@atom8n/n8n 2.2.0

package/dist/modules/mcp/mcp-oauth-service.js

@@ -0,0 +1,166 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthService = exports.SUPPORTED_SCOPES = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const di_1 = require("@n8n/di");
+const oauth_client_repository_1 = require("./database/repositories/oauth-client.repository");
+const oauth_user_consent_repository_1 = require("./database/repositories/oauth-user-consent.repository");
+const mcp_oauth_authorization_code_service_1 = require("./mcp-oauth-authorization-code.service");
+const mcp_oauth_token_service_1 = require("./mcp-oauth-token.service");
+const oauth_session_service_1 = require("./oauth-session.service");
+exports.SUPPORTED_SCOPES = ['tool:listWorkflows', 'tool:getWorkflowDetails'];
+let McpOAuthService = class McpOAuthService {
+    constructor(logger, oauthSessionService, oauthClientRepository, tokenService, authorizationCodeService, userConsentRepository) {
+        this.logger = logger;
+        this.oauthSessionService = oauthSessionService;
+        this.oauthClientRepository = oauthClientRepository;
+        this.tokenService = tokenService;
+        this.authorizationCodeService = authorizationCodeService;
+        this.userConsentRepository = userConsentRepository;
+    }
+    get clientsStore() {
+        return {
+            getClient: async (clientId) => {
+                const client = await this.oauthClientRepository.findOneBy({ id: clientId });
+                if (!client) {
+                    return undefined;
+                }
+                return {
+                    client_id: client.id,
+                    client_name: client.name,
+                    redirect_uris: client.redirectUris,
+                    grant_types: client.grantTypes,
+                    token_endpoint_auth_method: client.tokenEndpointAuthMethod,
+                    ...(client.clientSecret && { client_secret: client.clientSecret }),
+                    ...(client.clientSecretExpiresAt && {
+                        client_secret_expires_at: client.clientSecretExpiresAt,
+                    }),
+                    response_types: ['code'],
+                    scope: exports.SUPPORTED_SCOPES.join(' '),
+                    logo_uri: undefined,
+                    tos_uri: undefined,
+                };
+            },
+            registerClient: async (client) => {
+                try {
+                    await this.oauthClientRepository.insert({
+                        id: client.client_id,
+                        name: client.client_name,
+                        redirectUris: client.redirect_uris,
+                        grantTypes: client.grant_types,
+                        clientSecret: client.client_secret ?? null,
+                        clientSecretExpiresAt: client.client_secret_expires_at ?? null,
+                        tokenEndpointAuthMethod: client.token_endpoint_auth_method ?? 'none',
+                    });
+                }
+                catch (error) {
+                    this.logger.error('Error registering OAuth client', {
+                        error,
+                        clientId: client.client_id,
+                    });
+                }
+                return client;
+            },
+        };
+    }
+    async authorize(client, params, res) {
+        this.logger.debug('Starting OAuth authorization', { clientId: client.client_id });
+        try {
+            this.oauthSessionService.createSession(res, {
+                clientId: client.client_id,
+                redirectUri: params.redirectUri,
+                codeChallenge: params.codeChallenge,
+                state: params.state ?? null,
+            });
+            res.redirect('/oauth/consent');
+        }
+        catch (error) {
+            this.logger.error('Error in authorize method', { error, clientId: client.client_id });
+            this.oauthSessionService.clearSession(res);
+            res.status(500).json({ error: 'server_error', error_description: 'Internal server error' });
+        }
+    }
+    async challengeForAuthorizationCode(client, authorizationCode) {
+        return await this.authorizationCodeService.getCodeChallenge(authorizationCode, client.client_id);
+    }
+    async exchangeAuthorizationCode(client, authorizationCode, _codeVerifier, redirectUri) {
+        const authRecord = await this.authorizationCodeService.validateAndConsumeAuthorizationCode(authorizationCode, client.client_id, redirectUri);
+        const { accessToken, refreshToken } = this.tokenService.generateTokenPair(authRecord.userId, client.client_id);
+        await this.tokenService.saveTokenPair(accessToken, refreshToken, client.client_id, authRecord.userId);
+        this.logger.info('Authorization code exchanged for tokens', {
+            clientId: client.client_id,
+            userId: authRecord.userId,
+        });
+        return {
+            access_token: accessToken,
+            token_type: 'Bearer',
+            expires_in: 3600,
+            refresh_token: refreshToken,
+        };
+    }
+    async exchangeRefreshToken(client, refreshToken, _scopes) {
+        return await this.tokenService.validateAndRotateRefreshToken(refreshToken, client.client_id);
+    }
+    async verifyAccessToken(token) {
+        return await this.tokenService.verifyAccessToken(token);
+    }
+    async revokeToken(client, request) {
+        const { token, token_type_hint } = request;
+        if (!token_type_hint || token_type_hint === 'access_token') {
+            const revoked = await this.tokenService.revokeAccessToken(token, client.client_id);
+            if (revoked) {
+                return;
+            }
+        }
+        if (!token_type_hint || token_type_hint === 'refresh_token') {
+            const revoked = await this.tokenService.revokeRefreshToken(token, client.client_id);
+            if (revoked) {
+                return;
+            }
+        }
+        this.logger.debug('Token revocation requested for unknown token', {
+            clientId: client.client_id,
+        });
+    }
+    async getAllClients(userId) {
+        const userConsents = await this.userConsentRepository.findByUserWithClient(userId);
+        return userConsents.map((consent) => {
+            const { clientSecret, clientSecretExpiresAt, ...sanitizedClient } = consent.client;
+            return sanitizedClient;
+        });
+    }
+    async deleteClient(clientId) {
+        const client = await this.oauthClientRepository.findOne({
+            where: { id: clientId },
+        });
+        if (!client) {
+            throw new Error(`OAuth client with ID ${clientId} not found`);
+        }
+        this.logger.info('Deleting OAuth client and related data', { clientId });
+        await this.oauthClientRepository.delete({ id: clientId });
+        this.logger.info('OAuth client deleted successfully', {
+            clientId,
+            clientName: client.name,
+        });
+    }
+};
+exports.McpOAuthService = McpOAuthService;
+exports.McpOAuthService = McpOAuthService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [backend_common_1.Logger,
+        oauth_session_service_1.OAuthSessionService,
+        oauth_client_repository_1.OAuthClientRepository,
+        mcp_oauth_token_service_1.McpOAuthTokenService,
+        mcp_oauth_authorization_code_service_1.McpOAuthAuthorizationCodeService,
+        oauth_user_consent_repository_1.UserConsentRepository])
+], McpOAuthService);
+//# sourceMappingURL=mcp-oauth-service.js.map

