n8n 2.26.3 → 2.27.0

package/dist/modules/oauth-server/oauth-token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-token.service.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+EAAoF;AAGpF,wDAA6C;AAC7C,8CAAsC;AACtC,gCAA0D;AAC1D,gCAAkC;AAClC,0CAA+C;AAC/C,+CAA4D;AAC5D,6CAAsD;AAEtD,6FAA4E;AAC5E,+FAA8E;AAC9E,yGAA8F;AAC9F,2GAAgG;AAChG,iDAAgF;AAEhF,wDAAoD;AAKpD,wFAAmF;AAW5E,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAI7B,YACkB,MAAc,EACd,UAAsB,EACtB,cAA8B,EAC9B,qBAA4C,EAC5C,sBAA8C,EAC9C,gBAA2C;QAL3C,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAY;QACtB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,qBAAgB,GAAhB,gBAAgB,CAA2B;QAT5C,gCAA2B,GAAG,CAAC,GAAG,gBAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QACvD,4BAAuB,GAAG,EAAE,GAAG,gBAAI,CAAC,IAAI,CAAC,cAAc,CAAC;IAStE,CAAC;IAEJ,2BAA2B;QAC1B,OAAO,IAAI,CAAC,2BAA2B,CAAC;IACzC,CAAC;IAED,iBAAiB,CAChB,MAAc,EACd,QAAgB,EAChB,QAAiB;QAIjB,MAAM,QAAQ,GAAG,QAAQ,IAAI,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,EAAE,cAAc,EAAE,CAAC;QAC1F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,8BAAe,CACxB,0GAA0G,CAC1G,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACxC,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,QAAQ;YACb,SAAS,EAAE,QAAQ;YACnB,GAAG,EAAE,IAAA,wBAAU,GAAE;YACjB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,2BAA2B;YACrE,IAAI,EAAE;gBACL,OAAO,EAAE,IAAI;aACb;SACD,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAErD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,aAAa,CAClB,WAAmB,EACnB,YAAoB,EACpB,QAAgB,EAChB,MAAc;QAEd,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE;YACjF,MAAM,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE;gBAClE,KAAK,EAAE,WAAW;gBAClB,QAAQ;gBACR,MAAM;aACN,CAAC,CAAC;YAEH,MAAM,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE;gBACnE,KAAK,EAAE,YAAY;gBACnB,QAAQ;gBACR,MAAM;gBACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,uBAAuB;aACpD,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,6BAA6B,CAClC,YAAoB,EACpB,QAAgB,EAChB,QAAiB;QAEjB,OAAO,MAAM,IAAA,oBAAe,EAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,MAAM,kBAAkB,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,yCAAY,EAAE;gBAC1D,KAAK,EAAE;oBACN,KAAK,EAAE,YAAY;oBACnB,QAAQ;iBACR;aACD,CAAC,CAAC;YAIH,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACzB,MAAM,IAAI,6BAAiB,CAAC,uBAAuB,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,yCAAY,EAAE;gBAC7C,KAAK,EAAE,YAAY;gBACnB,QAAQ;gBACR,SAAS,EAAE,IAAA,yBAAe,EAAC,GAAG,CAAC;aAC/B,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;YACzC,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,6BAAiB,CAAC,uBAAuB,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAC5E,kBAAkB,CAAC,MAAM,EACzB,QAAQ,EACR,QAAQ,CACR,CAAC;YAEF,MAAM,GAAG,CAAC,MAAM,CAAC,uCAAW,EAAE;gBAC7B,KAAK,EAAE,WAAW;gBAClB,QAAQ;gBACR,MAAM,EAAE,kBAAkB,CAAC,MAAM;aACjC,CAAC,CAAC;YAEH,MAAM,GAAG,CAAC,MAAM,CAAC,yCAAY,EAAE;gBAC9B,KAAK,EAAE,eAAe;gBACtB,QAAQ;gBACR,MAAM,EAAE,kBAAkB,CAAC,MAAM;gBACjC,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,uBAAuB;aAC7C,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;gBACrE,QAAQ;gBACR,MAAM,EAAE,kBAAkB,CAAC,MAAM;aACjC,CAAC,CAAC;YAEH,OAAO;gBACN,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,IAAI,CAAC,2BAA2B;gBAC5C,aAAa,EAAE,eAAe;aAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,gBAAyB;QAC/D,IAAI,OAAgB,CAAC;QAErB,IAAI,CAAC;YACJ,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;YAC1E,OAAO,GAAG,IAAI,CAAC,6BAA6B,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,mCAAoB,EAAE,CAAC;QAClC,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,mCAAoB,EAAE,CAAC;QAClC,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;YAClE,KAAK,EAAE,EAAE,KAAK,EAAE;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxB,MAAM,IAAI,uCAAwB,EAAE,CAAC;QACtC,CAAC;QAED,OAAO;YACN,KAAK;YACL,QAAQ;YACR,MAAM,EAAE,EAAE;YACV,KAAK,EAAE;gBACN,MAAM;aACN;SACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,gBAAyB;QACpE,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;YAEvE,MAAM,MAAM,GACX,QAAQ,CAAC,KAAK,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;gBACnD,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAC/C,CAAC,CAAC,IAAI,CAAC;YACT,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC;YAC5F,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;gBAC9C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;gBACrB,SAAS,EAAE,CAAC,MAAM,CAAC;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC;YAClF,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,IAAA,0BAAW,EAAC,KAAK,CAAC,CAAC;YACxC,MAAM,MAAM,GACX,YAAY,YAAY,mCAAoB;gBAC3C,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,YAAY,YAAY,uCAAwB;oBACjD,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,eAAe,CAAC;YACrB,OAAO;gBACN,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE;oBACR,MAAM;oBACN,SAAS,EAAE,OAAO;oBAClB,aAAa,EAAE,YAAY,CAAC,OAAO;iBACnC;aACD,CAAC;QACH,CAAC;IACF,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,QAAgB;QACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;YACtD,KAAK;YACL,QAAQ;SACR,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,QAAgB;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC;YACvD,KAAK;YACL,QAAQ;SACR,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAWO,KAAK,CAAC,mBAAmB,CAAC,gBAAyB;QAC1D,IAAI,gBAAgB,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;YAChF,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAChE,CAAC;QAKD,OAAO,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,CAAC;IAChD,CAAC;IAIO,6BAA6B,CAAC,KAAa,EAAE,SAAmB;QACvE,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE;gBACpC,QAAQ,EAAE,SAAkC;aAC5C,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAEhB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACJ,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACpD,CAAC;gBAAC,MAAM,CAAC;oBACR,SAAS;gBACV,CAAC;YACF,CAAC;YAED,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAEO,cAAc,CAAC,OAAgB,EAAE,KAAa;QACrD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,UAAU,GAAI,OAAmC,CAAC,KAAK,CAAC,CAAC;QAC/D,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;CACD,CAAA;AA/RY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,YAAO,GAAE;qCAMiB,uBAAM;QACF,wBAAU;QACN,mBAAc;QACP,qDAAqB;QACpB,uDAAsB;QAC5B,uDAAyB;GAVjD,iBAAiB,CA+R7B"}

