n8n 2.15.1 → 2.17.0

package/dist/modules/token-exchange/database/entities/trusted-key.entity.js

@@ -0,0 +1,43 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TrustedKeyEntity = void 0;
+const db_1 = require("@n8n/db");
+const typeorm_1 = require("@n8n/typeorm");
+const trusted_key_source_entity_1 = require("./trusted-key-source.entity");
+let TrustedKeyEntity = class TrustedKeyEntity {
+};
+exports.TrustedKeyEntity = TrustedKeyEntity;
+__decorate([
+    (0, typeorm_1.PrimaryColumn)('varchar', { length: 36 }),
+    __metadata("design:type", String)
+], TrustedKeyEntity.prototype, "sourceId", void 0);
+__decorate([
+    (0, typeorm_1.PrimaryColumn)('varchar', { length: 255 }),
+    __metadata("design:type", String)
+], TrustedKeyEntity.prototype, "kid", void 0);
+__decorate([
+    (0, typeorm_1.Column)('text'),
+    __metadata("design:type", String)
+], TrustedKeyEntity.prototype, "data", void 0);
+__decorate([
+    (0, db_1.DateTimeColumn)(),
+    __metadata("design:type", Date)
+], TrustedKeyEntity.prototype, "createdAt", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => trusted_key_source_entity_1.TrustedKeySourceEntity, { onDelete: 'CASCADE' }),
+    (0, typeorm_1.JoinColumn)({ name: 'sourceId' }),
+    __metadata("design:type", Object)
+], TrustedKeyEntity.prototype, "source", void 0);
+exports.TrustedKeyEntity = TrustedKeyEntity = __decorate([
+    (0, typeorm_1.Entity)('trusted_key')
+], TrustedKeyEntity);
+//# sourceMappingURL=trusted-key.entity.js.map

package/dist/modules/token-exchange/database/entities/trusted-key.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-key.entity.js","sourceRoot":"","sources":["../../../../../src/modules/token-exchange/database/entities/trusted-key.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAAyC;AAEzC,0CAAoF;AAEpF,2EAAqE;AAG9D,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAgB5B,CAAA;AAhBY,4CAAgB;AAE5B;IADC,IAAA,uBAAa,EAAC,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;;kDACxB;AAGjB;IADC,IAAA,uBAAa,EAAC,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;6CAC9B;AAGZ;IADC,IAAA,gBAAM,EAAC,MAAM,CAAC;;8CACF;AAGb;IADC,IAAA,mBAAc,GAAE;8BACN,IAAI;mDAAC;AAIhB;IAFC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,kDAAsB,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAChE,IAAA,oBAAU,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;;gDACQ;2BAf7B,gBAAgB;IAD5B,IAAA,gBAAM,EAAC,aAAa,CAAC;GACT,gBAAgB,CAgB5B"}

package/dist/modules/token-exchange/database/repositories/token-exchange-jti.repository.d.ts

@@ -0,0 +1,10 @@
+import { GlobalConfig } from '@n8n/config';
+import { DataSource, Repository } from '@n8n/typeorm';
+import { TokenExchangeJti } from '../entities/token-exchange-jti.entity';
+export declare class TokenExchangeJtiRepository extends Repository<TokenExchangeJti> {
+    private readonly dbType;
+    private readonly escapedTableName;
+    constructor(dataSource: DataSource, globalConfig: GlobalConfig);
+    atomicConsume(jti: string, expiresAt: Date): Promise<boolean>;
+    deleteExpiredBatch(batchSize: number): Promise<number>;
+}

package/dist/modules/token-exchange/database/repositories/token-exchange-jti.repository.js