package/dist/modules/mcp/mcp-oauth-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-service.js","sourceRoot":"","sources":["../../../src/modules/mcp/mcp-oauth-service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAWA,wDAA6C;AAC7C,gCAAkC;AAIlC,6FAAwF;AACxF,yGAA8F;AAC9F,iGAA0F;AAC1F,uEAAiE;AACjE,mEAA8D;AAEjD,QAAA,gBAAgB,GAAG,CAAC,oBAAoB,EAAE,yBAAyB,CAAC,CAAC;AAO3E,IAAM,eAAe,GAArB,MAAM,eAAe;IAC3B,YACkB,MAAc,EACd,mBAAwC,EACxC,qBAA4C,EAC5C,YAAkC,EAClC,wBAA0D,EAC1D,qBAA4C;QAL5C,WAAM,GAAN,MAAM,CAAQ;QACd,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,iBAAY,GAAZ,YAAY,CAAsB;QAClC,6BAAwB,GAAxB,wBAAwB,CAAkC;QAC1D,0BAAqB,GAArB,qBAAqB,CAAuB;IAC3D,CAAC;IAEJ,IAAI,YAAY;QACf,OAAO;YACN,SAAS,EAAE,KAAK,EAAE,QAAgB,EAAmD,EAAE;gBACtF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;oBACb,OAAO,SAAS,CAAC;gBAClB,CAAC;gBAED,OAAO;oBACN,SAAS,EAAE,MAAM,CAAC,EAAE;oBACpB,WAAW,EAAE,MAAM,CAAC,IAAI;oBACxB,aAAa,EAAE,MAAM,CAAC,YAAY;oBAClC,WAAW,EAAE,MAAM,CAAC,UAAU;oBAC9B,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;oBAC1D,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;oBAClE,GAAG,CAAC,MAAM,CAAC,qBAAqB,IAAI;wBACnC,wBAAwB,EAAE,MAAM,CAAC,qBAAqB;qBACtD,CAAC;oBACF,cAAc,EAAE,CAAC,MAAM,CAAC;oBACxB,KAAK,EAAE,wBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;oBACjC,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,SAAS;iBAClB,CAAC;YACH,CAAC;YACD,cAAc,EAAE,KAAK,EACpB,MAAkC,EACI,EAAE;gBACxC,IAAI,CAAC;oBACJ,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;wBACvC,EAAE,EAAE,MAAM,CAAC,SAAS;wBACpB,IAAI,EAAE,MAAM,CAAC,WAAW;wBACxB,YAAY,EAAE,MAAM,CAAC,aAAa;wBAClC,UAAU,EAAE,MAAM,CAAC,WAAW;wBAC9B,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;wBAC1C,qBAAqB,EAAE,MAAM,CAAC,wBAAwB,IAAI,IAAI;wBAC9D,uBAAuB,EAAE,MAAM,CAAC,0BAA0B,IAAI,MAAM;qBACpE,CAAC,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;wBACnD,KAAK;wBACL,QAAQ,EAAE,MAAM,CAAC,SAAS;qBAC1B,CAAC,CAAC;gBACJ,CAAC;gBAED,OAAO,MAAM,CAAC;YACf,CAAC;SACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CACd,MAAkC,EAClC,MAA2B,EAC3B,GAAa;QAEb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAElF,IAAI,CAAC;YACJ,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,GAAG,EAAE;gBAC3C,QAAQ,EAAE,MAAM,CAAC,SAAS;gBAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;aAC3B,CAAC,CAAC;YAEH,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACtF,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC7F,CAAC;IACF,CAAC;IAED,KAAK,CAAC,6BAA6B,CAClC,MAAkC,EAClC,iBAAyB;QAEzB,OAAO,MAAM,IAAI,CAAC,wBAAwB,CAAC,gBAAgB,CAC1D,iBAAiB,EACjB,MAAM,CAAC,SAAS,CAChB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC9B,MAAkC,EAClC,iBAAyB,EACzB,aAAsB,EACtB,WAAoB;QAEpB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,mCAAmC,CACzF,iBAAiB,EACjB,MAAM,CAAC,SAAS,EAChB,WAAW,CACX,CAAC;QAEF,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CACxE,UAAU,CAAC,MAAM,EACjB,MAAM,CAAC,SAAS,CAChB,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CACpC,WAAW,EACX,YAAY,EACZ,MAAM,CAAC,SAAS,EAChB,UAAU,CAAC,MAAM,CACjB,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;YAC3D,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;SACzB,CAAC,CAAC;QAEH,OAAO;YACN,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI;YAChB,aAAa,EAAE,YAAY;SAC3B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CACzB,MAAkC,EAClC,YAAoB,EACpB,OAAkB;QAElB,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,6BAA6B,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9F,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACpC,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,WAAW,CAChB,MAAkC,EAClC,OAAoC;QAEpC,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QAE3C,IAAI,CAAC,eAAe,IAAI,eAAe,KAAK,cAAc,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACnF,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO;YACR,CAAC;QACF,CAAC;QAED,IAAI,CAAC,eAAe,IAAI,eAAe,KAAK,eAAe,EAAE,CAAC;YAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACpF,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO;YACR,CAAC;QACF,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE;YACjE,QAAQ,EAAE,MAAM,CAAC,SAAS;SAC1B,CAAC,CAAC;IACJ,CAAC;IAKD,KAAK,CAAC,aAAa,CAClB,MAAc;QAGd,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAGnF,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YACnC,MAAM,EAAE,YAAY,EAAE,qBAAqB,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YACnF,OAAO,eAAe,CAAC;QACxB,CAAC,CAAC,CAAC;IACJ,CAAC;IAKD,KAAK,CAAC,YAAY,CAAC,QAAgB;QAElC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;YACvD,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,YAAY,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEzE,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;YACrD,QAAQ;YACR,UAAU,EAAE,MAAM,CAAC,IAAI;SACvB,CAAC,CAAC;IACJ,CAAC;CACD,CAAA;AA5MY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,YAAO,GAAE;qCAGiB,uBAAM;QACO,2CAAmB;QACjB,+CAAqB;QAC9B,8CAAoB;QACR,uEAAgC;QACnC,qDAAqB;GAPlD,eAAe,CA4M3B"}

