npm - n8n - Versions diffs - 2.30.0 → 2.30.2 - Mend

n8n 2.30.0 → 2.30.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (93) hide show

package/dist/modules/oauth-server/oauth-consent.controller.js CHANGED Viewed

@@ -18,6 +18,7 @@ const decorators_1 = require("@n8n/decorators");
 const approve_consent_request_dto_1 = require("./dto/approve-consent-request.dto");
 const oauth_consent_service_1 = require("./oauth-consent.service");
 const oauth_session_service_1 = require("./oauth-session.service");
+const forbidden_error_1 = require("../../errors/response-errors/forbidden.error");
 let OAuthConsentController = class OAuthConsentController {
     constructor(logger, consentService, oauthSessionService) {
         this.logger = logger;
@@ -29,14 +30,19 @@ let OAuthConsentController = class OAuthConsentController {
             const sessionToken = this.getAndValidateSessionToken(req, res);
             if (!sessionToken)
                 return;
-            const consentDetails = await this.consentService.getConsentDetails(sessionToken);
+            const consentDetails = await this.consentService.getConsentDetails(sessionToken, req.user);
             if (!consentDetails) {
                 this.sendInvalidSessionError(res, true);
                 return;
             }
             if (!consentDetails.ok) {
                 this.oauthSessionService.clearSession(res);
-                this.sendErrorResponse(res, 422, 'Authorization target is no longer available');
+                if (consentDetails.reason === 'forbidden') {
+                    this.sendErrorResponse(res, 403, 'You do not have sufficient permissions to authorize this request');
+                }
+                else {
+                    this.sendErrorResponse(res, 422, 'Authorization target is no longer available');
+                }
                 return;
             }
             res.json({
@@ -59,7 +65,7 @@ let OAuthConsentController = class OAuthConsentController {
             const sessionToken = this.getAndValidateSessionToken(req, res);
             if (!sessionToken)
                 return;
-            const result = await this.consentService.handleConsentDecision(sessionToken, req.user.id, payload.approved);
+            const result = await this.consentService.handleConsentDecision(sessionToken, req.user, payload.approved);
             this.oauthSessionService.clearSession(res);
             res.json({
                 data: {
@@ -71,6 +77,10 @@ let OAuthConsentController = class OAuthConsentController {
         catch (error) {
             this.logger.error('Failed to process consent', { error });
             this.oauthSessionService.clearSession(res);
+            if (error instanceof forbidden_error_1.ForbiddenError) {
+                this.sendErrorResponse(res, 403, 'You do not have sufficient permissions to authorize this request');
+                return;
+            }
             const message = error instanceof Error ? error.message : 'Failed to process authorization';
             this.sendErrorResponse(res, 500, message);
         }

package/dist/modules/oauth-server/oauth-consent.controller.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-consent.controller.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth-consent.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wDAA6C;AAE7C,gDAAkE;AAGlE,mFAA6E;AAC7E,mEAA8D;AAC9D,mEAA8D;~~AAGvD~~,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAClC,YACkB,MAAc,EACd,cAAmC,EACnC,mBAAwC;QAFxC,WAAM,GAAN,MAAM,CAAQ;QACd,mBAAc,GAAd,cAAc,CAAqB;QACnC,wBAAmB,GAAnB,mBAAmB,CAAqB;IACvD,CAAC;IAGE,AAAN,KAAK,CAAC,iBAAiB,CAAC,GAAyB,EAAE,GAAa;QAC/D,IAAI,CAAC;YACJ,MAAM,YAAY,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/D,IAAI,CAAC,YAAY;gBAAE,OAAO;YAE1B,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;~~YAEjF~~,IAAI,CAAC,cAAc,EAAE,CAAC;gBACrB,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACxC,OAAO;YACR,CAAC;YAED,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;gBAC3C,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,6CAA6C,CAAC,CAAC;~~gBAChF~~,OAAO;YACR,CAAC;YAED,GAAG,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE;oBACL,UAAU,EAAE,cAAc,CAAC,UAAU;oBACrC,QAAQ,EAAE,cAAc,CAAC,QAAQ;oBACjC,WAAW,EAAE,cAAc,CAAC,WAAW;oBACvC,YAAY,EAAE,cAAc,CAAC,YAAY;iBACzC;aACD,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,sCAAsC,CAAC,CAAC;QAC1E,CAAC;IACF,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CACnB,GAAyB,EACzB,GAAa,EACP,OAAiC;QAEvC,IAAI,CAAC;YACJ,MAAM,YAAY,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/D,IAAI,CAAC,YAAY;gBAAE,OAAO;YAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAC7D,YAAY,EACZ,GAAG,CAAC,IAAI,~~CAAC~~,~~EAAE,EACX,~~OAAO,CAAC,QAAQ,CAChB,CAAC;YAEF,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAE3C,GAAG,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE;oBACL,MAAM,EAAE,SAAS;oBACjB,WAAW,EAAE,MAAM,CAAC,WAAW;iBAC/B;aACD,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC,CAAC;YAC3F,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;IACF,CAAC;IAEO,iBAAiB,CAAC,GAAa,EAAE,UAAkB,EAAE,OAAe;QAC3E,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;YAC3B,MAAM,EAAE,OAAO;YACf,OAAO;SACP,CAAC,CAAC;IACJ,CAAC;IAEO,uBAAuB,CAAC,GAAa,EAAE,WAAW,GAAG,KAAK;QACjE,IAAI,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,0CAA0C,CAAC,CAAC;IAC9E,CAAC;IAEO,0BAA0B,CAAC,GAAyB,EAAE,GAAa;QAC1E,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3E,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAClC,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,CAAC;YACJ,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YACrD,OAAO,YAAY,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;CACD,CAAA;~~AAvGY~~,wDAAsB;AAQ5B;IADL,IAAA,gBAAG,EAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;;;;+~~DAgCxC~~;AAGK;IADL,IAAA,iBAAI,EAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAIxC,WAAA,iBAAI,CAAA;;qDAAU,sDAAwB;;~~4DA0BvC~~;~~iCAvEW~~,sBAAsB;IADlC,IAAA,2BAAc,EAAC,UAAU,CAAC;qCAGA,uBAAM;QACE,2CAAmB;QACd,2CAAmB;GAJ9C,sBAAsB,~~CAuGlC~~"}
1	+ {"version":3,"file":"oauth-consent.controller.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth-consent.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wDAA6C;AAE7C,gDAAkE;AAGlE,mFAA6E;AAC7E,mEAA8D;AAC9D,mEAA8D;AAC9D,8EAA0E;AAGnE,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAClC,YACkB,MAAc,EACd,cAAmC,EACnC,mBAAwC;QAFxC,WAAM,GAAN,MAAM,CAAQ;QACd,mBAAc,GAAd,cAAc,CAAqB;QACnC,wBAAmB,GAAnB,mBAAmB,CAAqB;IACvD,CAAC;IAGE,AAAN,KAAK,CAAC,iBAAiB,CAAC,GAAyB,EAAE,GAAa;QAC/D,IAAI,CAAC;YACJ,MAAM,YAAY,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/D,IAAI,CAAC,YAAY;gBAAE,OAAO;YAE1B,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAE3F,IAAI,CAAC,cAAc,EAAE,CAAC;gBACrB,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACxC,OAAO;YACR,CAAC;YAED,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;gBAC3C,IAAI,cAAc,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;oBAC3C,IAAI,CAAC,iBAAiB,CACrB,GAAG,EACH,GAAG,EACH,kEAAkE,CAClE,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACP,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,6CAA6C,CAAC,CAAC;gBACjF,CAAC;gBACD,OAAO;YACR,CAAC;YAED,GAAG,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE;oBACL,UAAU,EAAE,cAAc,CAAC,UAAU;oBACrC,QAAQ,EAAE,cAAc,CAAC,QAAQ;oBACjC,WAAW,EAAE,cAAc,CAAC,WAAW;oBACvC,YAAY,EAAE,cAAc,CAAC,YAAY;iBACzC;aACD,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,sCAAsC,CAAC,CAAC;QAC1E,CAAC;IACF,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CACnB,GAAyB,EACzB,GAAa,EACP,OAAiC;QAEvC,IAAI,CAAC;YACJ,MAAM,YAAY,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/D,IAAI,CAAC,YAAY;gBAAE,OAAO;YAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAC7D,YAAY,EACZ,GAAG,CAAC,IAAI,EACR,OAAO,CAAC,QAAQ,CAChB,CAAC;YAEF,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAE3C,GAAG,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE;oBACL,MAAM,EAAE,SAAS;oBACjB,WAAW,EAAE,MAAM,CAAC,WAAW;iBAC/B;aACD,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,KAAK,YAAY,gCAAc,EAAE,CAAC;gBACrC,IAAI,CAAC,iBAAiB,CACrB,GAAG,EACH,GAAG,EACH,kEAAkE,CAClE,CAAC;gBACF,OAAO;YACR,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC,CAAC;YAC3F,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;IACF,CAAC;IAEO,iBAAiB,CAAC,GAAa,EAAE,UAAkB,EAAE,OAAe;QAC3E,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;YAC3B,MAAM,EAAE,OAAO;YACf,OAAO;SACP,CAAC,CAAC;IACJ,CAAC;IAEO,uBAAuB,CAAC,GAAa,EAAE,WAAW,GAAG,KAAK;QACjE,IAAI,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,0CAA0C,CAAC,CAAC;IAC9E,CAAC;IAEO,0BAA0B,CAAC,GAAyB,EAAE,GAAa;QAC1E,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3E,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAClC,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,CAAC;YACJ,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YACrD,OAAO,YAAY,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;CACD,CAAA;AAvHY,wDAAsB;AAQ5B;IADL,IAAA,gBAAG,EAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;;;;+DAwCxC;AAGK;IADL,IAAA,iBAAI,EAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAIxC,WAAA,iBAAI,CAAA;;qDAAU,sDAAwB;;4DAkCvC;iCAvFW,sBAAsB;IADlC,IAAA,2BAAc,EAAC,UAAU,CAAC;qCAGA,uBAAM;QACE,2CAAmB;QACd,2CAAmB;GAJ9C,sBAAsB,CAuHlC"}

