feat(core): Add 'verify' option to installPackage handler and update … (#28257)

packages/cli/src/public-api/v1/handlers/community-packages/__tests__/community-packages.handler.test.ts

@@ -68,6 +68,23 @@ describe('CommunityPackages Handler', () => {
 			expect(mockResponse.json).toHaveBeenCalledWith(mapToCommunityPackage(mockInstalledPackage));
 		});
 
+		it('should forward verify:true to lifecycle when provided', async () => {
+			const req = {
+				body: { name: 'n8n-nodes-test', verify: true },
+				user: mockUser,
+			};
+
+			mockLifecycle.install.mockResolvedValue(mockInstalledPackage as InstalledPackages);
+
+			await handler.installPackage[handler.installPackage.length - 1](req, mockResponse);
+
+			expect(mockLifecycle.install).toHaveBeenCalledWith(
+				{ name: 'n8n-nodes-test', version: undefined, verify: true },
+				mockUser,
+				'publicApi',
+			);
+		});
+
 		it('should return 400 when name is missing', async () => {
 			const req = {
 				body: {},

packages/cli/src/public-api/v1/handlers/community-packages/community-packages.handler.ts

@@ -16,14 +16,18 @@ export = {
 	installPackage: [
 		apiKeyHasScope('communityPackage:install'),
 		async (
-			req: AuthenticatedRequest<Record<string, never>, unknown, { name: string; version?: string }>,
+			req: AuthenticatedRequest<
+				Record<string, never>,
+				unknown,
+				{ name: string; version?: string; verify?: boolean }
+			>,
 			res: express.Response,
 		): Promise<express.Response> => {
 			const lifecycle = Container.get(CommunityPackagesLifecycleService);
 
 			try {
 				const installedPackage = await lifecycle.install(
-					{ name: req.body.name, version: req.body.version, verify: false },
+					{ name: req.body.name, version: req.body.version, verify: req.body.verify ?? false },
 					req.user,
 					'publicApi',
 				);

packages/cli/src/public-api/v1/handlers/community-packages/spec/schemas/installCommunityPackageRequest.yml

@@ -8,3 +8,8 @@ properties:
   version:
     type: string
     description: Specific semver version to install
+  verify:
+    type: boolean
+    description: >
+      Whether to verify the package against the n8n-vetted package list.
+      Required when the instance has N8N_UNVERIFIED_PACKAGES_ENABLED=false.