n8n 1.119.0 → 1.120.0

package/dist/modules/mcp/mcp-oauth-authorization-code.service.d.ts

@@ -0,0 +1,11 @@
+import type { AuthorizationCode } from './database/entities/oauth-authorization-code.entity';
+import { AuthorizationCodeRepository } from './database/repositories/oauth-authorization-code.repository';
+export declare class McpOAuthAuthorizationCodeService {
+    private readonly authorizationCodeRepository;
+    private readonly AUTHORIZATION_CODE_EXPIRY_MS;
+    constructor(authorizationCodeRepository: AuthorizationCodeRepository);
+    createAuthorizationCode(clientId: string, userId: string, redirectUri: string, codeChallenge: string, state: string | null): Promise<string>;
+    findAndValidateAuthorizationCode(authorizationCode: string, clientId: string): Promise<AuthorizationCode>;
+    validateAndConsumeAuthorizationCode(authorizationCode: string, clientId: string, redirectUri?: string): Promise<AuthorizationCode>;
+    getCodeChallenge(authorizationCode: string, clientId: string): Promise<string>;
+}

package/dist/modules/mcp/mcp-oauth-authorization-code.service.js

@@ -0,0 +1,76 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthAuthorizationCodeService = void 0;
+const constants_1 = require("@n8n/constants");
+const di_1 = require("@n8n/di");
+const node_crypto_1 = require("node:crypto");
+const oauth_authorization_code_repository_1 = require("./database/repositories/oauth-authorization-code.repository");
+let McpOAuthAuthorizationCodeService = class McpOAuthAuthorizationCodeService {
+    constructor(authorizationCodeRepository) {
+        this.authorizationCodeRepository = authorizationCodeRepository;
+        this.AUTHORIZATION_CODE_EXPIRY_MS = 10 * constants_1.Time.minutes.toMilliseconds;
+    }
+    async createAuthorizationCode(clientId, userId, redirectUri, codeChallenge, state) {
+        const code = (0, node_crypto_1.randomBytes)(32).toString('hex');
+        await this.authorizationCodeRepository.insert({
+            code,
+            clientId,
+            userId,
+            redirectUri,
+            codeChallenge,
+            codeChallengeMethod: 'S256',
+            state,
+            expiresAt: Date.now() + this.AUTHORIZATION_CODE_EXPIRY_MS,
+            used: false,
+        });
+        return code;
+    }
+    async findAndValidateAuthorizationCode(authorizationCode, clientId) {
+        const authRecord = await this.authorizationCodeRepository.findOne({
+            where: {
+                code: authorizationCode,
+                clientId,
+            },
+        });
+        if (!authRecord) {
+            throw new Error('Invalid authorization code');
+        }
+        if (authRecord.expiresAt < Date.now()) {
+            await this.authorizationCodeRepository.remove(authRecord);
+            throw new Error('Authorization code expired');
+        }
+        return authRecord;
+    }
+    async validateAndConsumeAuthorizationCode(authorizationCode, clientId, redirectUri) {
+        const authRecord = await this.findAndValidateAuthorizationCode(authorizationCode, clientId);
+        if (redirectUri && authRecord.redirectUri !== redirectUri) {
+            throw new Error('Redirect URI mismatch');
+        }
+        const result = await this.authorizationCodeRepository.update({ code: authorizationCode, used: false }, { used: true });
+        const numAffected = result.affected ?? 0;
+        if (numAffected < 1) {
+            throw new Error('Authorization code already used');
+        }
+        authRecord.used = true;
+        return authRecord;
+    }
+    async getCodeChallenge(authorizationCode, clientId) {
+        const authRecord = await this.findAndValidateAuthorizationCode(authorizationCode, clientId);
+        return authRecord.codeChallenge;
+    }
+};
+exports.McpOAuthAuthorizationCodeService = McpOAuthAuthorizationCodeService;
+exports.McpOAuthAuthorizationCodeService = McpOAuthAuthorizationCodeService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [oauth_authorization_code_repository_1.AuthorizationCodeRepository])
+], McpOAuthAuthorizationCodeService);
+//# sourceMappingURL=mcp-oauth-authorization-code.service.js.map

