n8n 1.110.1 → 1.111.0

package/dist/sso.ee/oidc/oidc.service.ee.d.ts

@@ -3,6 +3,7 @@ import { Logger } from '@n8n/backend-common';
 import { GlobalConfig } from '@n8n/config';
 import { AuthIdentityRepository, SettingsRepository, type User, UserRepository } from '@n8n/db';
 import { Cipher } from 'n8n-core';
+import { JwtService } from '../../services/jwt.service';
 import { UrlService } from '../../services/url.service';
 type OidcRuntimeConfig = Pick<OidcConfigDto, 'clientId' | 'clientSecret' | 'loginEnabled'> & {
     discoveryEndpoint: URL;
@@ -15,13 +16,28 @@ export declare class OidcService {
     private readonly userRepository;
     private readonly cipher;
     private readonly logger;
+    private readonly jwtService;
     private oidcConfig;
-    constructor(settingsRepository: SettingsRepository, authIdentityRepository: AuthIdentityRepository, urlService: UrlService, globalConfig: GlobalConfig, userRepository: UserRepository, cipher: Cipher, logger: Logger);
+    constructor(settingsRepository: SettingsRepository, authIdentityRepository: AuthIdentityRepository, urlService: UrlService, globalConfig: GlobalConfig, userRepository: UserRepository, cipher: Cipher, logger: Logger, jwtService: JwtService);
     init(): Promise<void>;
     getCallbackUrl(): string;
     getRedactedConfig(): OidcConfigDto;
-    generateLoginUrl(): Promise<URL>;
-    loginUser(callbackUrl: URL): Promise<User>;
+    generateState(): {
+        signed: string;
+        plaintext: string;
+    };
+    verifyState(signedState: string): string;
+    generateNonce(): {
+        signed: string;
+        plaintext: string;
+    };
+    verifyNonce(signedNonce: string): string;
+    generateLoginUrl(): Promise<{
+        url: URL;
+        state: string;
+        nonce: string;
+    }>;
+    loginUser(callbackUrl: URL, storedState: string, storedNonce: string): Promise<User>;
     loadConfig(decryptSecret?: boolean): Promise<OidcRuntimeConfig>;
     updateConfig(newConfig: OidcConfigDto): Promise<void>;
     private setOidcLoginEnabled;

package/dist/sso.ee/oidc/oidc.service.ee.js

@@ -47,15 +47,17 @@ const backend_common_1 = require("@n8n/backend-common");
 const config_1 = require("@n8n/config");
 const db_1 = require("@n8n/db");
 const di_1 = require("@n8n/di");
+const crypto_1 = require("crypto");
 const n8n_core_1 = require("n8n-core");
 const n8n_workflow_1 = require("n8n-workflow");
 const client = __importStar(require("openid-client"));
 const bad_request_error_1 = require("../../errors/response-errors/bad-request.error");
 const forbidden_error_1 = require("../../errors/response-errors/forbidden.error");
 const internal_server_error_1 = require("../../errors/response-errors/internal-server.error");
+const jwt_service_1 = require("../../services/jwt.service");
 const url_service_1 = require("../../services/url.service");
-const constants_1 = require("./constants");
 const sso_helpers_1 = require("../sso-helpers");
+const constants_1 = require("./constants");
 const DEFAULT_OIDC_CONFIG = {
     clientId: '',
     clientSecret: '',
@@ -67,7 +69,7 @@ const DEFAULT_OIDC_RUNTIME_CONFIG = {
     discoveryEndpoint: new URL('http://n8n.io/not-set'),
 };
 let OidcService = class OidcService {
-    constructor(settingsRepository, authIdentityRepository, urlService, globalConfig, userRepository, cipher, logger) {
+    constructor(settingsRepository, authIdentityRepository, urlService, globalConfig, userRepository, cipher, logger, jwtService) {
         this.settingsRepository = settingsRepository;
         this.authIdentityRepository = authIdentityRepository;
         this.urlService = urlService;
@@ -75,6 +77,7 @@ let OidcService = class OidcService {
         this.userRepository = userRepository;
         this.cipher = cipher;
         this.logger = logger;
+        this.jwtService = jwtService;
         this.oidcConfig = DEFAULT_OIDC_RUNTIME_CONFIG;
     }
     async init() {
@@ -92,24 +95,118 @@ let OidcService = class OidcService {
             clientSecret: constants_1.OIDC_CLIENT_SECRET_REDACTED_VALUE,
         };
     }
+    generateState() {
+        const state = `n8n_state:${(0, crypto_1.randomUUID)()}`;
+        return {
+            signed: this.jwtService.sign({ state }, { expiresIn: '15m' }),
+            plaintext: state,
+        };
+    }
+    verifyState(signedState) {
+        let state;
+        try {
+            const decodedState = this.jwtService.verify(signedState);
+            state = decodedState?.state;
+        }
+        catch (error) {
+            this.logger.error('Failed to verify state', { error });
+            throw new bad_request_error_1.BadRequestError('Invalid state');
+        }
+        if (typeof state !== 'string') {
+            this.logger.error('Provided state has an invalid format');
+            throw new bad_request_error_1.BadRequestError('Invalid state');
+        }
+        const splitState = state.split(':');
+        if (splitState.length !== 2 || splitState[0] !== 'n8n_state') {
+            this.logger.error('Provided state is missing the well-known prefix');
+            throw new bad_request_error_1.BadRequestError('Invalid state');
+        }
+        if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(splitState[1])) {
+            this.logger.error('Provided state is not formatted correctly');
+            throw new bad_request_error_1.BadRequestError('Invalid state');
+        }
+        return state;
+    }
+    generateNonce() {
+        const nonce = `n8n_nonce:${(0, crypto_1.randomUUID)()}`;
+        return {
+            signed: this.jwtService.sign({ nonce }, { expiresIn: '15m' }),