package/dist/modules/{mcp/mcp.oauth.controller.d.ts → oauth-server/oauth.controller.d.ts}

@@ -1,13 +1,15 @@
 import { StaticRouterMetadata } from '@n8n/decorators';
 import type { Response, Request } from 'express';
+import { ProtectedResourceRegistry } from '../../services/protected-resource.registry';
 import { UrlService } from '../../services/url.service';
-export declare class McpOAuthController {
+export declare class OAuthController {
     private readonly urlService;
-    constructor(urlService: UrlService);
+    private readonly resourceRegistry;
+    constructor(urlService: UrlService, resourceRegistry: ProtectedResourceRegistry);
     private setCorsHeaders;
     static routers: StaticRouterMetadata[];
     metadataOptions(_req: Request, res: Response): void;
     metadata(_req: Request, res: Response): void;
     protectedResourceMetadataOptions(_req: Request, res: Response): void;
-    protectedResourceMetadata(_req: Request, res: Response): void;
+    protectedResourceMetadata(req: Request, res: Response): Promise<void>;
 }

package/dist/modules/{mcp/mcp.oauth.controller.js → oauth-server/oauth.controller.js}

@@ -9,7 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.McpOAuthController = void 0;
+exports.OAuthController = void 0;
 const authorize_js_1 = require("@modelcontextprotocol/sdk/server/auth/handlers/authorize.js");
 const register_js_1 = require("@modelcontextprotocol/sdk/server/auth/handlers/register.js");
 const revoke_js_1 = require("@modelcontextprotocol/sdk/server/auth/handlers/revoke.js");
@@ -19,40 +19,64 @@ const config_1 = require("@n8n/config");
 const constants_1 = require("@n8n/constants");
 const decorators_1 = require("@n8n/decorators");
 const di_1 = require("@n8n/di");
+const protected_resource_registry_1 = require("../../services/protected-resource.registry");
 const url_service_1 = require("../../services/url.service");
-const mcp_oauth_service_1 = require("./mcp-oauth-service");
-const mcp_constants_1 = require("./mcp.constants");
-const mcp_errors_1 = require("./mcp.errors");
-const mcp_settings_service_1 = require("./mcp.settings.service");
-const mcpOAuthService = di_1.Container.get(mcp_oauth_service_1.McpOAuthService);
-const mcpSettingsService = di_1.Container.get(mcp_settings_service_1.McpSettingsService);
+const oauth_server_service_1 = require("./oauth-server.service");
+const oauth_errors_1 = require("./oauth.errors");
+const oauthServerService = di_1.Container.get(oauth_server_service_1.OAuthServerService);
 const globalConfig = di_1.Container.get(config_1.GlobalConfig);
 const logger = di_1.Container.get(backend_common_1.Logger);
-const mcpEnabledGuard = async (_req, res, next) => {
-    const enabled = await mcpSettingsService.getEnabled();
-    if (!enabled) {
-        res.status(403).json({ error: mcp_constants_1.MCP_ACCESS_DISABLED_ERROR_MESSAGE });
-        return;
-    }
-    next();
-};
-const mcpClientLimitGuard = async (_req, res, next) => {
-    if (await mcpOAuthService.isClientLimitReached()) {
+const oauthClientLimitGuard = async (_req, res, next) => {
+    if (await oauthServerService.isClientLimitReached()) {
         const limit = globalConfig.endpoints.mcpMaxRegisteredClients;
-        logger.warn('MCP OAuth client registration rejected: instance limit reached (pre-check)', {
+        logger.warn('OAuth client registration rejected: instance limit reached (pre-check)', {
             limit,
         });
         res.status(503).json({
             error: 'server_error',
-            error_description: (0, mcp_errors_1.buildMcpClientLimitReachedMessage)(limit),
+            error_description: (0, oauth_errors_1.buildOAuthClientLimitReachedMessage)(limit),
         });
         return;
     }
     next();
 };
-let McpOAuthController = class McpOAuthController {
-    constructor(urlService) {
+const registerRouter = (0, register_js_1.clientRegistrationHandler)({
+    clientsStore: oauthServerService.clientsStore,
+});
+const authorizeRouter = (0, authorize_js_1.authorizationHandler)({ provider: oauthServerService });
+const tokenRouter = (0, token_js_1.tokenHandler)({ provider: oauthServerService });
+const revokeRouter = (0, revoke_js_1.revocationHandler)({ provider: oauthServerService });
+const sharedEndpointRouters = (basePath) => [
+    {
+        path: `${basePath}/register`,
+        router: registerRouter,
+        skipAuth: true,
+        middlewares: [oauthClientLimitGuard],
+        ipRateLimit: { limit: 10, windowMs: 5 * constants_1.Time.minutes.toMilliseconds },
+    },
+    {
+        path: `${basePath}/authorize`,
+        router: authorizeRouter,
+        skipAuth: true,
+        ipRateLimit: { limit: 50, windowMs: 5 * constants_1.Time.minutes.toMilliseconds },
+    },
+    {
+        path: `${basePath}/token`,
+        router: tokenRouter,
+        skipAuth: true,
+        ipRateLimit: { limit: 20, windowMs: 5 * constants_1.Time.minutes.toMilliseconds },
+    },
+    {
+        path: `${basePath}/revoke`,
+        router: revokeRouter,
+        skipAuth: true,
+        ipRateLimit: { limit: 30, windowMs: 5 * constants_1.Time.minutes.toMilliseconds },
+    },
+];
+let OAuthController = class OAuthController {
+    constructor(urlService, resourceRegistry) {
         this.urlService = urlService;
+        this.resourceRegistry = resourceRegistry;
     }
     setCorsHeaders(res) {
         res.header('Access-Control-Allow-Origin', '*');
@@ -76,7 +100,7 @@ let McpOAuthController = class McpOAuthController {
