@n8n/engine 0.16.0 → 0.17.0

package/dist/auth/authenticate.d.ts

@@ -0,0 +1,3 @@
+import type { RequestHandler } from 'express';
+import type { IdentityVerifier } from './identity.types';
+export declare function createAuthenticationMiddleware(verifier: IdentityVerifier): RequestHandler;

package/dist/auth/authenticate.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthenticationMiddleware = createAuthenticationMiddleware;
+const error_response_1 = require("../server/error-response");
+const BEARER_PREFIX = /^bearer /i;
+function createAuthenticationMiddleware(verifier) {
+    return (req, res, next) => {
+        const reject = (reason) => {
+            const path = req.originalUrl.split('?')[0];
+            console.warn(`engine: rejected ${req.method} ${path} - ${reason}`);
+            (0, error_response_1.fail)(res, 401, { error: 'unauthenticated' });
+        };
+        const header = req.header('authorization');
+        if (!header || !BEARER_PREFIX.test(header)) {
+            reject('no bearer token');
+            return;
+        }
+        const token = header.replace(BEARER_PREFIX, '');
+        try {
+            req.caller = verifier.verify(token);
+        }
+        catch {
+            reject('token rejected');
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=authenticate.js.map

package/dist/auth/authenticate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../src/auth/authenticate.ts"],"names":[],"mappings":";;;AAGA,6DAAgD;AAEhD,MAAM,aAAa,GAAG,WAAW,CAAC;AAGlC,wCAA+C,QAA0B;IACxE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAEzB,MAAM,MAAM,GAAG,CAAC,MAAc,EAAQ,EAAE;YAEvC,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,oBAAoB,GAAG,CAAC,MAAM,IAAI,IAAI,MAAM,MAAM,EAAE,CAAC,CAAC;YACnE,IAAA,qBAAI,EAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC9C,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC1B,OAAO;QACR,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAEhD,IAAI,CAAC;YACJ,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACzB,OAAO;QACR,CAAC;QAED,IAAI,EAAE,CAAC;IACR,CAAC,CAAC;AACH,CAAC"}

package/dist/auth/identity-token.d.ts

@@ -0,0 +1,14 @@
+import type { AuthenticatedCaller, IdentityVerifier } from './identity.types';
+export declare const IDENTITY_ISSUER = "n8n-cp";
+export declare const IDENTITY_AUDIENCE = "n8n-engine-dp";
+export declare const IDENTITY_TOKEN_TTL_SECONDS = 60;
+export declare const IDENTITY_TOKEN_CLOCK_TOLERANCE_SECONDS = 30;
+export declare const MIN_SECRET_LENGTH = 32;
+export declare class InvalidIdentityTokenError extends Error {
+}
+export declare function mintIdentityToken(secret: string, caller: AuthenticatedCaller): string;
+export declare class SharedSecretIdentityVerifier implements IdentityVerifier {
+    private readonly secret;
+    constructor(secret: string);
+    verify(token: string): AuthenticatedCaller;
+}

