From d7475392ddec495eac3f44a8d0d84fc0abf3f00e Mon Sep 17 00:00:00 2001 From: Matsu Date: Wed, 16 Sep 2026 11:11:07 +0000 Subject: [PATCH] build: Cli package oxlint migration (#38714) --- .code-health-baseline.json | 116 +++++ packages/@n8n/eslint-config/package.json | 4 + .../src/configs/functional-guardrails.ts | 35 ++ packages/cli/eslint.guardrails.config.mjs | 44 ++ packages/cli/oxlint.config.mts | 432 ++++++++++++++++++ packages/cli/package.json | 9 +- .../executions/execution-recovery.service.ts | 10 +- .../agents/runtime/agent-isolate-pool.ts | 4 +- packages/cli/src/webhooks/webhook-helpers.ts | 9 +- pnpm-lock.yaml | 9 + 10 files changed, 663 insertions(+), 9 deletions(-) create mode 100644 packages/@n8n/eslint-config/src/configs/functional-guardrails.ts create mode 100644 packages/cli/eslint.guardrails.config.mjs create mode 100644 packages/cli/oxlint.config.mts diff --git a/.code-health-baseline.json b/.code-health-baseline.json index 5064ed1ee5c..d8d971550ae 100644 --- a/.code-health-baseline.json +++ b/.code-health-baseline.json @@ -2196,6 +2196,122 @@ "message": "packages/modules/insights/frontend turns '@typescript-eslint/require-await' down to 'warn' for the whole package.", "hash": "b857963c49d1" } + ], + "packages/cli/oxlint.config.mts": [ + { + "rule": "lint-config-layering", + "line": 86, + "message": "packages/cli turns 'typescript/ban-ts-comment' down to 'off' for the whole package.", + "hash": "8ce649f6325e" + }, + { + "rule": "lint-config-layering", + "line": 87, + "message": "packages/cli turns 'import/no-cycle' down to 'warn' for the whole package.", + "hash": "d1a323605d82" + }, + { + "rule": "lint-config-layering", + "line": 88, + "message": "packages/cli turns 'no-ex-assign' down to 'warn' for the whole package.", + "hash": "8e06c3185fea" + }, + { + "rule": "lint-config-layering", + "line": 89, + "message": "packages/cli turns 'no-case-declarations' down to 'warn' for the whole package.", + "hash": "0113294d567c" + }, + { + "rule": "lint-config-layering", + "line": 90, + "message": "packages/cli turns 'no-fallthrough' down to 'warn' for the whole package.", + "hash": "1c2c962990dc" + }, + { + "rule": "lint-config-layering", + "line": 91, + "message": "packages/cli turns 'no-unsafe-optional-chaining' down to 'warn' for the whole package.", + "hash": "ea7abf87c8e1" + }, + { + "rule": "lint-config-layering", + "line": 92, + "message": "packages/cli turns 'no-async-promise-executor' down to 'warn' for the whole package.", + "hash": "439bd5663098" + }, + { + "rule": "lint-config-layering", + "line": 93, + "message": "packages/cli turns 'typescript/prefer-promise-reject-errors' down to 'warn' for the whole package.", + "hash": "f66fb711f73c" + }, + { + "rule": "lint-config-layering", + "line": 94, + "message": "packages/cli turns 'typescript/no-explicit-any' down to 'warn' for the whole package.", + "hash": "8d04d20abf14" + }, + { + "rule": "lint-config-layering", + "line": 95, + "message": "packages/cli turns 'typescript/no-base-to-string' down to 'warn' for the whole package.", + "hash": "150b70a83647" + }, + { + "rule": "lint-config-layering", + "line": 96, + "message": "packages/cli turns 'typescript/no-redundant-type-constituents' down to 'warn' for the whole package.", + "hash": "305977256d63" + }, + { + "rule": "lint-config-layering", + "line": 97, + "message": "packages/cli turns 'typescript/no-restricted-types' down to 'warn' for the whole package.", + "hash": "c54dd4e9a991" + }, + { + "rule": "lint-config-layering", + "line": 98, + "message": "packages/cli turns 'typescript/no-unsafe-enum-comparison' down to 'warn' for the whole package.", + "hash": "24212381cd2c" + }, + { + "rule": "lint-config-layering", + "line": 99, + "message": "packages/cli turns 'typescript/no-unsafe-declaration-merging' down to 'warn' for the whole package.", + "hash": "b356b9e9c40f" + }, + { + "rule": "lint-config-layering", + "line": 100, + "message": "packages/cli turns 'typescript/only-throw-error' down to 'warn' for the whole