@@ -0,0 +1,106 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenExchangeJtiRepository = void 0;
+const config_1 = require("@n8n/config");
+const di_1 = require("@n8n/di");
+const typeorm_1 = require("@n8n/typeorm");
+const node_assert_1 = __importDefault(require("node:assert"));
+const token_exchange_jti_entity_1 = require("../entities/token-exchange-jti.entity");
+let TokenExchangeJtiRepository = class TokenExchangeJtiRepository extends typeorm_1.Repository {
+    constructor(dataSource, globalConfig) {
+        super(token_exchange_jti_entity_1.TokenExchangeJti, dataSource.manager);
+        this.dbType = globalConfig.database.type;
+        const { schema, tableName } = this.metadata;
+        const esc = (name) => dataSource.driver.escape(name);
+        this.escapedTableName = schema ? `${esc(schema)}.${esc(tableName)}` : esc(tableName);
+    }
+    async atomicConsume(jti, expiresAt) {
+        const esc = (name) => this.manager.connection.driver.escape(name);
+        const tableName = this.escapedTableName;
+        if (this.dbType === 'postgresdb') {
+            const [row] = (await this.query(`WITH ins AS (
+					INSERT INTO ${tableName} (${esc('jti')}, ${esc('expiresAt')}, ${esc('createdAt')})
+					VALUES ($1, $2, NOW())
+					ON CONFLICT (${esc('jti')}) DO NOTHING
+					RETURNING ${esc('jti')}
+				)
+				SELECT EXISTS (SELECT 1 FROM ins) AS inserted`, [jti, expiresAt]));
+            return row.inserted;
+        }
+        else if (this.dbType === 'sqlite') {
+            const qr = this.manager.connection.createQueryRunner();
+            await qr.startTransaction();
+            try {
+                await qr.query(`INSERT OR IGNORE INTO ${tableName} (${esc('jti')}, ${esc('expiresAt')}, ${esc('createdAt')}) VALUES (?, datetime(?), datetime('now'))`, [jti, expiresAt.toISOString()]);
+                const [{ cnt }] = (await qr.query('SELECT changes() as cnt'));
+                await qr.commitTransaction();
+                return cnt > 0;
+            }
+            catch (e) {
+                await qr.rollbackTransaction();
+                throw e;
+            }
+            finally {
+                await qr.release();
+            }
+        }
+        node_assert_1.default.fail('Unknown database type');
+    }
+    async deleteExpiredBatch(batchSize) {
+        const esc = (name) => this.manager.connection.driver.escape(name);
+        const tableName = this.escapedTableName;
+        if (this.dbType === 'postgresdb') {
+            const [row] = (await this.query(`WITH deleted AS (
+					DELETE FROM ${tableName}
+					WHERE ${esc('jti')} IN (
+						SELECT ${esc('jti')} FROM ${tableName}
+						WHERE ${esc('expiresAt')} < NOW()
+						LIMIT $1
+					)
+					RETURNING ${esc('jti')}
+				)
+				SELECT COUNT(*) AS ${esc('count')} FROM deleted`, [batchSize]));
+            return Number(row.count);
+        }
+        else if (this.dbType === 'sqlite') {
+            const qr = this.manager.connection.createQueryRunner();
+            await qr.startTransaction();
+            try {
+                await qr.query(`DELETE FROM ${tableName} WHERE ${esc('jti')} IN (
+						SELECT ${esc('jti')} FROM ${tableName}
+						WHERE ${esc('expiresAt')} < datetime('now')
+						LIMIT ?
+					)`, [batchSize]);
+                const [{ cnt }] = (await qr.query('SELECT changes() as cnt'));
+                await qr.commitTransaction();
+                return Number(cnt);
+            }
+            catch (e) {
+                await qr.rollbackTransaction();
+                throw e;
+            }
+            finally {
+                await qr.release();
+            }
+        }
+        node_assert_1.default.fail('Unknown database type');
+    }
+};
+exports.TokenExchangeJtiRepository = TokenExchangeJtiRepository;
+exports.TokenExchangeJtiRepository = TokenExchangeJtiRepository = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [typeorm_1.DataSource, config_1.GlobalConfig])
+], TokenExchangeJtiRepository);
+//# sourceMappingURL=token-exchange-jti.repository.js.map

