- Update tests to accept dynamic UID range (10000-59999) instead of hardcoded 1001
- Enhance lock file creation with permission error handling and graceful fallback
- Fix database initialization test to handle different container UIDs
- Add proper error recovery when lock file creation fails
- Improve test robustness with better permission management for mounted volumes
These changes ensure tests pass in CI environments while maintaining the security
benefits of dynamic UID generation.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Alpine's BusyBox ps shows numeric UIDs for non-system users
- The ps output was showing '1' (truncated from UID 1001) instead of 'nodejs'
- Modified tests to accept multiple possible values: 'nodejs', '1001', or '1'
- Added verification that nodejs user has the expected UID 1001
- This ensures tests work reliably in both local and CI environments
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
The test was incorrectly using 'docker exec id -u' which always returns
the container's original user context, not the user that the entrypoint
switched to.
Key insights:
- docker exec creates NEW processes with the container's user context
- When container starts with --user root, docker exec runs as root
- The entrypoint correctly switches the MAIN process to nodejs user
- We need to check the actual n8n-mcp process, not docker exec sessions
Changes:
- Check the actual n8n-mcp process user via ps aux
- Parse the process owner from the ps output
- Added demonstration test showing docker exec vs main process users
- Added clear comments explaining this Docker behavior
This correctly verifies that the entrypoint switches the main application
process to the nodejs user for security, which is what actually matters.
The test 'should switch to nodejs user when running as root' was failing because:
- Alpine Linux's ps command shows numeric UIDs (1) instead of usernames (nodejs)
- Parsing ps output is unreliable across different environments
Fixed by:
- Using 'id -u' to check the numeric UID directly (expects 1001 for nodejs user)
- Adding functional test to verify write permissions to /app directory
- This approach is environment-agnostic and more reliable than parsing ps output
The test now properly verifies that the container switches from root to nodejs user.
Fixed 2 remaining test failures:
1. NODE_DB_PATH environment variable test:
- Issue: Null byte handling error in shell command
- Fix: Use existing getProcessEnv helper function that properly escapes null bytes
- This helper was already designed for reading /proc/*/environ files
2. User switching test:
- Issue: Test checked PID 1 (su process) instead of actual node process
- Fix: Find and check the node process owner, not the su wrapper
- When using --user root, entrypoint uses 'su' to switch to nodejs user
- The su process (PID 1) runs as root but spawns node as nodejs
Also increased timeouts to 3s for better CI stability.
Root cause analysis and fixes:
1. **MCP_MODE environment variable tests**
- Issue: Tests were checking env vars after exec process replacement
- Fix: Test actual HTTP server behavior instead of env vars
- Changed tests to verify health endpoint responds in HTTP mode
2. **NODE_DB_PATH configuration tests**
- Issue: Tests expected env var output but got initialization logs
- Fix: Check process environment via /proc/1/environ
- Added proper async handling for container startup
3. **Permission handling tests**
- Issue: BusyBox sleep syntax and timing race conditions
- Fix: Use detached containers with proper wait times
- Check permissions after entrypoint completes
4. **Implementation improvements**
- Export NODE_DB_PATH in entrypoint for visibility
- Preserve env vars when switching to nodejs user
- Add debug output option in n8n-mcp wrapper
- Handle NODE_DB_PATH case preservation in parse-config.js
5. **Test infrastructure**
- Created test-helpers.ts with proper async utilities
- Use health checks instead of arbitrary sleep times
- Test actual functionality rather than implementation details
These changes ensure tests verify the actual behavior (server running,
health endpoint responding) rather than checking internal implementation
details that aren't accessible after process replacement.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix 'n8n-mcp serve' test to properly check MCP_MODE environment variable
- Use writable path (/app/data) for NODE_DB_PATH test instead of /custom
- Replace netstat check with environment variable check (netstat not available in Alpine)
- Increase sleep time to ensure processes are fully started before checking
These changes ensure tests work consistently in both local and CI environments.
- Add Docker image build step in beforeAll hook for CI environments
- Fix 'n8n-mcp serve' test to check process and port instead of env vars
- Update NODE_DB_PATH test to check environment variable instead of stdout
- Fix permission tests to handle async user switching correctly
- Add proper timeouts for container startup operations
- Ensure tests work both locally and in CI environment
Security Fixes:
- Add command injection prevention in n8n-mcp wrapper with whitelist validation
- Fix race condition in database initialization with proper lock directory creation
- Add flock availability check with fallback behavior
- Implement comprehensive input sanitization in parse-config.js
Improvements:
- Add debug logging support to parse-config.js (DEBUG_CONFIG=true)
- Improve test cleanup error handling with proper error tracking
- Increase integration test timeouts for CI compatibility
- Update test assertions to check environment variables instead of processes
All critical security vulnerabilities identified by code review have been addressed.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
This commit adds comprehensive support for JSON configuration files in Docker containers,
addressing the issue where the Docker image fails to start in server mode and ignores
configuration files.
## Changes
### Docker Configuration Support
- Added parse-config.js to safely parse JSON configs and export as shell variables
- Implemented secure shell quoting to prevent command injection
- Added dangerous environment variable blocking for security
- Support for all JSON data types with proper edge case handling
### Docker Server Mode Fix
- Added support for "n8n-mcp serve" command in entrypoint
- Properly transforms serve command to HTTP mode
- Fixed missing n8n-mcp binary issue in Docker image
### Security Enhancements
- POSIX-compliant shell quoting without eval
- Blocked dangerous variables (PATH, LD_PRELOAD, etc.)
- Sanitized configuration keys to prevent invalid shell variables
- Protection against shell metacharacters in values
### Testing
- Added 53 comprehensive tests for Docker configuration
- Unit tests for parsing, security, and edge cases
- Integration tests for Docker entrypoint behavior
- Security-focused tests for injection prevention
### Documentation
- Updated Docker README with config file mounting examples
- Enhanced troubleshooting guide with config file issues
- Added version bump to 2.8.2
### Additional Files
- Included deployment-engineer and technical-researcher agent files
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