package/dist/modules/mcp/mcp-oauth-authorization-code.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-authorization-code.service.js","sourceRoot":"","sources":["../../../src/modules/mcp/mcp-oauth-authorization-code.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,8CAAsC;AACtC,gCAAkC;AAClC,6CAA0C;AAG1C,qHAA0G;AAOnG,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAG5C,YAA6B,2BAAwD;QAAxD,gCAA2B,GAA3B,2BAA2B,CAA6B;QAFpE,iCAA4B,GAAG,EAAE,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,CAAC;IAEO,CAAC;IAMzF,KAAK,CAAC,uBAAuB,CAC5B,QAAgB,EAChB,MAAc,EACd,WAAmB,EACnB,aAAqB,EACrB,KAAoB;QAEpB,MAAM,IAAI,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE7C,MAAM,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC;YAC7C,IAAI;YACJ,QAAQ;YACR,MAAM;YACN,WAAW;YACX,aAAa;YACb,mBAAmB,EAAE,MAAM;YAC3B,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,4BAA4B;YACzD,IAAI,EAAE,KAAK;SACX,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACb,CAAC;IAMD,KAAK,CAAC,gCAAgC,CACrC,iBAAyB,EACzB,QAAgB;QAEhB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC;YACjE,KAAK,EAAE;gBACN,IAAI,EAAE,iBAAiB;gBACvB,QAAQ;aACR;SACD,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,UAAU,CAAC;IACnB,CAAC;IAMD,KAAK,CAAC,mCAAmC,CACxC,iBAAyB,EACzB,QAAgB,EAChB,WAAoB;QAEpB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gCAAgC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QAE5F,IAAI,WAAW,IAAI,UAAU,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAC3D,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,KAAK,EAAE,EACxC,EAAE,IAAI,EAAE,IAAI,EAAE,CACd,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QACzC,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACpD,CAAC;QAED,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;QACvB,OAAO,UAAU,CAAC;IACnB,CAAC;IAMD,KAAK,CAAC,gBAAgB,CAAC,iBAAyB,EAAE,QAAgB;QACjE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gCAAgC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QAC5F,OAAO,UAAU,CAAC,aAAa,CAAC;IACjC,CAAC;CACD,CAAA;AAjGY,4EAAgC;2CAAhC,gCAAgC;IAD5C,IAAA,YAAO,GAAE;qCAIiD,iEAA2B;GAHzE,gCAAgC,CAiG5C"}

package/dist/modules/mcp/mcp-oauth-consent.service.d.ts

@@ -0,0 +1,20 @@
+import { Logger } from '@n8n/backend-common';
+import { OAuthClientRepository } from './database/repositories/oauth-client.repository';
+import { UserConsentRepository } from './database/repositories/oauth-user-consent.repository';
+import { McpOAuthAuthorizationCodeService } from './mcp-oauth-authorization-code.service';
+import { OAuthSessionService } from './oauth-session.service';
+export declare class McpOAuthConsentService {
+    private readonly logger;
+    private readonly oauthSessionService;
+    private readonly oauthClientRepository;
+    private readonly userConsentRepository;
+    private readonly authorizationCodeService;
+    constructor(logger: Logger, oauthSessionService: OAuthSessionService, oauthClientRepository: OAuthClientRepository, userConsentRepository: UserConsentRepository, authorizationCodeService: McpOAuthAuthorizationCodeService);
+    getConsentDetails(sessionToken: string): Promise<{
+        clientName: string;
+        clientId: string;
+    } | null>;
+    handleConsentDecision(sessionToken: string, userId: string, approved: boolean): Promise<{
+        redirectUrl: string;
+    }>;
+}

package/dist/modules/mcp/mcp-oauth-consent.service.js

@@ -0,0 +1,87 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthConsentService = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const di_1 = require("@n8n/di");
+const n8n_workflow_1 = require("n8n-workflow");
+const oauth_client_repository_1 = require("./database/repositories/oauth-client.repository");
+const oauth_user_consent_repository_1 = require("./database/repositories/oauth-user-consent.repository");
+const mcp_oauth_authorization_code_service_1 = require("./mcp-oauth-authorization-code.service");
+const mcp_oauth_helpers_1 = require("./mcp-oauth.helpers");
+const oauth_session_service_1 = require("./oauth-session.service");
+let McpOAuthConsentService = class McpOAuthConsentService {
+    constructor(logger, oauthSessionService, oauthClientRepository, userConsentRepository, authorizationCodeService) {
+        this.logger = logger;
+        this.oauthSessionService = oauthSessionService;
+        this.oauthClientRepository = oauthClientRepository;
+        this.userConsentRepository = userConsentRepository;
+        this.authorizationCodeService = authorizationCodeService;
+    }
+    async getConsentDetails(sessionToken) {
+        try {
+            const sessionPayload = this.oauthSessionService.verifySession(sessionToken);
+            const client = await this.oauthClientRepository.findOne({
+                where: { id: sessionPayload.clientId },
+            });
+            if (!client) {
+                return null;
+            }
+            return {
+                clientName: client.name,
+                clientId: client.id,
+            };
+        }
+        catch (error) {
+            this.logger.error('Error getting consent details', { error });
+            return null;
+        }
+    }
+    async handleConsentDecision(sessionToken, userId, approved) {
+        let sessionPayload;
+        try {
+            sessionPayload = this.oauthSessionService.verifySession(sessionToken);
+        }
+        catch (error) {
+            throw new n8n_workflow_1.UserError('Invalid or expired session');
+        }
+        if (!approved) {
+            const redirectUrl = mcp_oauth_helpers_1.McpOAuthHelpers.buildErrorRedirectUrl(sessionPayload.redirectUri, 'access_denied', 'User denied the authorization request', sessionPayload.state);
+            this.logger.info('Consent denied', {
+                clientId: sessionPayload.clientId,
+                userId,
+            });
+            return { redirectUrl };
+        }
+        await this.userConsentRepository.insert({
+            userId,
+            clientId: sessionPayload.clientId,
+            grantedAt: Date.now(),
+        });
+        const code = await this.authorizationCodeService.createAuthorizationCode(sessionPayload.clientId, userId, sessionPayload.redirectUri, sessionPayload.codeChallenge, sessionPayload.state);
+        const successRedirectUrl = mcp_oauth_helpers_1.McpOAuthHelpers.buildSuccessRedirectUrl(sessionPayload.redirectUri, code, sessionPayload.state);
+        this.logger.info('Consent approved', {
+            clientId: sessionPayload.clientId,
+            userId,
+        });
+        return { redirectUrl: successRedirectUrl };
+    }
+};
+exports.McpOAuthConsentService = McpOAuthConsentService;
+exports.McpOAuthConsentService = McpOAuthConsentService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [backend_common_1.Logger,
+        oauth_session_service_1.OAuthSessionService,
+        oauth_client_repository_1.OAuthClientRepository,
+        oauth_user_consent_repository_1.UserConsentRepository,
+        mcp_oauth_authorization_code_service_1.McpOAuthAuthorizationCodeService])
+], McpOAuthConsentService);
+//# sourceMappingURL=mcp-oauth-consent.service.js.map