package/dist/modules/token-exchange/database/repositories/token-exchange-jti.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange-jti.repository.js","sourceRoot":"","sources":["../../../../../src/modules/token-exchange/database/repositories/token-exchange-jti.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wCAA2C;AAC3C,gCAAkC;AAClC,0CAAsD;AACtD,8DAAiC;AAEjC,qFAAyE;AAGlE,IAAM,0BAA0B,GAAhC,MAAM,0BAA2B,SAAQ,oBAA4B;IAK3E,YAAY,UAAsB,EAAE,YAA0B;QAC7D,KAAK,CAAC,4CAAgB,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5C,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtF,CAAC;IAWD,KAAK,CAAC,aAAa,CAAC,GAAW,EAAE,SAAe;QAC/C,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAExC,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAC9B;mBACe,SAAS,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,WAAW,CAAC,KAAK,GAAG,CAAC,WAAW,CAAC;;oBAEjE,GAAG,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,KAAK,CAAC;;kDAEuB,EAC9C,CAAC,GAAG,EAAE,SAAS,CAAC,CAChB,CAAiC,CAAC;YAEnC,OAAO,GAAG,CAAC,QAAQ,CAAC;QACrB,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;YACvD,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACJ,MAAM,EAAE,CAAC,KAAK,CACb,yBAAyB,SAAS,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,WAAW,CAAC,KAAK,GAAG,CAAC,WAAW,CAAC,4CAA4C,EACvI,CAAC,GAAG,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAC9B,CAAC;gBACF,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAE1D,CAAC;gBACH,MAAM,EAAE,CAAC,iBAAiB,EAAE,CAAC;gBAC7B,OAAO,GAAG,GAAG,CAAC,CAAC;YAChB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACZ,MAAM,EAAE,CAAC,mBAAmB,EAAE,CAAC;gBAC/B,MAAM,CAAC,CAAC;YACT,CAAC;oBAAS,CAAC;gBACV,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;YACpB,CAAC;QACF,CAAC;QAED,qBAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACtC,CAAC;IASD,KAAK,CAAC,kBAAkB,CAAC,SAAiB;QACzC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAExC,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAC9B;mBACe,SAAS;aACf,GAAG,CAAC,KAAK,CAAC;eACR,GAAG,CAAC,KAAK,CAAC,SAAS,SAAS;cAC7B,GAAG,CAAC,WAAW,CAAC;;;iBAGb,GAAG,CAAC,KAAK,CAAC;;yBAEF,GAAG,CAAC,OAAO,CAAC,eAAe,EAChD,CAAC,SAAS,CAAC,CACX,CAAsC,CAAC;YAExC,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;YACvD,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACJ,MAAM,EAAE,CAAC,KAAK,CACb,eAAe,SAAS,UAAU,GAAG,CAAC,KAAK,CAAC;eAClC,GAAG,CAAC,KAAK,CAAC,SAAS,SAAS;cAC7B,GAAG,CAAC,WAAW,CAAC;;OAEvB,EACF,CAAC,SAAS,CAAC,CACX,CAAC;gBACF,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAE1D,CAAC;gBACH,MAAM,EAAE,CAAC,iBAAiB,EAAE,CAAC;gBAC7B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACZ,MAAM,EAAE,CAAC,mBAAmB,EAAE,CAAC;gBAC/B,MAAM,CAAC,CAAC;YACT,CAAC;oBAAS,CAAC;gBACV,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;YACpB,CAAC;QACF,CAAC;QAED,qBAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACtC,CAAC;CACD,CAAA;AArHY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,YAAO,GAAE;qCAMe,oBAAU,EAAgB,qBAAY;GALlD,0BAA0B,CAqHtC"}

package/dist/modules/token-exchange/database/repositories/trusted-key-source.repository.d.ts

@@ -0,0 +1,5 @@
+import { DataSource, Repository } from '@n8n/typeorm';
+import { TrustedKeySourceEntity } from '../entities/trusted-key-source.entity';
+export declare class TrustedKeySourceRepository extends Repository<TrustedKeySourceEntity> {
+    constructor(dataSource: DataSource);
+}

package/dist/modules/token-exchange/database/repositories/trusted-key-source.repository.js

@@ -0,0 +1,26 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TrustedKeySourceRepository = void 0;
+const di_1 = require("@n8n/di");
+const typeorm_1 = require("@n8n/typeorm");
+const trusted_key_source_entity_1 = require("../entities/trusted-key-source.entity");
+let TrustedKeySourceRepository = class TrustedKeySourceRepository extends typeorm_1.Repository {
+    constructor(dataSource) {
+        super(trusted_key_source_entity_1.TrustedKeySourceEntity, dataSource.manager);
+    }
+};
+exports.TrustedKeySourceRepository = TrustedKeySourceRepository;
+exports.TrustedKeySourceRepository = TrustedKeySourceRepository = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [typeorm_1.DataSource])
+], TrustedKeySourceRepository);
+//# sourceMappingURL=trusted-key-source.repository.js.map

package/dist/modules/token-exchange/database/repositories/trusted-key-source.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-key-source.repository.js","sourceRoot":"","sources":["../../../../../src/modules/token-exchange/database/repositories/trusted-key-source.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAAkC;AAClC,0CAAsD;AAEtD,qFAA+E;AAGxE,IAAM,0BAA0B,GAAhC,MAAM,0BAA2B,SAAQ,oBAAkC;IACjF,YAAY,UAAsB;QACjC,KAAK,CAAC,kDAAsB,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;CACD,CAAA;AAJY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,YAAO,GAAE;qCAEe,oBAAU;GADtB,0BAA0B,CAItC"}

package/dist/modules/token-exchange/database/repositories/trusted-key.repository.d.ts

@@ -0,0 +1,7 @@
+import { DataSource, Repository } from '@n8n/typeorm';
+import { TrustedKeyEntity } from '../entities/trusted-key.entity';
+export declare class TrustedKeyRepository extends Repository<TrustedKeyEntity> {
+    constructor(dataSource: DataSource);
+    findBySourceAndKid(sourceId: string, kid: string): Promise<TrustedKeyEntity | null>;
+    findAllByKid(kid: string): Promise<TrustedKeyEntity[]>;
+}

package/dist/modules/token-exchange/database/repositories/trusted-key.repository.js

