n8n 2.26.6 → 2.27.1

package/dist/modules/{mcp/mcp-oauth-token.service.js → oauth-server/oauth-token.service.js}

@@ -9,7 +9,8 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.McpOAuthTokenService = void 0;
+exports.OAuthTokenService = void 0;
+const errors_js_1 = require("@modelcontextprotocol/sdk/server/auth/errors.js");
 const backend_common_1 = require("@n8n/backend-common");
 const constants_1 = require("@n8n/constants");
 const db_1 = require("@n8n/db");
@@ -21,31 +22,28 @@ const oauth_access_token_entity_1 = require("./database/entities/oauth-access-to
 const oauth_refresh_token_entity_1 = require("./database/entities/oauth-refresh-token.entity");
 const oauth_access_token_repository_1 = require("./database/repositories/oauth-access-token.repository");
 const oauth_refresh_token_repository_1 = require("./database/repositories/oauth-refresh-token.repository");
-const mcp_errors_1 = require("./mcp.errors");
+const oauth_errors_1 = require("./oauth.errors");
 const jwt_service_1 = require("../../services/jwt.service");
-const url_service_1 = require("../../services/url.service");
-let McpOAuthTokenService = class McpOAuthTokenService {
-    constructor(logger, jwtService, userRepository, accessTokenRepository, refreshTokenRepository, urlService) {
+const protected_resource_registry_1 = require("../../services/protected-resource.registry");
+let OAuthTokenService = class OAuthTokenService {
+    constructor(logger, jwtService, userRepository, accessTokenRepository, refreshTokenRepository, resourceRegistry) {
         this.logger = logger;
         this.jwtService = jwtService;
         this.userRepository = userRepository;
         this.accessTokenRepository = accessTokenRepository;
         this.refreshTokenRepository = refreshTokenRepository;
-        this.urlService = urlService;
-        this.LEGACY_MCP_AUDIENCE = 'mcp-server-api';
-        this.MCP_RESOURCE_PATH = '/mcp-server/http';
+        this.resourceRegistry = resourceRegistry;
         this.ACCESS_TOKEN_EXPIRY_SECONDS = 1 * constants_1.Time.hours.toSeconds;
         this.REFRESH_TOKEN_EXPIRY_MS = 30 * constants_1.Time.days.toMilliseconds;
     }
-    getCanonicalResourceUrl() {
-        const baseUrl = this.urlService.getInstanceBaseUrl().replace(/\/$/, '');
-        return `${baseUrl}${this.MCP_RESOURCE_PATH}`;
-    }
     getAccessTokenExpirySeconds() {
         return this.ACCESS_TOKEN_EXPIRY_SECONDS;
     }
     generateTokenPair(userId, clientId, resource) {
-        const audience = resource ?? this.getCanonicalResourceUrl();
+        const audience = resource ?? this.resourceRegistry.getDefaultResource()?.getResourceUrl();
+        if (!audience) {
+            throw new n8n_workflow_1.UnexpectedError('Cannot mint an OAuth access token: no resource requested and no default protected resource is registered');
+        }
         const accessToken = this.jwtService.sign({
             sub: userId,
             aud: audience,
@@ -85,7 +83,7 @@ let McpOAuthTokenService = class McpOAuthTokenService {
                 },
             });
             if (!refreshTokenRecord) {
-                throw new Error('Invalid refresh token');
+                throw new errors_js_1.InvalidGrantError('Invalid refresh token');
             }
             const result = await trx.delete(oauth_refresh_token_entity_1.RefreshToken, {
                 token: refreshToken,
@@ -94,7 +92,7 @@ let McpOAuthTokenService = class McpOAuthTokenService {
             });
             const numAffected = result.affected ?? 0;
             if (numAffected < 1) {
-                throw new Error('Invalid refresh token');
+                throw new errors_js_1.InvalidGrantError('Invalid refresh token');
             }
             const { accessToken, refreshToken: newRefreshToken } = this.generateTokenPair(refreshTokenRecord.userId, clientId, resource);