             grant_types_supported: ['authorization_code', 'refresh_token'],
             token_endpoint_auth_methods_supported: ['none', 'client_secret_post', 'client_secret_basic'],
             code_challenge_methods_supported: ['S256'],
-            scopes_supported: mcp_oauth_service_1.SUPPORTED_SCOPES,
+            scopes_supported: this.resourceRegistry.getAllScopes(),
         };
         res.json(metadata);
     }
@@ -84,47 +108,33 @@ let McpOAuthController = class McpOAuthController {
         this.setCorsHeaders(res);
         res.status(204).end();
     }
-    protectedResourceMetadata(_req, res) {
+    async protectedResourceMetadata(req, res) {
         this.setCorsHeaders(res);
+        const resourcePath = '/' +
+            (Array.isArray(req.params.resourcePath)
+                ? req.params.resourcePath.join('/')
+                : req.params.resourcePath);
+        const resource = await this.resourceRegistry.getByResourcePath(resourcePath);
+        if (!resource) {
+            res.status(404).json({ message: 'Unknown protected resource' });
+            return;
+        }
         const baseUrl = this.urlService.getInstanceBaseUrl();
-        res.json({
-            resource: `${baseUrl}/mcp-server/http`,
+        const metadata = {
+            resource: resource.getResourceUrl(),
             bearer_methods_supported: ['header'],
             authorization_servers: [baseUrl],
-            scopes_supported: mcp_oauth_service_1.SUPPORTED_SCOPES,
-        });
+        };
+        if (resource.scopes.length > 0) {
+            metadata.scopes_supported = resource.scopes;
+        }
+        res.json(metadata);
     }
 };
-exports.McpOAuthController = McpOAuthController;
-McpOAuthController.routers = [
-    {
-        path: '/mcp-oauth/register',
-        router: (0, register_js_1.clientRegistrationHandler)({ clientsStore: mcpOAuthService.clientsStore }),
-        skipAuth: true,
-        middlewares: [mcpEnabledGuard, mcpClientLimitGuard],
-        ipRateLimit: { limit: 10, windowMs: 5 * constants_1.Time.minutes.toMilliseconds },
-    },
-    {
-        path: '/mcp-oauth/authorize',
-        router: (0, authorize_js_1.authorizationHandler)({ provider: mcpOAuthService }),
-        skipAuth: true,
-        middlewares: [mcpEnabledGuard],
-        ipRateLimit: { limit: 50, windowMs: 5 * constants_1.Time.minutes.toMilliseconds },
-    },
-    {
-        path: '/mcp-oauth/token',
-        router: (0, token_js_1.tokenHandler)({ provider: mcpOAuthService }),
-        skipAuth: true,
-        middlewares: [mcpEnabledGuard],
-        ipRateLimit: { limit: 20, windowMs: 5 * constants_1.Time.minutes.toMilliseconds },
-    },
-    {
-        path: '/mcp-oauth/revoke',
-        router: (0, revoke_js_1.revocationHandler)({ provider: mcpOAuthService }),
-        skipAuth: true,
-        middlewares: [mcpEnabledGuard],
-        ipRateLimit: { limit: 30, windowMs: 5 * constants_1.Time.minutes.toMilliseconds },
-    },
+exports.OAuthController = OAuthController;
+OAuthController.routers = [
+    ...sharedEndpointRouters('/mcp-oauth'),
+    ...sharedEndpointRouters('/oauth'),
 ];
 __decorate([
     (0, decorators_1.Options)('/.well-known/oauth-authorization-server', {
@@ -135,7 +145,7 @@ __decorate([
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", void 0)
-], McpOAuthController.prototype, "metadataOptions", null);
+], OAuthController.prototype, "metadataOptions", null);
 __decorate([
     (0, decorators_1.Get)('/.well-known/oauth-authorization-server', {
         skipAuth: true,
@@ -145,9 +155,9 @@ __decorate([
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", void 0)
-], McpOAuthController.prototype, "metadata", null);
+], OAuthController.prototype, "metadata", null);
 __decorate([
-    (0, decorators_1.Options)('/.well-known/oauth-protected-resource/mcp-server/http', {
+    (0, decorators_1.Options)('/.well-known/oauth-protected-resource/*resourcePath', {
         skipAuth: true,
         usesTemplates: true,
         ipRateLimit: { limit: 100, windowMs: 5 * constants_1.Time.minutes.toMilliseconds },
@@ -155,19 +165,20 @@ __decorate([
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", void 0)
-], McpOAuthController.prototype, "protectedResourceMetadataOptions", null);
+], OAuthController.prototype, "protectedResourceMetadataOptions", null);
 __decorate([
-    (0, decorators_1.Get)('/.well-known/oauth-protected-resource/mcp-server/http', {
+    (0, decorators_1.Get)('/.well-known/oauth-protected-resource/*resourcePath', {
         skipAuth: true,
         usesTemplates: true,
         ipRateLimit: { limit: 100, windowMs: 5 * constants_1.Time.minutes.toMilliseconds },
     }),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, Object]),
-    __metadata("design:returntype", void 0)
-], McpOAuthController.prototype, "protectedResourceMetadata", null);
-exports.McpOAuthController = McpOAuthController = __decorate([
+    __metadata("design:returntype", Promise)
+], OAuthController.prototype, "protectedResourceMetadata", null);
+exports.OAuthController = OAuthController = __decorate([
     (0, decorators_1.RootLevelController)('/'),
-    __metadata("design:paramtypes", [url_service_1.UrlService])
-], McpOAuthController);
-//# sourceMappingURL=mcp.oauth.controller.js.map
+    __metadata("design:paramtypes", [url_service_1.UrlService,
+        protected_resource_registry_1.ProtectedResourceRegistry])
+], OAuthController);
+//# sourceMappingURL=oauth.controller.js.map