@@ -0,0 +1,32 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TrustedKeyRepository = void 0;
+const di_1 = require("@n8n/di");
+const typeorm_1 = require("@n8n/typeorm");
+const trusted_key_entity_1 = require("../entities/trusted-key.entity");
+let TrustedKeyRepository = class TrustedKeyRepository extends typeorm_1.Repository {
+    constructor(dataSource) {
+        super(trusted_key_entity_1.TrustedKeyEntity, dataSource.manager);
+    }
+    async findBySourceAndKid(sourceId, kid) {
+        return await this.findOneBy({ sourceId, kid });
+    }
+    async findAllByKid(kid) {
+        return await this.findBy({ kid });
+    }
+};
+exports.TrustedKeyRepository = TrustedKeyRepository;
+exports.TrustedKeyRepository = TrustedKeyRepository = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [typeorm_1.DataSource])
+], TrustedKeyRepository);
+//# sourceMappingURL=trusted-key.repository.js.map

package/dist/modules/token-exchange/database/repositories/trusted-key.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-key.repository.js","sourceRoot":"","sources":["../../../../../src/modules/token-exchange/database/repositories/trusted-key.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAAkC;AAClC,0CAAsD;AAEtD,uEAAkE;AAG3D,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,oBAA4B;IACrE,YAAY,UAAsB;QACjC,KAAK,CAAC,qCAAgB,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB,EAAE,GAAW;QACrD,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW;QAC7B,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,CAAC;CACD,CAAA;AAZY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,YAAO,GAAE;qCAEe,oBAAU;GADtB,oBAAoB,CAYhC"}

package/dist/modules/token-exchange/services/identity-resolution.service.d.ts

@@ -0,0 +1,23 @@
+import { Logger } from '@n8n/backend-common';
+import { AuthIdentityRepository, UserRepository, type User } from '@n8n/db';
+import { EventService } from '../../../events/event.service';
+import { UserService } from '../../../services/user.service';
+import type { ExternalTokenClaims } from '../token-exchange.schemas';
+export declare class IdentityResolutionService {
+    private readonly userRepository;
+    private readonly authIdentityRepository;
+    private readonly eventService;
+    private readonly userService;
+    private readonly logger;
+    constructor(logger: Logger, userRepository: UserRepository, authIdentityRepository: AuthIdentityRepository, eventService: EventService, userService: UserService);
+    resolve(claims: ExternalTokenClaims, allowedRoles?: string[], tokenContext?: {
+        kid: string;
+        issuer: string;
+    }): Promise<User>;
+    private resolveByIdentity;
+    private resolveByEmail;
+    private provisionUser;
+    private resolveRoleForExistingUser;
+    private resolveRoleForNewUser;
+    private syncProfile;
+}

