[tang-vu]

Summary

Read the complete n8n workflow inventory before reporting installed workflows, resolving execution history, or removing an installed workflow. The current code reads only the first page, so a workflow beyond n8n's page boundary appears absent. Validate list envelopes before publishing rows, reject invalid/repeated cursors, and share one five-second deadline across pages.

Closes #7293. This is a current-main reconstruction of closed #3835, incorporating its coherent pagination and read-response validation scope. It preserves current import/activation behavior from #7744 and does not overlap open #7644's template changes.

AI Assistance

tang-vu and Codex collaborated: tang-vu supplied project direction, scope decisions and environment setup; Codex assisted with implementation reconstruction, analysis, tests and review preparation. Commands below were executed by Codex. Specific personal verification by the human contributor is not claimed here. Human review remains required.

Release Lane / Changed Surface

• Mainline change targeting main.

• Dashboard API read-only workflow inventory and existing consumers; medium risk.

• No state/schema migration. Reverting restores the old read behavior.

Risk And Validation

• Base: 5c8aeaf10b4108085bd8a8d70e87bf16ad70d4de.

• Candidate: 76232140f9df6687cd5c8848fb9fc89780b039a9.

• Ubuntu 24.04.5 / WSL2, Python 3.12.3, existing isolated test venv used read-only.

• Old-main replay of the 30-case loopback HTTP suite: 29 failed, one passed. One failure exercises the newly introduced deadline hook; the others exercise public endpoint behavior.

• Four focused suites: test_workflow_pagination.py, test_workflows.py, test_workflows_n8n_api_key.py, test_workflow_missing_dependencies.py: 93 passed.

• Ruff with repository error selection, diff whitespace check, commit identity gate: passed.

• Mypy 2.4.0 / Python 3.11 target on both changed files: no errors in the changed files; 26 existing errors in three imported files. This is a focused check, not the complete CI ratchet.

• Full API run was deliberately interrupted after 715 passes and one environment failure: test_pins_match_the_shipped_folders cannot use Linux git against a Windows-linked worktree whose .git pointer contains D:/.... The exact failing git ls-files command independently reproduced that path error. No full-suite pass is claimed.

• .github/workflows/dashboard.yml executes the entire API tests/ directory, including the new suite.

• Production image is Python 3.11 and uses the standard-library timeout context. Native Python 3.10 compatibility uses the already-declared conditional async-timeout requirement; this dependency is not newly introduced. Native 3.10 execution remains deferred.

• Current pinned n8n 2.41.6 list/controller and pagination source checked: the data/nextCursor contract and base64 offset cursor remain applicable. Sources: https://github.com/n8n-io/n8n/blob/n8n%402.41.6/packages/cli/src/public-api/v1/controllers/workflows.public.controller.ts and https://github.com/n8n-io/n8n/blob/n8n%402.41.6/packages/cli/src/public-api/v1/shared/services/pagination.service.ts.

Operational Validation / Limits

Controlled HTTP fixtures cover later-page matching and removal targeting, live key rotation, failed/malformed later pages, refusal to remove from partial inventory, malformed execution responses, repeated/invalid cursors, cancellation and session cleanup on the shared deadline. They do not establish installed browser/auth behavior or a live n8n 2.41.6 deployment. Historical #3835's live n8n 2.6.4 receipt is context only and was not rerun for this candidate. Full-product/model/fleet lanes remain deferred; the change is confined to reading provider inventory and decoding list responses. Dashboard exact-base validation is coordinated separately.

Why this matters

n8n paginates the workflow list. Workflows after the first page currently disappear from the installed inventory and cannot be resolved by its existing consumers. Returning only an early page also makes partial results look complete after a later-page failure. This change returns a complete validated inventory or the existing unavailable result, with explicit 502 refusal for invalid/repeated cursors.

Overlap check

All-state workflow/n8n/pagination semantic searches and the full current open-PR changed-file inventory found no active PR touching either changed file. Closed #3835 is reconstructed on current main; open #7644 changes workflow templates. The existing import/activation fixes in merged #7744 are retained.

Independent source review

Root independently inspected the complete production diff against current main: bounded total deadline, cursor progression/refusal, validation before row publication, authenticated requests, and discarding partial inventory on later-page failure. No blocking finding. Human release approval remains separate.

Combined batch validation (2026-10-21)

Exact PR head: 76232140f9df6687cd5c8848fb9fc89780b039a9. All ten independent scopes were combined on main 5c8aeaf10 in the published QA source. Only additive CI manifest/Windows-test-step conflicts needed resolution; all entries/steps were retained.

Agent-executed combined checks: 2,625 frontend tests (251 files), lint (zero errors) and build; 185 API/build-context tests; CLI HTTP and real-process lifecycle suites; native Windows voice/report/chat scenarios; shell/Python lint, CI inventory, platform smoke and installer simulation passed. All ten commit ranges passed Gitleaks 8.30.1.

Broader local runs are explicitly not all green: unmodified main's make gate has four CLI diagnostic-fixture failures in this isolated container. Combined Bats has two failures, both reproduced on exact main with the repo-pinned Bats helpers (WSL-kernel dispatch expectation and Docker fixture's missing helpers). These were not changed to fill this scope. Hosted CI is tracked on each exact head; installed/fleet and independent human release review remain separate from these source-QA results.

Integration audit repairs (2026-10-23)

Unavailable n8n inventory is now distinct from a complete empty inventory. The catalog remains visible on new installs without an API key, but reports n8nAvailable=false and n8nInventoryComplete=false after a failed page. Removal returns 503 rather than a false not-installed 404, and execution lookup reports an explicit inventory error. The 102 workflow tests cover first-install, empty, partial, malformed, deletion and recovery behavior. The branch also includes the shared Datasette security-pin and cloud-permission fixture repairs required by fresh CI.