+            plaintext: nonce,
+        };
+    }
+    verifyNonce(signedNonce) {
+        let nonce;
+        try {
+            const decodedNonce = this.jwtService.verify(signedNonce);
+            nonce = decodedNonce?.nonce;
+        }
+        catch (error) {
+            this.logger.error('Failed to verify nonce', { error });
+            throw new bad_request_error_1.BadRequestError('Invalid nonce');
+        }
+        if (typeof nonce !== 'string') {
+            this.logger.error('Provided nonce has an invalid format');
+            throw new bad_request_error_1.BadRequestError('Invalid nonce');
+        }
+        const splitNonce = nonce.split(':');
+        if (splitNonce.length !== 2 || splitNonce[0] !== 'n8n_nonce') {
+            this.logger.error('Provided nonce is missing the well-known prefix');
+            throw new bad_request_error_1.BadRequestError('Invalid nonce');
+        }
+        if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(splitNonce[1])) {
+            this.logger.error('Provided nonce is not formatted correctly');
+            throw new bad_request_error_1.BadRequestError('Invalid nonce');
+        }
+        return nonce;
+    }
     async generateLoginUrl() {
         const configuration = await this.getOidcConfiguration();
+        const state = this.generateState();
+        const nonce = this.generateNonce();
         const authorizationURL = client.buildAuthorizationUrl(configuration, {
             redirect_uri: this.getCallbackUrl(),
             response_type: 'code',
             scope: 'openid email profile',
             prompt: 'select_account',
+            state: state.plaintext,
+            nonce: nonce.plaintext,
         });
-        return authorizationURL;
+        return { url: authorizationURL, state: state.signed, nonce: nonce.signed };
     }
-    async loginUser(callbackUrl) {
+    async loginUser(callbackUrl, storedState, storedNonce) {
         const configuration = await this.getOidcConfiguration();
-        const tokens = await client.authorizationCodeGrant(configuration, callbackUrl);
-        const claims = tokens.claims();
+        const expectedState = this.verifyState(storedState);
+        const expectedNonce = this.verifyNonce(storedNonce);
+        let tokens;
+        try {
+            tokens = await client.authorizationCodeGrant(configuration, callbackUrl, {
+                expectedState,
+                expectedNonce,
+            });
+        }
+        catch (error) {
+            this.logger.error('Failed to exchange authorization code for tokens', { error });
+            throw new bad_request_error_1.BadRequestError('Invalid authorization code');
+        }
+        let claims;
+        try {
+            claims = tokens.claims();
+        }
+        catch (error) {
+            this.logger.error('Failed to extract claims from tokens', { error });
+            throw new bad_request_error_1.BadRequestError('Invalid token');
+        }
         if (!claims) {
             throw new forbidden_error_1.ForbiddenError('No claims found in the OIDC token');
         }
-        const userInfo = await client.fetchUserInfo(configuration, tokens.access_token, claims.sub);
+        let userInfo;
+        try {
+            userInfo = await client.fetchUserInfo(configuration, tokens.access_token, claims.sub);
+        }
+        catch (error) {
+            this.logger.error('Failed to fetch user info', { error });
+            throw new bad_request_error_1.BadRequestError('Invalid token');
+        }
         if (!userInfo.email) {
             throw new bad_request_error_1.BadRequestError('An email is required');
         }
@@ -258,6 +355,7 @@ exports.OidcService = OidcService = __decorate([
         config_1.GlobalConfig,
         db_1.UserRepository,
         n8n_core_1.Cipher,
-        backend_common_1.Logger])
+        backend_common_1.Logger,
+        jwt_service_1.JwtService])
 ], OidcService);
 //# sourceMappingURL=oidc.service.ee.js.map

package/dist/sso.ee/oidc/oidc.service.ee.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.service.ee.js","sourceRoot":"","sources":["../../../src/sso.ee/oidc/oidc.service.ee.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wDAA6C;AAC7C,wCAA2C;AAC3C,gCAQiB;AACjB,gCAA6C;AAC7C,uCAAkC;AAClC,+CAAoD;AACpD,sDAAwC;AAExC,kFAA6E;AAC7E,8EAA0E;AAC1E,0FAAqF;AACrF,wDAAoD;AAEpD,2CAAyF;AACzF,gDAKwB;AAExB,MAAM,mBAAmB,GAAkB;IAC1C,QAAQ,EAAE,EAAE;IACZ,YAAY,EAAE,EAAE;IAChB,iBAAiB,EAAE,EAAE;IACrB,YAAY,EAAE,KAAK;CACnB,CAAC;AAMF,MAAM,2BAA2B,GAAsB;IACtD,GAAG,mBAAmB;IACtB,iBAAiB,EAAE,IAAI,GAAG,CAAC,uBAAuB,CAAC;CACnD,CAAC;AAGK,IAAM,WAAW,GAAjB,MAAM,WAAW;IAGvB,YACkB,kBAAsC,EACtC,sBAA8C,EAC9C,UAAsB,EACtB,YAA0B,EAC1B,cAA8B,EAC9B,MAAc,EACd,MAAc;QANd,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,eAAU,GAAV,UAAU,CAAY;QACtB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;QATxB,eAAU,GAAsB,2BAA2B,CAAC;IAUjE,CAAC;IAEJ,KAAK,CAAC,IAAI;QACT,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9D,CAAC;IAED,cAAc;QACb,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,oBAAoB,CAAC;IACxG,CAAC;IAED,iBAAiB;QAChB,OAAO;YACN,GAAG,IAAI,CAAC,UAAU;YAClB,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,QAAQ,EAAE;YAC/D,YAAY,EAAE,6CAAiC;SAC/C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB;QACrB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAExD,MAAM,gBAAgB,GAAG,MAAM,CAAC,qBAAqB,CAAC,aAAa,EAAE;YACpE,YAAY,EAAE,IAAI,CAAC,cAAc,EAAE;YACnC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,sBAAsB;YAC7B,MAAM,EAAE,gBAAgB;SACxB,CAAC,CAAC;QAEH,OAAO,gBAAgB,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,WAAgB;QAC/B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAExD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAE/E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,gCAAc,CAAC,mCAAmC,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAE5F,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,IAAI,mCAAe,CAAC,sBAAsB,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,CAAC,IAAA,iBAAY,EAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,mCAAe,CAAC,sBAAsB,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;YAC5D,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE;YACvD,SAAS,EAAE;gBACV,IAAI,EAAE;oBACL,IAAI,EAAE,IAAI;iBACV;aACD;SACD,CAAC,CAAC;QAEH,IAAI,UAAU,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC,IAAI,CAAC;QACxB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;YACnD,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;YAChC,SAAS,EAAE,CAAC,gBAAgB,EAAE,MAAM,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,+BAA+B,QAAQ,CAAC,KAAK,yCAAyC,CACtF,CAAC;YAEF,MAAM,EAAE,GAAG,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC;gBAC7C,UAAU,EAAE,MAAM,CAAC,GAAG;gBACtB,YAAY,EAAE,MAAM;gBACpB,MAAM,EAAE,SAAS,CAAC,EAAE;aACpB,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAE3C,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAClE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAC/D;gBACC,SAAS,EAAE,QAAQ,CAAC,UAAU;gBAC9B,QAAQ,EAAE,QAAQ,CAAC,WAAW;gBAC9B,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,cAAc,EAAE,EAAE;gBAClB,IAAI,EAAE,uBAAkB;gBACxB,QAAQ,EAAE,iBAAiB;aAC3B,EACD,GAAG,CACH,CAAC;YAEF,MAAM,GAAG,CAAC,IAAI,CACb,GAAG,CAAC,MAAM,CAAC,iBAAY,EAAE;gBACxB,UAAU,EAAE,MAAM,CAAC,GAAG;gBACtB,YAAY,EAAE,MAAM;gBACpB,MAAM,EAAE,IAAI,CAAC,EAAE;aACf,CAAC,CACF,CAAC;YAEF,OAAO,IAAI,CAAC;QACb,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,aAAa,GAAG,KAAK;QACrC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC;YAC7D,GAAG,EAAE,mCAAuB;SAC5B,CAAC,CAAC;QAEH,IAAI,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC;gBACJ,MAAM,UAAU,GAAG,IAAA,wBAAS,EAAgB,aAAa,CAAC,KAAK,CAAC,CAAC;gBAEjE,IAAI,UAAU,CAAC,iBAAiB,KAAK,EAAE;oBAAE,OAAO,2BAA2B,CAAC;gBAE5E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;gBAE3D,IAAI,UAAU,CAAC,YAAY,IAAI,aAAa,EAAE,CAAC;oBAC9C,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;gBACxE,CAAC;gBACD,OAAO;oBACN,GAAG,UAAU;oBACb,iBAAiB,EAAE,YAAY;iBAC/B,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CACf,yFAAyF,EAEzF,EAAE,KAAK,EAAE,CACT,CAAC;YACH,CAAC;QACF,CAAC;QAED,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;YAClC,GAAG,EAAE,mCAAuB;YAC5B,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;YAC1C,aAAa,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,OAAO,2BAA2B,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAwB;QAC1C,IAAI,iBAAsB,CAAC;QAC3B,IAAI,CAAC;YAEJ,iBAAiB,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC;YAC9F,MAAM,IAAI,wBAAS,CAAC,gDAAgD,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,SAAS,CAAC,YAAY,KAAK,6CAAiC,EAAE,CAAC;YAClE,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QACvD,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,kBAAkB,GAAG,MAAM,MAAM,CAAC,SAAS,CAChD,iBAAiB,EACjB,SAAS,CAAC,QAAQ,EAClB,SAAS,CAAC,YAAY,CACtB,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,MAAM,IAAI,wBAAS,CAAC,uEAAuE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CACnC;YACC,GAAG,EAAE,mCAAuB;SAC5B,EACD;YACC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;gBACrB,GAAG,SAAS;gBACZ,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC;aACzD,CAAC;SACF,CACD,CAAC;QAOF,IAAI,CAAC,UAAU,GAAG;YACjB,GAAG,SAAS;YACZ,iBAAiB;SACjB,CAAC;QACF,IAAI,CAAC,uBAAuB,GAAG,SAAS,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,qBAAqB,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,GAAG,CAC7E,CAAC;QAEF,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9D,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,OAAgB;QACjD,MAAM,2BAA2B,GAAG,IAAA,4CAA8B,GAAE,CAAC;QAErE,IAAI,OAAO,IAAI,CAAC,IAAA,gDAAkC,GAAE,IAAI,CAAC,IAAA,+CAAiC,GAAE,EAAE,CAAC;YAC9F,MAAM,IAAI,2CAAmB,CAC5B,qHAAqH,2BAA2B,GAAG,CACnJ,CAAC;QACH,CAAC;QAED,MAAM,0BAA0B,GAC/B,CAAC,OAAO,IAAI,2BAA2B,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC;QAE5F,cAAS,CAAC,GAAG,CAAC,qBAAY,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAC5D,MAAM,IAAA,4CAA8B,EAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACrF,CAAC;IASO,KAAK,CAAC,oBAAoB;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IACC,IAAI,CAAC,uBAAuB,KAAK,SAAS;YAC1C,GAAG,IAAI,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,OAAO,EAAE;YACvD,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,QAAQ,EAAE;gBAC3C,IAAI,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,QAAQ,EAAE;YAC1D,IAAI,CAAC,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAC,uBAAuB,CAAC,QAAQ;YAClE,IAAI,CAAC,UAAU,CAAC,YAAY,KAAK,IAAI,CAAC,uBAAuB,CAAC,YAAY,EACzE,CAAC;YACF,IAAI,CAAC,uBAAuB,GAAG;gBAC9B,GAAG,IAAI,CAAC,UAAU;gBAClB,aAAa,EAAE,MAAM,CAAC,SAAS,CAC9B,IAAI,CAAC,UAAU,CAAC,iBAAiB,EACjC,IAAI,CAAC,UAAU,CAAC,QAAQ,EACxB,IAAI,CAAC,UAAU,CAAC,YAAY,CAC5B;gBACD,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;aAChD,CAAC;QACH,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC;IACzD,CAAC;CACD,CAAA;AApQY,kCAAW;sBAAX,WAAW;IADvB,IAAA,YAAO,GAAE;qCAK6B,uBAAkB;QACd,2BAAsB;QAClC,wBAAU;QACR,qBAAY;QACV,mBAAc;QACtB,iBAAM;QACN,uBAAM;GAVpB,WAAW,CAoQvB"}
