Merge branch 'main' into fix/tavily-api-key-param

asimar007 · web-flow · commit 9e9408dc31af · 2026-05-12T09:05:03.000+05:30
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -116,6 +116,33 @@ Flowise has 3 different modules in a single mono repository.
 
 11. Commit code and submit Pull Request from forked branch pointing to [Flowise main](https://github.com/FlowiseAI/Flowise/tree/main).
 
+### Adding or modifying credential definitions
+
+Credential definitions live in `packages/components/credentials/`. Each input field has a `type` that controls both UI rendering and how the value is handled on the server.
+
+**Security rule: any field that contains a secret must use `type: 'url'` or `type: 'password'` — never `type: 'string'`.**
+
+The server redacts both `url` and `password` fields before returning credential data to the client. Fields typed `string` are returned in plaintext, which exposes stored secrets to any authenticated user with `credentials:view` permission.
+
+Use `type: 'url'` for connection strings with embedded credentials:
+
+-   Connection URLs that embed a username/password (e.g. `mongodb+srv://user:pass@host/db`, `redis://:pass@host`, `postgresql://user:pass@host/db`)
+-   Displayed with the password portion masked (e.g. `mongodb+srv://user:••••••@host/db`); users with edit permission can reveal the full URL
+
+Use `type: 'password'` for opaque secrets with no meaningful preview:
+
+-   API keys, access keys, secret keys, tokens
+-   JSON blobs containing private keys or certificates (e.g. Google service account JSON)
+-   Fully redacted in the UI; users must replace the entire value to update them
+
+Fields that are safe as `type: 'string'`:
+
+-   Usernames / account names (when the password is a separate field)
+-   Region, host, port, database name, project ID
+-   Non-secret identifiers and configuration values
+
+If in doubt, use `type: 'password'`. The only cost is that the field must be re-entered on edit; the cost of using `type: 'string'` for a secret is that it is exposed via the API.
+
 ### Testing
 