             await trx.insert(oauth_access_token_entity_1.AccessToken, {
@@ -123,22 +121,22 @@ let McpOAuthTokenService = class McpOAuthTokenService {
     async verifyAccessToken(token, expectedAudience) {
         let decoded;
         try {
-            const allowedAudiences = this.getAllowedAudiences(expectedAudience);
+            const allowedAudiences = await this.getAllowedAudiences(expectedAudience);
             decoded = this.verifyJwtWithAllowedAudiences(token, allowedAudiences);
         }
         catch (error) {
-            throw new mcp_errors_1.JWTVerificationError();
+            throw new oauth_errors_1.JWTVerificationError();
         }
         const clientId = this.getStringClaim(decoded, 'client_id');
         const userId = this.getStringClaim(decoded, 'sub');
         if (!clientId || !userId) {
-            throw new mcp_errors_1.JWTVerificationError();
+            throw new oauth_errors_1.JWTVerificationError();
         }
         const accessTokenRecord = await this.accessTokenRepository.findOne({
             where: { token },
         });
         if (!accessTokenRecord) {
-            throw new mcp_errors_1.AccessTokenNotFoundError();
+            throw new oauth_errors_1.AccessTokenNotFoundError();
         }
         return {
             token,
@@ -169,9 +167,9 @@ let McpOAuthTokenService = class McpOAuthTokenService {
         }
         catch (error) {
             const errorForSure = (0, n8n_workflow_1.ensureError)(error);
-            const reason = errorForSure instanceof mcp_errors_1.JWTVerificationError
+            const reason = errorForSure instanceof oauth_errors_1.JWTVerificationError
                 ? 'invalid_token'
-                : errorForSure instanceof mcp_errors_1.AccessTokenNotFoundError
+                : errorForSure instanceof oauth_errors_1.AccessTokenNotFoundError
                     ? 'token_not_found_in_db'
                     : 'unknown_error';
             return {
@@ -206,11 +204,12 @@ let McpOAuthTokenService = class McpOAuthTokenService {
         }
         return revoked;
     }
-    getAllowedAudiences(expectedAudience) {
-        if (expectedAudience && expectedAudience !== this.getCanonicalResourceUrl()) {
-            return [expectedAudience, this.getCanonicalResourceUrl(), this.LEGACY_MCP_AUDIENCE];
+    async getAllowedAudiences(expectedAudience) {
+        if (expectedAudience) {
+            const resource = await this.resourceRegistry.getByResourceUrl(expectedAudience);
+            return resource ? resource.getAudiences() : [expectedAudience];
         }
-        return [this.getCanonicalResourceUrl(), this.LEGACY_MCP_AUDIENCE];
+        return this.resourceRegistry.getAllAudiences();
     }
     verifyJwtWithAllowedAudiences(token, audiences) {
         try {
@@ -237,14 +236,14 @@ let McpOAuthTokenService = class McpOAuthTokenService {
         return typeof claimValue === 'string' ? claimValue : null;
     }
 };
-exports.McpOAuthTokenService = McpOAuthTokenService;
-exports.McpOAuthTokenService = McpOAuthTokenService = __decorate([
+exports.OAuthTokenService = OAuthTokenService;
+exports.OAuthTokenService = OAuthTokenService = __decorate([
     (0, di_1.Service)(),
     __metadata("design:paramtypes", [backend_common_1.Logger,
         jwt_service_1.JwtService,
         db_1.UserRepository,
         oauth_access_token_repository_1.AccessTokenRepository,
         oauth_refresh_token_repository_1.RefreshTokenRepository,
-        url_service_1.UrlService])
-], McpOAuthTokenService);
-//# sourceMappingURL=mcp-oauth-token.service.js.map
+        protected_resource_registry_1.ProtectedResourceRegistry])
+], OAuthTokenService);
+//# sourceMappingURL=oauth-token.service.js.map

