n8n 2.31.5 → 2.32.1

package/dist/modules/oauth-server/oauth-server.module.js

@@ -1,43 +1,10 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OAuthServerModule = void 0;
 const protected_resource_registry_1 = require("../../services/protected-resource.registry");
@@ -47,24 +14,24 @@ const n8n_core_1 = require("n8n-core");
 let OAuthServerModule = class OAuthServerModule {
     async init() {
         if (di_1.Container.get(n8n_core_1.InstanceSettings).instanceType === 'main') {
-            await Promise.resolve().then(() => __importStar(require('./oauth.controller')));
-            await Promise.resolve().then(() => __importStar(require('./oauth-consent.controller')));
-            await Promise.resolve().then(() => __importStar(require('./oauth-clients.controller')));
+            await import('./oauth.controller.js');
+            await import('./oauth-consent.controller.js');
+            await import('./oauth-clients.controller.js');
         }
-        const { OAuthTokenVerifierProxy } = await Promise.resolve().then(() => __importStar(require('../../services/oauth-token-verifier-proxy.service')));
-        const { OAuthTokenService } = await Promise.resolve().then(() => __importStar(require('./oauth-token.service')));
+        const { OAuthTokenVerifierProxy } = await import('../../services/oauth-token-verifier-proxy.service.js');
+        const { OAuthTokenService } = await import('./oauth-token.service.js');
         di_1.Container.get(OAuthTokenVerifierProxy).registerProvider(di_1.Container.get(OAuthTokenService));
-        const { WorkflowMcpTriggerResourceResolver } = await Promise.resolve().then(() => __importStar(require('./protected-resource-resolvers/workflow-mcp-trigger-resource.resolver')));
+        const { WorkflowMcpTriggerResourceResolver } = await import('./protected-resource-resolvers/workflow-mcp-trigger-resource.resolver.js');
         di_1.Container.get(protected_resource_registry_1.ProtectedResourceRegistry).registerResolver(di_1.Container.get(WorkflowMcpTriggerResourceResolver));
-        const { WorkflowMcpTestTriggerResourceResolver } = await Promise.resolve().then(() => __importStar(require('./protected-resource-resolvers/workflow-mcp-test-trigger-resource.resolver')));
+        const { WorkflowMcpTestTriggerResourceResolver } = await import('./protected-resource-resolvers/workflow-mcp-test-trigger-resource.resolver.js');
         di_1.Container.get(protected_resource_registry_1.ProtectedResourceRegistry).registerResolver(di_1.Container.get(WorkflowMcpTestTriggerResourceResolver));
     }
     async entities() {
-        const { OAuthClient } = await Promise.resolve().then(() => __importStar(require('./database/entities/oauth-client.entity')));
-        const { AuthorizationCode } = await Promise.resolve().then(() => __importStar(require('./database/entities/oauth-authorization-code.entity')));
-        const { AccessToken } = await Promise.resolve().then(() => __importStar(require('./database/entities/oauth-access-token.entity')));
-        const { RefreshToken } = await Promise.resolve().then(() => __importStar(require('./database/entities/oauth-refresh-token.entity')));
-        const { UserConsent } = await Promise.resolve().then(() => __importStar(require('./database/entities/oauth-user-consent.entity')));
+        const { OAuthClient } = await import('./database/entities/oauth-client.entity.js');
+        const { AuthorizationCode } = await import('./database/entities/oauth-authorization-code.entity.js');
+        const { AccessToken } = await import('./database/entities/oauth-access-token.entity.js');
+        const { RefreshToken } = await import('./database/entities/oauth-refresh-token.entity.js');
+        const { UserConsent } = await import('./database/entities/oauth-user-consent.entity.js');
         return [OAuthClient, AuthorizationCode, AccessToken, RefreshToken, UserConsent];
     }
 };

package/dist/modules/oauth-server/oauth-server.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-server.module.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth-server.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,wFAAmF;AAEnF,gDAAgD;AAChD,gCAAoC;AACpC,uCAA4C;AAerC,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC7B,KAAK,CAAC,IAAI;QAET,IAAI,cAAS,CAAC,GAAG,CAAC,2BAAgB,CAAC,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YAC7D,wDAAa,oBAAoB,GAAC,CAAC;YACnC,wDAAa,4BAA4B,GAAC,CAAC;YAC3C,wDAAa,4BAA4B,GAAC,CAAC;QAC5C,CAAC;QAKD,MAAM,EAAE,uBAAuB,EAAE,GAAG,wDACnC,+CAA+C,GAC/C,CAAC;QACF,MAAM,EAAE,iBAAiB,EAAE,GAAG,wDAAa,uBAAuB,GAAC,CAAC;QACpE,cAAS,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,gBAAgB,CAAC,cAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAE1F,MAAM,EAAE,kCAAkC,EAAE,GAAG,wDAC9C,uEAAuE,GACvE,CAAC;QACF,cAAS,CAAC,GAAG,CAAC,uDAAyB,CAAC,CAAC,gBAAgB,CACxD,cAAS,CAAC,GAAG,CAAC,kCAAkC,CAAC,CACjD,CAAC;QAEF,MAAM,EAAE,sCAAsC,EAAE,GAAG,wDAClD,4EAA4E,GAC5E,CAAC;QACF,cAAS,CAAC,GAAG,CAAC,uDAAyB,CAAC,CAAC,gBAAgB,CACxD,cAAS,CAAC,GAAG,CAAC,sCAAsC,CAAC,CACrD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACb,MAAM,EAAE,WAAW,EAAE,GAAG,wDAAa,yCAAyC,GAAC,CAAC;QAChF,MAAM,EAAE,iBAAiB,EAAE,GAAG,wDAC7B,qDAAqD,GACrD,CAAC;QACF,MAAM,EAAE,WAAW,EAAE,GAAG,wDAAa,+CAA+C,GAAC,CAAC;QACtF,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,gDAAgD,GAAC,CAAC;QACxF,MAAM,EAAE,WAAW,EAAE,GAAG,wDAAa,+CAA+C,GAAC,CAAC;QAEtF,OAAO,CAAC,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;IAC1F,CAAC;CACD,CAAA;AA5CY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,0BAAa,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;GACzE,iBAAiB,CA4C7B"}
+{"version":3,"file":"oauth-server.module.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth-server.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,wFAAmF;AAEnF,gDAAgD;AAChD,gCAAoC;AACpC,uCAA4C;AAerC,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC7B,KAAK,CAAC,IAAI;QAET,IAAI,cAAS,CAAC,GAAG,CAAC,2BAAgB,CAAC,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YAC7D,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YACtC,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;YAC9C,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;QAC/C,CAAC;QAKD,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAC/C,kDAAkD,CAClD,CAAC;QACF,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACvE,cAAS,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,gBAAgB,CAAC,cAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAE1F,MAAM,EAAE,kCAAkC,EAAE,GAAG,MAAM,MAAM,CAC1D,0EAA0E,CAC1E,CAAC;QACF,cAAS,CAAC,GAAG,CAAC,uDAAyB,CAAC,CAAC,gBAAgB,CACxD,cAAS,CAAC,GAAG,CAAC,kCAAkC,CAAC,CACjD,CAAC;QAEF,MAAM,EAAE,sCAAsC,EAAE,GAAG,MAAM,MAAM,CAC9D,+EAA+E,CAC/E,CAAC;QACF,cAAS,CAAC,GAAG,CAAC,uDAAyB,CAAC,CAAC,gBAAgB,CACxD,cAAS,CAAC,GAAG,CAAC,sCAAsC,CAAC,CACrD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACb,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,4CAA4C,CAAC,CAAC;QACnF,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CACzC,wDAAwD,CACxD,CAAC;QACF,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,kDAAkD,CAAC,CAAC;QACzF,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,mDAAmD,CAAC,CAAC;QAC3F,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,kDAAkD,CAAC,CAAC;QAEzF,OAAO,CAAC,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;IAC1F,CAAC;CACD,CAAA;;4BA5CY,iBAAiB;IAD7B,IAAA,0BAAa,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;GACzE,iBAAiB,CA4C7B"}

