fix(proxy): drop Content-Encoding from forwarded upstream responses (#50)

* fix(proxy): drop Content-Encoding from forwarded upstream responses

`fetch` transparently decodes the upstream body — the runtime adds its own
Accept-Encoding to the outgoing request — but the Response it hands back
still advertises the upstream's `Content-Encoding` and the compressed
`Content-Length`. `forwardRequest` returned that object verbatim, so the
proxy answered with a plain body labelled `content-encoding: br` and a
length measuring bytes it never sent.

Any client that honours the header then fails to decode. n8n-cli's own API
client dies on the first list call:

    Error: network error: BrotliDecompressionError fetching
    ".../api/v1/workflows?limit=2"

which makes the CLI unusable against a deployed proxy. curl only escaped it
because it doesn't request compression by default, so the breakage hid
behind manual testing.

Rebuild the response without those two headers when the upstream declares a
real content coding. Responses without an encoding (or `identity`) keep the
original object, so the mutable headers `handleWorkflowMutation` writes lint
counters onto are untouched.

The new test fails with a ZlibError before this change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore: bump version to 2.5.0

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: syucream

package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-cli",
-  "version": "2.4.0",
+  "version": "2.5.0",
   "module": "src/index.ts",
   "type": "module",
   "private": true,

src/proxy/upstream.ts

@@ -12,6 +12,9 @@
  * client is expected to supply them and the upstream needs them to
  * authenticate. Client middlewares (see `ClientMiddleware`) can rewrite or
  * replace these after the strip step but before fetch.
+ *
+ * On the way back, `Content-Encoding` (and the now-stale `Content-Length`) are
+ * dropped from the upstream response — see `normalizeResponseEncoding`.
  */
 import { runClientPipeline } from "@/middleware/client-pipeline.ts";
 import type { ClientMiddleware } from "@/middleware/types.ts";
@@ -47,6 +50,41 @@ function buildUpstreamHeaders(req: Request): Headers {
   return headers;
 }
 
+/**
+ * Rebuilds an upstream response so its headers describe the body we actually
+ * hand downstream.
+ *
+ * `fetch` negotiates and transparently *decodes* the response body (the
+ * outgoing request carries an `Accept-Encoding` the runtime adds on its own),
+ * but the `Response` it returns still advertises the upstream's
+ * `Content-Encoding` and the compressed `Content-Length`. Forwarding those
+ * verbatim hands the client a plain body labelled `content-encoding: br`,
+ * which any client that honours the header fails to decode — n8n-cli's own
+ * API client dies with `BrotliDecompressionError`. curl only escapes this
+ * because it doesn't ask for compression by default.
+ *
+ * So: when the upstream declares a real content coding, strip both headers and
+ * let the runtime recompute the length. Responses without an encoding (or with
+ * `identity`) pass through untouched, keeping the original object — and its
+ * mutable headers, which `handleWorkflowMutation` relies on to attach lint
+ * counters.
+ */
+function normalizeResponseEncoding(response: Response): Response {
+  const encoding = response.headers.get("content-encoding");
+  if (!encoding || encoding.trim().toLowerCase() === "identity") return response;
+
+  const headers = new Headers(response.headers);
+  headers.delete("content-encoding");
+  // Stale: it measures the compressed bytes, not the decoded body we forward.
+  headers.delete("content-length");
+
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+  });
+}
+
 export interface ForwardOptions {
   /** Total request timeout in milliseconds; 0 disables timeout. */
   timeoutMs?: number;
@@ -107,7 +145,7 @@ export async function forwardRequest(
   try {
     const response = await fetch(upstreamUrl, init);
     const elapsedMs = Math.round(performance.now() - start);
-    return { response, elapsedMs };
+    return { response: normalizeResponseEncoding(response), elapsedMs };
   } finally {
     if (timer) clearTimeout(timer);
   }