package/dist/modules/oauth-server/oauth-token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-token.service.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+EAAoF;AAGpF,wDAA6C;AAC7C,8CAAsC;AACtC,gCAA0D;AAC1D,gCAAkC;AAClC,0CAA+C;AAC/C,+CAA4D;AAC5D,6CAAsD;AAEtD,6FAA4E;AAC5E,+FAA8E;AAC9E,yGAA8F;AAC9F,2GAAgG;AAChG,iDAAgF;AAEhF,wDAAoD;AAKpD,wFAAmF;AAW5E,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAI7B,YACkB,MAAc,EACd,UAAsB,EACtB,cAA8B,EAC9B,qBAA4C,EAC5C,sBAA8C,EAC9C,gBAA2C;QAL3C,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAY;QACtB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,qBAAgB,GAAhB,gBAAgB,CAA2B;QAT5C,gCAA2B,GAAG,CAAC,GAAG,gBAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QACvD,4BAAuB,GAAG,EAAE,GAAG,gBAAI,CAAC,IAAI,CAAC,cAAc,CAAC;IAStE,CAAC;IAEJ,2BAA2B;QAC1B,OAAO,IAAI,CAAC,2BAA2B,CAAC;IACzC,CAAC;IAED,iBAAiB,CAChB,MAAc,EACd,QAAgB,EAChB,QAAiB;QAIjB,MAAM,QAAQ,GAAG,QAAQ,IAAI,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,EAAE,cAAc,EAAE,CAAC;QAC1F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,8BAAe,CACxB,0GAA0G,CAC1G,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACxC,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,QAAQ;YACb,SAAS,EAAE,QAAQ;YACnB,GAAG,EAAE,IAAA,wBAAU,GAAE;YACjB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,2BAA2B;YACrE,IAAI,EAAE;gBACL,OAAO,EAAE,IAAI;aACb;SACD,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAErD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,aAAa,CAClB,WAAmB,EACnB,YAAoB,EACpB,QAAgB,EAChB,MAAc;QAEd,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE;YACjF,MAAM,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE;gBAClE,KAAK,EAAE,WAAW;gBAClB,QAAQ;gBACR,MAAM;aACN,CAAC,CAAC;YAEH,MAAM,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE;gBACnE,KAAK,EAAE,YAAY;gBACnB,QAAQ;gBACR,MAAM;gBACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,uBAAuB;aACpD,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,6BAA6B,CAClC,YAAoB,EACpB,QAAgB,EAChB,QAAiB;QAEjB,OAAO,MAAM,IAAA,oBAAe,EAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,MAAM,kBAAkB,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,yCAAY,EAAE;gBAC1D,KAAK,EAAE;oBACN,KAAK,EAAE,YAAY;oBACnB,QAAQ;iBACR;aACD,CAAC,CAAC;YAIH,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACzB,MAAM,IAAI,6BAAiB,CAAC,uBAAuB,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,yCAAY,EAAE;gBAC7C,KAAK,EAAE,YAAY;gBACnB,QAAQ;gBACR,SAAS,EAAE,IAAA,yBAAe,EAAC,GAAG,CAAC;aAC/B,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;YACzC,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,6BAAiB,CAAC,uBAAuB,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAC5E,kBAAkB,CAAC,MAAM,EACzB,QAAQ,EACR,QAAQ,CACR,CAAC;YAEF,MAAM,GAAG,CAAC,MAAM,CAAC,uCAAW,EAAE;gBAC7B,KAAK,EAAE,WAAW;gBAClB,QAAQ;gBACR,MAAM,EAAE,kBAAkB,CAAC,MAAM;aACjC,CAAC,CAAC;YAEH,MAAM,GAAG,CAAC,MAAM,CAAC,yCAAY,EAAE;gBAC9B,KAAK,EAAE,eAAe;gBACtB,QAAQ;gBACR,MAAM,EAAE,kBAAkB,CAAC,MAAM;gBACjC,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,uBAAuB;aAC7C,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;gBACrE,QAAQ;gBACR,MAAM,EAAE,kBAAkB,CAAC,MAAM;aACjC,CAAC,CAAC;YAEH,OAAO;gBACN,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,IAAI,CAAC,2BAA2B;gBAC5C,aAAa,EAAE,eAAe;aAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,gBAAyB;QAC/D,IAAI,OAAgB,CAAC;QAErB,IAAI,CAAC;YACJ,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;YAC1E,OAAO,GAAG,IAAI,CAAC,6BAA6B,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,mCAAoB,EAAE,CAAC;QAClC,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,mCAAoB,EAAE,CAAC;QAClC,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;YAClE,KAAK,EAAE,EAAE,KAAK,EAAE;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxB,MAAM,IAAI,uCAAwB,EAAE,CAAC;QACtC,CAAC;QAED,OAAO;YACN,KAAK;YACL,QAAQ;YACR,MAAM,EAAE,EAAE;YACV,KAAK,EAAE;gBACN,MAAM;aACN;SACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,gBAAyB;QACpE,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;YAEvE,MAAM,MAAM,GACX,QAAQ,CAAC,KAAK,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;gBACnD,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAC/C,CAAC,CAAC,IAAI,CAAC;YACT,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC;YAC5F,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;gBAC9C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;gBACrB,SAAS,EAAE,CAAC,MAAM,CAAC;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC;YAClF,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,IAAA,0BAAW,EAAC,KAAK,CAAC,CAAC;YACxC,MAAM,MAAM,GACX,YAAY,YAAY,mCAAoB;gBAC3C,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,YAAY,YAAY,uCAAwB;oBACjD,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,eAAe,CAAC;YACrB,OAAO;gBACN,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE;oBACR,MAAM;oBACN,SAAS,EAAE,OAAO;oBAClB,aAAa,EAAE,YAAY,CAAC,OAAO;iBACnC;aACD,CAAC;QACH,CAAC;IACF,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,QAAgB;QACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;YACtD,KAAK;YACL,QAAQ;SACR,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,QAAgB;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC;YACvD,KAAK;YACL,QAAQ;SACR,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAWO,KAAK,CAAC,mBAAmB,CAAC,gBAAyB;QAC1D,IAAI,gBAAgB,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;YAChF,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAChE,CAAC;QAKD,OAAO,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,CAAC;IAChD,CAAC;IAIO,6BAA6B,CAAC,KAAa,EAAE,SAAmB;QACvE,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE;gBACpC,QAAQ,EAAE,SAAkC;aAC5C,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAEhB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACJ,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACpD,CAAC;gBAAC,MAAM,CAAC;oBACR,SAAS;gBACV,CAAC;YACF,CAAC;YAED,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAEO,cAAc,CAAC,OAAgB,EAAE,KAAa;QACrD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,UAAU,GAAI,OAAmC,CAAC,KAAK,CAAC,CAAC;QAC/D,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;CACD,CAAA;AA/RY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,YAAO,GAAE;qCAMiB,uBAAM;QACF,wBAAU;QACN,mBAAc;QACP,qDAAqB;QACpB,uDAAsB;QAC5B,uDAAyB;GAVjD,iBAAiB,CA+R7B"}

