|
||||
'n8n-local-rules/no-on-leader-takeover': 'error',
|
||||
// The clearance minter lives on the `policy-internal` subpath, off the public barrel.
|
||||
// Only PolicyEnforcementService may reach it; callers use enforce*/evaluate*.
|
||||
'no-restricted-imports': ['error', { paths: [POLICY_INTERNAL_RESTRICTION] }],
|
||||
'n8n-local-rules/project-owned-entity-transfer': [
|
||||
'error',
|
||||
{ acknowledged: acknowledgedProjectOwnedEntities },
|
||||
],
|
||||
|
||||
// TODO: Remove this
|
||||
'typescript/ban-ts-comment': 'off',
|
||||
'import/no-cycle': 'warn',
|
||||
'no-ex-assign': 'warn',
|
||||
'no-case-declarations': 'warn',
|
||||
'no-fallthrough': 'warn',
|
||||
'no-unsafe-optional-chaining': 'warn',
|
||||
'no-async-promise-executor': 'warn',
|
||||
'typescript/prefer-promise-reject-errors': 'warn',
|
||||
'typescript/no-explicit-any': 'warn',
|
||||
'typescript/no-base-to-string': 'warn',
|
||||
'typescript/no-redundant-type-constituents': 'warn',
|
||||
'typescript/no-restricted-types': 'warn',
|
||||
'typescript/no-unsafe-enum-comparison': 'warn',
|
||||
'typescript/no-unsafe-declaration-merging': 'warn',
|
||||
'typescript/only-throw-error': 'warn',
|
||||
'typescript/no-require-imports': 'warn',
|
||||
'typescript/array-type': 'warn',
|
||||
'no-useless-escape': 'warn',
|
||||
'typescript/no-duplicate-type-constituents': 'warn',
|
||||
},
|
||||
overrides: [
|
||||
{
|
||||
// Public API guardrail: handlers/controllers must go through a service, never a repository.
|
||||
files: ['./src/public-api/v1/handlers/**/*.ts', './src/public-api/v1/controllers/**/*.ts'],
|
||||
excludeFiles: ['./src/public-api/**/__tests__/**/*.ts'],
|
||||
rules: {
|
||||
'n8n-local-rules/no-repository-in-public-api-handler': 'error',
|
||||
},
|
||||
},
|
||||
{
|
||||
// Public API guardrail: new endpoints must be `@PublicApiController` classes, not `export =` tuples.
|
||||
files: [
|
||||
'./src/public-api/v1/handlers/**/*.handler.ts',
|
||||
'./src/public-api/v1/handlers/**/*.handler.ee.ts',
|
||||
],
|
||||
rules: {
|
||||
'n8n-local-rules/require-public-api-controller': 'error',
|
||||
},
|
||||
},
|
||||
{
|
||||
// Ratchet allowlist: handlers/services still reaching a repository directly, pending
|
||||
// migration to the `@PublicApiController` + service pattern (API-70). NEVER add to this
|
||||
// list — a new violation must fail CI. Entries are removed as each file migrates.
|
||||
files: [
|
||||
'./src/public-api/v1/handlers/data-tables/data-tables.handler.ts',
|
||||
'./src/public-api/v1/handlers/data-tables/data-tables.service.ts',
|
||||
],
|
||||
rules: {
|
||||
'n8n-local-rules/no-repository-in-public-api-handler': 'off',
|
||||
},
|
||||
},
|
||||
{
|
||||
// Ratchet allowlist: legacy `export =` handler tuples pending migration to
|
||||
// `@PublicApiController` classes (API-70). NEVER add to this list — a new tuple handler
|
||||
// must fail CI. Entries are removed as each handler becomes a controller.
