n8n 2.15.1 → 2.17.0

package/dist/modules/token-exchange/services/jti-store.service.js

@@ -0,0 +1,30 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JtiStoreService = void 0;
+const di_1 = require("@n8n/di");
+const token_exchange_jti_repository_1 = require("../database/repositories/token-exchange-jti.repository");
+const GRACE_PERIOD_MS = 60_000;
+let JtiStoreService = class JtiStoreService {
+    constructor(jtiRepository) {
+        this.jtiRepository = jtiRepository;
+    }
+    async consume(jti, expiresAt) {
+        const expiresAtWithGrace = new Date(expiresAt.getTime() + GRACE_PERIOD_MS);
+        return await this.jtiRepository.atomicConsume(jti, expiresAtWithGrace);
+    }
+};
+exports.JtiStoreService = JtiStoreService;
+exports.JtiStoreService = JtiStoreService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [token_exchange_jti_repository_1.TokenExchangeJtiRepository])
+], JtiStoreService);
+//# sourceMappingURL=jti-store.service.js.map

package/dist/modules/token-exchange/services/jti-store.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jti-store.service.js","sourceRoot":"","sources":["../../../../src/modules/token-exchange/services/jti-store.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAAkC;AAElC,0GAAoG;AAEpG,MAAM,eAAe,GAAG,MAAM,CAAC;AAmBxB,IAAM,eAAe,GAArB,MAAM,eAAe;IAC3B,YAA6B,aAAyC;QAAzC,kBAAa,GAAb,aAAa,CAA4B;IAAG,CAAC;IAS1E,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,SAAe;QACzC,MAAM,kBAAkB,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC,CAAC;QAC3E,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACxE,CAAC;CACD,CAAA;AAdY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,YAAO,GAAE;qCAEmC,0DAA0B;GAD1D,eAAe,CAc3B"}

package/dist/modules/token-exchange/services/jwks-resolver.d.ts

@@ -0,0 +1,30 @@
+import { Logger } from '@n8n/backend-common';
+import type { JwksKeySource } from '../token-exchange.schemas';
+export interface SkippedKey {
+    kid?: string;
+    reason: string;
+}
+export interface JwksResolvedKey {
+    kid: string;
+    algorithms: string[];
+    keyMaterial: string;
+    issuer: string;
+    expectedAudience?: string;
+    allowedRoles?: string[];
+}
+export interface JwksResolverResult {
+    keys: JwksResolvedKey[];
+    ttlSeconds: number;
+    skipped: SkippedKey[];
+}
+export declare class JwksResolverService {
+    private readonly logger;
+    constructor(logger: Logger);
+    resolveKeys(source: JwksKeySource, options?: {
+        fetcher?: typeof fetch;
+        defaultTtlSeconds?: number;
+    }): Promise<JwksResolverResult>;
+    private fetchJwkSet;
+    private parseJwk;
+    private computeTtl;
+}