package/dist/modules/mcp/mcp-oauth-consent.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-consent.service.js","sourceRoot":"","sources":["../../../src/modules/mcp/mcp-oauth-consent.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;AAC7C,gCAAkC;AAClC,+CAAyC;AAEzC,6FAAwF;AACxF,yGAA8F;AAC9F,iGAA0F;AAC1F,2DAAsD;AACtD,mEAAwF;AAOjF,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAClC,YACkB,MAAc,EACd,mBAAwC,EACxC,qBAA4C,EAC5C,qBAA4C,EAC5C,wBAA0D;QAJ1D,WAAM,GAAN,MAAM,CAAQ;QACd,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,6BAAwB,GAAxB,wBAAwB,CAAkC;IACzE,CAAC;IAMJ,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAI3C,IAAI,CAAC;YACJ,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAE5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;gBACvD,KAAK,EAAE,EAAE,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;aACtC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACb,CAAC;YAED,OAAO;gBACN,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;aACnB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAMD,KAAK,CAAC,qBAAqB,CAC1B,YAAoB,EACpB,MAAc,EACd,QAAiB;QAEjB,IAAI,cAAmC,CAAC;QACxC,IAAI,CAAC;YACJ,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,wBAAS,CAAC,4BAA4B,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,mCAAe,CAAC,qBAAqB,CACxD,cAAc,CAAC,WAAW,EAC1B,eAAe,EACf,uCAAuC,EACvC,cAAc,CAAC,KAAK,CACpB,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE;gBAClC,QAAQ,EAAE,cAAc,CAAC,QAAQ;gBACjC,MAAM;aACN,CAAC,CAAC;YAEH,OAAO,EAAE,WAAW,EAAE,CAAC;QACxB,CAAC;QAED,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;YACvC,MAAM;YACN,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CACvE,cAAc,CAAC,QAAQ,EACvB,MAAM,EACN,cAAc,CAAC,WAAW,EAC1B,cAAc,CAAC,aAAa,EAC5B,cAAc,CAAC,KAAK,CACpB,CAAC;QAEF,MAAM,kBAAkB,GAAG,mCAAe,CAAC,uBAAuB,CACjE,cAAc,CAAC,WAAW,EAC1B,IAAI,EACJ,cAAc,CAAC,KAAK,CACpB,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE;YACpC,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,MAAM;SACN,CAAC,CAAC;QAEH,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAC5C,CAAC;CACD,CAAA;AAjGY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,YAAO,GAAE;qCAGiB,uBAAM;QACO,2CAAmB;QACjB,+CAAqB;QACrB,qDAAqB;QAClB,uEAAgC;GANhE,sBAAsB,CAiGlC"}

package/dist/modules/mcp/mcp-oauth-service.d.ts

@@ -0,0 +1,31 @@
+import type { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients';
+import type { AuthorizationParams, OAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/provider';
+import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types';
+import type { OAuthClientInformationFull, OAuthTokens, OAuthTokenRevocationRequest } from '@modelcontextprotocol/sdk/shared/auth';
+import { Logger } from '@n8n/backend-common';
+import type { Response } from 'express';
+import { OAuthClient } from './database/entities/oauth-client.entity';
+import { OAuthClientRepository } from './database/repositories/oauth-client.repository';
+import { UserConsentRepository } from './database/repositories/oauth-user-consent.repository';
+import { McpOAuthAuthorizationCodeService } from './mcp-oauth-authorization-code.service';
+import { McpOAuthTokenService } from './mcp-oauth-token.service';
+import { OAuthSessionService } from './oauth-session.service';
+export declare const SUPPORTED_SCOPES: string[];
+export declare class McpOAuthService implements OAuthServerProvider {
+    private readonly logger;
+    private readonly oauthSessionService;
+    private readonly oauthClientRepository;
+    private readonly tokenService;
+    private readonly authorizationCodeService;
+    private readonly userConsentRepository;
+    constructor(logger: Logger, oauthSessionService: OAuthSessionService, oauthClientRepository: OAuthClientRepository, tokenService: McpOAuthTokenService, authorizationCodeService: McpOAuthAuthorizationCodeService, userConsentRepository: UserConsentRepository);
+    get clientsStore(): OAuthRegisteredClientsStore;
+    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
+    challengeForAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, _codeVerifier?: string, redirectUri?: string): Promise<OAuthTokens>;
+    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, _scopes?: string[]): Promise<OAuthTokens>;
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    revokeToken(client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
+    getAllClients(userId: string): Promise<Array<Omit<OAuthClient, 'clientSecret' | 'clientSecretExpiresAt' | 'setUpdateDate'>>>;
+    deleteClient(clientId: string): Promise<void>;
+}