package/dist/modules/oauth-server/oauth.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.controller.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,8FAAmG;AACnG,4FAAuG;AACvG,wFAA6F;AAC7F,sFAAuF;AACvF,wDAA6C;AAC7C,wCAA2C;AAC3C,8CAAsC;AACtC,gDAA0F;AAC1F,gCAAoC;AAGpC,wFAAmF;AACnF,wDAAoD;AAEpD,iEAA4D;AAC5D,iDAAqE;AAErE,MAAM,kBAAkB,GAAG,cAAS,CAAC,GAAG,CAAC,yCAAkB,CAAC,CAAC;AAC7D,MAAM,YAAY,GAAG,cAAS,CAAC,GAAG,CAAC,qBAAY,CAAC,CAAC;AACjD,MAAM,MAAM,GAAG,cAAS,CAAC,GAAG,CAAC,uBAAM,CAAC,CAAC;AAcrC,MAAM,qBAAqB,GAAmB,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACvE,IAAI,MAAM,kBAAkB,CAAC,oBAAoB,EAAE,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,uBAAuB,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,wEAAwE,EAAE;YACrF,KAAK;SACL,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACpB,KAAK,EAAE,cAAc;YACrB,iBAAiB,EAAE,IAAA,kDAAmC,EAAC,KAAK,CAAC;SAC7D,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IACD,IAAI,EAAE,CAAC;AACR,CAAC,CAAC;AAKF,MAAM,cAAc,GAAG,IAAA,uCAAyB,EAAC;IAChD,YAAY,EAAE,kBAAkB,CAAC,YAAY;CAC7C,CAAW,CAAC;AACb,MAAM,eAAe,GAAG,IAAA,mCAAoB,EAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAW,CAAC;AACzF,MAAM,WAAW,GAAG,IAAA,uBAAY,EAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAW,CAAC;AAC7E,MAAM,YAAY,GAAG,IAAA,6BAAiB,EAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAW,CAAC;AAEnF,MAAM,qBAAqB,GAAG,CAAC,QAAiC,EAA0B,EAAE,CAAC;IAC5F;QACC,IAAI,EAAE,GAAG,QAAQ,WAAW;QAC5B,MAAM,EAAE,cAAc;QACtB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,CAAC,qBAAqB,CAAC;QACpC,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,EAAE;KACrE;IACD;QACC,IAAI,EAAE,GAAG,QAAQ,YAAY;QAC7B,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,EAAE;KACrE;IACD;QACC,IAAI,EAAE,GAAG,QAAQ,QAAQ;QACzB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,EAAE;KACrE;IACD;QACC,IAAI,EAAE,GAAG,QAAQ,SAAS;QAC1B,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,EAAE;KACrE;CACD,CAAC;AAGK,IAAM,eAAe,GAArB,MAAM,eAAe;IAC3B,YACkB,UAAsB,EACtB,gBAA2C;QAD3C,eAAU,GAAV,UAAU,CAAY;QACtB,qBAAgB,GAAhB,gBAAgB,CAA2B;IAC1D,CAAC;IAGI,cAAc,CAAC,GAAa;QAEnC,GAAG,CAAC,MAAM,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAC/C,GAAG,CAAC,MAAM,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;IAC5D,CAAC;IAYD,eAAe,CAAC,IAAa,EAAE,GAAa;QAC3C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACvB,CAAC;IAgBD,QAAQ,CAAC,IAAa,EAAE,GAAa;QACpC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG;YAChB,MAAM,EAAE,OAAO;YACf,sBAAsB,EAAE,GAAG,OAAO,sBAAsB;YACxD,cAAc,EAAE,GAAG,OAAO,kBAAkB;YAC5C,qBAAqB,EAAE,GAAG,OAAO,qBAAqB;YACtD,mBAAmB,EAAE,GAAG,OAAO,mBAAmB;YAClD,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC9D,qCAAqC,EAAE,CAAC,MAAM,EAAE,oBAAoB,EAAE,qBAAqB,CAAC;YAC5F,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE;SACtD,CAAC;QAEF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAOD,gCAAgC,CAAC,IAAa,EAAE,GAAa;QAC5D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACvB,CAAC;IAYK,AAAN,KAAK,CAAC,yBAAyB,CAAC,GAAY,EAAE,GAAa;QAC1D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAEzB,MAAM,YAAY,GACjB,GAAG;YACH,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC;gBACtC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;gBACnC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAChE,OAAO;QACR,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACrD,MAAM,QAAQ,GAA4B;YACzC,QAAQ,EAAE,QAAQ,CAAC,cAAc,EAAE;YACnC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;YACpC,qBAAqB,EAAE,CAAC,OAAO,CAAC;SAChC,CAAC;QAEF,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC7C,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;;AA7GW,0CAAe;AAcpB,uBAAO,GAA2B;IACxC,GAAG,qBAAqB,CAAC,YAAY,CAAC;IACtC,GAAG,qBAAqB,CAAC,QAAQ,CAAC;CAClC,AAHa,CAGZ;AAOF;IALC,IAAA,oBAAO,EAAC,yCAAyC,EAAE;QACnD,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,EAAE;KACtE,CAAC;;;;sDAID;AAgBD;IALC,IAAA,gBAAG,EAAC,yCAAyC,EAAE;QAC/C,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,EAAE;KACtE,CAAC;;;;+CAmBD;AAOD;IALC,IAAA,oBAAO,EAAC,qDAAqD,EAAE;QAC/D,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,EAAE;KACtE,CAAC;;;;uEAID;AAYK;IALL,IAAA,gBAAG,EAAC,qDAAqD,EAAE;QAC3D,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,EAAE;KACtE,CAAC;;;;gEA2BD;0BA7GW,eAAe;IAD3B,IAAA,gCAAmB,EAAC,GAAG,CAAC;qCAGM,wBAAU;QACJ,uDAAyB;GAHjD,eAAe,CA8G3B"}