package/dist/modules/token-exchange/services/jwks-resolver.js

@@ -0,0 +1,190 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwksResolverService = void 0;
+const node_crypto_1 = require("node:crypto");
+const backend_common_1 = require("@n8n/backend-common");
+const di_1 = require("@n8n/di");
+const n8n_workflow_1 = require("n8n-workflow");
+const zod_1 = require("zod");
+const token_exchange_schemas_1 = require("../token-exchange.schemas");
+const FETCH_TIMEOUT_MS = 10_000;
+const DEFAULT_TTL_SECONDS = 3600;
+const MIN_TTL_SECONDS = 60;
+const MAX_TTL_SECONDS = 86_400;
+const supportedAlgorithmSet = new Set(token_exchange_schemas_1.JwtAlgorithmSchema.options);
+const SigningJwkSchema = zod_1.z
+    .object({
+    kid: zod_1.z.string().min(1),
+    kty: zod_1.z.enum(['RSA', 'EC', 'OKP']),
+    alg: zod_1.z.string().optional(),
+    use: zod_1.z
+        .string()
+        .optional()
+        .refine((use) => use === undefined || use === 'sig', {
+        message: 'Only signing keys (use: "sig" or absent) are accepted',
+    }),
+    crv: zod_1.z.string().optional(),
+})
+    .passthrough();
+const JwkSetSchema = zod_1.z.object({
+    keys: zod_1.z.array(zod_1.z.unknown()).min(1),
+});
+const CURVE_TO_ALGORITHM = {
+    'P-256': 'ES256',
+    'P-384': 'ES384',
+    'P-521': 'ES512',
+    Ed25519: 'EdDSA',
+};
+function inferAlgorithm(jwk) {
+    if (jwk.alg) {
+        return supportedAlgorithmSet.has(jwk.alg) ? jwk.alg : undefined;
+    }
+    switch (jwk.kty) {
+        case 'RSA':
+            return 'RS256';
+        case 'EC':
+        case 'OKP':
+            return jwk.crv ? CURVE_TO_ALGORITHM[jwk.crv] : undefined;
+        default:
+            return undefined;
+    }
+}
+function parseMaxAge(cacheControl) {
+    if (!cacheControl)
+        return undefined;
+    const match = /max-age=(\d+)/.exec(cacheControl);
+    if (!match)
+        return undefined;
+    const value = parseInt(match[1], 10);
+    return Number.isNaN(value) ? undefined : value;
+}
+let JwksResolverService = class JwksResolverService {
+    constructor(logger) {
+        this.logger = logger.scoped('token-exchange');
+    }
+    async resolveKeys(source, options) {
+        const fetcher = options?.fetcher ?? globalThis.fetch;
+        const defaultTtl = options?.defaultTtlSeconds ?? DEFAULT_TTL_SECONDS;
+        const { url } = source;
+        this.logger.debug(`Fetching JWKS from "${url}"`);
+        const { rawKeys, cacheControl } = await this.fetchJwkSet(url, fetcher);
+        const ttlSeconds = this.computeTtl(cacheControl, source, defaultTtl);
+        const keys = [];
+        const skipped = [];
+        for (const rawJwk of rawKeys) {
+            const result = this.parseJwk(rawJwk, source);
+            if ('resolved' in result) {
+                keys.push(result.resolved);
+            }
+            else {
+                skipped.push(result.skipped);
+            }
+        }
+        if (keys.length === 0) {
+            const reasons = skipped.map((s) => `${s.kid ?? 'unknown'}: ${s.reason}`).join('; ');
+            throw new n8n_workflow_1.OperationalError(`JWKS response has no usable signing keys for "${url}" (${reasons})`);
+        }
+        this.logger.debug(`Resolved ${keys.length} key(s) from "${url}"`, {
+            resolved: keys.length,
+            skipped: skipped.length,
+            ttlSeconds,
+        });
+        return { keys, ttlSeconds, skipped };
+    }
+    async fetchJwkSet(url, fetcher) {
+        let response;
+        try {
+            response = await fetcher(url, {
+                signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+                headers: { Accept: 'application/json' },
+                redirect: 'error',
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'unknown error';
+            throw new n8n_workflow_1.OperationalError(`JWKS fetch failed for "${url}": ${message}`);
+        }
+        if (!response.ok) {
+            throw new n8n_workflow_1.OperationalError(`JWKS fetch failed for "${url}": HTTP ${response.status}`);
+        }
+        let body;
+        try {
+            body = await response.json();
+        }
+        catch {
+            throw new n8n_workflow_1.OperationalError(`JWKS response is not valid JSON for "${url}"`);
+        }
+        const jwkSetResult = JwkSetSchema.safeParse(body);
+        if (!jwkSetResult.success) {
+            throw new n8n_workflow_1.OperationalError(`JWKS response has no keys for "${url}"`);
+        }
+        return {
+            rawKeys: jwkSetResult.data.keys,
+            cacheControl: response.headers.get('cache-control'),
+        };
+    }
+    parseJwk(rawJwk, source) {
+        if (rawJwk === null || typeof rawJwk !== 'object') {
+            return { skipped: { kid: undefined, reason: 'not an object' } };
+        }
+        const jwkResult = SigningJwkSchema.safeParse(rawJwk);
+        if (!jwkResult.success) {
+            const raw = rawJwk;
+            return {
+                skipped: {
+                    kid: typeof raw.kid === 'string' ? raw.kid : undefined,
+                    reason: 'failed schema validation',
+                },
+            };
+        }
+        const jwk = jwkResult.data;
+        const algorithm = inferAlgorithm(jwk);
+        if (!algorithm) {
+            return {
+                skipped: {
+                    kid: jwk.kid,
+                    reason: `unsupported algorithm or key type (kty=${jwk.kty}, alg=${jwk.alg ?? 'none'}, crv=${jwk.crv ?? 'none'})`,
+                },
+            };
+        }
+        let keyObject;
+        try {
+            keyObject = (0, node_crypto_1.createPublicKey)({ format: 'jwk', key: jwk });
+        }
+        catch {
+            return {
+                skipped: { kid: jwk.kid, reason: 'failed to create public key from JWK material' },
+            };
+        }
+        return {
+            resolved: {
+                kid: jwk.kid,
+                algorithms: [algorithm],
+                keyMaterial: keyObject.export({ type: 'spki', format: 'pem' }),
+                issuer: source.issuer,
+                expectedAudience: source.expectedAudience,
+                allowedRoles: source.allowedRoles,
+            },
+        };
+    }
+    computeTtl(cacheControl, source, defaultTtl) {
+        const maxAge = parseMaxAge(cacheControl);
+        const rawTtl = maxAge ?? source.cacheTtlSeconds ?? defaultTtl;
+        return Math.max(MIN_TTL_SECONDS, Math.min(rawTtl, MAX_TTL_SECONDS));
+    }
+};
+exports.JwksResolverService = JwksResolverService;
+exports.JwksResolverService = JwksResolverService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [backend_common_1.Logger])
+], JwksResolverService);
+//# sourceMappingURL=jwks-resolver.js.map