package/dist/modules/{mcp/mcp.oauth.controller.d.ts → oauth-server/oauth.controller.d.ts}

@@ -1,13 +1,15 @@
 import { StaticRouterMetadata } from '@n8n/decorators';
 import type { Response, Request } from 'express';
+import { ProtectedResourceRegistry } from '../../services/protected-resource.registry';
 import { UrlService } from '../../services/url.service';
-export declare class McpOAuthController {
+export declare class OAuthController {
     private readonly urlService;
-    constructor(urlService: UrlService);
+    private readonly resourceRegistry;
+    constructor(urlService: UrlService, resourceRegistry: ProtectedResourceRegistry);
     private setCorsHeaders;
     static routers: StaticRouterMetadata[];
     metadataOptions(_req: Request, res: Response): void;
     metadata(_req: Request, res: Response): void;
     protectedResourceMetadataOptions(_req: Request, res: Response): void;
-    protectedResourceMetadata(_req: Request, res: Response): void;
+    protectedResourceMetadata(req: Request, res: Response): Promise<void>;
 }

package/dist/modules/{mcp/mcp.oauth.controller.js → oauth-server/oauth.controller.js}

@@ -9,7 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.McpOAuthController = void 0;
+exports.OAuthController = void 0;
 const authorize_js_1 = require("@modelcontextprotocol/sdk/server/auth/handlers/authorize.js");
 const register_js_1 = require("@modelcontextprotocol/sdk/server/auth/handlers/register.js");
 const revoke_js_1 = require("@modelcontextprotocol/sdk/server/auth/handlers/revoke.js");
@@ -19,40 +19,67 @@ const config_1 = require("@n8n/config");
 const constants_1 = require("@n8n/constants");
 const decorators_1 = require("@n8n/decorators");
 const di_1 = require("@n8n/di");
+const protected_resource_registry_1 = require("../../services/protected-resource.registry");
 const url_service_1 = require("../../services/url.service");
-const mcp_oauth_service_1 = require("./mcp-oauth-service");
-const mcp_constants_1 = require("./mcp.constants");
-const mcp_errors_1 = require("./mcp.errors");
-const mcp_settings_service_1 = require("./mcp.settings.service");
-const mcpOAuthService = di_1.Container.get(mcp_oauth_service_1.McpOAuthService);
-const mcpSettingsService = di_1.Container.get(mcp_settings_service_1.McpSettingsService);
+const oauth_server_config_1 = require("./oauth-server.config");
+const oauth_server_service_1 = require("./oauth-server.service");
+const oauth_errors_1 = require("./oauth.errors");
+const oauthServerService = di_1.Container.get(oauth_server_service_1.OAuthServerService);
 const globalConfig = di_1.Container.get(config_1.GlobalConfig);
+const oauthServerConfig = di_1.Container.get(oauth_server_config_1.OAuthServerConfig);
 const logger = di_1.Container.get(backend_common_1.Logger);
-const mcpEnabledGuard = async (_req, res, next) => {
-    const enabled = await mcpSettingsService.getEnabled();
-    if (!enabled) {
-        res.status(403).json({ error: mcp_constants_1.MCP_ACCESS_DISABLED_ERROR_MESSAGE });
-        return;
-    }
-    next();
-};
-const mcpClientLimitGuard = async (_req, res, next) => {
-    if (await mcpOAuthService.isClientLimitReached()) {
+const oauthClientLimitGuard = async (_req, res, next) => {
+    if (await oauthServerService.isClientLimitReached()) {
         const limit = globalConfig.endpoints.mcpMaxRegisteredClients;
-        logger.warn('MCP OAuth client registration rejected: instance limit reached (pre-check)', {
+        logger.warn('OAuth client registration rejected: instance limit reached (pre-check)', {
             limit,
         });
         res.status(503).json({
             error: 'server_error',
-            error_description: (0, mcp_errors_1.buildMcpClientLimitReachedMessage)(limit),
+            error_description: (0, oauth_errors_1.buildOAuthClientLimitReachedMessage)(limit),
         });
         return;
     }
     next();
 };
-let McpOAuthController = class McpOAuthController {
-    constructor(urlService) {
+const registerRouter = (0, register_js_1.clientRegistrationHandler)({
+    clientsStore: oauthServerService.clientsStore,
+});
+const authorizeRouter = (0, authorize_js_1.authorizationHandler)({ provider: oauthServerService });
+const tokenRouter = (0, token_js_1.tokenHandler)({ provider: oauthServerService });
+const revokeRouter = (0, revoke_js_1.revocationHandler)({ provider: oauthServerService });
+const sharedEndpointRouters = (basePath) => [
+    {
+        path: `${basePath}/register`,
+        router: registerRouter,
+        skipAuth: true,
+        middlewares: [oauthClientLimitGuard],
+        ipRateLimit: (0, decorators_1.createIpRateLimit)(oauthServerConfig.rateLimitRegister, 5 * constants_1.Time.minutes.toMilliseconds),
+    },
+    {
+        path: `${basePath}/authorize`,
+        router: authorizeRouter,
+        skipAuth: true,
+        ipRateLimit: (0, decorators_1.createIpRateLimit)(oauthServerConfig.rateLimitAuthorize, 5 * constants_1.Time.minutes.toMilliseconds),
+    },
+    {
+        path: `${basePath}/token`,
+        router: tokenRouter,
+        skipAuth: true,
+        ipRateLimit: (0, decorators_1.createIpRateLimit)(oauthServerConfig.rateLimitToken, 5 * constants_1.Time.minutes.toMilliseconds),
+    },
+    {
+        path: `${basePath}/revoke`,
+        router: revokeRouter,
+        skipAuth: true,
+        ipRateLimit: (0, decorators_1.createIpRateLimit)(oauthServerConfig.rateLimitRevoke, 5 * constants_1.Time.minutes.toMilliseconds),
+    },
+];
+const wellKnownIpRateLimit = (0, decorators_1.createIpRateLimit)(oauthServerConfig.rateLimitWellKnown, 5 * constants_1.Time.minutes.toMilliseconds);
+let OAuthController = class OAuthController {
+    constructor(urlService, resourceRegistry) {
         this.urlService = urlService;
+        this.resourceRegistry = resourceRegistry;
     }
     setCorsHeaders(res) {
         res.header('Access-Control-Allow-Origin', '*');
