@n8n/engine 0.16.2 → 0.18.0

package/dist/auth/action-token.d.ts

@@ -0,0 +1,7 @@
+import { type SharedSecretTokenSpec } from './shared-secret-token';
+export type ActionScope = 'lifecycle-events:write';
+export declare const ACTION_TOKEN: SharedSecretTokenSpec;
+export declare class InvalidActionTokenError extends Error {
+}
+export declare function mintActionToken(secret: string, scope: ActionScope): string;
+export declare function verifyActionToken(secret: string, token: string, requiredScope: ActionScope): void;

package/dist/auth/action-token.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidActionTokenError = exports.ACTION_TOKEN = void 0;
+exports.mintActionToken = mintActionToken;
+exports.verifyActionToken = verifyActionToken;
+const zod_1 = require("zod");
+const shared_secret_token_1 = require("./shared-secret-token");
+exports.ACTION_TOKEN = Object.freeze({
+    issuer: 'n8n-engine-dp',
+    audience: 'n8n-cp',
+    ttlSeconds: 60,
+    clockToleranceSeconds: 30,
+});
+const actionClaimsSchema = zod_1.z.object({
+    scope: zod_1.z.enum(['lifecycle-events:write']),
+    iat: zod_1.z.number().int(),
+    exp: zod_1.z.number().int(),
+});
+class InvalidActionTokenError extends Error {
+}
+exports.InvalidActionTokenError = InvalidActionTokenError;
+function mintActionToken(secret, scope) {
+    return (0, shared_secret_token_1.signSharedSecretToken)(exports.ACTION_TOKEN, secret, { scope });
+}
+function verifyActionToken(secret, token, requiredScope) {
+    const claims = (0, shared_secret_token_1.verifySharedSecretToken)(exports.ACTION_TOKEN, secret, token, actionClaimsSchema);
+    if (!claims || claims.scope !== requiredScope)
+        throw new InvalidActionTokenError();
+}
+//# sourceMappingURL=action-token.js.map

package/dist/auth/action-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-token.js","sourceRoot":"","sources":["../../src/auth/action-token.ts"],"names":[],"mappings":";;;;;AAAA,6BAAwB;AAExB,+DAI+B;AAclB,QAAA,YAAY,GAA0B,MAAM,CAAC,MAAM,CAAC;IAChE,MAAM,EAAE,eAAe;IACvB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,EAAE;IACd,qBAAqB,EAAE,EAAE;CACzB,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,wBAAwB,CAAC,CAAC;IACzC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CACrB,CAAC,CAAC;AAGH,6BAAqC,SAAQ,KAAK;CAAG;;AAGrD,yBAAgC,MAAc,EAAE,KAAkB;IACjE,OAAO,IAAA,2CAAqB,EAAC,QAAA,YAAY,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/D,CAAC;AAMD,2BAAkC,MAAc,EAAE,KAAa,EAAE,aAA0B;IAC1F,MAAM,MAAM,GAAG,IAAA,6CAAuB,EAAC,QAAA,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC;IACxF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa;QAAE,MAAM,IAAI,uBAAuB,EAAE,CAAC;AACpF,CAAC"}

package/dist/auth/authenticate.d.ts

@@ -0,0 +1,4 @@
+import type { RequestHandler } from 'express';
+import type { IdentityVerifier } from './identity.types';
+import { type EngineLogger } from '../logging';
+export declare function createAuthenticationMiddleware(verifier: IdentityVerifier, logger?: EngineLogger): RequestHandler;

package/dist/auth/authenticate.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthenticationMiddleware = createAuthenticationMiddleware;
+const logging_1 = require("../logging");
+const error_response_1 = require("../server/error-response");
+const BEARER_PREFIX = /^bearer /i;
+function createAuthenticationMiddleware(verifier, logger = (0, logging_1.createConsoleLogger)()) {
+    return (req, res, next) => {
+        const reject = (reason) => {
+            const path = req.originalUrl.split('?')[0];
+            logger.warn(`rejected ${req.method} ${path} - ${reason}`);
+            (0, error_response_1.fail)(res, 401, { error: 'unauthenticated' });
+        };
+        const header = req.header('authorization');
+        if (!header || !BEARER_PREFIX.test(header)) {
+            reject('no bearer token');
+            return;
+        }
+        const token = header.replace(BEARER_PREFIX, '');
+        try {
+            req.caller = verifier.verify(token);
+        }
+        catch {
+            reject('token rejected');
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=authenticate.js.map