package/dist/modules/token-exchange/services/jwks-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks-resolver.js","sourceRoot":"","sources":["../../../../src/modules/token-exchange/services/jwks-resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,6CAA8C;AAE9C,wDAA6C;AAC7C,gCAAkC;AAElC,+CAAgD;AAChD,6BAAwB;AAGxB,sEAA+D;AAS/D,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,eAAe,GAAG,MAAM,CAAC;AA2B/B,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAS,2CAAkB,CAAC,OAAO,CAAC,CAAC;AAG1E,MAAM,gBAAgB,GAAG,OAAC;KACxB,MAAM,CAAC;IACP,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,OAAC;SACJ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,KAAK,EAAE;QACpD,OAAO,EAAE,uDAAuD;KAChE,CAAC;IACH,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1B,CAAC;KACD,WAAW,EAAE,CAAC;AAKhB,MAAM,YAAY,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7B,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAMH,MAAM,kBAAkB,GAAuC;IAC9D,OAAO,EAAE,OAAO;IAChB,OAAO,EAAE,OAAO;IAChB,OAAO,EAAE,OAAO;IAChB,OAAO,EAAE,OAAO;CAChB,CAAC;AAEF,SAAS,cAAc,CAAC,GAAe;IACtC,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QACb,OAAO,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,GAA0B,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,CAAC;IAED,QAAQ,GAAG,CAAC,GAAG,EAAE,CAAC;QACjB,KAAK,KAAK;YACT,OAAO,OAAO,CAAC;QAChB,KAAK,IAAI,CAAC;QACV,KAAK,KAAK;YACT,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D;YACC,OAAO,SAAS,CAAC;IACnB,CAAC;AACF,CAAC;AAMD,SAAS,WAAW,CAAC,YAA2B;IAC/C,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAChD,CAAC;AAWM,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAG/B,YAAY,MAAc;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,WAAW,CAChB,MAAqB,EACrB,OAGC;QAED,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC;QACrD,MAAM,UAAU,GAAG,OAAO,EAAE,iBAAiB,IAAI,mBAAmB,CAAC;QACrE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;QAEvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,GAAG,CAAC,CAAC;QAEjD,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAErE,MAAM,IAAI,GAAsB,EAAE,CAAC;QACnC,MAAM,OAAO,GAAiB,EAAE,CAAC;QAEjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC7C,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;QACF,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,SAAS,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpF,MAAM,IAAI,+BAAgB,CACzB,iDAAiD,GAAG,MAAM,OAAO,GAAG,CACpE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,MAAM,iBAAiB,GAAG,GAAG,EAAE;YACjE,QAAQ,EAAE,IAAI,CAAC,MAAM;YACrB,OAAO,EAAE,OAAO,CAAC,MAAM;YACvB,UAAU;SACV,CAAC,CAAC;QAEH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACtC,CAAC;IAKO,KAAK,CAAC,WAAW,CACxB,GAAW,EACX,OAAqB;QAErB,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;gBAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;gBAC7C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,QAAQ,EAAE,OAAO;aACjB,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,MAAM,IAAI,+BAAgB,CAAC,0BAA0B,GAAG,MAAM,OAAO,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,+BAAgB,CAAC,0BAA0B,GAAG,WAAW,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACJ,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,+BAAgB,CAAC,wCAAwC,GAAG,GAAG,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,YAAY,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,+BAAgB,CAAC,kCAAkC,GAAG,GAAG,CAAC,CAAC;QACtE,CAAC;QAED,OAAO;YACN,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI;YAC/B,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;SACnD,CAAC;IACH,CAAC;IAGO,QAAQ,CACf,MAAe,EACf,MAAqB;QAErB,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACnD,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,CAAC;QACjE,CAAC;QAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,MAAiC,CAAC;YAC9C,OAAO;gBACN,OAAO,EAAE;oBACR,GAAG,EAAE,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;oBACtD,MAAM,EAAE,0BAA0B;iBAClC;aACD,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC;QAE3B,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO;gBACN,OAAO,EAAE;oBACR,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,MAAM,EAAE,0CAA0C,GAAG,CAAC,GAAG,SAAS,GAAG,CAAC,GAAG,IAAI,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,MAAM,GAAG;iBAChH;aACD,CAAC;QACH,CAAC;QAED,IAAI,SAA6C,CAAC;QAClD,IAAI,CAAC;YACJ,SAAS,GAAG,IAAA,6BAAe,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAA4B,CAAC,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACR,OAAO;gBACN,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,+CAA+C,EAAE;aAClF,CAAC;QACH,CAAC;QAED,OAAO;YACN,QAAQ,EAAE;gBACT,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,UAAU,EAAE,CAAC,SAAS,CAAC;gBACvB,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW;gBACxE,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,YAAY,EAAE,MAAM,CAAC,YAAY;aACjC;SACD,CAAC;IACH,CAAC;IAGO,UAAU,CACjB,YAA2B,EAC3B,MAAqB,EACrB,UAAkB;QAElB,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,MAAM,CAAC,eAAe,IAAI,UAAU,CAAC;QAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACrE,CAAC;CACD,CAAA;AA3JY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,YAAO,GAAE;qCAIW,uBAAM;GAHd,mBAAmB,CA2J/B"}

