refactor(core): Cache workflow ownership (#6738)

* refactor: Set up ownership service

* refactor: Specify cache keys and values

* refactor: Replace util with service calls

* test: Mock service in tests

* refactor: Use dependency injection

* test: Write tests

* refactor: Apply feedback from Omar and Micha

* test: Fix tests

* test: Fix missing spot

* refactor: Return user entity from cache

* refactor: More dependency injection!

packages/cli/test/unit/PermissionChecker.test.ts

@@ -23,6 +23,7 @@ import * as testDb from '../integration/shared/testDb';
 import { mockNodeTypesData } from './Helpers';
 import type { SaveCredentialFunction } from '../integration/shared/types';
 import { mockInstance } from '../integration/shared/utils/';
+import { OwnershipService } from '@/services/ownership.service';
 
 let mockNodeTypes: INodeTypes;
 let credentialOwnerRole: Role;
@@ -221,6 +222,7 @@ describe('PermissionChecker.checkSubworkflowExecutePolicy', () => {
 	const userId = uuid();
 	const fakeUser = new User();
 	fakeUser.id = userId;
+	const ownershipService = mockInstance(OwnershipService);
 
 	const ownerMockRole = new Role();
 	ownerMockRole.name = 'owner';
@@ -234,9 +236,11 @@ describe('PermissionChecker.checkSubworkflowExecutePolicy', () => {
 
 	test('sets default policy from environment when subworkflow has none', async () => {
 		config.set('workflows.callerPolicyDefaultOption', 'none');
-		jest.spyOn(UserManagementHelper, 'getWorkflowOwner').mockImplementation(async (workflowId) => {
-			return fakeUser;
-		});
+		jest
+			.spyOn(ownershipService, 'getWorkflowOwnerCached')
+			.mockImplementation(async (workflowId) => {
+				return fakeUser;
+			});
 		jest.spyOn(UserManagementHelper, 'isSharingEnabled').mockReturnValue(true);
 
 		const subworkflow = new Workflow({
@@ -253,7 +257,7 @@ describe('PermissionChecker.checkSubworkflowExecutePolicy', () => {
 
 	test('if sharing is disabled, ensures that workflows are owner by same user', async () => {
 		jest
-			.spyOn(UserManagementHelper, 'getWorkflowOwner')
+			.spyOn(ownershipService, 'getWorkflowOwnerCached')
 			.mockImplementation(async (workflowId) => fakeUser);
 		jest.spyOn(UserManagementHelper, 'isSharingEnabled').mockReturnValue(false);
 		jest.spyOn(UserService, 'get').mockImplementation(async () => fakeUser);
@@ -287,7 +291,7 @@ describe('PermissionChecker.checkSubworkflowExecutePolicy', () => {
 	test('list of ids must include the parent workflow id', async () => {
 		const invalidParentWorkflowId = uuid();
 		jest
-			.spyOn(UserManagementHelper, 'getWorkflowOwner')
+			.spyOn(ownershipService, 'getWorkflowOwnerCached')
 			.mockImplementation(async (workflowId) => fakeUser);
 		jest.spyOn(UserManagementHelper, 'isSharingEnabled').mockReturnValue(true);
 		jest.spyOn(UserService, 'get').mockImplementation(async () => fakeUser);
@@ -313,7 +317,7 @@ describe('PermissionChecker.checkSubworkflowExecutePolicy', () => {
 
 	test('sameOwner passes when both workflows are owned by the same user', async () => {
 		jest
-			.spyOn(UserManagementHelper, 'getWorkflowOwner')
+			.spyOn(ownershipService, 'getWorkflowOwnerCached')
 			.mockImplementation(async (workflowId) => fakeUser);
 		jest.spyOn(UserManagementHelper, 'isSharingEnabled').mockReturnValue(false);
 		jest.spyOn(UserService, 'get').mockImplementation(async () => fakeUser);
@@ -336,7 +340,7 @@ describe('PermissionChecker.checkSubworkflowExecutePolicy', () => {
 	test('workflowsFromAList works when the list contains the parent id', async () => {
 		const workflowId = uuid();
 		jest
-			.spyOn(UserManagementHelper, 'getWorkflowOwner')
+			.spyOn(ownershipService, 'getWorkflowOwnerCached')
 			.mockImplementation(async (workflowId) => fakeUser);
 		jest.spyOn(UserManagementHelper, 'isSharingEnabled').mockReturnValue(true);
 		jest.spyOn(UserService, 'get').mockImplementation(async () => fakeUser);
@@ -362,7 +366,7 @@ describe('PermissionChecker.checkSubworkflowExecutePolicy', () => {
 
 	test('should not throw when workflow policy is set to any', async () => {
 		jest
-			.spyOn(UserManagementHelper, 'getWorkflowOwner')
+			.spyOn(ownershipService, 'getWorkflowOwnerCached')
 			.mockImplementation(async (workflowId) => fakeUser);
 		jest.spyOn(UserManagementHelper, 'isSharingEnabled').mockReturnValue(true);
 		jest.spyOn(UserService, 'get').mockImplementation(async () => fakeUser);

