@atom8n/n8n 2.2.0

package/dist/node-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-types.js","sourceRoot":"","sources":["../src/node-types.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAAkC;AAGlC,0CAAsC;AACtC,uCAAuC;AAGvC,+CAAuE;AACvE,+BAAqC;AAErC,6EAAuE;AACvE,mCAAoD;AAG7C,IAAM,SAAS,GAAf,MAAM,SAAS;IACrB,YAA6B,uBAAgD;QAAhD,4BAAuB,GAAvB,uBAAuB,CAAyB;IAAG,CAAC;IAKjF,iBAAiB,CAChB,YAAoB,EACpB,OAAe;QAEf,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACpE,MAAM,EAAE,WAAW,EAAE,GAAG,0BAAW,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEjF,OAAO,EAAE,WAAW,EAAE,EAAE,GAAG,WAAW,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;IAC7E,CAAC;IAED,SAAS,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAED,mBAAmB,CAAC,QAAgB,EAAE,OAAgB;QACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC;QAE1B,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAGhD,IAAI,aAAa,IAAI,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC5D,OAAO,0BAAW,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7D,CAAC;QAGD,IAAI,aAAa,EAAE,CAAC;YACnB,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,iBAAiB,GAAG,0BAAW,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/E,IAAI,aAAa,IAAI,OAAO,iBAAiB,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACzE,MAAM,IAAI,8BAAe,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9F,CAAC;QAED,IAAI,IAAA,iCAAyB,EAAC,iBAAiB,CAAC,EAAE,CAAC;YAClD,iBAAiB,CAAC,OAAO,GAAG,KAAK;gBAChC,MAAM,WAAW,GAAG,IAAI,sBAAW,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;gBAC7D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC;gBACzC,OAAO,IAAI,IAAI,EAAE,CAAC;YACnB,CAAC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa;YAAE,OAAO,iBAAiB,CAAC;QAE7C,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,YAAY;YAC9C,MAAM,IAAI,wBAAS,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAE/E,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,uBAAuB,CAAC;QACrD,IAAI,QAAQ,IAAI,WAAW,EAAE,CAAC;YAC7B,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC,IAAiB,CAAC;QAChD,CAAC;QAGD,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CACrC,iBAAiB,CAAC,WAAW,CAAC,UAAU,CACF,CAAC;QACxC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,EAAE;YACtE,UAAU,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE;SACvC,CAAyB,CAAC;QAC3B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE;YACnD,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE;SACzC,CAAc,CAAC;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC1E,WAAW,CAAC,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACb,CAAC;IAED,aAAa;QACZ,OAAO,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,EAC5B,cAAc,EACd,YAAY,EACZ,MAAM,GAKN;QACA,MAAM,OAAO,GAAG,IAAA,cAAO,EAAC,cAAc,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QAE7D,OAAO,UAAU;YAChB,CAAC,CAAC,IAAA,WAAI,EAAC,OAAO,EAAE,IAAI,UAAU,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,QAAQ,OAAO,CAAC;YAC7E,CAAC,CAAC,IAAA,WAAI,EAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;IAC9D,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAW;QACtC,MAAM,OAAO,GAAG,MAAM,IAAA,kBAAO,EAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACtD,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrD,OAAO,GAAG,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QAEP,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAElC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAEO,kBAAkB,CAAC,MAAc;QACxC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;YAAE,OAAO,KAAK,CAAC;QAExC,MAAM,gCAAgC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAEhD,OAAO,CACN,gCAAgC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CACzC,CAAC;IACH,CAAC;IAED,uBAAuB,CAAC,SAA2B;QAClD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE;YACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACpE,MAAM,EAAE,WAAW,EAAE,GAAG,0BAAW,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAEzF,MAAM,eAAe,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;YAG3C,eAAe,CAAC,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;gBAClE,CAAC,CAAC,eAAe,CAAC,IAAI;gBACtB,CAAC,CAAC,kBAAkB,eAAe,CAAC,IAAI,EAAE,CAAC;YAE5C,OAAO,eAAe,CAAC;QACxB,CAAC,CAAC,CAAC;IACJ,CAAC;CACD,CAAA;AAxIY,8BAAS;oBAAT,SAAS;IADrB,IAAA,YAAO,GAAE;qCAE6C,oDAAuB;GADjE,SAAS,CAwIrB"}

package/dist/oauth/oauth.service.d.ts

@@ -0,0 +1,57 @@
+import { Logger } from '@n8n/backend-common';
+import { GlobalConfig } from '@n8n/config';
+import type { AuthenticatedRequest, CredentialsEntity, ICredentialsDb } from '@n8n/db';
+import { CredentialsRepository } from '@n8n/db';
+import type { Response } from 'express';
+import { Cipher } from 'n8n-core';
+import type { ICredentialDataDecryptedObject, IWorkflowExecuteAdditionalData } from 'n8n-workflow';
+import { CredentialsFinderService } from '../credentials/credentials-finder.service';
+import { CredentialsHelper } from '../credentials-helper';
+import type { OAuthRequest } from '../requests';
+import { UrlService } from '../services/url.service';
+import { ExternalHooks } from '../external-hooks';
+import { OauthVersion, type CreateCsrfStateData, type CsrfState, type OAuth1CredentialData } from './types';
+import { DynamicCredentialsProxy } from '../credentials/dynamic-credentials-proxy';
+export declare function shouldSkipAuthOnOAuthCallback(): boolean;
+export declare const skipAuthOnOAuthCallback: boolean;
+export { OauthVersion, type OAuth1CredentialData, type CreateCsrfStateData, type CsrfState };
+export declare class OauthService {
+    protected readonly logger: Logger;
+    private readonly credentialsHelper;
+    private readonly credentialsRepository;
+    private readonly credentialsFinderService;
+    private readonly urlService;
+    private readonly globalConfig;
+    private readonly externalHooks;
+    private readonly cipher;
+    private readonly dynamicCredentialsProxy;
+    constructor(logger: Logger, credentialsHelper: CredentialsHelper, credentialsRepository: CredentialsRepository, credentialsFinderService: CredentialsFinderService, urlService: UrlService, globalConfig: GlobalConfig, externalHooks: ExternalHooks, cipher: Cipher, dynamicCredentialsProxy: DynamicCredentialsProxy);