|
||||
files: [
|
||||
'./src/public-api/v1/handlers/audit/audit.handler.ts',
|
||||
'./src/public-api/v1/handlers/community-packages/community-packages.handler.ts',
|
||||
'./src/public-api/v1/handlers/credentials/credentials.handler.ts',
|
||||
'./src/public-api/v1/handlers/data-tables/data-tables.columns.handler.ts',
|
||||
'./src/public-api/v1/handlers/data-tables/data-tables.handler.ts',
|
||||
'./src/public-api/v1/handlers/data-tables/data-tables.rows.handler.ts',
|
||||
'./src/public-api/v1/handlers/discover/discover.handler.ts',
|
||||
'./src/public-api/v1/handlers/evaluations/evaluations.handler.ts',
|
||||
'./src/public-api/v1/handlers/folders/folders.handler.ts',
|
||||
'./src/public-api/v1/handlers/insights/insights.handler.ts',
|
||||
'./src/public-api/v1/handlers/ldap/ldap.handler.ts',
|
||||
'./src/public-api/v1/handlers/log-streaming/log-streaming.handler.ts',
|
||||
'./src/public-api/v1/handlers/n8n-packages/n8n-packages.handler.ts',
|
||||
'./src/public-api/v1/handlers/otel/otel.handler.ts',
|
||||
'./src/public-api/v1/handlers/security-policy/security-policy.handler.ts',
|
||||
'./src/public-api/v1/handlers/sso-oidc/sso-oidc.handler.ts',
|
||||
'./src/public-api/v1/handlers/sso-saml/sso-saml.handler.ts',
|
||||
'./src/public-api/v1/handlers/tags/tags.handler.ts',
|
||||
'./src/public-api/v1/handlers/users/users.handler.ee.ts',
|
||||
'./src/public-api/v1/handlers/workflows/workflows.handler.ts',
|
||||
],
|
||||
rules: {
|
||||
'n8n-local-rules/require-public-api-controller': 'off',
|
||||
},
|
||||
},
|
||||
{
|
||||
files: ['./src/**/*.ts'],
|
||||
excludeFiles: ['./src/modules/engine-v2/**/*.ts'],
|
||||
rules: {
|
||||
// Repeats the policy restriction: a later block replaces the rule's options
|
||||
// wholesale rather than merging them.
|
||||
'no-restricted-imports': [
|
||||
'error',
|
||||
{ paths: [POLICY_INTERNAL_RESTRICTION, engineV2ModuleOnlyImport] },
|
||||
],
|
||||
},
|
||||
},
|
||||
{
|
||||
files: ['./src/modules/instance-ai/**/*.ts'],
|
||||
excludeFiles: ['./src/modules/instance-ai/**/__tests__/**/*.ts'],
|
||||
rules: {
|
||||
// Repeats the engine restriction: a later block replaces the rule's options
|
||||
// wholesale rather than merging them.
|
||||
'no-restricted-imports': [
|
||||
'error',
|
||||
{
|
||||
paths: [
|
||||
POLICY_INTERNAL_RESTRICTION,
|
||||
...instanceAiLazyRuntimeImports,
|
||||
engineV2ModuleOnlyImport,
|
||||
],
|
||||
},
|
||||
],
|
||||
},
|
||||
},
|
||||
{
|
||||
files: ['./src/modules/instance-ai/web-research/fetch-and-extract.ts'],
|
||||
// This file loads pdf-parse lazily inside extractPdf().
|
||||
rules: { 'no-restricted-imports': 'off' },
|
||||
},
|
||||
{
|
||||
files: ['./src/modules/agents/runtime/agent-isolate-pool.ts'],
|
||||
rules: { 'prefer-const': 'off' },
|
||||
},
|
||||
{
|
||||
// Only the PEP may import the clearance minter.
|
||||
files: ['./src/policy/policy-enforcement.service.ts'],
|
||||
rules: { 'no-restricted-imports': 'off' },
|
||||
},
|
||||
{
|
||||
files: ['./src/databases/migrations/**/*.ts'],
|
||||
rules: {
|
||||
'unicorn/filename-case': 'off',
|
||||
},
|
||||
},
|
||||
{
|
||||
// @n8n/typeorm belongs in the persistence layer; exempt entities/repositories.
|
||||
// Path-based (not suffix-only) so entity files without the `.entity.ts` suffix are covered.