@@ -76,7 +103,7 @@ let McpOAuthController = class McpOAuthController {
             grant_types_supported: ['authorization_code', 'refresh_token'],
             token_endpoint_auth_methods_supported: ['none', 'client_secret_post', 'client_secret_basic'],
             code_challenge_methods_supported: ['S256'],
-            scopes_supported: mcp_oauth_service_1.SUPPORTED_SCOPES,
+            scopes_supported: this.resourceRegistry.getAllScopes(),
         };
         res.json(metadata);
     }
@@ -84,90 +111,77 @@ let McpOAuthController = class McpOAuthController {
         this.setCorsHeaders(res);
         res.status(204).end();
     }
-    protectedResourceMetadata(_req, res) {
+    async protectedResourceMetadata(req, res) {
         this.setCorsHeaders(res);
+        const resourcePath = '/' +
+            (Array.isArray(req.params.resourcePath)
+                ? req.params.resourcePath.join('/')
+                : req.params.resourcePath);
+        const resource = await this.resourceRegistry.getByResourcePath(resourcePath);
+        if (!resource) {
+            res.status(404).json({ message: 'Unknown protected resource' });
+            return;
+        }
         const baseUrl = this.urlService.getInstanceBaseUrl();
-        res.json({
-            resource: `${baseUrl}/mcp-server/http`,
+        const metadata = {
+            resource: resource.getResourceUrl(),
             bearer_methods_supported: ['header'],
             authorization_servers: [baseUrl],
-            scopes_supported: mcp_oauth_service_1.SUPPORTED_SCOPES,
-        });
+        };
+        if (resource.scopes.length > 0) {
+            metadata.scopes_supported = resource.scopes;
+        }
+        res.json(metadata);
     }
 };
-exports.McpOAuthController = McpOAuthController;
-McpOAuthController.routers = [
-    {
-        path: '/mcp-oauth/register',
-        router: (0, register_js_1.clientRegistrationHandler)({ clientsStore: mcpOAuthService.clientsStore }),
-        skipAuth: true,
-        middlewares: [mcpEnabledGuard, mcpClientLimitGuard],
-        ipRateLimit: { limit: 10, windowMs: 5 * constants_1.Time.minutes.toMilliseconds },
-    },
-    {
-        path: '/mcp-oauth/authorize',
-        router: (0, authorize_js_1.authorizationHandler)({ provider: mcpOAuthService }),
-        skipAuth: true,
-        middlewares: [mcpEnabledGuard],
-        ipRateLimit: { limit: 50, windowMs: 5 * constants_1.Time.minutes.toMilliseconds },
-    },
-    {
-        path: '/mcp-oauth/token',
-        router: (0, token_js_1.tokenHandler)({ provider: mcpOAuthService }),
-        skipAuth: true,
-        middlewares: [mcpEnabledGuard],
-        ipRateLimit: { limit: 20, windowMs: 5 * constants_1.Time.minutes.toMilliseconds },
-    },
-    {
-        path: '/mcp-oauth/revoke',
-        router: (0, revoke_js_1.revocationHandler)({ provider: mcpOAuthService }),
-        skipAuth: true,
-        middlewares: [mcpEnabledGuard],
-        ipRateLimit: { limit: 30, windowMs: 5 * constants_1.Time.minutes.toMilliseconds },
-    },
+exports.OAuthController = OAuthController;
+OAuthController.routers = [
+    ...sharedEndpointRouters('/mcp-oauth'),
+    ...sharedEndpointRouters('/oauth'),
 ];
 __decorate([
     (0, decorators_1.Options)('/.well-known/oauth-authorization-server', {
         skipAuth: true,
         usesTemplates: true,
-        ipRateLimit: { limit: 100, windowMs: 5 * constants_1.Time.minutes.toMilliseconds },
+        ipRateLimit: wellKnownIpRateLimit,
     }),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", void 0)
-], McpOAuthController.prototype, "metadataOptions", null);
+], OAuthController.prototype, "metadataOptions", null);
 __decorate([
     (0, decorators_1.Get)('/.well-known/oauth-authorization-server', {
         skipAuth: true,
         usesTemplates: true,
-        ipRateLimit: { limit: 100, windowMs: 5 * constants_1.Time.minutes.toMilliseconds },
+        ipRateLimit: wellKnownIpRateLimit,
     }),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", void 0)
-], McpOAuthController.prototype, "metadata", null);
+], OAuthController.prototype, "metadata", null);
 __decorate([
-    (0, decorators_1.Options)('/.well-known/oauth-protected-resource/mcp-server/http', {
+    (0, decorators_1.Options)('/.well-known/oauth-protected-resource/*resourcePath', {
         skipAuth: true,
         usesTemplates: true,
-        ipRateLimit: { limit: 100, windowMs: 5 * constants_1.Time.minutes.toMilliseconds },
+        ipRateLimit: wellKnownIpRateLimit,
     }),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", void 0)
-], McpOAuthController.prototype, "protectedResourceMetadataOptions", null);
+], OAuthController.prototype, "protectedResourceMetadataOptions", null);
 __decorate([
-    (0, decorators_1.Get)('/.well-known/oauth-protected-resource/mcp-server/http', {
+    (0, decorators_1.Get)('/.well-known/oauth-protected-resource/*resourcePath', {
         skipAuth: true,
         usesTemplates: true,
-        ipRateLimit: { limit: 100, windowMs: 5 * constants_1.Time.minutes.toMilliseconds },
+        ipRateLimit: wellKnownIpRateLimit,
     }),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, Object]),
-    __metadata("design:returntype", void 0)
-], McpOAuthController.prototype, "protectedResourceMetadata", null);
-exports.McpOAuthController = McpOAuthController = __decorate([
+    __metadata("design:returntype", Promise)
+], OAuthController.prototype, "protectedResourceMetadata", null);
+exports.OAuthController = OAuthController = __decorate([
     (0, decorators_1.RootLevelController)('/'),
-    __metadata("design:paramtypes", [url_service_1.UrlService])
-], McpOAuthController);
-//# sourceMappingURL=mcp.oauth.controller.js.map
+    __metadata("design:paramtypes", [url_service_1.UrlService,
+        protected_resource_registry_1.ProtectedResourceRegistry])
+], OAuthController);
+//# sourceMappingURL=oauth.controller.js.map