package/dist/modules/mcp/mcp-oauth-token.service.d.ts

@@ -0,0 +1,29 @@
+import { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types';
+import { OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth';
+import { Logger } from '@n8n/backend-common';
+import { UserRepository } from '@n8n/db';
+import { AccessTokenRepository } from './database/repositories/oauth-access-token.repository';
+import { RefreshTokenRepository } from './database/repositories/oauth-refresh-token.repository';
+import { UserWithContext } from './mcp.types';
+import { JwtService } from '../../services/jwt.service';
+export declare class McpOAuthTokenService {
+    private readonly logger;
+    private readonly jwtService;
+    private readonly userRepository;
+    private readonly accessTokenRepository;
+    private readonly refreshTokenRepository;
+    private readonly MCP_AUDIENCE;
+    private readonly ACCESS_TOKEN_EXPIRY_SECONDS;
+    private readonly REFRESH_TOKEN_EXPIRY_MS;
+    constructor(logger: Logger, jwtService: JwtService, userRepository: UserRepository, accessTokenRepository: AccessTokenRepository, refreshTokenRepository: RefreshTokenRepository);
+    generateTokenPair(userId: string, clientId: string): {
+        accessToken: string;
+        refreshToken: string;
+    };
+    saveTokenPair(accessToken: string, refreshToken: string, clientId: string, userId: string): Promise<void>;
+    validateAndRotateRefreshToken(refreshToken: string, clientId: string): Promise<OAuthTokens>;
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    verifyOAuthAccessToken(token: string): Promise<UserWithContext>;
+    revokeAccessToken(token: string, clientId: string): Promise<boolean>;
+    revokeRefreshToken(token: string, clientId: string): Promise<boolean>;
+}