package/dist/modules/oauth-server/oauth-server.service.d.ts

@@ -1,17 +1,44 @@
-import type { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients';
-import type { AuthorizationParams, OAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/provider';
-import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types';
-import type { OAuthClientInformationFull, OAuthTokens, OAuthTokenRevocationRequest } from '@modelcontextprotocol/sdk/shared/auth';
+import type { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients.js';
+import type { AuthorizationParams, OAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/provider.js';
+import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
+import type { OAuthClientInformationFull, OAuthTokens, OAuthTokenRevocationRequest } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { McpClientConnectedPeriod, McpClientTypeFilter } from '@n8n/api-types';
 import { Logger } from '@n8n/backend-common';
 import { GlobalConfig } from '@n8n/config';
+import type { User } from '@n8n/db';
 import type { Response } from 'express';
+import { ProtectedResourceRegistry } from '../../services/protected-resource.registry';
 import { OAuthClient } from './database/entities/oauth-client.entity';
 import { OAuthClientRepository } from './database/repositories/oauth-client.repository';
 import { UserConsentRepository } from './database/repositories/oauth-user-consent.repository';
 import { OAuthAuthorizationCodeService } from './oauth-authorization-code.service';
 import { OAuthSessionService } from './oauth-session.service';
 import { OAuthTokenService } from './oauth-token.service';
-import { ProtectedResourceRegistry } from '../../services/protected-resource.registry';
+import { UserManagementMailer } from '../../user-management/email';
+export type ConnectedOAuthClientOwner = {
+    id: string;
+    firstName: string | null;
+    lastName: string | null;
+    email: string;
+};
+export type ConnectedOAuthClient = Omit<OAuthClient, 'clientSecret' | 'clientSecretExpiresAt' | 'setUpdateDate'> & {
+    grantedAt: number;
+    scopes: string[];
+    owner?: ConnectedOAuthClientOwner;
+};
+export type ConnectedOAuthClientTotals = {
+    mine: number;
+    all?: number;
+};
+export type ListConnectedClientsOptions = {
+    ownership?: 'mine' | 'all';
+    skip?: number;
+    take?: number;
+    name?: string;
+    ownerId?: string;
+    type?: McpClientTypeFilter;
+    connected?: McpClientConnectedPeriod;
+};
 export declare class OAuthServerService implements OAuthServerProvider {
     private readonly logger;
     private readonly globalConfig;
@@ -21,7 +48,8 @@ export declare class OAuthServerService implements OAuthServerProvider {
     private readonly authorizationCodeService;
     private readonly userConsentRepository;
     private readonly resourceRegistry;
-    constructor(logger: Logger, globalConfig: GlobalConfig, oauthSessionService: OAuthSessionService, oauthClientRepository: OAuthClientRepository, tokenService: OAuthTokenService, authorizationCodeService: OAuthAuthorizationCodeService, userConsentRepository: UserConsentRepository, resourceRegistry: ProtectedResourceRegistry);
+    private readonly mailer;
+    constructor(logger: Logger, globalConfig: GlobalConfig, oauthSessionService: OAuthSessionService, oauthClientRepository: OAuthClientRepository, tokenService: OAuthTokenService, authorizationCodeService: OAuthAuthorizationCodeService, userConsentRepository: UserConsentRepository, resourceRegistry: ProtectedResourceRegistry, mailer: UserManagementMailer);
     get clientsStore(): OAuthRegisteredClientsStore;
     isClientLimitReached(): Promise<boolean>;
     getInstanceClientStats(): Promise<{
@@ -40,6 +68,12 @@ export declare class OAuthServerService implements OAuthServerProvider {
     verifyAccessToken(token: string): Promise<AuthInfo>;
     private resolveAndValidateResourceIndicator;
     revokeToken(client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
-    getAllClients(userId: string): Promise<Array<Omit<OAuthClient, 'clientSecret' | 'clientSecretExpiresAt' | 'setUpdateDate'>>>;
-    deleteClient(clientId: string, userId: string): Promise<void>;
+    getAllClients(user: User, options?: ListConnectedClientsOptions): Promise<{
+        clients: ConnectedOAuthClient[];
+        count: number;
+        totals: ConnectedOAuthClientTotals;
+        owners?: ConnectedOAuthClientOwner[];
+    }>;
+    getInstanceScopeTools(): Record<string, string[]> | undefined;
+    deleteClient(clientId: string, userId: string, revoker?: User): Promise<void>;
 }