+    getBaseUrl(oauthVersion: OauthVersion): string;
+    getCredential(req: OAuthRequest.OAuth1Credential.Auth | OAuthRequest.OAuth2Credential.Auth): Promise<CredentialsEntity>;
+    protected getAdditionalData(): Promise<IWorkflowExecuteAdditionalData>;
+    protected getDecryptedDataForAuthUri(credential: ICredentialsDb, additionalData: IWorkflowExecuteAdditionalData): Promise<ICredentialDataDecryptedObject>;
+    protected getDecryptedDataForCallback(credential: ICredentialsDb, additionalData: IWorkflowExecuteAdditionalData): Promise<ICredentialDataDecryptedObject>;
+    private getDecryptedData;
+    protected applyDefaultsAndOverwrites<T>(credential: ICredentialsDb, decryptedData: ICredentialDataDecryptedObject, additionalData: IWorkflowExecuteAdditionalData): Promise<T>;
+    encryptAndSaveData(credential: ICredentialsDb, toUpdate: ICredentialDataDecryptedObject, toDelete?: string[]): Promise<void>;
+    protected getCredentialWithoutUser(credentialId: string): Promise<CredentialsEntity | null>;
+    createCsrfState(data: CreateCsrfStateData): [string, string];
+    protected decodeCsrfState(encodedState: string, req: AuthenticatedRequest): CsrfState & CreateCsrfStateData;
+    protected verifyCsrfState(decrypted: ICredentialDataDecryptedObject & {
+        csrfSecret?: string;
+    }, state: CsrfState): boolean;
+    resolveCredential<T>(req: OAuthRequest.OAuth1Credential.Callback | OAuthRequest.OAuth2Credential.Callback): Promise<[
+        CredentialsEntity,
+        ICredentialDataDecryptedObject,
+        T,
+        CsrfState & CreateCsrfStateData
+    ]>;
+    renderCallbackError(res: Response, message: string, reason?: string): void;
+    getOAuthCredentials<T>(credential: CredentialsEntity): Promise<T>;
+    generateAOauth2AuthUri(credential: CredentialsEntity, csrfData: CreateCsrfStateData): Promise<string>;
+    generateAOauth1AuthUri(credential: CredentialsEntity, csrfData: CreateCsrfStateData): Promise<string>;
+    private convertCredentialToOptions;
+    private selectGrantTypeAndAuthenticationMethod;
+    private mapGrantTypeAndAuthenticationMethod;
+    saveDynamicCredential(credential: CredentialsEntity, oauthTokenData: ICredentialDataDecryptedObject, authHeader: string, credentialResolverId: string): Promise<void>;
+}

package/dist/oauth/oauth.service.js

@@ -0,0 +1,425 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OauthService = exports.OauthVersion = exports.skipAuthOnOAuthCallback = void 0;
+exports.shouldSkipAuthOnOAuthCallback = shouldSkipAuthOnOAuthCallback;
+const backend_common_1 = require("@n8n/backend-common");
+const config_1 = require("@n8n/config");
+const db_1 = require("@n8n/db");
+const di_1 = require("@n8n/di");
+const csrf_1 = __importDefault(require("csrf"));
+const n8n_core_1 = require("n8n-core");
+const n8n_workflow_1 = require("n8n-workflow");
+const constants_1 = require("../constants");
+const credentials_finder_service_1 = require("../credentials/credentials-finder.service");
+const credentials_helper_1 = require("../credentials-helper");
+const auth_error_1 = require("../errors/response-errors/auth.error");
+const bad_request_error_1 = require("../errors/response-errors/bad-request.error");
+const not_found_error_1 = require("../errors/response-errors/not-found.error");
+const url_service_1 = require("../services/url.service");
+const WorkflowExecuteAdditionalData = __importStar(require("../workflow-execute-additional-data"));
+const client_oauth2_1 = require("@n8n/client-oauth2");
+const axios_1 = __importDefault(require("axios"));
+const oauth2_dynamic_client_registration_schema_1 = require("../controllers/oauth/oauth2-dynamic-client-registration.schema");
+const pkce_challenge_1 = __importDefault(require("pkce-challenge"));
+const qs = __importStar(require("querystring"));
+const split_1 = __importDefault(require("lodash/split"));
+const external_hooks_1 = require("../external-hooks");
+const crypto_1 = require("crypto");
+const oauth_1_0a_1 = __importDefault(require("oauth-1.0a"));
+const types_1 = require("./types");
+Object.defineProperty(exports, "OauthVersion", { enumerable: true, get: function () { return types_1.OauthVersion; } });
+const dynamic_credentials_proxy_1 = require("../credentials/dynamic-credentials-proxy");
+function shouldSkipAuthOnOAuthCallback() {
+    const value = process.env.N8N_SKIP_AUTH_ON_OAUTH_CALLBACK?.toLowerCase() ?? 'false';
+    return value === 'true';
+}
+exports.skipAuthOnOAuthCallback = shouldSkipAuthOnOAuthCallback();
+let OauthService = class OauthService {
+    constructor(logger, credentialsHelper, credentialsRepository, credentialsFinderService, urlService, globalConfig, externalHooks, cipher, dynamicCredentialsProxy) {
+        this.logger = logger;
+        this.credentialsHelper = credentialsHelper;
+        this.credentialsRepository = credentialsRepository;
+        this.credentialsFinderService = credentialsFinderService;
+        this.urlService = urlService;
+        this.globalConfig = globalConfig;
+        this.externalHooks = externalHooks;
+        this.cipher = cipher;
+        this.dynamicCredentialsProxy = dynamicCredentialsProxy;
+    }
+    getBaseUrl(oauthVersion) {
+        const restUrl = `${this.urlService.getInstanceBaseUrl()}/${this.globalConfig.endpoints.rest}`;
+        return `${restUrl}/oauth${oauthVersion}-credential`;
+    }
+    async getCredential(req) {
+        const { id: credentialId } = req.query;
+        if (!credentialId) {
+            throw new bad_request_error_1.BadRequestError('Required credential ID is missing');
+        }
+        const credential = await this.credentialsFinderService.findCredentialForUser(credentialId, req.user, ['credential:read']);
+        if (!credential) {
+            this.logger.error('OAuth credential authorization failed because the current user does not have the correct permissions', { userId: req.user.id });