|
||||
files: [
|
||||
'./src/databases/**/*.ts',
|
||||
'./src/modules/**/database/entities/**/*.ts',
|
||||
'./src/modules/**/database/repositories/**/*.ts',
|
||||
'./src/modules/**/*.entity.ts',
|
||||
'./src/modules/**/*.repository.ts',
|
||||
'./test/**/*.ts',
|
||||
'./src/**/__tests__/**/*.ts',
|
||||
],
|
||||
rules: {
|
||||
'n8n-local-rules/misplaced-n8n-typeorm-import': 'off',
|
||||
},
|
||||
},
|
||||
{
|
||||
// Permanent: legitimate TypeORM use outside the persistence tree. Do not remove.
|
||||
// - db/revert.ts: MigrationExecutor (CLI migration tooling)
|
||||
// - security-audit.repository.ts: PackagesRepository, relocation tracked separately
|
||||
files: ['./src/commands/db/revert.ts', './src/security-audit/security-audit.repository.ts'],
|
||||
rules: {
|
||||
'n8n-local-rules/misplaced-n8n-typeorm-import': 'off',
|
||||
},
|
||||
},
|
||||
{
|
||||
// Ratchet allowlist: known @n8n/typeorm leaks pending migration to @n8n/db.
|
||||
// NEVER add to this list — a new leak must fail CI. Entries are removed as each file migrates.
|
||||
files: [
|
||||
// credentials/
|
||||
'./src/credentials-helper.ts',
|
||||
'./src/credentials/credential-connection-status-provider.interface.ts',
|
||||
'./src/credentials/credential-connection-status-proxy.ts',
|
||||
'./src/credentials/credential-dependency.service.ts',
|
||||
'./src/credentials/credentials-finder.service.ts',
|
||||
'./src/credentials/credentials.controller.ts',
|
||||
'./src/credentials/credentials.service.ee.ts',
|
||||
'./src/credentials/credentials.service.ts',
|
||||
// workflows/
|
||||
'./src/workflows/workflow-finder.service.ts',
|
||||
'./src/workflows/workflow-history/workflow-history.service.ts',
|
||||
'./src/workflows/workflow-sharing.service.ts',
|
||||
'./src/workflows/workflow-validation.service.ts',
|
||||
'./src/workflows/workflow.service.ee.ts',
|
||||
'./src/workflows/workflow.service.ts',
|
||||
'./src/workflows/workflows.controller.ts',
|
||||
// services/ (incl. ownership.service.ts — surfaced only by the deep-path prefix change)
|
||||
'./src/services/export.service.ts',
|
||||
'./src/services/folder.service.ts',
|
||||
'./src/services/folder-finder.service.ts',
|
||||
'./src/services/hooks.service.ts',
|
||||
'./src/services/import.service.ts',
|
||||
'./src/services/ownership.service.ts',
|
||||
'./src/services/ownership-transfer/ownership-transfer-handler.registry.ts',
|
||||
'./src/services/project.service.ee.ts',
|
||||
'./src/services/public-api-key.service.ts',
|
||||
'./src/services/tag.service.ts',
|
||||
// commands / controllers / eventbus / evaluation / public-api
|
||||
'./src/commands/import/credentials.ts',
|
||||
'./src/commands/ldap/reset.ts',
|
||||
'./src/controllers/project.controller.ts',
|
||||
'./src/eventbus/message-event-bus/message-event-bus.ts',
|
||||
'./src/evaluation.ee/evaluation-collection.service.ts',
|
||||
'./src/evaluation.ee/test-runner/test-runner.service.ee.ts',
|
||||
'./src/public-api/v1/handlers/tags/tags.handler.ts',
|
||||
// modules/** non-persistence services surfaced by narrowing the exemption
|
||||
'./src/modules/agents/agent-knowledge.service.ts',
|