package/dist/modules/oauth-server/oauth-server.service.js

@@ -11,20 +11,36 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OAuthServerService = void 0;
 const errors_js_1 = require("@modelcontextprotocol/sdk/server/auth/errors.js");
+const api_types_1 = require("@n8n/api-types");
 const backend_common_1 = require("@n8n/backend-common");
 const config_1 = require("@n8n/config");
 const di_1 = require("@n8n/di");
+const permissions_1 = require("@n8n/permissions");
+const protected_resource_registry_1 = require("../../services/protected-resource.registry");
+const oauth_client_entity_1 = require("./database/entities/oauth-client.entity");
 const oauth_client_repository_1 = require("./database/repositories/oauth-client.repository");
 const oauth_user_consent_repository_1 = require("./database/repositories/oauth-user-consent.repository");
 const oauth_authorization_code_service_1 = require("./oauth-authorization-code.service");
 const oauth_session_service_1 = require("./oauth-session.service");
 const oauth_token_service_1 = require("./oauth-token.service");
 const oauth_errors_1 = require("./oauth.errors");
-const protected_resource_registry_1 = require("../../services/protected-resource.registry");
+const forbidden_error_1 = require("../../errors/response-errors/forbidden.error");
+const email_1 = require("../../user-management/email");
 const MAX_REDIRECT_URIS = 10;
+function matchesTypeFilter(name, type) {
+    const clientType = (0, api_types_1.getMcpClientType)(name);
+    return clientType !== null && api_types_1.MCP_CLIENT_TYPE_FILTER_BUCKETS[type].includes(clientType);
+}
+function sortOwners(owners) {
+    return [...owners].sort((a, b) => {
+        const nameA = [a.firstName, a.lastName].filter(Boolean).join(' ') || a.email;
+        const nameB = [b.firstName, b.lastName].filter(Boolean).join(' ') || b.email;
+        return nameA.localeCompare(nameB);
+    });
+}
 const MAX_REDIRECT_URI_LENGTH = 2048;
 let OAuthServerService = class OAuthServerService {
-    constructor(logger, globalConfig, oauthSessionService, oauthClientRepository, tokenService, authorizationCodeService, userConsentRepository, resourceRegistry) {
+    constructor(logger, globalConfig, oauthSessionService, oauthClientRepository, tokenService, authorizationCodeService, userConsentRepository, resourceRegistry, mailer) {
         this.logger = logger;
         this.globalConfig = globalConfig;
         this.oauthSessionService = oauthSessionService;
@@ -33,6 +49,7 @@ let OAuthServerService = class OAuthServerService {
         this.authorizationCodeService = authorizationCodeService;
         this.userConsentRepository = userConsentRepository;
         this.resourceRegistry = resourceRegistry;
+        this.mailer = mailer;
     }
     get clientsStore() {
         return {
@@ -161,12 +178,15 @@ let OAuthServerService = class OAuthServerService {
                 });
                 return;
             }
+            const supportedScopes = targetResource?.scopes ?? [];
+            const requestedScopes = params.scopes?.filter((scope) => supportedScopes.includes(scope));
             this.oauthSessionService.createSession(res, {
                 clientId: client.client_id,
                 redirectUri: params.redirectUri,
                 codeChallenge: params.codeChallenge,
                 state: params.state ?? null,
                 resource,
+                ...(requestedScopes && requestedScopes.length > 0 && { requestedScopes }),
             });
             res.redirect('/oauth/consent');
         }
@@ -211,13 +231,15 @@ let OAuthServerService = class OAuthServerService {
             finalResource = tokenResource ?? codeResource;
         }
         await this.authorizationCodeService.markAuthorizationCodeAsUsed(authorizationCode);
-        const { accessToken, refreshToken } = this.tokenService.generateTokenPair(authRecord.userId, client.client_id, finalResource);
-        await this.tokenService.saveTokenPair(accessToken, refreshToken, client.client_id, authRecord.userId);
+        const grantedScopes = authRecord.scope;
+        const { accessToken, refreshToken } = this.tokenService.generateTokenPair(authRecord.userId, client.client_id, finalResource, grantedScopes);
+        await this.tokenService.saveTokenPair(accessToken, refreshToken, client.client_id, authRecord.userId, grantedScopes);
         return {
             access_token: accessToken,
             token_type: 'Bearer',
             expires_in: this.tokenService.getAccessTokenExpirySeconds(),
             refresh_token: refreshToken,
+            scope: grantedScopes.join(' '),
         };
     }
     async exchangeRefreshToken(client, refreshToken, _scopes, resource) {
@@ -260,43 +282,118 @@ let OAuthServerService = class OAuthServerService {
             clientId: client.client_id,
         });
     }
-    async getAllClients(userId) {
-        const userConsents = await this.userConsentRepository.findByUserWithClient(userId);
-        return userConsents.map((consent) => {
+    async getAllClients(user, options = {}) {
+        const canSeeAll = (0, permissions_1.hasGlobalScope)(user, 'mcp:manage');
+        const listAll = options.ownership === 'all';
+        if (listAll && !canSeeAll) {
+            throw new forbidden_error_1.ForbiddenError('You are not allowed to list connected clients of other users');
+        }
+        let clientIds;
+        if (options.type) {
+            const registered = await this.oauthClientRepository.find({
+                select: { id: true, name: true },
+            });
+            clientIds = registered
+                .filter((client) => matchesTypeFilter(client.name, options.type))
+                .map((client) => client.id);
+        }
+        const { rows: consents, total } = clientIds?.length === 0
+            ? { rows: [], total: 0 }
+            : await this.userConsentRepository.findConnectedClients({
+                userId: listAll ? undefined : user.id,
+                withOwner: listAll,
+                name: options.name,
+                ownerId: listAll ? options.ownerId : undefined,
+                clientIds,
+                connected: options.connected,
+                now: Date.now(),
+                skip: options.skip,
+                take: options.take,
+            });
+        const clients = consents.map((consent) => {
             const { clientSecret, clientSecretExpiresAt, ...sanitizedClient } = consent.client;
-            return sanitizedClient;
+            return {
+                ...sanitizedClient,
+                grantedAt: Number(consent.grantedAt),
+                scopes: consent.scope,
+                ...(listAll
+                    ? {
+                        owner: {
+                            id: consent.user.id,
+                            firstName: consent.user.firstName ?? null,
+                            lastName: consent.user.lastName ?? null,
+                            email: consent.user.email,
+                        },
+                    }
+                    : {}),
+            };
         });
+        const count = total;
+        const [consentOwners, mineCount, allCount] = await Promise.all([
+            listAll ? this.userConsentRepository.findConsentOwners() : undefined,
+            this.userConsentRepository.countBy({ userId: user.id }),
+            canSeeAll ? this.userConsentRepository.count() : undefined,
+        ]);
+        const owners = consentOwners ? sortOwners(consentOwners) : undefined;
+        const totals = { mine: mineCount };
+        if (allCount !== undefined) {
+            totals.all = allCount;
+        }
+        return { clients, count, totals, owners };
     }
-    async deleteClient(clientId, userId) {
+    getInstanceScopeTools() {
+        return this.resourceRegistry.getDefaultResource()?.getScopeTools?.();
+    }
+    async deleteClient(clientId, userId, revoker) {
         const client = await this.oauthClientRepository.findOne({
             where: { id: clientId },
         });
         if (!client) {
             throw new Error(`OAuth client with ID ${clientId} not found`);
         }
-        const consent = await this.userConsentRepository.findOneBy({ clientId, userId });
+        const consent = await this.userConsentRepository.findOne({
+            where: { clientId, userId },
+            relations: ['user'],
+        });
         if (!consent) {
             throw new Error(`OAuth client with ID ${clientId} not found`);
         }
-        this.logger.info('Deleting OAuth client and related data', { clientId });
-        await this.oauthClientRepository.delete({ id: clientId });
-        this.logger.info('OAuth client deleted successfully', {
-            clientId,
-            clientName: client.name,
-        });
+        this.logger.info('Revoking OAuth client access for user', { clientId, userId });
+        await Promise.all([
+            this.tokenService.revokeAllTokensForGrant(clientId, userId),
+            this.authorizationCodeService.deleteForGrant(clientId, userId),
+            this.userConsentRepository.delete({ clientId, userId }),
+        ]);
+        const consentsTable = this.userConsentRepository.metadata.tableName;
+        const result = await this.oauthClientRepository
+            .createQueryBuilder()
+            .delete()
+            .from(oauth_client_entity_1.OAuthClient)
+            .where(`id = :clientId AND NOT EXISTS (SELECT 1 FROM ${consentsTable} WHERE "clientId" = :clientId)`, { clientId })
+            .execute();
+        if (result.affected && result.affected > 0) {
+            this.logger.info('OAuth client deleted after last consent was revoked', {
+                clientId,
+                clientName: client.name,
+            });
+        }
+        if (revoker && revoker.id !== userId) {
+            this.mailer
+                .notifyMcpClientRevoked({ clientName: client.name, owner: consent.user, revoker })
+                .catch((e) => {
+                this.logger.error('Failed to send MCP client revocation email', {
+                    clientId,
+                    ownerId: userId,
+                    error: e instanceof Error ? e.message : String(e),
+                });
+            });
+        }
     }
 };
 exports.OAuthServerService = OAuthServerService;
 exports.OAuthServerService = OAuthServerService = __decorate([
     (0, di_1.Service)(),
-    __metadata("design:paramtypes", [backend_common_1.Logger,
-        config_1.GlobalConfig,
-        oauth_session_service_1.OAuthSessionService,
-        oauth_client_repository_1.OAuthClientRepository,
-        oauth_token_service_1.OAuthTokenService,
-        oauth_authorization_code_service_1.OAuthAuthorizationCodeService,
-        oauth_user_consent_repository_1.UserConsentRepository,
-        protected_resource_registry_1.ProtectedResourceRegistry])
+    __metadata("design:paramtypes", [backend_common_1.Logger, config_1.GlobalConfig, oauth_session_service_1.OAuthSessionService, oauth_client_repository_1.OAuthClientRepository, oauth_token_service_1.OAuthTokenService, oauth_authorization_code_service_1.OAuthAuthorizationCodeService, oauth_user_consent_repository_1.UserConsentRepository, protected_resource_registry_1.ProtectedResourceRegistry, email_1.UserManagementMailer])
 ], OAuthServerService);
 class InvalidResourceIndicatorError extends errors_js_1.InvalidTargetError {
     constructor(resource, expectedResource) {