package/dist/modules/token-exchange/services/scoped-jwt.strategy.d.ts

@@ -0,0 +1,12 @@
+import type { AuthenticatedRequest } from '@n8n/db';
+import { UserRepository } from '@n8n/db';
+import type { AuthStrategy } from '../../../services/auth-strategy.types';
+import { JwtService } from '../../../services/jwt.service';
+export declare class ScopedJwtStrategy implements AuthStrategy {
+    private readonly jwtService;
+    private readonly userRepository;
+    constructor(jwtService: JwtService, userRepository: UserRepository);
+    authenticate(req: AuthenticatedRequest): Promise<boolean | null>;
+    private findUser;
+    private extractToken;
+}

package/dist/modules/token-exchange/services/scoped-jwt.strategy.js

@@ -0,0 +1,92 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScopedJwtStrategy = void 0;
+const db_1 = require("@n8n/db");
+const di_1 = require("@n8n/di");
+const jsonwebtoken_1 = require("jsonwebtoken");
+const jwt_service_1 = require("../../../services/jwt.service");
+const permissions_1 = require("@n8n/permissions");
+const token_exchange_types_1 = require("../token-exchange.types");
+const BEARER_PREFIX = 'Bearer ';
+const API_KEY_HEADER = 'x-n8n-api-key';
+let ScopedJwtStrategy = class ScopedJwtStrategy {
+    constructor(jwtService, userRepository) {
+        this.jwtService = jwtService;
+        this.userRepository = userRepository;
+    }
+    async authenticate(req) {
+        const token = this.extractToken(req);
+        if (!token)
+            return null;
+        const decoded = this.jwtService.decode(token);
+        if (!decoded || decoded.iss !== token_exchange_types_1.TOKEN_EXCHANGE_ISSUER) {
+            return null;
+        }
+        let payload;
+        try {
+            payload = this.jwtService.verify(token, {
+                issuer: token_exchange_types_1.TOKEN_EXCHANGE_ISSUER,
+            });
+        }
+        catch (error) {
+            if (error instanceof jsonwebtoken_1.TokenExpiredError || error instanceof jsonwebtoken_1.JsonWebTokenError) {
+                return false;
+            }
+            throw error;
+        }
+        const subject = await this.findUser(payload.sub);
+        if (!subject || subject.disabled)
+            return false;
+        let actor;
+        if (payload.act) {
+            const found = await this.findUser(payload.act.sub);
+            if (found?.disabled)
+                return false;
+            actor = found ?? undefined;
+        }
+        const actingUser = actor ?? subject;
+        req.tokenGrant = {
+            scopes: actingUser.role.scopes.map((s) => s.slug),
+            apiKeyScopes: Array.from(permissions_1.ALL_API_KEY_SCOPES),
+            subject,
+            ...(actor && { actor }),
+        };
+        req.user = actingUser;
+        return true;
+    }
+    async findUser(id) {
+        return await this.userRepository.findOne({
+            where: { id },
+            relations: { role: true },
+        });
+    }
+    extractToken(req) {
+        const authHeader = req.headers.authorization;
+        if (typeof authHeader === 'string' && authHeader.startsWith(BEARER_PREFIX)) {
+            const token = authHeader.slice(BEARER_PREFIX.length).trim();
+            if (token)
+                return token;
+        }
+        const apiKeyHeader = req.headers[API_KEY_HEADER];
+        if (typeof apiKeyHeader === 'string' && apiKeyHeader) {
+            return apiKeyHeader;
+        }
+        return null;
+    }
+};
+exports.ScopedJwtStrategy = ScopedJwtStrategy;
+exports.ScopedJwtStrategy = ScopedJwtStrategy = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [jwt_service_1.JwtService,
+        db_1.UserRepository])
+], ScopedJwtStrategy);
+//# sourceMappingURL=scoped-jwt.strategy.js.map