package/dist/auth/authenticate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../src/auth/authenticate.ts"],"names":[],"mappings":";;;AAGA,wCAAoE;AACpE,6DAAgD;AAEhD,MAAM,aAAa,GAAG,WAAW,CAAC;AAGlC,wCACC,QAA0B,EAC1B,MAAM,GAAiB,IAAA,6BAAmB,GAAE;IAE5C,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAEzB,MAAM,MAAM,GAAG,CAAC,MAAc,EAAQ,EAAE;YAEvC,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,MAAM,IAAI,IAAI,MAAM,MAAM,EAAE,CAAC,CAAC;YAC1D,IAAA,qBAAI,EAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC9C,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC1B,OAAO;QACR,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAEhD,IAAI,CAAC;YACJ,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACzB,OAAO;QACR,CAAC;QAED,IAAI,EAAE,CAAC;IACR,CAAC,CAAC;AACH,CAAC"}

package/dist/auth/identity-token.d.ts

@@ -0,0 +1,12 @@
+import type { AuthenticatedCaller, IdentityVerifier } from './identity.types';
+import { MIN_SECRET_LENGTH, type SharedSecretTokenSpec } from './shared-secret-token';
+export { MIN_SECRET_LENGTH };
+export declare const IDENTITY_TOKEN: SharedSecretTokenSpec;
+export declare class InvalidIdentityTokenError extends Error {
+}
+export declare function mintIdentityToken(secret: string, caller: AuthenticatedCaller): string;
+export declare class SharedSecretIdentityVerifier implements IdentityVerifier {
+    private readonly secret;
+    constructor(secret: string);
+    verify(token: string): AuthenticatedCaller;
+}

package/dist/auth/identity-token.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SharedSecretIdentityVerifier = exports.InvalidIdentityTokenError = exports.IDENTITY_TOKEN = exports.MIN_SECRET_LENGTH = void 0;
+exports.mintIdentityToken = mintIdentityToken;
+const zod_1 = require("zod");
+const shared_secret_token_1 = require("./shared-secret-token");
+Object.defineProperty(exports, "MIN_SECRET_LENGTH", { enumerable: true, get: function () { return shared_secret_token_1.MIN_SECRET_LENGTH; } });
+exports.IDENTITY_TOKEN = Object.freeze({
+    issuer: 'n8n-cp',
+    audience: 'n8n-engine-dp',
+    ttlSeconds: 60,
+    clockToleranceSeconds: 30,
+});
+const identityClaimsSchema = zod_1.z.object({
+    sub: zod_1.z.string().min(1),
+    tenant_id: zod_1.z.string().min(1),
+    iat: zod_1.z.number().int(),
+    exp: zod_1.z.number().int(),
+});
+class InvalidIdentityTokenError extends Error {
+}
+exports.InvalidIdentityTokenError = InvalidIdentityTokenError;
+function mintIdentityToken(secret, caller) {
+    return (0, shared_secret_token_1.signSharedSecretToken)(exports.IDENTITY_TOKEN, secret, {
+        sub: caller.cpId,
+        tenant_id: caller.tenantId,
+    });
+}
+class SharedSecretIdentityVerifier {
+    secret;
+    constructor(secret) {
+        this.secret = secret;
+        if (!secret || secret.length < shared_secret_token_1.MIN_SECRET_LENGTH) {
+            throw new Error(`Identity verifier secret must be at least ${shared_secret_token_1.MIN_SECRET_LENGTH} chars`);
+        }
+    }
+    verify(token) {
+        const claims = (0, shared_secret_token_1.verifySharedSecretToken)(exports.IDENTITY_TOKEN, this.secret, token, identityClaimsSchema);
+        if (!claims)
+            throw new InvalidIdentityTokenError();
+        return { cpId: claims.sub, tenantId: claims.tenant_id };
+    }
+}
+exports.SharedSecretIdentityVerifier = SharedSecretIdentityVerifier;
+//# sourceMappingURL=identity-token.js.map