package/dist/modules/oauth-server/oauth-server.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-server.service.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth-server.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+EAGyD;AAWzD,wDAA6C;AAC7C,wCAA2C;AAC3C,gCAAkC;AAIlC,6FAAwF;AACxF,yGAA8F;AAC9F,yFAAmF;AACnF,mEAA8D;AAC9D,+DAA0D;AAC1D,iDAA8D;AAC9D,wFAAmF;AAGnF,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAG7B,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAO9B,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC9B,YACkB,MAAc,EACd,YAA0B,EAC1B,mBAAwC,EACxC,qBAA4C,EAC5C,YAA+B,EAC/B,wBAAuD,EACvD,qBAA4C,EAC5C,gBAA2C;QAP3C,WAAM,GAAN,MAAM,CAAQ;QACd,iBAAY,GAAZ,YAAY,CAAc;QAC1B,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,iBAAY,GAAZ,YAAY,CAAmB;QAC/B,6BAAwB,GAAxB,wBAAwB,CAA+B;QACvD,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,qBAAgB,GAAhB,gBAAgB,CAA2B;IAC1D,CAAC;IAEJ,IAAI,YAAY;QACf,OAAO;YACN,SAAS,EAAE,KAAK,EAAE,QAAgB,EAAmD,EAAE;gBACtF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;oBACb,OAAO,SAAS,CAAC;gBAClB,CAAC;gBAKD,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;gBAE7D,OAAO;oBACN,SAAS,EAAE,MAAM,CAAC,EAAE;oBACpB,WAAW,EAAE,MAAM,CAAC,IAAI;oBACxB,aAAa,EAAE,MAAM,CAAC,YAAY;oBAClC,WAAW,EAAE,MAAM,CAAC,UAAU;oBAC9B,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;oBAC1D,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;oBAClE,GAAG,CAAC,MAAM,CAAC,qBAAqB,IAAI;wBACnC,wBAAwB,EAAE,MAAM,CAAC,qBAAqB;qBACtD,CAAC;oBACF,cAAc,EAAE,CAAC,MAAM,CAAC;oBACxB,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACvE,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,SAAS;iBAClB,CAAC;YACH,CAAC;YACD,cAAc,EAAE,KAAK,EACpB,MAAkC,EACI,EAAE;gBACxC,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;gBAExC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;oBACvC,EAAE,EAAE,MAAM,CAAC,SAAS;oBACpB,IAAI,EAAE,MAAM,CAAC,WAAW;oBACxB,YAAY,EAAE,MAAM,CAAC,aAAa;oBAClC,UAAU,EAAE,MAAM,CAAC,WAAW;oBAC9B,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;oBAC1C,qBAAqB,EAAE,MAAM,CAAC,wBAAwB,IAAI,IAAI;oBAC9D,uBAAuB,EAAE,MAAM,CAAC,0BAA0B,IAAI,MAAM;iBACpE,CAAC,CAAC;gBAEH,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAEhD,OAAO,MAAM,CAAC;YACf,CAAC;SACD,CAAC;IACH,CAAC;IAGD,KAAK,CAAC,oBAAoB;QACzB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;QAC7D,OAAO,WAAW,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,uBAAuB,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,sBAAsB;QAK3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,uBAAuB,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,IAAI,KAAK,EAAE,CAAC;IACrD,CAAC;IAUO,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QAChD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,uBAAuB,CAAC;QAClE,IAAI,WAAW,GAAG,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CACf,mFAAmF,EACnF,EAAE,KAAK,EAAE,WAAW,EAAE,CACtB,CAAC;YACF,MAAM,IAAI,2CAA4B,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;IAEO,0BAA0B,CAAC,MAAkC;QACpE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,0CAA0C,iBAAiB,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACxC,IAAI,GAAG,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACd,0CAA0C,uBAAuB,aAAa,CAC9E,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAWO,oBAAoB,CAAC,WAAqB,EAAE,WAAmB;QACtE,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,SAAc,CAAC;QACnB,IAAI,CAAC;YACJ,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACd,CAAC;QAED,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YACnC,IAAI,SAAc,CAAC;YACnB,IAAI,CAAC;gBACJ,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,KAAK,CAAC;YACd,CAAC;YAED,OAAO,CACN,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC;gBACvC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ;gBACzC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ;gBACzC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,CACzC,CAAC;QACH,CAAC,CAAC,CAAC;IACJ,CAAC;IAEO,cAAc,CAAC,QAAgB;QACtC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,SAAS,CACd,MAAkC,EAClC,MAA2B,EAC3B,GAAa;QAEb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAElF,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mCAAmC,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YAE7F,MAAM,cAAc,GAAG,QAAQ;gBAC9B,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,QAAQ,CAAC;gBACxD,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,CAAC;YAC9C,MAAM,WAAW,GAAG,CAAC,MAAM,cAAc,EAAE,sBAAsB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;YAC7E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC3F,IAAI,CAAC,MAAM,CAAC,IAAI,CACf,6FAA6F,EAC7F;oBACC,QAAQ,EAAE,MAAM,CAAC,SAAS;oBAC1B,YAAY,EAAE,MAAM,CAAC,WAAW;iBAChC,CACD,CAAC;gBACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACpB,KAAK,EAAE,iBAAiB;oBACxB,iBAAiB,EAAE,kCAAkC;iBACrD,CAAC,CAAC;gBACH,OAAO;YACR,CAAC;YAED,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,GAAG,EAAE;gBAC3C,QAAQ,EAAE,MAAM,CAAC,SAAS;gBAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;gBAC3B,QAAQ;aACR,CAAC,CAAC;YAEH,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,6BAA6B,EAAE,CAAC;gBACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6DAA6D,EAAE;oBAC/E,QAAQ,EAAE,MAAM,CAAC,SAAS;oBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;iBACxC,CAAC,CAAC;gBACH,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;gBAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACpB,KAAK,EAAE,gBAAgB;oBACvB,iBAAiB,EAAE,4BAA4B;iBAC/C,CAAC,CAAC;gBACH,OAAO;YACR,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACtF,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC7F,CAAC;IACF,CAAC;IAED,KAAK,CAAC,6BAA6B,CAClC,MAAkC,EAClC,iBAAyB;QAEzB,OAAO,MAAM,IAAI,CAAC,wBAAwB,CAAC,gBAAgB,CAC1D,iBAAiB,EACjB,MAAM,CAAC,SAAS,CAChB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC9B,MAAkC,EAClC,iBAAyB,EACzB,aAAsB,EACtB,WAAoB,EACpB,QAAc;QAEd,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,qBAAqB,CAC3E,iBAAiB,EACjB,MAAM,CAAC,SAAS,EAChB,WAAW,CACX,CAAC;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,IAAI,6BAAiB,CAAC,4BAA4B,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACzC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC;QAKlF,IAAI,aAAiC,CAAC;QACtC,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,IAAI,SAAS,CAAC;QAEtD,IAAI,aAAa,IAAI,YAAY,EAAE,CAAC;YACnC,IAAI,aAAa,KAAK,YAAY,EAAE,CAAC;gBACpC,MAAM,IAAI,6BAA6B,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;YACtE,CAAC;YACD,aAAa,GAAG,aAAa,CAAC;QAC/B,CAAC;aAAM,CAAC;YACP,aAAa,GAAG,aAAa,IAAI,YAAY,CAAC;QAC/C,CAAC;QAED,MAAM,IAAI,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,CAAC;QAEnF,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CACxE,UAAU,CAAC,MAAM,EACjB,MAAM,CAAC,SAAS,EAChB,aAAa,CACb,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CACpC,WAAW,EACX,YAAY,EACZ,MAAM,CAAC,SAAS,EAChB,UAAU,CAAC,MAAM,CACjB,CAAC;QAEF,OAAO;YACN,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,2BAA2B,EAAE;YAC3D,aAAa,EAAE,YAAY;SAC3B,CAAC;IACH,CAAC;IAKD,KAAK,CAAC,oBAAoB,CACzB,MAAkC,EAClC,YAAoB,EACpB,OAAkB,EAClB,QAAc;QAEd,MAAM,WAAW,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACzC,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,6BAA6B,CAC3D,YAAY,EACZ,MAAM,CAAC,SAAS,EAChB,MAAM,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAC3D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACpC,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IAKO,KAAK,CAAC,mCAAmC,CAChD,QAA4B;QAE5B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB;iBAC1C,