package/dist/modules/oauth-server/oauth-consent.service.d.ts CHANGED Viewed

@@ -1,4 +1,5 @@
 import { Logger } from '@n8n/backend-common';
+import type { User } from '@n8n/db';
 import { OAuthClientRepository } from './database/repositories/oauth-client.repository';
 import { UserConsentRepository } from './database/repositories/oauth-user-consent.repository';
 import { OAuthAuthorizationCodeService } from './oauth-authorization-code.service';
@@ -14,6 +15,9 @@ type ConsentDetailsResult = {
 } | {
     ok: false;
     reason: 'resource_unavailable';
+} | {
+    ok: false;
+    reason: 'forbidden';
 };
 export declare class OAuthConsentService {
     private readonly logger;
@@ -24,8 +28,8 @@ export declare class OAuthConsentService {
     private readonly protectedResourceRegistry;
     private readonly urlService;
     constructor(logger: Logger, oauthSessionService: OAuthSessionService, oauthClientRepository: OAuthClientRepository, userConsentRepository: UserConsentRepository, authorizationCodeService: OAuthAuthorizationCodeService, protectedResourceRegistry: ProtectedResourceRegistry, urlService: UrlService);
-    getConsentDetails(sessionToken: string): Promise<ConsentDetailsResult | null>;
-    handleConsentDecision(sessionToken: string, userId: string, approved: boolean): Promise<{
+    getConsentDetails(sessionToken: string, user: User): Promise<ConsentDetailsResult | null>;
+    handleConsentDecision(sessionToken: string, user: User, approved: boolean): Promise<{
         redirectUrl: string;
     }>;
 }

package/dist/modules/oauth-server/oauth-consent.service.js CHANGED Viewed

@@ -18,6 +18,7 @@ const oauth_user_consent_repository_1 = require("./database/repositories/oauth-u
 const oauth_authorization_code_service_1 = require("./oauth-authorization-code.service");
 const oauth_session_service_1 = require("./oauth-session.service");
 const oauth_helpers_1 = require("./oauth.helpers");
+const forbidden_error_1 = require("../../errors/response-errors/forbidden.error");
 const protected_resource_registry_1 = require("../../services/protected-resource.registry");
 const url_service_1 = require("../../services/url.service");
 let OAuthConsentService = class OAuthConsentService {
@@ -30,7 +31,7 @@ let OAuthConsentService = class OAuthConsentService {
         this.protectedResourceRegistry = protectedResourceRegistry;
         this.urlService = urlService;
     }
-    async getConsentDetails(sessionToken) {
+    async getConsentDetails(sessionToken, user) {
         try {
             const sessionPayload = this.oauthSessionService.verifySession(sessionToken);
             const client = await this.oauthClientRepository.findOne({
@@ -44,6 +45,11 @@ let OAuthConsentService = class OAuthConsentService {
                 if (!resource) {
                     return { ok: false, reason: 'resource_unavailable' };
                 }
+                if (!(await resource.authorize(user)))
+                    return {
+                        ok: false,
+                        reason: 'forbidden',
+                    };
                 return {
                     ok: true,
                     clientName: client.name,
@@ -64,7 +70,7 @@ let OAuthConsentService = class OAuthConsentService {
             return null;
         }
     }
-    async handleConsentDecision(sessionToken, userId, approved) {
+    async handleConsentDecision(sessionToken, user, approved) {
         let sessionPayload;
         try {
             sessionPayload = this.oauthSessionService.verifySession(sessionToken);
@@ -77,20 +83,34 @@ let OAuthConsentService = class OAuthConsentService {
             const redirectUrl = oauth_helpers_1.OAuthHelpers.buildErrorRedirectUrl(sessionPayload.redirectUri, 'access_denied', 'User denied the authorization request', sessionPayload.state, issuer);
             this.logger.info('Consent denied', {
                 clientId: sessionPayload.clientId,
-                userId,
+                userId: user.id,
             });
             return { redirectUrl };
         }
+        if (sessionPayload.resource) {
+            const resource = await this.protectedResourceRegistry.getByResourceUrl(sessionPayload.resource);
+            if (!resource) {
+                throw new n8n_workflow_1.UserError('Resource is not available for the requested authorization');
+            }
+            if (!(await resource.authorize(user))) {
+                this.logger.warn('User is not authorized for the requested resource', {
+                    clientId: sessionPayload.clientId,
+                    userId: user.id,
+                    resourceUrl: sessionPayload.resource,
+                });
+                throw new forbidden_error_1.ForbiddenError('User is not authorized for the requested resource');
+            }
+        }
         await this.userConsentRepository.upsert({
-            userId,
+            userId: user.id,
             clientId: sessionPayload.clientId,
             grantedAt: Date.now(),
         }, ['userId', 'clientId']);
-        const code = await this.authorizationCodeService.createAuthorizationCode(sessionPayload.clientId, userId, sessionPayload.redirectUri, sessionPayload.codeChallenge, sessionPayload.state, sessionPayload.resource);
+        const code = await this.authorizationCodeService.createAuthorizationCode(sessionPayload.clientId, user.id, sessionPayload.redirectUri, sessionPayload.codeChallenge, sessionPayload.state, sessionPayload.resource);
         const successRedirectUrl = oauth_helpers_1.OAuthHelpers.buildSuccessRedirectUrl(sessionPayload.redirectUri, code, sessionPayload.state, issuer);
         this.logger.info('Consent approved', {
             clientId: sessionPayload.clientId,
-            userId,
+            userId: user.id,
         });
         return { redirectUrl: successRedirectUrl };
     }

