feat(core): Add nodeTypePolicy RBAC scope and license flag (no-changelog) (#37538)

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

packages/@n8n/constants/src/index.ts

@@ -12,6 +12,7 @@ export * from './uuid';
 export const LICENSE_FEATURES = {
 	SHARING: 'feat:sharing',
 	LDAP: 'feat:ldap',
+	NODE_TYPE_POLICIES: 'feat:nodeTypePolicies',
 	SAML: 'feat:saml',
 	OIDC: 'feat:oidc',
 	MFA_ENFORCEMENT: 'feat:mfaEnforcement',

packages/@n8n/permissions/src/__tests__/__snapshots__/scope-information.test.ts.snap

@@ -54,6 +54,7 @@ exports[`Scope Information > ensure scopes are defined correctly 1`] = `
   "ldap:manage",
   "license:manage",
   "logStreaming:manage",
+  "nodeTypePolicy:manage",
   "orchestration:read",
   "orchestration:list",
   "project:create",

packages/@n8n/permissions/src/constants.ee.ts

@@ -24,6 +24,7 @@ export const RESOURCES = {
 	ldap: ['sync', 'manage'] as const,
 	license: ['manage'] as const,
 	logStreaming: ['manage'] as const,
+	nodeTypePolicy: ['manage'] as const,
 	orchestration: ['read', 'list'] as const,
 	// `manageMembers` gates changes to a project's membership list: adding a member
 	// with a role, changing a member's role, and removing a member. Kept separate

packages/@n8n/permissions/src/roles/scopes/global-scopes.ee.ts

@@ -52,6 +52,7 @@ export const GLOBAL_OWNER_SCOPES: Scope[] = [
 	'ldap:sync',
 	'license:manage',
 	'logStreaming:manage',
+	'nodeTypePolicy:manage',
 	'orchestration:read',
 	'saml:manage',
 	'securityAudit:generate',

packages/@n8n/permissions/src/scope-information.ts

@@ -58,6 +58,10 @@ export const scopeInformation: Partial<Record<Scope, ScopeInformation>> = {
 		displayName: 'Manage AI Usage',
 		description: 'Allows managing AI Usage settings.',
 	},
+	'nodeTypePolicy:manage': {
+		displayName: 'Manage Node Type Policies',
+		description: 'Allows managing which node types are available on the instance.',
+	},
 	'encryptionKey:manage': {
 		displayName: 'Manage Encryption Keys',
 		description: 'Allows listing and rotating instance encryption keys.',

packages/@n8n/permissions/src/utilities/__tests__/get-resource-permissions.test.ts

@@ -22,6 +22,7 @@ describe('permissions', () => {
 			ldap: {},
 			license: {},
 			logStreaming: {},
+			nodeTypePolicy: {},
 			oidc: {},
 			orchestration: {},
 			project: {},
@@ -117,6 +118,7 @@ describe('permissions', () => {
 			ldap: {},
 			license: {},
 			logStreaming: {},
+			nodeTypePolicy: {},
 			orchestration: {},
 			project: {
 				list: true,

packages/cli/src/controllers/e2e.controller.ts

@@ -100,6 +100,7 @@ export class E2EController {
 		[LICENSE_FEATURES.DYNAMIC_CREDENTIALS]: false,
 		[LICENSE_FEATURES.SHARING]: false,
 		[LICENSE_FEATURES.LDAP]: false,
+		[LICENSE_FEATURES.NODE_TYPE_POLICIES]: false,
 		[LICENSE_FEATURES.SAML]: false,
 		[LICENSE_FEATURES.LOG_STREAMING]: false,
 		[LICENSE_FEATURES.ADVANCED_EXECUTION_FILTERS]: false,

packages/frontend/@n8n/stores/src/rbac.store.ts

@@ -37,6 +37,7 @@ export const useRBACStore = defineStore(STORES.RBAC, () => {
 		ldap: {},
 		license: {},
 		logStreaming: {},
+		nodeTypePolicy: {},
 		saml: {},
 		oidc: {},
 		provisioning: {},