package/dist/modules/oauth-server/oauth.errors.d.ts

@@ -0,0 +1,13 @@
+import { ServerError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
+import { AuthError } from '../../errors/response-errors/auth.error';
+export declare const buildOAuthClientLimitReachedMessage: (limit: number) => string;
+export declare class OAuthClientLimitReachedError extends ServerError {
+    readonly limit: number;
+    constructor(limit: number);
+}
+export declare class JWTVerificationError extends AuthError {
+    constructor();
+}
+export declare class AccessTokenNotFoundError extends AuthError {
+    constructor();
+}

package/dist/modules/oauth-server/oauth.errors.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessTokenNotFoundError = exports.JWTVerificationError = exports.OAuthClientLimitReachedError = exports.buildOAuthClientLimitReachedMessage = void 0;
+const errors_js_1 = require("@modelcontextprotocol/sdk/server/auth/errors.js");
+const auth_error_1 = require("../../errors/response-errors/auth.error");
+const buildOAuthClientLimitReachedMessage = (limit) => `This n8n instance has reached its maximum of ${limit} registered MCP clients. Ask an administrator to revoke unused clients or raise N8N_MCP_MAX_REGISTERED_CLIENTS.`;
+exports.buildOAuthClientLimitReachedMessage = buildOAuthClientLimitReachedMessage;
+class OAuthClientLimitReachedError extends errors_js_1.ServerError {
+    constructor(limit) {
+        super((0, exports.buildOAuthClientLimitReachedMessage)(limit));
+        this.name = 'OAuthClientLimitReachedError';
+        this.limit = limit;
+    }
+}
+exports.OAuthClientLimitReachedError = OAuthClientLimitReachedError;
+class JWTVerificationError extends auth_error_1.AuthError {
+    constructor() {
+        super('JWT Verification Failed');
+        this.name = 'JWTVerificationError';
+    }
+}
+exports.JWTVerificationError = JWTVerificationError;
+class AccessTokenNotFoundError extends auth_error_1.AuthError {
+    constructor() {
+        super('Access Token Not Found in Database');
+        this.name = 'AccessTokenNotFoundError';
+    }
+}
+exports.AccessTokenNotFoundError = AccessTokenNotFoundError;
+//# sourceMappingURL=oauth.errors.js.map