package/dist/auth/identity-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-token.js","sourceRoot":"","sources":["../../src/auth/identity-token.ts"],"names":[],"mappings":";;;;AAAA,6BAAwB;AAGxB,+DAK+B;kGAJ9B,uCAAiB;AASL,QAAA,cAAc,GAA0B,MAAM,CAAC,MAAM,CAAC;IAClE,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,eAAe;IACzB,UAAU,EAAE,EAAE;IACd,qBAAqB,EAAE,EAAE;CACzB,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CACrB,CAAC,CAAC;AAGH,+BAAuC,SAAQ,KAAK;CAAG;;AAGvD,2BAAkC,MAAc,EAAE,MAA2B;IAC5E,OAAO,IAAA,2CAAqB,EAAC,QAAA,cAAc,EAAE,MAAM,EAAE;QACpD,GAAG,EAAE,MAAM,CAAC,IAAI;QAChB,SAAS,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;AACJ,CAAC;AAGD;IAC8B,MAAM;IAAnC,YAA6B,MAAc;sBAAd,MAAM;QAClC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,uCAAiB,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,6CAA6C,uCAAiB,QAAQ,CAAC,CAAC;QACzF,CAAC;IACF,CAAC;IAED,MAAM,CAAC,KAAa;QACnB,MAAM,MAAM,GAAG,IAAA,6CAAuB,EACrC,QAAA,cAAc,EACd,IAAI,CAAC,MAAM,EACX,KAAK,EACL,oBAAoB,CACpB,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,yBAAyB,EAAE,CAAC;QAEnD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IACzD,CAAC;CACD"}

package/dist/auth/identity.types.d.ts

@@ -0,0 +1,7 @@
+export interface AuthenticatedCaller {
+    cpId: string;
+    tenantId: string;
+}
+export interface IdentityVerifier {
+    verify(token: string): AuthenticatedCaller;
+}

package/dist/auth/identity.types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=identity.types.js.map

package/dist/auth/identity.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.types.js","sourceRoot":"","sources":["../../src/auth/identity.types.ts"],"names":[],"mappings":""}

package/dist/auth/index.d.ts

@@ -0,0 +1,5 @@
+export { createAuthenticationMiddleware } from './authenticate';
+export { ACTION_TOKEN, InvalidActionTokenError, mintActionToken, verifyActionToken, } from './action-token';
+export type { ActionScope } from './action-token';
+export { IDENTITY_TOKEN, InvalidIdentityTokenError, MIN_SECRET_LENGTH, mintIdentityToken, SharedSecretIdentityVerifier, } from './identity-token';
+export type { AuthenticatedCaller, IdentityVerifier } from './identity.types';

package/dist/auth/index.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SharedSecretIdentityVerifier = exports.mintIdentityToken = exports.MIN_SECRET_LENGTH = exports.InvalidIdentityTokenError = exports.IDENTITY_TOKEN = exports.verifyActionToken = exports.mintActionToken = exports.InvalidActionTokenError = exports.ACTION_TOKEN = exports.createAuthenticationMiddleware = void 0;
+var authenticate_1 = require("./authenticate");
+Object.defineProperty(exports, "createAuthenticationMiddleware", { enumerable: true, get: function () { return authenticate_1.createAuthenticationMiddleware; } });
+var action_token_1 = require("./action-token");
+Object.defineProperty(exports, "ACTION_TOKEN", { enumerable: true, get: function () { return action_token_1.ACTION_TOKEN; } });
+Object.defineProperty(exports, "InvalidActionTokenError", { enumerable: true, get: function () { return action_token_1.InvalidActionTokenError; } });
+Object.defineProperty(exports, "mintActionToken", { enumerable: true, get: function () { return action_token_1.mintActionToken; } });
+Object.defineProperty(exports, "verifyActionToken", { enumerable: true, get: function () { return action_token_1.verifyActionToken; } });
+var identity_token_1 = require("./identity-token");
+Object.defineProperty(exports, "IDENTITY_TOKEN", { enumerable: true, get: function () { return identity_token_1.IDENTITY_TOKEN; } });
+Object.defineProperty(exports, "InvalidIdentityTokenError", { enumerable: true, get: function () { return identity_token_1.InvalidIdentityTokenError; } });
+Object.defineProperty(exports, "MIN_SECRET_LENGTH", { enumerable: true, get: function () { return identity_token_1.MIN_SECRET_LENGTH; } });
+Object.defineProperty(exports, "mintIdentityToken", { enumerable: true, get: function () { return identity_token_1.mintIdentityToken; } });
+Object.defineProperty(exports, "SharedSecretIdentityVerifier", { enumerable: true, get: function () { return identity_token_1.SharedSecretIdentityVerifier; } });
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":";;;AAAA,+CAAgE;AAAvD,8HAAA,8BAA8B,OAAA;AACvC,+CAKwB;AAJvB,4GAAA,YAAY,OAAA;AACZ,uHAAA,uBAAuB,OAAA;AACvB,+GAAA,eAAe,OAAA;AACf,iHAAA,iBAAiB,OAAA;AAGlB,mDAM0B;AALzB,gHAAA,cAAc,OAAA;AACd,2HAAA,yBAAyB,OAAA;AACzB,mHAAA,iBAAiB,OAAA;AACjB,mHAAA,iBAAiB,OAAA;AACjB,8HAAA,4BAA4B,OAAA"}