 -   Unit tests are **co-located** with their source files — a test for `Foo.ts` lives in `Foo.test.ts` in the same directory. This is the standard used across all packages in this repo.
diff --git a/package.json b/package.json
@@ -35,8 +35,7 @@
         "postinstall": "husky install",
         "migration:create": "pnpm typeorm migration:create",
         "changeset": "changeset",
-        "changeset:version": "changeset version",
-        "changeset:publish": "changeset publish"
+        "changeset:version": "changeset version"
     },
     "lint-staged": {
         "*.{js,jsx,ts,tsx,json,md}": "eslint --fix"
diff --git a/packages/components/credentials/AWSCredential.credential.ts b/packages/components/credentials/AWSCredential.credential.ts
@@ -19,7 +19,7 @@ class AWSApi implements INodeCredential {
             {
                 label: 'AWS Access Key',
                 name: 'awsKey',
-                type: 'string',
+                type: 'password',
                 placeholder: '<AWS_ACCESS_KEY_ID>',
                 description: 'The access key for your AWS account.',
                 optional: true
diff --git a/packages/components/credentials/BaiduApi.credential.ts b/packages/components/credentials/BaiduApi.credential.ts
@@ -14,7 +14,7 @@ class BaiduQianfanApi implements INodeCredential {
             {
                 label: 'Qianfan Access Key',
                 name: 'qianfanAccessKey',
-                type: 'string'
+                type: 'password'
             },
             {
                 label: 'Qianfan Secret Key',
diff --git a/packages/components/credentials/CouchbaseApi.credential.ts b/packages/components/credentials/CouchbaseApi.credential.ts
@@ -15,7 +15,7 @@ class CouchbaseApi implements INodeCredential {
             {
                 label: 'Couchbase Connection String',
                 name: 'connectionString',
-                type: 'string'
+                type: 'url'
             },
             {
                 label: 'Couchbase Username',
diff --git a/packages/components/credentials/GoogleAuth.credential.ts b/packages/components/credentials/GoogleAuth.credential.ts
@@ -36,7 +36,7 @@ class GoogleVertexAuth implements INodeCredential {
     "auth_provider_x509_cert_url": ...,
     "client_x509_cert_url": ...
 }`,
-                type: 'string',
+                type: 'password',
                 rows: 4,
                 optional: true
             },
diff --git a/packages/components/credentials/MongoDBUrlApi.credential.ts b/packages/components/credentials/MongoDBUrlApi.credential.ts
@@ -15,7 +15,7 @@ class MongoDBUrlApi implements INodeCredential {
             {
                 label: 'ATLAS Connection URL',
                 name: 'mongoDBConnectUrl',
-                type: 'string',
+                type: 'url',
                 placeholder: 'mongodb+srv://<user>:<pwd>@cluster0.example.mongodb.net/?retryWrites=true&w=majority'
             }
         ]
diff --git a/packages/components/credentials/OpenSearchUrl.credential.ts b/packages/components/credentials/OpenSearchUrl.credential.ts
@@ -15,7 +15,7 @@ class OpenSearchUrl implements INodeCredential {
             {
                 label: 'OpenSearch Url',
                 name: 'openSearchUrl',
-                type: 'string'
+                type: 'url'
             },
             {
                 label: 'User',
diff --git a/packages/components/credentials/PostgresUrl.credential.ts b/packages/components/credentials/PostgresUrl.credential.ts
@@ -15,7 +15,7 @@ class PostgresUrl implements INodeCredential {
             {
                 label: 'Postgres URL',
                 name: 'postgresUrl',
-                type: 'string',
+                type: 'url',
                 placeholder: 'postgresql://localhost/mydb'
             }
         ]
diff --git a/packages/components/credentials/RedisCacheUrlApi.credential.ts b/packages/components/credentials/RedisCacheUrlApi.credential.ts
@@ -15,7 +15,7 @@ class RedisCacheUrlApi implements INodeCredential {
             {
                 label: 'Redis URL',
                 name: 'redisUrl',
-                type: 'string',
+                type: 'url',
                 default: 'redis://localhost:6379'
             }
         ]
diff --git a/packages/components/credentials/UpstashRedisApi.credential.ts b/packages/components/credentials/UpstashRedisApi.credential.ts
@@ -17,7 +17,7 @@ class UpstashRedisApi implements INodeCredential {
             {
                 label: 'Upstash Redis REST URL',
                 name: 'upstashConnectionUrl',
-                type: 'string'
+                type: 'url'
             },
             {
                 label: 'Token',
diff --git a/packages/components/credentials/UpstashVectorApi.credential.ts b/packages/components/credentials/UpstashVectorApi.credential.ts
@@ -15,7 +15,7 @@ class UpstashVectorApi implements INodeCredential {
             {
                 label: 'Upstash Vector REST URL',
                 name: 'UPSTASH_VECTOR_REST_URL',
-                type: 'string'
+                type: 'url'
             },
             {
                 label: 'Upstash Vector REST Token',
diff --git a/packages/components/package.json b/packages/components/package.json
@@ -181,7 +181,7 @@
         "supergateway": "3.0.1",
         "typeorm": "^0.3.6",
         "uuid": "^10.0.0",
-        "vm2": "^3.10.5",
+        "vm2": "3.11.2",
         "weaviate-client": "3.12.0",
         "winston": "^3.9.0",
         "ws": "^8.18.0",
diff --git a/packages/server/src/controllers/credentials/index.ts b/packages/server/src/controllers/credentials/index.ts
@@ -80,6 +80,28 @@ const getCredentialById = async (req: Request, res: Response, next: NextFunction
     }
 }
 
