refactor(core): Switch over all user-management routes to use decorat…

…ors (#5115)

cypress/e2e/4-node-creator.cy.ts

@@ -1,5 +1,5 @@
 import { NodeCreator } from '../pages/features/node-creator';
-import { INodeTypeDescription } from '../../packages/workflow';
+import { INodeTypeDescription } from 'n8n-workflow';
 import CustomNodeFixture from '../fixtures/Custom_node.json';
 import { DEFAULT_USER_EMAIL, DEFAULT_USER_PASSWORD } from '../constants';
 import { randFirstName, randLastName } from '@ngneat/falso';

cypress/pages/features/node-creator.ts

@@ -1,5 +1,5 @@
 import { BasePage } from '../base';
-import { INodeTypeDescription } from '../../packages/workflow';
+import { INodeTypeDescription } from 'n8n-workflow';
 
 export class NodeCreator extends BasePage {
 	url = '/workflow/new';

packages/cli/src/AbstractServer.ts

@@ -25,7 +25,7 @@ import {
 	sendSuccessResponse,
 	ServiceUnavailableError,
 } from '@/ResponseHelper';
-import { corsMiddleware } from '@/middlewares/cors';
+import { corsMiddleware } from '@/middlewares';
 import * as TestWebhooks from '@/TestWebhooks';
 import { WaitingWebhooks } from '@/WaitingWebhooks';
 import { WEBHOOK_METHODS } from '@/WebhookHelpers';

packages/cli/src/Interfaces.ts

@@ -1,4 +1,5 @@
 /* eslint-disable @typescript-eslint/naming-convention */
+import type { Application } from 'express';
 import type {
 	ExecutionError,
 	ICredentialDataDecryptedObject,
@@ -21,9 +22,11 @@ import type {
 	WorkflowExecuteMode,
 } from 'n8n-workflow';
 
-import { WorkflowExecute } from 'n8n-core';
+import type { ActiveWorkflowRunner } from '@/ActiveWorkflowRunner';
 
-import PCancelable from 'p-cancelable';
+import type { WorkflowExecute } from 'n8n-core';
+
+import type PCancelable from 'p-cancelable';
 import type { FindOperator, Repository } from 'typeorm';
 
 import type { ChildProcess } from 'child_process';
@@ -365,6 +368,7 @@ export interface IInternalHooksClass {
 		user: User;
 		target_user_id: string[];
 		public_api: boolean;
+		email_sent: boolean;
 	}): Promise<void>;
 	onUserReinvite(userReinviteData: {
 		user: User;
@@ -378,6 +382,7 @@ export interface IInternalHooksClass {
 		userTransactionalEmailData: {
 			user_id: string;
 			message_type: 'Reset password' | 'New user invite' | 'Resend invite';
+			public_api: boolean;
 		},
 		user?: User,
 	): Promise<void>;
@@ -841,3 +846,37 @@ export interface ILicenseReadResponse {
 export interface ILicensePostResponse extends ILicenseReadResponse {
 	managementToken: string;
 }
+
+export interface JwtToken {
+	token: string;
+	expiresIn: number;
+}
+
+export interface JwtPayload {
+	id: string;
+	email: string | null;
+	password: string | null;
+}
+
+export interface PublicUser {
+	id: string;
+	email?: string;
+	firstName?: string;
+	lastName?: string;
+	personalizationAnswers?: IPersonalizationSurveyAnswers | null;
+	password?: string;
+	passwordResetToken?: string;
+	createdAt: Date;
+	isPending: boolean;
+	globalRole?: Role;
+	signInType: AuthProviderType;
+	disabled: boolean;
+	inviteAcceptUrl?: string;
+}
+
+export interface N8nApp {
+	app: Application;
+	restEndpoint: string;
+	externalHooks: IExternalHooksClass;
+	activeWorkflowRunner: ActiveWorkflowRunner;
+}

packages/cli/src/Ldap/helpers.ts

@@ -8,7 +8,7 @@ import * as Db from '@/Db';
 import config from '@/config';
 import type { Role } from '@db/entities/Role';
 import { User } from '@db/entities/User';
-import { AuthIdentity } from '@/databases/entities/AuthIdentity';
+import { AuthIdentity } from '@db/entities/AuthIdentity';
 import type { AuthProviderSyncHistory } from '@db/entities/AuthProviderSyncHistory';
 import { isUserManagementEnabled } from '@/UserManagement/UserManagementHelper';
 import { LdapManager } from './LdapManager.ee';

packages/cli/src/Server.ts

@@ -63,9 +63,6 @@ import {
 	WorkflowExecuteMode,
 	INodeTypes,
 	ICredentialTypes,
-	INode,
-	IWorkflowBase,
-	IRun,
 } from 'n8n-workflow';
 