package.", + "hash": "1a50fa1c43a1" + }, + { + "rule": "lint-config-layering", + "line": 101, + "message": "packages/cli turns 'typescript/no-require-imports' down to 'warn' for the whole package.", + "hash": "311019e3d1e5" + }, + { + "rule": "lint-config-layering", + "line": 102, + "message": "packages/cli turns 'typescript/array-type' down to 'warn' for the whole package.", + "hash": "51a269c524d3" + }, + { + "rule": "lint-config-layering", + "line": 103, + "message": "packages/cli turns 'no-useless-escape' down to 'warn' for the whole package.", + "hash": "6a48caa02e63" + }, + { + "rule": "lint-config-layering", + "line": 104, + "message": "packages/cli turns 'typescript/no-duplicate-type-constituents' down to 'warn' for the whole package.", + "hash": "9e547bb1eaae" + } ] } } diff --git a/packages/@n8n/eslint-config/package.json b/packages/@n8n/eslint-config/package.json index 9d86485ace2..69ee8a26d70 100644 --- a/packages/@n8n/eslint-config/package.json +++ b/packages/@n8n/eslint-config/package.json @@ -20,6 +20,10 @@ "types": "./dist/configs/nodes.d.js", "default": "./dist/configs/nodes.js" }, + "./functional-guardrails": { + "types": "./dist/configs/functional-guardrails.d.js", + "default": "./dist/configs/functional-guardrails.js" + }, "./plugin": { "types": "./dist/plugin.d.ts", "default": "./dist/plugin.js" diff --git a/packages/@n8n/eslint-config/src/configs/functional-guardrails.ts b/packages/@n8n/eslint-config/src/configs/functional-guardrails.ts new file mode 100644 index 00000000000..849e9e86f30 --- /dev/null +++ b/packages/@n8n/eslint-config/src/configs/functional-guardrails.ts @@ -0,0 +1,35 @@ +import tseslint from 'typescript-eslint'; +import { localRulesPlugin } from '../plugin.js'; + +/** + * Type-aware production guards that Oxlint cannot execute. Keep this config + * small so packages can run it beside Oxlint without loading general lint rules. + */ +export const functionalGuardrailsConfig = tseslint.config({ + files: ['**/*.ts'], + plugins: { 'n8n-local-rules': localRulesPlugin }, + languageOptions: { + parser: tseslint.parser, + parserOptions: { projectService: true }, + }, + rules: { + 'n8n-local-rules/no-legacy-cipher-methods': 'error', + 'n8n-local-rules/no-misplaced-cipher-primitives': 'error', + 'n8n-local-rules/no-deployment-key-delete': 'error', + 'n8n-local-rules/no-unsealed-workflow-entity-write': 'error', + 'n8n-local-rules/no-encryption-guardrail-disable': 'error', + 'n8n-local-rules/no-guardrail-disable': [ + 'error', + { + guarded: [ + { + rule: 'no-unsealed-workflow-entity-write', + message: 'Route the write through a token-gated `WorkflowRepository` method.', + }, + ], + }, + ], + }, +}); + +export default functionalGuardrailsConfig; diff --git a/packages/cli/eslint.guardrails.config.mjs b/packages/cli/eslint.guardrails.config.mjs new file mode 100644 index 00000000000..805beea2253 --- /dev/null +++ b/packages/cli/eslint.guardrails.config.mjs @@ -0,0 +1,44 @@ +import { defineConfig, globalIgnores } from 'eslint/config'; +import { functionalGuardrailsConfig } from '@n8n/eslint-config/functional-guardrails'; +import { localRulesPlugin } from '@n8n/eslint-config/plugin'; +import cliConfig from './eslint.config.mjs'; + +const directivePluginConfigs = cliConfig.flatMap(({ plugins }) => { + const externalPlugins = Object.fromEntries( + Object.entries(plugins ?? {}).filter(([name]) => name !== 'n8n-local-rules'), + ); + + return Object.keys(externalPlugins).length === 0 ? [] : [{ plugins: externalPlugins }]; +}); + +const dependencyRuleConfigs = cliConfig.flatMap(({ files, ignores, settings, rules }) => { + const rule = rules?.['import-x/no-extraneous-dependencies']; + if (!rule) return []; + + return [ + { + ...(files ? { files } : {}), + ...(ignores ? { ignores } : {}), + ...(settings ? { settings } : {}), + rules: { 'import-x/no-extraneous-dependencies': rule }, + }, + ]; +}); + +export default defineConfig( + globalIgnores([ + 'dist/**', + 'coverage/**', + 'eslint.config.mjs', + 'eslint.guardrails.config.mjs', + 'oxlint.config.mts', + 'scripts/**/*.mjs', + 'vitest.