package/dist/modules/mcp/mcp-oauth-token.service.js

@@ -0,0 +1,200 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthTokenService = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const constants_1 = require("@n8n/constants");
+const db_1 = require("@n8n/db");
+const di_1 = require("@n8n/di");
+const typeorm_1 = require("@n8n/typeorm");
+const n8n_workflow_1 = require("n8n-workflow");
+const node_crypto_1 = require("node:crypto");
+const oauth_access_token_entity_1 = require("./database/entities/oauth-access-token.entity");
+const oauth_refresh_token_entity_1 = require("./database/entities/oauth-refresh-token.entity");
+const oauth_access_token_repository_1 = require("./database/repositories/oauth-access-token.repository");
+const oauth_refresh_token_repository_1 = require("./database/repositories/oauth-refresh-token.repository");
+const mcp_errors_1 = require("./mcp.errors");
+const jwt_service_1 = require("../../services/jwt.service");
+let McpOAuthTokenService = class McpOAuthTokenService {
+    constructor(logger, jwtService, userRepository, accessTokenRepository, refreshTokenRepository) {
+        this.logger = logger;
+        this.jwtService = jwtService;
+        this.userRepository = userRepository;
+        this.accessTokenRepository = accessTokenRepository;
+        this.refreshTokenRepository = refreshTokenRepository;
+        this.MCP_AUDIENCE = 'mcp-server-api';
+        this.ACCESS_TOKEN_EXPIRY_SECONDS = 1 * constants_1.Time.hours.toSeconds;
+        this.REFRESH_TOKEN_EXPIRY_MS = 30 * constants_1.Time.days.toMilliseconds;
+    }
+    generateTokenPair(userId, clientId) {
+        const accessToken = this.jwtService.sign({
+            sub: userId,
+            aud: this.MCP_AUDIENCE,
+            client_id: clientId,
+            jti: (0, node_crypto_1.randomUUID)(),
+            iat: Math.floor(Date.now() / 1000),
+            exp: Math.floor(Date.now() / 1000) + this.ACCESS_TOKEN_EXPIRY_SECONDS,
+            meta: {
+                isOAuth: true,
+            },
+        });
+        const refreshToken = (0, node_crypto_1.randomBytes)(32).toString('hex');
+        return { accessToken, refreshToken };
+    }
+    async saveTokenPair(accessToken, refreshToken, clientId, userId) {
+        await this.accessTokenRepository.manager.transaction(async (transactionManager) => {
+            await transactionManager.insert(this.accessTokenRepository.target, {
+                token: accessToken,
+                clientId,
+                userId,
+            });
+            await transactionManager.insert(this.refreshTokenRepository.target, {
+                token: refreshToken,
+                clientId,
+                userId,
+                expiresAt: Date.now() + this.REFRESH_TOKEN_EXPIRY_MS,
+            });
+        });
+    }
+    async validateAndRotateRefreshToken(refreshToken, clientId) {
+        return await (0, db_1.withTransaction)(this.refreshTokenRepository.manager, undefined, async (trx) => {
+            const now = Date.now();
+            const refreshTokenRecord = await trx.findOne(oauth_refresh_token_entity_1.RefreshToken, {
+                where: {
+                    token: refreshToken,
+                    clientId,
+                },
+            });
+            if (!refreshTokenRecord) {
+                throw new Error('Invalid refresh token');
+            }
+            const result = await trx.delete(oauth_refresh_token_entity_1.RefreshToken, {
+                token: refreshToken,
+                clientId,
+                expiresAt: (0, typeorm_1.MoreThanOrEqual)(now),
+            });
+            const numAffected = result.affected ?? 0;
+            if (numAffected < 1) {
+                throw new Error('Invalid refresh token');
+            }
+            const { accessToken, refreshToken: newRefreshToken } = this.generateTokenPair(refreshTokenRecord.userId, clientId);
+            await trx.insert(oauth_access_token_entity_1.AccessToken, {
+                token: accessToken,
+                clientId,
+                userId: refreshTokenRecord.userId,
+            });
+            await trx.insert(oauth_refresh_token_entity_1.RefreshToken, {
+                token: newRefreshToken,
+                clientId,
+                userId: refreshTokenRecord.userId,
+                expiresAt: now + this.REFRESH_TOKEN_EXPIRY_MS,
+            });
+            this.logger.info('Refresh token rotated and new access token issued', {
+                clientId,
+                userId: refreshTokenRecord.userId,
+            });
+            return {
+                access_token: accessToken,
+                token_type: 'Bearer',
+                expires_in: this.ACCESS_TOKEN_EXPIRY_SECONDS,
+                refresh_token: newRefreshToken,
+            };
+        });
+    }
+    async verifyAccessToken(token) {
+        let decoded;
+        try {
+            decoded = this.jwtService.verify(token, { audience: this.MCP_AUDIENCE });
+        }
+        catch (error) {
+            throw new mcp_errors_1.JWTVerificationError();
+        }
+        const accessTokenRecord = await this.accessTokenRepository.findOne({
+            where: { token },
+        });
+        if (!accessTokenRecord) {
+            throw new mcp_errors_1.AccessTokenNotFoundError();
+        }
+        return {
+            token,
+            clientId: decoded.client_id,
+            scopes: [],
+            extra: {
+                userId: decoded.sub,
+            },
+        };
+    }
+    async verifyOAuthAccessToken(token) {
+        try {
+            const authInfo = await this.verifyAccessToken(token);
+            const userId = authInfo.extra?.userId;
+            if (!userId) {
+                return { user: null, context: { reason: 'user_id_not_in_auth_info', auth_type: 'oauth' } };
+            }
+            const user = await this.userRepository.findOne({
+                where: { id: userId },
+                relations: ['role'],
+            });
+            if (!user) {
+                return { user: null, context: { reason: 'user_not_found', auth_type: 'oauth' } };
+            }
+            return { user };
+        }
+        catch (error) {
+            const errorForSure = (0, n8n_workflow_1.ensureError)(error);
+            const reason = errorForSure instanceof mcp_errors_1.JWTVerificationError
+                ? 'invalid_token'
+                : errorForSure instanceof mcp_errors_1.AccessTokenNotFoundError
+                    ? 'token_not_found_in_db'
+                    : 'unknown_error';
+            return {
+                user: null,
+                context: {
+                    reason,
+                    auth_type: 'oauth',
+                    error_details: errorForSure.message,
+                },
+            };
+        }
+    }
+    async revokeAccessToken(token, clientId) {
+        const result = await this.accessTokenRepository.delete({
+            token,
+            clientId,
+        });
+        const revoked = (result.affected ?? 0) > 0;
+        if (revoked) {
+            this.logger.info('Access token revoked', { clientId });
+        }
+        return revoked;
+    }
+    async revokeRefreshToken(token, clientId) {
+        const result = await this.refreshTokenRepository.delete({
+            token,
+            clientId,
+        });
+        const revoked = (result.affected ?? 0) > 0;
+        if (revoked) {
+            this.logger.info('Refresh token revoked', { clientId });
+        }
+        return revoked;
+    }
+};
+exports.McpOAuthTokenService = McpOAuthTokenService;
+exports.McpOAuthTokenService = McpOAuthTokenService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [backend_common_1.Logger,
+        jwt_service_1.JwtService,
+        db_1.UserRepository,
+        oauth_access_token_repository_1.AccessTokenRepository,
+        oauth_refresh_token_repository_1.RefreshTokenRepository])
+], McpOAuthTokenService);
+//# sourceMappingURL=mcp-oauth-token.service.js.map