+            throw new not_found_error_1.NotFoundError(constants_1.RESPONSE_ERROR_MESSAGES.NO_CREDENTIAL);
+        }
+        return credential;
+    }
+    async getAdditionalData() {
+        return await WorkflowExecuteAdditionalData.getBase();
+    }
+    async getDecryptedDataForAuthUri(credential, additionalData) {
+        return await this.getDecryptedData(credential, additionalData, false);
+    }
+    async getDecryptedDataForCallback(credential, additionalData) {
+        return await this.getDecryptedData(credential, additionalData, true);
+    }
+    async getDecryptedData(credential, additionalData, raw) {
+        return await this.credentialsHelper.getDecrypted(additionalData, credential, credential.type, 'internal', undefined, raw);
+    }
+    async applyDefaultsAndOverwrites(credential, decryptedData, additionalData) {
+        return (await this.credentialsHelper.applyDefaultsAndOverwrites(additionalData, decryptedData, credential, credential.type, 'internal', undefined, undefined));
+    }
+    async encryptAndSaveData(credential, toUpdate, toDelete = []) {
+        const credentials = new n8n_core_1.Credentials(credential, credential.type, credential.data);
+        credentials.updateData(toUpdate, toDelete);
+        await this.credentialsRepository.update(credential.id, {
+            ...credentials.getDataToSave(),
+            updatedAt: new Date(),
+        });
+    }
+    async getCredentialWithoutUser(credentialId) {
+        return await this.credentialsRepository.findOneBy({ id: credentialId });
+    }
+    createCsrfState(data) {
+        const token = new csrf_1.default();
+        const csrfSecret = token.secretSync();
+        const state = {
+            token: token.create(csrfSecret),
+            createdAt: Date.now(),
+            data: this.cipher.encrypt(JSON.stringify(data)),
+        };
+        const base64State = Buffer.from(JSON.stringify(state)).toString('base64');
+        return [csrfSecret, base64State];
+    }
+    decodeCsrfState(encodedState, req) {
+        const errorMessage = 'Invalid state format';
+        const decodedState = Buffer.from(encodedState, 'base64').toString();
+        const decoded = (0, n8n_workflow_1.jsonParse)(decodedState, {
+            errorMessage,
+        });
+        const decryptedState = (0, n8n_workflow_1.jsonParse)(this.cipher.decrypt(decoded.data), {
+            errorMessage,
+        });
+        if (typeof decryptedState.cid !== 'string' || typeof decoded.token !== 'string') {
+            throw new n8n_workflow_1.UnexpectedError(errorMessage);
+        }
+        if (decryptedState.origin === 'dynamic-credential') {
+            return {
+                ...decoded,
+                ...decryptedState,
+            };
+        }
+        if (!exports.skipAuthOnOAuthCallback && decryptedState.userId !== req.user?.id) {
+            throw new auth_error_1.AuthError('Unauthorized');
+        }
+        return {
+            ...decoded,
+            ...decryptedState,
+        };
+    }
+    verifyCsrfState(decrypted, state) {
+        const token = new csrf_1.default();
+        return (Date.now() - state.createdAt <= types_1.MAX_CSRF_AGE &&
+            decrypted.csrfSecret !== undefined &&
+            token.verify(decrypted.csrfSecret, state.token));
+    }
+    async resolveCredential(req) {
+        const { state: encodedState } = req.query;
+        const state = this.decodeCsrfState(encodedState, req);
+        const credential = await this.getCredentialWithoutUser(state.cid);
+        if (!credential) {
+            throw new n8n_workflow_1.UnexpectedError('OAuth callback failed because of insufficient permissions');
+        }
+        const additionalData = await this.getAdditionalData();
+        const decryptedDataOriginal = await this.getDecryptedDataForCallback(credential, additionalData);
+        const oauthCredentials = await this.applyDefaultsAndOverwrites(credential, decryptedDataOriginal, additionalData);
+        if (!this.verifyCsrfState(decryptedDataOriginal, state)) {
+            throw new n8n_workflow_1.UnexpectedError('The OAuth callback state is invalid!');
+        }
+        return [credential, decryptedDataOriginal, oauthCredentials, state];
+    }
+    renderCallbackError(res, message, reason) {
+        res.render('oauth-error-callback', { error: { message, reason } });
+    }
+    async getOAuthCredentials(credential) {
+        const additionalData = await this.getAdditionalData();
+        const decryptedDataOriginal = await this.getDecryptedDataForAuthUri(credential, additionalData);
+        if (decryptedDataOriginal?.scope &&
+            credential.type.includes('OAuth2') &&
+            !constants_1.GENERIC_OAUTH2_CREDENTIALS_WITH_EDITABLE_SCOPE.includes(credential.type)) {
+            delete decryptedDataOriginal.scope;
+        }
+        const oauthCredentials = await this.applyDefaultsAndOverwrites(credential, decryptedDataOriginal, additionalData);
+        return oauthCredentials;
+    }
+    async generateAOauth2AuthUri(credential, csrfData) {
+        const oauthCredentials = await this.getOAuthCredentials(credential);
+        const toUpdate = {};
+        if (oauthCredentials.useDynamicClientRegistration && oauthCredentials.serverUrl) {
+            const serverUrl = new URL(oauthCredentials.serverUrl);
+            const { data } = await axios_1.default.get(`${serverUrl.origin}/.well-known/oauth-authorization-server`);
+            const metadataValidation = oauth2_dynamic_client_registration_schema_1.oAuthAuthorizationServerMetadataSchema.safeParse(data);
+            if (!metadataValidation.success) {
+                throw new bad_request_error_1.BadRequestError(`Invalid OAuth2 server metadata: ${metadataValidation.error.issues.map((e) => e.message).join(', ')}`);
+            }
+            const { authorization_endpoint, token_endpoint, registration_endpoint, scopes_supported } = metadataValidation.data;