package/dist/modules/oauth-server/oauth-consent.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-consent.service.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth-consent.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;~~AAC7C~~,gCAAkC;AAClC,+CAAyC;AAEzC,6FAAwF;AACxF,yGAA8F;AAC9F,yFAAmF;AACnF,mEAAwF;AACxF,mDAA+C;AAC/C,wFAAmF;AACnF,wDAAoD;~~AAW7C~~,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC/B,YACkB,MAAc,EACd,mBAAwC,EACxC,qBAA4C,EAC5C,qBAA4C,EAC5C,wBAAuD,EACvD,yBAAoD,EACpD,UAAsB;QANtB,WAAM,GAAN,MAAM,CAAQ;QACd,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,6BAAwB,GAAxB,wBAAwB,CAA+B;QACvD,8BAAyB,GAAzB,yBAAyB,CAA2B;QACpD,eAAU,GAAV,UAAU,CAAY;IACrC,CAAC;IAMJ,KAAK,CAAC,iBAAiB,CAAC,YAAoB;~~QAC3C~~,IAAI,CAAC;YACJ,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAE5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;gBACvD,KAAK,EAAE,EAAE,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;aACtC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACb,CAAC;YAED,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,gBAAgB,CACrE,cAAc,CAAC,QAAQ,CACvB,CAAC;gBAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;gBACtD,CAAC;gBAED,OAAO;oBACN,EAAE,EAAE,IAAI;oBACR,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;oBACnB,YAAY,EAAE,QAAQ,CAAC,WAAW;oBAClC,WAAW,EAAE,cAAc,CAAC,WAAW;iBACvC,CAAC;YACH,CAAC;YAED,OAAO;gBACN,EAAE,EAAE,IAAI;gBACR,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,WAAW,EAAE,cAAc,CAAC,WAAW;aACvC,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAMD,KAAK,CAAC,qBAAqB,CAC1B,YAAoB,EACpB,~~MAAc~~,~~EACd~~,QAAiB;QAEjB,IAAI,cAAmC,CAAC;QACxC,IAAI,CAAC;YACJ,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,wBAAS,CAAC,4BAA4B,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QAEpD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,4BAAY,CAAC,qBAAqB,CACrD,cAAc,CAAC,WAAW,EAC1B,eAAe,EACf,uCAAuC,EACvC,cAAc,CAAC,KAAK,EACpB,MAAM,CACN,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE;gBAClC,QAAQ,EAAE,cAAc,CAAC,QAAQ;gBACjC,MAAM;~~aACN~~,CAAC,CAAC;YAEH,OAAO,EAAE,WAAW,EAAE,CAAC;QACxB,CAAC;QAED,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CACtC;YACC,MAAM;~~YACN~~,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,EACD,CAAC,QAAQ,EAAE,UAAU,CAAC,CACtB,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CACvE,cAAc,CAAC,QAAQ,EACvB,~~MAAM~~,~~EACN~~,cAAc,CAAC,WAAW,EAC1B,cAAc,CAAC,aAAa,EAC5B,cAAc,CAAC,KAAK,EACpB,cAAc,CAAC,QAAQ,CACvB,CAAC;QAEF,MAAM,kBAAkB,GAAG,4BAAY,CAAC,uBAAuB,CAC9D,cAAc,CAAC,WAAW,EAC1B,IAAI,EACJ,cAAc,CAAC,KAAK,EACpB,MAAM,CACN,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE;YACpC,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,MAAM;~~SACN~~,CAAC,CAAC;QAEH,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAC5C,CAAC;CACD,CAAA;~~AA5HY~~,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,YAAO,GAAE;qCAGiB,uBAAM;QACO,2CAAmB;QACjB,+CAAqB;QACrB,qDAAqB;QAClB,gEAA6B;QAC5B,uDAAyB;QACxC,wBAAU;GAR5B,mBAAmB,~~CA4H~~/B"}
1	+ {"version":3,"file":"oauth-consent.service.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth-consent.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;AAE7C,gCAAkC;AAClC,+CAAyC;AAEzC,6FAAwF;AACxF,yGAA8F;AAC9F,yFAAmF;AACnF,mEAAwF;AACxF,mDAA+C;AAC/C,8EAA0E;AAC1E,wFAAmF;AACnF,wDAAoD;AAY7C,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC/B,YACkB,MAAc,EACd,mBAAwC,EACxC,qBAA4C,EAC5C,qBAA4C,EAC5C,wBAAuD,EACvD,yBAAoD,EACpD,UAAsB;QANtB,WAAM,GAAN,MAAM,CAAQ;QACd,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,6BAAwB,GAAxB,wBAAwB,CAA+B;QACvD,8BAAyB,GAAzB,yBAAyB,CAA2B;QACpD,eAAU,GAAV,UAAU,CAAY;IACrC,CAAC;IAMJ,KAAK,CAAC,iBAAiB,CAAC,YAAoB,EAAE,IAAU;QACvD,IAAI,CAAC;YACJ,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAE5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;gBACvD,KAAK,EAAE,EAAE,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;aACtC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACb,CAAC;YAED,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,gBAAgB,CACrE,cAAc,CAAC,QAAQ,CACvB,CAAC;gBAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;gBACtD,CAAC;gBAED,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;oBACpC,OAAO;wBACN,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,WAAW;qBACnB,CAAC;gBAEH,OAAO;oBACN,EAAE,EAAE,IAAI;oBACR,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;oBACnB,YAAY,EAAE,QAAQ,CAAC,WAAW;oBAClC,WAAW,EAAE,cAAc,CAAC,WAAW;iBACvC,CAAC;YACH,CAAC;YAED,OAAO;gBACN,EAAE,EAAE,IAAI;gBACR,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,WAAW,EAAE,cAAc,CAAC,WAAW;aACvC,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAMD,KAAK,CAAC,qBAAqB,CAC1B,YAAoB,EACpB,IAAU,EACV,QAAiB;QAEjB,IAAI,cAAmC,CAAC;QACxC,IAAI,CAAC;YACJ,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,wBAAS,CAAC,4BAA4B,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QAEpD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,4BAAY,CAAC,qBAAqB,CACrD,cAAc,CAAC,WAAW,EAC1B,eAAe,EACf,uCAAuC,EACvC,cAAc,CAAC,KAAK,EACpB,MAAM,CACN,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE;gBAClC,QAAQ,EAAE,cAAc,CAAC,QAAQ;gBACjC,MAAM,EAAE,IAAI,CAAC,EAAE;aACf,CAAC,CAAC;YAEH,OAAO,EAAE,WAAW,EAAE,CAAC;QACxB,CAAC;QAED,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,gBAAgB,CACrE,cAAc,CAAC,QAAQ,CACvB,CAAC;YAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,MAAM,IAAI,wBAAS,CAAC,2DAA2D,CAAC,CAAC;YAClF,CAAC;YAED,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;oBACrE,QAAQ,EAAE,cAAc,CAAC,QAAQ;oBACjC,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,WAAW,EAAE,cAAc,CAAC,QAAQ;iBACpC,CAAC,CAAC;gBACH,MAAM,IAAI,gCAAc,CAAC,mDAAmD,CAAC,CAAC;YAC/E,CAAC;QACF,CAAC;QAED,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CACtC;YACC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,EACD,CAAC,QAAQ,EAAE,UAAU,CAAC,CACtB,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CACvE,cAAc,CAAC,QAAQ,EACvB,IAAI,CAAC,EAAE,EACP,cAAc,CAAC,WAAW,EAC1B,cAAc,CAAC,aAAa,EAC5B,cAAc,CAAC,KAAK,EACpB,cAAc,CAAC,QAAQ,CACvB,CAAC;QAEF,MAAM,kBAAkB,GAAG,4BAAY,CAAC,uBAAuB,CAC9D,cAAc,CAAC,WAAW,EAC1B,IAAI,EACJ,cAAc,CAAC,KAAK,EACpB,MAAM,CACN,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE;YACpC,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,MAAM,EAAE,IAAI,CAAC,EAAE;SACf,CAAC,CAAC;QAEH,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAC5C,CAAC;CACD,CAAA;AArJY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,YAAO,GAAE;qCAGiB,uBAAM;QACO,2CAAmB;QACjB,+CAAqB;QACrB,qDAAqB;QAClB,gEAA6B;QAC5B,uDAAyB;QACxC,wBAAU;GAR5B,mBAAmB,CAqJ/B"}

package/dist/modules/oauth-server/oauth-token.service.d.ts CHANGED Viewed

@@ -4,9 +4,9 @@ import { Logger } from '@n8n/backend-common';
 import { UserRepository } from '@n8n/db';
 import { AccessTokenRepository } from './database/repositories/oauth-access-token.repository';
 import { RefreshTokenRepository } from './database/repositories/oauth-refresh-token.repository';
+import { ProtectedResourceRegistry } from '../../services/protected-resource.registry';
 import { JwtService } from '../../services/jwt.service';
 import type { OAuthTokenVerifier, UserWithContext } from '../../services/oauth-token-verifier-proxy.service';
-import { ProtectedResourceRegistry } from '../../services/protected-resource.registry';
 export declare class OAuthTokenService implements OAuthTokenVerifier {
     private readonly logger;
     private readonly jwtService;
@@ -25,10 +25,13 @@ export declare class OAuthTokenService implements OAuthTokenVerifier {
     saveTokenPair(accessToken: string, refreshToken: string, clientId: string, userId: string): Promise<void>;
     validateAndRotateRefreshToken(refreshToken: string, clientId: string, resource?: string): Promise<OAuthTokens>;
     verifyAccessToken(token: string, expectedAudience?: string): Promise<AuthInfo>;
+    private verifyTokenWithAudiences;
     verifyOAuthAccessToken(token: string, expectedAudience?: string): Promise<UserWithContext>;
     revokeAccessToken(token: string, clientId: string): Promise<boolean>;
     revokeRefreshToken(token: string, clientId: string): Promise<boolean>;
     private getAllowedAudiences;
+    private audiencesForResource;
+    private getResourceByAudience;
     private verifyJwtWithAllowedAudiences;
     private getStringClaim;
 }