package/dist/modules/mcp/mcp-oauth-token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-token.service.js","sourceRoot":"","sources":["../../../src/modules/mcp/mcp-oauth-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,wDAA6C;AAC7C,8CAAsC;AACtC,gCAA0D;AAC1D,gCAAkC;AAClC,0CAA+C;AAC/C,+CAA2C;AAC3C,6CAAsD;AAEtD,6FAA4E;AAC5E,+FAA8E;AAC9E,yGAA8F;AAC9F,2GAAgG;AAChG,6CAA8E;AAG9E,wDAAoD;AAO7C,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAKhC,YACkB,MAAc,EACd,UAAsB,EACtB,cAA8B,EAC9B,qBAA4C,EAC5C,sBAA8C;QAJ9C,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAY;QACtB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,2BAAsB,GAAtB,sBAAsB,CAAwB;QAT/C,iBAAY,GAAG,gBAAgB,CAAC;QAChC,gCAA2B,GAAG,CAAC,GAAG,gBAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QACvD,4BAAuB,GAAG,EAAE,GAAG,gBAAI,CAAC,IAAI,CAAC,cAAc,CAAC;IAQtE,CAAC;IAEJ,iBAAiB,CAChB,MAAc,EACd,QAAgB;QAEhB,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACxC,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,IAAI,CAAC,YAAY;YACtB,SAAS,EAAE,QAAQ;YACnB,GAAG,EAAE,IAAA,wBAAU,GAAE;YACjB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,2BAA2B;YACrE,IAAI,EAAE;gBACL,OAAO,EAAE,IAAI;aACb;SACD,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAErD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,aAAa,CAClB,WAAmB,EACnB,YAAoB,EACpB,QAAgB,EAChB,MAAc;QAEd,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE;YACjF,MAAM,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE;gBAClE,KAAK,EAAE,WAAW;gBAClB,QAAQ;gBACR,MAAM;aACN,CAAC,CAAC;YAEH,MAAM,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE;gBACnE,KAAK,EAAE,YAAY;gBACnB,QAAQ;gBACR,MAAM;gBACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,uBAAuB;aACpD,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,6BAA6B,CAClC,YAAoB,EACpB,QAAgB;QAEhB,OAAO,MAAM,IAAA,oBAAe,EAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,MAAM,kBAAkB,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,yCAAY,EAAE;gBAC1D,KAAK,EAAE;oBACN,KAAK,EAAE,YAAY;oBACnB,QAAQ;iBACR;aACD,CAAC,CAAC;YAEH,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,yCAAY,EAAE;gBAC7C,KAAK,EAAE,YAAY;gBACnB,QAAQ;gBACR,SAAS,EAAE,IAAA,yBAAe,EAAC,GAAG,CAAC;aAC/B,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;YACzC,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAC5E,kBAAkB,CAAC,MAAM,EACzB,QAAQ,CACR,CAAC;YAEF,MAAM,GAAG,CAAC,MAAM,CAAC,uCAAW,EAAE;gBAC7B,KAAK,EAAE,WAAW;gBAClB,QAAQ;gBACR,MAAM,EAAE,kBAAkB,CAAC,MAAM;aACjC,CAAC,CAAC;YAEH,MAAM,GAAG,CAAC,MAAM,CAAC,yCAAY,EAAE;gBAC9B,KAAK,EAAE,eAAe;gBACtB,QAAQ;gBACR,MAAM,EAAE,kBAAkB,CAAC,MAAM;gBACjC,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,uBAAuB;aAC7C,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;gBACrE,QAAQ;gBACR,MAAM,EAAE,kBAAkB,CAAC,MAAM;aACjC,CAAC,CAAC;YAEH,OAAO;gBACN,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,IAAI,CAAC,2BAA2B;gBAC5C,aAAa,EAAE,eAAe;aAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACpC,IAAI,OAAO,CAAC;QAEZ,IAAI,CAAC;YACJ,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,iCAAoB,EAAE,CAAC;QAClC,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;YAClE,KAAK,EAAE,EAAE,KAAK,EAAE;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxB,MAAM,IAAI,qCAAwB,EAAE,CAAC;QACtC,CAAC;QAED,OAAO;YACN,KAAK;YACL,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,MAAM,EAAE,EAAE;YACV,KAAK,EAAE;gBACN,MAAM,EAAE,OAAO,CAAC,GAAG;aACnB;SACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa;QACzC,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAErD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAgB,CAAC;YAChD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC;YAC5F,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;gBAC9C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;gBACrB,SAAS,EAAE,CAAC,MAAM,CAAC;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC;YAClF,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,IAAA,0BAAW,EAAC,KAAK,CAAC,CAAC;YACxC,MAAM,MAAM,GACX,YAAY,YAAY,iCAAoB;gBAC3C,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,YAAY,YAAY,qCAAwB;oBACjD,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,eAAe,CAAC;YACrB,OAAO;gBACN,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE;oBACR,MAAM;oBACN,SAAS,EAAE,OAAO;oBAClB,aAAa,EAAE,YAAY,CAAC,OAAO;iBACnC;aACD,CAAC;QACH,CAAC;IACF,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,QAAgB;QACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;YACtD,KAAK;YACL,QAAQ;SACR,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,QAAgB;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC;YACvD,KAAK;YACL,QAAQ;SACR,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;CACD,CAAA;AAnNY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,YAAO,GAAE;qCAOiB,uBAAM;QACF,wBAAU;QACN,mBAAc;QACP,qDAAqB;QACpB,uDAAsB;GAVpD,oBAAoB,CAmNhC"}