+{"version":3,"file":"oidc.service.ee.js","sourceRoot":"","sources":["../../../src/sso.ee/oidc/oidc.service.ee.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wDAA6C;AAC7C,wCAA2C;AAC3C,gCAQiB;AACjB,gCAA6C;AAC7C,mCAAoC;AACpC,uCAAkC;AAClC,+CAAoD;AACpD,sDAAwC;AAExC,kFAA6E;AAC7E,8EAA0E;AAC1E,0FAAqF;AACrF,wDAAoD;AACpD,wDAAoD;AAEpD,gDAKwB;AACxB,2CAAyF;AAEzF,MAAM,mBAAmB,GAAkB;IAC1C,QAAQ,EAAE,EAAE;IACZ,YAAY,EAAE,EAAE;IAChB,iBAAiB,EAAE,EAAE;IACrB,YAAY,EAAE,KAAK;CACnB,CAAC;AAMF,MAAM,2BAA2B,GAAsB;IACtD,GAAG,mBAAmB;IACtB,iBAAiB,EAAE,IAAI,GAAG,CAAC,uBAAuB,CAAC;CACnD,CAAC;AAGK,IAAM,WAAW,GAAjB,MAAM,WAAW;IAGvB,YACkB,kBAAsC,EACtC,sBAA8C,EAC9C,UAAsB,EACtB,YAA0B,EAC1B,cAA8B,EAC9B,MAAc,EACd,MAAc,EACd,UAAsB;QAPtB,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,eAAU,GAAV,UAAU,CAAY;QACtB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAY;QAVhC,eAAU,GAAsB,2BAA2B,CAAC;IAWjE,CAAC;IAEJ,KAAK,CAAC,IAAI;QACT,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9D,CAAC;IAED,cAAc;QACb,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,oBAAoB,CAAC;IACxG,CAAC;IAED,iBAAiB;QAChB,OAAO;YACN,GAAG,IAAI,CAAC,UAAU;YAClB,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,QAAQ,EAAE;YAC/D,YAAY,EAAE,6CAAiC;SAC/C,CAAC;IACH,CAAC;IAED,aAAa;QACZ,MAAM,KAAK,GAAG,aAAa,IAAA,mBAAU,GAAE,EAAE,CAAC;QAC1C,OAAO;YACN,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAC7D,SAAS,EAAE,KAAK;SAChB,CAAC;IACH,CAAC;IAED,WAAW,CAAC,WAAmB;QAC9B,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACJ,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACzD,KAAK,GAAG,YAAY,EAAE,KAAK,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACvD,MAAM,IAAI,mCAAe,CAAC,eAAe,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,MAAM,IAAI,mCAAe,CAAC,eAAe,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEpC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,MAAM,IAAI,mCAAe,CAAC,eAAe,CAAC,CAAC;QAC5C,CAAC;QAED,IACC,CAAC,6EAA6E,CAAC,IAAI,CAClF,UAAU,CAAC,CAAC,CAAC,CACb,EACA,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,MAAM,IAAI,mCAAe,CAAC,eAAe,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,aAAa;QACZ,MAAM,KAAK,GAAG,aAAa,IAAA,mBAAU,GAAE,EAAE,CAAC;QAC1C,OAAO;YACN,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAC7D,SAAS,EAAE,KAAK;SAChB,CAAC;IACH,CAAC;IAED,WAAW,CAAC,WAAmB;QAC9B,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACJ,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACzD,KAAK,GAAG,YAAY,EAAE,KAAK,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACvD,MAAM,IAAI,mCAAe,CAAC,eAAe,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,MAAM,IAAI,mCAAe,CAAC,eAAe,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEpC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,MAAM,IAAI,mCAAe,CAAC,eAAe,CAAC,CAAC;QAC5C,CAAC;QAED,IACC,CAAC,6EAA6E,CAAC,IAAI,CAClF,UAAU,CAAC,CAAC,CAAC,CACb,EACA,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,MAAM,IAAI,mCAAe,CAAC,eAAe,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,KAAK,CAAC,gBAAgB;QACrB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAExD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAEnC,MAAM,gBAAgB,GAAG,MAAM,CAAC,qBAAqB,CAAC,aAAa,EAAE;YACpE,YAAY,EAAE,IAAI,CAAC,cAAc,EAAE;YACnC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,sBAAsB;YAC7B,MAAM,EAAE,gBAAgB;YACxB,KAAK,EAAE,KAAK,CAAC,SAAS;YACtB,KAAK,EAAE,KAAK,CAAC,SAAS;SACtB,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,WAAgB,EAAE,WAAmB,EAAE,WAAmB;QACzE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAExD,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAEpD,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACJ,MAAM,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,aAAa,EAAE,WAAW,EAAE;gBACxE,aAAa;gBACb,aAAa;aACb,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACjF,MAAM,IAAI,mCAAe,CAAC,4BAA4B,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACJ,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACrE,MAAM,IAAI,mCAAe,CAAC,eAAe,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,gCAAc,CAAC,mCAAmC,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACvF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,MAAM,IAAI,mCAAe,CAAC,eAAe,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,IAAI,mCAAe,CAAC,sBAAsB,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,CAAC,IAAA,iBAAY,EAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,mCAAe,CAAC,sBAAsB,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;YAC5D,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE;YACvD,SAAS,EAAE;gBACV,IAAI,EAAE;oBACL,IAAI,EAAE,IAAI;iBACV;aACD;SACD,CAAC,CAAC;QAEH,IAAI,UAAU,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC,IAAI,CAAC;QACxB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;YACnD,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;YAChC,SAAS,EAAE,CAAC,gBAAgB,EAAE,MAAM,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,+BAA+B,QAAQ,CAAC,KAAK,yCAAyC,CACtF,CAAC;YAEF,MAAM,EAAE,GAAG,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC;gBAC7C,UAAU,EAAE,MAAM,CAAC,GAAG;gBACtB,YAAY,EAAE,MAAM;gBACpB,MAAM,EAAE,SAAS,CAAC,EAAE;aACpB,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAE3C,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAClE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAC/D;gBACC,SAAS,EAAE,QAAQ,CAAC,UAAU;gBAC9B,QAAQ,EAAE,QAAQ,CAAC,WAAW;gBAC9B,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,cAAc,EAAE,EAAE;gBAClB,IAAI,EAAE,uBAAkB;gBACxB,QAAQ,EAAE,iBAAiB;aAC3B,EACD,GAAG,CACH,CAAC;YAEF,MAAM,GAAG,CAAC,IAAI,CACb,GAAG,CAAC,MAAM,CAAC,iBAAY,EAAE;gBACxB,UAAU,EAAE,MAAM,CAAC,GAAG;gBACtB,YAAY,EAAE,MAAM;gBACpB,MAAM,EAAE,IAAI,CAAC,EAAE;aACf,CAAC,CACF,CAAC;YAEF,OAAO,IAAI,CAAC;QACb,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,aAAa,GAAG,KAAK;QACrC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC;YAC7D,GAAG,EAAE,mCAAuB;SAC5B,CAAC,CAAC;QAEH,IAAI,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC;gBACJ,MAAM,UAAU,GAAG,IAAA,wBAAS,EAAgB,aAAa,CAAC,KAAK,CAAC,CAAC;gBAEjE,IAAI,UAAU,CAAC,iBAAiB,KAAK,EAAE;oBAAE,OAAO,2BAA2B,CAAC;gBAE5E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;gBAE3D,IAAI