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;iBAChD,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,MAAM,IAAI,6BAA6B,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,kBAAkB,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW,CAChB,MAAkC,EAClC,OAAoC;QAEpC,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QAE3C,IAAI,CAAC,eAAe,IAAI,eAAe,KAAK,cAAc,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACnF,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO;YACR,CAAC;QACF,CAAC;QAED,IAAI,CAAC,eAAe,IAAI,eAAe,KAAK,eAAe,EAAE,CAAC;YAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACpF,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO;YACR,CAAC;QACF,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE;YACjE,QAAQ,EAAE,MAAM,CAAC,SAAS;SAC1B,CAAC,CAAC;IACJ,CAAC;IAKD,KAAK,CAAC,aAAa,CAClB,MAAc;QAGd,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAGnF,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YACnC,MAAM,EAAE,YAAY,EAAE,qBAAqB,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YACnF,OAAO,eAAe,CAAC;QACxB,CAAC,CAAC,CAAC;IACJ,CAAC;IAMD,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,MAAc;QAElD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;YACvD,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,YAAY,CAAC,CAAC;QAC/D,CAAC;QAGD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,YAAY,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEzE,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;YACrD,QAAQ;YACR,UAAU,EAAE,MAAM,CAAC,IAAI;SACvB,CAAC,CAAC;IACJ,CAAC;CACD,CAAA;AA7ZY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,YAAO,GAAE;qCAGiB,uBAAM;QACA,qBAAY;QACL,2CAAmB;QACjB,+CAAqB;QAC9B,uCAAiB;QACL,gEAA6B;QAChC,qDAAqB;QAC1B,uDAAyB;GATjD,kBAAkB,CA6Z9B;AAKD,MAAM,6BAA8B,SAAQ,8BAAkB;IAC7D,YACU,QAAgB,EAChB,gBAAwB;QAEjC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAH3B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,qBAAgB,GAAhB,gBAAgB,CAAQ;IAGlC,CAAC;CACD"}
+{"version":3,"file":"oauth-server.service.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth-server.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+EAGyD;AAYzD,8CAAkF;AAClF,wDAA6C;AAC7C,wCAA2C;AAE3C,gCAAkC;AAClC,kDAAkD;AAGlD,wFAAmF;AAEnF,iFAAsE;AACtE,6FAAwF;AACxF,yGAA8F;AAC9F,yFAAmF;AACnF,mEAA8D;AAC9D,+DAA0D;AAC1D,iDAA8D;AAC9D,8EAA0E;AAC1E,mDAA+D;AAG/D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAkC7B,SAAS,iBAAiB,CAAC,IAAY,EAAE,IAAyB;IACjE,MAAM,UAAU,GAAG,IAAA,4BAAgB,EAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,UAAU,KAAK,IAAI,IAAI,0CAA8B,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACzF,CAAC;AAGD,SAAS,UAAU,CAAC,MAAmC;IACtD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;QAC7E,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;QAC7E,OAAO,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACJ,CAAC;AAGD,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAO9B,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC9B,YACkB,MAAc,EACd,YAA0B,EAC1B,mBAAwC,EACxC,qBAA4C,EAC5C,YAA+B,EAC/B,wBAAuD,EACvD,qBAA4C,EAC5C,gBAA2C,EAC3C,MAA4B;sBAR5B,MAAM;4BACN,YAAY;mCACZ,mBAAmB;qCACnB,qBAAqB;4BACrB,YAAY;wCACZ,wBAAwB;qCACxB,qBAAqB;gCACrB,gBAAgB;sBAChB,MAAM;IACrB,CAAC;IAEJ,IAAI,YAAY;QACf,OAAO;YACN,SAAS,EAAE,KAAK,EAAE,QAAgB,EAAmD,EAAE;gBACtF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;oBACb,OAAO,SAAS,CAAC;gBAClB,CAAC;gBAKD,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;gBAE7D,OAAO;oBACN,SAAS,EAAE,MAAM,CAAC,EAAE;oBACpB,WAAW,EAAE,MAAM,CAAC,IAAI;oBACxB,aAAa,EAAE,MAAM,CAAC,YAAY;oBAClC,WAAW,EAAE,MAAM,CAAC,UAAU;oBAC9B,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;oBAC1D,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;oBAClE,GAAG,CAAC,MAAM,CAAC,qBAAqB,IAAI;wBACnC,wBAAwB,EAAE,MAAM,CAAC,qBAAqB;qBACtD,CAAC;oBACF,cAAc,EAAE,CAAC,MAAM,CAAC;oBACxB,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACvE,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,SAAS;iBAClB,CAAC;YACH,CAAC;YACD,cAAc,EAAE,KAAK,EACpB,MAAkC,EACI,EAAE;gBACxC,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;gBAExC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;oBACvC,EAAE,EAAE,MAAM,CAAC,SAAS;oBACpB,IAAI,EAAE,MAAM,CAAC,WAAW;oBACxB,YAAY,EAAE,MAAM,CAAC,aAAa;oBAClC,UAAU,EAAE,MAAM,CAAC,WAAW;oBAC9B,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;oBAC1C,qBAAqB,EAAE,MAAM,CAAC,wBAAwB,IAAI,IAAI;oBAC9D,uBAAuB,EAAE,MAAM,CAAC,0BAA0B,IAAI,MAAM;iBACpE,CAAC,CAAC;gBAEH,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAEhD,OAAO,MAAM,CAAC;YACf,CAAC;SACD,CAAC;IACH,CAAC;IAGD,KAAK,CAAC,oBAAoB;QACzB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;QAC7D,OAAO,WAAW,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,uBAAuB,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,sBAAsB;QAK3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,uBAAuB,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,IAAI,KAAK,EAAE,CAAC;IACrD,CAAC;IAUO,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QAChD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,uBAAuB,CAAC;QAClE,IAAI,WAAW,GAAG,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CACf,mFAAmF,EACnF,EAAE,KAAK,EAAE,WAAW,EAAE,CACtB,CAAC;YACF,MAAM,IAAI,2CAA4B,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;IAEO,0BAA0B,CAAC,MAAkC;QACpE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,0CAA0C,iBAAiB,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACxC,IAAI,GAAG,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACd,0CAA0C,uBAAuB,aAAa,CAC9E,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAWO,oBAAoB,CAAC,WAAqB,EAAE,WAAmB;QACtE,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,SAAc,CAAC;QACnB,IAAI,CAAC;YACJ,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACd,CAAC;QAED,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YACnC,IAAI,SAAc,CAAC;YACnB,IAAI,CAAC;gBACJ,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,KAAK,CAAC;YACd,CAAC;YAED,OAAO,CACN,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC;gBACvC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ;gBACzC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ;gBACzC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,CACzC,CAAC;QACH,CAAC,CAAC,CAAC;IACJ,CAAC;IAEO,cAAc,CAAC,QAAgB;QACtC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,SAAS,CACd,MAAkC,EAClC,MAA2B,EAC3B,GAAa;QAEb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAElF,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mCAAmC,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YAE7F,MAAM,cAAc,GAAG,QAAQ;gBAC9B,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,QAAQ,CAAC;gBACxD,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,CAAC;YAC9C,MAAM,WAAW,GAAG,CAAC,MAAM,cAAc,EAAE,sBAAsB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;YAC7E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC3F,IAAI,CAAC,MAAM,CAAC,IAAI,CACf,6FAA6F,EAC7F;oBACC,QAAQ,EAAE,MAAM,CAAC,SAAS;oBAC1B,YAAY,EAAE,MAAM,CAAC,WAAW;iBAChC,CACD,CAAC;gBACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACpB,KAAK,EAAE,iBAAiB;oBACxB,iBAAiB,EAAE,kCAAkC;iBACrD,CAAC,CAAC;gBACH,OAAO;YACR,CAAC;YAID,MAAM,eAAe,GAAG,cAAc,EAAE,MAAM,IAAI,EAAE,CAAC;YACrD,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAE1F,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,GAAG,EAAE;gBAC3C,QAAQ,EAAE,MAAM,CAAC,SAAS;gBAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;gBAC3B,QAAQ;gBACR,GAAG,CAAC,eAAe,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC;aACzE,CAAC,CAAC;YAEH,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