*.ts', + ]), + { + plugins: { 'n8n-local-rules': localRulesPlugin }, + }, + functionalGuardrailsConfig, + ...directivePluginConfigs, + ...dependencyRuleConfigs, +); diff --git a/packages/cli/oxlint.config.mts b/packages/cli/oxlint.config.mts new file mode 100644 index 00000000000..2159eb59688 --- /dev/null +++ b/packages/cli/oxlint.config.mts @@ -0,0 +1,432 @@ +import { defineConfig } from 'oxlint'; +import { backendConfig } from '@n8n/oxlint-config/backend'; +import { createRequire } from 'node:module'; + +const require = createRequire(import.meta.url); +// Single source of truth for project-owned entity transfer decisions +const ownershipTransferManifest = require('./src/services/ownership-transfer/ownership-transfer.manifest.json'); +const acknowledgedProjectOwnedEntities = [ + ...ownershipTransferManifest.transferred, + ...ownershipTransferManifest.notTransferred, +].map(({ name, path }) => ({ name, path })); + +const INSTANCE_AI_LAZY_IMPORT_MESSAGE = + 'Use an existing lazy loader, or add one near first use. Static runtime imports of this dependency undo the Instance AI idle-memory guardrail.'; + +const POLICY_INTERNAL_RESTRICTION = { + name: '@n8n/decorators/policy-internal', + message: + 'Only PolicyEnforcementService may mint a policy clearance. Call enforce*/evaluate* instead.', +}; + +const instanceAiLazyRuntimeImports = [ + '@joplin/turndown-plugin-gfm', + '@mozilla/readability', + 'linkedom', + 'pdf-parse', + 'turndown', +].map((name) => ({ + name, + allowTypeImports: true, + message: INSTANCE_AI_LAZY_IMPORT_MESSAGE, +})); + +const engineV2ModuleOnlyImport = { + name: '@n8n/engine', + allowTypeImports: true, + message: + 'Only src/modules/engine-v2/** may import @n8n/engine at runtime. Use a type import, or reach the engine through EngineDataPlaneProxyService.', +}; + +export default defineConfig({ + extends: [backendConfig], + ignorePatterns: ['scripts/**/*.mjs', 'vitest.*.ts', 'coverage/**'], + rules: { + 'n8n-local-rules/no-dynamic-import-template': 'error', + 'n8n-local-rules/misplaced-n8n-typeorm-import': 'error', + // Ratchets: the allowlists below only shrink, so an inline disable is the one way to add a + // violation. The narrow ESLint guardrail config owns no-unsealed-workflow-entity-write. + 'n8n-local-rules/no-guardrail-disable': [ + 'error', + { + guarded: [ + { + rule: 'misplaced-n8n-typeorm-import', + message: + 'Keep TypeORM in the persistence layer: put the query behind a use-case repository method in @n8n/db.', + }, + { + rule: 'no-repository-in-public-api-handler', + message: 'Call a service instead of reaching the repository.', + }, + { + rule: 'require-public-api-controller', + message: 'Migrate to `@PublicApiController`.', + }, + { + rule: 'no-unsealed-workflow-entity-write', + message: 'Route the write through a token-gated `WorkflowRepository` method.', + }, + ], + }, + ], + 'n8n-local-rules/no-type-unsafe-event-emitter': 'error', + // Periodic leader-only work must be a @SystemTask() class; hand-rolled + // @OnLeaderTakeover timers are reserved for the allowlisted services below. + 'n8n-local-rules/no-on-leader-takeover': 'error', + // The clearance minter lives on the `policy-internal` subpath, off the public barrel. + // Only PolicyEnforcementService may reach it; callers use enforce*/evaluate*. + 'no-restricted-imports': ['error', { paths: [POLICY_INTERNAL_RESTRICTION] }], + 'n8n-local-rules/project-owned-entity-transfer': [ + 'error', + { acknowledged: acknowledgedProjectOwnedEntities }, + ], + + // TODO: Remove this + 'typescript/ban-ts-comment': 'off', + 'import/no-cycle': 'warn', + 'no-ex-assign': 'warn', + 'no-case-declarations': 'warn', + 'no-fallthrough': 'warn', + 'no-unsafe-optional-chaining': 'warn', + 'no-async-promise-executor': 'warn', + 'typescript/prefer-promise-reject-errors': 'warn', + 'typescript/no-explicit-any': 'warn', + 'typescript/no-base-to-string': 'warn', + 'typescript/no-redundant-type-constituents': 