[pull] main from FlowiseAI:main

packages/server/src/controllers/nodes/index.ts

@@ -77,7 +77,8 @@ const getSingleNodeAsyncOptions = async (req: Request, res: Response, next: Next
         }
         const body = req.body
         body.searchOptions = getWorkspaceSearchOptionsFromReq(req)
-        const apiResponse = await nodesService.getSingleNodeAsyncOptions(req.params.name, body)
+        const workspaceId = req.user?.activeWorkspaceId
+        const apiResponse = await nodesService.getSingleNodeAsyncOptions(req.params.name, body, workspaceId)
         return res.json(apiResponse)
     } catch (error) {
         next(error)

packages/server/src/routes/node-load-methods/index.ts

@@ -1,7 +1,15 @@
 import express from 'express'
 import nodesRouter from '../../controllers/nodes'
+import { checkAnyPermission } from '../../enterprise/rbac/PermissionCheck'
+
 const router = express.Router()
 
-router.post(['/', '/:name'], nodesRouter.getSingleNodeAsyncOptions)
+router.post(
+    ['/', '/:name'],
+    checkAnyPermission(
+        'chatflows:view,chatflows:create,chatflows:update,chatflows:delete,agentflows:view,agentflows:create,agentflows:update,agentflows:delete,documentStores:view,documentStores:create,documentStores:update,documentStores:add-loader'
+    ),
+    nodesRouter.getSingleNodeAsyncOptions
+)
 
 export default router

packages/server/src/services/credentials/index.ts

@@ -192,6 +192,35 @@ const updateCredential = async (credentialId: string, requestBody: any, workspac
     }
 }
 
+/**
+ * Confirms a credential exists and belongs to (or is shared with) the given workspace.
+ * Does NOT decrypt or return credential material — only used for authorization checks.
+ * Throws 400 when workspaceId is missing (prevents unscoped lookup), 404 when the
+ * credential does not belong to the workspace or is not shared with it.
+ */
+const assertCredentialInWorkspace = async (credentialId: string, workspaceId: string | undefined): Promise<void> => {
+    if (!workspaceId) {
+        throw new InternalFlowiseError(StatusCodes.BAD_REQUEST, `Workspace ID is required`)
+    }
+    const appServer = getRunningExpressApp()
+    const owned = await appServer.AppDataSource.getRepository(Credential).findOneBy({
+        id: credentialId,
+        workspaceId: workspaceId
+    })
+    if (owned) return
+
+    const shared = await appServer.AppDataSource.getRepository(WorkspaceShared).count({
+        where: {
+            workspaceId: workspaceId,
+            sharedItemId: credentialId,
+            itemType: 'credential'
+        }
+    })
+    if (shared > 0) return
+
+    throw new InternalFlowiseError(StatusCodes.NOT_FOUND, `Credential ${credentialId} not found`)
+}
+
 const revealCredentialById = async (credentialId: string, workspaceId: string): Promise<any> => {
     try {
         const appServer = getRunningExpressApp()
@@ -227,5 +256,6 @@ export default {
     getAllCredentials,
     getCredentialById,
     revealCredentialById,
-    updateCredential
+    updateCredential,
+    assertCredentialInWorkspace
 }

packages/server/src/services/nodes/index.ts

@@ -1,14 +1,15 @@
-import { cloneDeep, omit } from 'lodash'
-import { StatusCodes } from 'http-status-codes'
-import { getRunningExpressApp } from '../../utils/getRunningExpressApp'
-import { INodeData, MODE } from '../../Interface'
 import { ClientType, INodeOptionsValue } from 'flowise-components'
-import { databaseEntities } from '../../utils'
-import logger from '../../utils/logger'
+import { StatusCodes } from 'http-status-codes'
+import { cloneDeep, omit } from 'lodash'
 import { InternalFlowiseError } from '../../errors/internalFlowiseError'
 import { getErrorMessage } from '../../errors/utils'
+import { INodeData, MODE } from '../../Interface'
+import { databaseEntities } from '../../utils'
 import { OMIT_QUEUE_JOB_DATA } from '../../utils/constants'
 import { executeCustomNodeFunction } from '../../utils/executeCustomNodeFunction'
+import { getRunningExpressApp } from '../../utils/getRunningExpressApp'
+import logger from '../../utils/logger'
+import credentialsService from '../credentials'
 import { filterNodeByClient } from './filterNodeByClient'
 
 export { filterNodeByClient }
@@ -91,11 +92,15 @@ const getSingleNodeIcon = async (nodeName: string) => {
     }
 }
 
-const getSingleNodeAsyncOptions = async (nodeName: string, requestBody: any): Promise<any> => {
+const getSingleNodeAsyncOptions = async (nodeName: string, requestBody: any, workspaceId?: string): Promise<any> => {
     try {
         const appServer = getRunningExpressApp()
         const nodeData: INodeData = requestBody
         if (Object.prototype.hasOwnProperty.call(appServer.nodesPool.componentNodes, nodeName)) {
+            if (nodeData.credential) {
+                await credentialsService.assertCredentialInWorkspace(nodeData.credential, workspaceId)
+            }
+
             try {
                 const nodeInstance = appServer.nodesPool.componentNodes[nodeName]
                 const methodName = nodeData.loadMethod || ''
@@ -118,6 +123,9 @@ const getSingleNodeAsyncOptions = async (nodeName: string, requestBody: any): Pr
             throw new InternalFlowiseError(StatusCodes.NOT_FOUND, `Node ${nodeName} not found`)
         }
     } catch (error) {
+        if (error instanceof InternalFlowiseError) {
+            throw error
+        }
         throw new InternalFlowiseError(
             StatusCodes.INTERNAL_SERVER_ERROR,
             `Error: nodesService.getSingleNodeAsyncOptions - ${getErrorMessage(error)}`