package/dist/modules/oauth-server/oauth-token.service.js CHANGED Viewed

@@ -23,9 +23,9 @@ const oauth_access_token_entity_1 = require("./database/entities/oauth-access-to
 const oauth_refresh_token_entity_1 = require("./database/entities/oauth-refresh-token.entity");
 const oauth_access_token_repository_1 = require("./database/repositories/oauth-access-token.repository");
 const oauth_refresh_token_repository_1 = require("./database/repositories/oauth-refresh-token.repository");
+const protected_resource_registry_1 = require("../../services/protected-resource.registry");
 const oauth_errors_1 = require("./oauth.errors");
 const jwt_service_1 = require("../../services/jwt.service");
-const protected_resource_registry_1 = require("../../services/protected-resource.registry");
 let OAuthTokenService = class OAuthTokenService {
     constructor(logger, jwtService, userRepository, accessTokenRepository, refreshTokenRepository, resourceRegistry) {
         this.logger = logger;
@@ -120,9 +120,11 @@ let OAuthTokenService = class OAuthTokenService {
         });
     }
     async verifyAccessToken(token, expectedAudience) {
+        return await this.verifyTokenWithAudiences(token, await this.getAllowedAudiences(expectedAudience));
+    }
+    async verifyTokenWithAudiences(token, allowedAudiences) {
         let decoded;
         try {
-            const allowedAudiences = await this.getAllowedAudiences(expectedAudience);
             decoded = this.verifyJwtWithAllowedAudiences(token, allowedAudiences);
         }
         catch (error) {
@@ -150,7 +152,11 @@ let OAuthTokenService = class OAuthTokenService {
     }
     async verifyOAuthAccessToken(token, expectedAudience) {
         try {
-            const authInfo = await this.verifyAccessToken(token, expectedAudience);
+            const resource = await this.getResourceByAudience(expectedAudience);
+            if (expectedAudience && !resource) {
+                return { user: null, context: { reason: 'insufficient_scope', auth_type: 'oauth' } };
+            }
+            const authInfo = await this.verifyTokenWithAudiences(token, this.audiencesForResource(resource, expectedAudience));
             const userId = authInfo.extra && typeof authInfo.extra === 'object'
                 ? this.getStringClaim(authInfo.extra, 'userId')
                 : null;
@@ -164,6 +170,13 @@ let OAuthTokenService = class OAuthTokenService {
             if (!user) {
                 return { user: null, context: { reason: 'user_not_found', auth_type: 'oauth' } };
             }
+            if (resource && !(await resource.authorize(user))) {
+                this.logger.warn('OAuth token denied: user lacks execute access', {
+                    userId: user.id,
+                    expectedAudience,
+                });
+                return { user: null, context: { reason: 'insufficient_scope', auth_type: 'oauth' } };
+            }
             return { user, authType: 'oauth' };
         }
         catch (error) {
@@ -206,12 +219,23 @@ let OAuthTokenService = class OAuthTokenService {
         return revoked;
     }
     async getAllowedAudiences(expectedAudience) {
+        const resource = expectedAudience
+            ? await this.resourceRegistry.getByResourceUrl(expectedAudience)
+            : undefined;
+        return this.audiencesForResource(resource, expectedAudience);
+    }
+    audiencesForResource(resource, expectedAudience) {
         if (expectedAudience) {
-            const resource = await this.resourceRegistry.getByResourceUrl(expectedAudience);
             return resource ? resource.getAudiences() : [expectedAudience];
         }
         return this.resourceRegistry.getAllAudiences();
     }
+    async getResourceByAudience(expectedAudience) {
+        if (!expectedAudience) {
+            return this.resourceRegistry.getDefaultResource();
+        }
+        return await this.resourceRegistry.getByResourceUrl(expectedAudience);
+    }
     verifyJwtWithAllowedAudiences(token, audiences) {
         try {
             return this.jwtService.verify(token, {