package/dist/modules/token-exchange/services/identity-resolution.service.js

@@ -0,0 +1,195 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityResolutionService = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const db_1 = require("@n8n/db");
+const di_1 = require("@n8n/di");
+const auth_error_1 = require("../../../errors/response-errors/auth.error");
+const event_service_1 = require("../../../events/event.service");
+const user_service_1 = require("../../../services/user.service");
+const INVALID_PASSWORD_PLACEHOLDER = '!token-exchange-no-password';
+const MAX_NAME_LENGTH = 32;
+function isGlobalRole(role) {
+    return role in db_1.GLOBAL_ROLES;
+}
+function trimName(value, fallback = '') {
+    return (value ?? fallback).slice(0, MAX_NAME_LENGTH);
+}
+let IdentityResolutionService = class IdentityResolutionService {
+    constructor(logger, userRepository, authIdentityRepository, eventService, userService) {
+        this.userRepository = userRepository;
+        this.authIdentityRepository = authIdentityRepository;
+        this.eventService = eventService;
+        this.userService = userService;
+        this.logger = logger.scoped('token-exchange');
+    }
+    async resolve(claims, allowedRoles, tokenContext) {
+        const email = claims.email?.toLowerCase();
+        const identity = await this.authIdentityRepository.findOne({
+            where: { providerId: claims.sub, providerType: 'token-exchange' },
+            relations: { user: { role: true } },
+        });
+        if (identity) {
+            return await this.resolveByIdentity(claims, identity, allowedRoles, tokenContext);
+        }
+        if (email) {
+            const existingUser = await this.userRepository.findOne({
+                where: { email },
+                relations: ['authIdentities', 'role'],
+            });
+            if (existingUser) {
+                return await this.resolveByEmail(claims, email, existingUser, allowedRoles, tokenContext);
+            }
+        }
+        if (!email) {
+            throw new auth_error_1.AuthError('Email claim is required for user provisioning');
+        }
+        return await this.provisionUser(claims, email, allowedRoles, tokenContext);
+    }
+    async resolveByIdentity(claims, identity, allowedRoles, tokenContext) {
+        this.logger.debug('Resolved user by auth identity', { sub: claims.sub });
+        const resolvedRole = this.resolveRoleForExistingUser(claims.role, allowedRoles, identity.user.role?.slug);
+        return await this.syncProfile(identity.user, claims, resolvedRole, tokenContext);
+    }
+    async resolveByEmail(claims, email, existingUser, allowedRoles, tokenContext) {
+        this.logger.debug('Linking external identity to existing user by email', {
+            sub: claims.sub,
+            email,
+        });
+        const resolvedRole = this.resolveRoleForExistingUser(claims.role, allowedRoles, existingUser.role?.slug);
+        await this.authIdentityRepository.save(db_1.AuthIdentity.create(existingUser, claims.sub, 'token-exchange'));
+        this.eventService.emit('token-exchange-identity-linked', {
+            userId: existingUser.id,
+            sub: claims.sub,
+            email,
+            kid: tokenContext?.kid ?? '',
+            issuer: tokenContext?.issuer ?? claims.iss,
+        });
+        return await this.syncProfile(existingUser, claims, resolvedRole, tokenContext);
+    }
+    async provisionUser(claims, email, allowedRoles, tokenContext) {
+        this.logger.debug('JIT provisioning new user', { sub: claims.sub, email });
+        const jitRole = this.resolveRoleForNewUser(claims.role, allowedRoles);
+        const targetRole = jitRole ? { slug: jitRole } : db_1.GLOBAL_MEMBER_ROLE;
+        const user = await this.userRepository.manager.transaction(async (trx) => {
+            const { user: newUser } = await this.userRepository.createUserWithProject({
+                email,
+                firstName: trimName(claims.given_name),
+                lastName: trimName(claims.family_name),
+                role: targetRole,
+                password: INVALID_PASSWORD_PLACEHOLDER,
+            }, trx);