package/dist/auth/identity-token.js

@@ -0,0 +1,66 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SharedSecretIdentityVerifier = exports.InvalidIdentityTokenError = exports.MIN_SECRET_LENGTH = exports.IDENTITY_TOKEN_CLOCK_TOLERANCE_SECONDS = exports.IDENTITY_TOKEN_TTL_SECONDS = exports.IDENTITY_AUDIENCE = exports.IDENTITY_ISSUER = void 0;
+exports.mintIdentityToken = mintIdentityToken;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const zod_1 = require("zod");
+exports.IDENTITY_ISSUER = 'n8n-cp';
+exports.IDENTITY_AUDIENCE = 'n8n-engine-dp';
+exports.IDENTITY_TOKEN_TTL_SECONDS = 60;
+exports.IDENTITY_TOKEN_CLOCK_TOLERANCE_SECONDS = 30;
+exports.MIN_SECRET_LENGTH = 32;
+const identityClaimsSchema = zod_1.z.object({
+    sub: zod_1.z.string().min(1),
+    tenant_id: zod_1.z.string().min(1),
+    iat: zod_1.z.number().int(),
+    exp: zod_1.z.number().int(),
+});
+class InvalidIdentityTokenError extends Error {
+}
+exports.InvalidIdentityTokenError = InvalidIdentityTokenError;
+function mintIdentityToken(secret, caller) {
+    return jsonwebtoken_1.default.sign({ sub: caller.cpId, tenant_id: caller.tenantId }, secret, {
+        algorithm: 'HS256',
+        issuer: exports.IDENTITY_ISSUER,
+        audience: exports.IDENTITY_AUDIENCE,
+        expiresIn: exports.IDENTITY_TOKEN_TTL_SECONDS,
+    });
+}
+class SharedSecretIdentityVerifier {
+    secret;
+    constructor(secret) {
+        this.secret = secret;
+        if (!secret || secret.length < exports.MIN_SECRET_LENGTH) {
+            throw new Error(`Identity verifier secret must be at least ${exports.MIN_SECRET_LENGTH} chars`);
+        }
+    }
+    verify(token) {
+        const now = Math.floor(Date.now() / 1000);
+        let claims;
+        try {
+            claims = jsonwebtoken_1.default.verify(token, this.secret, {
+                algorithms: ['HS256'],
+                issuer: exports.IDENTITY_ISSUER,
+                audience: exports.IDENTITY_AUDIENCE,
+                maxAge: exports.IDENTITY_TOKEN_TTL_SECONDS,
+                clockTolerance: exports.IDENTITY_TOKEN_CLOCK_TOLERANCE_SECONDS,
+                clockTimestamp: now,
+            });
+        }
+        catch {
+            throw new InvalidIdentityTokenError();
+        }
+        const parsed = identityClaimsSchema.safeParse(claims);
+        if (!parsed.success)
+            throw new InvalidIdentityTokenError();
+        if (parsed.data.iat > now + exports.IDENTITY_TOKEN_CLOCK_TOLERANCE_SECONDS) {
+            throw new InvalidIdentityTokenError();
+        }
+        return { cpId: parsed.data.sub, tenantId: parsed.data.tenant_id };
+    }
+}
+exports.SharedSecretIdentityVerifier = SharedSecretIdentityVerifier;
+//# sourceMappingURL=identity-token.js.map

package/dist/auth/identity-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-token.js","sourceRoot":"","sources":["../../src/auth/identity-token.ts"],"names":[],"mappings":";;;;;;;AAAA,gEAA+B;AAC/B,6BAAwB;AAIX,QAAA,eAAe,GAAG,QAAQ,CAAC;AAC3B,QAAA,iBAAiB,GAAG,eAAe,CAAC;AACpC,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAChC,QAAA,sCAAsC,GAAG,EAAE,CAAC;AAC5C,QAAA,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CACrB,CAAC,CAAC;AAGH,+BAAuC,SAAQ,KAAK;CAAG;;AAGvD,2BAAkC,MAAc,EAAE,MAA2B;IAC5E,OAAO,sBAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE;QACzE,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,QAAA,eAAe;QACvB,QAAQ,EAAE,QAAA,iBAAiB;QAC3B,SAAS,EAAE,QAAA,0BAA0B;KACrC,CAAC,CAAC;AACJ,CAAC;AAGD;IAC8B,MAAM;IAAnC,YAA6B,MAAc;sBAAd,MAAM;QAClC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,QAAA,iBAAiB,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAA,iBAAiB,QAAQ,CAAC,CAAC;QACzF,CAAC;IACF,CAAC;IAED,MAAM,CAAC,KAAa;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YAIJ,MAAM,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;gBACvC,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,QAAA,eAAe;gBACvB,QAAQ,EAAE,QAAA,iBAAiB;gBAC3B,MAAM,EAAE,QAAA,0BAA0B;gBAClC,cAAc,EAAE,QAAA,sCAAsC;gBACtD,cAAc,EAAE,GAAG;aACnB,CAAC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,yBAAyB,EAAE,CAAC;QAC3D,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,GAAG,QAAA,sCAAsC,EAAE,CAAC;YACpE,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACnE,CAAC;CACD"}

