chore(editor): Gate personal space policy settings behind license feature (#25527)

Author: afitzek

packages/@n8n/api-types/src/frontend-settings.ts

@@ -60,6 +60,7 @@ export interface IEnterpriseSettings {
 		};
 	};
 	customRoles: boolean;
+	personalSpacePolicy: boolean;
 }
 
 export interface FrontendSettings {

packages/@n8n/backend-common/src/license-state.ts

@@ -62,6 +62,10 @@ export class LicenseState {
 		return this.isLicensed(LICENSE_FEATURES.DYNAMIC_CREDENTIALS);
 	}
 
+	isPersonalSpacePolicyLicensed() {
+		return this.isLicensed(LICENSE_FEATURES.PERSONAL_SPACE_POLICY);
+	}
+
 	isSharingLicensed() {
 		return this.isLicensed('feat:sharing');
 	}

packages/@n8n/constants/src/index.ts

@@ -40,6 +40,7 @@ export const LICENSE_FEATURES = {
 	CUSTOM_ROLES: 'feat:customRoles',
 	AI_BUILDER: 'feat:aiBuilder',
 	DYNAMIC_CREDENTIALS: 'feat:dynamicCredentials',
+	PERSONAL_SPACE_POLICY: 'feat:personalSpacePolicy',
 } as const;
 
 export const LICENSE_QUOTAS = {

packages/cli/src/controllers/e2e.controller.ts

@@ -122,6 +122,7 @@ export class E2EController {
 		[LICENSE_FEATURES.NAMED_VERSIONS]: false,
 		[LICENSE_FEATURES.CUSTOM_ROLES]: false,
 		[LICENSE_FEATURES.AI_BUILDER]: false,
+		[LICENSE_FEATURES.PERSONAL_SPACE_POLICY]: false,
 	};
 
 	private static readonly numericFeaturesDefaults: Record<NumericLicenseFeature, number> = {

packages/cli/src/controllers/security-settings.controller.ts

@@ -1,6 +1,6 @@
 import { UpdateSecuritySettingsDto } from '@n8n/api-types';
 import { type AuthenticatedRequest } from '@n8n/db';
-import { Body, Get, GlobalScope, Post, RestController } from '@n8n/decorators';
+import { Body, Get, GlobalScope, Licensed, Post, RestController } from '@n8n/decorators';
 import {
 	PERSONAL_SPACE_PUBLISHING_SETTING,
 	PERSONAL_SPACE_SHARING_SETTING,
@@ -17,6 +17,7 @@ export class SecuritySettingsController {
 		private readonly eventService: EventService,
 	) {}
 
+	@Licensed('feat:personalSpacePolicy')
 	@GlobalScope('securitySettings:manage')
 	@Get('/')
 	async getSecuritySettings(_req: AuthenticatedRequest, _res: Response) {
@@ -39,6 +40,7 @@ export class SecuritySettingsController {
 		};
 	}
 
+	@Licensed('feat:personalSpacePolicy')
 	@GlobalScope('securitySettings:manage')
 	@Post('/')
 	async updateSecuritySettings(

packages/cli/src/services/frontend.service.ts

@@ -318,6 +318,7 @@ export class FrontendService {
 					},
 				},
 				customRoles: false,
+				personalSpacePolicy: false,
 			},
 			mfa: {
 				enabled: false,
@@ -460,6 +461,7 @@ export class FrontendService {
 			workflowDiffs: this.licenseState.isWorkflowDiffsLicensed(),
 			namedVersions: this.license.isLicensed(LICENSE_FEATURES.NAMED_VERSIONS),
 			customRoles: this.licenseState.isCustomRolesLicensed(),
+			personalSpacePolicy: this.licenseState.isPersonalSpacePolicyLicensed(),
 		});
 
 		if (this.license.isLdapEnabled()) {

packages/cli/test/integration/controllers/security-settings.controller.test.ts

@@ -23,9 +23,15 @@ describe('SecuritySettingsController', () => {
 
 	beforeEach(() => {
 		jest.clearAllMocks();
+		testServer.license.enable('feat:personalSpacePolicy');
 	});
 
 	describe('GET /settings/security', () => {
+		it('should return 403 when personalSpacePolicy license is not active', async () => {
+			testServer.license.disable('feat:personalSpacePolicy');
+			await ownerAgent.get('/settings/security').expect(403);
+		});
+
 		it('should return security settings and all counts', async () => {
 			securitySettingsService.arePersonalSpaceSettingsEnabled.mockResolvedValue({
 				personalSpacePublishing: true,
@@ -78,6 +84,14 @@ describe('SecuritySettingsController', () => {
 	});
 
 	describe('POST /settings/security', () => {
+		it('should return 403 when personalSpacePolicy license is not active', async () => {
+			testServer.license.disable('feat:personalSpacePolicy');
+			await ownerAgent
+				.post('/settings/security')
+				.send({ personalSpacePublishing: true })
+				.expect(403);
+		});
+
 		it('should update only personalSpacePublishing when only that is set in body', async () => {
 			securitySettingsService.setPersonalSpaceSetting.mockResolvedValue(undefined);
 

packages/frontend/@n8n/i18n/src/locales/en.json

@@ -3995,6 +3995,8 @@
 	"settings.security.personalSpace.sharing.confirmMessage.disable.message": "This will prevent sharing workflows and credentials from personal spaces going forwards. Existing shares will remain in place.",
 	"settings.security.personalSpace.sharing.existingCount.label": "Existing shares",
 	"settings.security.personalSpace.sharing.existingCount.value": "{workflowCount} workflows, {credentialCount} credentials",
+	"settings.security.personalSpace.unlicensed_tooltip": "Upgrade to a plan that includes personal space policies to manage this setting. {action}",
+	"settings.security.personalSpace.unlicensed_tooltip.link": "Upgrade now",
 	"settings.sso": "SSO",
 	"settings.sso.title": "Single Sign On",
 	"settings.sso.subtitle": "SAML 2.0 Configuration",

packages/frontend/editor-ui/src/Interface.ts

@@ -949,6 +949,7 @@ export type EnterpriseEditionFeatureKey =
 	| 'EnforceMFA'
 	| 'NamedVersions'
 	| 'Provisioning'
+	| 'PersonalSpacePolicy'
 	| 'CustomRoles';
 
 export type EnterpriseEditionFeatureValue = keyof Omit<FrontendSettings['enterprise'], 'projects'>;

packages/frontend/editor-ui/src/__tests__/defaults.ts

@@ -51,6 +51,7 @@ export const defaultSettings: FrontendSettings = {
 			},
 		},
 		customRoles: false,
+		personalSpacePolicy: false,
 	},
 	executionMode: 'regular',
 	isMultiMain: false,