+            await trx.save(trx.create(db_1.AuthIdentity, {
+                providerId: claims.sub,
+                providerType: 'token-exchange',
+                userId: newUser.id,
+            }));
+            return newUser;
+        });
+        this.eventService.emit('token-exchange-user-provisioned', {
+            userId: user.id,
+            sub: claims.sub,
+            email,
+            role: targetRole.slug,
+            kid: tokenContext?.kid ?? '',
+            issuer: tokenContext?.issuer ?? claims.iss,
+        });
+        return user;
+    }
+    resolveRoleForExistingUser(roleClaim, allowedRoles, currentRole) {
+        if (roleClaim === undefined)
+            return undefined;
+        if (currentRole === 'global:owner') {
+            this.logger.debug('Skipping role sync for existing owner');
+            return undefined;
+        }
+        const role = roleClaim;
+        if (role === 'global:owner') {
+            this.logger.warn('Ignoring global:owner role claim for existing user');
+            return undefined;
+        }
+        if (!isGlobalRole(role)) {
+            this.logger.warn('Unknown role claim ignored', { role });
+            return undefined;
+        }
+        if (allowedRoles && allowedRoles.length > 0 && !allowedRoles.includes(role)) {
+            throw new auth_error_1.AuthError(`Role '${role}' is not allowed for this token exchange key`);
+        }
+        return role;
+    }
+    resolveRoleForNewUser(roleClaim, allowedRoles) {
+        if (roleClaim === undefined)
+            return undefined;
+        const role = roleClaim;
+        if (role === 'global:owner') {
+            throw new auth_error_1.AuthError('Cannot provision global:owner role via token exchange');
+        }
+        if (!isGlobalRole(role)) {
+            throw new auth_error_1.AuthError(`Unrecognized role '${role}' cannot be assigned to new user`);
+        }
+        if (allowedRoles && allowedRoles.length > 0 && !allowedRoles.includes(role)) {
+            throw new auth_error_1.AuthError(`Role '${role}' is not allowed for this token exchange key`);
+        }
+        return role;
+    }
+    async syncProfile(user, claims, resolvedRole, tokenContext) {
+        let needsReload = false;
+        const profileUpdates = {};
+        if (claims.given_name !== undefined) {
+            const trimmed = trimName(claims.given_name);
+            if (trimmed !== user.firstName) {
+                profileUpdates.firstName = trimmed;
+            }
+        }
+        if (claims.family_name !== undefined) {
+            const trimmed = trimName(claims.family_name);
+            if (trimmed !== user.lastName) {
+                profileUpdates.lastName = trimmed;
+            }
+        }
+        if (Object.keys(profileUpdates).length > 0) {
+            await this.userRepository.update(user.id, profileUpdates);
+            needsReload = true;
+        }
+        const previousRole = user.role?.slug;
+        if (resolvedRole && resolvedRole !== previousRole) {
+            await this.userService.changeUserRole(user, { newRoleName: resolvedRole });
+            needsReload = true;
+            if (previousRole) {
+                this.eventService.emit('token-exchange-role-updated', {
+                    userId: user.id,
+                    previousRole,
+                    newRole: resolvedRole,
+                    kid: tokenContext?.kid ?? '',
+                    issuer: tokenContext?.issuer ?? claims.iss,
+                });
+            }
+        }
+        if (needsReload) {
+            return await this.userRepository.findOneOrFail({
+                where: { id: user.id },
+                relations: ['role'],
+            });
+        }
+        return user;
+    }
+};
+exports.IdentityResolutionService = IdentityResolutionService;
+exports.IdentityResolutionService = IdentityResolutionService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [backend_common_1.Logger,
+        db_1.UserRepository,
+        db_1.AuthIdentityRepository,
+        event_service_1.EventService,
+        user_service_1.UserService])
+], IdentityResolutionService);
+//# sourceMappingURL=identity-resolution.service.js.map