package/dist/auth/identity.types.d.ts

@@ -0,0 +1,7 @@
+export interface AuthenticatedCaller {
+    cpId: string;
+    tenantId: string;
+}
+export interface IdentityVerifier {
+    verify(token: string): AuthenticatedCaller;
+}

package/dist/auth/identity.types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=identity.types.js.map

package/dist/auth/identity.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.types.js","sourceRoot":"","sources":["../../src/auth/identity.types.ts"],"names":[],"mappings":""}

package/dist/auth/index.d.ts

@@ -0,0 +1,3 @@
+export { createAuthenticationMiddleware } from './authenticate';
+export { IDENTITY_AUDIENCE, IDENTITY_ISSUER, IDENTITY_TOKEN_CLOCK_TOLERANCE_SECONDS, IDENTITY_TOKEN_TTL_SECONDS, InvalidIdentityTokenError, MIN_SECRET_LENGTH, mintIdentityToken, SharedSecretIdentityVerifier, } from './identity-token';
+export type { AuthenticatedCaller, IdentityVerifier } from './identity.types';

package/dist/auth/index.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SharedSecretIdentityVerifier = exports.mintIdentityToken = exports.MIN_SECRET_LENGTH = exports.InvalidIdentityTokenError = exports.IDENTITY_TOKEN_TTL_SECONDS = exports.IDENTITY_TOKEN_CLOCK_TOLERANCE_SECONDS = exports.IDENTITY_ISSUER = exports.IDENTITY_AUDIENCE = exports.createAuthenticationMiddleware = void 0;
+var authenticate_1 = require("./authenticate");
+Object.defineProperty(exports, "createAuthenticationMiddleware", { enumerable: true, get: function () { return authenticate_1.createAuthenticationMiddleware; } });
+var identity_token_1 = require("./identity-token");
+Object.defineProperty(exports, "IDENTITY_AUDIENCE", { enumerable: true, get: function () { return identity_token_1.IDENTITY_AUDIENCE; } });
+Object.defineProperty(exports, "IDENTITY_ISSUER", { enumerable: true, get: function () { return identity_token_1.IDENTITY_ISSUER; } });
+Object.defineProperty(exports, "IDENTITY_TOKEN_CLOCK_TOLERANCE_SECONDS", { enumerable: true, get: function () { return identity_token_1.IDENTITY_TOKEN_CLOCK_TOLERANCE_SECONDS; } });
+Object.defineProperty(exports, "IDENTITY_TOKEN_TTL_SECONDS", { enumerable: true, get: function () { return identity_token_1.IDENTITY_TOKEN_TTL_SECONDS; } });
+Object.defineProperty(exports, "InvalidIdentityTokenError", { enumerable: true, get: function () { return identity_token_1.InvalidIdentityTokenError; } });
+Object.defineProperty(exports, "MIN_SECRET_LENGTH", { enumerable: true, get: function () { return identity_token_1.MIN_SECRET_LENGTH; } });
+Object.defineProperty(exports, "mintIdentityToken", { enumerable: true, get: function () { return identity_token_1.mintIdentityToken; } });
+Object.defineProperty(exports, "SharedSecretIdentityVerifier", { enumerable: true, get: function () { return identity_token_1.SharedSecretIdentityVerifier; } });
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":";;;AAAA,+CAAgE;AAAvD,8HAAA,8BAA8B,OAAA;AACvC,mDAS0B;AARzB,mHAAA,iBAAiB,OAAA;AACjB,iHAAA,eAAe,OAAA;AACf,wIAAA,sCAAsC,OAAA;AACtC,4HAAA,0BAA0B,OAAA;AAC1B,2HAAA,yBAAyB,OAAA;AACzB,mHAAA,iBAAiB,OAAA;AACjB,mHAAA,iBAAiB,OAAA;AACjB,8HAAA,4BAA4B,OAAA"}