feat(core)!: Remove the "Any workflow" caller policy

Merged
RI
2mo ago
+155-156

Summary

Removes the any workflow caller policy ("This workflow can be called by → Any workflow") for v3. The option let a sub-workflow be called from any project on the instance, which bypasses project permissions.

  • 'any' is gone from the CallerPolicy type, the N8N_WORKFLOW_CALLER_POLICY_DEFAULT_OPTION config enum, the public API DTO/spec, the MCP workflow-builder schema, and the workflow settings dropdown (including the deprecation notice from #36350).
  • A workflow that still stores callerPolicy: 'any' (or any unknown value) fails when called. Every caller is denied until the owner opens the workflow settings and saves a supported policy. This matches what the v2 migration report tells users: pick a new policy, or the sub-workflow calls fail. The settings dialog preselects the instance default so saving is the one-step fix.
  • The callable-workflows picker no longer offers cross-project workflows that store any. Same-project workflows stay listed because the picker unions readable and callable workflows.
  • N8N_WORKFLOW_CALLER_POLICY_DEFAULT_OPTION=any logs a startup warning and falls back to the default (workflowsFromSameOwner); an unset workflow policy keeps inheriting the instance default as before.
  • Public API writes of settings.callerPolicy: 'any' return 400. Reads of workflows still storing the value keep working (express-openapi-validator runs with validateRequests only).
  • The v2 migration-report rules (caller-policy-any-removed-v3, caller-policy-default-any-v3) are untouched and remain the user-facing migration path.
  • Adds the 3.0.0 entry to packages/cli/BREAKING-CHANGES.md.

How to test

  1. Open workflow settings: the "This workflow can be called by" dropdown no longer offers "Any workflow". A workflow that stored any opens with the instance default selected; saving persists it.
  2. Execute a sub-workflow that stores callerPolicy: 'any': the call is denied from every caller, including the same project. After saving a supported policy in its settings, the call works again per that policy.
  3. PUT /api/v1/workflows/:id with settings.callerPolicy: 'any': 400.
  4. Start n8n with N8N_WORKFLOW_CALLER_POLICY_DEFAULT_OPTION=any: startup warning, default falls back to workflowsFromSameOwner.
  5. Unit + integration coverage: subworkflow-policy-checker, config fallback, WorkflowSettings, and the callable-workflows picker integration tests.

Related Linear tickets, Github issues, and Community forum posts

https://linear.app/n8n/issue/ADO-4923

Review / Merge checklist

  • PR title and summary are descriptive.
  • PR targets 3.x, branched off master per .github/DEVELOPING_V3.md.
  • Tests included.