+const revealCredentialById = async (req: Request, res: Response, next: NextFunction) => {
+    try {
+        if (typeof req.params === 'undefined' || !req.params.id) {
+            throw new InternalFlowiseError(
+                StatusCodes.PRECONDITION_FAILED,
+                `Error: credentialsController.revealCredentialById - id not provided!`
+            )
+        }
+        const workspaceId = req.user?.activeWorkspaceId
+        if (!workspaceId) {
+            throw new InternalFlowiseError(
+                StatusCodes.NOT_FOUND,
+                `Error: credentialsController.revealCredentialById - workspace ${workspaceId} not found!`
+            )
+        }
+        const apiResponse = await credentialsService.revealCredentialById(req.params.id, workspaceId)
+        return res.json(apiResponse)
+    } catch (error) {
+        next(error)
+    }
+}
+
 const updateCredential = async (req: Request, res: Response, next: NextFunction) => {
     try {
         if (typeof req.params === 'undefined' || !req.params.id) {
@@ -113,5 +135,6 @@ export default {
     deleteCredentials,
     getAllCredentials,
     getCredentialById,
+    revealCredentialById,
     updateCredential
 }
diff --git a/packages/server/src/enterprise/controllers/organization.controller.ts b/packages/server/src/enterprise/controllers/organization.controller.ts
@@ -7,6 +7,7 @@ import { Organization } from '../database/entities/organization.entity'
 import { GeneralErrorMessage } from '../../utils/constants'
 import { OrganizationUserService } from '../services/organization-user.service'
 import { getCurrentUsage } from '../../utils/quotaUsage'
+import { assertStripeIdMatchesSession } from '../utils/tenantRequestGuards'
 
 export class OrganizationController {
     public async create(req: Request, res: Response, next: NextFunction) {
@@ -62,6 +63,7 @@ export class OrganizationController {
             if (!subscriptionId) {
                 return res.status(400).json({ error: 'Subscription ID is required' })
             }
+            assertStripeIdMatchesSession(subscriptionId as string, req.user?.activeOrganizationSubscriptionId)
             const organizationUserservice = new OrganizationUserService()
             const totalOrgUsers = await organizationUserservice.readOrgUsersCountByOrgId(req.user?.activeOrganizationId as string)
 
@@ -80,6 +82,7 @@ export class OrganizationController {
             if (!customerId) {
                 return res.status(400).json({ error: 'Customer ID is required' })
             }
+            assertStripeIdMatchesSession(customerId as string, req.user?.activeOrganizationCustomerId)
             const identityManager = getRunningExpressApp().identityManager
             const result = await identityManager.getCustomerWithDefaultSource(customerId as string)
 
@@ -93,11 +96,12 @@ export class OrganizationController {
         try {
             const { subscriptionId, quantity } = req.query
             if (!subscriptionId) {
-                return res.status(400).json({ error: 'Customer ID is required' })
+                return res.status(400).json({ error: 'Subscription ID is required' })
             }
             if (quantity === undefined) {
                 return res.status(400).json({ error: 'Quantity is required' })
             }
+            assertStripeIdMatchesSession(subscriptionId as string, req.user?.activeOrganizationSubscriptionId)
             const identityManager = getRunningExpressApp().identityManager
             const result = await identityManager.getAdditionalSeatsProration(subscriptionId as string, parseInt(quantity as string))
 
@@ -116,6 +120,7 @@ export class OrganizationController {
             if (!newPlanId) {
                 return res.status(400).json({ error: 'New plan ID is required' })
             }
+            assertStripeIdMatchesSession(subscriptionId as string, req.user?.activeOrganizationSubscriptionId)
             const identityManager = getRunningExpressApp().identityManager
             const result = await identityManager.getPlanProration(subscriptionId as string, newPlanId as string)
 
@@ -137,6 +142,7 @@ export class OrganizationController {
             if (!prorationDate) {
                 return res.status(400).json({ error: 'Proration date is required' })
             }
+            assertStripeIdMatchesSession(subscriptionId, req.user?.activeOrganizationSubscriptionId)
             const identityManager = getRunningExpressApp().identityManager
             const result = await identityManager.updateAdditionalSeats(subscriptionId, quantity, prorationDate)
 
@@ -158,6 +164,7 @@ export class OrganizationController {
             if (!prorationDate) {
                 return res.status(400).json({ error: 'Proration date is required' })
             }
+            assertStripeIdMatchesSession(subscriptionId, req.user?.activeOrganizationSubscriptionId)
             const identityManager = getRunningExpressApp().identityManager
             const result = await identityManager.updateSubscriptionPlan(req, subscriptionId, newPlanId, prorationDate)
 
diff --git a/packages/server/src/enterprise/utils/tenantRequestGuards.ts b/packages/server/src/enterprise/utils/tenantRequestGuards.ts
@@ -65,6 +65,12 @@ export async function assertWorkspaceIdAccessibleToUser(
     throw new InternalFlowiseError(StatusCodes.FORBIDDEN, GeneralErrorMessage.FORBIDDEN)
 }
 