||||
'./src/modules/agents/agent-publish.service.ts',
|
||||
'./src/modules/agents/agent-task.service.ts',
|
||||
'./src/modules/agents/builder/agents-builder.service.ts',
|
||||
'./src/modules/agents/instance-ai-builder-delegate.adapter.ts',
|
||||
'./src/modules/agents/integrations/n8n-memory.ts',
|
||||
'./src/modules/agents/tools/workflow-tool-workflow-resolver.ts',
|
||||
'./src/modules/breaking-changes/breaking-changes.service.ts',
|
||||
'./src/modules/chat-hub/chat-hub-credentials.service.ts',
|
||||
'./src/modules/chat-hub/chat-hub-workflow.service.ts',
|
||||
'./src/modules/chat-hub/chat-hub.attachment.service.ts',
|
||||
'./src/modules/data-table/data-table-ddl.service.ts',
|
||||
'./src/modules/data-table/data-table.service.ts',
|
||||
'./src/modules/data-table/utils/sql-utils.ts',
|
||||
'./src/modules/dynamic-credentials.ee/services/credential-connection-status.service.ts',
|
||||
'./src/modules/dynamic-credentials.ee/services/credential-resolver.service.ts',
|
||||
'./src/modules/external-secrets.ee/secrets-providers-connections.service.ee.ts',
|
||||
'./src/modules/favorites/favorites.service.ts',
|
||||
'./src/modules/insights/insights-collection.service.ts',
|
||||
'./src/modules/instance-ai/instance-ai.adapter.service.ts',
|
||||
'./src/modules/instance-ai/mcp/instance-ai-mcp-registry.service.ts',
|
||||
'./src/modules/instance-ai/storage/typeorm-agent-checkpoint-store.ts',
|
||||
'./src/modules/instance-ai/storage/typeorm-agent-memory.ts',
|
||||
'./src/modules/instance-ai/storage/typeorm-observation-log-store.ts',
|
||||
'./src/modules/instance-ai/suspended-thread-persistence.service.ts',
|
||||
'./src/modules/log-streaming.ee/log-streaming-destination.service.ts',
|
||||
'./src/modules/mcp/mcp-api-key.service.ts',
|
||||
'./src/modules/mcp/mcp.settings.service.ts',
|
||||
'./src/modules/oauth-jwe/oauth-jwe-key.service.ts',
|
||||
'./src/modules/provisioning.ee/provisioning.service.ee.ts',
|
||||
'./src/modules/provisioning.ee/role-mapping-rule.service.ee.ts',
|
||||
'./src/modules/provisioning.ee/role-resolver.service.ee.ts',
|
||||
'./src/modules/source-control.ee/source-control-context.factory.ts',
|
||||
'./src/modules/source-control.ee/source-control-export.service.ee.ts',
|
||||
'./src/modules/source-control.ee/source-control-import.service.ee.ts',
|
||||
'./src/modules/source-control.ee/source-control-scoped.service.ts',
|
||||
'./src/modules/source-control.ee/source-control-status.service.ee.ts',
|
||||
'./src/modules/token-exchange/services/trusted-key.service.ts',
|
||||
'./src/modules/workflow-index/workflow-dependency-query.service.ts',
|
||||
],
|
||||
rules: {
|
||||
'n8n-local-rules/misplaced-n8n-typeorm-import': 'off',
|
||||
},
|
||||
},
|
||||
{
|
||||
// Ratchet allowlist: known relabel leaks — business logic importing a TypeORM
|
||||
// operator/driver type (`In`, `Not`, `EntityManager`, `FindOptionsWhere`, …) from
|
||||
// `@n8n/db` instead of `@n8n/typeorm`. Same rule, same shrink-only contract:
|
||||
// NEVER add to this list — a new relabel must fail CI. Entries removed as each file
|
||||
// drops TypeORM in favor of a use-case repository method.
