@app4you/n8n-nodes-portal-invoices

Read-only n8n community node for downloading purchase-invoice PDFs from vendor billing
portals when the document is missing from email, Drive, or KSeF.

This package is the deterministic portal collector for suppliers not covered by
structured sources. In production, run KSeF and email/Drive ingestion first, then
enable a portal only for suppliers that remain uncovered. Deduplicate the returned
sha256 and externalId before uploading a PDF.

The node is deliberately narrower than a general browser agent:

• it can navigate only to an allowlisted portal/authentication host;
• it never clicks actions labelled as payment, purchase, subscription change, refund,
  cancellation, or deletion;
• it returns only valid PDF files (magic-byte checked, maximum 25 MB);
• it never emits a password, TOTP secret, cookie, complete source URL, screenshot, or
  page body into workflow data;
• session cookies and local storage are encrypted at rest with AES-256-GCM;
• passkey, CAPTCHA, hardware-key, and missing-2FA challenges stop with
  AUTH_INTERACTION_REQUIRED.

The Rozpoznaj układ (bez pobierania) operation can be used while maintaining an
adapter. It returns only route templates, query-key names, and action categories.
It never returns page text, document identifiers, query values, or credentials.

Configured portals

Stripe, Uber Business, Mistral, Domeny.tv, Cursor, Claude.ai, Installatron, Anthropic
Console, OpenAI API, ChatGPT subscriptions, Google Workspace, Qboxmail, CloudLinux, DirectAdmin, Canva, and
Vercel.

Being present in the registry does not mean that an adapter is production-ready.
An adapter is enabled only after a manual run has reached the vendor's invoice
history and downloaded a representative PDF. Until then the node returns
PORTAL_NOT_VERIFIED instead of incorrectly reporting no_documents.

If a supplier already delivers complete invoices through KSeF, leave its portal
node disabled and do not create a persistent login credential for it.

The DirectAdmin PDF route is verified against a real invoice PDF and the explicit
zero-invoice counter, but password login remains disabled because the portal uses
invisible reCAPTCHA v3. Canva has a fail-closed Purchase history → invoice detail →
print-to-PDF route prepared; it remains disabled until an authenticated n8n run
produces a representative valid PDF. The remaining configured portals stay disabled
until the same evidence is collected for each of them.

ChatGPT subscription invoices use a separately verified, read-only adapter. It opens
Settings → Account → Manage payment and downloads only Stripe-hosted invoice PDFs.
The adapter actively opens the profile menu and Account settings before looking for
the payment action; it also distinguishes an expired/interactive login, a free account,
and an unexpected portal layout instead of reporting all three as a missing invoice.
The default authentication mode is saved session only: the node never automates
passkeys or CAPTCHA. When the saved session expires it returns
AUTH_INTERACTION_REQUIRED once to the workflow, which should alert an operator and
stop retrying until the session is refreshed.

For passkey-protected accounts, the preferred unattended mode is Pobierz podpisaną
fakturę ChatGPT. Feed it the official https://invoice.stripe.com/i/.../... link
extracted from a billing email. The operation downloads exactly one Stripe-hosted
PDF without opening the ChatGPT account or billing portal. It accepts only the exact
invoice.stripe.com route and first uses Stripe's read-only PDF metadata endpoint.
If Stripe returns the hosted HTML invoice instead, it clicks only the exact
Pobierz fakturę / Download invoice action (never the receipt action), follows
only allowlisted Stripe storage hosts, validates the PDF, and returns a SHA-256
source hash instead of the signed URL.

The older official https://pay.openai.com/p/session/... or
https://pay.openai.com/p/session?secret=... mode remains available for interactive
backfill, but its session URL expires and must not be used by a recurring workflow.
The signed values are treated as credentials and must be passed through encrypted
n8n credentials or item data, never logs or Sheets.

Each portal can use one of four authentication strategies:

• login and password;
• Google SSO;
• GitHub SSO;
• saved session only.

Portal layouts change. An adapter failure is isolated to that portal and produces a
sanitized error code; it does not expose account contents or credentials.

IMAP backfill

The package also contains IMAP Backfill — tylko odczyt for transaction-email
mailboxes whose long-lived IMAP trigger may temporarily disconnect. Put it after a
Schedule Trigger and before the same parser used by the live email trigger.

The node:

• reuses n8n's encrypted built-in IMAP credential;
• requires SSL/TLS;
• reads a configurable overlapping time window without marking, deleting, or moving
  messages;
• does not download attachments and emits only the minimal fields needed by the
  transaction parser;
• stores only one-way message hashes in workflow static data, so an overlapping
  nightly window does not re-emit the same messages after a successful run;
• fails closed instead of silently truncating a mailbox that exceeds the configured
  message limit.

Downstream storage must use a stable transaction fingerprint as its matching key.
This makes repeated catch-up runs idempotent.

Installation

Install @app4you/n8n-nodes-portal-invoices in Settings → Community nodes.

The default Dołączony Chromium (Bezpłatny) mode ships a compatible headless
Chromium with the node. It needs no root access, external browser service, API key,
or per-session fee.

For a custom host installation, configure an absolute path through
PORTAL_INVOICES_CHROMIUM_PATH, for example:

PORTAL_INVOICES_CHROMIUM_PATH=/usr/bin/chromium

A private HTTPS/WSS or loopback-only CDP endpoint remains available for operators
who deliberately choose it; the node never switches connection modes automatically.

Credentials

Create one or more Portal faktur — bezpieczne logowanie credentials. Passwords
and TOTP secrets are encrypted by n8n. The Klucz szyfrowania sesji is an
independent random secret of at least 16 characters and encrypts the persisted
browser state.

For ChatGPT, create a separate credential per paid account and paste its UUID from
the official chatgpt.com/account/manage?account_id=... link into ChatGPT Account
ID. This prevents a saved browser session with multiple profiles from opening the
wrong billing history.

Never put credentials into node expressions, workflow JSON, Sheets, screenshots,
Sentry, environment-variable values committed to Git, or test fixtures.

Output contract

One n8n item per PDF:

• JSON: status, source, portal, portalName, externalId, fileName,
  sha256, sourceUrlHash, collectedAt;
• binary: document (application/pdf).

sourceUrlHash is a SHA-256 hash, not the private billing URL. The node may emit
status=no_documents only when a verified adapter recognizes the portal's explicit
empty state. With Continue On Fail, failures emit only the portal name plus a
sanitized error code and message.

Development

pnpm install
pnpm lint
pnpm typecheck
pnpm test
pnpm build

The package intentionally uses deterministic Playwright code rather than an LLM
browser agent. This keeps credentials out of prompts and makes every clickable
action auditable.