package/dist/modules/mcp/mcp-oauth-service.js

@@ -0,0 +1,164 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthService = exports.SUPPORTED_SCOPES = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const di_1 = require("@n8n/di");
+const oauth_client_repository_1 = require("./database/repositories/oauth-client.repository");
+const oauth_user_consent_repository_1 = require("./database/repositories/oauth-user-consent.repository");
+const mcp_oauth_authorization_code_service_1 = require("./mcp-oauth-authorization-code.service");
+const mcp_oauth_token_service_1 = require("./mcp-oauth-token.service");
+const oauth_session_service_1 = require("./oauth-session.service");
+exports.SUPPORTED_SCOPES = ['tool:listWorkflows', 'tool:getWorkflowDetails'];
+let McpOAuthService = class McpOAuthService {
+    constructor(logger, oauthSessionService, oauthClientRepository, tokenService, authorizationCodeService, userConsentRepository) {
+        this.logger = logger;
+        this.oauthSessionService = oauthSessionService;
+        this.oauthClientRepository = oauthClientRepository;
+        this.tokenService = tokenService;
+        this.authorizationCodeService = authorizationCodeService;
+        this.userConsentRepository = userConsentRepository;
+    }
+    get clientsStore() {
+        return {
+            getClient: async (clientId) => {
+                const client = await this.oauthClientRepository.findOneBy({ id: clientId });
+                if (!client) {
+                    return undefined;
+                }
+                return {
+                    client_id: client.id,
+                    client_name: client.name,
+                    redirect_uris: client.redirectUris,
+                    grant_types: client.grantTypes,
+                    token_endpoint_auth_method: client.tokenEndpointAuthMethod,
+                    ...(client.clientSecret && { client_secret: client.clientSecret }),
+                    ...(client.clientSecretExpiresAt && {
+                        client_secret_expires_at: client.clientSecretExpiresAt,
+                    }),
+                    response_types: ['code'],
+                    scope: exports.SUPPORTED_SCOPES.join(' '),
+                };
+            },
+            registerClient: async (client) => {
+                try {
+                    await this.oauthClientRepository.insert({
+                        id: client.client_id,
+                        name: client.client_name,
+                        redirectUris: client.redirect_uris,
+                        grantTypes: client.grant_types,
+                        clientSecret: client.client_secret ?? null,
+                        clientSecretExpiresAt: client.client_secret_expires_at ?? null,
+                        tokenEndpointAuthMethod: client.token_endpoint_auth_method ?? 'none',
+                    });
+                }
+                catch (error) {
+                    this.logger.error('Error registering OAuth client', {
+                        error,
+                        clientId: client.client_id,
+                    });
+                }
+                return client;
+            },
+        };
+    }
+    async authorize(client, params, res) {
+        this.logger.debug('Starting OAuth authorization', { clientId: client.client_id });
+        try {
+            this.oauthSessionService.createSession(res, {
+                clientId: client.client_id,
+                redirectUri: params.redirectUri,
+                codeChallenge: params.codeChallenge,
+                state: params.state ?? null,
+            });
+            res.redirect('/oauth/consent');
+        }
+        catch (error) {
+            this.logger.error('Error in authorize method', { error, clientId: client.client_id });
+            this.oauthSessionService.clearSession(res);
+            res.status(500).json({ error: 'server_error', error_description: 'Internal server error' });
+        }
+    }
+    async challengeForAuthorizationCode(client, authorizationCode) {
+        return await this.authorizationCodeService.getCodeChallenge(authorizationCode, client.client_id);
+    }
+    async exchangeAuthorizationCode(client, authorizationCode, _codeVerifier, redirectUri) {
+        const authRecord = await this.authorizationCodeService.validateAndConsumeAuthorizationCode(authorizationCode, client.client_id, redirectUri);
+        const { accessToken, refreshToken } = this.tokenService.generateTokenPair(authRecord.userId, client.client_id);
+        await this.tokenService.saveTokenPair(accessToken, refreshToken, client.client_id, authRecord.userId);
+        this.logger.info('Authorization code exchanged for tokens', {
+            clientId: client.client_id,
+            userId: authRecord.userId,
+        });
+        return {
+            access_token: accessToken,
+            token_type: 'Bearer',
+            expires_in: 3600,
+            refresh_token: refreshToken,
+        };
+    }
+    async exchangeRefreshToken(client, refreshToken, _scopes) {
+        return await this.tokenService.validateAndRotateRefreshToken(refreshToken, client.client_id);
+    }
+    async verifyAccessToken(token) {
+        return await this.tokenService.verifyAccessToken(token);
+    }
+    async revokeToken(client, request) {
+        const { token, token_type_hint } = request;
+        if (!token_type_hint || token_type_hint === 'access_token') {
+            const revoked = await this.tokenService.revokeAccessToken(token, client.client_id);
+            if (revoked) {
+                return;
+            }
+        }
+        if (!token_type_hint || token_type_hint === 'refresh_token') {
+            const revoked = await this.tokenService.revokeRefreshToken(token, client.client_id);
+            if (revoked) {
+                return;
+            }
+        }
+        this.logger.debug('Token revocation requested for unknown token', {
+            clientId: client.client_id,
+        });
+    }
+    async getAllClients(userId) {
+        const userConsents = await this.userConsentRepository.findByUserWithClient(userId);
+        return userConsents.map((consent) => {
+            const { clientSecret, clientSecretExpiresAt, ...sanitizedClient } = consent.client;
+            return sanitizedClient;
+        });
+    }
+    async deleteClient(clientId) {
+        const client = await this.oauthClientRepository.findOne({
+            where: { id: clientId },
+        });
+        if (!client) {
+            throw new Error(`OAuth client with ID ${clientId} not found`);
+        }
+        this.logger.info('Deleting OAuth client and related data', { clientId });
+        await this.oauthClientRepository.delete({ id: clientId });
+        this.logger.info('OAuth client deleted successfully', {
+            clientId,
+            clientName: client.name,
+        });
+    }
+};
+exports.McpOAuthService = McpOAuthService;
+exports.McpOAuthService = McpOAuthService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [backend_common_1.Logger,
+        oauth_session_service_1.OAuthSessionService,
+        oauth_client_repository_1.OAuthClientRepository,
+        mcp_oauth_token_service_1.McpOAuthTokenService,
+        mcp_oauth_authorization_code_service_1.McpOAuthAuthorizationCodeService,
+        oauth_user_consent_repository_1.UserConsentRepository])
+], McpOAuthService);
+//# sourceMappingURL=mcp-oauth-service.js.map

