From 0bde73c42f1422614536ff1dfab5403b9bda3a8b Mon Sep 17 00:00:00 2001
From: Andreas Fitzek <andreas.fitzek@n8n.io>
Date: Tue, 12 May 2026 10:03:29 +0200
Subject: [PATCH] feat(core): Scaffold inbound-secrets module (no-changelog)
 (#30093)

---
 .../modules/__tests__/module-registry.test.ts |  2 ++
 .../src/modules/module-registry.ts            |  1 +
 .../src/modules/modules.config.ts             |  1 +
 .../__tests__/inbound-secrets.module.test.ts  | 27 +++++++++++++++++++
 .../inbound-secrets/inbound-secrets.config.ts |  4 +++
 .../inbound-secrets/inbound-secrets.module.ts | 15 +++++++++++
 6 files changed, 50 insertions(+)
 create mode 100644 packages/cli/src/modules/inbound-secrets/__tests__/inbound-secrets.module.test.ts
 create mode 100644 packages/cli/src/modules/inbound-secrets/inbound-secrets.config.ts
 create mode 100644 packages/cli/src/modules/inbound-secrets/inbound-secrets.module.ts

diff --git a/packages/@n8n/backend-common/src/modules/__tests__/module-registry.test.ts b/packages/@n8n/backend-common/src/modules/__tests__/module-registry.test.ts
index 63a24cd36a8..071b529f943 100644
--- a/packages/@n8n/backend-common/src/modules/__tests__/module-registry.test.ts
+++ b/packages/@n8n/backend-common/src/modules/__tests__/module-registry.test.ts
@@ -44,6 +44,7 @@ describe('eligibleModules', () => {
 			'instance-version-history',
 			'encryption-key-manager',
 			'oauth-jwe',
+			'inbound-secrets',
 		]);
 	});
 
@@ -74,6 +75,7 @@ describe('eligibleModules', () => {
 			'instance-version-history',
 			'encryption-key-manager',
 			'oauth-jwe',
+			'inbound-secrets',
 			'instance-ai',
 		]);
 	});
diff --git a/packages/@n8n/backend-common/src/modules/module-registry.ts b/packages/@n8n/backend-common/src/modules/module-registry.ts
index ac7c57d6f68..4536ba68e24 100644
--- a/packages/@n8n/backend-common/src/modules/module-registry.ts
+++ b/packages/@n8n/backend-common/src/modules/module-registry.ts
@@ -55,6 +55,7 @@ export class ModuleRegistry {
 		'instance-version-history',
 		'encryption-key-manager',
 		'oauth-jwe',
+		'inbound-secrets',
 	];
 
 	private readonly activeModules: string[] = [];
diff --git a/packages/@n8n/backend-common/src/modules/modules.config.ts b/packages/@n8n/backend-common/src/modules/modules.config.ts
index 470467abeb2..f12b5010387 100644
--- a/packages/@n8n/backend-common/src/modules/modules.config.ts
+++ b/packages/@n8n/backend-common/src/modules/modules.config.ts
@@ -30,6 +30,7 @@ export const MODULE_NAMES = [
 	'instance-version-history',
 	'encryption-key-manager',
 	'oauth-jwe',
+	'inbound-secrets',
 ] as const;
 
 export type ModuleName = (typeof MODULE_NAMES)[number];
diff --git a/packages/cli/src/modules/inbound-secrets/__tests__/inbound-secrets.module.test.ts b/packages/cli/src/modules/inbound-secrets/__tests__/inbound-secrets.module.test.ts
new file mode 100644
index 00000000000..b045be5d248
--- /dev/null
+++ b/packages/cli/src/modules/inbound-secrets/__tests__/inbound-secrets.module.test.ts
@@ -0,0 +1,27 @@
+import { Container } from '@n8n/di';
+
+import { InboundSecretsModule } from '../inbound-secrets.module';
+
+describe('InboundSecretsModule', () => {
+	let module: InboundSecretsModule;
+
+	beforeEach(() => {
+		Container.reset();
+		module = new InboundSecretsModule();
+	});
+
+	afterEach(() => {
+		delete process.env.N8N_ENV_FEAT_INBOUND_SECRETS;
+	});
+
+	describe('init', () => {
+		it('is a no-op when the feature flag is off', async () => {
+			await expect(module.init()).resolves.toBeUndefined();
+		});
+
+		it('loads without error when the feature flag is on', async () => {
+			process.env.N8N_ENV_FEAT_INBOUND_SECRETS = 'true';
+			await expect(module.init()).resolves.toBeUndefined();
+		});
+	});
+});
diff --git a/packages/cli/src/modules/inbound-secrets/inbound-secrets.config.ts b/packages/cli/src/modules/inbound-secrets/inbound-secrets.config.ts
new file mode 100644
index 00000000000..a2742340ca8
--- /dev/null
+++ b/packages/cli/src/modules/inbound-secrets/inbound-secrets.config.ts
@@ -0,0 +1,4 @@
+import { Config } from '@n8n/config';
+
+@Config
+export class InboundSecretsConfig {}
diff --git a/packages/cli/src/modules/inbound-secrets/inbound-secrets.module.ts b/packages/cli/src/modules/inbound-secrets/inbound-secrets.module.ts
new file mode 100644
index 00000000000..bc8dc68f9e2
--- /dev/null
+++ b/packages/cli/src/modules/inbound-secrets/inbound-secrets.module.ts
@@ -0,0 +1,15 @@
+import type { ModuleInterface } from '@n8n/decorators';
+import { BackendModule } from '@n8n/decorators';
+
+function isFeatureFlagEnabled(): boolean {
+	return process.env.N8N_ENV_FEAT_INBOUND_SECRETS === 'true';
+}
+
+@BackendModule({ name: 'inbound-secrets' })
+export class InboundSecretsModule implements ModuleInterface {
+	async init() {
+		if (!isFeatureFlagEnabled()) return;
+
+		await import('./inbound-secrets.config');
+	}
+}