'warn', + 'typescript/no-restricted-types': 'warn', + 'typescript/no-unsafe-enum-comparison': 'warn', + 'typescript/no-unsafe-declaration-merging': 'warn', + 'typescript/only-throw-error': 'warn', + 'typescript/no-require-imports': 'warn', + 'typescript/array-type': 'warn', + 'no-useless-escape': 'warn', + 'typescript/no-duplicate-type-constituents': 'warn', + }, + overrides: [ + { + // Public API guardrail: handlers/controllers must go through a service, never a repository. + files: ['./src/public-api/v1/handlers/**/*.ts', './src/public-api/v1/controllers/**/*.ts'], + excludeFiles: ['./src/public-api/**/__tests__/**/*.ts'], + rules: { + 'n8n-local-rules/no-repository-in-public-api-handler': 'error', + }, + }, + { + // Public API guardrail: new endpoints must be `@PublicApiController` classes, not `export =` tuples. + files: [ + './src/public-api/v1/handlers/**/*.handler.ts', + './src/public-api/v1/handlers/**/*.handler.ee.ts', + ], + rules: { + 'n8n-local-rules/require-public-api-controller': 'error', + }, + }, + { + // Ratchet allowlist: handlers/services still reaching a repository directly, pending + // migration to the `@PublicApiController` + service pattern (API-70). NEVER add to this + // list — a new violation must fail CI. Entries are removed as each file migrates. + files: [ + './src/public-api/v1/handlers/data-tables/data-tables.handler.ts', + './src/public-api/v1/handlers/data-tables/data-tables.service.ts', + ], + rules: { + 'n8n-local-rules/no-repository-in-public-api-handler': 'off', + }, + }, + { + // Ratchet allowlist: legacy `export =` handler tuples pending migration to + // `@PublicApiController` classes (API-70). NEVER add to this list — a new tuple handler + // must fail CI. Entries are removed as each handler becomes a controller. + files: [ + './src/public-api/v1/handlers/audit/audit.handler.ts', + './src/public-api/v1/handlers/community-packages/community-packages.handler.ts', + './src/public-api/v1/handlers/credentials/credentials.handler.ts', + './src/public-api/v1/handlers/data-tables/data-tables.columns.handler.ts', + './src/public-api/v1/handlers/data-tables/data-tables.handler.ts', + './src/public-api/v1/handlers/data-tables/data-tables.rows.handler.ts', + './src/public-api/v1/handlers/discover/discover.handler.ts', + './src/public-api/v1/handlers/evaluations/evaluations.handler.ts', + './src/public-api/v1/handlers/folders/folders.handler.ts', + './src/public-api/v1/handlers/insights/insights.handler.ts', + './src/public-api/v1/handlers/ldap/ldap.handler.ts', + './src/public-api/v1/handlers/log-streaming/log-streaming.handler.ts', + './src/public-api/v1/handlers/n8n-packages/n8n-packages.handler.ts', + './src/public-api/v1/handlers/otel/otel.handler.ts', + './src/public-api/v1/handlers/security-policy/security-policy.handler.ts', + './src/public-api/v1/handlers/sso-oidc/sso-oidc.handler.ts', + './src/public-api/v1/handlers/sso-saml/sso-saml.handler.ts', + './src/public-api/v1/handlers/tags/tags.handler.ts', + './src/public-api/v1/handlers/users/users.handler.ee.ts', + './src/public-api/v1/handlers/workflows/workflows.handler.ts', + ], + rules: { + 'n8n-local-rules/require-public-api-controller': 'off', + }, + }, + { + files: ['./src/**/*.ts'], + excludeFiles: ['./src/modules/engine-v2/**/*.ts'], + rules: { + // Repeats the policy restriction: a later block replaces the rule's options + // wholesale rather than merging them. + 'no-restricted-imports': [ + 'error', + { paths: [POLICY_INTERNAL_RESTRICTION, engineV2ModuleOnlyImport] }, + ], + }, + }, + { + files: ['./src/modules/instance-ai/**/*.ts'], + excludeFiles: ['./src/modules/instance-ai/**/__tests__/**/*.ts'], + rules: { + // Repeats the engine restriction: a later block replaces the rule's options + // wholesale rather than merging them. + 'no-restricted-imports': [ + 'error', + { + paths: [ + POLICY_INTERNAL_RESTRICTION, + ...instanceAiLazyRuntimeImports, + engineV2ModuleOnlyImport, + ], + }, + ], + }, + }, + { + files: ['./src/modules/instance-ai/web-research/fetch-and-extract.ts'], + // This file loads pdf-parse lazily inside extractPdf(). + rules: { 'no-restricted-imports': 'off' }, + }, + { + files: ['./src/modules/agents/runtime/agent-isolate-pool.ts'], + rules: { 'prefer-const': 'off' }, + }, + { + // Only the PEP may import the clearance minter. + files: ['./src/policy/policy-enforcement.service.ts'], + rules: { 'no-restricted-imports': 'off' }, + }, + { + files: ['./src/databases/migrations/**/*.ts'], + rules: { + 'unicorn/filename-case': 'off', + }, + }, + { + // @n8n/typeorm belongs in the persistence layer; exempt entities/repositories. + // Path-based (not suffix-only) so entity files without the `.entity.ts` suffix are covered. + files: [ + './src/databases/**/*.ts', + './src/modules/**/database/entities/**/*.ts', + './src/modules/**/database/repositories/**/*.ts', + './src/modules/**/*.entity.ts', + './src/modules/**/*.repository.ts', + './test/**/*.ts', + './src/**/__tests__/**/*.ts', + ], + rules: { + 'n8n-local-rules/misplaced-n8n-typeorm-import': 'off', + }, + }, + { + // Permanent: legitimate TypeORM use outside the persistence tree. Do not remove. + // - db/revert.ts: MigrationExecutor (CLI migration tooling) + // - security-audit.repository.ts: PackagesRepository, relocation tracked separately + files: ['./src/commands/db/revert.ts', './src/security-audit/security-audit.repository.ts'], + rules: { + 'n8n-local-rules/misplaced-n8n-typeorm-import': 'off', + }, + }, + { + // Ratchet allowlist: known @n8n/typeorm leaks pending migration to @n8n/db. + // NEVER add to this list — a new leak must fail CI. Entries are removed as each file migrates. + files: [ + // credentials/ + './src/credentials-helper.ts', + './src/credentials/credential-connection-status-provider.interface.ts', + './src/credentials/credential-connection-status-proxy.ts', + './src/credentials/credential-dependency.service.ts', + './src/credentials/credentials-finder.service.ts', + './src/credentials/credentials.controller.ts', + './src/credentials/credentials.service.ee.ts', + './src/credentials/credentials.service.ts', + // workflows/ + './src/workflows/workflow-finder.service.ts', + './src/workflows/workflow-history/workflow-history.service.ts', + './src/workflows/workflow-sharing.service.ts', + './src/workflows/workflow-validation.service.ts', + './src/workflows/workflow.service.ee.ts', + './src/workflows/workflow.service.ts', + './src/workflows/workflows.controller.ts', + // services/ (incl. ownership.service.ts — surfaced only by the deep-path prefix change) + './src/services/export.service.ts', + './src/services/folder.service.ts', + './src/services/folder-finder.service.ts', + './src/services/hooks.service.ts', + './src/services/import.service.ts', + './src/services/ownership.service.ts', + './src/services/ownership-transfer/ownership-transfer-handler.registry.ts', + './src/services/project.service.ee.ts', + './src/services/public-api-key.service.ts', + './src/services/tag.service.ts', + // commands / controllers / eventbus / evaluation / public-api + './src/commands/import/credentials.ts', + './src/commands/ldap/reset.ts', + './src/controllers/project.controller.ts', + './src/eventbus/message-event-bus/message-event-bus.ts', + './src/evaluation.ee/evaluation-collection.service.ts', + './src/evaluation.ee/test-runner/test-runner.service.ee.ts', + './src/public-api/v1/handlers/tags/tags.handler.ts', + // modules/** non-persistence services surfaced by narrowing the exemption + './src/modules/agents/agent-knowledge.service.ts', + './src/modules/agents/agent-publish.service.ts', + './src/modules/agents/agent-task.service.ts', + './src/modules/agents/builder/agents-builder.service.ts', + './src/modules/agents/instance-ai-builder-delegate.adapter.ts', + './src/modules/agents/integrations/n8n-memory.ts', + './src/modules/agents/tools/workflow-tool-workflow-resolver.ts', + './src/modules/breaking-changes/breaking-changes.service.ts', + './src/modules/chat-hub/chat-hub-credentials.service.ts', + './src/modules/chat-hub/chat-hub-workflow.service.ts', + './src/modules/chat-hub/chat-hub.attachment.service.ts', + './src/modules/data-table/data-table-ddl.service.ts', + './src/modules/data-table/data-table.service.ts', + './src/modules/data-table/utils/sql-utils.ts', + './src/modules/dynamic-credentials.ee/services/credential-connection-status.service.ts', + './src/modules/dynamic-credentials.ee/services/credential-resolver.service.ts', + './src/modules/external-secrets.ee/secrets-providers-connections.service.ee.ts', + './src/modules/favorites/favorites.service.ts', + './src/modules/insights/insights-collection.service.ts', + './src/modules/instance-ai/instance-ai.adapter.service.ts', + './src/modules/instance-ai/mcp/instance-ai-mcp-registry.service.ts', + './src/modules/instance-ai/storage/typeorm-agent-checkpoint-store.ts', + './src/modules/instance-ai/storage/typeorm-agent-memory.ts', + './src/modules/instance-ai/storage/typeorm-observation-log-store.ts', + './src/modules/instance-ai/suspended-thread-persistence.service.ts', + './src/modules/log-streaming.ee/log-streaming-destination.service.ts', + './src/modules/mcp/mcp-api-key.service.ts', + './src/modules/mcp/mcp.settings.service.ts', + './src/modules/oauth-jwe/oauth-jwe-key.service.ts', + './src/modules/provisioning.ee/provisioning.service.ee.ts', + './src/modules/provisioning.ee/role-mapping-rule.service.ee.ts', + './src/modules/provisioning.ee/role-resolver.service.ee.ts', + './src/modules/source-control.ee/source-control-context.factory.ts', + './src/modules/source-control.ee/source-control-export.service.ee.ts', + './src/modules/source-control.ee/source-control-import.service.ee.ts', + './src/modules/source-control.ee/source-control-scoped.service.ts', + './src/modules/source-control.ee/source-control-status.service.ee.ts', + './src/modules/token-exchange/services/trusted-key.service.ts', + './src/modules/workflow-index/workflow-dependency-query.service.ts', + ], + rules: { + 'n8n-local-rules/misplaced-n8n-typeorm-import': 'off', + }, + }, + { + // Ratchet allowlist: known relabel leaks — business logic importing a TypeORM + // operator/driver type (`In`, `Not`, `EntityManager`, `FindOptionsWhere`, …) from + // `@n8n/db` instead of `@n8n/typeorm`. Same rule, same shrink-only contract: + // NEVER add to this list — a new relabel must fail CI. Entries removed as each file + // drops TypeORM in favor of a use-case repository method. + files: [ + './src/binary-data/database.manager.ts', + './src/events/relays/telemetry.event-relay.ts', + './src/executions/execution-data/db-store.ts', + './src/executions/execution-persistence.ts', + './src/executions/execution-recovery.service.ts', + './src/executions/execution.service.ts', + './src/instance-settings-loader/loaders/log-streaming.instance-settings-loader.ts', + './src/modules/agents/agents.service.ts', + './src/modules/chat-hub/chat-hub-agent.service.ts', + './src/modules/chat-hub/chat-hub-title.service.ts', + './src/modules/chat-hub/chat-hub-tool.service.ts', + './src/modules/chat-hub/chat-hub.models.service.ts', + './src/modules/chat-hub/chat-hub.service.ts', + './src/modules/chat-hub/chat-hub.settings.service.ts', + './src/modules/dynamic-credentials.ee/services/credential-resolver-workflow.service.ts', + './src/permissions.ee/check-access.ts', + './src/scheduling/durable-job-provisioner.ts', + './src/scheduling/durable-scheduler.ts', + './src/scheduling/poll-trigger-node/poll-trigger-job-registrar.ts', + './src/scheduling/schedule-trigger-node/schedule-trigger-job-registrar.ts', + './src/security-audit/risk-reporters/credentials-risk-reporter.ts', + './src/services/role-cache.service.ts', + './src/services/role.service.ts', + './src/services/user.service.ts', + './src/workflows/workflow-creation.service.ts', + ], + rules: { + 'n8n-local-rules/misplaced-n8n-typeorm-import': 'off', + }, + }, + { + // Sanctioned `@OnLeaderTakeover` users. Permanent, but additions need review: + // the system task runner itself, services