package/dist/modules/mcp/mcp-oauth-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-service.js","sourceRoot":"","sources":["../../../src/modules/mcp/mcp-oauth-service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAWA,wDAA6C;AAC7C,gCAAkC;AAIlC,6FAAwF;AACxF,yGAA8F;AAC9F,iGAA0F;AAC1F,uEAAiE;AACjE,mEAA8D;AAEjD,QAAA,gBAAgB,GAAG,CAAC,oBAAoB,EAAE,yBAAyB,CAAC,CAAC;AAO3E,IAAM,eAAe,GAArB,MAAM,eAAe;IAC3B,YACkB,MAAc,EACd,mBAAwC,EACxC,qBAA4C,EAC5C,YAAkC,EAClC,wBAA0D,EAC1D,qBAA4C;QAL5C,WAAM,GAAN,MAAM,CAAQ;QACd,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,iBAAY,GAAZ,YAAY,CAAsB;QAClC,6BAAwB,GAAxB,wBAAwB,CAAkC;QAC1D,0BAAqB,GAArB,qBAAqB,CAAuB;IAC3D,CAAC;IAEJ,IAAI,YAAY;QACf,OAAO;YACN,SAAS,EAAE,KAAK,EAAE,QAAgB,EAAmD,EAAE;gBACtF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;oBACb,OAAO,SAAS,CAAC;gBAClB,CAAC;gBAED,OAAO;oBACN,SAAS,EAAE,MAAM,CAAC,EAAE;oBACpB,WAAW,EAAE,MAAM,CAAC,IAAI;oBACxB,aAAa,EAAE,MAAM,CAAC,YAAY;oBAClC,WAAW,EAAE,MAAM,CAAC,UAAU;oBAC9B,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;oBAC1D,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;oBAClE,GAAG,CAAC,MAAM,CAAC,qBAAqB,IAAI;wBACnC,wBAAwB,EAAE,MAAM,CAAC,qBAAqB;qBACtD,CAAC;oBACF,cAAc,EAAE,CAAC,MAAM,CAAC;oBACxB,KAAK,EAAE,wBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;iBACjC,CAAC;YACH,CAAC;YACD,cAAc,EAAE,KAAK,EACpB,MAAkC,EACI,EAAE;gBACxC,IAAI,CAAC;oBACJ,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;wBACvC,EAAE,EAAE,MAAM,CAAC,SAAS;wBACpB,IAAI,EAAE,MAAM,CAAC,WAAW;wBACxB,YAAY,EAAE,MAAM,CAAC,aAAa;wBAClC,UAAU,EAAE,MAAM,CAAC,WAAW;wBAC9B,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;wBAC1C,qBAAqB,EAAE,MAAM,CAAC,wBAAwB,IAAI,IAAI;wBAC9D,uBAAuB,EAAE,MAAM,CAAC,0BAA0B,IAAI,MAAM;qBACpE,CAAC,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;wBACnD,KAAK;wBACL,QAAQ,EAAE,MAAM,CAAC,SAAS;qBAC1B,CAAC,CAAC;gBACJ,CAAC;gBAED,OAAO,MAAM,CAAC;YACf,CAAC;SACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CACd,MAAkC,EAClC,MAA2B,EAC3B,GAAa;QAEb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAElF,IAAI,CAAC;YACJ,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,GAAG,EAAE;gBAC3C,QAAQ,EAAE,MAAM,CAAC,SAAS;gBAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;aAC3B,CAAC,CAAC;YAEH,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACtF,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC7F,CAAC;IACF,CAAC;IAED,KAAK,CAAC,6BAA6B,CAClC,MAAkC,EAClC,iBAAyB;QAEzB,OAAO,MAAM,IAAI,CAAC,wBAAwB,CAAC,gBAAgB,CAC1D,iBAAiB,EACjB,MAAM,CAAC,SAAS,CAChB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC9B,MAAkC,EAClC,iBAAyB,EACzB,aAAsB,EACtB,WAAoB;QAEpB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,mCAAmC,CACzF,iBAAiB,EACjB,MAAM,CAAC,SAAS,EAChB,WAAW,CACX,CAAC;QAEF,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CACxE,UAAU,CAAC,MAAM,EACjB,MAAM,CAAC,SAAS,CAChB,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CACpC,WAAW,EACX,YAAY,EACZ,MAAM,CAAC,SAAS,EAChB,UAAU,CAAC,MAAM,CACjB,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;YAC3D,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;SACzB,CAAC,CAAC;QAEH,OAAO;YACN,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI;YAChB,aAAa,EAAE,YAAY;SAC3B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CACzB,MAAkC,EAClC,YAAoB,EACpB,OAAkB;QAElB,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,6BAA6B,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9F,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACpC,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,WAAW,CAChB,MAAkC,EAClC,OAAoC;QAEpC,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QAE3C,IAAI,CAAC,eAAe,IAAI,eAAe,KAAK,cAAc,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACnF,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO;YACR,CAAC;QACF,CAAC;QAED,IAAI,CAAC,eAAe,IAAI,eAAe,KAAK,eAAe,EAAE,CAAC;YAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACpF,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO;YACR,CAAC;QACF,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE;YACjE,QAAQ,EAAE,MAAM,CAAC,SAAS;SAC1B,CAAC,CAAC;IACJ,CAAC;IAKD,KAAK,CAAC,aAAa,CAClB,MAAc;QAGd,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAGnF,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YACnC,MAAM,EAAE,YAAY,EAAE,qBAAqB,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YACnF,OAAO,eAAe,CAAC;QACxB,CAAC,CAAC,CAAC;IACJ,CAAC;IAKD,KAAK,CAAC,YAAY,CAAC,QAAgB;QAElC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;YACvD,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,YAAY,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEzE,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;YACrD,QAAQ;YACR,UAAU,EAAE,MAAM,CAAC,IAAI;SACvB,CAAC,CAAC;IACJ,CAAC;CACD,CAAA;AA1MY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,YAAO,GAAE;qCAGiB,uBAAM;QACO,2CAAmB;QACjB,+CAAqB;QAC9B,8CAAoB;QACR,uEAAgC;QACnC,qDAAqB;GAPlD,eAAe,CA0M3B"}

