Skip to content

User N8N workflows [WIP] #599

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sheriffjimoh wants to merge 7 commits into
base: develop
Choose a base branch
from
Open

User N8N workflows [WIP] #599

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
de5fcae
feat: created migrations, routes and types
sheriffjimoh Dec 18, 2025
bb801bd
feat: backend oauth/google setup for 8n8
sheriffjimoh Dec 22, 2025
4f3830b
Merge branch 'develop' of https://github.com/bitcashorg/masterbots in…
sheriffjimoh Dec 22, 2025
6172ec4
fix(BE): update start process and callback
sheriffjimoh Jan 7, 2026
4d10a40
fix(BE): update callback
sheriffjimoh Jan 7, 2026
cd9a346
fix: merge issue
sheriffjimoh Jan 7, 2026
fb961ff
fix: update on workflow api
sheriffjimoh Jan 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 5 additions & 14 deletions apps/hasura/metadata/databases/masterbots/tables/public_chatbot.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,6 @@ object_relationships:
- name: complexityEnum
using:
foreign_key_constraint_on: default_complexity
- name: department
using:
foreign_key_constraint_on: department_id
- name: lengthEnum
using:
foreign_key_constraint_on: default_length
Expand Down Expand Up @@ -39,13 +36,6 @@ array_relationships:
table:
name: chatbot_domain
schema: public
- name: organization_chatbots
using:
foreign_key_constraint_on:
column: chatbot_id
table:
name: organization_chatbot
schema: public
- name: prompts
using:
foreign_key_constraint_on:
Expand All @@ -66,6 +56,7 @@ select_permissions:
columns:
- avatar
- chatbot_id
- chatbot_id
Copy link

Copilot AI Dec 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Duplicate column chatbot_id appears twice in the select permissions. This appears to be an accidental duplication that should be removed.

Suggested change
- chatbot_id

Copilot uses AI. Check for mistakes.
Copy link
Contributor

@coderabbitai coderabbitai bot Dec 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Remove duplicate column entry.

The chatbot_id column appears twice in the anonymous role's select permissions (lines 58 and 59). This duplication is redundant and may cause metadata validation warnings.

🔎 Proposed fix 
       columns:
         - avatar
         - chatbot_id
-        - chatbot_id
         - created_by
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- chatbot_id
columns:
- avatar
- chatbot_id
- created_by
🤖 Prompt for AI Agents 
In apps/hasura/metadata/databases/masterbots/tables/public_chatbot.yaml around
line 59, the anonymous role's select permissions include a duplicated
"chatbot_id" column entry; remove the second occurrence (the entry on line 59)
so each column appears only once in the columns list, then save and run Hasura
metadata validation to ensure no warnings remain.

- created_by
- default_complexity
- default_length
Expand All @@ -84,20 +75,20 @@ select_permissions:
- role: moderator
permission:
columns:
- disabled
- is_pro
- pro_exclusive
- avatar
- chatbot_id
- department_id
- order
- avatar
- created_by
- default_complexity
- default_length
- default_tone
- default_type
- department_id
- description
- disabled
- name
- order
filter: {}
allow_aggregations: true
comment: ""
Expand Down
81 changes: 81 additions & 0 deletions apps/hasura/metadata/databases/masterbots/tables/public_n8n_credentials.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,81 @@
table:
name: n8n_credentials
schema: public
Comment on lines +1 to +3
Copy link
Contributor

@coderabbitai coderabbitai bot Dec 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Critical: Add strict permissions for credential data.

This table stores n8n credentials, which are highly sensitive. This MUST have proper permissions before merging to any non-development environment:

  1. Strict row-level security: Users should ONLY access their own credentials
  2. Object relationship to public.user via the user_id foreign key
  3. Limited column access: Consider whether all credential fields should be readable
  4. Audit logging: Consider tracking access to credential data
🔎 Example with strict security controls 
table:
  name: n8n_credentials
  schema: public
object_relationships:
  - name: user
    using:
      foreign_key_constraint_on: user_id
select_permissions:
  - role: user
    permission:
      columns:
        - id
        - user_id
        - provider
        - service
        - n8n_credential_id
        - created_at
      filter:
        user_id:
          _eq: X-Hasura-User-Id
insert_permissions:
  - role: user
    permission:
      check:
        user_id:
          _eq: X-Hasura-User-Id
      columns:
        - provider
        - service
        - n8n_credential_id
delete_permissions:
  - role: user
    permission:
      filter:
        user_id:
          _eq: X-Hasura-User-Id
🤖 Prompt for AI Agents 
In apps/hasura/metadata/databases/masterbots/tables/public_n8n_credentials.yaml
lines 1-3: this table holds sensitive n8n credentials and needs strict security
before non-dev deployment—enable row-level security, add an object_relationship
named "user" using foreign_key_constraint_on: user_id, and add
select/insert/delete permissions scoped to role "user" that filter/check user_id
equals X-Hasura-User-Id; restrict select columns to only non-secret fields
(e.g., id, user_id, provider, service, n8n_credential_id, created_at), restrict
insert columns to only allowed writable fields, and restrict delete to the same
user filter; additionally ensure any remaining secret columns are excluded from
select and consider adding audit logging/triggers for access events.