package/dist/modules/token-exchange/services/identity-resolution.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-resolution.service.js","sourceRoot":"","sources":["../../../../src/modules/token-exchange/services/identity-resolution.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;AAC7C,gCAOiB;AACjB,gCAAkC;AAElC,oEAAgE;AAChE,0DAAsD;AACtD,0DAAsD;AAStD,MAAM,4BAA4B,GAAG,6BAA6B,CAAC;AAGnE,MAAM,eAAe,GAAG,EAAE,CAAC;AAI3B,SAAS,YAAY,CAAC,IAAY;IACjC,OAAO,IAAI,IAAI,iBAAY,CAAC;AAC7B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB,EAAE,QAAQ,GAAG,EAAE;IACzD,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;AACtD,CAAC;AAGM,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAGrC,YACC,MAAc,EACG,cAA8B,EAC9B,sBAA8C,EAC9C,YAA0B,EAC1B,WAAwB;QAHxB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,iBAAY,GAAZ,YAAY,CAAc;QAC1B,gBAAW,GAAX,WAAW,CAAa;QAEzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC/C,CAAC;IAcD,KAAK,CAAC,OAAO,CACZ,MAA2B,EAC3B,YAAuB,EACvB,YAA8C;QAE9C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;QAG1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;YAC1D,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,gBAAgB,EAAE;YACjE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;SACnC,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;QACnF,CAAC;QAGD,IAAI,KAAK,EAAE,CAAC;YACX,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;gBACtD,KAAK,EAAE,EAAE,KAAK,EAAE;gBAChB,SAAS,EAAE,CAAC,gBAAgB,EAAE,MAAM,CAAC;aACrC,CAAC,CAAC;YAEH,IAAI,YAAY,EAAE,CAAC;gBAClB,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;YAC3F,CAAC;QACF,CAAC;QAGD,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,sBAAS,CAAC,+CAA+C,CAAC,CAAC;QACtE,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IAC5E,CAAC;IAGO,KAAK,CAAC,iBAAiB,CAC9B,MAA2B,EAC3B,QAAsB,EACtB,YAAkC,EAClC,YAAyD;QAEzD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACzE,MAAM,YAAY,GAAG,IAAI,CAAC,0BAA0B,CACnD,MAAM,CAAC,IAAI,EACX,YAAY,EACZ,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CACxB,CAAC;QACF,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IAClF,CAAC;IAGO,KAAK,CAAC,cAAc,CAC3B,MAA2B,EAC3B,KAAa,EACb,YAAkB,EAClB,YAAkC,EAClC,YAAyD;QAEzD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE;YACxE,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,KAAK;SACL,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,0BAA0B,CACnD,MAAM,CAAC,IAAI,EACX,YAAY,EACZ,YAAY,CAAC,IAAI,EAAE,IAAI,CACvB,CAAC;QACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CACrC,iBAAY,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAC/D,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,EAAE;YACxD,MAAM,EAAE,YAAY,CAAC,EAAE;YACvB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,KAAK;YACL,GAAG,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE;YAC5B,MAAM,EAAE,YAAY,EAAE,MAAM,IAAI,MAAM,CAAC,GAAG;SAC1C,CAAC,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IACjF,CAAC;IAGO,KAAK,CAAC,aAAa,CAC1B,MAA2B,EAC3B,KAAa,EACb,YAAkC,EAClC,YAAyD;QAEzD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAE3E,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,uBAAkB,CAAC;QAEpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACxE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CACxE;gBACC,KAAK;gBACL,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;gBACtC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC;gBACtC,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,4BAA4B;aACtC,EACD,GAAG,CACH,CAAC;YAEF,MAAM,GAAG,CAAC,IAAI,CACb,GAAG,CAAC,MAAM,CAAC,iBAAY,EAAE;gBACxB,UAAU,EAAE,MAAM,CAAC,GAAG;gBACtB,YAAY,EAAE,gBAAgB;gBAC9B,MAAM,EAAE,OAAO,CAAC,EAAE;aAClB,CAAC,CACF,CAAC;YAEF,OAAO,OAAO,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,EAAE;YACzD,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,KAAK;YACL,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,GAAG,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE;YAC5B,MAAM,EAAE,YAAY,EAAE,MAAM,IAAI,MAAM,CAAC,GAAG;SAC1C,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACb,CAAC;IAUO,0BAA0B,CACjC,SAAsC,EACtC,YAAkC,EAClC,WAA+B;QAE/B,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAG9C,IAAI,WAAW,KAAK,cAAc,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,SAAS,CAAC;QAGvB,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;YACvE,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,sBAAS,CAAC,SAAS,IAAI,8CAA8C,CAAC,CAAC;QAClF,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;IASO,qBAAqB,CAC5B,SAAsC,EACtC,YAAkC;QAElC,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAE9C,MAAM,IAAI,GAAG,SAAS,CAAC;QAEvB,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC7B,MAAM,IAAI,sBAAS,CAAC,uDAAuD,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,sBAAS,CAAC,sBAAsB,IAAI,kCAAkC,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,sBAAS,CAAC,SAAS,IAAI,8CAA8C,CAAC,CAAC;QAClF,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;IAOO,KAAK,CAAC,WAAW,CACxB,IAAU,EACV,MAA2B,EAC3B,YAA4B,EAC5B,YAA8C;QAE9C,IAAI,WAAW,GAAG,KAAK,CAAC;QAGxB,MAAM,cAAc,GAAkD,EAAE,CAAC;QAEzE,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC5C,IAAI,OAAO,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChC,cAAc,CAAC,SAAS,GAAG,OAAO,CAAC;YACpC,CAAC;QACF,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,OAAO,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC/B,cAAc,CAAC,QAAQ,GAAG,OAAO,CAAC;YACnC,CAAC;QACF,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;YAC1D,WAAW,GAAG,IAAI,CAAC;QACpB,CAAC;QAGD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;QACrC,IAAI,YAAY,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;YACnD,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;YAC3E,WAAW,GAAG,IAAI,CAAC;YAEnB,IAAI,YAAY,EAAE,CAAC;gBAClB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,6BAA6B,EAAE;oBACrD,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,YAAY;oBACZ,OAAO,EAAE,YAAY;oBACrB,GAAG,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE;oBAC5B,MAAM,EAAE,YAAY,EAAE,MAAM,IAAI,MAAM,CAAC,GAAG;iBAC1C,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YACjB,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC;gBAC9C,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;gBACtB,SAAS,EAAE,CAAC,MAAM,CAAC;aACnB,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;CACD,CAAA;AA/RY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,YAAO,GAAE;qCAKA,uBAAM;QACmB,mBAAc;QACN,2BAAsB;QAChC,4BAAY;QACb,0BAAW;GAR9B,yBAAyB,CA+RrC"}

