fix(core): Resolve managed OAuth endpoint fields from the credential type (no-changelog)

[afitzek]

Summary

For managed OAuth credentials — where the instance supplies the OAuth client
through credential overwrites — the OAuth endpoint and flow fields now resolve
from the credential type definition instead of the stored credential data.

Key implementation decisions

• Resolve-time rather than save-time: this also corrects credentials whose
  stored data was already set, with no data migration.
• The values are read directly onto the resolved object, mirroring the existing
  dynamic-client-registration branch, so it does not depend on the defaults
  pass keeping hidden fields.

Related

• Linear: https://linear.app/n8n/issue/IAM-1222

Review / Merge checklist

• I have seen this code, I have run this code, and I take responsibility for this code.
• PR title and summary are descriptive. (conventions)
• Docs updated or follow-up ticket created.
• Tests included.
• PR Labeled with Backport to Beta, Backport to Stable, or Backport to v1 (if the PR is an urgent fix that needs to be backported)

[n8n-assistant]

PR review overview

Based on ownership of the 3 changed files in this PR:

Ownership	Files owned	Share	Source code	Test files	Misc
@n8n-io/catalysts	2	67%	+17 / -1	+215 / -0	+0 / -0
@n8n-io/iam	1	33%	+10 / -0	+0 / -0	+0 / -0
Total	3	100%	+27 / -1	+215 / -0	+0 / -0

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[cubic-dev-ai]

1 issue found across 3 files

Prompt for AI agents (unresolved issues)

Architecture diagram

sequenceDiagram
    participant W as Workflow Executor
    participant CH as CredentialsHelper
    participant CO as CredentialsOverwrites
    participant CT as CredentialTypes
    participant DB as Credentials Repository

    Note over W,DB: Runtime Credential Resolution Flow

    W->>CH: getDecrypted(credentialId)
    CH->>DB: Fetch encrypted credential data
    DB-->>CH: Data (JSON)
    CH->>CH: Decrypt data

    CH->>CO: usesManagedAuth(type, data)
    
    alt NEW: Is Managed OAuth Credential
        CO-->>CH: true
        CH->>CO: getOverwrites(type)
        CO-->>CH: Overwrite map (e.g. environment variables)
        
        loop For each Pinned Field (authUrl, grantType, etc.)
            CH->>CT: Get property definition for field
            CT-->>CH: Property (type: hidden, default: "...")
            
            alt NEW: Admin Overwrite exists
                CH->>CH: Set field to Admin Overwrite value
            else NEW: Fallback to Type Definition
                CH->>CH: CHANGED: Set field to Credential Type default value
            end
            Note right of CH: User-provided values for these<br/>fields are now ignored/discarded
        end

    else Standard Credential
        CO-->>CH: false
        CH->>CH: Use values from decrypted stored data
    end

    CH->>CH: Apply remaining non-pinned defaults
    CH-->>W: Resolved Credential Object (Ready for API call)

Loading

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>