+            oauthCredentials.authUrl = authorization_endpoint;
+            oauthCredentials.accessTokenUrl = token_endpoint;
+            toUpdate.authUrl = authorization_endpoint;
+            toUpdate.accessTokenUrl = token_endpoint;
+            const scope = scopes_supported ? scopes_supported.join(' ') : undefined;
+            if (scope) {
+                oauthCredentials.scope = scope;
+                toUpdate.scope = scope;
+            }
+            const { grantType, authentication } = this.selectGrantTypeAndAuthenticationMethod(metadataValidation.data.grant_types_supported ?? ['authorization_code', 'implicit'], metadataValidation.data.token_endpoint_auth_methods_supported ?? ['client_secret_basic'], metadataValidation.data.code_challenge_methods_supported ?? []);
+            oauthCredentials.grantType = grantType;
+            toUpdate.grantType = grantType;
+            if (authentication) {
+                oauthCredentials.authentication = authentication;
+                toUpdate.authentication = authentication;
+            }
+            const { grant_types, token_endpoint_auth_method } = this.mapGrantTypeAndAuthenticationMethod(grantType, authentication);
+            const registerPayload = {
+                redirect_uris: [`${this.getBaseUrl(2)}/callback`],
+                token_endpoint_auth_method,
+                grant_types,
+                response_types: ['code'],
+                client_name: 'n8n',
+                client_uri: 'https://n8n.io/',
+                scope,
+            };
+            await this.externalHooks.run('oauth2.dynamicClientRegistration', [registerPayload]);
+            const { data: registerResult } = await axios_1.default.post(registration_endpoint, registerPayload);
+            const registrationValidation = oauth2_dynamic_client_registration_schema_1.dynamicClientRegistrationResponseSchema.safeParse(registerResult);
+            if (!registrationValidation.success) {
+                throw new bad_request_error_1.BadRequestError(`Invalid client registration response: ${registrationValidation.error.issues.map((e) => e.message).join(', ')}`);
+            }
+            const { client_id, client_secret } = registrationValidation.data;
+            oauthCredentials.clientId = client_id;
+            toUpdate.clientId = client_id;
+            if (client_secret) {
+                oauthCredentials.clientSecret = client_secret;
+                toUpdate.clientSecret = client_secret;
+            }
+        }
+        const [csrfSecret, state] = this.createCsrfState(csrfData);
+        const oAuthOptions = {
+            ...this.convertCredentialToOptions(oauthCredentials),
+            state,
+        };
+        if (oauthCredentials.authQueryParameters) {
+            oAuthOptions.query = qs.parse(oauthCredentials.authQueryParameters);
+        }
+        await this.externalHooks.run('oauth2.authenticate', [oAuthOptions]);
+        toUpdate.csrfSecret = csrfSecret;
+        if (oauthCredentials.grantType === 'pkce') {
+            const { code_verifier, code_challenge } = await (0, pkce_challenge_1.default)();
+            oAuthOptions.query = {
+                ...oAuthOptions.query,
+                code_challenge,
+                code_challenge_method: 'S256',
+            };
+            toUpdate.codeVerifier = code_verifier;
+        }
+        await this.encryptAndSaveData(credential, toUpdate);
+        const oAuthObj = new client_oauth2_1.ClientOAuth2(oAuthOptions);
+        const returnUri = oAuthObj.code.getUri();
+        this.logger.debug('OAuth2 authorization url created for credential', {
+            csrfData,
+            credentialId: credential.id,
+        });
+        return returnUri.toString();
+    }
+    async generateAOauth1AuthUri(credential, csrfData) {
+        const oauthCredentials = await this.getOAuthCredentials(credential);
+        const [csrfSecret, state] = this.createCsrfState(csrfData);
+        const signatureMethod = oauthCredentials.signatureMethod;
+        const oAuthOptions = {
+            consumer: {
+                key: oauthCredentials.consumerKey,
+                secret: oauthCredentials.consumerSecret,
+            },
+            signature_method: signatureMethod,
+            hash_function(base, key) {
+                const algorithm = types_1.algorithmMap[signatureMethod] ?? 'sha1';
+                return (0, crypto_1.createHmac)(algorithm, key).update(base).digest('base64');
+            },
+        };
+        const oauthRequestData = {
+            oauth_callback: `${this.getBaseUrl(1)}/callback?state=${state}`,
+        };
+        await this.externalHooks.run('oauth1.authenticate', [oAuthOptions, oauthRequestData]);
+        const oauth = new oauth_1_0a_1.default(oAuthOptions);
+        const options = {
+            method: 'POST',
+            url: oauthCredentials.requestTokenUrl,
+            data: oauthRequestData,
+        };
+        const data = oauth.toHeader(oauth.authorize(options));
+        const axiosConfig = {
+            method: options.method,
+            url: options.url,
+            headers: {
+                ...data,
+            },
+        };
+        const { data: response } = await axios_1.default.request(axiosConfig);
+        if (typeof response !== 'string') {
+            throw new bad_request_error_1.BadRequestError('Expected string response from OAuth1 request token endpoint, but received invalid response type');
+        }
+        const paramsParser = new URLSearchParams(response);
+        const responseJson = Object.fromEntries(paramsParser.entries());
+        if (!responseJson.oauth_token) {
+            throw new bad_request_error_1.BadRequestError('OAuth1 request token response is missing required oauth_token parameter');
+        }
+        const returnUri = `${oauthCredentials.authUrl}?oauth_token=${responseJson.oauth_token}`;
+        await this.encryptAndSaveData(credential, { csrfSecret }, []);