package/dist/modules/oauth-server/oauth.errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.errors.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth.errors.ts"],"names":[],"mappings":";;;AAAA,+EAA8E;AAE9E,oEAAgE;AAKzD,MAAM,mCAAmC,GAAG,CAAC,KAAa,EAAU,EAAE,CAC5E,gDAAgD,KAAK,iHAAiH,CAAC;AAD3J,QAAA,mCAAmC,uCACwH;AAQxK,MAAa,4BAA6B,SAAQ,uBAAW;IAG5D,YAAY,KAAa;QACxB,KAAK,CAAC,IAAA,2CAAmC,EAAC,KAAK,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,CAAC;CACD;AARD,oEAQC;AAED,MAAa,oBAAqB,SAAQ,sBAAS;IAClD;QACC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACpC,CAAC;CACD;AALD,oDAKC;AAED,MAAa,wBAAyB,SAAQ,sBAAS;IACtD;QACC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACxC,CAAC;CACD;AALD,4DAKC"}

package/dist/modules/{mcp/mcp-oauth.helpers.d.ts → oauth-server/oauth.helpers.d.ts}

@@ -1,4 +1,4 @@
-export declare class McpOAuthHelpers {
+export declare class OAuthHelpers {
     static buildSuccessRedirectUrl(redirectUri: string, code: string, state: string | null): string;
     static buildErrorRedirectUrl(redirectUri: string, error: string, errorDescription: string, state: string | null): string;
 }

package/dist/modules/{mcp/mcp-oauth.helpers.js → oauth-server/oauth.helpers.js}

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.McpOAuthHelpers = void 0;
-class McpOAuthHelpers {
+exports.OAuthHelpers = void 0;
+class OAuthHelpers {
     static buildSuccessRedirectUrl(redirectUri, code, state) {
         const targetUrl = new URL(redirectUri);
         targetUrl.searchParams.set('code', code);
@@ -20,5 +20,5 @@ class McpOAuthHelpers {
         return targetUrl.toString();
     }
 }
-exports.McpOAuthHelpers = McpOAuthHelpers;
-//# sourceMappingURL=mcp-oauth.helpers.js.map
+exports.OAuthHelpers = OAuthHelpers;
+//# sourceMappingURL=oauth.helpers.js.map

package/dist/modules/oauth-server/oauth.helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.helpers.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth.helpers.ts"],"names":[],"mappings":";;;AAGA,MAAa,YAAY;IAKxB,MAAM,CAAC,uBAAuB,CAAC,WAAmB,EAAE,IAAY,EAAE,KAAoB;QACrF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACvC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,EAAE,CAAC;YACX,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAMD,MAAM,CAAC,qBAAqB,CAC3B,WAAmB,EACnB,KAAa,EACb,gBAAwB,EACxB,KAAoB;QAEpB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACvC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3C,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;QAClE,IAAI,KAAK,EAAE,CAAC;YACX,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;CACD;AAhCD,oCAgCC"}

package/dist/modules/oauth-server/protected-resource-resolvers/utils.d.ts

@@ -0,0 +1,4 @@
+export declare const WORKFLOW_MCP_TRIGGER_SCOPES: string[];
+export declare function trimTrailingSlash(path: string): string;
+export declare function trimSlashes(path: string): string;
+export declare function resourceUrlToWebhookPath(resourceUrl: string, webhookBaseUrl: string): string | undefined;

package/dist/modules/oauth-server/protected-resource-resolvers/utils.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WORKFLOW_MCP_TRIGGER_SCOPES = void 0;
+exports.trimTrailingSlash = trimTrailingSlash;
+exports.trimSlashes = trimSlashes;
+exports.resourceUrlToWebhookPath = resourceUrlToWebhookPath;
+exports.WORKFLOW_MCP_TRIGGER_SCOPES = [];
+function trimTrailingSlash(path) {
+    if (path.endsWith('/')) {
+        path = path.slice(0, -1);
+    }
+    return path;
+}
+function trimSlashes(path) {
+    if (path.startsWith('/')) {
+        path = path.slice(1);
+    }
+    if (path.endsWith('/')) {
+        path = path.slice(0, -1);
+    }
+    return path;
+}
+function resourceUrlToWebhookPath(resourceUrl, webhookBaseUrl) {
+    let url;
+    try {
+        url = new URL(resourceUrl);
+    }
+    catch {
+        return undefined;
+    }
+    const base = new URL(webhookBaseUrl);
+    if (url.origin !== base.origin) {
+        return undefined;
+    }
+    const basePath = trimTrailingSlash(base.pathname);
+    if (basePath && !url.pathname.startsWith(`${basePath}/`)) {
+        return undefined;
+    }
+    return url.pathname.slice(basePath.length);
+}
+//# sourceMappingURL=utils.js.map