package/dist/modules/oauth-server/oauth-token.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-token.service.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+EAAoF;AAGpF,wDAA6C;AAC7C,8CAAsC;AACtC,gCAA0D;AAC1D,gCAAkC;AAClC,0CAA+C;AAC/C,iEAA6D;AAC7D,+CAA+C;AAC/C,6CAAsD;AAEtD,6FAA4E;AAC5E,+FAA8E;AAC9E,yGAA8F;AAC9F,2GAAgG;~~AAChG~~,iDAAgF;AAEhF,wDAAoD;~~AAKpD~~,~~wFAAmF;AAW5E,~~IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAI7B,YACkB,MAAc,EACd,UAAsB,EACtB,cAA8B,EAC9B,qBAA4C,EAC5C,sBAA8C,EAC9C,gBAA2C;QAL3C,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAY;QACtB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,qBAAgB,GAAhB,gBAAgB,CAA2B;QAT5C,gCAA2B,GAAG,CAAC,GAAG,gBAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QACvD,4BAAuB,GAAG,EAAE,GAAG,gBAAI,CAAC,IAAI,CAAC,cAAc,CAAC;IAStE,CAAC;IAEJ,2BAA2B;QAC1B,OAAO,IAAI,CAAC,2BAA2B,CAAC;IACzC,CAAC;IAED,iBAAiB,CAChB,MAAc,EACd,QAAgB,EAChB,QAAiB;QAIjB,MAAM,QAAQ,GAAG,QAAQ,IAAI,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,EAAE,cAAc,EAAE,CAAC;QAC1F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,8BAAe,CACxB,0GAA0G,CAC1G,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACxC,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,QAAQ;YACb,SAAS,EAAE,QAAQ;YACnB,GAAG,EAAE,IAAA,wBAAU,GAAE;YACjB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,2BAA2B;YACrE,IAAI,EAAE;gBACL,OAAO,EAAE,IAAI;aACb;SACD,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAErD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,aAAa,CAClB,WAAmB,EACnB,YAAoB,EACpB,QAAgB,EAChB,MAAc;QAEd,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE;YACjF,MAAM,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE;gBAClE,KAAK,EAAE,WAAW;gBAClB,QAAQ;gBACR,MAAM;aACN,CAAC,CAAC;YAEH,MAAM,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE;gBACnE,KAAK,EAAE,YAAY;gBACnB,QAAQ;gBACR,MAAM;gBACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,uBAAuB;aACpD,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,6BAA6B,CAClC,YAAoB,EACpB,QAAgB,EAChB,QAAiB;QAEjB,OAAO,MAAM,IAAA,oBAAe,EAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,MAAM,kBAAkB,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,yCAAY,EAAE;gBAC1D,KAAK,EAAE;oBACN,KAAK,EAAE,YAAY;oBACnB,QAAQ;iBACR;aACD,CAAC,CAAC;YAIH,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACzB,MAAM,IAAI,6BAAiB,CAAC,uBAAuB,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,yCAAY,EAAE;gBAC7C,KAAK,EAAE,YAAY;gBACnB,QAAQ;gBACR,SAAS,EAAE,IAAA,yBAAe,EAAC,GAAG,CAAC;aAC/B,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;YACzC,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,6BAAiB,CAAC,uBAAuB,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAC5E,kBAAkB,CAAC,MAAM,EACzB,QAAQ,EACR,QAAQ,CACR,CAAC;YAEF,MAAM,GAAG,CAAC,MAAM,CAAC,uCAAW,EAAE;gBAC7B,KAAK,EAAE,WAAW;gBAClB,QAAQ;gBACR,MAAM,EAAE,kBAAkB,CAAC,MAAM;aACjC,CAAC,CAAC;YAEH,MAAM,GAAG,CAAC,MAAM,CAAC,yCAAY,EAAE;gBAC9B,KAAK,EAAE,eAAe;gBACtB,QAAQ;gBACR,MAAM,EAAE,kBAAkB,CAAC,MAAM;gBACjC,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,uBAAuB;aAC7C,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;gBACrE,QAAQ;gBACR,MAAM,EAAE,kBAAkB,CAAC,MAAM;aACjC,CAAC,CAAC;YAEH,OAAO;gBACN,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,IAAI,CAAC,2BAA2B;gBAC5C,aAAa,EAAE,eAAe;aAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,gBAAyB;QAC/D,~~IAAI~~,~~OAAgB~~,~~CAAC;QAErB,~~IAAI,CAAC~~;YACJ~~,~~MAAM~~,~~gBAAgB~~,~~GAAG~~,MAAM,IAAI,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;~~YAC1E~~,OAAO,GAAG,IAAI,CAAC,6BAA6B,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,mCAAoB,EAAE,CAAC;QAClC,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,mCAAoB,EAAE,CAAC;QAClC,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;YAClE,KAAK,EAAE,EAAE,KAAK,EAAE;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxB,MAAM,IAAI,uCAAwB,EAAE,CAAC;QACtC,CAAC;QAED,OAAO;YACN,KAAK;YACL,QAAQ;YACR,MAAM,EAAE,EAAE;YACV,KAAK,EAAE;gBACN,MAAM;aACN;SACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,gBAAyB;QACpE,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,~~iBAAiB~~,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;~~YAEvE~~,MAAM,MAAM,GACX,QAAQ,CAAC,KAAK,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;gBACnD,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAC/C,CAAC,CAAC,IAAI,CAAC;YACT,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC;YAC5F,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;gBAC9C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;gBACrB,SAAS,EAAE,CAAC,MAAM,CAAC;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC;YAClF,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,IAAA,0BAAW,EAAC,KAAK,CAAC,CAAC;YACxC,MAAM,MAAM,GACX,YAAY,YAAY,mCAAoB;gBAC3C,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,YAAY,YAAY,uCAAwB;oBACjD,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,eAAe,CAAC;YACrB,OAAO;gBACN,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE;oBACR,MAAM;oBACN,SAAS,EAAE,OAAO;oBAClB,aAAa,EAAE,YAAY,CAAC,OAAO;iBACnC;aACD,CAAC;QACH,CAAC;IACF,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,QAAgB;QACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;YACtD,KAAK;YACL,QAAQ;SACR,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,QAAgB;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC;YACvD,KAAK;YACL,QAAQ;SACR,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAWO,KAAK,CAAC,mBAAmB,CAAC,gBAAyB;QAC1D,IAAI,gBAAgB,~~EAAE~~,CAAC;~~YACtB~~,~~MAAM~~,~~QAAQ~~,~~GAAG~~,~~MAAM~~,IAAI,CAAC,~~gBAAgB~~,CAAC,gBAAgB,CAAC,~~gBAAgB~~,CAAC,CAAC;~~YAChF~~,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAChE,CAAC;QAKD,OAAO,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,CAAC;IAChD,CAAC;IAIO,6BAA6B,CAAC,KAAa,EAAE,SAAmB;QACvE,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE;gBACpC,QAAQ,EAAE,SAAkC;aAC5C,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAEhB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACJ,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACpD,CAAC;gBAAC,MAAM,CAAC;oBACR,SAAS;gBACV,CAAC;YACF,CAAC;YAED,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAEO,cAAc,CAAC,OAAgB,EAAE,KAAa;QACrD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,UAAU,GAAI,OAAmC,CAAC,KAAK,CAAC,CAAC;QAC/D,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;CACD,CAAA;~~AA/RY~~,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,YAAO,GAAE;qCAMiB,uBAAM;QACF,wBAAU;QACN,mBAAc;QACP,qDAAqB;QACpB,uDAAsB;QAC5B,uDAAyB;GAVjD,iBAAiB,~~CA+R7B~~"}
1	+ {"version":3,"file":"oauth-token.service.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+EAAoF;AAGpF,wDAA6C;AAC7C,8CAAsC;AACtC,gCAA0D;AAC1D,gCAAkC;AAClC,0CAA+C;AAC/C,iEAA6D;AAC7D,+CAA+C;AAC/C,6CAAsD;AAEtD,6FAA4E;AAC5E,+FAA8E;AAC9E,yGAA8F;AAC9F,2GAAgG;AAEhG,wFAAmF;AACnF,iDAAgF;AAEhF,wDAAoD;AAe7C,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAI7B,YACkB,MAAc,EACd,UAAsB,EACtB,cAA8B,EAC9B,qBAA4C,EAC5C,sBAA8C,EAC9C,gBAA2C;QAL3C,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAY;QACtB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,qBAAgB,GAAhB,gBAAgB,CAA2B;QAT5C,gCAA2B,GAAG,CAAC,GAAG,gBAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QACvD,4BAAuB,GAAG,EAAE,GAAG,gBAAI,CAAC,IAAI,CAAC,cAAc,CAAC;IAStE,CAAC;IAEJ,2BAA2B;QAC1B,OAAO,IAAI,CAAC,2BAA2B,CAAC;IACzC,CAAC;IAED,iBAAiB,CAChB,MAAc,EACd,QAAgB,EAChB,QAAiB;QAIjB,MAAM,QAAQ,GAAG,QAAQ,IAAI,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,EAAE,cAAc,EAAE,CAAC;QAC1F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,8BAAe,CACxB,0GAA0G,CAC1G,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACxC,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,QAAQ;YACb,SAAS,EAAE,QAAQ;YACnB,GAAG,EAAE,IAAA,wBAAU,GAAE;YACjB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,2BAA2B;YACrE,IAAI,EAAE;gBACL,OAAO,EAAE,IAAI;aACb;SACD,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAErD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,aAAa,CAClB,WAAmB,EACnB,YAAoB,EACpB,QAAgB,EAChB,MAAc;QAEd,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE;YACjF,MAAM,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE;gBAClE,KAAK,EAAE,WAAW;gBAClB,QAAQ;gBACR,MAAM;aACN,CAAC,CAAC;YAEH,MAAM,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE;gBACnE,KAAK,EAAE,YAAY;gBACnB,QAAQ;gBACR,MAAM;gBACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,uBAAuB;aACpD,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,6BAA6B,CAClC,YAAoB,EACpB,QAAgB,EAChB,QAAiB;QAEjB,OAAO,MAAM,IAAA,oBAAe,EAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,MAAM,kBAAkB,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,yCAAY,EAAE;gBAC1D,KAAK,EAAE;oBACN,KAAK,EAAE,YAAY;oBACnB,QAAQ;iBACR;aACD,CAAC,CAAC;YAIH,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACzB,MAAM,IAAI,6BAAiB,CAAC,uBAAuB,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,yCAAY,EAAE;gBAC7C,KAAK,EAAE,YAAY;gBACnB,QAAQ;gBACR,SAAS,EAAE,IAAA,yBAAe,EAAC,GAAG,CAAC;aAC/B,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;YACzC,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,6BAAiB,CAAC,uBAAuB,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAC5E,kBAAkB,CAAC,MAAM,EACzB,QAAQ,EACR,QAAQ,CACR,CAAC;YAEF,MAAM,GAAG,CAAC,MAAM,CAAC,uCAAW,EAAE;gBAC7B,KAAK,EAAE,WAAW;gBAClB,QAAQ;gBACR,MAAM,EAAE,kBAAkB,CAAC,MAAM;aACjC,CAAC,CAAC;YAEH,MAAM,GAAG,CAAC,MAAM,CAAC,yCAAY,EAAE;gBAC9B,KAAK,EAAE,eAAe;gBACtB,QAAQ;gBACR,MAAM,EAAE,kBAAkB,CAAC,MAAM;gBACjC,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,uBAAuB;aAC7C,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;gBACrE,QAAQ;gBACR,MAAM,EAAE,kBAAkB,CAAC,MAAM;aACjC,CAAC,CAAC;YAEH,OAAO;gBACN,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,IAAI,CAAC,2BAA2B;gBAC5C,aAAa,EAAE,eAAe;aAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,gBAAyB;QAC/D,OAAO,MAAM,IAAI,CAAC,wBAAwB,CACzC,KAAK,EACL,MAAM,IAAI,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAChD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,wBAAwB,CACrC,KAAa,EACb,gBAA0B;QAE1B,IAAI,OAAgB,CAAC;QAErB,IAAI,CAAC;YACJ,OAAO,GAAG,IAAI,CAAC,6BAA6B,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,mCAAoB,EAAE,CAAC;QAClC,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,mCAAoB,EAAE,CAAC;QAClC,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;YAClE,KAAK,EAAE,EAAE,KAAK,EAAE;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxB,MAAM,IAAI,uCAAwB,EAAE,CAAC;QACtC,CAAC;QAED,OAAO;YACN,KAAK;YACL,QAAQ;YACR,MAAM,EAAE,EAAE;YACV,KAAK,EAAE;gBACN,MAAM;aACN;SACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,gBAAyB;QACpE,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;YAKpE,IAAI,gBAAgB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC;YACtF,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,wBAAwB,CACnD,KAAK,EACL,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CACrD,CAAC;YAEF,MAAM,MAAM,GACX,QAAQ,CAAC,KAAK,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;gBACnD,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAC/C,CAAC,CAAC,IAAI,CAAC;YACT,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC;YAC5F,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;gBAC9C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;gBACrB,SAAS,EAAE,CAAC,MAAM,CAAC;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC;YAClF,CAAC;YAED,IAAI,QAAQ,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACnD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;oBACjE,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,gBAAgB;iBAChB,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC;YACtF,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,IAAA,0BAAW,EAAC,KAAK,CAAC,CAAC;YACxC,MAAM,MAAM,GACX,YAAY,YAAY,mCAAoB;gBAC3C,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,YAAY,YAAY,uCAAwB;oBACjD,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,eAAe,CAAC;YACrB,OAAO;gBACN,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE;oBACR,MAAM;oBACN,SAAS,EAAE,OAAO;oBAClB,aAAa,EAAE,YAAY,CAAC,OAAO;iBACnC;aACD,CAAC;QACH,CAAC;IACF,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,QAAgB;QACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;YACtD,KAAK;YACL,QAAQ;SACR,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,QAAgB;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC;YACvD,KAAK;YACL,QAAQ;SACR,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAWO,KAAK,CAAC,mBAAmB,CAAC,gBAAyB;QAC1D,MAAM,QAAQ,GAAG,gBAAgB;YAChC,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;YAChE,CAAC,CAAC,SAAS,CAAC;QACb,OAAO,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC9D,CAAC;IAOO,oBAAoB,CAC3B,QAAuC,EACvC,gBAAyB;QAEzB,IAAI,gBAAgB,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAChE,CAAC;QAKD,OAAO,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,CAAC;IAChD,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAClC,gBAAyB;QAEzB,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,CAAC;QACnD,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IACvE,CAAC;IAIO,6BAA6B,CAAC,KAAa,EAAE,SAAmB;QACvE,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE;gBACpC,QAAQ,EAAE,SAAkC;aAC5C,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAEhB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACJ,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACpD,CAAC;gBAAC,MAAM,CAAC;oBACR,SAAS;gBACV,CAAC;YACF,CAAC;YAED,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAEO,cAAc,CAAC,OAAgB,EAAE,KAAa;QACrD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,UAAU,GAAI,OAAmC,CAAC,KAAK,CAAC,CAAC;QAC/D,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;CACD,CAAA;AAnVY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,YAAO,GAAE;qCAMiB,uBAAM;QACF,wBAAU;QACN,mBAAc;QACP,qDAAqB;QACpB,uDAAsB;QAC5B,uDAAyB;GAVjD,iBAAiB,CAmV7B"}

package/dist/modules/oauth-server/protected-resource-resolvers/workflow-mcp-test-trigger-resource.resolver.d.ts CHANGED Viewed