package/dist/modules/mcp/mcp-oauth.helpers.d.ts

@@ -0,0 +1,4 @@
+export declare class McpOAuthHelpers {
+    static buildSuccessRedirectUrl(redirectUri: string, code: string, state: string | null): string;
+    static buildErrorRedirectUrl(redirectUri: string, error: string, errorDescription: string, state: string | null): string;
+}

package/dist/modules/mcp/mcp-oauth.helpers.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthHelpers = void 0;
+class McpOAuthHelpers {
+    static buildSuccessRedirectUrl(redirectUri, code, state) {
+        const targetUrl = new URL(redirectUri);
+        targetUrl.searchParams.set('code', code);
+        if (state) {
+            targetUrl.searchParams.set('state', state);
+        }
+        return targetUrl.toString();
+    }
+    static buildErrorRedirectUrl(redirectUri, error, errorDescription, state) {
+        const targetUrl = new URL(redirectUri);
+        targetUrl.searchParams.set('error', error);
+        targetUrl.searchParams.set('error_description', errorDescription);
+        if (state) {
+            targetUrl.searchParams.set('state', state);
+        }
+        return targetUrl.toString();
+    }
+}
+exports.McpOAuthHelpers = McpOAuthHelpers;
+//# sourceMappingURL=mcp-oauth.helpers.js.map

package/dist/modules/mcp/mcp-oauth.helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth.helpers.js","sourceRoot":"","sources":["../../../src/modules/mcp/mcp-oauth.helpers.ts"],"names":[],"mappings":";;;AAGA,MAAa,eAAe;IAK3B,MAAM,CAAC,uBAAuB,CAAC,WAAmB,EAAE,IAAY,EAAE,KAAoB;QACrF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACvC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,EAAE,CAAC;YACX,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAMD,MAAM,CAAC,qBAAqB,CAC3B,WAAmB,EACnB,KAAa,EACb,gBAAwB,EACxB,KAAoB;QAEpB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACvC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3C,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;QAClE,IAAI,KAAK,EAAE,CAAC;YACX,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;CACD;AAhCD,0CAgCC"}