package/dist/modules/mcp/mcp-oauth-token.service.d.ts

@@ -0,0 +1,28 @@
+import { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types';
+import { OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth';
+import { Logger } from '@n8n/backend-common';
+import { User, UserRepository } from '@n8n/db';
+import { JwtService } from '../../services/jwt.service';
+import { AccessTokenRepository } from './database/repositories/oauth-access-token.repository';
+import { RefreshTokenRepository } from './database/repositories/oauth-refresh-token.repository';
+export declare class McpOAuthTokenService {
+    private readonly logger;
+    private readonly jwtService;
+    private readonly userRepository;
+    private readonly accessTokenRepository;
+    private readonly refreshTokenRepository;
+    private readonly MCP_AUDIENCE;
+    private readonly ACCESS_TOKEN_EXPIRY_SECONDS;
+    private readonly REFRESH_TOKEN_EXPIRY_MS;
+    constructor(logger: Logger, jwtService: JwtService, userRepository: UserRepository, accessTokenRepository: AccessTokenRepository, refreshTokenRepository: RefreshTokenRepository);
+    generateTokenPair(userId: string, clientId: string): {
+        accessToken: string;
+        refreshToken: string;
+    };
+    saveTokenPair(accessToken: string, refreshToken: string, clientId: string, userId: string): Promise<void>;
+    validateAndRotateRefreshToken(refreshToken: string, clientId: string): Promise<OAuthTokens>;
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    verifyOAuthAccessToken(token: string): Promise<User | null>;
+    revokeAccessToken(token: string, clientId: string): Promise<boolean>;
+    revokeRefreshToken(token: string, clientId: string): Promise<boolean>;
+}

