n8n/packages/testing/playwright/tests/e2e/sharing/access-control.spec.ts

import { nanoid } from 'nanoid';

import { test, expect } from '../../../fixtures/base';

const TEST_API_KEY = 'test-api-key';

test.describe(
	'Access Control Boundaries',
	{
		annotation: [{ type: 'owner', description: 'Identity & Access' }],
	},
	() => {
		test('should prevent credential editing by sharee', async ({ n8n, api }) => {
			const member = await api.publicApi.createUser({
				email: `member-${nanoid()}@test.com`,
				firstName: 'Test',
				lastName: 'Member',
			});

			const credentialName = `Owner Credential ${nanoid()}`;
			const credential = await api.credentials.createCredential({
				name: credentialName,
				type: 'notionApi',
				data: { apiKey: TEST_API_KEY },
			});

			const memberApi = await api.createApiForUser(member);
			const memberProject = await memberApi.projects.getMyPersonalProject();
			await api.credentials.shareCredential(credential.id, [memberProject.id]);

			const memberN8n = await n8n.start.withUser(member);
			await memberN8n.navigate.toCredentials();
			await memberN8n.credentials.cards.clickCredentialCard(credentialName);

			await expect(memberN8n.credentials.credentialModal.getCredentialName()).toContainText(
				credentialName,
			);
			await expect(memberN8n.credentials.credentialModal.getSaveButton()).toBeHidden();
		});

		test('should allow admin full access to credentials created by others', async ({
			n8n,
			api,
		}) => {
			const member = await api.publicApi.createUser({
				email: `member-${nanoid()}@test.com`,
				firstName: 'Test',
				lastName: 'Member',
			});
			const admin = await api.publicApi.createUser({
				email: `admin-${nanoid()}@test.com`,
				firstName: 'Test',
				lastName: 'Admin',
				role: 'global:admin',
			});

			const credentialName = `Member Credential ${nanoid()}`;
			const memberApi = await api.createApiForUser(member);
			await memberApi.credentials.createCredential({
				name: credentialName,
				type: 'notionApi',
				data: { apiKey: TEST_API_KEY },
			});

			const adminN8n = await n8n.start.withUser(admin);
			await adminN8n.navigate.toCredentials();
			await adminN8n.credentials.cards.clickCredentialCard(credentialName);

			await expect(adminN8n.credentials.credentialModal.getCredentialName()).toContainText(
				credentialName,
			);

			const apiKeyInput = adminN8n.credentials.credentialModal.getFieldInput('apiKey');
			await expect(apiKeyInput).toHaveValue(/__n8n_BLANK_VALUE_/);

			await adminN8n.credentials.credentialModal.changeTab('Sharing');
			await expect(adminN8n.credentials.credentialModal.getUsersSelect()).toBeVisible();

			await adminN8n.credentials.credentialModal.getUsersSelect().click();
			// Personal projects show "Name (Personal space)" instead of email
			const adminName = `${admin.firstName} ${admin.lastName}`;
			await expect(
				adminN8n.credentials.credentialModal.getVisibleDropdown().getByText(adminName),
			).toBeVisible();
		});

		test('should prevent access to private workflows via direct URL', async ({ api }) => {
			const member = await api.publicApi.createUser({
				email: `member-${nanoid()}@test.com`,
				firstName: 'Test',
				lastName: 'Member',
			});
			const workflow = await api.workflows.createWorkflow({
				name: `Private Workflow ${nanoid()}`,
				nodes: [
					{
						id: 'manual-trigger',
						name: 'Manual Trigger',
						type: 'n8n-nodes-base.manualTrigger',
						position: [100, 200],
						parameters: {},
						typeVersion: 1,
					},
				],
				connections: {},
			});

			const memberApi = await api.createApiForUser(member);
			const response = await memberApi.request.get(`/rest/workflows/${workflow.id}`);
			expect(response.status()).toBe(403);
		});

		test('should enforce project isolation for team projects', async ({ n8n, api }) => {
			await api.setMaxTeamProjectsQuota(-1);

			const devProject = await api.projects.createProject(`Development ${nanoid()}`);
			const testProject = await api.projects.createProject(`Testing ${nanoid()}`);

			const devCredName = `Dev Credential ${nanoid()}`;
			await api.credentials.createCredential({
				name: devCredName,
				type: 'notionApi',
				data: { apiKey: TEST_API_KEY },
				projectId: devProject.id,
			});

			const testCredName = `Test Credential ${nanoid()}`;
			await api.credentials.createCredential({
				name: testCredName,
				type: 'notionApi',
				data: { apiKey: TEST_API_KEY },
				projectId: testProject.id,
			});

			await n8n.navigate.toProject(testProject.id);
			await n8n.projectTabs.clickWorkflowsTab();
			await n8n.workflows.clickNewWorkflowButtonFromProject();
			await n8n.canvas.addNode('Manual Trigger');
			await n8n.canvas.addNode('Notion');
			await n8n.canvas.getFirstAction().click();

			await n8n.ndv.getNodeCredentialsSelect().click();
			const credentialDropdown = n8n.ndv.getVisiblePopper();
			await expect(credentialDropdown.getByText(testCredName)).toBeVisible();
			await expect(credentialDropdown.getByText(devCredName)).toBeHidden();
		});

		test('should prevent sharing team project workflows', async ({ n8n, api }) => {
			const teamProject = await api.projects.createProject(`Team Project ${nanoid()}`);
			const teamWorkflow = await api.workflows.createInProject(teamProject.id, {
				name: `Team Workflow ${nanoid()}`,
			});

			await n8n.navigate.toWorkflow(teamWorkflow.id);
			await n8n.canvas.openShareModal();

			// Team project workflows cannot be shared - no user selector shown
			await expect(n8n.workflowSharingModal.getUsersSelect()).toBeHidden();
		});
	},
);