package/dist/modules/token-exchange/services/scoped-jwt.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-jwt.strategy.js","sourceRoot":"","sources":["../../../../src/modules/token-exchange/services/scoped-jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,gCAAyC;AACzC,gCAAkC;AAClC,+CAAoE;AAGpE,wDAAoD;AAEpD,kDAAsD;AACtD,kEAAuF;AAEvF,MAAM,aAAa,GAAG,SAAS,CAAC;AAChC,MAAM,cAAc,GAAG,eAAe,CAAC;AAGhC,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC7B,YACkB,UAAsB,EACtB,cAA8B;QAD9B,eAAU,GAAV,UAAU,CAAY;QACtB,mBAAc,GAAd,cAAc,CAAgB;IAC7C,CAAC;IAEJ,KAAK,CAAC,YAAY,CAAC,GAAyB;QAE3C,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAGxB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAmB,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,KAAK,4CAAqB,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC;QACb,CAAC;QAGD,IAAI,OAAyB,CAAC;QAC9B,IAAI,CAAC;YACJ,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAmB,KAAK,EAAE;gBACzD,MAAM,EAAE,4CAAqB;aAC7B,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,gCAAiB,IAAI,KAAK,YAAY,gCAAiB,EAAE,CAAC;gBAC9E,OAAO,KAAK,CAAC;YACd,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;QAGD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAI/C,IAAI,KAAuB,CAAC;QAC5B,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnD,IAAI,KAAK,EAAE,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAClC,KAAK,GAAG,KAAK,IAAI,SAAS,CAAC;QAC5B,CAAC;QAGD,MAAM,UAAU,GAAG,KAAK,IAAI,OAAO,CAAC;QAGpC,GAAG,CAAC,UAAU,GAAG;YAChB,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACjD,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,gCAAkB,CAAC;YAC5C,OAAO;YACP,GAAG,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;SACvB,CAAC;QAEF,GAAG,CAAC,IAAI,GAAG,UAAU,CAAC;QAEtB,OAAO,IAAI,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,EAAU;QAChC,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;YACxC,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SACzB,CAAC,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,GAAyB;QAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC5E,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5D,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QACzB,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,EAAE,CAAC;YACtD,OAAO,YAAY,CAAC;QACrB,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;CACD,CAAA;AAhFY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,YAAO,GAAE;qCAGqB,wBAAU;QACN,mBAAc;GAHpC,iBAAiB,CAgF7B"}

package/dist/modules/token-exchange/services/token-exchange.service.d.ts

@@ -0,0 +1,31 @@
+import { Logger } from '@n8n/backend-common';
+import type { User } from '@n8n/db';
+import { JwtService } from '../../../services/jwt.service';
+import { TokenExchangeConfig } from '../token-exchange.config';
+import type { ExternalTokenClaims, ResolvedTrustedKey, TokenExchangeRequest } from '../token-exchange.schemas';
+import { type IssuedTokenResult } from '../token-exchange.types';
+import { IdentityResolutionService } from './identity-resolution.service';
+import { JtiStoreService } from './jti-store.service';
+import { TrustedKeyService } from './trusted-key.service';
+export declare class TokenExchangeService {
+    private readonly trustedKeyStore;
+    private readonly jtiStore;
+    private readonly identityResolutionService;
+    private readonly config;
+    private readonly jwtService;
+    private readonly logger;
+    constructor(logger: Logger, trustedKeyStore: TrustedKeyService, jtiStore: JtiStoreService, identityResolutionService: IdentityResolutionService, config: TokenExchangeConfig, jwtService: JwtService);
+    verifyToken(subjectToken: string, { maxLifetimeSeconds }?: {
+        maxLifetimeSeconds?: number;
+    }): Promise<{
+        claims: ExternalTokenClaims;
+        resolvedKey: ResolvedTrustedKey;
+    }>;
+    embedLogin(subjectToken: string): Promise<{
+        user: User;
+        subject: string;
+        issuer: string;
+        kid: string;
+    }>;
+    exchange(request: TokenExchangeRequest): Promise<IssuedTokenResult>;
+}

