Authorization — n8n custom node

Replaces Access Edit + Authorization (Microsoft SQL) + If Authorization with one
node and two outputs. This is an npm package for self-hosted n8n instances, not a
Code node snippet. Plain CommonJS source is shipped in dist; no TypeScript build
is needed.

Install

Extract the ZIP. Copy its n8n-nodes-somepharm-authorization-1.0.2.tgz to the n8n server/container
(for example, /tmp/n8n-nodes-somepharm-authorization-1.0.2.tgz). Run as the operating-system user
that runs n8n, using the actual n8n user directory if different:

mkdir -p ~/.n8n/nodes
cd ~/.n8n/nodes
npm install /tmp/n8n-nodes-somepharm-authorization-1.0.2.tgz --omit=dev

Restart n8n and search for Authorization. Dependencies require npm
registry access at installation. Community nodes must be enabled by the instance
administrator. This package requires Node.js 20+; also meet your n8n version's
own Node.js requirement.

For Docker/Kubernetes, the usual directory is /home/node/.n8n/nodes for the
node user. Install into persistent storage or provision the package during
your deployment; an installation into a pod's temporary filesystem disappears
when that pod is replaced. Ensure every n8n instance that loads or executes the
workflow (including workers) has the same package. Do not install it in task
runner containers. No deployment changes have been made for you.

Configure your replacement

The default user expression is $json.REF_USER. For your supplied workflow,
change it to the Authentication expression above or paste the example node from
examples/replacement-node.json after installing the package. Re-select Dev
if the credential reference does not resolve on a different instance. That file
contains a credential reference, no password. The Authentication node must have
executed and have valid item linking to the input. Only use .first() instead
of .item if all input items intentionally share one authenticated identity.

Connect the predecessor of Access Edit to this node. Connect output 0
(Authorized) to the old IF true branch; connect output 1 (Denied) to its
false branch. Then remove the three old nodes.

Use a trusted Authentication result for REF_USER, and configure company/table/
access from trusted workflow settings. The node checks authorization only; it
does not authenticate an arbitrary REF_USER supplied by an end user. Keep
Settings > On Error = Stop Workflow and Always Output Data = off so an
execution failure or empty branch cannot enter the protected operation.

Behavior

• Root administrators (ROOT_ADMIN = 'OUI') are authorized.
• Administrators of the requested company are authorized.
• Otherwise the user's company, table, selector and selected permission must match.
• One access code per check: 1 consultation, 2 validation, 4 ajout, 8 modification,
  16 suppression. Combined masks such as 9 are rejected, not interpreted as flags.
• Authorized items have numeric D_Result: 1 and authorized: true.
• Denied items have numeric D_Result: 0 and authorized: false.
• Incoming JSON and binary data are retained. Existing D_Result/authorized fields
  are replaced. Each item links back to its original input index.
• Missing/invalid parameters, SQL errors and malformed SQL responses throw errors.
  A database outage is not an authorization denial or an authorization grant.
• Parameters use varchar(50) and smallint, matching the supplied SQL. Strings
  longer than 50 characters are rejected rather than truncated. The permissions
  database name is fixed as DROITSMK_LA in the source.
• Queries are parameterized. No input value is interpolated into SQL text.
• One execution-local connection pool; one read-only SQL query per input item.
  The pool closes after execution. Credential timeouts, TLS, port and domain are
  honored. The SQL account needs SELECT access to the referenced tables/view.
• Company admin/root behavior matches the supplied rules for valid inputs. No
  extra active-user, expiry, or deny-override policy is introduced.

Develop and test

npm ci
npm test
python3 test/permissions.py
npm pack

Tests cover output routing, item pairing, binary preservation, bound parameters,
invalid inputs, database failures, credential mapping, and permission rules.
The permission matrix uses SQLite with only the database qualifiers removed;
it verifies relational logic, not SQL Server connectivity or its collation.

Validated locally with Node.js 24, n8n-workflow 2.16.0 and mssql 12.7.2. A live
n8n editor/loader and your SQL Server were not available. Verify in your Dev
instance with a root admin, company admin, authorized user and denied user before
connecting the node to a production operation.

References

• n8n Microsoft SQL credential definition:
  https://github.com/n8n-io/n8n/blob/master/packages/nodes-base/credentials/MicrosoftSql.credentials.ts
• SQL driver's parameters, pooling and configuration:
  https://github.com/tediousjs/node-mssql