package/dist/modules/mcp/mcp-server-middleware.service.d.ts

@@ -0,0 +1,18 @@
+import { NextFunction, Response, Request } from 'express';
+import { McpServerApiKeyService } from './mcp-api-key.service';
+import { McpOAuthTokenService } from './mcp-oauth-token.service';
+import type { UserWithContext } from './mcp.types';
+import { JwtService } from '../../services/jwt.service';
+import { Telemetry } from '../../telemetry';
+export declare class McpServerMiddlewareService {
+    private readonly mcpServerApiKeyService;
+    private readonly mcpAuthTokenService;
+    private readonly jwtService;
+    private readonly telemetry;
+    constructor(mcpServerApiKeyService: McpServerApiKeyService, mcpAuthTokenService: McpOAuthTokenService, jwtService: JwtService, telemetry: Telemetry);
+    getUserForToken(token: string): Promise<UserWithContext>;
+    getAuthMiddleware(): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    private extractBearerToken;
+    private responseWithUnauthorized;
+    private trackUnauthorizedEvent;
+}

package/dist/modules/mcp/mcp-server-middleware.service.js

@@ -0,0 +1,120 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpServerMiddlewareService = void 0;
+const di_1 = require("@n8n/di");
+const n8n_workflow_1 = require("n8n-workflow");
+const mcp_api_key_service_1 = require("./mcp-api-key.service");
+const mcp_oauth_token_service_1 = require("./mcp-oauth-token.service");
+const mcp_constants_1 = require("./mcp.constants");
+const mcp_utils_1 = require("./mcp.utils");
+const auth_error_1 = require("../../errors/response-errors/auth.error");
+const jwt_service_1 = require("../../services/jwt.service");
+const telemetry_1 = require("../../telemetry");
+let McpServerMiddlewareService = class McpServerMiddlewareService {
+    constructor(mcpServerApiKeyService, mcpAuthTokenService, jwtService, telemetry) {
+        this.mcpServerApiKeyService = mcpServerApiKeyService;
+        this.mcpAuthTokenService = mcpAuthTokenService;
+        this.jwtService = jwtService;
+        this.telemetry = telemetry;
+    }
+    async getUserForToken(token) {
+        let decoded;
+        try {
+            decoded = this.jwtService.decode(token);
+        }
+        catch (error) {
+            return {
+                user: null,
+                context: {
+                    reason: 'jwt_decode_failed',
+                    auth_type: 'unknown',
+                    error_details: (0, n8n_workflow_1.ensureError)(error).message,
+                },
+            };
+        }
+        if (decoded?.meta?.isOAuth === true) {
+            return await this.mcpAuthTokenService.verifyOAuthAccessToken(token);
+        }
+        return await this.mcpServerApiKeyService.verifyApiKey(token);
+    }
+    getAuthMiddleware() {
+        return async (req, res, next) => {
+            const authorizationHeader = req.header('authorization');
+            if (!authorizationHeader) {
+                this.responseWithUnauthorized(res, req, {
+                    reason: 'missing_authorization_header',
+                    auth_type: 'unknown',
+                    error_details: 'Authorization header not sent',
+                });
+                return;
+            }
+            let token;
+            try {
+                token = this.extractBearerToken(authorizationHeader);
+            }
+            catch (er) {
+                const error = (0, n8n_workflow_1.ensureError)(er);
+                this.responseWithUnauthorized(res, req, {
+                    reason: 'invalid_bearer_format',
+                    auth_type: 'unknown',
+                    error_details: error.message,
+                });
+                return;
+            }
+            const result = await this.getUserForToken(token);
+            const user = result.user;
+            if (!user) {
+                this.responseWithUnauthorized(res, req, result.context);
+                return;
+            }
+            req.user = user;
+            next();
+        };
+    }
+    extractBearerToken(headerValue) {
+        if (!headerValue.startsWith('Bearer')) {
+            throw new auth_error_1.AuthError('Invalid authorization header format - Missing Bearer prefix');
+        }
+        const tokenMatch = headerValue.match(/^Bearer\s+(.+)$/i);
+        if (tokenMatch) {
+            return tokenMatch[1];
+        }
+        throw new auth_error_1.AuthError('Invalid authorization header format - Malformed Bearer token');
+    }
+    responseWithUnauthorized(res, req, context) {
+        this.trackUnauthorizedEvent(req, context);
+        res.header('WWW-Authenticate', 'Bearer realm="n8n MCP Server"');
+        res.status(401).send({
+            message: `${mcp_constants_1.UNAUTHORIZED_ERROR_MESSAGE}${context?.error_details ? ': ' + context.error_details : ''}`,
+        });
+    }
+    trackUnauthorizedEvent(req, context) {
+        const clientInfo = (0, mcp_utils_1.getClientInfo)(req);
+        const payload = {
+            mcp_connection_status: 'error',
+            error: mcp_constants_1.UNAUTHORIZED_ERROR_MESSAGE,
+            client_name: clientInfo?.name,
+            client_version: clientInfo?.version,
+            ...context,
+        };
+        this.telemetry.track(mcp_constants_1.USER_CONNECTED_TO_MCP_EVENT, payload);
+    }
+};
+exports.McpServerMiddlewareService = McpServerMiddlewareService;
+exports.McpServerMiddlewareService = McpServerMiddlewareService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [mcp_api_key_service_1.McpServerApiKeyService,
+        mcp_oauth_token_service_1.McpOAuthTokenService,
+        jwt_service_1.JwtService,
+        telemetry_1.Telemetry])
+], McpServerMiddlewareService);
+//# sourceMappingURL=mcp-server-middleware.service.js.map