packages/cli/test/unit/services/events.service.test.ts

@@ -15,13 +15,15 @@ import type { WorkflowStatistics } from '@db/entities/WorkflowStatistics';
 import { WorkflowStatisticsRepository } from '@db/repositories';
 import { EventsService } from '@/services/events.service';
 import { UserService } from '@/user/user.service';
-import { getWorkflowOwner } from '@/UserManagement/UserManagementHelper';
+import { OwnershipService } from '@/services/ownership.service';
+import { mockInstance } from '../../integration/shared/utils';
 
 jest.mock('@/UserManagement/UserManagementHelper', () => ({ getWorkflowOwner: jest.fn() }));
 
 describe('EventsService', () => {
 	const dbType = config.getEnv('database.type');
 	const fakeUser = mock<User>({ id: 'abcde-fghij' });
+	const ownershipService = mockInstance(OwnershipService);
 
 	const entityManager = mock<EntityManager>();
 	const dataSource = mock<DataSource>({
@@ -36,10 +38,13 @@ describe('EventsService', () => {
 	LoggerProxy.init(mock<ILogger>());
 	config.set('diagnostics.enabled', true);
 	config.set('deployment.type', 'n8n-testing');
-	mocked(getWorkflowOwner).mockResolvedValue(fakeUser);
+	mocked(ownershipService.getWorkflowOwnerCached).mockResolvedValue(fakeUser);
 	const updateUserSettingsMock = jest.spyOn(UserService, 'updateUserSettings').mockImplementation();
 
-	const eventsService = new EventsService(new WorkflowStatisticsRepository(dataSource));
+	const eventsService = new EventsService(
+		new WorkflowStatisticsRepository(dataSource),
+		ownershipService,
+	);
 
 	const onFirstProductionWorkflowSuccess = jest.fn();
 	const onFirstWorkflowDataLoad = jest.fn();

packages/cli/test/unit/services/ownership.service.test.ts

@@ -0,0 +1,68 @@
+import { OwnershipService } from '@/services/ownership.service';
+import { RoleRepository, SharedWorkflowRepository, UserRepository } from '@/databases/repositories';
+import { mockInstance } from '../../integration/shared/utils';
+import { Role } from '@/databases/entities/Role';
+import { randomInteger } from '../../integration/shared/random';
+import { SharedWorkflow } from '@/databases/entities/SharedWorkflow';
+import { CacheService } from '@/services/cache.service';
+import { User } from '@/databases/entities/User';
+
+const wfOwnerRole = () =>
+	Object.assign(new Role(), {
+		scope: 'workflow',
+		name: 'owner',
+		id: randomInteger(),
+	});
+
+describe('OwnershipService', () => {
+	const cacheService = mockInstance(CacheService);
+	const roleRepository = mockInstance(RoleRepository);
+	const userRepository = mockInstance(UserRepository);
+	const sharedWorkflowRepository = mockInstance(SharedWorkflowRepository);
+
+	const ownershipService = new OwnershipService(
+		cacheService,
+		userRepository,
+		roleRepository,
+		sharedWorkflowRepository,
+	);
+
+	beforeEach(() => {
+		jest.clearAllMocks();
+	});
+
+	describe('getWorkflowOwner()', () => {
+		test('should retrieve a workflow owner', async () => {
+			roleRepository.findWorkflowOwnerRole.mockResolvedValueOnce(wfOwnerRole());
+
+			const mockOwner = new User();
+			const mockNonOwner = new User();
+
+			const sharedWorkflow = Object.assign(new SharedWorkflow(), {
+				role: new Role(),
+				user: mockOwner,
+			});
+
+			sharedWorkflowRepository.findOneOrFail.mockResolvedValueOnce(sharedWorkflow);
+
+			const returnedOwner = await ownershipService.getWorkflowOwnerCached('some-workflow-id');
+
+			expect(returnedOwner).toBe(mockOwner);
+			expect(returnedOwner).not.toBe(mockNonOwner);
+		});
+
+		test('should throw if no workflow owner role found', async () => {
+			roleRepository.findWorkflowOwnerRole.mockRejectedValueOnce(new Error());
+
+			await expect(ownershipService.getWorkflowOwnerCached('some-workflow-id')).rejects.toThrow();
+		});
+
+		test('should throw if no workflow owner found', async () => {
+			roleRepository.findWorkflowOwnerRole.mockResolvedValueOnce(wfOwnerRole());
+
+			sharedWorkflowRepository.findOneOrFail.mockRejectedValue(new Error());
+
+			await expect(ownershipService.getWorkflowOwnerCached('some-workflow-id')).rejects.toThrow();
+		});
+	});
+});