feat: Build pinecone quick connect integration flow (#25854)

Author: dlavrenuek

packages/@n8n/api-types/src/quick-connect.ts

@@ -1,8 +1,18 @@
-export type QuickConnectOption = {
+type QuickConnectGenericOption = {
 	packageName: string;
 	credentialType: string;
 	text: string;
 	quickConnectType: string;
 	serviceName: string;
 	consentText?: string;
+	config?: never;
 };
+
+export type QuickConnectPineconeOption = Omit<QuickConnectGenericOption, 'config'> & {
+	quickConnectType: 'pinecone';
+	config: {
+		integrationId: string;
+	};
+};
+
+export type QuickConnectOption = QuickConnectGenericOption | QuickConnectPineconeOption;

packages/@n8n/config/src/configs/security.config.ts

@@ -1,5 +1,9 @@
+import z from 'zod';
+
 import { Config, Env } from '../decorators';
 
+const crossOriginOpenerPolicySchema = z.enum(['same-origin', 'same-origin-allow-popups']);
+
 @Config
 export class SecurityConfig {
 	/**
@@ -48,6 +52,12 @@ export class SecurityConfig {
 	@Env('N8N_CONTENT_SECURITY_POLICY_REPORT_ONLY')
 	contentSecurityPolicyReportOnly: boolean = false;
 
+	/**
+	 * Configuration for the `Cross-Origin-Opener-Policy` header.
+	 */
+	@Env('N8N_CROSS_ORIGIN_OPENER_POLICY', crossOriginOpenerPolicySchema)
+	crossOriginOpenerPolicy: z.infer<typeof crossOriginOpenerPolicySchema> = 'same-origin';
+
 	/**
 	 * Whether to disable HTML sandboxing for webhooks. The sandboxing mechanism uses CSP headers now,
 	 * but the name is kept for backwards compatibility.

packages/@n8n/config/test/config.test.ts

@@ -332,6 +332,7 @@ describe('GlobalConfig', () => {
 			daysAbandonedWorkflow: 90,
 			contentSecurityPolicy: '{}',
 			contentSecurityPolicyReportOnly: false,
+			crossOriginOpenerPolicy: 'same-origin',
 			disableWebhookHtmlSandboxing: false,
 			disableBareRepos: true,
 			awsSystemCredentialsAccess: false,
@@ -568,6 +569,24 @@ describe('GlobalConfig', () => {
 			expect(globalConfig.taskRunners.enabled).toEqual(true);
 			expect(globalConfig.database.type).toEqual('postgresdb');
 		});
+
+		it('should validate crossOriginOpenerPolicy enum values', () => {
+			process.env = {
+				N8N_CROSS_ORIGIN_OPENER_POLICY: 'same-origin-allow-popups',
+			};
+
+			const globalConfig = Container.get(GlobalConfig);
+			expect(globalConfig.security.crossOriginOpenerPolicy).toEqual('same-origin-allow-popups');
+		});
+
+		it('should warn and fall back to default for invalid crossOriginOpenerPolicy', () => {
+			process.env = {
+				N8N_CROSS_ORIGIN_OPENER_POLICY: 'invalid-policy',
+			};
+
+			const globalConfig = Container.get(GlobalConfig);
+			expect(globalConfig.security.crossOriginOpenerPolicy).toEqual('same-origin');
+		});
 	});
 
 	describe('health endpoint transformation', () => {

packages/cli/src/modules/quick-connect/__tests__/quick-connect.service.test.ts

@@ -41,18 +41,20 @@ describe('QuickConnectService', () => {
 		type: 'testCredentialType',
 	};
 
-	const createMockOption = (overrides: Partial<QuickConnectOption> = {}): QuickConnectOption => ({
-		packageName: '@n8n/test-package',
-		credentialType: 'testCredentialType',
-		text: 'Test Quick connect',
-		quickConnectType: 'backend',
-		serviceName: 'Test Service',
-		consentText: 'Allow access?',
-		backendFlowConfig: {
-			secret: 'test-secret',
-		},
-		...overrides,
-	});
+	const createMockOption = (overrides: Partial<QuickConnectOption> = {}): QuickConnectOption =>
+		// @ts-expect-error default values overrides for test scenario produce TS error
+		({
+			packageName: '@n8n/test-package',
+			credentialType: 'testCredentialType',
+			text: 'Test Quick connect',
+			quickConnectType: 'backend',
+			serviceName: 'Test Service',
+			consentText: 'Allow access?',
+			backendFlowConfig: {
+				secret: 'test-secret',
+			},
+			...overrides,
+		});
 
 	const createMockHandler = (
 		credentialType: string,

packages/cli/src/modules/quick-connect/quick-connect.config.ts

@@ -7,19 +7,32 @@ const backendFlowConfigSchema = z.object({
 
 export type BackendFlowConfig = z.infer<typeof backendFlowConfigSchema>;
 
-const quickConnectOptionSchema = z.object({
+const baseQuickConnectOptionSchema = z.object({
 	packageName: z.string(),
 	credentialType: z.string(),
 	text: z.string(),
 	quickConnectType: z.string(),
 	serviceName: z.string(),
 	consentText: z.string().optional(),
+	config: z.never().optional(),
 	backendFlowConfig: backendFlowConfigSchema.optional(),
 });
 
+const pineconeQuickConnectOptionSchema = baseQuickConnectOptionSchema.extend({
+	quickConnectType: z.literal('pinecone'),
+	config: z.object({
+		integrationId: z.string(),
+	}),
+});
+
+const quickConnectOptionSchema = z.union([
+	pineconeQuickConnectOptionSchema,
+	baseQuickConnectOptionSchema,
+]);
+
 export type QuickConnectOption = z.infer<typeof quickConnectOptionSchema>;
 
-const quickConnectBackendOptionSchema = quickConnectOptionSchema.required({
+const quickConnectBackendOptionSchema = baseQuickConnectOptionSchema.required({
 	backendFlowConfig: true,
 });
 

packages/cli/src/server.ts

@@ -366,6 +366,7 @@ export class Server extends AbstractServer {
 					errorMessage: 'The contentSecurityPolicy is not valid JSON.',
 				},
 			);
+			const crossOriginOpenerPolicy = Container.get(SecurityConfig).crossOriginOpenerPolicy;
 			const cspReportOnly = Container.get(SecurityConfig).contentSecurityPolicyReportOnly;
 			const securityHeadersMiddleware = helmet({
 				contentSecurityPolicy: isEmpty(cspDirectives)
@@ -393,6 +394,9 @@ export class Server extends AbstractServer {
 							preload: false,
 						}
 					: false,
+				crossOriginOpenerPolicy: {
+					policy: crossOriginOpenerPolicy,
+				},
 			});
 
 			// Route all UI urls to index.html to support history-api

packages/frontend/editor-ui/package.json

@@ -49,6 +49,7 @@
     "@n8n/rest-api-client": "workspace:*",
     "@n8n/stores": "workspace:*",
     "@n8n/utils": "workspace:*",
+    "@pinecone-database/connect": "0.0.4",
     "@replit/codemirror-indentation-markers": "^6.5.3",
     "@sentry/vue": "catalog:frontend",
     "@types/semver": "^7.7.0",