+        this.logger.debug('OAuth1 authorization url created for credential', {
+            csrfData,
+            credentialId: credential.id,
+        });
+        return returnUri;
+    }
+    convertCredentialToOptions(credential) {
+        const options = {
+            clientId: credential.clientId,
+            clientSecret: credential.clientSecret ?? '',
+            accessTokenUri: credential.accessTokenUrl ?? '',
+            authorizationUri: credential.authUrl ?? '',
+            authentication: credential.authentication ?? 'header',
+            redirectUri: `${this.getBaseUrl(2)}/callback`,
+            scopes: (0, split_1.default)(credential.scope ?? 'openid', ','),
+            scopesSeparator: credential.scope?.includes(',') ? ',' : ' ',
+            ignoreSSLIssues: credential.ignoreSSLIssues ?? false,
+        };
+        if (credential.additionalBodyProperties &&
+            typeof credential.additionalBodyProperties === 'string') {
+            const parsedBody = (0, n8n_workflow_1.jsonParse)(credential.additionalBodyProperties);
+            if (parsedBody) {
+                options.body = parsedBody;
+            }
+        }
+        return options;
+    }
+    selectGrantTypeAndAuthenticationMethod(grantTypes, tokenEndpointAuthMethods, codeChallengeMethods) {
+        if (grantTypes.includes('authorization_code') && grantTypes.includes('refresh_token')) {
+            if (codeChallengeMethods.includes('S256')) {
+                return { grantType: 'pkce' };
+            }
+            if (tokenEndpointAuthMethods.includes('client_secret_basic')) {
+                return { grantType: 'authorizationCode', authentication: 'header' };
+            }
+            if (tokenEndpointAuthMethods.includes('client_secret_post')) {
+                return { grantType: 'authorizationCode', authentication: 'body' };
+            }
+        }
+        if (grantTypes.includes('client_credentials')) {
+            if (tokenEndpointAuthMethods.includes('client_secret_basic')) {
+                return { grantType: 'clientCredentials', authentication: 'header' };
+            }
+            if (tokenEndpointAuthMethods.includes('client_secret_post')) {
+                return { grantType: 'clientCredentials', authentication: 'body' };
+            }
+        }
+        throw new bad_request_error_1.BadRequestError('No supported grant type and authentication method found');
+    }
+    mapGrantTypeAndAuthenticationMethod(grantType, authentication) {
+        if (grantType === 'pkce') {
+            return {
+                grant_types: ['authorization_code', 'refresh_token'],
+                token_endpoint_auth_method: 'none',
+            };
+        }
+        const tokenEndpointAuthMethod = authentication === 'header' ? 'client_secret_basic' : 'client_secret_post';
+        if (grantType === 'authorizationCode') {
+            return {
+                grant_types: ['authorization_code', 'refresh_token'],
+                token_endpoint_auth_method: tokenEndpointAuthMethod,
+            };
+        }
+        return {
+            grant_types: ['client_credentials'],
+            token_endpoint_auth_method: tokenEndpointAuthMethod,
+        };
+    }
+    async saveDynamicCredential(credential, oauthTokenData, authHeader, credentialResolverId) {
+        const credentials = new n8n_core_1.Credentials(credential, credential.type, credential.data);
+        credentials.updateData(oauthTokenData, ['csrfSecret']);
+        const credentialStoreMetadata = {
+            id: credential.id,
+            name: credential.name,
+            type: credential.type,
+            isResolvable: credential.isResolvable,
+            resolverId: credentialResolverId,
+        };
+        await this.dynamicCredentialsProxy.storeIfNeeded(credentialStoreMetadata, oauthTokenData, { version: 1, identity: authHeader }, credentials.getData(), { credentialResolverId });
+    }
+};
+exports.OauthService = OauthService;
+exports.OauthService = OauthService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [backend_common_1.Logger,
+        credentials_helper_1.CredentialsHelper,
+        db_1.CredentialsRepository,
+        credentials_finder_service_1.CredentialsFinderService,
+        url_service_1.UrlService,
+        config_1.GlobalConfig,
+        external_hooks_1.ExternalHooks,
+        n8n_core_1.Cipher,
+        dynamic_credentials_proxy_1.DynamicCredentialsProxy])
+], OauthService);
+//# sourceMappingURL=oauth.service.js.map

package/dist/oauth/oauth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.service.js","sourceRoot":"","sources":["../../src/oauth/oauth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDA,sEAGC;AAzDD,wDAA6C;AAC7C,wCAA2C;AAE3C,gCAAgD;AAChD,gCAAkC;AAClC,gDAAwB;AAExB,uCAA+C;AAE/C,+CAA0D;AAE1D,2CAGqB;AACrB,yFAAoF;AACpF,6DAAyD;AACzD,oEAAgE;AAChE,kFAA6E;AAC7E,8EAAyE;AAEzE,wDAAoD;AACpD,kGAAoF;AACpF,sDAM4B;AAC5B,kDAA0B;AAC1B,6HAGuE;AACvE,oEAA2C;AAC3C,gDAAkC;AAClC,yDAAiC;AACjC,qDAAiD;AAEjD,mCAAoC;AAEpC,4DAAsC;AACtC,mCAOiB;AAWR,6FAfR,oBAAY,OAeQ;AATrB,uFAAkF;AAElF,SAAgB,6BAA6B;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,WAAW,EAAE,IAAI,OAAO,CAAC;IACpF,OAAO,KAAK,KAAK,MAAM,CAAC;AACzB,CAAC;AAEY,QAAA,uBAAuB,GAAG,6BAA6B,EAAE,CAAC;AAKhE,IAAM,YAAY,GAAlB,MAAM,YAAY;IACxB,YACoB,MAAc,EAChB,iBAAoC,EACpC,qBAA4C,EAC5C,wBAAkD,EAClD,UAAsB,EACtB,YAA0B,EAC1B,aAA4B,EAC5B,MAAc,EACd,uBAAgD;QAR9C,WAAM,GAAN,MAAM,CAAQ;QAChB,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,eAAU,GAAV,UAAU,CAAY;QACtB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,kBAAa,GAAb,aAAa,CAAe;QAC5B,WAAM,GAAN,MAAM,CAAQ;QACd,4BAAuB,GAAvB,uBAAuB,CAAyB;IAC/D,CAAC;IAEJ,UAAU,CAAC,YAA0B;QACpC,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC9F,OAAO,GAAG,OAAO,SAAS,YAAY,aAAa,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,aAAa,CAClB,GAA4E;QAE5E,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;QAEvC,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,MAAM,IAAI,mCAAe,CAAC,mCAAmC,