@@ -1,14 +1,17 @@
 import type { ProtectedResourceResolver } from '../../../services/protected-resource.registry';
 import { UrlService } from '../../../services/url.service';
 import { TestWebhookRegistrationsService } from '../../../webhooks/test-webhook-registrations.service';
+import { WorkflowFinderService } from '../../../workflows/workflow-finder.service';
 import { Logger } from '@n8n/backend-common';
 import { GlobalConfig } from '@n8n/config';
+import { User } from '@n8n/db';
 export declare class WorkflowMcpTestTriggerResourceResolver implements ProtectedResourceResolver {
     private readonly config;
     private readonly registrations;
     private readonly urlService;
     private readonly logger;
-    constructor(config: GlobalConfig, registrations: TestWebhookRegistrationsService, urlService: UrlService, logger: Logger);
+    private readonly workflowFinderService;
+    constructor(config: GlobalConfig, registrations: TestWebhookRegistrationsService, urlService: UrlService, logger: Logger, workflowFinderService: WorkflowFinderService);
     readonly id = "workflow-mcp-test-trigger";
     readonly scopes: string[];
     resolveByUrl(resourceUrl: string): Promise<{
@@ -17,6 +20,7 @@ export declare class WorkflowMcpTestTriggerResourceResolver implements Protected
         getAudiences: () => string[];
         scopes: string[];
         displayName: string;
+        authorize: (user: User) => Promise<boolean>;
     } | undefined>;
     resolveByPath(pathname: string): Promise<{
         id: string;
@@ -24,5 +28,6 @@ export declare class WorkflowMcpTestTriggerResourceResolver implements Protected
         getAudiences: () => string[];
         scopes: string[];
         displayName: string;
+        authorize: (user: User) => Promise<boolean>;
     } | undefined>;
 }

package/dist/modules/oauth-server/protected-resource-resolvers/workflow-mcp-test-trigger-resource.resolver.js CHANGED Viewed

@@ -13,16 +13,18 @@ exports.WorkflowMcpTestTriggerResourceResolver = void 0;
 const constants_1 = require("../../../constants");
 const url_service_1 = require("../../../services/url.service");
 const test_webhook_registrations_service_1 = require("../../../webhooks/test-webhook-registrations.service");
+const workflow_finder_service_1 = require("../../../workflows/workflow-finder.service");
 const backend_common_1 = require("@n8n/backend-common");
 const config_1 = require("@n8n/config");
 const di_1 = require("@n8n/di");
 const utils_1 = require("./utils");
 let WorkflowMcpTestTriggerResourceResolver = class WorkflowMcpTestTriggerResourceResolver {
-    constructor(config, registrations, urlService, logger) {
+    constructor(config, registrations, urlService, logger, workflowFinderService) {
         this.config = config;
         this.registrations = registrations;
         this.urlService = urlService;
         this.logger = logger;
+        this.workflowFinderService = workflowFinderService;
         this.id = 'workflow-mcp-test-trigger';
         this.scopes = utils_1.WORKFLOW_MCP_TRIGGER_SCOPES;
     }
@@ -54,13 +56,20 @@ let WorkflowMcpTestTriggerResourceResolver = class WorkflowMcpTestTriggerResourc
         if (node.type === constants_1.MCP_TRIGGER_NODE_TYPE &&
             !node.disabled &&
             node.parameters.authentication === 'n8nOAuth2') {
-            const resourceUrl = `${(0, utils_1.trimTrailingSlash)(this.urlService.getTestWebhookBaseUrl())}/${this.config.endpoints.mcpTest}/${path}`;
+            const resourceUrl = `${(0, utils_1.trimTrailingSlash)(this.urlService.getWebhookBaseUrl())}/${this.config.endpoints.mcpTest}/${path}`;
+            const requireExecute = node.parameters.requireExecuteAccess !== false;
             return {
                 id: 'workflow-mcp-test:' + workflowEntity.id,
                 getResourceUrl: () => resourceUrl,
                 getAudiences: () => [resourceUrl],
                 scopes: utils_1.WORKFLOW_MCP_TRIGGER_SCOPES,
                 displayName: workflowEntity.name,
+                authorize: async (user) => {
+                    if (requireExecute) {
+                        return (await this.workflowFinderService.findWorkflowIdsWithScopeForUser([workflowEntity.id], user, ['workflow:execute'])).has(workflowEntity.id);
+                    }
+                    return true;
+                },
             };
         }
         this.logger.debug(`Node with name ${webhook.node} in test registration for workflow with ID: ${workflowEntity.id} is not an enabled MCP trigger with n8nOAuth2 authentication`);
@@ -73,6 +82,7 @@ exports.WorkflowMcpTestTriggerResourceResolver = WorkflowMcpTestTriggerResourceR
     __metadata("design:paramtypes", [config_1.GlobalConfig,
         test_webhook_registrations_service_1.TestWebhookRegistrationsService,
         url_service_1.UrlService,
-        backend_common_1.Logger])
+        backend_common_1.Logger,
+        workflow_finder_service_1.WorkflowFinderService])
 ], WorkflowMcpTestTriggerResourceResolver);
 //# sourceMappingURL=workflow-mcp-test-trigger-resource.resolver.js.map

package/dist/modules/oauth-server/protected-resource-resolvers/workflow-mcp-test-trigger-resource.resolver.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"workflow-mcp-test-trigger-resource.resolver.js","sourceRoot":"","sources":["../../../../src/modules/oauth-server/protected-resource-resolvers/workflow-mcp-test-trigger-resource.resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAoD;AAEpD,wDAAoD;AACpD,sGAAgG;AAChG,wDAA6C;AAC7C,wCAA2C;AAC3C,gCAAkC;AAElC,mCAKiB;~~AAGV~~,IAAM,sCAAsC,GAA5C,MAAM,sCAAsC;IAClD,YACkB,MAAoB,EACpB,aAA8C,EAC9C,UAAsB,EACtB,MAAc;~~QAHd~~,WAAM,GAAN,MAAM,CAAc;QACpB,kBAAa,GAAb,aAAa,CAAiC;QAC9C,eAAU,GAAV,UAAU,CAAY;QACtB,WAAM,GAAN,MAAM,CAAQ;~~QAGvB~~,OAAE,GAAG,2BAA2B,CAAC;QACjC,WAAM,GAAG,mCAA2B,CAAC;IAH3C,CAAC;IAKJ,KAAK,CAAC,YAAY,CAAC,WAAmB;QACrC,MAAM,QAAQ,GAAG,IAAA,gCAAwB,EAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC,CAAC;QAChG,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,WAAW,EAAE,CAAC,CAAC;YACpF,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB;QACnC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YAEhE,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,mBAAW,EAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAEnF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0DAA0D,IAAI,EAAE,CAAC,CAAC;QAMpF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAChD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CACtD,CAAC;QAEF,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,IAAI,EAAE,CAAC,CAAC;YAC1E,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC;QAEjD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAEvE,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,2BAA2B,OAAO,CAAC,IAAI,+CAA+C,cAAc,CAAC,EAAE,EAAE,CACzG,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,IACC,IAAI,CAAC,IAAI,KAAK,iCAAqB;YACnC,CAAC,IAAI,CAAC,QAAQ;YACd,IAAI,CAAC,UAAU,CAAC,cAAc,KAAK,WAAW,EAC7C,CAAC;YACF,MAAM,WAAW,GAAG,GAAG,IAAA,yBAAiB,EAAC,IAAI,CAAC,UAAU,CAAC,~~qBAAqB~~,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;~~YAC7H~~,OAAO;gBACN,EAAE,EAAE,oBAAoB,GAAG,cAAc,CAAC,EAAE;gBAC5C,cAAc,EAAE,GAAG,EAAE,CAAC,WAAW;gBACjC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC;gBACjC,MAAM,EAAE,mCAA2B;gBACnC,WAAW,EAAE,cAAc,CAAC,IAAI;~~aAChC~~,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,kBAAkB,OAAO,CAAC,IAAI,+CAA+C,cAAc,CAAC,EAAE,8DAA8D,CAC5J,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;CACD,CAAA;~~AA1EY~~,wFAAsC;iDAAtC,sCAAsC;IADlD,IAAA,YAAO,GAAE;qCAGiB,qBAAY;QACL,oEAA+B;QAClC,wBAAU;QACd,uBAAM;~~GALpB~~,sCAAsC,~~CA0ElD~~"}
1	+ {"version":3,"file":"workflow-mcp-test-trigger-resource.resolver.js","sourceRoot":"","sources":["../../../../src/modules/oauth-server/protected-resource-resolvers/workflow-mcp-test-trigger-resource.resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAoD;AAEpD,wDAAoD;AACpD,sGAAgG;AAChG,iFAA4E;AAC5E,wDAA6C;AAC7C,wCAA2C;AAC3C,gCAAkC;AAElC,mCAKiB;AAIV,IAAM,sCAAsC,GAA5C,MAAM,sCAAsC;IAClD,YACkB,MAAoB,EACpB,aAA8C,EAC9C,UAAsB,EACtB,MAAc,EACd,qBAA4C;QAJ5C,WAAM,GAAN,MAAM,CAAc;QACpB,kBAAa,GAAb,aAAa,CAAiC;QAC9C,eAAU,GAAV,UAAU,CAAY;QACtB,WAAM,GAAN,MAAM,CAAQ;QACd,0BAAqB,GAArB,qBAAqB,CAAuB;QAGrD,OAAE,GAAG,2BAA2B,CAAC;QACjC,WAAM,GAAG,mCAA2B,CAAC;IAH3C,CAAC;IAKJ,KAAK,CAAC,YAAY,CAAC,WAAmB;QACrC,MAAM,QAAQ,GAAG,IAAA,gCAAwB,EAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC,CAAC;QAChG,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,WAAW,EAAE,CAAC,CAAC;YACpF,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB;QACnC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YAEhE,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,mBAAW,EAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAEnF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0DAA0D,IAAI,EAAE,CAAC,CAAC;QAMpF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAChD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CACtD,CAAC;QAEF,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,IAAI,EAAE,CAAC,CAAC;YAC1E,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC;QAEjD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAEvE,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,2BAA2B,OAAO,CAAC,IAAI,+CAA+C,cAAc,CAAC,EAAE,EAAE,CACzG,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,IACC,IAAI,CAAC,IAAI,KAAK,iCAAqB;YACnC,CAAC,IAAI,CAAC,QAAQ;YACd,IAAI,CAAC,UAAU,CAAC,cAAc,KAAK,WAAW,EAC7C,CAAC;YACF,MAAM,WAAW,GAAG,GAAG,IAAA,yBAAiB,EAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YACzH,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,oBAAoB,KAAK,KAAK,CAAC;YACtE,OAAO;gBACN,EAAE,EAAE,oBAAoB,GAAG,cAAc,CAAC,EAAE;gBAC5C,cAAc,EAAE,GAAG,EAAE,CAAC,WAAW;gBACjC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC;gBACjC,MAAM,EAAE,mCAA2B;gBACnC,WAAW,EAAE,cAAc,CAAC,IAAI;gBAChC,SAAS,EAAE,KAAK,EAAE,IAAU,EAAE,EAAE;oBAC/B,IAAI,cAAc,EAAE,CAAC;wBACpB,OAAO,CACN,MAAM,IAAI,CAAC,qBAAqB,CAAC,+BAA+B,CAC/D,CAAC,cAAc,CAAC,EAAE,CAAC,EACnB,IAAI,EACJ,CAAC,kBAAkB,CAAC,CACpB,CACD,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;oBAC1B,CAAC;oBACD,OAAO,IAAI,CAAC;gBACb,CAAC;aACD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,kBAAkB,OAAO,CAAC,IAAI,+CAA+C,cAAc,CAAC,EAAE,8DAA8D,CAC5J,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;CACD,CAAA;AAxFY,wFAAsC;iDAAtC,sCAAsC;IADlD,IAAA,YAAO,GAAE;qCAGiB,qBAAY;QACL,oEAA+B;QAClC,wBAAU;QACd,uBAAM;QACS,+CAAqB;GANlD,sCAAsC,CAwFlD"}