|
||||
files: [
|
||||
'./src/binary-data/database.manager.ts',
|
||||
'./src/events/relays/telemetry.event-relay.ts',
|
||||
'./src/executions/execution-data/db-store.ts',
|
||||
'./src/executions/execution-persistence.ts',
|
||||
'./src/executions/execution-recovery.service.ts',
|
||||
'./src/executions/execution.service.ts',
|
||||
'./src/instance-settings-loader/loaders/log-streaming.instance-settings-loader.ts',
|
||||
'./src/modules/agents/agents.service.ts',
|
||||
'./src/modules/chat-hub/chat-hub-agent.service.ts',
|
||||
'./src/modules/chat-hub/chat-hub-title.service.ts',
|
||||
'./src/modules/chat-hub/chat-hub-tool.service.ts',
|
||||
'./src/modules/chat-hub/chat-hub.models.service.ts',
|
||||
'./src/modules/chat-hub/chat-hub.service.ts',
|
||||
'./src/modules/chat-hub/chat-hub.settings.service.ts',
|
||||
'./src/modules/dynamic-credentials.ee/services/credential-resolver-workflow.service.ts',
|
||||
'./src/permissions.ee/check-access.ts',
|
||||
'./src/scheduling/durable-job-provisioner.ts',
|
||||
'./src/scheduling/durable-scheduler.ts',
|
||||
'./src/scheduling/poll-trigger-node/poll-trigger-job-registrar.ts',
|
||||
'./src/scheduling/schedule-trigger-node/schedule-trigger-job-registrar.ts',
|
||||
'./src/security-audit/risk-reporters/credentials-risk-reporter.ts',
|
||||
'./src/services/role-cache.service.ts',
|
||||
'./src/services/role.service.ts',
|
||||
'./src/services/user.service.ts',
|
||||
'./src/workflows/workflow-creation.service.ts',
|
||||
],
|
||||
rules: {
|
||||
'n8n-local-rules/misplaced-n8n-typeorm-import': 'off',
|
||||
},
|
||||
},
|
||||
{
|
||||
// Sanctioned `@OnLeaderTakeover` users. Permanent, but additions need review:
|
||||
// the system task runner itself, services that hold live resources on the
|
||||
// leader (webhooks, pollers, sockets, queue consumers), and services that
|
||||
// run a documented one-shot catch-up pass on takeover.
|
||||
files: [
|
||||
'./src/scheduling/system-tasks/system-task-runner.ts',
|
||||
'./src/active-workflow-manager.ts',
|
||||
'./src/metrics/prometheus/instance-role-metrics.service.ts',
|
||||
'./src/scaling/scaling.service.ts',
|
||||
'./src/wait-tracker.ts',
|
||||
'./src/workflows/publication/workflow-publication-outbox-consumer.ts',
|
||||
'./src/workflows/publication/workflow-publication-reconciler.service.ts',
|
||||
'./src/modules/agents/agent-task.service.ts',
|
||||
'./src/modules/agents/integrations/agent-channel-reconciler.service.ts',
|
||||
'./src/modules/agents/integrations/leader-channel-relay.service.ts',
|
||||
'./src/modules/agents/integrations/platforms/discord-integration.ts',
|
||||
'./src/modules/token-exchange/services/trusted-key.service.ts',
|
||||
'./src/services/pruning/workflow-history-compaction.service.ts',
|
||||
],
|
||||
rules: { 'n8n-local-rules/no-on-leader-takeover': 'off' },
|
||||
},
|
||||
{
|
||||
// Shrink-only ratchet: periodic leader timers not yet migrated to system
|
||||
// tasks. NEVER add to this list — new periodic leader work must be a
|
||||
// @SystemTask() class. Entries are removed as each migrates on its own ticket.
|
||||
files: [
|
||||
'./src/modules/instance-reporting.ee/instance-reporting-scheduler.service.ts',
|
||||
'./src/services/pruning/executions-pruning.service.ts',
|
||||
'./src/services/workflow-statistics-rollup.service.ts',
|
||||
],
|
||||
rules: { 'n8n-local-rules/no-on-leader-takeover': 'off' },
|
||||
},
|
||||
{
|
||||
files: ['./test/**/*.ts', './src/**/__tests__/**/*.ts'],
|
||||
rules: {
|
||||
'n8n-local-rules/no-type-unsafe-event-emitter': 'off',
|
||||
'n8n-local-rules/no-on-leader-takeover': 'off',
|
||||
},
|
||||
},
|
||||
{
|
||||
files: ['./src/decorators/**/*.ts'],
|
||||
rules: {
|
||||
'typescript/no-restricted-types': 'warn',
|
||||
},
|
||||
},
|
||||
{
|
||||
files: ['./test/**/*.ts', './src/**/__tests__/**/*.ts'],
|
||||
rules: {
|
||||
// Allow inline `typeof import('x')` type annotations — the idiomatic shape for
|
||||
// `vi.importActual<typeof import('x')>('x')` in mock factories.