package/dist/modules/oauth-server/protected-resource-resolvers/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../../src/modules/oauth-server/protected-resource-resolvers/utils.ts"],"names":[],"mappings":";;;AAOA,8CAKC;AAED,kCAQC;AAYD,4DAsBC;AAnDY,QAAA,2BAA2B,GAAa,EAAE,CAAC;AAExD,SAAgB,iBAAiB,CAAC,IAAY;IAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAgB,WAAW,CAAC,IAAY;IACvC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAYD,SAAgB,wBAAwB,CACvC,WAAmB,EACnB,cAAsB;IAEtB,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC"}

package/dist/modules/oauth-server/protected-resource-resolvers/workflow-mcp-test-trigger-resource.resolver.d.ts

@@ -0,0 +1,28 @@
+import type { ProtectedResourceResolver } from '../../../services/protected-resource.registry';
+import { UrlService } from '../../../services/url.service';
+import { TestWebhookRegistrationsService } from '../../../webhooks/test-webhook-registrations.service';
+import { Logger } from '@n8n/backend-common';
+import { GlobalConfig } from '@n8n/config';
+export declare class WorkflowMcpTestTriggerResourceResolver implements ProtectedResourceResolver {
+    private readonly config;
+    private readonly registrations;
+    private readonly urlService;
+    private readonly logger;
+    constructor(config: GlobalConfig, registrations: TestWebhookRegistrationsService, urlService: UrlService, logger: Logger);
+    readonly id = "workflow-mcp-test-trigger";
+    readonly scopes: string[];
+    resolveByUrl(resourceUrl: string): Promise<{
+        id: string;
+        getResourceUrl: () => string;
+        getAudiences: () => string[];
+        scopes: string[];
+        displayName: string;
+    } | undefined>;
+    resolveByPath(pathname: string): Promise<{
+        id: string;
+        getResourceUrl: () => string;
+        getAudiences: () => string[];
+        scopes: string[];
+        displayName: string;
+    } | undefined>;
+}

package/dist/modules/oauth-server/protected-resource-resolvers/workflow-mcp-test-trigger-resource.resolver.js

@@ -0,0 +1,78 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkflowMcpTestTriggerResourceResolver = void 0;
+const constants_1 = require("../../../constants");
+const url_service_1 = require("../../../services/url.service");
+const test_webhook_registrations_service_1 = require("../../../webhooks/test-webhook-registrations.service");
+const backend_common_1 = require("@n8n/backend-common");
+const config_1 = require("@n8n/config");
+const di_1 = require("@n8n/di");
+const utils_1 = require("./utils");
+let WorkflowMcpTestTriggerResourceResolver = class WorkflowMcpTestTriggerResourceResolver {
+    constructor(config, registrations, urlService, logger) {
+        this.config = config;
+        this.registrations = registrations;
+        this.urlService = urlService;
+        this.logger = logger;
+        this.id = 'workflow-mcp-test-trigger';
+        this.scopes = utils_1.WORKFLOW_MCP_TRIGGER_SCOPES;
+    }
+    async resolveByUrl(resourceUrl) {
+        const pathname = (0, utils_1.resourceUrlToWebhookPath)(resourceUrl, this.urlService.getWebhookBaseUrl());
+        if (pathname === undefined) {
+            this.logger.debug(`Resource URL is not under the webhook base URL: ${resourceUrl}`);
+            return undefined;
+        }
+        return await this.resolveByPath(pathname);
+    }
+    async resolveByPath(pathname) {
+        if (!pathname.startsWith(`/${this.config.endpoints.mcpTest}/`)) {
+            return undefined;
+        }
+        const path = (0, utils_1.trimSlashes)(pathname.slice(this.config.endpoints.mcpTest.length + 1));
+        this.logger.debug(`Resolving workflow MCP test trigger resource for path: ${path}`);
+        const registration = await this.registrations.get(this.registrations.toKey({ httpMethod: 'POST', path }));
+        if (!registration) {
+            this.logger.debug(`No test webhook registration found for path: ${path}`);
+            return undefined;
+        }
+        const { workflowEntity, webhook } = registration;
+        const node = workflowEntity.nodes.find((n) => n.name === webhook.node);
+        if (!node) {
+            this.logger.debug(`No node found with name ${webhook.node} in test registration for workflow with ID: ${workflowEntity.id}`);
+            return undefined;
+        }
+        if (node.type === constants_1.MCP_TRIGGER_NODE_TYPE &&
+            !node.disabled &&
+            node.parameters.authentication === 'n8nOAuth2') {
+            const resourceUrl = `${(0, utils_1.trimTrailingSlash)(this.urlService.getWebhookBaseUrl())}/${this.config.endpoints.mcpTest}/${path}`;
+            return {
+                id: 'workflow-mcp-test:' + workflowEntity.id,
+                getResourceUrl: () => resourceUrl,
+                getAudiences: () => [resourceUrl],
+                scopes: utils_1.WORKFLOW_MCP_TRIGGER_SCOPES,
+                displayName: workflowEntity.name,
+            };
+        }
+        this.logger.debug(`Node with name ${webhook.node} in test registration for workflow with ID: ${workflowEntity.id} is not an enabled MCP trigger with n8nOAuth2 authentication`);
+        return undefined;
+    }
+};
+exports.WorkflowMcpTestTriggerResourceResolver = WorkflowMcpTestTriggerResourceResolver;
+exports.WorkflowMcpTestTriggerResourceResolver = WorkflowMcpTestTriggerResourceResolver = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [config_1.GlobalConfig,
+        test_webhook_registrations_service_1.TestWebhookRegistrationsService,
+        url_service_1.UrlService,
+        backend_common_1.Logger])
+], WorkflowMcpTestTriggerResourceResolver);
+//# sourceMappingURL=workflow-mcp-test-trigger-resource.resolver.js.map