package/dist/modules/mcp/mcp-oauth-token.service.js

@@ -0,0 +1,182 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthTokenService = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const constants_1 = require("@n8n/constants");
+const db_1 = require("@n8n/db");
+const di_1 = require("@n8n/di");
+const typeorm_1 = require("@n8n/typeorm");
+const node_crypto_1 = require("node:crypto");
+const jwt_service_1 = require("../../services/jwt.service");
+const oauth_access_token_entity_1 = require("./database/entities/oauth-access-token.entity");
+const oauth_refresh_token_entity_1 = require("./database/entities/oauth-refresh-token.entity");
+const oauth_access_token_repository_1 = require("./database/repositories/oauth-access-token.repository");
+const oauth_refresh_token_repository_1 = require("./database/repositories/oauth-refresh-token.repository");
+let McpOAuthTokenService = class McpOAuthTokenService {
+    constructor(logger, jwtService, userRepository, accessTokenRepository, refreshTokenRepository) {
+        this.logger = logger;
+        this.jwtService = jwtService;
+        this.userRepository = userRepository;
+        this.accessTokenRepository = accessTokenRepository;
+        this.refreshTokenRepository = refreshTokenRepository;
+        this.MCP_AUDIENCE = 'mcp-server-api';
+        this.ACCESS_TOKEN_EXPIRY_SECONDS = 1 * constants_1.Time.hours.toSeconds;
+        this.REFRESH_TOKEN_EXPIRY_MS = 30 * constants_1.Time.days.toMilliseconds;
+    }
+    generateTokenPair(userId, clientId) {
+        const accessToken = this.jwtService.sign({
+            sub: userId,
+            aud: this.MCP_AUDIENCE,
+            client_id: clientId,
+            jti: (0, node_crypto_1.randomUUID)(),
+            iat: Math.floor(Date.now() / 1000),
+            exp: Math.floor(Date.now() / 1000) + this.ACCESS_TOKEN_EXPIRY_SECONDS,
+            meta: {
+                isOAuth: true,
+            },
+        });
+        const refreshToken = (0, node_crypto_1.randomBytes)(32).toString('hex');
+        return { accessToken, refreshToken };
+    }
+    async saveTokenPair(accessToken, refreshToken, clientId, userId) {
+        await this.accessTokenRepository.manager.transaction(async (transactionManager) => {
+            await transactionManager.insert(this.accessTokenRepository.target, {
+                token: accessToken,
+                clientId,
+                userId,
+            });
+            await transactionManager.insert(this.refreshTokenRepository.target, {
+                token: refreshToken,
+                clientId,
+                userId,
+                expiresAt: Date.now() + this.REFRESH_TOKEN_EXPIRY_MS,
+            });
+        });
+    }
+    async validateAndRotateRefreshToken(refreshToken, clientId) {
+        return await (0, db_1.withTransaction)(this.refreshTokenRepository.manager, undefined, async (trx) => {
+            const now = Date.now();
+            const refreshTokenRecord = await trx.findOne(oauth_refresh_token_entity_1.RefreshToken, {
+                where: {
+                    token: refreshToken,
+                    clientId,
+                },
+            });
+            if (!refreshTokenRecord) {
+                throw new Error('Invalid refresh token');
+            }
+            const result = await trx.delete(oauth_refresh_token_entity_1.RefreshToken, {
+                token: refreshToken,
+                clientId,
+                expiresAt: (0, typeorm_1.MoreThanOrEqual)(now),
+            });
+            const numAffected = result.affected ?? 0;
+            if (numAffected < 1) {
+                throw new Error('Invalid refresh token');
+            }
+            const { accessToken, refreshToken: newRefreshToken } = this.generateTokenPair(refreshTokenRecord.userId, clientId);
+            await trx.insert(oauth_access_token_entity_1.AccessToken, {
+                token: accessToken,
+                clientId,
+                userId: refreshTokenRecord.userId,
+            });
+            await trx.insert(oauth_refresh_token_entity_1.RefreshToken, {
+                token: newRefreshToken,
+                clientId,
+                userId: refreshTokenRecord.userId,
+                expiresAt: now + this.REFRESH_TOKEN_EXPIRY_MS,
+            });
+            this.logger.info('Refresh token rotated and new access token issued', {
+                clientId,
+                userId: refreshTokenRecord.userId,
+            });
+            return {
+                access_token: accessToken,
+                token_type: 'Bearer',
+                expires_in: this.ACCESS_TOKEN_EXPIRY_SECONDS,
+                refresh_token: newRefreshToken,
+            };
+        });
+    }
+    async verifyAccessToken(token) {
+        let decoded;
+        try {
+            decoded = this.jwtService.verify(token, { audience: this.MCP_AUDIENCE });
+        }
+        catch (error) {
+            throw new Error('Invalid access token: JWT verification failed');
+        }
+        const accessTokenRecord = await this.accessTokenRepository.findOne({
+            where: { token },
+        });
+        if (!accessTokenRecord) {
+            throw new Error('Invalid access token: not found in database');
+        }
+        return {
+            token,
+            clientId: decoded.client_id,
+            scopes: [],
+            extra: {
+                userId: decoded.sub,
+            },
+        };
+    }
+    async verifyOAuthAccessToken(token) {
+        try {
+            const authInfo = await this.verifyAccessToken(token);
+            const userId = authInfo.extra?.userId;
+            if (!userId) {
+                return null;
+            }
+            const user = await this.userRepository.findOne({
+                where: { id: userId },
+                relations: ['role'],
+            });
+            return user;
+        }
+        catch (error) {
+            return null;
+        }
+    }
+    async revokeAccessToken(token, clientId) {
+        const result = await this.accessTokenRepository.delete({
+            token,
+            clientId,
+        });
+        const revoked = (result.affected ?? 0) > 0;
+        if (revoked) {
+            this.logger.info('Access token revoked', { clientId });
+        }
+        return revoked;
+    }
+    async revokeRefreshToken(token, clientId) {
+        const result = await this.refreshTokenRepository.delete({
+            token,
+            clientId,
+        });
+        const revoked = (result.affected ?? 0) > 0;
+        if (revoked) {
+            this.logger.info('Refresh token revoked', { clientId });
+        }
+        return revoked;
+    }
+};
+exports.McpOAuthTokenService = McpOAuthTokenService;
+exports.McpOAuthTokenService = McpOAuthTokenService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [backend_common_1.Logger,
+        jwt_service_1.JwtService,
+        db_1.UserRepository,
+        oauth_access_token_repository_1.AccessTokenRepository,
+        oauth_refresh_token_repository_1.RefreshTokenRepository])
+], McpOAuthTokenService);
+//# sourceMappingURL=mcp-oauth-token.service.js.map