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,qBAAqB,CAC3E,YAAY,EACZ,GAAG,CAAC,IAAI,EACR,CAAC,iBAAiB,CAAC,CACnB,CAAC;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,sGAAsG,EACtG,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CACvB,CAAC;YACF,MAAM,IAAI,+BAAa,CAAC,mCAAuB,CAAC,aAAa,CAAC,CAAC;QAChE,CAAC;QAED,OAAO,UAAU,CAAC;IACnB,CAAC;IAES,KAAK,CAAC,iBAAiB;QAChC,OAAO,MAAM,6BAA6B,CAAC,OAAO,EAAE,CAAC;IACtD,CAAC;IAKS,KAAK,CAAC,0BAA0B,CACzC,UAA0B,EAC1B,cAA8C;QAE9C,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;IACvE,CAAC;IAKS,KAAK,CAAC,2BAA2B,CAC1C,UAA0B,EAC1B,cAA8C;QAE9C,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IACtE,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC7B,UAA0B,EAC1B,cAA8C,EAC9C,GAAY;QAEZ,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAC/C,cAAc,EACd,UAAU,EACV,UAAU,CAAC,IAAI,EACf,UAAU,EACV,SAAS,EACT,GAAG,CACH,CAAC;IACH,CAAC;IAES,KAAK,CAAC,0BAA0B,CACzC,UAA0B,EAC1B,aAA6C,EAC7C,cAA8C;QAE9C,OAAO,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,0BAA0B,CAC9D,cAAc,EACd,aAAa,EACb,UAAU,EACV,UAAU,CAAC,IAAI,EACf,UAAU,EACV,SAAS,EACT,SAAS,CACT,CAAiB,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,kBAAkB,CACvB,UAA0B,EAC1B,QAAwC,EACxC,WAAqB,EAAE;QAEvB,MAAM,WAAW,GAAG,IAAI,sBAAW,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QAClF,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE;YACtD,GAAG,WAAW,CAAC,aAAa,EAAE;YAC9B,SAAS,EAAE,IAAI,IAAI,EAAE;SACrB,CAAC,CAAC;IACJ,CAAC;IAGS,KAAK,CAAC,wBAAwB,CACvC,YAAoB;QAEpB,OAAO,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,eAAe,CAAC,IAAyB;QACxC,MAAM,KAAK,GAAG,IAAI,cAAI,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,KAAK,GAAc;YACxB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;SAC/C,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1E,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAClC,CAAC;IAES,eAAe,CACxB,YAAoB,EACpB,GAAyB;QAEzB,MAAM,YAAY,GAAG,sBAAsB,CAAC;QAC5C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;QACpE,MAAM,OAAO,GAAG,IAAA,wBAAS,EAAY,YAAY,EAAE;YAClD,YAAY;SACZ,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,IAAA,wBAAS,EAAsB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YACxF,YAAY;SACZ,CAAC,CAAC;QAEH,IAAI,OAAO,cAAc,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACjF,MAAM,IAAI,8BAAe,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QAGD,IAAI,cAAc,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;YACpD,OAAO;gBACN,GAAG,OAAO;gBACV,GAAG,cAAc;aACjB,CAAC;QACH,CAAC;QAGD,IAAI,CAAC,+BAAuB,IAAI,cAAc,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YACxE,MAAM,IAAI,sBAAS,CAAC,cAAc,CAAC,CAAC;QACrC,CAAC;QAED,OAAO;YACN,GAAG,OAAO;YACV,GAAG,cAAc;SACjB,CAAC;IACH,CAAC;IAES,eAAe,CACxB,SAAmE,EACnE,KAAgB;QAEhB,MAAM,KAAK,GAAG,IAAI,cAAI,EAAE,CAAC;QAEzB,OAAO,CACN,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,IAAI,oBAAY;YAC5C,SAAS,CAAC,UAAU,KAAK,SAAS;YAClC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAC/C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CACtB,GAAoF;QAIpF,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,IAAI,8BAAe,CAAC,2DAA2D,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACtD,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CACnE,UAAU,EACV,cAAc,CACd,CAAC;QAEF,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAC7D,UAAU,EACV,qBAAqB,EACrB,cAAc,CACd,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,qBAAqB,EAAE,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,8BAAe,CAAC,sCAAsC,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,CAAC,UAAU,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IAED,mBAAmB,CAAC,GAAa,EAAE,OAAe,EAAE,MAAe;QAClE,GAAG,CAAC,MAAM,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAI,UAA6B;QACzD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACtD,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAKhG,IACC,qBAAqB,EAAE,KAAK;YAC5B,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAClC,CAAC,0DAA8C,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EACxE,CAAC;YACF,OAAO,qBAAqB,CAAC,KAAK,CAAC;QACpC,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAC7D,UAAU,EACV,qBAAqB,EACrB,cAAc,CACd,CAAC;QAEF,OAAO,gBAAgB,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC3B,UAA6B,EAC7B,QAA6B;QAE7B,MAAM,gBAAgB,GACrB,MAAM,IAAI,CAAC,mBAAmB,CAAuB,UAAU,CAAC,CAAC;QAElE,MAAM,QAAQ,GAAmC,EAAE,CAAC;QAEpD,IAAI,gBAAgB,CAAC,4BAA4B,IAAI,gBAAgB,CAAC,SAAS,EAAE,CAAC;YACjF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,eAAK,CAAC,GAAG,CAC/B,GAAG,SAAS,CAAC,MAAM,yCAAyC,CAC5D,CAAC;YACF,MAAM,kBAAkB,GAAG,kFAAsC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClF,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC;gBACjC,MAAM,IAAI,mCAAe,CACxB,mCAAmC,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrG,CAAC;YACH,CAAC;YAED,MAAM,EAAE,sBAAsB,EAAE,cAAc,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,GACxF,kBAAkB,CAAC,IAAI,CAAC;YACzB,gBAAgB,CAAC,OAAO,GAAG,sBAAsB,CAAC;YAClD,gBAAgB,CAAC,cAAc,GAAG,cAAc,CAAC;YACjD,QAAQ,CAAC,OAAO,GAAG,sBAAsB,CAAC;YAC1C,QAAQ,CAAC,cAAc,GAAG,cAAc,CAAC;YACzC,MAAM,KAAK,GAAG,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxE,IAAI,KAAK,EAAE,CAAC;gBACX,gBAAgB,CAAC,KAAK,GAAG,KAAK,CAAC;gBAC/B,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;YACxB,CAAC;YAED,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,sCAAsC,CAChF,kBAAkB,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,oBAAoB,EAAE,UAAU,CAAC,EACnF,kBAAkB,CAAC,IAAI,CAAC,qCAAqC,IAAI,CAAC,qBAAqB,CAAC,EACxF,kBAAkB,CAAC,IAAI,CAAC,gCAAgC,IAAI,EAAE,CAC9D,CAAC;YACF,gBAAgB,CAAC,SAAS,GAAG,SAAS,CAAC;YACvC,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;YAC/B,IAAI,cAAc,EAAE,CAAC;gBACpB,gBAAgB,CAAC,cAAc,GAAG,cAAc,CAAC;gBACjD,QAAQ,CAAC,cAAc,GAAG,cAAc,CAAC;YAC1C,CAAC;YAED,MAAM,EAAE,WAAW,EAAE,0BAA0B,EAAE,GAAG,IAAI,CAAC,mCAAmC,CAC3F,SAAS,EACT,cAAc,CACd,CAAC;YACF,MAAM,eAAe,GAAG;gBACvB,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,GAAiB,WAAW,CAAC;gBAC/D,0BAA0B;gBAC1B,WAAW;gBACX,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,WAAW,EAAE,KAAK;gBAClB,UAAU,EAAE,iBAAiB;gBAC7B,KAAK;aACL,CAAC;YAEF,