package/dist/modules/oauth-server/oauth.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.controller.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,8FAAmG;AACnG,4FAAuG;AACvG,wFAA6F;AAC7F,sFAAuF;AACvF,wDAA6C;AAC7C,wCAA2C;AAC3C,8CAAsC;AACtC,gDAMyB;AACzB,gCAAoC;AAGpC,wFAAmF;AACnF,wDAAoD;AAEpD,+DAA0D;AAC1D,iEAA4D;AAC5D,iDAAqE;AAErE,MAAM,kBAAkB,GAAG,cAAS,CAAC,GAAG,CAAC,yCAAkB,CAAC,CAAC;AAC7D,MAAM,YAAY,GAAG,cAAS,CAAC,GAAG,CAAC,qBAAY,CAAC,CAAC;AACjD,MAAM,iBAAiB,GAAG,cAAS,CAAC,GAAG,CAAC,uCAAiB,CAAC,CAAC;AAC3D,MAAM,MAAM,GAAG,cAAS,CAAC,GAAG,CAAC,uBAAM,CAAC,CAAC;AAcrC,MAAM,qBAAqB,GAAmB,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACvE,IAAI,MAAM,kBAAkB,CAAC,oBAAoB,EAAE,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,uBAAuB,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,wEAAwE,EAAE;YACrF,KAAK;SACL,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACpB,KAAK,EAAE,cAAc;YACrB,iBAAiB,EAAE,IAAA,kDAAmC,EAAC,KAAK,CAAC;SAC7D,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IACD,IAAI,EAAE,CAAC;AACR,CAAC,CAAC;AAKF,MAAM,cAAc,GAAG,IAAA,uCAAyB,EAAC;IAChD,YAAY,EAAE,kBAAkB,CAAC,YAAY;CAC7C,CAAW,CAAC;AACb,MAAM,eAAe,GAAG,IAAA,mCAAoB,EAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAW,CAAC;AACzF,MAAM,WAAW,GAAG,IAAA,uBAAY,EAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAW,CAAC;AAC7E,MAAM,YAAY,GAAG,IAAA,6BAAiB,EAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAW,CAAC;AAEnF,MAAM,qBAAqB,GAAG,CAAC,QAAiC,EAA0B,EAAE,CAAC;IAC5F;QACC,IAAI,EAAE,GAAG,QAAQ,WAAW;QAC5B,MAAM,EAAE,cAAc;QACtB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,CAAC,qBAAqB,CAAC;QACpC,WAAW,EAAE,IAAA,8BAAiB,EAC7B,iBAAiB,CAAC,iBAAiB,EACnC,CAAC,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,CAC/B;KACD;IACD;QACC,IAAI,EAAE,GAAG,QAAQ,YAAY;QAC7B,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,IAAA,8BAAiB,EAC7B,iBAAiB,CAAC,kBAAkB,EACpC,CAAC,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,CAC/B;KACD;IACD;QACC,IAAI,EAAE,GAAG,QAAQ,QAAQ;QACzB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,IAAA,8BAAiB,EAC7B,iBAAiB,CAAC,cAAc,EAChC,CAAC,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,CAC/B;KACD;IACD;QACC,IAAI,EAAE,GAAG,QAAQ,SAAS;QAC1B,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,IAAA,8BAAiB,EAC7B,iBAAiB,CAAC,eAAe,EACjC,CAAC,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,CAC/B;KACD;CACD,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAA,8BAAiB,EAC7C,iBAAiB,CAAC,kBAAkB,EACpC,CAAC,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,CAC/B,CAAC;AAGK,IAAM,eAAe,GAArB,MAAM,eAAe;IAC3B,YACkB,UAAsB,EACtB,gBAA2C;QAD3C,eAAU,GAAV,UAAU,CAAY;QACtB,qBAAgB,GAAhB,gBAAgB,CAA2B;IAC1D,CAAC;IAGI,cAAc,CAAC,GAAa;QAEnC,GAAG,CAAC,MAAM,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAC/C,GAAG,CAAC,MAAM,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;IAC5D,CAAC;IAYD,eAAe,CAAC,IAAa,EAAE,GAAa;QAC3C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACvB,CAAC;IAgBD,QAAQ,CAAC,IAAa,EAAE,GAAa;QACpC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG;YAChB,MAAM,EAAE,OAAO;YACf,sBAAsB,EAAE,GAAG,OAAO,sBAAsB;YACxD,cAAc,EAAE,GAAG,OAAO,kBAAkB;YAC5C,qBAAqB,EAAE,GAAG,OAAO,qBAAqB;YACtD,mBAAmB,EAAE,GAAG,OAAO,mBAAmB;YAClD,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC9D,qCAAqC,EAAE,CAAC,MAAM,EAAE,oBAAoB,EAAE,qBAAqB,CAAC;YAC5F,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE;SACtD,CAAC;QAEF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAOD,gCAAgC,CAAC,IAAa,EAAE,GAAa;QAC5D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACvB,CAAC;IAYK,AAAN,KAAK,CAAC,yBAAyB,CAAC,GAAY,EAAE,GAAa;QAC1D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAEzB,MAAM,YAAY,GACjB,GAAG;YACH,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC;gBACtC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;gBACnC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAChE,OAAO;QACR,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACrD,MAAM,QAAQ,GAA4B;YACzC,QAAQ,EAAE,QAAQ,CAAC,cAAc,EAAE;YACnC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;YACpC,qBAAqB,EAAE,CAAC,OAAO,CAAC;SAChC,CAAC;QAEF,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC7C,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;;AA7GW,0CAAe;AAcpB,uBAAO,GAA2B;IACxC,GAAG,qBAAqB,CAAC,YAAY,CAAC;IACtC,GAAG,qBAAqB,CAAC,QAAQ,CAAC;CAClC,AAHa,CAGZ;AAOF;IALC,IAAA,oBAAO,EAAC,yCAAyC,EAAE;QACnD,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,oBAAoB;KACjC,CAAC;;;;sDAID;AAgBD;IALC,IAAA,gBAAG,EAAC,yCAAyC,EAAE;QAC/C,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,oBAAoB;KACjC,CAAC;;;;+CAmBD;AAOD;IALC,IAAA,oBAAO,EAAC,qDAAqD,EAAE;QAC/D,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,oBAAoB;KACjC,CAAC;;;;uEAID;AAYK;IALL,IAAA,gBAAG,EAAC,qDAAqD,EAAE;QAC3D,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,oBAAoB;KACjC,CAAC;;;;gEA2BD;0BA7GW,eAAe;IAD3B,IAAA,gCAAmB,EAAC,GAAG,CAAC;qCAGM,wBAAU;QACJ,uDAAyB;GAHjD,eAAe,CA8G3B"}