package/dist/modules/oauth-server/protected-resource-resolvers/workflow-mcp-trigger-resource.resolver.d.ts CHANGED Viewed

@@ -1,16 +1,18 @@
 import type { ProtectedResourceResolver } from '../../../services/protected-resource.registry';
 import { UrlService } from '../../../services/url.service';
 import { WebhookService } from '../../../webhooks/webhook.service';
+import { WorkflowFinderService } from '../../../workflows/workflow-finder.service';
 import { Logger } from '@n8n/backend-common';
 import { GlobalConfig } from '@n8n/config';
-import { WorkflowRepository } from '@n8n/db';
+import { User, WorkflowRepository } from '@n8n/db';
 export declare class WorkflowMcpTriggerResourceResolver implements ProtectedResourceResolver {
     private readonly config;
     private readonly webhookService;
     private readonly workflowRepository;
     private readonly urlService;
     private readonly logger;
-    constructor(config: GlobalConfig, webhookService: WebhookService, workflowRepository: WorkflowRepository, urlService: UrlService, logger: Logger);
+    private readonly workflowFinderService;
+    constructor(config: GlobalConfig, webhookService: WebhookService, workflowRepository: WorkflowRepository, urlService: UrlService, logger: Logger, workflowFinderService: WorkflowFinderService);
     readonly id = "workflow-mcp-trigger";
     readonly scopes: string[];
     resolveByUrl(resourceUrl: string): Promise<{
@@ -19,6 +21,7 @@ export declare class WorkflowMcpTriggerResourceResolver implements ProtectedReso
         getAudiences: () => string[];
         scopes: string[];
         displayName: string;
+        authorize: (user: User) => Promise<boolean>;
     } | undefined>;
     resolveByPath(pathname: string): Promise<{
         id: string;
@@ -26,5 +29,6 @@ export declare class WorkflowMcpTriggerResourceResolver implements ProtectedReso
         getAudiences: () => string[];
         scopes: string[];
         displayName: string;
+        authorize: (user: User) => Promise<boolean>;
     } | undefined>;
 }

package/dist/modules/oauth-server/protected-resource-resolvers/workflow-mcp-trigger-resource.resolver.js CHANGED Viewed

@@ -13,18 +13,20 @@ exports.WorkflowMcpTriggerResourceResolver = void 0;
 const constants_1 = require("../../../constants");
 const url_service_1 = require("../../../services/url.service");
 const webhook_service_1 = require("../../../webhooks/webhook.service");
+const workflow_finder_service_1 = require("../../../workflows/workflow-finder.service");
 const backend_common_1 = require("@n8n/backend-common");
 const config_1 = require("@n8n/config");
 const db_1 = require("@n8n/db");
 const di_1 = require("@n8n/di");
 const utils_1 = require("./utils");
 let WorkflowMcpTriggerResourceResolver = class WorkflowMcpTriggerResourceResolver {
-    constructor(config, webhookService, workflowRepository, urlService, logger) {
+    constructor(config, webhookService, workflowRepository, urlService, logger, workflowFinderService) {
         this.config = config;
         this.webhookService = webhookService;
         this.workflowRepository = workflowRepository;
         this.urlService = urlService;
         this.logger = logger;
+        this.workflowFinderService = workflowFinderService;
         this.id = 'workflow-mcp-trigger';
         this.scopes = utils_1.WORKFLOW_MCP_TRIGGER_SCOPES;
     }
@@ -71,12 +73,19 @@ let WorkflowMcpTriggerResourceResolver = class WorkflowMcpTriggerResourceResolve
             !node.disabled &&
             node.parameters.authentication === 'n8nOAuth2') {
             const resourceUrl = `${(0, utils_1.trimTrailingSlash)(this.urlService.getWebhookBaseUrl())}/${this.config.endpoints.mcp}/${path}`;
+            const requireExecute = node.parameters.requireExecuteAccess !== false;
             return {
                 id: 'workflow-mcp:' + workflow.id,
                 getResourceUrl: () => resourceUrl,
                 getAudiences: () => [resourceUrl],
                 scopes: utils_1.WORKFLOW_MCP_TRIGGER_SCOPES,
                 displayName: workflow.name,
+                authorize: async (user) => {
+                    if (requireExecute) {
+                        return (await this.workflowFinderService.findWorkflowIdsWithScopeForUser([workflow.id], user, ['workflow:execute'])).has(workflow.id);
+                    }
+                    return true;
+                },
             };
         }
         this.logger.debug(`Node with name ${nodeName} in active version of workflow with ID: ${workflowId} is not an enabled MCP trigger with n8nOAuth2 authentication`);
@@ -90,6 +99,7 @@ exports.WorkflowMcpTriggerResourceResolver = WorkflowMcpTriggerResourceResolver
         webhook_service_1.WebhookService,
         db_1.WorkflowRepository,
         url_service_1.UrlService,
-        backend_common_1.Logger])
+        backend_common_1.Logger,
+        workflow_finder_service_1.WorkflowFinderService])
 ], WorkflowMcpTriggerResourceResolver);
 //# sourceMappingURL=workflow-mcp-trigger-resource.resolver.js.map