package/dist/modules/token-exchange/services/token-exchange.service.js

@@ -0,0 +1,152 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenExchangeService = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const di_1 = require("@n8n/di");
+const crypto_1 = require("crypto");
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const auth_error_1 = require("../../../errors/response-errors/auth.error");
+const bad_request_error_1 = require("../../../errors/response-errors/bad-request.error");
+const jwt_service_1 = require("../../../services/jwt.service");
+const token_exchange_config_1 = require("../token-exchange.config");
+const token_exchange_schemas_1 = require("../token-exchange.schemas");
+const token_exchange_types_1 = require("../token-exchange.types");
+const identity_resolution_service_1 = require("./identity-resolution.service");
+const jti_store_service_1 = require("./jti-store.service");
+const trusted_key_service_1 = require("./trusted-key.service");
+const MAX_TOKEN_LIFETIME_SECONDS = 60;
+const MIN_REMAINING_LIFETIME_SECONDS = 5;
+let TokenExchangeService = class TokenExchangeService {
+    constructor(logger, trustedKeyStore, jtiStore, identityResolutionService, config, jwtService) {
+        this.trustedKeyStore = trustedKeyStore;
+        this.jtiStore = jtiStore;
+        this.identityResolutionService = identityResolutionService;
+        this.config = config;
+        this.jwtService = jwtService;
+        this.logger = logger.scoped('token-exchange');
+    }
+    async verifyToken(subjectToken, { maxLifetimeSeconds } = {}) {
+        const decoded = jsonwebtoken_1.default.decode(subjectToken, { complete: true });
+        if (!decoded || typeof decoded === 'string') {
+            throw new bad_request_error_1.BadRequestError('Invalid token format');
+        }
+        const { kid } = decoded.header;
+        if (!kid) {
+            throw new bad_request_error_1.BadRequestError('Token header missing kid');
+        }
+        const decodedPayload = decoded.payload;
+        const iss = typeof decodedPayload === 'object' && decodedPayload !== null
+            ? decodedPayload.iss
+            : undefined;
+        if (typeof iss !== 'string' || !iss) {
+            throw new bad_request_error_1.BadRequestError('Token payload missing iss');
+        }
+        const resolvedKey = await this.trustedKeyStore.getByKidAndIss(kid, iss);
+        if (!resolvedKey) {
+            throw new auth_error_1.AuthError('Unknown key id');
+        }
+        let payload;
+        try {
+            const result = jsonwebtoken_1.default.verify(subjectToken, resolvedKey.key, {
+                algorithms: resolvedKey.algorithms,
+                issuer: resolvedKey.issuer,
+                audience: resolvedKey.expectedAudience,
+                ignoreExpiration: false,
+                ignoreNotBefore: false,
+            });
+            if (typeof result === 'string' || !('iat' in result)) {
+                throw new auth_error_1.AuthError('Unexpected token format');
+            }
+            payload = result;
+        }
+        catch (error) {
+            if (error instanceof auth_error_1.AuthError)
+                throw error;
+            const message = error instanceof Error ? error.message : 'unknown error';
+            this.logger.warn('JWT verification failed', { error: message });
+            throw new auth_error_1.AuthError('Token verification failed');
+        }
+        const claims = token_exchange_schemas_1.ExternalTokenClaimsSchema.parse(payload);
+        if (maxLifetimeSeconds !== undefined) {
+            const tokenLifetime = claims.exp - claims.iat;
+            if (tokenLifetime > maxLifetimeSeconds) {
+                throw new auth_error_1.AuthError('Token lifetime exceeds maximum allowed');
+            }
+        }
+        const consumed = await this.jtiStore.consume(claims.jti, new Date(claims.exp * 1000));
+        if (!consumed) {
+            throw new auth_error_1.AuthError('Token has already been used');
+        }
+        return { claims, resolvedKey };
+    }
+    async embedLogin(subjectToken) {
+        const { claims, resolvedKey } = await this.verifyToken(subjectToken, {
+            maxLifetimeSeconds: MAX_TOKEN_LIFETIME_SECONDS,
+        });
+        const user = await this.identityResolutionService.resolve(claims, resolvedKey.allowedRoles, {
+            kid: resolvedKey.kid,
+            issuer: resolvedKey.issuer,
+        });
+        return { user, subject: claims.sub, issuer: resolvedKey.issuer, kid: resolvedKey.kid };
+    }
+    async exchange(request) {
+        const subjectClaims = await this.verifyToken(request.subject_token);
+        const actorClaims = request.actor_token
+            ? await this.verifyToken(request.actor_token)
+            : undefined;
+        const actor = actorClaims
+            ? await this.identityResolutionService.resolve(actorClaims.claims, actorClaims.resolvedKey.allowedRoles, actorClaims.resolvedKey)
+            : undefined;
+        const subject = await this.identityResolutionService.resolve(subjectClaims.claims, subjectClaims.resolvedKey.allowedRoles, subjectClaims.resolvedKey);
+        const now = Math.floor(Date.now() / 1000);
+        const maxTtl = this.config.maxTokenTtl;
+        const exp = Math.min(subjectClaims.claims.exp, actorClaims?.claims.exp ?? Infinity, now + maxTtl);
+        if (exp <= now + MIN_REMAINING_LIFETIME_SECONDS) {
+            throw new auth_error_1.AuthError('Subject token too close to expiry to issue a new token');
+        }
+        const resources = request.resource?.split(' ').filter(Boolean);
+        const payload = {
+            iss: token_exchange_types_1.TOKEN_EXCHANGE_ISSUER,
+            sub: subject.id,
+            ...(actor && { act: { sub: actor.id } }),
+            ...(request.scope && { scope: request.scope }),
+            ...(resources?.length && { resource: resources }),
+            iat: now,
+            exp,
+            jti: (0, crypto_1.randomUUID)(),
+        };
+        const accessToken = this.jwtService.sign(payload);
+        return {
+            accessToken,
+            expiresIn: exp - now,
+            subjectUserId: subject.id,
+            subject: subjectClaims.claims.sub,
+            issuer: subjectClaims.claims.iss,
+            actor: actorClaims?.claims.sub,
+            actorUserId: actor?.id,
+        };
+    }
+};
+exports.TokenExchangeService = TokenExchangeService;
+exports.TokenExchangeService = TokenExchangeService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [backend_common_1.Logger,
+        trusted_key_service_1.TrustedKeyService,
+        jti_store_service_1.JtiStoreService,
+        identity_resolution_service_1.IdentityResolutionService,
+        token_exchange_config_1.TokenExchangeConfig,
+        jwt_service_1.JwtService])
+], TokenExchangeService);
+//# sourceMappingURL=token-exchange.service.js.map