package/dist/modules/token-exchange/services/jti-cleanup.service.d.ts

@@ -0,0 +1,18 @@
+import { Logger } from '@n8n/backend-common';
+import { InstanceSettings } from 'n8n-core';
+import { TokenExchangeJtiRepository } from '../database/repositories/token-exchange-jti.repository';
+import { TokenExchangeConfig } from '../token-exchange.config';
+export declare class JtiCleanupService {
+    private readonly config;
+    private readonly jtiRepository;
+    private readonly instanceSettings;
+    private cleanupInterval;
+    private isShuttingDown;
+    private readonly logger;
+    constructor(logger: Logger, config: TokenExchangeConfig, jtiRepository: TokenExchangeJtiRepository, instanceSettings: InstanceSettings);
+    init(): void;
+    startCleanup(): void;
+    stopCleanup(): void;
+    private cleanup;
+    shutdown(): void;
+}

package/dist/modules/token-exchange/services/jti-cleanup.service.js

@@ -0,0 +1,90 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JtiCleanupService = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const constants_1 = require("@n8n/constants");
+const decorators_1 = require("@n8n/decorators");
+const di_1 = require("@n8n/di");
+const n8n_core_1 = require("n8n-core");
+const token_exchange_jti_repository_1 = require("../database/repositories/token-exchange-jti.repository");
+const token_exchange_config_1 = require("../token-exchange.config");
+let JtiCleanupService = class JtiCleanupService {
+    constructor(logger, config, jtiRepository, instanceSettings) {
+        this.config = config;
+        this.jtiRepository = jtiRepository;
+        this.instanceSettings = instanceSettings;
+        this.isShuttingDown = false;
+        this.logger = logger.scoped('token-exchange');
+    }
+    init() {
+        if (this.instanceSettings.isLeader)
+            this.startCleanup();
+    }
+    startCleanup() {
+        if (this.isShuttingDown || this.cleanupInterval)
+            return;
+        const intervalMs = this.config.jtiCleanupIntervalSeconds * constants_1.Time.seconds.toMilliseconds;
+        this.cleanupInterval = setInterval(async () => await this.cleanup(), intervalMs);
+        this.logger.debug(`JTI cleanup scheduled every ${this.config.jtiCleanupIntervalSeconds}s`);
+    }
+    stopCleanup() {
+        clearInterval(this.cleanupInterval);
+        this.cleanupInterval = undefined;
+    }
+    async cleanup() {
+        let totalDeleted = 0;
+        try {
+            let deleted;
+            do {
+                deleted = await this.jtiRepository.deleteExpiredBatch(this.config.jtiCleanupBatchSize);
+                totalDeleted += deleted;
+            } while (deleted >= this.config.jtiCleanupBatchSize);
+            if (totalDeleted > 0) {
+                this.logger.debug('Cleaned up expired JTIs', { count: totalDeleted });
+            }
+        }
+        catch (error) {
+            this.logger.error('Failed to clean up expired JTIs', { error });
+        }
+    }
+    shutdown() {
+        this.isShuttingDown = true;
+        this.stopCleanup();
+    }
+};
+exports.JtiCleanupService = JtiCleanupService;
+__decorate([
+    (0, decorators_1.OnLeaderTakeover)(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], JtiCleanupService.prototype, "startCleanup", null);
+__decorate([
+    (0, decorators_1.OnLeaderStepdown)(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], JtiCleanupService.prototype, "stopCleanup", null);
+__decorate([
+    (0, decorators_1.OnShutdown)(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], JtiCleanupService.prototype, "shutdown", null);
+exports.JtiCleanupService = JtiCleanupService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [backend_common_1.Logger,
+        token_exchange_config_1.TokenExchangeConfig,
+        token_exchange_jti_repository_1.TokenExchangeJtiRepository,
+        n8n_core_1.InstanceSettings])
+], JtiCleanupService);
+//# sourceMappingURL=jti-cleanup.service.js.map

package/dist/modules/token-exchange/services/jti-cleanup.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jti-cleanup.service.js","sourceRoot":"","sources":["../../../../src/modules/token-exchange/services/jti-cleanup.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;AAC7C,8CAAsC;AACtC,gDAAiF;AACjF,gCAAkC;AAClC,uCAA4C;AAE5C,0GAAoG;AACpG,oEAA+D;AAGxD,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAO7B,YACC,MAAc,EACG,MAA2B,EAC3B,aAAyC,EACzC,gBAAkC;QAFlC,WAAM,GAAN,MAAM,CAAqB;QAC3B,kBAAa,GAAb,aAAa,CAA4B;QACzC,qBAAgB,GAAhB,gBAAgB,CAAkB;QAR5C,mBAAc,GAAG,KAAK,CAAC;QAU9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI;QACH,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ;YAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IACzD,CAAC;IAGD,YAAY;QACX,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO;QAExD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,yBAAyB,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,CAAC;QACvF,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;QAEjF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,IAAI,CAAC,MAAM,CAAC,yBAAyB,GAAG,CAAC,CAAC;IAC5F,CAAC;IAGD,WAAW;QACV,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACpC,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;IAClC,CAAC;IAEO,KAAK,CAAC,OAAO;QACpB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC;YACJ,IAAI,OAAe,CAAC;YACpB,GAAG,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;gBACvF,YAAY,IAAI,OAAO,CAAC;YACzB,CAAC,QAAQ,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE;YAErD,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACvE,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC;IACF,CAAC;IAGD,QAAQ;QACP,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,WAAW,EAAE,CAAC;IACpB,CAAC;CACD,CAAA;AA1DY,8CAAiB;AAqB7B;IADC,IAAA,6BAAgB,GAAE;;;;qDAQlB;AAGD;IADC,IAAA,6BAAgB,GAAE;;;;oDAIlB;AAoBD;IADC,IAAA,uBAAU,GAAE;;;;iDAIZ;4BAzDW,iBAAiB;IAD7B,IAAA,YAAO,GAAE;qCASA,uBAAM;QACW,2CAAmB;QACZ,0DAA0B;QACvB,2BAAgB;GAXxC,iBAAiB,CA0D7B"}

package/dist/modules/token-exchange/services/jti-store.service.d.ts

@@ -0,0 +1,6 @@
+import { TokenExchangeJtiRepository } from '../database/repositories/token-exchange-jti.repository';
+export declare class JtiStoreService {
+    private readonly jtiRepository;
+    constructor(jtiRepository: TokenExchangeJtiRepository);
+    consume(jti: string, expiresAt: Date): Promise<boolean>;
+}