tests/proxy/proxy.response-encoding.test.ts

@@ -0,0 +1,110 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { type ProxyHandle, startProxy } from "@/proxy/server.ts";
+
+/**
+ * Regression tests for forwarding compressed upstream responses.
+ *
+ * `fetch` decodes the upstream body on its own but leaves `Content-Encoding`
+ * and the compressed `Content-Length` on the Response. Passing those through
+ * hands the client a plain body labelled `content-encoding: gzip`, which any
+ * client that honours the header fails to decode.
+ */
+
+interface MockUpstream {
+  server: ReturnType<typeof Bun.serve>;
+  port: number;
+}
+
+/** Upstream that answers with a gzip-encoded JSON body, as n8n's LB does. */
+function startCompressingUpstream(payload: unknown): MockUpstream {
+  const raw = Buffer.from(JSON.stringify(payload));
+  const gzipped = Bun.gzipSync(raw);
+  const server = Bun.serve({
+    port: 0,
+    fetch: () =>
+      new Response(gzipped, {
+        status: 200,
+        headers: {
+          "content-type": "application/json; charset=utf-8",
+          "content-encoding": "gzip",
+          // The compressed length — exactly what makes a verbatim forward wrong.
+          "content-length": String(gzipped.byteLength),
+          "x-upstream-marker": "kept",
+        },
+      }),
+  });
+  return { server, port: server.port! };
+}
+
+/** Upstream that answers uncompressed, to prove the pass-through path is untouched. */
+function startPlainUpstream(payload: unknown): MockUpstream {
+  const body = JSON.stringify(payload);
+  const server = Bun.serve({
+    port: 0,
+    fetch: () =>
+      new Response(body, {
+        status: 200,
+        headers: {
+          "content-type": "application/json; charset=utf-8",
+          "content-length": String(Buffer.byteLength(body)),
+          "x-upstream-marker": "kept",
+        },
+      }),
+  });
+  return { server, port: server.port! };
+}
+
+let upstream: MockUpstream | undefined;
+let proxy: ProxyHandle | undefined;
+
+afterEach(async () => {
+  await proxy?.stop();
+  await upstream?.server.stop(true);
+  proxy = undefined;
+  upstream = undefined;
+});
+
+function startProxyAgainst(port: number): ProxyHandle {
+  return startProxy({
+    listen: "127.0.0.1:0",
+    upstream: `http://127.0.0.1:${port}`,
+    enforce: "off",
+    disableRules: [],
+    logFormat: "json",
+    allowDuplicates: true,
+  });
+}
+
+describe("proxy: upstream response encoding", () => {
+  test("a compressed upstream response reaches the client decodable", async () => {
+    const payload = { data: [{ id: "abc123", name: "workflow" }], nextCursor: null };
+    upstream = startCompressingUpstream(payload);
+    proxy = startProxyAgainst(upstream.port);
+
+    const res = await fetch(`http://127.0.0.1:${proxy.port}/api/v1/workflows`, {
+      headers: { "accept-encoding": "gzip" },
+    });
+
+    expect(res.status).toBe(200);
+    // The body must be readable — before the fix this threw a decompression error.
+    expect(await res.json()).toEqual(payload);
+    // And the misleading headers must be gone rather than describing a body we no longer send.
+    expect(res.headers.get("content-encoding")).toBeNull();
+    // Unrelated upstream headers survive the rebuild.
+    expect(res.headers.get("x-upstream-marker")).toBe("kept");
+    expect(res.headers.get("content-type")).toBe("application/json; charset=utf-8");
+  });
+
+  test("an uncompressed upstream response is forwarded untouched", async () => {
+    const payload = { data: [], nextCursor: null };
+    upstream = startPlainUpstream(payload);
+    proxy = startProxyAgainst(upstream.port);
+
+    const res = await fetch(`http://127.0.0.1:${proxy.port}/api/v1/workflows`);
+
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual(payload);
+    expect(res.headers.get("content-encoding")).toBeNull();
+    expect(res.headers.get("x-upstream-marker")).toBe("kept");
+  });
+});