Feature/change token

[ivanovahr]

Make webhook authentication configurable

Previously the plugin forwarded X-N8N-API-KEY on every outbound webhook call. This was semantically wrong — X-N8N-API-KEY is an n8n REST API credential, not a webhook credential — and it hardcoded the header name, preventing workflows from using their own auth configuration.

What changed

Webhook auth is now opt-in and configured via n8n.webhook-auth.*:

n8n:
  webhook-auth:
    type: header        # basic | header | bearer
    name: X-My-Header  # for type=header
    value: ${N8N_WEBHOOK_TOKEN}

The three supported types mirror n8n's Webhook node auth options:

type	Required fields	Header sent
basic	username, password	Authorization: Basic base64(username:password)
header	name, value	<name>: <value>
bearer	token	Authorization: Bearer <token>

When n8n.webhook-auth is absent, webhook calls are sent without authentication.

n8n.api-key is kept in the config model for future REST API (/api/v1/…) use but is no longer forwarded to webhook nodes.

BTP destination path is unchanged in behaviour: destination headers are forwarded (minus X-N8N-API-KEY), with n8n.webhook-auth merged on top.

Files changed

• N8nWebhookService — removed apiKey field; constructor now takes Map<String, String> authHeaders
• N8nAutoConfiguration — added WebhookAuth nested config class and resolveWebhookAuthHeaders() static helper; updated both bean factories (n8nWebhookService and n8nWebhookServiceFromDestination)
• ConsoleN8NWebhookService — updated super(...) call to match new constructor
• N8nAutoConfigurationTest — 9 new tests covering all auth types, missing-field errors, and unsupported type
• N8nWebhookServiceRetryIT — updated constructor call
• Integration tests — removed n8n.api-key config and all X-N8N-API-KEY header assertions
• samples/bookshop/application.yaml — added commented-out webhook-auth example
• docs/adr-webhook-authentication.md — updated to V0.2; documents new decision, preserves V0.1 history

Test plan

• mvn verify passes (165 unit + 19 integration tests)
• No X-N8N-API-KEY header is sent to a webhook node in any code path
• type=basic sends correct Base64-encoded Authorization: Basic header
• type=header sends the configured custom header name and value
• type=bearer sends Authorization: Bearer <token>
• Missing required fields (e.g. basic without password) throw IllegalStateException at startup
• Omitting n8n.webhook-auth entirely sends no auth header

[hyperspace-pr-bot]

👋 Hi — I'm PR Bot, your SAP code review assistant.

I'll automatically review your pull requests for code quality, security, and SAP compliance. Get an overview of what I do →

What I do

• Summarize your pull request changes
• Review code for quality, correctness, and reliability
• Suggest fixes when a pipeline job fails

Key commands

Command	Description
/review [--all]	Trigger a code review. Add --all to include files excluded by excluded_paths.
/summarize	Generate a PR summary
/ask <question>	Ask about the current changes
/help	See all available commands

*This introduction message will be shown to you only once, you will not see it in future PRs.

[hyperspace-pr-bot]

Summary

The following content is AI-generated and provides a summary of the pull request:

---

Make n8n Webhook Authentication Configurable

New Features

✨ Adds opt-in, configurable webhook authentication via n8n.webhook-auth.*, supporting basic, header, and bearer auth types aligned with n8n Webhook node options.

This also fixes the previous behavior of forwarding X-N8N-API-KEY to webhook nodes. n8n.api-key remains in the configuration model for future n8n REST API usage, but is no longer sent with webhook calls.

Changes

• N8nAutoConfiguration.java: Added WebhookAuth configuration binding and resolveWebhookAuthHeaders() helper. Updated direct and BTP destination webhook service creation to use resolved webhook auth headers.
• N8nWebhookService.java: Removed API key handling and simplified construction to rely only on configured auth headers.
• ConsoleN8NWebhookService.java: Updated superclass constructor usage after removing the API key parameter.
• N8nAutoConfigurationTest.java: Added coverage for missing auth, Basic Auth, Header Auth, Bearer Auth, validation errors, unsupported auth types, and destination header behavior.
• N8nWebhookServiceRetryIT.java: Updated test service construction for the new constructor signature.
• Integration tests: Removed n8n.api-key setup and assertions expecting X-N8N-API-KEY on webhook requests.
• integration-tests/srv/src/main/resources/application.yaml: Removed test API key configuration for webhook calls.
• samples/bookshop/srv/src/main/resources/application.yaml: Added commented webhook-auth configuration examples.
• docs/adr-webhook-authentication.md: Updated ADR to V0.2 documenting the move from fixed X-N8N-API-KEY forwarding to configurable webhook authentication.

---

• 🔄 Regenerate and Update Summary
• ✏️ Insert as PR Description (deletes this comment)
• 🗑️ Delete comment

PR Bot Information

Version: 1.31.51

• Summary Prompt: Default Prompt
• Output Template: Default Template
• File Content Strategy: Full file content
• LLM: gpt-5.5
• Correlation ID: 832519e0-b82a-11f1-8654-3d6a5570a176
• Event Trigger: pull_request.opened

[hyperspace-pr-bot]

⚠️ The bot could not produce a final review summary. The model's context window may be full, or an unexpected error may have occurred.

We are aware of this problem and are working to improve it. Try /review+ to use the beta review engine. Try to limit the pull request's size.

PR Bot Information

Version: 1.31.51

• LLM: gpt-5.5
• File Content Strategy: Full file content
• Correlation ID: 832519e0-b82a-11f1-8654-3d6a5570a176
• Event Trigger: pull_request.opened

[hyperspace-pr-bot]

Bug: Blank webhook auth values are accepted

The resolver only treats null as missing, so common optional placeholders like ${N8N_WEBHOOK_TOKEN:} bind to empty strings and produce invalid auth headers instead of failing at startup. Consider normalizing type and rejecting blank required fields (username, password, name, value, token) with isBlank() before constructing headers.

Suggested change

	if (auth == null || auth.getType() == null) return Collections.emptyMap();
	if (auth == null || auth.getType() == null || auth.getType().isBlank()) return Collections.emptyMap();

Double-check suggestion before committing. Edit this comment for amendments.

---

Please provide feedback on the review comment by checking the appropriate box:

• 🌟 Awesome comment, a human might have missed that.
• ✅ Helpful comment
• 🤷 Neutral
• ❌ This comment is not helpful