package/dist/modules/oauth-server/protected-resource-resolvers/workflow-mcp-test-trigger-resource.resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-mcp-test-trigger-resource.resolver.js","sourceRoot":"","sources":["../../../../src/modules/oauth-server/protected-resource-resolvers/workflow-mcp-test-trigger-resource.resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAoD;AAEpD,wDAAoD;AACpD,sGAAgG;AAChG,wDAA6C;AAC7C,wCAA2C;AAC3C,gCAAkC;AAElC,mCAKiB;AAGV,IAAM,sCAAsC,GAA5C,MAAM,sCAAsC;IAClD,YACkB,MAAoB,EACpB,aAA8C,EAC9C,UAAsB,EACtB,MAAc;QAHd,WAAM,GAAN,MAAM,CAAc;QACpB,kBAAa,GAAb,aAAa,CAAiC;QAC9C,eAAU,GAAV,UAAU,CAAY;QACtB,WAAM,GAAN,MAAM,CAAQ;QAGvB,OAAE,GAAG,2BAA2B,CAAC;QACjC,WAAM,GAAG,mCAA2B,CAAC;IAH3C,CAAC;IAKJ,KAAK,CAAC,YAAY,CAAC,WAAmB;QACrC,MAAM,QAAQ,GAAG,IAAA,gCAAwB,EAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC5F,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,WAAW,EAAE,CAAC,CAAC;YACpF,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB;QACnC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YAEhE,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,mBAAW,EAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAEnF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0DAA0D,IAAI,EAAE,CAAC,CAAC;QAMpF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAChD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CACtD,CAAC;QAEF,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,IAAI,EAAE,CAAC,CAAC;YAC1E,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC;QAEjD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAEvE,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,2BAA2B,OAAO,CAAC,IAAI,+CAA+C,cAAc,CAAC,EAAE,EAAE,CACzG,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,IACC,IAAI,CAAC,IAAI,KAAK,iCAAqB;YACnC,CAAC,IAAI,CAAC,QAAQ;YACd,IAAI,CAAC,UAAU,CAAC,cAAc,KAAK,WAAW,EAC7C,CAAC;YACF,MAAM,WAAW,GAAG,GAAG,IAAA,yBAAiB,EAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YACzH,OAAO;gBACN,EAAE,EAAE,oBAAoB,GAAG,cAAc,CAAC,EAAE;gBAC5C,cAAc,EAAE,GAAG,EAAE,CAAC,WAAW;gBACjC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC;gBACjC,MAAM,EAAE,mCAA2B;gBACnC,WAAW,EAAE,cAAc,CAAC,IAAI;aAChC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,kBAAkB,OAAO,CAAC,IAAI,+CAA+C,cAAc,CAAC,EAAE,8DAA8D,CAC5J,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;CACD,CAAA;AA1EY,wFAAsC;iDAAtC,sCAAsC;IADlD,IAAA,YAAO,GAAE;qCAGiB,qBAAY;QACL,oEAA+B;QAClC,wBAAU;QACd,uBAAM;GALpB,sCAAsC,CA0ElD"}

package/dist/modules/oauth-server/protected-resource-resolvers/workflow-mcp-trigger-resource.resolver.d.ts

@@ -0,0 +1,30 @@
+import type { ProtectedResourceResolver } from '../../../services/protected-resource.registry';
+import { UrlService } from '../../../services/url.service';
+import { WebhookService } from '../../../webhooks/webhook.service';
+import { Logger } from '@n8n/backend-common';
+import { GlobalConfig } from '@n8n/config';
+import { WorkflowRepository } from '@n8n/db';
+export declare class WorkflowMcpTriggerResourceResolver implements ProtectedResourceResolver {
+    private readonly config;
+    private readonly webhookService;
+    private readonly workflowRepository;
+    private readonly urlService;
+    private readonly logger;
+    constructor(config: GlobalConfig, webhookService: WebhookService, workflowRepository: WorkflowRepository, urlService: UrlService, logger: Logger);
+    readonly id = "workflow-mcp-trigger";
+    readonly scopes: string[];
+    resolveByUrl(resourceUrl: string): Promise<{
+        id: string;
+        getResourceUrl: () => string;
+        getAudiences: () => string[];
+        scopes: string[];
+        displayName: string;
+    } | undefined>;
+    resolveByPath(pathname: string): Promise<{
+        id: string;
+        getResourceUrl: () => string;
+        getAudiences: () => string[];
+        scopes: string[];
+        displayName: string;
+    } | undefined>;
+}