{
  "meta": {
    "templateCredsSetupCompleted": true
  },
  "nodes": [
    {
      "id": "d542b250-1878-4430-ace4-ef66d331df36",
      "name": "Trigger: Watch Secure Inbox",
      "type": "n8n-nodes-base.googleDrive",
      "position": [
        1424,
        1408
      ],
      "parameters": {
        "driveId": {
          "__rl": true,
          "mode": "list",
          "value": "My Drive"
        },
        "options": {},
        "folderId": {
          "__rl": true,
          "mode": "list",
          "value": "root",
          "cachedResultName": "/ (Root folder)"
        }
      },
      "credentials": {
        "googleDriveOAuth2Api": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 3
    },
    {
      "id": "4e2b9126-7949-4081-9608-700e1aa2a9ad",
      "name": "Download PDF Binary",
      "type": "n8n-nodes-base.googleDrive",
      "position": [
        1616,
        1408
      ],
      "parameters": {
        "fileId": "={{ $json.id }}",
        "options": {},
        "operation": "download"
      },
      "credentials": {
        "googleDriveOAuth2Api": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 3
    },
    {
      "id": "12f127df-2a9e-4a7f-9dae-4a0afc3e4371",
      "name": "Lookup Employee Password",
      "type": "n8n-nodes-base.googleSheets",
      "position": [
        1824,
        1408
      ],
      "parameters": {
        "operation": "lookup",
        "documentId": "YOUR_EMPLOYEE_DB_ID"
      },
      "credentials": {
        "googleSheetsOAuth2Api": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 4
    },
    {
      "id": "3c451a1d-76d8-4b62-a8d5-f2bb479de499",
      "name": "Pre-Encryption Integrity Check",
      "type": "n8n-nodes-base.code",
      "position": [
        2016,
        1408
      ],
      "parameters": {
        "jsCode": "// Verify if password was found, else throw to error path\nif (!$input.first().json.National_ID) {\n  throw new Error(\"Employee Security Metadata Missing\");\n}\nreturn $input.first();"
      },
      "typeVersion": 2
    },
    {
      "id": "78826291-aeb6-4fb0-b68e-1a37ec7572e6",
      "name": "Encrypt PDF (AES-128)",
      "type": "n8n-nodes-htmlcsstopdf.htmlcsstopdf",
      "onError": "continueErrorOutput",
      "position": [
        2224,
        1408
      ],
      "parameters": {
        "resource": "pdfManipulation",
        "operation": "encrypt"
      },
      "credentials": {
        "htmlcsstopdfApi": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 1
    },
    {
      "id": "e2ec7c3f-9f09-43e4-891f-f12496995280",
      "name": "IF: Encryption Success?",
      "type": "n8n-nodes-base.if",
      "position": [
        2416,
        1408
      ],
      "parameters": {
        "conditions": {
          "boolean": [
            {
              "value1": "={{ !!$json.data }}"
            }
          ]
        }
      },
      "typeVersion": 1
    },
    {
      "id": "22d01e26-6884-4b25-9148-ce7dfb148790",
      "name": "Deliver Secure Email",
      "type": "n8n-nodes-base.gmail",
      "position": [
        2672,
        1312
      ],
      "parameters": {
        "sendTo": "={{ $node[\"Lookup Employee Password\"].json.Email }}",
        "message": "Hello,\n\nPlease find your encrypted payslip for the last month. Use your National ID to unlock.",
        "options": {},
        "subject": "=Secure Payslip: {{ $now.minus({ months: 1 }).toFormat('MMMM yyyy') }}"
      },
      "credentials": {
        "gmailOAuth2": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 2.1
    },
    {
      "id": "70515242-c816-4805-811b-a49ede836539",
      "name": "Alert Admin (Slack)",
      "type": "n8n-nodes-base.slack",
      "position": [
        2672,
        1552
      ],
      "parameters": {
        "text": "=\ud83d\udea8 *Payroll Security Failure*\nEmployee: {{ $node[\"Lookup Employee Password\"].json.Email }}\nReason: Encryption failed or metadata missing.",
        "user": {
          "__rl": true,
          "mode": "list",
          "value": ""
        },
        "select": "user",
        "otherOptions": {},
        "authentication": "oAuth2"
      },
      "credentials": {
        "slackOAuth2Api": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 2.1
    },
    {
      "id": "258461af-8769-4e62-8435-c681b4ad2ad9",
      "name": "Main Documentation",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1184,
        864
      ],
      "parameters": {
        "width": 550,
        "height": 480,
        "content": "## How it works\nThis enterprise workflow manages secure payroll distribution. It triggers on new file arrivals, performs a lookup for employee-specific passwords, and validates security metadata. The PDF is encrypted using 128-bit AES. If successful, it is delivered via Gmail. If any step fails (missing password or encryption error), the workflow routes to an error-handling path that alerts admins via Slack and logs the failure for auditing.\n\n## Setup steps\n1. **Employee DB**: Connect a Google Sheet containing Employee Emails and National IDs.\n2. **Drive**: Select your source folder for unencrypted payslips.\n3. **Encryption**: Connect your HTML to PDF node; the password is dynamically mapped to the 'National ID' column.\n4. **Gmail**: Set up your payroll sender account.\n5. **Error Handling**: Configure the Slack channel to receive alerts for any failed encryptions."
      },
      "typeVersion": 1
    },
    {
      "id": "513598d6-c807-40cc-9ece-bf300eaf365c",
      "name": "Security Overview",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1792,
        1200
      ],
      "parameters": {
        "color": 7,
        "width": 1000,
        "height": 450,
        "content": "### \ud83d\udee1\ufe0f Secure Processing & Fail-Safe Routing\nNodes grouped here manage the encryption lifecycle and ensure that only successfully locked files are dispatched."
      },
      "typeVersion": 1
    }
  ],
  "connections": {
    "Download PDF Binary": {
      "main": [
        [
          {
            "node": "Lookup Employee Password",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Encrypt PDF (AES-128)": {
      "main": [
        [
          {
            "node": "IF: Encryption Success?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF: Encryption Success?": {
      "main": [
        [
          {
            "node": "Deliver Secure Email",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Alert Admin (Slack)",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Lookup Employee Password": {
      "main": [
        [
          {
            "node": "Pre-Encryption Integrity Check",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Trigger: Watch Secure Inbox": {
      "main": [
        [
          {
            "node": "Download PDF Binary",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Pre-Encryption Integrity Check": {
      "main": [
        [
          {
            "node": "Encrypt PDF (AES-128)",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}