,UAAU,CAAC,YAAY,IAAI,aAAa,EAAE,CAAC;oBAC9C,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;gBACxE,CAAC;gBACD,OAAO;oBACN,GAAG,UAAU;oBACb,iBAAiB,EAAE,YAAY;iBAC/B,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CACf,yFAAyF,EAEzF,EAAE,KAAK,EAAE,CACT,CAAC;YACH,CAAC;QACF,CAAC;QAED,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;YAClC,GAAG,EAAE,mCAAuB;YAC5B,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;YAC1C,aAAa,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,OAAO,2BAA2B,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAwB;QAC1C,IAAI,iBAAsB,CAAC;QAC3B,IAAI,CAAC;YAEJ,iBAAiB,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC;YAC9F,MAAM,IAAI,wBAAS,CAAC,gDAAgD,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,SAAS,CAAC,YAAY,KAAK,6CAAiC,EAAE,CAAC;YAClE,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QACvD,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,kBAAkB,GAAG,MAAM,MAAM,CAAC,SAAS,CAChD,iBAAiB,EACjB,SAAS,CAAC,QAAQ,EAClB,SAAS,CAAC,YAAY,CACtB,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,MAAM,IAAI,wBAAS,CAAC,uEAAuE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CACnC;YACC,GAAG,EAAE,mCAAuB;SAC5B,EACD;YACC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;gBACrB,GAAG,SAAS;gBACZ,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC;aACzD,CAAC;SACF,CACD,CAAC;QAOF,IAAI,CAAC,UAAU,GAAG;YACjB,GAAG,SAAS;YACZ,iBAAiB;SACjB,CAAC;QACF,IAAI,CAAC,uBAAuB,GAAG,SAAS,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,qBAAqB,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,GAAG,CAC7E,CAAC;QAEF,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9D,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,OAAgB;QACjD,MAAM,2BAA2B,GAAG,IAAA,4CAA8B,GAAE,CAAC;QAErE,IAAI,OAAO,IAAI,CAAC,IAAA,gDAAkC,GAAE,IAAI,CAAC,IAAA,+CAAiC,GAAE,EAAE,CAAC;YAC9F,MAAM,IAAI,2CAAmB,CAC5B,qHAAqH,2BAA2B,GAAG,CACnJ,CAAC;QACH,CAAC;QAED,MAAM,0BAA0B,GAC/B,CAAC,OAAO,IAAI,2BAA2B,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC;QAE5F,cAAS,CAAC,GAAG,CAAC,qBAAY,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAC5D,MAAM,IAAA,4CAA8B,EAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACrF,CAAC;IASO,KAAK,CAAC,oBAAoB;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IACC,IAAI,CAAC,uBAAuB,KAAK,SAAS;YAC1C,GAAG,IAAI,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,OAAO,EAAE;YACvD,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,QAAQ,EAAE;gBAC3C,IAAI,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,QAAQ,EAAE;YAC1D,IAAI,CAAC,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAC,uBAAuB,CAAC,QAAQ;YAClE,IAAI,CAAC,UAAU,CAAC,YAAY,KAAK,IAAI,CAAC,uBAAuB,CAAC,YAAY,EACzE,CAAC;YACF,IAAI,CAAC,uBAAuB,GAAG;gBAC9B,GAAG,IAAI,CAAC,UAAU;gBAClB,aAAa,EAAE,MAAM,CAAC,SAAS,CAC9B,IAAI,CAAC,UAAU,CAAC,iBAAiB,EACjC,IAAI,CAAC,UAAU,CAAC,QAAQ,EACxB,IAAI,CAAC,UAAU,CAAC,YAAY,CAC5B;gBACD,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;aAChD,CAAC;QACH,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC;IACzD,CAAC;CACD,CAAA;AApXY,kCAAW;sBAAX,WAAW;IADvB,IAAA,YAAO,GAAE;qCAK6B,uBAAkB;QACd,2BAAsB;QAClC,wBAAU;QACR,qBAAY;QACV,mBAAc;QACtB,iBAAM;QACN,uBAAM;QACF,wBAAU;GAX5B,WAAW,CAoXvB"}

package/dist/sso.ee/oidc/routes/oidc.controller.ee.d.ts

@@ -1,15 +1,19 @@
 import { OidcConfigDto } from '@n8n/api-types';
+import { Logger } from '@n8n/backend-common';
+import { GlobalConfig } from '@n8n/config';
 import { AuthenticatedRequest } from '@n8n/db';
 import { Request, Response } from 'express';
 import { AuthService } from '../../../auth/auth.service';
+import { AuthlessRequest } from '../../../requests';
 import { UrlService } from '../../../services/url.service';
 import { OidcService } from '../oidc.service.ee';
-import { AuthlessRequest } from '../../../requests';
 export declare class OidcController {
     private readonly oidcService;
     private readonly authService;
     private readonly urlService;
-    constructor(oidcService: OidcService, authService: AuthService, urlService: UrlService);
+    private readonly globalConfig;
+    private readonly logger;
+    constructor(oidcService: OidcService, authService: AuthService, urlService: UrlService, globalConfig: GlobalConfig, logger: Logger);
     retrieveConfiguration(_req: AuthenticatedRequest): Promise<Pick<OidcConfigDto, "clientId" | "clientSecret" | "loginEnabled"> & {
         discoveryEndpoint: URL;
     }>;

package/dist/sso.ee/oidc/routes/oidc.controller.ee.js

@@ -14,21 +14,28 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OidcController = void 0;
 const api_types_1 = require("@n8n/api-types");
+const backend_common_1 = require("@n8n/backend-common");
+const config_1 = require("@n8n/config");
+const constants_1 = require("@n8n/constants");
 const decorators_1 = require("@n8n/decorators");
 const auth_service_1 = require("../../../auth/auth.service");
+const constants_2 = require("../../../constants");
+const bad_request_error_1 = require("../../../errors/response-errors/bad-request.error");
 const url_service_1 = require("../../../services/url.service");
-const constants_1 = require("../constants");
+const constants_3 = require("../constants");
 const oidc_service_ee_1 = require("../oidc.service.ee");
 let OidcController = class OidcController {
-    constructor(oidcService, authService, urlService) {
+    constructor(oidcService, authService, urlService, globalConfig, logger) {
         this.oidcService = oidcService;
         this.authService = authService;
         this.urlService = urlService;
+        this.globalConfig = globalConfig;
+        this.logger = logger;
     }
     async retrieveConfiguration(_req) {
         const config = await this.oidcService.loadConfig();