that hold live resources on the + // leader (webhooks, pollers, sockets, queue consumers), and services that + // run a documented one-shot catch-up pass on takeover. + files: [ + './src/scheduling/system-tasks/system-task-runner.ts', + './src/active-workflow-manager.ts', + './src/metrics/prometheus/instance-role-metrics.service.ts', + './src/scaling/scaling.service.ts', + './src/wait-tracker.ts', + './src/workflows/publication/workflow-publication-outbox-consumer.ts', + './src/workflows/publication/workflow-publication-reconciler.service.ts', + './src/modules/agents/agent-task.service.ts', + './src/modules/agents/integrations/agent-channel-reconciler.service.ts', + './src/modules/agents/integrations/leader-channel-relay.service.ts', + './src/modules/agents/integrations/platforms/discord-integration.ts', + './src/modules/token-exchange/services/trusted-key.service.ts', + './src/services/pruning/workflow-history-compaction.service.ts', + ], + rules: { 'n8n-local-rules/no-on-leader-takeover': 'off' }, + }, + { + // Shrink-only ratchet: periodic leader timers not yet migrated to system + // tasks. NEVER add to this list — new periodic leader work must be a + // @SystemTask() class. Entries are removed as each migrates on its own ticket. + files: [ + './src/modules/instance-reporting.ee/instance-reporting-scheduler.service.ts', + './src/services/pruning/executions-pruning.service.ts', + './src/services/workflow-statistics-rollup.service.ts', + ], + rules: { 'n8n-local-rules/no-on-leader-takeover': 'off' }, + }, + { + files: ['./test/**/*.ts', './src/**/__tests__/**/*.ts'], + rules: { + 'n8n-local-rules/no-type-unsafe-event-emitter': 'off', + 'n8n-local-rules/no-on-leader-takeover': 'off', + }, + }, + { + files: ['./src/decorators/**/*.ts'], + rules: { + 'typescript/no-restricted-types': 'warn', + }, + }, + { + files: ['./test/**/*.ts', './src/**/__tests__/**/*.ts'], + rules: { + // Allow inline `typeof import('x')` type annotations — the idiomatic shape for + // `vi.importActual('x')` in mock factories. + 'id-denylist': 'warn', + 'prefer-const': 'warn', + 'n8n-local-rules/no-dynamic-import-template': 'off', + 'import/no-duplicates': 'warn', + 'no-unused-expressions': 'off', + 'typescript/restrict-template-expressions': 'warn', + }, + }, + { + files: ['**/*.module.ts'], + + rules: { + 'n8n-local-rules/no-top-level-relative-imports-in-backend-module': 'error', + 'n8n-local-rules/no-constructor-in-backend-module': 'error', + }, + }, + ], +}); diff --git a/packages/cli/package.json b/packages/cli/package.json index f0e27f28a2d..5064c914d72 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -17,8 +17,10 @@ "dev:webhook": "concurrently -k -n \"TypeScript,Node\" -c \"yellow.bold,cyan.bold\" \"pnpm run watch\" \"nodemon webhook\"", "format": "biome format --write .", "format:check": "biome ci .", - "lint": "cross-env NODE_OPTIONS=\"--max-old-space-size=6144\" eslint . --quiet", - "lint:fix": "eslint . --fix", + "lint": "pnpm run lint:base && pnpm run lint:guardrails", + "lint:base": "oxlint --type-aware . --quiet", + "lint:fix": "oxlint --type-aware . --fix && pnpm run lint:guardrails", + "lint:guardrails": "cross-env NODE_OPTIONS=\"--max-old-space-size=6144\" eslint --config eslint.guardrails.config.mjs . --quiet", "recording:list": "node scripts/agent-integration-recordings.mjs --list", "recording:export": "node scripts/agent-integration-recordings.mjs", "start": "node ../../scripts/os-normalize.mjs --dir bin n8n", @@ -72,6 +74,7 @@ "devDependencies": { "@faker-js/faker": "^8.0.2", "@n8n/backend-test-utils": "workspace:*", + "@n8n/oxlint-config": "workspace:*", "@n8n/playwright-janitor": "workspace:*", "@n8n/typescript-config": "workspace:*", "@n8n/vitest-config": "workspace:*", @@ -114,6 +117,8 @@ "n8n-containers": "workspace:*", "nock": "catalog:", "openai": "catalog:", + "oxlint": "catalog:", + "oxlint-tsgolint": "catalog:", "supertest": "^7.1.1", "tsc-watch": "^7.2.1", "@vitest/coverage-v8": "catalog:", diff --git