package/dist/modules/token-exchange/services/token-exchange.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange.service.js","sourceRoot":"","sources":["../../../../src/modules/token-exchange/services/token-exchange.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wDAA6C;AAE7C,gCAAkC;AAClC,mCAAoC;AACpC,gEAA+B;AAE/B,oEAAgE;AAChE,kFAA6E;AAC7E,wDAAoD;AAEpD,oEAA+D;AAM/D,sEAAsE;AACtE,kEAIiC;AACjC,+EAA0E;AAC1E,2DAAsD;AACtD,+DAA0D;AAE1D,MAAM,0BAA0B,GAAG,EAAE,CAAC;AACtC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAGlC,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAGhC,YACC,MAAc,EACG,eAAkC,EAClC,QAAyB,EACzB,yBAAoD,EACpD,MAA2B,EAC3B,UAAsB;QAJtB,oBAAe,GAAf,eAAe,CAAmB;QAClC,aAAQ,GAAR,QAAQ,CAAiB;QACzB,8BAAyB,GAAzB,yBAAyB,CAA2B;QACpD,WAAM,GAAN,MAAM,CAAqB;QAC3B,eAAU,GAAV,UAAU,CAAY;QAEvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC/C,CAAC;IAaD,KAAK,CAAC,WAAW,CAChB,YAAoB,EACpB,EAAE,kBAAkB,KAAsC,EAAE;QAE5D,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,IAAI,mCAAe,CAAC,sBAAsB,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,MAAM,IAAI,mCAAe,CAAC,0BAA0B,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;QACvC,MAAM,GAAG,GACR,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,IAAI;YAC5D,CAAC,CAAC,cAAc,CAAC,GAAG;YACpB,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC;YACrC,MAAM,IAAI,mCAAe,CAAC,2BAA2B,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,MAAM,IAAI,sBAAS,CAAC,gBAAgB,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,OAAuB,CAAC;QAC5B,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,sBAAG,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,GAAG,EAAE;gBAExD,UAAU,EAAE,WAAW,CAAC,UAA6B;gBACrD,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,QAAQ,EAAE,WAAW,CAAC,gBAAgB;gBACtC,gBAAgB,EAAE,KAAK;gBACvB,eAAe,EAAE,KAAK;aACtB,CAAC,CAAC;YACH,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,sBAAS,CAAC,yBAAyB,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,GAAG,MAAM,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,sBAAS;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAChE,MAAM,IAAI,sBAAS,CAAC,2BAA2B,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,MAAM,GAAG,kDAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAExD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;YAC9C,IAAI,aAAa,GAAG,kBAAkB,EAAE,CAAC;gBACxC,MAAM,IAAI,sBAAS,CAAC,wCAAwC,CAAC,CAAC;YAC/D,CAAC;QACF,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,sBAAS,CAAC,6BAA6B,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,UAAU,CACf,YAAoB;QAEpB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE;YACpE,kBAAkB,EAAE,0BAA0B;SAC9C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,YAAY,EAAE;YAC3F,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,MAAM,EAAE,WAAW,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAA6B;QAC3C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW;YACtC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC;QAEb,MAAM,KAAK,GAAG,WAAW;YACxB,CAAC,CAAC,MAAM,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAC5C,WAAW,CAAC,MAAM,EAClB,WAAW,CAAC,WAAW,CAAC,YAAY,EACpC,WAAW,CAAC,WAAW,CACvB;YACF,CAAC,CAAC,SAAS,CAAC;QACb,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAC3D,aAAa,CAAC,MAAM,EACpB,aAAa,CAAC,WAAW,CAAC,YAAY,EACtC,aAAa,CAAC,WAAW,CACzB,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CACnB,aAAa,CAAC,MAAM,CAAC,GAAG,EACxB,WAAW,EAAE,MAAM,CAAC,GAAG,IAAI,QAAQ,EACnC,GAAG,GAAG,MAAM,CACZ,CAAC;QAEF,IAAI,GAAG,IAAI,GAAG,GAAG,8BAA8B,EAAE,CAAC;YACjD,MAAM,IAAI,sBAAS,CAAC,wDAAwD,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE/D,MAAM,OAAO,GAAqB;YACjC,GAAG,EAAE,4CAAqB;YAC1B,GAAG,EAAE,OAAO,CAAC,EAAE;YACf,GAAG,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACxC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAC9C,GAAG,CAAC,SAAS,EAAE,MAAM,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;YACjD,GAAG,EAAE,GAAG;YACR,GAAG;YACH,GAAG,EAAE,IAAA,mBAAU,GAAE;SACjB,CAAC;QAEF,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAElD,OAAO;YACN,WAAW;YACX,SAAS,EAAE,GAAG,GAAG,GAAG;YACpB,aAAa,EAAE,OAAO,CAAC,EAAE;YACzB,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG;YACjC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG;YAChC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG;YAC9B,WAAW,EAAE,KAAK,EAAE,EAAE;SACtB,CAAC;IACH,CAAC;CACD,CAAA;AAjKY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,YAAO,GAAE;qCAKA,uBAAM;QACoB,uCAAiB;QACxB,mCAAe;QACE,uDAAyB;QAC5C,2CAAmB;QACf,wBAAU;GAT5B,oBAAoB,CAiKhC"}