|
||||
'id-denylist': 'warn',
|
||||
'prefer-const': 'warn',
|
||||
'n8n-local-rules/no-dynamic-import-template': 'off',
|
||||
'import/no-duplicates': 'warn',
|
||||
'no-unused-expressions': 'off',
|
||||
'typescript/restrict-template-expressions': 'warn',
|
||||
},
|
||||
},
|
||||
{
|
||||
files: ['**/*.module.ts'],
|
||||
|
||||
rules: {
|
||||
'n8n-local-rules/no-top-level-relative-imports-in-backend-module': 'error',
|
||||
'n8n-local-rules/no-constructor-in-backend-module': 'error',
|
||||
},
|
||||
},
|
||||
],
|
||||
});
|
||||
@@ -17,8 +17,10 @@
|
||||
"dev:webhook": "concurrently -k -n \"TypeScript,Node\" -c \"yellow.bold,cyan.bold\" \"pnpm run watch\" \"nodemon webhook\"",
|
||||
"format": "biome format --write .",
|
||||
"format:check": "biome ci .",
|
||||
"lint": "cross-env NODE_OPTIONS=\"--max-old-space-size=6144\" eslint . --quiet",
|
||||
"lint:fix": "eslint . --fix",
|
||||
"lint": "pnpm run lint:base && pnpm run lint:guardrails",
|
||||
"lint:base": "oxlint --type-aware . --quiet",
|
||||
"lint:fix": "oxlint --type-aware . --fix && pnpm run lint:guardrails",
|
||||
"lint:guardrails": "cross-env NODE_OPTIONS=\"--max-old-space-size=6144\" eslint --config eslint.guardrails.config.mjs . --quiet",
|
||||
"recording:list": "node scripts/agent-integration-recordings.mjs --list",
|
||||
"recording:export": "node scripts/agent-integration-recordings.mjs",
|
||||
"start": "node ../../scripts/os-normalize.mjs --dir bin n8n",
|
||||
@@ -72,6 +74,7 @@
|
||||
"devDependencies": {
|
||||
"@faker-js/faker": "^8.0.2",
|
||||
"@n8n/backend-test-utils": "workspace:*",
|
||||
"@n8n/oxlint-config": "workspace:*",
|
||||
"@n8n/playwright-janitor": "workspace:*",
|
||||
"@n8n/typescript-config": "workspace:*",
|
||||
"@n8n/vitest-config": "workspace:*",
|
||||
@@ -114,6 +117,8 @@
|
||||
"n8n-containers": "workspace:*",
|
||||
"nock": "catalog:",
|
||||
"openai": "catalog:",
|
||||
"oxlint": "catalog:",
|
||||
"oxlint-tsgolint": "catalog:",
|
||||
"supertest": "^7.1.1",
|
||||
"tsc-watch": "^7.2.1",
|
||||
"@vitest/coverage-v8": "catalog:",
|
||||
|
||||
@@ -1,7 +1,13 @@
|
||||
import { Logger } from '@n8n/backend-common';
|
||||
import { ExecutionsConfig } from '@n8n/config';
|
||||
import { type IExecutionResponse, ProjectRelationRepository, WorkflowEntity, User } from '@n8n/db';
|
||||
import { ExecutionRepository, WorkflowRepository } from '@n8n/db';
|
||||
import {
|
||||
type IExecutionResponse,
|
||||
ExecutionRepository,
|
||||
ProjectRelationRepository,
|
||||
WorkflowEntity,
|
||||
WorkflowRepository,
|
||||
User,
|
||||
} from '@n8n/db';
|
||||
import { Container, Service } from '@n8n/di';
|
||||
import { PROJECT_ADMIN_ROLE_SLUG, PROJECT_OWNER_ROLE_SLUG } from '@n8n/permissions';
|
||||
import { ensureError } from '@n8n/utils/errors/ensure-error';
|
||||
|
||||
@@ -325,7 +325,7 @@ export class AgentIsolatePool {
|
||||
|
||||
this.warming++;
|
||||
let promise: Promise<void>;
|
||||
// eslint-disable-next-line prefer-const
|
||||
// The callback refers to promise after it is assigned.