 import basicAuth from 'basic-auth';
@@ -103,8 +100,15 @@ import type {
 	OAuthRequest,
 	WorkflowRequest,
 } from '@/requests';
-import { userManagementRouter } from '@/UserManagement';
-import { resolveJwt } from '@/UserManagement/auth/jwt';
+import { registerController } from '@/decorators';
+import {
+	AuthController,
+	MeController,
+	OwnerController,
+	PasswordResetController,
+	UsersController,
+} from '@/controllers';
+import { resolveJwt } from '@/auth/jwt';
 
 import { executionsController } from '@/executions/executions.controller';
 import { nodeTypesController } from '@/api/nodeTypes.api';
@@ -118,6 +122,7 @@ import {
 	isUserManagementEnabled,
 	whereClause,
 } from '@/UserManagement/UserManagementHelper';
+import { getInstance as getMailerInstance } from '@/UserManagement/email';
 import * as Db from '@/Db';
 import {
 	DatabaseType,
@@ -151,7 +156,7 @@ import { eventBusRouter } from '@/eventbus/eventBusRoutes';
 import { isLogStreamingEnabled } from '@/eventbus/MessageEventBus/MessageEventBusHelper';
 import { getLicense } from '@/License';
 import { licenseController } from './license/license.controller';
-import { corsMiddleware } from './middlewares/cors';
+import { corsMiddleware, setupAuthMiddlewares } from './middlewares';
 import { initEvents } from './events';
 import { ldapController } from './Ldap/routes/ldap.controller.ee';
 import { getLdapLoginLabel, isLdapEnabled, isLdapLoginEnabled } from './Ldap/helpers';
@@ -336,6 +341,33 @@ class Server extends AbstractServer {
 		}
 	}
 
+	private registerControllers(ignoredEndpoints: Readonly<string[]>) {
+		const { app, externalHooks, activeWorkflowRunner } = this;
+		const repositories = Db.collections;
+		setupAuthMiddlewares(app, ignoredEndpoints, this.restEndpoint, repositories.User);
+
+		const logger = LoggerProxy;
+		const internalHooks = InternalHooksManager.getInstance();
+		const mailer = getMailerInstance();
+
+		const controllers = [
+			new AuthController({ config, internalHooks, repositories, logger }),
+			new OwnerController({ config, internalHooks, repositories, logger }),
+			new MeController({ externalHooks, internalHooks, repositories, logger }),
+			new PasswordResetController({ config, externalHooks, internalHooks, repositories, logger }),
+			new UsersController({
+				config,
+				mailer,
+				externalHooks,
+				internalHooks,
+				repositories,
+				activeWorkflowRunner,
+				logger,
+			}),
+		];
+		controllers.forEach((controller) => registerController(app, config, controller));
+	}
+
 	async configure(): Promise<void> {
 		configureMetrics(this.app);
 
@@ -354,7 +386,7 @@ class Server extends AbstractServer {
 		const publicApiEndpoint = config.getEnv('publicApi.path');
 		const excludeEndpoints = config.getEnv('security.excludeEndpoints');
 
-		const ignoredEndpoints = [
+		const ignoredEndpoints: Readonly<string[]> = [
 			'assets',
 			'healthz',
 			'metrics',
@@ -587,7 +619,7 @@ class Server extends AbstractServer {
 		// ----------------------------------------
 		// User Management
 		// ----------------------------------------
-		await userManagementRouter.addRoutes.apply(this, [ignoredEndpoints, this.restEndpoint]);
+		this.registerControllers(ignoredEndpoints);
 
 		this.app.use(`/${this.restEndpoint}/credentials`, credentialsController);
 

packages/cli/src/UserManagement/UserManagementHelper.ts

@@ -6,14 +6,13 @@ import { compare, genSaltSync, hash } from 'bcryptjs';
 
 import * as Db from '@/Db';
 import * as ResponseHelper from '@/ResponseHelper';
-import { PublicUser } from './Interfaces';
+import type { PublicUser, WhereClause } from '@/Interfaces';
 import { MAX_PASSWORD_LENGTH, MIN_PASSWORD_LENGTH, User } from '@db/entities/User';
 import { Role } from '@db/entities/Role';
 import { AuthenticatedRequest } from '@/requests';
 import config from '@/config';
-import { getWebhookBaseUrl } from '../WebhookHelpers';
+import { getWebhookBaseUrl } from '@/WebhookHelpers';
 import { getLicense } from '@/License';
-import { WhereClause } from '@/Interfaces';
 import { RoleService } from '@/role/role.service';
 
 export async function getWorkflowOwner(workflowId: string): Promise<User> {
@@ -177,7 +176,7 @@ export async function getUserById(userId: string): Promise<User> {
 /**
  * Check if a URL contains an auth-excluded endpoint.
  */
-export function isAuthExcluded(url: string, ignoredEndpoints: string[]): boolean {
+export function isAuthExcluded(url: string, ignoredEndpoints: Readonly<string[]>): boolean {
 	return !!ignoredEndpoints
 		.filter(Boolean) // skip empty paths
 		.find((ignoredEndpoint) => url.startsWith(`/${ignoredEndpoint}`));