package/dist/modules/token-exchange/services/trusted-key.service.d.ts

@@ -0,0 +1,47 @@
+import { Logger } from '@n8n/backend-common';
+import { DbLockService } from '@n8n/db';
+import { InstanceSettings } from 'n8n-core';
+import { TrustedKeySourceEntity } from '../database/entities/trusted-key-source.entity';
+import { TrustedKeyEntity } from '../database/entities/trusted-key.entity';
+import { TrustedKeySourceRepository } from '../database/repositories/trusted-key-source.repository';
+import { TrustedKeyRepository } from '../database/repositories/trusted-key.repository';
+import { TokenExchangeConfig } from '../token-exchange.config';
+import type { ResolvedTrustedKey } from '../token-exchange.schemas';
+import { JwksResolverService } from './jwks-resolver';
+export declare class TrustedKeyService {
+    private readonly config;
+    private readonly trustedKeySourceRepository;
+    private readonly trustedKeyRepository;
+    private readonly instanceSettings;
+    private readonly dbLockService;
+    private readonly jwksResolverService;
+    private readonly logger;
+    private refreshInterval;
+    private isShuttingDown;
+    private readonly cryptoCache;
+    constructor(logger: Logger, config: TokenExchangeConfig, trustedKeySourceRepository: TrustedKeySourceRepository, trustedKeyRepository: TrustedKeyRepository, instanceSettings: InstanceSettings, dbLockService: DbLockService, jwksResolverService: JwksResolverService);
+    initialize(): Promise<void>;
+    onLeaderTakeover(): Promise<void>;
+    private initializeAsLeader;
+    startRefresh(): void;
+    stopRefresh(): void;
+    shutdown(): void;
+    getByKidAndIss(kid: string, issuer: string): Promise<ResolvedTrustedKey | undefined>;
+    refreshSource(sourceId: string): Promise<void>;
+    listAll(): Promise<TrustedKeyEntity[]>;
+    listSources(): Promise<TrustedKeySourceEntity[]>;
+    private parseConfigSources;
+    private generateSourceId;
+    private syncSourcesToDb;
+    private refreshAllSources;
+    private refreshDueSources;
+    private getRefreshIntervalMs;
+    private refreshSourceInternal;
+    private refreshSourceWithinTransaction;
+    private resolveKeysForSource;
+    private resolveKeysForJwksSource;
+    private resolveKeysForStaticSource;
+    private resolveStaticKeys;
+    private validateKeyMaterial;
+    private resolveCryptoKey;
+}