package/dist/modules/oauth-server/oauth.errors.d.ts

@@ -0,0 +1,13 @@
+import { ServerError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
+import { AuthError } from '../../errors/response-errors/auth.error';
+export declare const buildOAuthClientLimitReachedMessage: (limit: number) => string;
+export declare class OAuthClientLimitReachedError extends ServerError {
+    readonly limit: number;
+    constructor(limit: number);
+}
+export declare class JWTVerificationError extends AuthError {
+    constructor();
+}
+export declare class AccessTokenNotFoundError extends AuthError {
+    constructor();
+}

package/dist/modules/oauth-server/oauth.errors.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessTokenNotFoundError = exports.JWTVerificationError = exports.OAuthClientLimitReachedError = exports.buildOAuthClientLimitReachedMessage = void 0;
+const errors_js_1 = require("@modelcontextprotocol/sdk/server/auth/errors.js");
+const auth_error_1 = require("../../errors/response-errors/auth.error");
+const buildOAuthClientLimitReachedMessage = (limit) => `This n8n instance has reached its maximum of ${limit} registered MCP clients. Ask an administrator to revoke unused clients or raise N8N_MCP_MAX_REGISTERED_CLIENTS.`;
+exports.buildOAuthClientLimitReachedMessage = buildOAuthClientLimitReachedMessage;
+class OAuthClientLimitReachedError extends errors_js_1.ServerError {
+    constructor(limit) {
+        super((0, exports.buildOAuthClientLimitReachedMessage)(limit));
+        this.name = 'OAuthClientLimitReachedError';
+        this.limit = limit;
+    }
+}
+exports.OAuthClientLimitReachedError = OAuthClientLimitReachedError;
+class JWTVerificationError extends auth_error_1.AuthError {
+    constructor() {
+        super('JWT Verification Failed');
+        this.name = 'JWTVerificationError';
+    }
+}
+exports.JWTVerificationError = JWTVerificationError;
+class AccessTokenNotFoundError extends auth_error_1.AuthError {
+    constructor() {
+        super('Access Token Not Found in Database');
+        this.name = 'AccessTokenNotFoundError';
+    }
+}
+exports.AccessTokenNotFoundError = AccessTokenNotFoundError;
+//# sourceMappingURL=oauth.errors.js.map

package/dist/modules/oauth-server/oauth.errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.errors.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth.errors.ts"],"names":[],"mappings":";;;AAAA,+EAA8E;AAE9E,oEAAgE;AAKzD,MAAM,mCAAmC,GAAG,CAAC,KAAa,EAAU,EAAE,CAC5E,gDAAgD,KAAK,iHAAiH,CAAC;AAD3J,QAAA,mCAAmC,uCACwH;AAQxK,MAAa,4BAA6B,SAAQ,uBAAW;IAG5D,YAAY,KAAa;QACxB,KAAK,CAAC,IAAA,2CAAmC,EAAC,KAAK,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,CAAC;CACD;AARD,oEAQC;AAED,MAAa,oBAAqB,SAAQ,sBAAS;IAClD;QACC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACpC,CAAC;CACD;AALD,oDAKC;AAED,MAAa,wBAAyB,SAAQ,sBAAS;IACtD;QACC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACxC,CAAC;CACD;AALD,4DAKC"}

package/dist/modules/{mcp/mcp-oauth.helpers.d.ts → oauth-server/oauth.helpers.d.ts}