a/packages/cli/src/executions/execution-recovery.service.ts b/packages/cli/src/executions/execution-recovery.service.ts index 80537d7011d..b80a0cd37d0 100644 --- a/packages/cli/src/executions/execution-recovery.service.ts +++ b/packages/cli/src/executions/execution-recovery.service.ts @@ -1,7 +1,13 @@ import { Logger } from '@n8n/backend-common'; import { ExecutionsConfig } from '@n8n/config'; -import { type IExecutionResponse, ProjectRelationRepository, WorkflowEntity, User } from '@n8n/db'; -import { ExecutionRepository, WorkflowRepository } from '@n8n/db'; +import { + type IExecutionResponse, + ExecutionRepository, + ProjectRelationRepository, + WorkflowEntity, + WorkflowRepository, + User, +} from '@n8n/db'; import { Container, Service } from '@n8n/di'; import { PROJECT_ADMIN_ROLE_SLUG, PROJECT_OWNER_ROLE_SLUG } from '@n8n/permissions'; import { ensureError } from '@n8n/utils/errors/ensure-error'; diff --git a/packages/cli/src/modules/agents/runtime/agent-isolate-pool.ts b/packages/cli/src/modules/agents/runtime/agent-isolate-pool.ts index 2c0827e0568..aae26a923fe 100644 --- a/packages/cli/src/modules/agents/runtime/agent-isolate-pool.ts +++ b/packages/cli/src/modules/agents/runtime/agent-isolate-pool.ts @@ -325,7 +325,7 @@ export class AgentIsolatePool { this.warming++; let promise: Promise; - // eslint-disable-next-line prefer-const + // The callback refers to promise after it is assigned. promise = Promise.resolve() .then(() => { const slot = this.createSlot(); @@ -359,7 +359,7 @@ export class AgentIsolatePool { }); // Track the retry timer in replenishPromises so dispose() awaits it. let retryPromise: Promise; - // eslint-disable-next-line prefer-const + // The callback refers to retryPromise after it is assigned. retryPromise = new Promise((resolve) => { setTimeout(resolve, delay).unref(); }).then(() => { diff --git a/packages/cli/src/webhooks/webhook-helpers.ts b/packages/cli/src/webhooks/webhook-helpers.ts index f2c8cf0811d..9e71317a47c 100644 --- a/packages/cli/src/webhooks/webhook-helpers.ts +++ b/packages/cli/src/webhooks/webhook-helpers.ts @@ -87,15 +87,18 @@ import { WebhookExecutionContext } from '@/webhooks/webhook-execution-context'; import { createMultiFormDataParser } from '@/webhooks/webhook-form-data'; import { extractWebhookLastNodeResponse } from '@/webhooks/webhook-last-node-response-extractor'; import { extractWebhookOnReceivedResponse } from '@/webhooks/webhook-on-received-response-extractor'; -import type { WebhookResponse } from '@/webhooks/webhook-response'; -import { createStaticResponse, createStreamResponse } from '@/webhooks/webhook-response'; +import { + createStaticResponse, + createStreamResponse, + type WebhookResponse, +} from '@/webhooks/webhook-response'; import * as WorkflowExecuteAdditionalData from '@/workflow-execute-additional-data'; import * as WorkflowHelpers from '@/workflow-helpers'; import { WorkflowRunner } from '@/workflow-runner'; import { EngineV2Webhooks } from './engine-v2-webhooks'; -import { applySandboxCSP } from './webhook-response-headers'; import { + applySandboxCSP, WebhookResponseHeaders, type WebhookNodeResponseHeaders, } from './webhook-response-headers'; diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 32dd1371c50..20d0a9a4539 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -4628,6 +4628,9 @@ importers: '@n8n/backend-test-utils': specifier: workspace:* version: link:../@n8n/backend-test-utils + '@n8n/oxlint-config': + specifier: workspace:* + version: link:../@n8n/oxlint-config '@n8n/playwright-janitor': specifier: workspace:* version: link:../testing/janitor @@ -4760,6 +4763,12 @@ importers: openai: specifier: 'catalog:' version: 6.46.0(@aws-sdk/credential-provider-node@3.972.80)(@smithy/signature-v4@5.7.2)(ws@8.21.1(bufferutil@4.0.9)(utf-8-validate@5.0.10))(zod@3.25.76) + oxlint: + specifier: 'catalog:' + version: 1.78.0(oxlint-tsgolint@0.21.1) + oxlint-tsgolint: + specifier: 'catalog:' + version: 0.21.1 supertest: specifier: ^7.1.1 version: 7.1.1(supports-color@8.1.1)