+export function assertStripeIdMatchesSession(requestedId: string, activeId: string | undefined): void {
+    if (!activeId || requestedId !== activeId) {
+        throw new InternalFlowiseError(StatusCodes.FORBIDDEN, GeneralErrorMessage.FORBIDDEN)
+    }
+}
+
 export function userMayManageOrgUsers(user: LoggedInUser): boolean {
     return user.isOrganizationAdmin === true || (user.permissions?.includes('users:manage') ?? false)
 }
diff --git a/packages/server/src/routes/credentials/index.ts b/packages/server/src/routes/credentials/index.ts
@@ -8,7 +8,10 @@ router.post('/', checkPermission('credentials:create'), credentialsController.cr
 
 // READ
 router.get('/', checkPermission('credentials:view'), credentialsController.getAllCredentials)
-router.get(['/', '/:id'], checkPermission('credentials:view'), credentialsController.getCredentialById)
+router.get(['/', '/:id'], checkAnyPermission('credentials:create,credentials:update'), credentialsController.getCredentialById)
+
+// REVEAL
+router.get('/:id/reveal', checkAnyPermission('credentials:create,credentials:update'), credentialsController.revealCredentialById)
 
 // UPDATE
 router.put(['/', '/:id'], checkAnyPermission('credentials:create,credentials:update'), credentialsController.updateCredential)
diff --git a/packages/server/src/services/credentials/index.ts b/packages/server/src/services/credentials/index.ts
@@ -7,7 +7,7 @@ import { WorkspaceService } from '../../enterprise/services/workspace.service'
 import { getWorkspaceSearchOptions } from '../../enterprise/utils/ControllerServiceUtils'
 import { InternalFlowiseError } from '../../errors/internalFlowiseError'
 import { getErrorMessage } from '../../errors/utils'
-import { decryptCredentialData, transformToCredentialEntity } from '../../utils'
+import { decryptCredentialData, transformToCredentialEntity, REDACTED_CREDENTIAL_VALUE } from '../../utils'
 import { getRunningExpressApp } from '../../utils/getRunningExpressApp'
 
 const createCredential = async (requestBody: any) => {
@@ -177,7 +177,8 @@ const updateCredential = async (credentialId: string, requestBody: any, workspac
             throw new InternalFlowiseError(StatusCodes.NOT_FOUND, `Credential ${credentialId} not found`)
         }
         const decryptedCredentialData = await decryptCredentialData(credential.encryptedData)
-        requestBody.plainDataObj = { ...decryptedCredentialData, ...requestBody.plainDataObj }
+        const incomingData = requestBody.plainDataObj ?? {}
+        requestBody.plainDataObj = { ...decryptedCredentialData, ...incomingData }
         const updateCredential = await transformToCredentialEntity(requestBody)
         updateCredential.workspaceId = workspaceId
         await appServer.AppDataSource.getRepository(Credential).merge(credential, updateCredential)
@@ -191,10 +192,40 @@ const updateCredential = async (credentialId: string, requestBody: any, workspac
     }
 }
 