         if (config.clientSecret) {
-            config.clientSecret = constants_1.OIDC_CLIENT_SECRET_REDACTED_VALUE;
+            config.clientSecret = constants_3.OIDC_CLIENT_SECRET_REDACTED_VALUE;
         }
         return config;
     }
@@ -38,13 +45,38 @@ let OidcController = class OidcController {
         return config;
     }
     async redirectToAuthProvider(_req, res) {
-        const authorizationURL = await this.oidcService.generateLoginUrl();
-        res.redirect(authorizationURL.toString());
+        const authorization = await this.oidcService.generateLoginUrl();
+        const { samesite, secure } = this.globalConfig.auth.cookie;
+        res.cookie(constants_2.OIDC_STATE_COOKIE_NAME, authorization.state, {
+            maxAge: 15 * constants_1.Time.minutes.toMilliseconds,
+            httpOnly: true,
+            sameSite: samesite,
+            secure,
+        });
+        res.cookie(constants_2.OIDC_NONCE_COOKIE_NAME, authorization.nonce, {
+            maxAge: 15 * constants_1.Time.minutes.toMilliseconds,
+            httpOnly: true,
+            sameSite: samesite,
+            secure,
+        });
+        res.redirect(authorization.url.toString());
     }
     async callbackHandler(req, res) {
         const fullUrl = `${this.urlService.getInstanceBaseUrl()}${req.originalUrl}`;
         const callbackUrl = new URL(fullUrl);
-        const user = await this.oidcService.loginUser(callbackUrl);
+        const state = req.cookies[constants_2.OIDC_STATE_COOKIE_NAME];
+        if (typeof state !== 'string') {
+            this.logger.error('State is missing');
+            throw new bad_request_error_1.BadRequestError('Invalid state');
+        }
+        const nonce = req.cookies[constants_2.OIDC_NONCE_COOKIE_NAME];
+        if (typeof nonce !== 'string') {
+            this.logger.error('Nonce is missing');
+            throw new bad_request_error_1.BadRequestError('Invalid nonce');
+        }
+        const user = await this.oidcService.loginUser(callbackUrl, state, nonce);
+        res.clearCookie(constants_2.OIDC_STATE_COOKIE_NAME);
+        res.clearCookie(constants_2.OIDC_NONCE_COOKIE_NAME);
         this.authService.issueCookie(res, user, true, req.browserId);
         res.redirect('/');
     }
@@ -85,6 +117,8 @@ exports.OidcController = OidcController = __decorate([
     (0, decorators_1.RestController)('/sso/oidc'),
     __metadata("design:paramtypes", [oidc_service_ee_1.OidcService,
         auth_service_1.AuthService,
-        url_service_1.UrlService])
+        url_service_1.UrlService,
+        config_1.GlobalConfig,
+        backend_common_1.Logger])
 ], OidcController);
 //# sourceMappingURL=oidc.controller.ee.js.map

package/dist/sso.ee/oidc/routes/oidc.controller.ee.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.controller.ee.js","sourceRoot":"","sources":["../../../../src/sso.ee/oidc/routes/oidc.controller.ee.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,8CAA+C;AAE/C,gDAAyF;AAGzF,sDAAkD;AAClD,wDAAoD;AAEpD,4CAAiE;AACjE,wDAAiD;AAI1C,IAAM,cAAc,GAApB,MAAM,cAAc;IAC1B,YACkB,WAAwB,EACxB,WAAwB,EACxB,UAAsB;QAFtB,gBAAW,GAAX,WAAW,CAAa;QACxB,gBAAW,GAAX,WAAW,CAAa;QACxB,eAAU,GAAV,UAAU,CAAY;IACrC,CAAC;IAKE,AAAN,KAAK,CAAC,qBAAqB,CAAC,IAA0B;QACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;QACnD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,CAAC,YAAY,GAAG,6CAAiC,CAAC;QACzD,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAKK,AAAN,KAAK,CAAC,iBAAiB,CACtB,IAA0B,EAC1B,IAAc,EACR,OAAsB;QAE5B,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC;IACf,CAAC;IAIK,AAAN,KAAK,CAAC,sBAAsB,CAAC,IAAa,EAAE,GAAa;QACxD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAEnE,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3C,CAAC;IAIK,AAAN,KAAK,CAAC,eAAe,CAAC,GAAoB,EAAE,GAAa;QACxD,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAErC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAE3D,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAE7D,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;CACD,CAAA;AAnDY,wCAAc;AAUpB;IAHL,IAAA,gBAAG,EAAC,SAAS,CAAC;IACd,IAAA,qBAAQ,EAAC,WAAW,CAAC;IACrB,IAAA,wBAAW,EAAC,aAAa,CAAC;;;;2DAO1B;AAKK;IAHL,IAAA,iBAAI,EAAC,SAAS,CAAC;IACf,IAAA,qBAAQ,EAAC,WAAW,CAAC;IACrB,IAAA,wBAAW,EAAC,aAAa,CAAC;IAIzB,WAAA,iBAAI,CAAA;;qDAAU,yBAAa;;uDAK5B;AAIK;IAFL,IAAA,gBAAG,EAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjC,IAAA,qBAAQ,EAAC,WAAW,CAAC;;;;4DAKrB;AAIK;IAFL,IAAA,gBAAG,EAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpC,IAAA,qBAAQ,EAAC,WAAW,CAAC;;;;qDAUrB;yBAlDW,cAAc;IAD1B,IAAA,2BAAc,EAAC,WAAW,CAAC;qCAGI,6BAAW;QACX,0BAAW;QACZ,wBAAU;GAJ5B,cAAc,CAmD1B"}
+{"version":3,"file":"oidc.controller.ee.js","sourceRoot":"","sources":["../../../../src/sso.ee/oidc/routes/oidc.controller.ee.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,8CAA+C;AAC/C,wDAA6C;AAC7C,wCAA2C;AAC3C,8CAAsC;AAEtC,gDAAyF;AAGzF,sDAAkD;AAClD,2CAA6E;AAC7E,kFAA6E;AAE7E,wDAAoD;AAEpD,4CAAiE;AACjE,wDAAiD;AAG1C,IAAM,cAAc,GAApB,MAAM,cAAc;IAC1B,YACkB,WAAwB,EACxB,WAAwB,EACxB,UAAsB,EACtB,YAA0B,EAC1B,MAAc;QAJd,gBAAW,GAAX,WAAW,CAAa;QACxB,gBAAW,GAAX,WAAW,CAAa;QACxB,eAAU,GAAV,UAAU,CAAY;QACtB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,WAAM,GAAN,MAAM,CAAQ;IAC7B,CAAC;IAKE,AAAN,KAAK,CAAC,qBAAqB,CAAC,IAA0B;QACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;QACnD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,CAAC,YAAY,GAAG,6CAAiC,CAAC;QACzD,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAKK,AAAN,KAAK,CAAC,iBAAiB,CACtB,IAA0B,EAC1B,IAAc,EACR,OAAsB;QAE5B,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC;IACf,CAAC;IAIK,AAAN,KAAK,CAAC,sBAAsB,CAAC,IAAa,EAAE,GAAa;QACxD