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,kCAAkC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;YAEpF,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,MAAM,eAAK,CAAC,IAAI,CAChD,qBAAqB,EACrB,eAAe,CACf,CAAC;YACF,MAAM,sBAAsB,GAC3B,mFAAuC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;YACnE,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,CAAC;gBACrC,MAAM,IAAI,mCAAe,CACxB,yCAAyC,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/G,CAAC;YACH,CAAC;YAED,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,sBAAsB,CAAC,IAAI,CAAC;YACjE,gBAAgB,CAAC,QAAQ,GAAG,SAAS,CAAC;YACtC,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC9B,IAAI,aAAa,EAAE,CAAC;gBACnB,gBAAgB,CAAC,YAAY,GAAG,aAAa,CAAC;gBAC9C,QAAQ,CAAC,YAAY,GAAG,aAAa,CAAC;YACvC,CAAC;QACF,CAAC;QAGD,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAE3D,MAAM,YAAY,GAAG;YACpB,GAAG,IAAI,CAAC,0BAA0B,CAAC,gBAAgB,CAAC;YACpD,KAAK;SACL,CAAC;QAEF,IAAI,gBAAgB,CAAC,mBAAmB,EAAE,CAAC;YAC1C,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAEpE,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;QACjC,IAAI,gBAAgB,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAC3C,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,MAAM,IAAA,wBAAa,GAAE,CAAC;YAChE,YAAY,CAAC,KAAK,GAAG;gBACpB,GAAG,YAAY,CAAC,KAAK;gBACrB,cAAc;gBACd,qBAAqB,EAAE,MAAM;aAC7B,CAAC;YACF,QAAQ,CAAC,YAAY,GAAG,aAAa,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEpD,MAAM,QAAQ,GAAG,IAAI,4BAAY,CAAC,YAAY,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAEzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,EAAE;YACpE,QAAQ;YACR,YAAY,EAAE,UAAU,CAAC,EAAE;SAC3B,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC3B,UAA6B,EAC7B,QAA6B;QAE7B,MAAM,gBAAgB,GACrB,MAAM,IAAI,CAAC,mBAAmB,CAAuB,UAAU,CAAC,CAAC;QAElE,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAE3D,MAAM,eAAe,GAAG,gBAAgB,CAAC,eAAe,CAAC;QAEzD,MAAM,YAAY,GAAyB;YAC1C,QAAQ,EAAE;gBACT,GAAG,EAAE,gBAAgB,CAAC,WAAW;gBACjC,MAAM,EAAE,gBAAgB,CAAC,cAAc;aACvC;YACD,gBAAgB,EAAE,eAAe;YAEjC,aAAa,CAAC,IAAI,EAAE,GAAG;gBACtB,MAAM,SAAS,GAAG,oBAAY,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC;gBAC1D,OAAO,IAAA,mBAAU,EAAC,SAAS,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACjE,CAAC;SACD,CAAC;QAEF,MAAM,gBAAgB,GAAG;YACxB,cAAc,EAAE,GAAG,IAAI,CAAC,UAAU,GAAiB,mBAAmB,KAAK,EAAE;SAC7E,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAEtF,MAAM,KAAK,GAAG,IAAI,oBAAY,CAAC,YAAY,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAmB;YAC/B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,gBAAgB,CAAC,eAAe;YACrC,IAAI,EAAE,gBAAgB;SACtB,CAAC;QAEF,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAEtD,MAAM,WAAW,GAAuB;YACvC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE;gBACR,GAAG,IAAI;aACP;SACD,CAAC;QAEF,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAG5D,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,mCAAe,CACxB,iGAAiG,CACjG,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QAEhE,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;YAC/B,MAAM,IAAI,mCAAe,CACxB,yEAAyE,CACzE,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,gBAAgB,CAAC,OAAO,gBAAgB,YAAY,CAAC,WAAW,EAAE,CAAC;QAExF,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QAE9D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,EAAE;YACpE,QAAQ;YACR,YAAY,EAAE,UAAU,CAAC,EAAE;SAC3B,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IAClB,CAAC;IAEO,0BAA0B,CAAC,UAAgC;QAClE,MAAM,OAAO,GAAwB;YACpC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,YAAY,EAAE,UAAU,CAAC,YAAY,IAAI,EAAE;YAC3C,cAAc,EAAE,UAAU,CAAC,cAAc,IAAI,EAAE;YAC/C,gBAAgB,EAAE,UAAU,CAAC,OAAO,IAAI,EAAE;YAC1C,cAAc,EAAE,UAAU,CAAC,cAAc,IAAI,QAAQ;YACrD,WAAW,EAAE,GAAG,IAAI,CAAC,UAAU,GAAiB,WAAW;YAC3D,MAAM,EAAE,IAAA,eAAK,EAAC,UAAU,CAAC,KAAK,IAAI,QAAQ,EAAE,GAAG,CAAC;YAChD,eAAe,EAAE,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;YAC5D,eAAe,EAAE,UAAU,CAAC,eAAe,IAAI,KAAK;SACpD,CAAC;QAEF,IACC,UAAU,CAAC,wBAAwB;YACnC,OAAO,UAAU,CAAC,wBAAwB,KAAK,QAAQ,EACtD,CAAC;YACF,MAAM,UAAU,GAAG,IAAA,wBAAS,EAAyB,UAAU,CAAC,wBAAwB,CAAC,CAAC;YAE1F,IAAI,UAAU,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC;YAC3B,CAAC;QACF,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,sCAAsC,CAC7C,UAAoB,EACpB,wBAAkC,EAClC,oBAA8B;QAE9B,IAAI,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACvF,IAAI,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YAC9B,CAAC;YAED,IAAI,wBAAwB,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBAC9D,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;YACrE,CAAC;YAED,IAAI,wBAAwB,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC7D,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;YACnE,CAAC;QACF,CAAC;QAED,IAAI,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC/C,IAAI,wBAAwB,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBAC9D,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;YACrE,CAAC;YAED,IAAI,wBAAwB,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC7D,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;YACnE,CAAC;QACF,CAAC;QAED,MAAM,IAAI,mCAAe,CAAC,yDAAyD,CAAC,CAAC;IACtF,CAAC;IAEO,mCAAmC,CAC1C,SAA0B,EAC1B,cAA2C;QAE3C,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;YAC1B,OAAO;gBACN,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACpD,0BAA0B,EAAE,MAAM;aAClC,CAAC;QACH,CAAC;QAED,MAAM,uBAAuB,GAC5B,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAC5E,IAAI,SAAS,KAAK,mBAAmB,EAAE,CAAC;YACvC,OAAO;gBACN,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACpD,0BAA0B,EAAE,uBAAuB;aACnD,CAAC;QACH,CAAC;QAED,OAAO;YACN,WAAW,EAAE,CAAC,oBAAoB,CAAC;YACnC,0BAA0B,EAAE,uBAAuB;SACnD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,qBAAqB,CAC1B,UAA6B,EAC7B,cAA8C,EAC9C,UAAkB,EAClB,oBAA4B;QAE5B,MAAM,WAAW,GAAG,IAAI,sBAAW,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QAClF,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAEvD,MAAM,uBAAuB,GAA4B;YACxD,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,UAAU,EAAE,oBAAoB;SAChC,CAAC;QAEF,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAC/C,uBAAuB,EACvB,cAAc,EAEd,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,EACpC,WAAW,CAAC,OAAO,EAAE,EACrB,EAAE,oBAAoB,EAAE,CACxB,CAAC;IACH,CAAC;CACD,CAAA;AAtiBY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,YAAO,GAAE;qCAGmB,uBAAM;QACG,sCAAiB;QACb,0BAAqB;QAClB,qDAAwB;QACtC,wBAAU;QACR,qBAAY;QACX,8BAAa;QACpB,iBAAM;QACW,mDAAuB;GAVtD,YAAY,CAsiBxB"}