|
||||
promise = Promise.resolve()
|
||||
.then(() => {
|
||||
const slot = this.createSlot();
|
||||
@@ -359,7 +359,7 @@ export class AgentIsolatePool {
|
||||
});
|
||||
// Track the retry timer in replenishPromises so dispose() awaits it.
|
||||
let retryPromise: Promise<void>;
|
||||
// eslint-disable-next-line prefer-const
|
||||
// The callback refers to retryPromise after it is assigned.
|
||||
retryPromise = new Promise<void>((resolve) => {
|
||||
setTimeout(resolve, delay).unref();
|
||||
}).then(() => {
|
||||
|
||||
@@ -87,15 +87,18 @@ import { WebhookExecutionContext } from '@/webhooks/webhook-execution-context';
|
||||
import { createMultiFormDataParser } from '@/webhooks/webhook-form-data';
|
||||
import { extractWebhookLastNodeResponse } from '@/webhooks/webhook-last-node-response-extractor';
|
||||
import { extractWebhookOnReceivedResponse } from '@/webhooks/webhook-on-received-response-extractor';
|
||||
import type { WebhookResponse } from '@/webhooks/webhook-response';
|
||||
import { createStaticResponse, createStreamResponse } from '@/webhooks/webhook-response';
|
||||
import {
|
||||
createStaticResponse,
|
||||
createStreamResponse,
|
||||
type WebhookResponse,
|
||||
} from '@/webhooks/webhook-response';
|
||||
import * as WorkflowExecuteAdditionalData from '@/workflow-execute-additional-data';
|
||||
import * as WorkflowHelpers from '@/workflow-helpers';
|
||||
import { WorkflowRunner } from '@/workflow-runner';
|
||||
|
||||
import { EngineV2Webhooks } from './engine-v2-webhooks';
|
||||
import { applySandboxCSP } from './webhook-response-headers';
|
||||
import {
|
||||
applySandboxCSP,
|
||||
WebhookResponseHeaders,
|
||||
type WebhookNodeResponseHeaders,
|
||||
} from './webhook-response-headers';
|
||||
|
||||
Generated
+9
@@ -4628,6 +4628,9 @@ importers:
|
||||
'@n8n/backend-test-utils':
|
||||
specifier: workspace:*
|
||||
version: link:../@n8n/backend-test-utils
|
||||
'@n8n/oxlint-config':
|
||||
specifier: workspace:*
|
||||
version: link:../@n8n/oxlint-config
|
||||
'@n8n/playwright-janitor':
|
||||
specifier: workspace:*
|
||||
version: link:../testing/janitor
|
||||
@@ -4760,6 +4763,12 @@ importers:
|
||||
openai:
|
||||
specifier: 'catalog:'
|
||||
version: 6.46.0(@aws-sdk/[email protected])(@smithy/[email protected])([email protected]([email protected])([email protected]))([email protected])
|
||||
oxlint:
|
||||
specifier: 'catalog:'
|
||||
version: 1.78.0([email protected])
|
||||
oxlint-tsgolint:
|
||||
specifier: 'catalog:'
|
||||
version: 0.21.1
|
||||
supertest:
|
||||
specifier: ^7.1.1
|
||||
version: 7.1.1([email protected])
|
||||
|
||||
Reference in New Issue
Block a user