+const revealCredentialById = async (credentialId: string, workspaceId: string): Promise<any> => {
+    try {
+        const appServer = getRunningExpressApp()
+        const credential = await appServer.AppDataSource.getRepository(Credential).findOneBy({
+            id: credentialId,
+            workspaceId: workspaceId
+        })
+        if (!credential) {
+            throw new InternalFlowiseError(StatusCodes.NOT_FOUND, `Credential ${credentialId} not found`)
+        }
+        const decryptedCredentialData = await decryptCredentialData(credential.encryptedData)
+        const componentCredentials = appServer.nodesPool.componentCredentials
+        const inputs = componentCredentials[credential.credentialName]?.inputs ?? []
+        const plainDataObj: Record<string, any> = { ...decryptedCredentialData }
+        for (const key in plainDataObj) {
+            const inputParam = inputs.find((inp: any) => inp.name === key)
+            if (inputParam?.type !== 'url') {
+                plainDataObj[key] = REDACTED_CREDENTIAL_VALUE
+            }
+        }
+        return { plainDataObj }
+    } catch (error) {
+        throw new InternalFlowiseError(
+            StatusCodes.INTERNAL_SERVER_ERROR,
+            `Error: credentialsService.revealCredentialById - ${getErrorMessage(error)}`
+        )
+    }
+}
+
 export default {
     createCredential,
     deleteCredentials,
     getAllCredentials,
     getCredentialById,
+    revealCredentialById,
     updateCredential
 }
diff --git a/packages/server/src/utils/buildAgentflow.ts b/packages/server/src/utils/buildAgentflow.ts
@@ -1134,8 +1134,7 @@ const executeNode = async ({
             apiMessageId,
             chatHistory,
             runtimeChatHistoryLength: Math.max(0, runtimeChatHistory.length - 1),
-            state: updatedState,
-            ...overrideConfig
+            state: updatedState
         }
         if (
             iterationContext &&
diff --git a/packages/server/src/utils/buildChatflow.ts b/packages/server/src/utils/buildChatflow.ts
@@ -562,8 +562,7 @@ export const executeFlow = async ({
         chatId,
         sessionId,
         chatHistory,
-        apiMessageId,
-        ...incomingInput.overrideConfig
+        apiMessageId
     }
 
     logger.debug(`[server]: [${orgId}]: Start building flow ${chatflowid}`)
diff --git a/packages/server/src/utils/index.ts b/packages/server/src/utils/index.ts
@@ -568,10 +568,11 @@ export const buildFlow = async ({
 
     const flowData: ICommonObject = {
         chatflowid,
+        chatflowId: chatflowid,
         chatId,
         sessionId,
         chatHistory,
-        ...overrideConfig
+        apiMessageId
     }
     while (nodeQueue.length) {
         const { nodeId, depth } = nodeQueue.shift() as INodeQueue
@@ -1769,15 +1770,34 @@ export const transformToCredentialEntity = async (body: ICredentialReqBody): Pro
  * @param {IComponentCredentials} componentCredentials
  * @returns {ICredentialDataDecrypted}
  */
+const maskUrlPassword = (value: string): string | null => {
+    try {
+        const url = new URL(value)
+        if (!url.password) return null
+        url.password = 'FLOWISE_MASKED'
+        return url.toString().replace('FLOWISE_MASKED', '\u2022\u2022\u2022\u2022\u2022\u2022')
+    } catch {
+        return null
+    }
+}
+
 export const redactCredentialWithPasswordType = (
     componentCredentialName: string,
     decryptedCredentialObj: ICredentialDataDecrypted,
     componentCredentials: IComponentCredentials
 ): ICredentialDataDecrypted => {
     const plainDataObj = cloneDeep(decryptedCredentialObj)
     for (const cred in plainDataObj) {
-        const inputParam = componentCredentials[componentCredentialName].inputs?.find((inp) => inp.type === 'password' && inp.name === cred)
-        if (inputParam) {
+        const inputs = componentCredentials[componentCredentialName].inputs
+        const inputParam = inputs?.find((inp) => inp.name === cred && (inp.type === 'password' || inp.type === 'url'))
+        if (!inputParam) continue
+        if (inputParam.type === 'url') {
+            const maskedUrl = typeof plainDataObj[cred] === 'string' ? maskUrlPassword(plainDataObj[cred]) : null
+            // Only redact if there was actually a password to mask; otherwise keep URL as-is
+            if (maskedUrl !== null) {
+                plainDataObj[cred] = maskedUrl
+            }
+        } else {
             plainDataObj[cred] = REDACTED_CREDENTIAL_VALUE
         }
     }
diff --git a/packages/ui/src/api/credentials.js b/packages/ui/src/api/credentials.js
diff --git a/packages/ui/src/ui-component/input/Input.jsx b/packages/ui/src/ui-component/input/Input.jsx
diff --git a/packages/ui/src/ui-component/input/SensitiveInput.jsx b/packages/ui/src/ui-component/input/SensitiveInput.jsx
diff --git a/packages/ui/src/views/credentials/AddEditCredentialDialog.jsx b/packages/ui/src/views/credentials/AddEditCredentialDialog.jsx
diff --git a/packages/ui/src/views/credentials/CredentialInputHandler.jsx b/packages/ui/src/views/credentials/CredentialInputHandler.jsx
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml

Original file line number	Diff line number	Diff line change
`@@ -19,7 +19,7 @@ class AWSApi implements INodeCredential {`
`19`	`19`	`{`
`20`	`20`	`label: 'AWS Access Key',`
`21`	`21`	`name: 'awsKey',`
`22`		`- type: 'string',`
	`22`	`+ type: 'password',`
`23`	`23`	`placeholder: '<AWS_ACCESS_KEY_ID>',`
`24`	`24`	`description: 'The access key for your AWS account.',`
`25`	`25`	`optional: true`
Original file line number	Diff line number	Diff line change
`@@ -14,7 +14,7 @@ class BaiduQianfanApi implements INodeCredential {`
`14`	`14`	`{`
`15`	`15`	`label: 'Qianfan Access Key',`
`16`	`16`	`name: 'qianfanAccessKey',`
`17`		`- type: 'string'`
	`17`	`+ type: 'password'`
`18`	`18`	`},`
`19`	`19`	`{`
`20`	`20`	`label: 'Qianfan Secret Key',`
Original file line number	Diff line number	Diff line change
`@@ -15,7 +15,7 @@ class CouchbaseApi implements INodeCredential {`
`15`	`15`	`{`
`16`	`16`	`label: 'Couchbase Connection String',`
`17`	`17`	`name: 'connectionString',`
`18`		`- type: 'string'`
	`18`	`+ type: 'url'`
`19`	`19`	`},`
`20`	`20`	`{`
`21`	`21`	`label: 'Couchbase Username',`
Original file line number	Diff line number	Diff line change
`@@ -15,7 +15,7 @@ class MongoDBUrlApi implements INodeCredential {`
`15`	`15`	`{`
`16`	`16`	`label: 'ATLAS Connection URL',`
`17`	`17`	`name: 'mongoDBConnectUrl',`
`18`		`- type: 'string',`
	`18`	`+ type: 'url',`
`19`	`19`	`placeholder: 'mongodb+srv://<user>:<pwd>@cluster0.example.mongodb.net/?retryWrites=true&w=majority'`
`20`	`20`	`}`
`21`	`21`	`]`
Original file line number	Diff line number	Diff line change
`@@ -15,7 +15,7 @@ class OpenSearchUrl implements INodeCredential {`
`15`	`15`	`{`
`16`	`16`	`label: 'OpenSearch Url',`
`17`	`17`	`name: 'openSearchUrl',`
`18`		`- type: 'string'`
	`18`	`+ type: 'url'`
`19`	`19`	`},`
`20`	`20`	`{`
`21`	`21`	`label: 'User',`
Original file line number	Diff line number	Diff line change
`@@ -15,7 +15,7 @@ class PostgresUrl implements INodeCredential {`
`15`	`15`	`{`
`16`	`16`	`label: 'Postgres URL',`
`17`	`17`	`name: 'postgresUrl',`
`18`		`- type: 'string',`
	`18`	`+ type: 'url',`
`19`	`19`	`placeholder: 'postgresql://localhost/mydb'`
`20`	`20`	`}`
`21`	`21`	`]`
Original file line number	Diff line number	Diff line change
`@@ -15,7 +15,7 @@ class RedisCacheUrlApi implements INodeCredential {`
`15`	`15`	`{`
`16`	`16`	`label: 'Redis URL',`
`17`	`17`	`name: 'redisUrl',`
`18`		`- type: 'string',`
	`18`	`+ type: 'url',`
`19`	`19`	`default: 'redis://localhost:6379'`
`20`	`20`	`}`
`21`	`21`	`]`