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAChE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;QAE3D,GAAG,CAAC,MAAM,CAAC,kCAAsB,EAAE,aAAa,CAAC,KAAK,EAAE;YACvD,MAAM,EAAE,EAAE,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc;YACxC,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,QAAQ;YAClB,MAAM;SACN,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,kCAAsB,EAAE,aAAa,CAAC,KAAK,EAAE;YACvD,MAAM,EAAE,EAAE,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc;YACxC,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,QAAQ;YAClB,MAAM;SACN,CAAC,CAAC;QACH,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5C,CAAC;IAIK,AAAN,KAAK,CAAC,eAAe,CAAC,GAAoB,EAAE,GAAa;QACxD,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,kCAAsB,CAAC,CAAC;QAElD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACtC,MAAM,IAAI,mCAAe,CAAC,eAAe,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,kCAAsB,CAAC,CAAC;QAElD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACtC,MAAM,IAAI,mCAAe,CAAC,eAAe,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAEzE,GAAG,CAAC,WAAW,CAAC,kCAAsB,CAAC,CAAC;QACxC,GAAG,CAAC,WAAW,CAAC,kCAAsB,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAE7D,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;CACD,CAAA;AAjFY,wCAAc;AAYpB;IAHL,IAAA,gBAAG,EAAC,SAAS,CAAC;IACd,IAAA,qBAAQ,EAAC,WAAW,CAAC;IACrB,IAAA,wBAAW,EAAC,aAAa,CAAC;;;;2DAO1B;AAKK;IAHL,IAAA,iBAAI,EAAC,SAAS,CAAC;IACf,IAAA,qBAAQ,EAAC,WAAW,CAAC;IACrB,IAAA,wBAAW,EAAC,aAAa,CAAC;IAIzB,WAAA,iBAAI,CAAA;;qDAAU,yBAAa;;uDAK5B;AAIK;IAFL,IAAA,gBAAG,EAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjC,IAAA,qBAAQ,EAAC,WAAW,CAAC;;;;4DAkBrB;AAIK;IAFL,IAAA,gBAAG,EAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpC,IAAA,qBAAQ,EAAC,WAAW,CAAC;;;;qDAyBrB;yBAhFW,cAAc;IAD1B,IAAA,2BAAc,EAAC,WAAW,CAAC;qCAGI,6BAAW;QACX,0BAAW;QACZ,wBAAU;QACR,qBAAY;QAClB,uBAAM;GANpB,cAAc,CAiF1B"}

package/dist/user-management/email/templates/credentials-shared.handlebars

@@ -58,9 +58,9 @@
     </style>
     <![endif]-->
   <!--[if !mso]><!-->
-  <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,400,500,700" rel="stylesheet" type="text/css">
+  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap" rel="stylesheet" type="text/css">
   <style type="text/css">
-    @import url(https://fonts.googleapis.com/css?family=Open+Sans:300,400,500,700);
+    @import url(https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap);
 
   </style>
   <!--<![endif]-->
@@ -94,21 +94,37 @@
   </style>
 </head>
 
-<body style="word-spacing:normal;background-color:#fbfcfe;">
-  <div style="background-color:#fbfcfe;" lang="und" dir="auto">
+<body style="word-spacing:normal;">
+  <div style="" lang="und" dir="auto">
     <!--[if mso | IE]><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:600px;" width="600" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
     <div style="margin:0px auto;max-width:600px;">
       <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
         <tbody>
           <tr>
-            <td style="direction:ltr;font-size:0px;padding:20px 0px;text-align:center;">
-              <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" style="vertical-align:top;width:600px;" ><![endif]-->
+            <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
+              <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td align="left" class="" style="vertical-align:top;width:600px;" ><![endif]-->
               <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" width="100%">
                   <tbody>
                     <tr>
-                      <td align="center" style="font-size:0px;padding:10px 0 0 0;word-break:break-word;">
-                        <div style="font-family:Open Sans, sans-serif;font-size:24px;font-weight:400;line-height:24px;text-align:center;color:#ff6f5c;">A credential has been shared with you</div>
+                      <td style="vertical-align:top;padding-left:15px;">
+                        <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="" width="100%">
+                          <tbody>
+                            <tr>
+                              <td align="left" style="font-size:0px;padding:0;word-break:break-word;">
+                                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
+                                  <tbody>
+                                    <tr>
+                                      <td style="width:125px;">
+                                        <img alt="" src="cid:n8n-logo" style="border:0;display:block;outline:none;text-decoration:none;height:auto;width:100%;font-size:13px;" width="125" height="auto" />
+                                      </td>
+                                    </tr>
+                                  </tbody>
+                                </table>
+                              </td>
+                            </tr>
+                          </tbody>
+                        </table>
                       </td>
                     </tr>
                   </tbody>
@@ -120,37 +136,19 @@
         </tbody>
       </table>
     </div>
-    <!--[if mso | IE]></td></tr></table><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:600px;" width="600" bgcolor="#FFFFFF" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
-    <div style="background:#FFFFFF;background-color:#FFFFFF;margin:0px auto;max-width:600px;">
-      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="background:#FFFFFF;background-color:#FFFFFF;width:100%;">
+    <!--[if mso | IE]></td></tr></table><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:600px;" width="600" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