package/dist/auth/shared-secret-token.d.ts

@@ -0,0 +1,12 @@
+import type { z } from 'zod';
+export declare const MIN_SECRET_LENGTH = 32;
+export interface SharedSecretTokenSpec {
+    readonly issuer: string;
+    readonly audience: string;
+    readonly ttlSeconds: number;
+    readonly clockToleranceSeconds: number;
+}
+export declare function signSharedSecretToken(spec: SharedSecretTokenSpec, secret: string, claims: object): string;
+export declare function verifySharedSecretToken<T extends {
+    iat: number;
+}>(spec: SharedSecretTokenSpec, secret: string, token: string, schema: z.ZodType<T>): T | undefined;

package/dist/auth/shared-secret-token.js

@@ -0,0 +1,44 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MIN_SECRET_LENGTH = void 0;
+exports.signSharedSecretToken = signSharedSecretToken;
+exports.verifySharedSecretToken = verifySharedSecretToken;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+exports.MIN_SECRET_LENGTH = 32;
+function signSharedSecretToken(spec, secret, claims) {
+    return jsonwebtoken_1.default.sign(claims, secret, {
+        algorithm: 'HS256',
+        issuer: spec.issuer,
+        audience: spec.audience,
+        expiresIn: spec.ttlSeconds,
+    });
+}
+function verifySharedSecretToken(spec, secret, token, schema) {
+    if (!secret || secret.length < exports.MIN_SECRET_LENGTH)
+        return undefined;
+    const now = Math.floor(Date.now() / 1000);
+    let claims;
+    try {
+        claims = jsonwebtoken_1.default.verify(token, secret, {
+            algorithms: ['HS256'],
+            issuer: spec.issuer,
+            audience: spec.audience,
+            maxAge: spec.ttlSeconds,
+            clockTolerance: spec.clockToleranceSeconds,
+            clockTimestamp: now,
+        });
+    }
+    catch {
+        return undefined;
+    }
+    const parsed = schema.safeParse(claims);
+    if (!parsed.success)
+        return undefined;
+    if (parsed.data.iat > now + spec.clockToleranceSeconds)
+        return undefined;
+    return parsed.data;
+}
+//# sourceMappingURL=shared-secret-token.js.map

package/dist/auth/shared-secret-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-secret-token.js","sourceRoot":"","sources":["../../src/auth/shared-secret-token.ts"],"names":[],"mappings":";;;;;;;;AAAA,gEAA+B;AAOlB,QAAA,iBAAiB,GAAG,EAAE,CAAC;AAUpC,+BACC,IAA2B,EAC3B,MAAc,EACd,MAAc;IAEd,OAAO,sBAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE;QAC/B,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,UAAU;KAC1B,CAAC,CAAC;AACJ,CAAC;AAUD,iCACC,IAA2B,EAC3B,MAAc,EACd,KAAa,EACb,MAAoB;IAEpB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,QAAA,iBAAiB;QAAE,OAAO,SAAS,CAAC;IAEnE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAIJ,MAAM,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE;YAClC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,cAAc,EAAE,IAAI,CAAC,qBAAqB;YAC1C,cAAc,EAAE,GAAG;SACnB,CAAC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAGtC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,qBAAqB;QAAE,OAAO,SAAS,CAAC;IAEzE,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC"}