insert_permissions:
- role: moderator
permission:
check:
user_id:
_eq: X-Hasura-User-Id
columns:
- n8n_credential_id
- provider
- service
- created_at
- id
- user_id
comment: ""
- role: user
permission:
check:
user_id:
_eq: X-Hasura-User-Id
columns:
- n8n_credential_id
- provider
- service
- created_at
- id
- user_id
comment: ""
select_permissions:
- role: moderator
permission:
columns:
- n8n_credential_id
- provider
- service
- created_at
- id
- user_id
filter:
user_id:
_eq: X-Hasura-User-Id
comment: ""
- role: user
permission:
columns:
- n8n_credential_id
- provider
- service
- created_at
- id
- user_id
filter:
user_id:
_eq: X-Hasura-User-Id
comment: ""
update_permissions:
- role: moderator
permission:
columns:
- n8n_credential_id
- provider
- service
filter:
user_id:
_eq: X-Hasura-User-Id
check: null
comment: ""
- role: user
permission:
columns:
- created_at
- n8n_credential_id
- provider
- service
filter:
user_id:
_eq: X-Hasura-User-Id
check: null
comment: ""
10 changes: 2 additions & 8 deletions apps/hasura/metadata/databases/masterbots/tables/public_preference.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,11 +36,7 @@ insert_permissions:
comment: ""
- role: user
permission:
check:
user_id:
_eq: X-Hasura-User-Id
set:
user_id: X-Hasura-User-Id
check: {}
Copy link

Copilot AI Dec 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The check: {} permission allows any authenticated user to insert preferences for any user, bypassing user isolation. This is a security vulnerability. The original permission with user_id check should be restored to ensure users can only create their own preferences.

Suggested change
check: {}
check:
user_id:
_eq: X-Hasura-User-Id

Copilot uses AI. Check for mistakes.
Copy link
Contributor

@coderabbitai coderabbitai bot Dec 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Critical security vulnerability: Empty check allows privilege escalation.

The empty check: {} for the user role permits any authenticated user to insert preferences with any user_id, effectively allowing users to create or modify preferences for other users.

This should enforce row-level security:

check:
  user_id:
    _eq: X-Hasura-User-Id
🔎 Proposed fix 
   - role: user
     permission:
-      check: {}
+      check:
+        user_id:
+          _eq: X-Hasura-User-Id
       columns:
🤖 Prompt for AI Agents 
In apps/hasura/metadata/databases/masterbots/tables/public_preference.yaml
around line 36, the `check: {}` for the `user` role allows any authenticated
user to insert or modify rows for arbitrary `user_id`; replace the empty check
with a row-level security condition that enforces user_id equals the Hasura
session variable (X-Hasura-User-Id) for inserts/updates (e.g. set check to
require user_id _eq to the X-Hasura-User-Id session variable), ensuring the
comparison type matches the column type (cast the session var if needed) and
keep the rest of the permission block intact.

columns:
- deep_expertise
- favorite
Expand Down Expand Up @@ -108,9 +104,7 @@ select_permissions:
- preferred_type
- user_id
- web_search
filter:
user_id:
_eq: X-Hasura-User-Id
filter: {}
Copy link

Copilot AI Dec 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The filter: {} permission allows any authenticated user to read all preferences from all users, which is a privacy violation. The original permission with user_id filter should be restored to ensure users can only access their own preferences.

Suggested change
filter: {}
filter:
user_id:
_eq: X-Hasura-User-Id

Copilot uses AI. Check for mistakes.
Copy link
Contributor

@coderabbitai coderabbitai bot Dec 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Critical security vulnerability: Empty filter exposes all user preferences.

The empty filter: {} for the user role allows any authenticated user to query all preferences across all users, leaking sensitive user data.

This should enforce row-level security to restrict users to their own preferences.

🔎 Proposed fix 
   - role: user
     permission:
       columns:
         - deep_expertise
         - favorite
         - font_size
         - lang
         - preference_id
         - preferred_complexity
         - preferred_length
         - preferred_tone
         - preferred_type
         - user_id
         - web_search
-      filter: {}
+      filter:
+        user_id:
+          _eq: X-Hasura-User-Id
     comment: ""
🤖 Prompt for AI Agents 
In apps/hasura/metadata/databases/masterbots/tables/public_preference.yaml
around line 94, the permission filter is currently empty (filter: {}), exposing
all preferences; replace it with a row-level filter that restricts results to
the logged-in user by comparing the preference's user_id to the Hasura session
variable (for example: set filter to {"user_id": {"_eq": "X-Hasura-User-Id"}} or
to the correct JWT claim/key your app uses, e.g. "x-hasura-user-id"), ensuring
the permission only returns rows where user_id equals the session user id.