package/dist/oauth/types.d.ts

@@ -0,0 +1,29 @@
+export type CsrfStateRequired = {
+    token: string;
+    createdAt: number;
+    data: string;
+};
+export type CreateCsrfStateData = {
+    cid: string;
+    origin: 'static-credential' | 'dynamic-credential';
+    [key: string]: unknown;
+};
+export type CsrfState = CsrfStateRequired;
+export declare const MAX_CSRF_AGE: number;
+export declare const enum OauthVersion {
+    V1 = 1,
+    V2 = 2
+}
+export interface OAuth1CredentialData {
+    signatureMethod: 'HMAC-SHA256' | 'HMAC-SHA512' | 'HMAC-SHA1';
+    consumerKey: string;
+    consumerSecret: string;
+    authUrl: string;
+    accessTokenUrl: string;
+    requestTokenUrl: string;
+}
+export declare const algorithmMap: {
+    readonly 'HMAC-SHA256': "sha256";
+    readonly 'HMAC-SHA512': "sha512";
+    readonly 'HMAC-SHA1': "sha1";
+};

package/dist/oauth/types.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.algorithmMap = exports.OauthVersion = exports.MAX_CSRF_AGE = void 0;
+const constants_1 = require("@n8n/constants");
+exports.MAX_CSRF_AGE = 5 * constants_1.Time.minutes.toMilliseconds;
+var OauthVersion;
+(function (OauthVersion) {
+    OauthVersion[OauthVersion["V1"] = 1] = "V1";
+    OauthVersion[OauthVersion["V2"] = 2] = "V2";
+})(OauthVersion || (exports.OauthVersion = OauthVersion = {}));
+exports.algorithmMap = {
+    'HMAC-SHA256': 'sha256',
+    'HMAC-SHA512': 'sha512',
+    'HMAC-SHA1': 'sha1',
+};
+//# sourceMappingURL=types.js.map

package/dist/oauth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":";;;AAAA,8CAAsC;AAmBzB,QAAA,YAAY,GAAG,CAAC,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,CAAC;AAE5D,IAAkB,YAGjB;AAHD,WAAkB,YAAY;IAC7B,2CAAM,CAAA;IACN,2CAAM,CAAA;AACP,CAAC,EAHiB,YAAY,4BAAZ,YAAY,QAG7B;AAWY,QAAA,YAAY,GAAG;IAC3B,aAAa,EAAE,QAAQ;IACvB,aAAa,EAAE,QAAQ;IACvB,WAAW,EAAE,MAAM;CACV,CAAC"}

package/dist/permissions.ee/check-access.d.ts

@@ -0,0 +1,7 @@
+import type { User } from '@n8n/db';
+import { type Scope } from '@n8n/permissions';
+export declare function userHasScopes(user: User, scopes: Scope[], globalOnly: boolean, { credentialId, workflowId, projectId, }: {
+    credentialId?: string;
+    workflowId?: string;
+    projectId?: string;
+}): Promise<boolean>;

package/dist/permissions.ee/check-access.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.userHasScopes = userHasScopes;
+const db_1 = require("@n8n/db");
+const di_1 = require("@n8n/di");
+const permissions_1 = require("@n8n/permissions");
+const n8n_workflow_1 = require("n8n-workflow");
+const credentials_finder_service_1 = require("../credentials/credentials-finder.service");
+const not_found_error_1 = require("../errors/response-errors/not-found.error");
+const role_service_1 = require("../services/role.service");
+async function userHasScopes(user, scopes, globalOnly, { credentialId, workflowId, projectId, }) {
+    if ((0, permissions_1.hasGlobalScope)(user, scopes, { mode: 'allOf' }))
+        return true;
+    if (globalOnly)
+        return false;
+    const userProjectIds = (await di_1.Container.get(db_1.ProjectRepository)
+        .createQueryBuilder('project')
+        .innerJoin('project.projectRelations', 'relation')
+        .innerJoin('relation.role', 'role')
+        .innerJoin('role.scopes', 'scope')
+        .where('relation.userId = :userId', { userId: user.id })
+        .andWhere('scope.slug IN (:...scopes)', { scopes })
+        .groupBy('project.id')
+        .having('COUNT(DISTINCT scope.slug) = :scopeCount', { scopeCount: scopes.length })
+        .select(['project.id AS id'])
+        .getRawMany()).map((row) => row.id);
+    const roleService = di_1.Container.get(role_service_1.RoleService);
+    if (credentialId) {
+        const credentials = await di_1.Container.get(db_1.SharedCredentialsRepository).findBy({
+            credentialsId: credentialId,
+        });
+        if (!credentials.length) {
+            throw new not_found_error_1.NotFoundError(`Credential with ID "${credentialId}" not found.`);
+        }
+        const validRoles = await roleService.rolesWithScope('credential', scopes);
+        const hasValidRoles = credentials.some((c) => userProjectIds.includes(c.projectId) && validRoles.includes(c.role));
+        if (hasValidRoles) {
+            return true;
+        }
+        const credentialsFinderService = di_1.Container.get(credentials_finder_service_1.CredentialsFinderService);
+        if (credentialsFinderService.hasGlobalReadOnlyAccess(scopes)) {
+            const globalCredential = await credentialsFinderService.findGlobalCredentialById(credentialId);
+            if (globalCredential) {
+                return true;
+            }
+        }
+        return false;
+    }
+    if (workflowId) {
+        const workflows = await di_1.Container.get(db_1.SharedWorkflowRepository).findBy({
+            workflowId,
+        });
+        if (!workflows.length) {
+            throw new not_found_error_1.NotFoundError(`Workflow with ID "${workflowId}" not found.`);
+        }
+        const validRoles = await roleService.rolesWithScope('workflow', scopes);
+        return workflows.some((w) => userProjectIds.includes(w.projectId) && validRoles.includes(w.role));
+    }
+    if (projectId)
+        return userProjectIds.includes(projectId);
+    throw new n8n_workflow_1.UnexpectedError("`@ProjectScope` decorator was used but does not have a `credentialId`, `workflowId`, or `projectId` in its URL parameters. This is likely an implementation error. If you're a developer, please check your URL is correct or that this should be using `@GlobalScope`.");
+}
+//# sourceMappingURL=check-access.js.map