,6BAA6B,EAAE,CAAC;gBACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6DAA6D,EAAE;oBAC/E,QAAQ,EAAE,MAAM,CAAC,SAAS;oBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;iBACxC,CAAC,CAAC;gBACH,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;gBAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACpB,KAAK,EAAE,gBAAgB;oBACvB,iBAAiB,EAAE,4BAA4B;iBAC/C,CAAC,CAAC;gBACH,OAAO;YACR,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACtF,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC7F,CAAC;IACF,CAAC;IAED,KAAK,CAAC,6BAA6B,CAClC,MAAkC,EAClC,iBAAyB;QAEzB,OAAO,MAAM,IAAI,CAAC,wBAAwB,CAAC,gBAAgB,CAC1D,iBAAiB,EACjB,MAAM,CAAC,SAAS,CAChB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC9B,MAAkC,EAClC,iBAAyB,EACzB,aAAsB,EACtB,WAAoB,EACpB,QAAc;QAEd,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,qBAAqB,CAC3E,iBAAiB,EACjB,MAAM,CAAC,SAAS,EAChB,WAAW,CACX,CAAC;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,IAAI,6BAAiB,CAAC,4BAA4B,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACzC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC;QAKlF,IAAI,aAAiC,CAAC;QACtC,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,IAAI,SAAS,CAAC;QAEtD,IAAI,aAAa,IAAI,YAAY,EAAE,CAAC;YACnC,IAAI,aAAa,KAAK,YAAY,EAAE,CAAC;gBACpC,MAAM,IAAI,6BAA6B,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;YACtE,CAAC;YACD,aAAa,GAAG,aAAa,CAAC;QAC/B,CAAC;aAAM,CAAC;YACP,aAAa,GAAG,aAAa,IAAI,YAAY,CAAC;QAC/C,CAAC;QAED,MAAM,IAAI,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,CAAC;QAEnF,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;QAEvC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CACxE,UAAU,CAAC,MAAM,EACjB,MAAM,CAAC,SAAS,EAChB,aAAa,EACb,aAAa,CACb,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CACpC,WAAW,EACX,YAAY,EACZ,MAAM,CAAC,SAAS,EAChB,UAAU,CAAC,MAAM,EACjB,aAAa,CACb,CAAC;QAEF,OAAO;YACN,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,2BAA2B,EAAE;YAC3D,aAAa,EAAE,YAAY;YAG3B,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;SAC9B,CAAC;IACH,CAAC;IAKD,KAAK,CAAC,oBAAoB,CACzB,MAAkC,EAClC,YAAoB,EACpB,OAAkB,EAClB,QAAc;QAEd,MAAM,WAAW,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACzC,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,6BAA6B,CAC3D,YAAY,EACZ,MAAM,CAAC,SAAS,EAChB,MAAM,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAC3D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACpC,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IAKO,KAAK,CAAC,mCAAmC,CAChD,QAA4B;QAE5B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB;iBAC1C,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;iBAChD,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,MAAM,IAAI,6BAA6B,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,kBAAkB,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW,CAChB,MAAkC,EAClC,OAAoC;QAEpC,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QAE3C,IAAI,CAAC,eAAe,IAAI,eAAe,KAAK,cAAc,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACnF,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO;YACR,CAAC;QACF,CAAC;QAED,IAAI,CAAC,eAAe,IAAI,eAAe,KAAK,eAAe,EAAE,CAAC;YAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACpF,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO;YACR,CAAC;QACF,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE;YACjE,QAAQ,EAAE,MAAM,CAAC,SAAS;SAC1B,CAAC,CAAC;IACJ,CAAC;IAYD,KAAK,CAAC,aAAa,CAClB,IAAU,EACV,OAAO,GAAgC,EAAE;QAOzC,MAAM,SAAS,GAAG,IAAA,4BAAc,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC;QAE5C,IAAI,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,gCAAc,CAAC,8DAA8D,CAAC,CAAC;QAC1F,CAAC;QAKD,IAAI,SAA+B,CAAC;QACpC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;gBACxD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;aAChC,CAAC,CAAC;YACH,SAAS,GAAG,UAAU;iBACpB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAK,CAAC,CAAC;iBACjE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAC9B,SAAS,EAAE,MAAM,KAAK,CAAC;YACtB,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;YACxB,CAAC,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,CAAC;gBACtD,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;gBACrC,SAAS,EAAE,OAAO;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBAC9C,SAAS;gBACT,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;gBACf,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;aAClB,CAAC,CAAC;QAEN,MAAM,OAAO,GAA2B,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YAChE,MAAM,EAAE,YAAY,EAAE,qBAAqB,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YACnF,OAAO;gBACN,GAAG,eAAe;gBAElB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;gBACpC,MAAM,EAAE,OAAO,CAAC,KAAK;gBACrB,GAAG,CAAC,OAAO;oBACV,CAAC,CAAC;wBACA,KAAK,EAAE;4BACN,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;4BACnB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI;4BACzC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI;4BACvC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;yBACzB;qBACD;oBACF,CAAC,CAAC,EAAE,CAAC;aACN,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC;QAIpB,MAAM,CAAC,aAAa,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9D,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS;YACpE,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YACvD,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;SAC1D,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,MAAM,MAAM,GAA+B,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC/D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,GAAG,QAAQ,CAAC;QACvB,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IAGD,qBAAqB;QACpB,OAAO,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC;IACtE,CAAC;IAUD,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,MAAc,EAAE,OAAc;QAElE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;YACvD,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,YAAY,CAAC,CAAC;QAC/D,CAAC;QAGD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;YACxD,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;YAC3B,SAAS,EAAE,CAAC,MAAM,CAAC;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,YAAY,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAIhF,MAAM,OAAO,CAAC,GAAG,CAAC;YACjB,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC3D,IAAI,CAAC,wBAAwB,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC9D,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;SACvD,CAAC,CAAC;QAMH,MAAM,aAAa,GAAG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,SAAS,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB;aAC7C,kBAAkB,EAAE;aACpB,MAAM,EAAE;aACR,IAAI,CAAC,iCAAW,CAAC;aACjB,KAAK,CACL,gDAAgD,aAAa,gCAAgC,EAC7F,EAAE,QAAQ,EAAE,CACZ;aACA,OAAO,EAAE,CAAC;QAEZ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;gBACvE,QAAQ;gBACR,UAAU,EAAE,MAAM,CAAC,IAAI;aACvB,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM;iBACT,sBAAsB,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;iBACjF,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;gBACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;oBAC/D,QAAQ;oBACR,OAAO,EAAE,MAAM;oBACf,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;iBACjD,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;IACF,CAAC;CACD,CAAA;;6BAriBY,kBAAkB;IAD9B,IAAA,YAAO,GAAE;qCAGiB,uBAAM,EACA,qBAAY,EACL,2CAAmB,EACjB,+CAAqB,EAC9B,uCAAiB,EACL,gEAA6B,EAChC,qDAAqB,EAC1B,uDAAyB,EACnC,4BAAoB;GAVlC,kBAAkB,CAqiB9B;AAKD,MAAM,6BAA8B,SAAQ,8BAAkB;IAC7D,YACU,QAAgB,EAChB,gBAAwB;QAEjC,KAAK,CAAC,4BAA4B,CAAC,CAAC;wBAH3B,QAAQ;gCACR,gBAAgB;IAG1B,CAAC;CACD"}