package/dist/modules/mcp/mcp-server-middleware.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server-middleware.service.js","sourceRoot":"","sources":["../../../src/modules/mcp/mcp-server-middleware.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,gCAAkC;AAElC,+CAA2C;AAE3C,+DAA+D;AAC/D,uEAAiE;AACjE,mDAA0F;AAE1F,2CAA4C;AAE5C,oEAAgE;AAChE,wDAAoD;AACpD,2CAAwC;AAQjC,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACtC,YACkB,sBAA8C,EAC9C,mBAAyC,EACzC,UAAsB,EACtB,SAAoB;QAHpB,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,wBAAmB,GAAnB,mBAAmB,CAAsB;QACzC,eAAU,GAAV,UAAU,CAAY;QACtB,cAAS,GAAT,SAAS,CAAW;IACnC,CAAC;IAMJ,KAAK,CAAC,eAAe,CAAC,KAAa;QAClC,IAAI,OAAyC,CAAC;QAC9C,IAAI,CAAC;YACJ,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAmC,KAAK,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO;gBACN,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE;oBACR,MAAM,EAAE,mBAAmB;oBAC3B,SAAS,EAAE,SAAS;oBACpB,aAAa,EAAE,IAAA,0BAAW,EAAC,KAAK,CAAC,CAAC,OAAO;iBACzC;aACD,CAAC;QACH,CAAC;QAED,IAAI,OAAO,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YACrC,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAMD,iBAAiB;QAChB,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YAChE,MAAM,mBAAmB,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAExD,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAC1B,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,EAAE;oBACvC,MAAM,EAAE,8BAA8B;oBACtC,SAAS,EAAE,SAAS;oBACpB,aAAa,EAAE,+BAA+B;iBAC9C,CAAC,CAAC;gBACH,OAAO;YACR,CAAC;YAED,IAAI,KAAa,CAAC;YAClB,IAAI,CAAC;gBACJ,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,EAAE,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,IAAA,0BAAW,EAAC,EAAE,CAAC,CAAC;gBAC9B,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,EAAE;oBACvC,MAAM,EAAE,uBAAuB;oBAC/B,SAAS,EAAE,SAAS;oBACpB,aAAa,EAAE,KAAK,CAAC,OAAO;iBAC5B,CAAC,CAAC;gBACH,OAAO;YACR,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YAEzB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBACxD,OAAO;YACR,CAAC;YAEA,GAA4B,CAAC,IAAI,GAAG,IAAI,CAAC;YAE1C,IAAI,EAAE,CAAC;QACR,CAAC,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,WAAmB;QAC7C,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,sBAAS,CAAC,6DAA6D,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACzD,IAAI,UAAU,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC;QAED,MAAM,IAAI,sBAAS,CAAC,8DAA8D,CAAC,CAAC;IACrF,CAAC;IAEO,wBAAwB,CAAC,GAAa,EAAE,GAAY,EAAE,OAA8B;QAC3F,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAE1C,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,+BAA+B,CAAC,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACpB,OAAO,EAAE,GAAG,0CAA0B,GAAG,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE;SACrG,CAAC,CAAC;IACJ,CAAC;IAEO,sBAAsB,CAAC,GAAY,EAAE,OAA8B;QAC1E,MAAM,UAAU,GAAG,IAAA,yBAAa,EAAC,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG;YACf,qBAAqB,EAAE,OAAO;YAC9B,KAAK,EAAE,0CAA0B;YACjC,WAAW,EAAE,UAAU,EAAE,IAAI;YAC7B,cAAc,EAAE,UAAU,EAAE,OAAO;YACnC,GAAG,OAAO;SACV,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,2CAA2B,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;CACD,CAAA;AA/GY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,YAAO,GAAE;qCAGiC,4CAAsB;QACzB,8CAAoB;QAC7B,wBAAU;QACX,qBAAS;GAL1B,0BAA0B,CA+GtC"}

package/dist/modules/mcp/mcp.auth.consent.controller.d.ts

@@ -0,0 +1,17 @@
+import { Logger } from '@n8n/backend-common';
+import type { AuthenticatedRequest } from '@n8n/db';
+import type { Response } from 'express';
+import { ApproveConsentRequestDto } from './dto/approve-consent-request.dto';
+import { McpOAuthConsentService } from './mcp-oauth-consent.service';
+import { OAuthSessionService } from './oauth-session.service';
+export declare class McpConsentController {
+    private readonly logger;
+    private readonly consentService;
+    private readonly oauthSessionService;
+    constructor(logger: Logger, consentService: McpOAuthConsentService, oauthSessionService: OAuthSessionService);
+    getConsentDetails(req: AuthenticatedRequest, res: Response): Promise<void>;
+    approveConsent(req: AuthenticatedRequest, res: Response, payload: ApproveConsentRequestDto): Promise<void>;
+    private sendErrorResponse;
+    private sendInvalidSessionError;
+    private getAndValidateSessionToken;
+}