package/dist/modules/oauth-server/protected-resource-resolvers/workflow-mcp-trigger-resource.resolver.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"workflow-mcp-trigger-resource.resolver.js","sourceRoot":"","sources":["../../../../src/modules/oauth-server/protected-resource-resolvers/workflow-mcp-trigger-resource.resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAoD;AAEpD,wDAAoD;AACpD,gEAA4D;AAC5D,wDAA6C;AAC7C,wCAA2C;AAC3C,~~gCAA6C~~;~~AAC7C~~,gCAAkC;AAElC,mCAKiB;AAGV,IAAM,kCAAkC,GAAxC,MAAM,kCAAkC;IAC9C,YACkB,MAAoB,EACpB,cAA8B,EAC9B,kBAAsC,EACtC,UAAsB,EACtB,MAAc;~~QAJd~~,WAAM,GAAN,MAAM,CAAc;QACpB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,eAAU,GAAV,UAAU,CAAY;QACtB,WAAM,GAAN,MAAM,CAAQ;~~QAGvB~~,OAAE,GAAG,sBAAsB,CAAC;QAC5B,WAAM,GAAG,mCAA2B,CAAC;IAH3C,CAAC;IAKJ,KAAK,CAAC,YAAY,CAAC,WAAmB;QACrC,MAAM,QAAQ,GAAG,IAAA,gCAAwB,EAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC5F,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,WAAW,EAAE,CAAC,CAAC;YACpF,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB;QACnC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YAE5D,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,mBAAW,EAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAE/E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,IAAI,EAAE,CAAC,CAAC;QAK/E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE1E,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;YACxD,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YAGvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,oBAAoB,IAAI,qDAAqD,CAC7E,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAE/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;YACtD,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;YACzB,SAAS,EAAE;gBACV,aAAa,EAAE,IAAI;aACnB;SACD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,UAAU,EAAE,CAAC,CAAC;YACjF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAE3E,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,2BAA2B,QAAQ,2CAA2C,UAAU,EAAE,CAC1F,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,IACC,IAAI,CAAC,IAAI,KAAK,iCAAqB;YACnC,CAAC,IAAI,CAAC,QAAQ;YACd,IAAI,CAAC,UAAU,CAAC,cAAc,KAAK,WAAW,EAC7C,CAAC;YACF,MAAM,WAAW,GAAG,GAAG,IAAA,yBAAiB,EAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;YACrH,OAAO;gBACN,EAAE,EAAE,eAAe,GAAG,QAAQ,CAAC,EAAE;gBACjC,cAAc,EAAE,GAAG,EAAE,CAAC,WAAW;gBACjC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC;gBACjC,MAAM,EAAE,mCAA2B;gBACnC,WAAW,EAAE,QAAQ,CAAC,IAAI;~~aAC1B~~,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,kBAAkB,QAAQ,2CAA2C,UAAU,8DAA8D,CAC7I,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;CACD,CAAA;~~AA7FY~~,gFAAkC;6CAAlC,kCAAkC;IAD9C,IAAA,YAAO,GAAE;qCAGiB,qBAAY;QACJ,gCAAc;QACV,uBAAkB;QAC1B,wBAAU;QACd,uBAAM;~~GANpB~~,kCAAkC,~~CA6F9C~~"}
1	+ {"version":3,"file":"workflow-mcp-trigger-resource.resolver.js","sourceRoot":"","sources":["../../../../src/modules/oauth-server/protected-resource-resolvers/workflow-mcp-trigger-resource.resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAoD;AAEpD,wDAAoD;AACpD,gEAA4D;AAC5D,iFAA4E;AAC5E,wDAA6C;AAC7C,wCAA2C;AAC3C,gCAAmD;AACnD,gCAAkC;AAElC,mCAKiB;AAGV,IAAM,kCAAkC,GAAxC,MAAM,kCAAkC;IAC9C,YACkB,MAAoB,EACpB,cAA8B,EAC9B,kBAAsC,EACtC,UAAsB,EACtB,MAAc,EACd,qBAA4C;QAL5C,WAAM,GAAN,MAAM,CAAc;QACpB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,eAAU,GAAV,UAAU,CAAY;QACtB,WAAM,GAAN,MAAM,CAAQ;QACd,0BAAqB,GAArB,qBAAqB,CAAuB;QAGrD,OAAE,GAAG,sBAAsB,CAAC;QAC5B,WAAM,GAAG,mCAA2B,CAAC;IAH3C,CAAC;IAKJ,KAAK,CAAC,YAAY,CAAC,WAAmB;QACrC,MAAM,QAAQ,GAAG,IAAA,gCAAwB,EAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC5F,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,WAAW,EAAE,CAAC,CAAC;YACpF,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB;QACnC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YAE5D,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,mBAAW,EAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAE/E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,IAAI,EAAE,CAAC,CAAC;QAK/E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE1E,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;YACxD,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YAGvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,oBAAoB,IAAI,qDAAqD,CAC7E,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAE/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;YACtD,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;YACzB,SAAS,EAAE;gBACV,aAAa,EAAE,IAAI;aACnB;SACD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,UAAU,EAAE,CAAC,CAAC;YACjF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAE3E,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,2BAA2B,QAAQ,2CAA2C,UAAU,EAAE,CAC1F,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,IACC,IAAI,CAAC,IAAI,KAAK,iCAAqB;YACnC,CAAC,IAAI,CAAC,QAAQ;YACd,IAAI,CAAC,UAAU,CAAC,cAAc,KAAK,WAAW,EAC7C,CAAC;YACF,MAAM,WAAW,GAAG,GAAG,IAAA,yBAAiB,EAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;YACrH,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,oBAAoB,KAAK,KAAK,CAAC;YACtE,OAAO;gBACN,EAAE,EAAE,eAAe,GAAG,QAAQ,CAAC,EAAE;gBACjC,cAAc,EAAE,GAAG,EAAE,CAAC,WAAW;gBACjC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC;gBACjC,MAAM,EAAE,mCAA2B;gBACnC,WAAW,EAAE,QAAQ,CAAC,IAAI;gBAC1B,SAAS,EAAE,KAAK,EAAE,IAAU,EAAE,EAAE;oBAC/B,IAAI,cAAc,EAAE,CAAC;wBACpB,OAAO,CACN,MAAM,IAAI,CAAC,qBAAqB,CAAC,+BAA+B,CAC/D,CAAC,QAAQ,CAAC,EAAE,CAAC,EACb,IAAI,EACJ,CAAC,kBAAkB,CAAC,CACpB,CACD,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBACpB,CAAC;oBACD,OAAO,IAAI,CAAC;gBACb,CAAC;aACD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,kBAAkB,QAAQ,2CAA2C,UAAU,8DAA8D,CAC7I,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;CACD,CAAA;AA3GY,gFAAkC;6CAAlC,kCAAkC;IAD9C,IAAA,YAAO,GAAE;qCAGiB,qBAAY;QACJ,gCAAc;QACV,uBAAkB;QAC1B,wBAAU;QACd,uBAAM;QACS,+CAAqB;GAPlD,kCAAkC,CA2G9C"}

package/dist/modules/provisioning.ee/provisioning.service.ee.js CHANGED Viewed

@@ -16,6 +16,7 @@ const config_1 = require("@n8n/config");
 const db_1 = require("@n8n/db");
 const decorators_1 = require("@n8n/decorators");
 const di_1 = require("@n8n/di");
+const permissions_1 = require("@n8n/permissions");
 const typeorm_1 = require("@n8n/typeorm");
 const n8n_core_1 = require("n8n-core");
 const n8n_workflow_1 = require("n8n-workflow");
@@ -58,7 +59,7 @@ let ProvisioningService = class ProvisioningService {
         if (!(await this.isInstanceRoleProvisioningEnabled())) {
             return;
         }
-        const globalOwnerRoleSlug = 'global:owner';
+        const globalOwnerRoleSlug = permissions_1.GLOBAL_OWNER_ROLE_SLUG;
         if (typeof roleSlug !== 'string') {
             this.logger.warn(`skipping instance role provisioning. Invalid role type: expected string, received ${typeof roleSlug}`, {
                 userId: user.id,
@@ -78,6 +79,10 @@ let ProvisioningService = class ProvisioningService {
             this.logger.warn(`Skipping instance role provisioning. Role ${roleSlug} is not a global role`, { userId: user.id, roleSlug });
             return;
         }
+        if (dbRole.slug === globalOwnerRoleSlug && user.role.slug !== globalOwnerRoleSlug) {
+            this.logger.warn(`Skipping instance role provisioning. Cannot assign owner role: ${globalOwnerRoleSlug} to user: ${user.id}`, { userId: user.id, roleSlug });
+            return;
+        }
         if (user.role.slug === globalOwnerRoleSlug && dbRole.slug !== globalOwnerRoleSlug) {
             const otherOwners = await this.userRepository.count({
                 where: { role: { slug: globalOwnerRoleSlug }, id: (0, typeorm_1.Not)(user.id) },
@@ -388,10 +393,13 @@ let ProvisioningService = class ProvisioningService {
             this.logger.warn(`Expression mapping: skipping instance role, "${instanceRoleSlug}" is not a global role`, { userId: user.id });
             return;
         }
-        const globalOwnerRoleSlug = 'global:owner';
-        if (user.role.slug === globalOwnerRoleSlug && dbRole.slug !== globalOwnerRoleSlug) {
+        if (dbRole.slug === permissions_1.GLOBAL_OWNER_ROLE_SLUG && user.role.slug !== permissions_1.GLOBAL_OWNER_ROLE_SLUG) {
+            this.logger.warn(`Skipping instance role provisioning. Cannot assign owner role: ${permissions_1.GLOBAL_OWNER_ROLE_SLUG} to user: ${user.id}`, { userId: user.id, roleSlug: permissions_1.GLOBAL_OWNER_ROLE_SLUG });
+            return;
+        }
+        if (user.role.slug === permissions_1.GLOBAL_OWNER_ROLE_SLUG && dbRole.slug !== permissions_1.GLOBAL_OWNER_ROLE_SLUG) {
             const otherOwners = await this.userRepository.count({
-                where: { role: { slug: globalOwnerRoleSlug }, id: (0, typeorm_1.Not)(user.id) },
+                where: { role: { slug: permissions_1.GLOBAL_OWNER_ROLE_SLUG }, id: (0, typeorm_1.Not)(user.id) },
             });
             if (otherOwners === 0) {
                 this.logger.warn('Expression mapping: skipping instance role update, cannot demote last owner', { userId: user.id });