package/dist/modules/mcp/mcp-oauth-token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-token.service.js","sourceRoot":"","sources":["../../../src/modules/mcp/mcp-oauth-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,wDAA6C;AAC7C,8CAAsC;AACtC,gCAAgE;AAChE,gCAAkC;AAClC,0CAA+C;AAC/C,6CAAsD;AAEtD,wDAAoD;AAEpD,6FAA4E;AAC5E,+FAA8E;AAC9E,yGAA8F;AAC9F,2GAAgG;AAOzF,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAKhC,YACkB,MAAc,EACd,UAAsB,EACtB,cAA8B,EAC9B,qBAA4C,EAC5C,sBAA8C;QAJ9C,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAY;QACtB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,2BAAsB,GAAtB,sBAAsB,CAAwB;QAT/C,iBAAY,GAAG,gBAAgB,CAAC;QAChC,gCAA2B,GAAG,CAAC,GAAG,gBAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QACvD,4BAAuB,GAAG,EAAE,GAAG,gBAAI,CAAC,IAAI,CAAC,cAAc,CAAC;IAQtE,CAAC;IAEJ,iBAAiB,CAChB,MAAc,EACd,QAAgB;QAEhB,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACxC,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,IAAI,CAAC,YAAY;YACtB,SAAS,EAAE,QAAQ;YACnB,GAAG,EAAE,IAAA,wBAAU,GAAE;YACjB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,2BAA2B;YACrE,IAAI,EAAE;gBACL,OAAO,EAAE,IAAI;aACb;SACD,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAErD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,aAAa,CAClB,WAAmB,EACnB,YAAoB,EACpB,QAAgB,EAChB,MAAc;QAEd,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE;YACjF,MAAM,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE;gBAClE,KAAK,EAAE,WAAW;gBAClB,QAAQ;gBACR,MAAM;aACN,CAAC,CAAC;YAEH,MAAM,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE;gBACnE,KAAK,EAAE,YAAY;gBACnB,QAAQ;gBACR,MAAM;gBACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,uBAAuB;aACpD,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,6BAA6B,CAClC,YAAoB,EACpB,QAAgB;QAEhB,OAAO,MAAM,IAAA,oBAAe,EAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,MAAM,kBAAkB,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,yCAAY,EAAE;gBAC1D,KAAK,EAAE;oBACN,KAAK,EAAE,YAAY;oBACnB,QAAQ;iBACR;aACD,CAAC,CAAC;YAEH,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,yCAAY,EAAE;gBAC7C,KAAK,EAAE,YAAY;gBACnB,QAAQ;gBACR,SAAS,EAAE,IAAA,yBAAe,EAAC,GAAG,CAAC;aAC/B,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;YACzC,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAC5E,kBAAkB,CAAC,MAAM,EACzB,QAAQ,CACR,CAAC;YAEF,MAAM,GAAG,CAAC,MAAM,CAAC,uCAAW,EAAE;gBAC7B,KAAK,EAAE,WAAW;gBAClB,QAAQ;gBACR,MAAM,EAAE,kBAAkB,CAAC,MAAM;aACjC,CAAC,CAAC;YAEH,MAAM,GAAG,CAAC,MAAM,CAAC,yCAAY,EAAE;gBAC9B,KAAK,EAAE,eAAe;gBACtB,QAAQ;gBACR,MAAM,EAAE,kBAAkB,CAAC,MAAM;gBACjC,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,uBAAuB;aAC7C,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;gBACrE,QAAQ;gBACR,MAAM,EAAE,kBAAkB,CAAC,MAAM;aACjC,CAAC,CAAC;YAEH,OAAO;gBACN,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,IAAI,CAAC,2BAA2B;gBAC5C,aAAa,EAAE,eAAe;aAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACpC,IAAI,OAAO,CAAC;QAEZ,IAAI,CAAC;YACJ,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;YAClE,KAAK,EAAE,EAAE,KAAK,EAAE;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAChE,CAAC;QAED,OAAO;YACN,KAAK;YACL,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,MAAM,EAAE,EAAE;YACV,KAAK,EAAE;gBACN,MAAM,EAAE,OAAO,CAAC,GAAG;aACnB;SACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa;QACzC,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAErD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAgB,CAAC;YAChD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACb,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;gBAC9C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;gBACrB,SAAS,EAAE,CAAC,MAAM,CAAC;aACnB,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,QAAgB;QACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;YACtD,KAAK;YACL,QAAQ;SACR,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,QAAgB;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC;YACvD,KAAK;YACL,QAAQ;SACR,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;CACD,CAAA;AAjMY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,YAAO,GAAE;qCAOiB,uBAAM;QACF,wBAAU;QACN,mBAAc;QACP,qDAAqB;QACpB,uDAAsB;GAVpD,oBAAoB,CAiMhC"}

package/dist/modules/mcp/mcp-oauth.helpers.d.ts

@@ -0,0 +1,4 @@
+export declare class McpOAuthHelpers {
+    static buildSuccessRedirectUrl(redirectUri: string, code: string, state: string | null): string;
+    static buildErrorRedirectUrl(redirectUri: string, error: string, errorDescription: string, state: string | null): string;
+}