comment: ""
update_permissions:
- role: moderator
Expand Down
2 changes: 0 additions & 2 deletions apps/hasura/metadata/databases/masterbots/tables/public_thread.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,6 @@ insert_permissions:
- is_blocked
- is_pro
- is_public
- metadata
- model
- parent_thread_id
- short_link
Expand All @@ -63,7 +62,6 @@ insert_permissions:
- is_blocked
- is_pro
- is_public
- metadata
- model
- parent_thread_id
- short_link
Expand Down
7 changes: 0 additions & 7 deletions apps/hasura/metadata/databases/masterbots/tables/public_user.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,13 +24,6 @@ array_relationships:
table:
name: social_following
schema: public
- name: organizations
using:
foreign_key_constraint_on:
column: user_id
table:
name: organization
schema: public
- name: preferences
using:
foreign_key_constraint_on:
Expand Down
92 changes: 92 additions & 0 deletions apps/hasura/metadata/databases/masterbots/tables/public_user_oauth_connections.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,92 @@
table:
name: user_oauth_connections
schema: public
Comment on lines +1 to +3
Copy link
Contributor

@coderabbitai coderabbitai bot Dec 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion | 🟠 Major

Add permissions and relationships with privacy controls.

This table stores OAuth connection data, which is sensitive user information. Before merging, you should add:

  1. Row-level security: Users should only access their own OAuth connections
  2. Object relationship to public.user via the user_id foreign key
  3. Restricted permissions: Carefully control which roles can select/insert/update/delete
🔎 Example with privacy controls 
table:
  name: user_oauth_connections
  schema: public
object_relationships:
  - name: user
    using:
      foreign_key_constraint_on: user_id
select_permissions:
  - role: user
    permission:
      columns:
        - id
        - user_id
        - provider
        - service
        - scopes
        - status
        - connected_at
        - revoked_at
      filter:
        user_id:
          _eq: X-Hasura-User-Id
insert_permissions:
  - role: user
    permission:
      check:
        user_id:
          _eq: X-Hasura-User-Id
      columns:
        - provider
        - service
        - scopes
        - status
update_permissions:
  - role: user
    permission:
      columns:
        - status
        - revoked_at
      filter:
        user_id:
          _eq: X-Hasura-User-Id
🤖 Prompt for AI Agents 
In
apps/hasura/metadata/databases/masterbots/tables/public_user_oauth_connections.yaml
around lines 1-3, the table currently lacks row-level security, object
relationship to public.user, and role-restricted permissions; add an
object_relationship mapping on user_id to public.user, enable/select row-level
security policies so users can only access their own rows (filters using
X-Hasura-User-Id), and add select/insert/update (and delete if needed)
permission entries for the user role that explicitly list allowed columns, use
filters like user_id: {_eq: X-Hasura-User-Id} for selects/updates and checks for
inserts, and restrict update columns to only safe fields (e.g., status,
revoked_at) while preventing exposing sensitive columns.

insert_permissions:
- role: moderator
permission:
check:
user_id:
_eq: X-Hasura-User-Id
columns:
- provider
- scopes
- service
- status
- connected_at
- revoked_at
- id
- user_id
comment: ""
- role: user
permission:
check:
user_id:
_eq: X-Hasura-User-Id
columns:
- provider
- scopes
- service
- status
- connected_at
- revoked_at
- id
- user_id
comment: ""
select_permissions:
- role: moderator
permission:
columns:
- connected_at
- id
- provider
- revoked_at
- scopes
- service
- status
- user_id
filter:
user_id:
_eq: X-Hasura-User-Id
comment: ""
- role: user
permission:
columns:
- connected_at
- id
- provider
- revoked_at
- scopes
- service
- status
- user_id
filter:
user_id:
_eq: X-Hasura-User-Id
comment: ""
update_permissions:
- role: moderator
permission:
columns:
- provider
- revoked_at
- scopes
- service
- status
filter:
user_id:
_eq: X-Hasura-User-Id
check: null
comment: ""
- role: user
permission:
columns:
- provider
- revoked_at
- scopes
- service
- status
filter:
user_id:
_eq: X-Hasura-User-Id
check: null
comment: ""
38 changes: 38 additions & 0 deletions apps/hasura/metadata/databases/masterbots/tables/public_user_token.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,25 @@ object_relationships:
- name: user
using:
foreign_key_constraint_on: user_id
insert_permissions:
- role: moderator
permission:
check:
user_id:
_eq: X-Hasura-User-Id
columns:
- token
- user_id
comment: ""
- role: user
permission:
check:
user_id:
_eq: X-Hasura-User-Id
columns:
- token
- user_id
comment: ""
select_permissions:
- role: anonymous
permission:
Expand All @@ -32,3 +51,22 @@ select_permissions:
user_id:
_eq: X-Hasura-User-Id
comment: ""
update_permissions:
- role: moderator
permission:
columns:
- token
filter:
user_id:
_eq: X-Hasura-User-Id
check: null
comment: ""
- role: user
permission:
columns:
- token
filter:
user_id:
_eq: X-Hasura-User-Id
check: null
comment: ""
Loading