feat(core): Split share and unshare into separate scopes

[everettbu]

Mirror of n8n-io/n8n#26011
Original author: afitzek

---

Summary

Splits the single workflow:share / credential:share scope into separate share and unshare scopes (workflow:unshare, credential:unshare). This ensures users can remove existing shares even when the personal space sharing setting (security.personalSpaceSharing) is disabled.

Previously, disabling personal space sharing removed the share scope from the project:personalOwner role, which also prevented unsharing existing resources. Now, the unshare scopes remain in the project:personalOwner base definition regardless of the sharing setting.

Changes:

• Add workflow:unshare and credential:unshare to the scope registry and all role definitions that have the corresponding share scope
• Add unshare scopes to PERSONAL_PROJECT_OWNER_SCOPES base definition (not behind the sharing setting toggle)
• Modify the PUT /workflows/:id/share endpoint to check workflow:share for adding shares and workflow:unshare for removing shares
• Modify the PUT /credentials/:id/share endpoint to check credential:share for adding shares and credential:unshare for removing shares
• Add database migration to grant unshare scopes to existing custom roles that have the corresponding share scope

How to test:

1. Create a custom role with workflow:share scope — verify it also gets workflow:unshare after migration
2. Disable personal space sharing setting — verify a personal project owner can still remove existing workflow/credential shares but cannot add new ones
3. Enable personal space sharing setting — verify both sharing and unsharing work

Related Linear tickets, Github issues, and Community forum posts

https://linear.app/n8n/issue/IAM-274/split-share-and-unshare-scope

Review / Merge checklist

• PR title and summary are descriptive. (conventions)
• Docs updated or follow-up ticket created.
• Tests included.

[everettbu]

Upstream PR was closed or merged. Code is synced via branch mirror.