@@ -1,4 +1,4 @@
-export declare class McpOAuthHelpers {
+export declare class OAuthHelpers {
     static buildSuccessRedirectUrl(redirectUri: string, code: string, state: string | null): string;
     static buildErrorRedirectUrl(redirectUri: string, error: string, errorDescription: string, state: string | null): string;
 }

package/dist/modules/{mcp/mcp-oauth.helpers.js → oauth-server/oauth.helpers.js}

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.McpOAuthHelpers = void 0;
-class McpOAuthHelpers {
+exports.OAuthHelpers = void 0;
+class OAuthHelpers {
     static buildSuccessRedirectUrl(redirectUri, code, state) {
         const targetUrl = new URL(redirectUri);
         targetUrl.searchParams.set('code', code);
@@ -20,5 +20,5 @@ class McpOAuthHelpers {
         return targetUrl.toString();
     }
 }
-exports.McpOAuthHelpers = McpOAuthHelpers;
-//# sourceMappingURL=mcp-oauth.helpers.js.map
+exports.OAuthHelpers = OAuthHelpers;
+//# sourceMappingURL=oauth.helpers.js.map

package/dist/modules/oauth-server/oauth.helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.helpers.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth.helpers.ts"],"names":[],"mappings":";;;AAGA,MAAa,YAAY;IAKxB,MAAM,CAAC,uBAAuB,CAAC,WAAmB,EAAE,IAAY,EAAE,KAAoB;QACrF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACvC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,EAAE,CAAC;YACX,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAMD,MAAM,CAAC,qBAAqB,CAC3B,WAAmB,EACnB,KAAa,EACb,gBAAwB,EACxB,KAAoB;QAEpB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACvC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3C,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;QAClE,IAAI,KAAK,EAAE,CAAC;YACX,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;CACD;AAhCD,oCAgCC"}

package/dist/modules/oauth-server/protected-resource-resolvers/utils.d.ts

@@ -0,0 +1,4 @@
+export declare const WORKFLOW_MCP_TRIGGER_SCOPES: string[];
+export declare function trimTrailingSlash(path: string): string;
+export declare function trimSlashes(path: string): string;
+export declare function resourceUrlToWebhookPath(resourceUrl: string, webhookBaseUrl: string): string | undefined;

package/dist/modules/oauth-server/protected-resource-resolvers/utils.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WORKFLOW_MCP_TRIGGER_SCOPES = void 0;
+exports.trimTrailingSlash = trimTrailingSlash;
+exports.trimSlashes = trimSlashes;
+exports.resourceUrlToWebhookPath = resourceUrlToWebhookPath;
+exports.WORKFLOW_MCP_TRIGGER_SCOPES = [];
+function trimTrailingSlash(path) {
+    if (path.endsWith('/')) {
+        path = path.slice(0, -1);
+    }
+    return path;
+}
+function trimSlashes(path) {
+    if (path.startsWith('/')) {
+        path = path.slice(1);
+    }
+    if (path.endsWith('/')) {
+        path = path.slice(0, -1);
+    }
+    return path;
+}
+function resourceUrlToWebhookPath(resourceUrl, webhookBaseUrl) {
+    let url;
+    try {
+        url = new URL(resourceUrl);
+    }
+    catch {
+        return undefined;
+    }
+    const base = new URL(webhookBaseUrl);
+    if (url.origin !== base.origin) {
+        return undefined;
+    }
+    const basePath = trimTrailingSlash(base.pathname);
+    if (basePath && !url.pathname.startsWith(`${basePath}/`)) {
+        return undefined;
+    }
+    return url.pathname.slice(basePath.length);
+}
+//# sourceMappingURL=utils.js.map

package/dist/modules/oauth-server/protected-resource-resolvers/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../../src/modules/oauth-server/protected-resource-resolvers/utils.ts"],"names":[],"mappings":";;;AAOA,8CAKC;AAED,kCAQC;AAYD,4DAsBC;AAnDY,QAAA,2BAA2B,GAAa,EAAE,CAAC;AAExD,SAAgB,iBAAiB,CAAC,IAAY;IAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAgB,WAAW,CAAC,IAAY;IACvC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAYD,SAAgB,wBAAwB,CACvC,WAAmB,EACnB,cAAsB;IAEtB,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC"}

package/dist/modules/oauth-server/protected-resource-resolvers/workflow-mcp-test-trigger-resource.resolver.d.ts

@@ -0,0 +1,28 @@
+import type { ProtectedResourceResolver } from '../../../services/protected-resource.registry';
+import { UrlService } from '../../../services/url.service';
+import { TestWebhookRegistrationsService } from '../../../webhooks/test-webhook-registrations.service';
+import { Logger } from '@n8n/backend-common';
+import { GlobalConfig } from '@n8n/config';
+export declare class WorkflowMcpTestTriggerResourceResolver implements ProtectedResourceResolver {
+    private readonly config;
+    private readonly registrations;
+    private readonly urlService;
+    private readonly logger;
+    constructor(config: GlobalConfig, registrations: TestWebhookRegistrationsService, urlService: UrlService, logger: Logger);
+    readonly id = "workflow-mcp-test-trigger";
+    readonly scopes: string[];
+    resolveByUrl(resourceUrl: string): Promise<{
+        id: string;
+        getResourceUrl: () => string;
+        getAudiences: () => string[];
+        scopes: string[];
+        displayName: string;
+    } | undefined>;
+    resolveByPath(pathname: string): Promise<{
+        id: string;
+        getResourceUrl: () => string;
+        getAudiences: () => string[];
+        scopes: string[];
+        displayName: string;
+    } | undefined>;
+}