         <tbody>
           <tr>
-            <td style="border:1px solid #ddd;direction:ltr;font-size:0px;padding:20px 0px;text-align:center;">
-              <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" style="vertical-align:top;width:598px;" ><![endif]-->
+            <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
+              <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td align="left" class="" style="vertical-align:top;width:600px;" ><![endif]-->
               <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
                 <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
                   <tbody>
                     <tr>
-                      <td align="center" style="font-size:0px;padding:10px 0 0 0;word-break:break-word;">
-                        <div style="font-family:Open Sans, sans-serif;font-size:16px;font-weight:400;line-height:24px;text-align:center;color:#444444;"><b>"{{ credentialsName }}"</b> credential has been shared with you.</div>
-                      </td>
-                    </tr>
-                    <tr>
-                      <td align="center" style="font-size:0px;padding:10px 0 0 0;word-break:break-word;">
-                        <div style="font-family:Open Sans, sans-serif;font-size:16px;font-weight:400;line-height:24px;text-align:center;color:#444444;">To access it, please click the button below.</div>
-                      </td>
-                    </tr>
-                    <tr>
-                      <td align="center" style="font-size:0px;padding:10px 25px;padding-top:20px;word-break:break-word;">
-                        <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:separate;line-height:100%;">
-                          <tbody>
-                            <tr>
-                              <td align="center" bgcolor="#ff6f5c" role="presentation" style="border:none;border-radius:4px;cursor:auto;mso-padding-alt:10px 25px;background:#ff6f5c;" valign="middle">
-                                <a href="{{credentialsListUrl}}" style="display:inline-block;background:#ff6f5c;color:#ffffff;font-family:Open Sans, sans-serif;font-size:18px;font-weight:600;line-height:24px;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:4px;" target="_blank"> Open credential </a>
-                              </td>
-                            </tr>
-                          </tbody>
-                        </table>
+                      <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                        <div style="font-family:Inter, Helvetica, Arial, sans-serif;font-size:24px;font-weight:400;line-height:24px;text-align:left;color:#444444;">A credential has been shared with you</div>
                       </td>
                     </tr>
                   </tbody>
@@ -167,18 +165,28 @@
       <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
         <tbody>
           <tr>
-            <td style="direction:ltr;font-size:0px;padding:20px 0px;text-align:center;">
-              <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" style="vertical-align:top;width:600px;" ><![endif]-->
+            <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
+              <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td align="left" class="" style="vertical-align:top;width:600px;" ><![endif]-->
               <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
                 <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
                   <tbody>
                     <tr>
-                      <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                        <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
+                      <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                        <div style="font-family:Inter, Helvetica, Arial, sans-serif;font-size:16px;font-weight:400;line-height:24px;text-align:left;color:#444444;"><b>"{{ credentialsName }}"</b> credential has been shared with you.</div>
+                      </td>
+                    </tr>
+                    <tr>
+                      <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                        <div style="font-family:Inter, Helvetica, Arial, sans-serif;font-size:16px;font-weight:400;line-height:24px;text-align:left;color:#444444;">To access it, please click the button below.</div>
+                      </td>
+                    </tr>
+                    <tr>
+                      <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                        <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:separate;line-height:100%;">
                           <tbody>
                             <tr>
-                              <td style="width:70px;">
-                                <img alt="" src="cid:n8n-logo" style="border:0;display:block;outline:none;text-decoration:none;height:40px;width:100%;font-size:13px;" width="70" height="40" />
+                              <td align="center" bgcolor="#ff6f5c" role="presentation" style="border:none;border-radius:5px;cursor:auto;mso-padding-alt:10px 25px;background:#ff6f5c;" valign="middle">
+                                <a href="{{credentialsListUrl}}" style="display:inline-block;background:#ff6f5c;color:#ffffff;font-family:Inter, Helvetica, Arial, sans-serif;font-size:16px;font-weight:500;line-height:20px;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:5px;" target="_blank"> Open credential </a>
                               </td>
                             </tr>
                           </tbody>