package/dist/modules/oauth-server/oauth-session.service.d.ts

@@ -6,6 +6,7 @@ export interface OAuthSessionPayload {
     codeChallenge: string;
     state: string | null;
     resource?: string;
+    requestedScopes?: string[];
 }
 export declare class OAuthSessionService {
     private readonly jwtService;

package/dist/modules/oauth-server/oauth-session.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-session.service.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth-session.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,8CAAsC;AACtC,gCAAkC;AAGlC,wDAAoD;AAUpD,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,iBAAiB,GAAG,EAAE,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,CAAC;AAOpD,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC/B,YAA6B,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;IAAG,CAAC;IAKvD,aAAa,CAAC,GAAa,EAAE,OAA4B;QACxD,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE;YAClD,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE;YACrC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;YAC7C,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,iBAAiB;SACzB,CAAC,CAAC;IACJ,CAAC;IAKD,aAAa,CAAC,YAAoB;QACjC,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAsB,YAAY,CAAC,CAAC;IAClE,CAAC;IAKD,YAAY,CAAC,GAAa;QACzB,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAC9B,CAAC;IAKD,eAAe,CAAC,OAA2C;QAC1D,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;CACD,CAAA;AAvCY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,YAAO,GAAE;qCAEgC,wBAAU;GADvC,mBAAmB,CAuC/B"}
+{"version":3,"file":"oauth-session.service.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth-session.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,8CAAsC;AACtC,gCAAkC;AAGlC,wDAAoD;AAYpD,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,iBAAiB,GAAG,EAAE,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,CAAC;AAOpD,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC/B,YAA6B,UAAsB;0BAAtB,UAAU;IAAe,CAAC;IAKvD,aAAa,CAAC,GAAa,EAAE,OAA4B;QACxD,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE;YAClD,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE;YACrC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;YAC7C,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,iBAAiB;SACzB,CAAC,CAAC;IACJ,CAAC;IAKD,aAAa,CAAC,YAAoB;QACjC,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAsB,YAAY,CAAC,CAAC;IAClE,CAAC;IAKD,YAAY,CAAC,GAAa;QACzB,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAC9B,CAAC;IAKD,eAAe,CAAC,OAA2C;QAC1D,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;CACD,CAAA;;8BAvCY,mBAAmB;IAD/B,IAAA,YAAO,GAAE;qCAEgC,wBAAU;GADvC,mBAAmB,CAuC/B"}

package/dist/modules/oauth-server/oauth-token.service.d.ts

@@ -1,12 +1,12 @@
-import { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types';
-import { OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth';
+import { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
+import { OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
 import { Logger } from '@n8n/backend-common';
 import { UserRepository } from '@n8n/db';
-import { AccessTokenRepository } from './database/repositories/oauth-access-token.repository';
-import { RefreshTokenRepository } from './database/repositories/oauth-refresh-token.repository';
-import { ProtectedResourceRegistry } from '../../services/protected-resource.registry';
 import { JwtService } from '../../services/jwt.service';
 import type { OAuthTokenVerifier, UserWithContext } from '../../services/oauth-token-verifier-proxy.service';
+import { ProtectedResourceRegistry } from '../../services/protected-resource.registry';
+import { AccessTokenRepository } from './database/repositories/oauth-access-token.repository';
+import { RefreshTokenRepository } from './database/repositories/oauth-refresh-token.repository';
 export declare class OAuthTokenService implements OAuthTokenVerifier {
     private readonly logger;
     private readonly jwtService;
@@ -18,15 +18,17 @@ export declare class OAuthTokenService implements OAuthTokenVerifier {
     private readonly REFRESH_TOKEN_EXPIRY_MS;
     constructor(logger: Logger, jwtService: JwtService, userRepository: UserRepository, accessTokenRepository: AccessTokenRepository, refreshTokenRepository: RefreshTokenRepository, resourceRegistry: ProtectedResourceRegistry);
     getAccessTokenExpirySeconds(): number;
-    generateTokenPair(userId: string, clientId: string, resource?: string): {
+    generateTokenPair(userId: string, clientId: string, resource: string | undefined, scopes: string[]): {
         accessToken: string;
         refreshToken: string;
     };
-    saveTokenPair(accessToken: string, refreshToken: string, clientId: string, userId: string): Promise<void>;
+    saveTokenPair(accessToken: string, refreshToken: string, clientId: string, userId: string, scopes: string[]): Promise<void>;
     validateAndRotateRefreshToken(refreshToken: string, clientId: string, resource?: string): Promise<OAuthTokens>;
     verifyAccessToken(token: string, expectedAudience?: string): Promise<AuthInfo>;
     private verifyTokenWithAudiences;
+    private parseScopeClaim;
     verifyOAuthAccessToken(token: string, expectedAudience?: string): Promise<UserWithContext>;
+    revokeAllTokensForGrant(clientId: string, userId: string): Promise<void>;
     revokeAccessToken(token: string, clientId: string): Promise<boolean>;
     revokeRefreshToken(token: string, clientId: string): Promise<boolean>;
     private getAllowedAudiences;

