fix: surface HTTP status in audit errors + workaround oAuth2 schema bug (#736, #740) (#759)

* fix: surface HTTP status in audit errors + workaround oAuth2 schema bug (#736, #740)

## #736 — n8n_audit_instance error message includes HTTP status

Pre-fix the warning was `Built-in audit failed: <message>` regardless of cause.
The reporter's Zeabur deployment produced `Invalid URL` from inside n8n's own
audit code (likely missing N8N_PROTOCOL/N8N_HOST env vars) and returned it
as the HTTP response body — but the warning made it look like a client bug.

Three new shapes in handleAuditInstance:
  - 404 → "Built-in audit endpoint not available on this n8n version." (unchanged)
  - other status → "Built-in audit failed (HTTP <status>): <reason>"
  - no status → "Built-in audit failed (no response from n8n): <reason>"

Also fixed a long-standing nit: the catch block's builtinAuditMs was computed
against totalStart instead of auditStart. Hoisted auditStart so both paths use
the same anchor.

3 unit tests covering each branch.

## #740 — n8n_manage_credentials accepts oAuth2Api + clientCredentials payloads

n8n's upstream Ajv schema for oAuth2Api has a known bug: the if/then/else on
useDynamicClientRegistration uses properties.x.enum to test value, which
evaluates true vacuously when the field is absent — so both then branches
fire simultaneously and there is no payload shape that satisfies the schema
for a plain clientCredentials grant. Reporter (@bwsnwl) hit this on a
Microsoft Graph app-only auth setup.

New applyCredentialDataShims() helper in handlers-n8n-manager.ts:
  - Activates only for type === 'oAuth2Api' && grantType === 'clientCredentials'
  - Strips useDynamicClientRegistration when present and falsy (root has
    additionalProperties: false and doesn't list it)
  - Injects sendAdditionalBodyProperties: false and additionalBodyProperties: ''
    (grant-type then branch requirement)
  - Injects serverUrl: '' ONLY when the DCR branch fires spuriously (DCR is
    absent or false) — explicit useDynamicClientRegistration: true callers
    are left alone so n8n surfaces real missing-field errors
  - Applied symmetrically on both create and update paths

The shim is a hack with a clear sunset condition: remove when n8n fixes the
schema upstream. Comment block documents the bug + each injection.

5 unit tests (positive + negative + DCR-true preservation + non-oAuth2 regression
+ update path symmetry). Verified end-to-end against live n8n: 4 credentials
created + cleaned up; httpHeaderAuth unaffected.

Reporters: @waltho1123-cloud (#736), @bwsnwl (#740).

Conceived by Romuald Członkowski - https://www.aiadvisors.pl/en

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(handlers-n8n-manager): address Copilot review on PR #759

Three nits from Copilot, all uzasadnione:

1. handleUpdateCredential previously skipped the oAuth2 clientCredentials
   shim when the caller omitted `type` (a common partial-update pattern
   where users only re-send `data`). The shim's first check is type-based,
   so an update without `type` would silently bypass it and re-trigger the
   upstream n8n schema bug. Now: when `type` is omitted AND
   `data.grantType === 'clientCredentials'` (cheap pre-check), fetch the
   existing credential to derive its type before applying the shim. The
   extra GET only fires for the specific narrow case where the shim might
   apply — other updates skip it.

2. package-lock.json was still on 2.47.14 after the version bump to 2.48.2.
   Synced via `npm install --package-lock-only`.

3. Added two unit tests covering:
   - update with `type` omitted + clientCredentials data → fetches existing
     credential, derives type, applies shim
   - update with `type` omitted + non-clientCredentials data → does NOT
     fetch (no extra round-trip)

71 unit tests pass; lint clean.

Conceived by Romuald Członkowski - https://www.aiadvisors.pl/en

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: czlonkowski

CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.48.2] - 2026-04-28
+
+### Fixed
+
+- **`n8n_audit_instance` error message now distinguishes server-side from client-side failures (#736, reported by @waltho1123-cloud).** Pre-fix the warning was always `Built-in audit failed: <message>`, hiding HTTP status. The reporter's Zeabur deployment generates the `Invalid URL` string inside n8n's own audit code (likely from missing `N8N_PROTOCOL`/`N8N_HOST` env vars) and returned it as the response body — but the warning made it look like a client bug. Three new shapes: `endpoint not available` (404, unchanged); `Built-in audit failed (HTTP <status>): <reason>` for any other status; `Built-in audit failed (no response from n8n): <reason>` when no status was returned (timeouts, ECONNREFUSED). Also fixed a long-standing nit where the error path computed `builtinAuditMs` against `totalStart` instead of `auditStart`.
+- **`n8n_manage_credentials` accepts `oAuth2Api` + `clientCredentials` payloads (#740, reported by @bwsnwl).** n8n's upstream Ajv schema for `oAuth2Api` has a known bug: the `if/then/else` on `useDynamicClientRegistration` uses `properties.x.enum` to test value, which evaluates true vacuously when the field is absent — so both `then` branches fire simultaneously and there is no payload shape that satisfies the schema for a plain `clientCredentials` grant. New `applyCredentialDataShims` helper normalizes the payload for that specific combination: strips `useDynamicClientRegistration` when falsy, injects `sendAdditionalBodyProperties: false`, `additionalBodyProperties: ''`, and `serverUrl: ''` (only when the DCR branch fires spuriously — explicit `useDynamicClientRegistration: true` callers are left alone so n8n surfaces real missing-field errors). Applied symmetrically on both create and update paths. Will be removed once n8n fixes the schema upstream.
+
+Conceived by Romuald Członkowski - https://www.aiadvisors.pl/en
+
 ## [2.48.1] - 2026-04-28
 
 ### Fixed

dist/mcp/handlers-n8n-manager.d.ts.map

@@ -1,6 +1,6 @@
 {
   "name": "n8n-mcp",
-  "version": "2.48.1",
+  "version": "2.48.2",
   "description": "Integration between n8n workflow automation and Model Context Protocol (MCP)",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",