Adds GET /catalog/runs, selected by the marker the run service writes rather
than by workflow, so someone sharing a workflow with colleagues sees only what
they started themselves.
Each entry is projected down from the execution summary. The summary also
carries lastNodeExecuted, per-node statuses and error details, which would hand
node names to someone who was given execute but not read.
Moves the route prefix to /catalog so runs are not addressed as a sub-resource
of workflows.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adds GET /catalog/workflows, returning each workflow's name, description and
declared input contract — never its nodes or connections. Execute access must
not become a way to obtain the graph.
Workflows with no readable contract are left out rather than shown as broken:
the person browsing cannot fix them, and the builder is the one who needs to
know.
Describing a workflow means reading its trigger through a node context, so the
listing is capped. The cap is reported back as `truncated` and logged, because a
short list that reads as a complete one is worse than an obvious limit.
The finder returns one row per share path, so entries are deduped by id.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adds POST /catalog/workflows/:id/run for people who were granted execute but
not read: the endpoint never returns or requires the graph, and @ProjectScope
rejects before the handler.
The run is a production one even though a person pressed the button. A manual
run would honour a workflow-level "don't save manual executions" and silently
erase their history, and would feed them the builder's pinned test data instead
of a real result.
Values not named by the workflow's declared contract are dropped rather than
passed through, and the execution is tagged with the person who ran it so "my
runs" is a filter over existing execution storage rather than a new column.
Start-node precedence is extracted from findWorkflowStart rather than repeated,
so a catalog run enters a workflow through the same node a sub-workflow call
would.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The fields a workflow declares on its Execute Workflow Trigger are what a run
surface renders a form from, so a caller needs them without executing the node.
Adds a service that answers eligibility and schema together — a workflow with no
readable contract cannot be offered for direct running, and the caller should
not have to ask twice.
Moves the extraction from nodes-base into n8n-workflow. It now has several
readers — the parent editor's resource mapper, MCP deriving tool arguments, and
the run surfaces — and they must all see the same fields. nodes-base re-exports
so call sites are unchanged.
A pre-1.1 trigger gates its input-source parameter behind the node version and
therefore declares nothing, which reads as passthrough. That is correct, and
covered.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adds the identity path a run needs when it starts for a user with no session
behind it: a minted, short-lived token names the user, and the authorization a
live session would have carried is re-established at resolution time.
Four checks replace what a session validated implicitly - token signature and
expiry, user still enabled, binding still active, and execute access still
granted. The last one is the only thing that catches a user removed from the
project after granting, since that never touches the binding.
Kept as a member of the existing metadata union rather than a separate
identifier: N8NCredentialResolver injects N8NIdentifier directly, and the three
existing sources already discriminate on metadata.source.
Binding storage is an in-memory stub for the spike. Nothing mints this token
yet, so the path is unreachable at runtime; the stub must be replaced by the
real binding row before any of this is proposed for merge.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