package/dist/modules/oauth-server/oauth-token.service.js

@@ -19,13 +19,13 @@ const typeorm_1 = require("@n8n/typeorm");
 const ensure_error_1 = require("@n8n/utils/errors/ensure-error");
 const n8n_workflow_1 = require("n8n-workflow");
 const node_crypto_1 = require("node:crypto");
+const jwt_service_1 = require("../../services/jwt.service");
+const protected_resource_registry_1 = require("../../services/protected-resource.registry");
 const oauth_access_token_entity_1 = require("./database/entities/oauth-access-token.entity");
 const oauth_refresh_token_entity_1 = require("./database/entities/oauth-refresh-token.entity");
 const oauth_access_token_repository_1 = require("./database/repositories/oauth-access-token.repository");
 const oauth_refresh_token_repository_1 = require("./database/repositories/oauth-refresh-token.repository");
-const protected_resource_registry_1 = require("../../services/protected-resource.registry");
 const oauth_errors_1 = require("./oauth.errors");
-const jwt_service_1 = require("../../services/jwt.service");
 let OAuthTokenService = class OAuthTokenService {
     constructor(logger, jwtService, userRepository, accessTokenRepository, refreshTokenRepository, resourceRegistry) {
         this.logger = logger;
@@ -40,7 +40,7 @@ let OAuthTokenService = class OAuthTokenService {
     getAccessTokenExpirySeconds() {
         return this.ACCESS_TOKEN_EXPIRY_SECONDS;
     }
-    generateTokenPair(userId, clientId, resource) {
+    generateTokenPair(userId, clientId, resource, scopes) {
         const audience = resource ?? this.resourceRegistry.getDefaultResource()?.getResourceUrl();
         if (!audience) {
             throw new n8n_workflow_1.UnexpectedError('Cannot mint an OAuth access token: no resource requested and no default protected resource is registered');
@@ -52,6 +52,7 @@ let OAuthTokenService = class OAuthTokenService {
             jti: (0, node_crypto_1.randomUUID)(),
             iat: Math.floor(Date.now() / 1000),
             exp: Math.floor(Date.now() / 1000) + this.ACCESS_TOKEN_EXPIRY_SECONDS,
+            scope: scopes.join(' '),
             meta: {
                 isOAuth: true,
             },
@@ -59,7 +60,7 @@ let OAuthTokenService = class OAuthTokenService {
         const refreshToken = (0, node_crypto_1.randomBytes)(32).toString('hex');
         return { accessToken, refreshToken };
     }
-    async saveTokenPair(accessToken, refreshToken, clientId, userId) {
+    async saveTokenPair(accessToken, refreshToken, clientId, userId, scopes) {
         await this.accessTokenRepository.manager.transaction(async (transactionManager) => {
             await transactionManager.insert(this.accessTokenRepository.target, {
                 token: accessToken,
@@ -71,6 +72,7 @@ let OAuthTokenService = class OAuthTokenService {
                 clientId,
                 userId,
                 expiresAt: Date.now() + this.REFRESH_TOKEN_EXPIRY_MS,
+                scope: scopes,
             });
         });
     }
@@ -95,7 +97,8 @@ let OAuthTokenService = class OAuthTokenService {
             if (numAffected < 1) {
                 throw new errors_js_1.InvalidGrantError('Invalid refresh token');
             }
-            const { accessToken, refreshToken: newRefreshToken } = this.generateTokenPair(refreshTokenRecord.userId, clientId, resource);
+            const scopes = refreshTokenRecord.scope;
+            const { accessToken, refreshToken: newRefreshToken } = this.generateTokenPair(refreshTokenRecord.userId, clientId, resource, scopes);
             await trx.insert(oauth_access_token_entity_1.AccessToken, {
                 token: accessToken,
                 clientId,
@@ -106,6 +109,7 @@ let OAuthTokenService = class OAuthTokenService {
                 clientId,
                 userId: refreshTokenRecord.userId,
                 expiresAt: now + this.REFRESH_TOKEN_EXPIRY_MS,
+                scope: scopes,
             });
             this.logger.info('Refresh token rotated and new access token issued', {
                 clientId,
@@ -116,6 +120,7 @@ let OAuthTokenService = class OAuthTokenService {
                 token_type: 'Bearer',
                 expires_in: this.ACCESS_TOKEN_EXPIRY_SECONDS,
                 refresh_token: newRefreshToken,
+                scope: scopes.join(' '),
             };
         });
     }
@@ -144,12 +149,19 @@ let OAuthTokenService = class OAuthTokenService {
         return {
             token,
             clientId,
-            scopes: [],
+            scopes: this.parseScopeClaim(decoded),
             extra: {
                 userId,
             },
         };
     }
+    parseScopeClaim(decoded) {
+        const scopeClaim = this.getStringClaim(decoded, 'scope');
+        if (scopeClaim === null) {
+            return [];
+        }
+        return scopeClaim === '' ? [] : scopeClaim.split(' ');
+    }
     async verifyOAuthAccessToken(token, expectedAudience) {
         try {
             const resource = await this.getResourceByAudience(expectedAudience);
@@ -177,7 +189,7 @@ let OAuthTokenService = class OAuthTokenService {
                 });
                 return { user: null, context: { reason: 'insufficient_scope', auth_type: 'oauth' } };
             }
-            return { user, authType: 'oauth' };
+            return { user, authType: 'oauth', scopes: authInfo.scopes };
         }
         catch (error) {
             const errorForSure = (0, ensure_error_1.ensureError)(error);
@@ -196,6 +208,12 @@ let OAuthTokenService = class OAuthTokenService {
             };
         }
     }
+    async revokeAllTokensForGrant(clientId, userId) {
+        await Promise.all([
+            this.accessTokenRepository.delete({ clientId, userId }),
+            this.refreshTokenRepository.delete({ clientId, userId }),
+        ]);
+    }
     async revokeAccessToken(token, clientId) {
         const result = await this.accessTokenRepository.delete({
             token,
@@ -264,11 +282,6 @@ let OAuthTokenService = class OAuthTokenService {
 exports.OAuthTokenService = OAuthTokenService;
 exports.OAuthTokenService = OAuthTokenService = __decorate([
     (0, di_1.Service)(),
-    __metadata("design:paramtypes", [backend_common_1.Logger,
-        jwt_service_1.JwtService,
-        db_1.UserRepository,
-        oauth_access_token_repository_1.AccessTokenRepository,
-        oauth_refresh_token_repository_1.RefreshTokenRepository,
-        protected_resource_registry_1.ProtectedResourceRegistry])
+    __metadata("design:paramtypes", [backend_common_1.Logger, jwt_service_1.JwtService, db_1.UserRepository, oauth_access_token_repository_1.AccessTokenRepository, oauth_refresh_token_repository_1.RefreshTokenRepository, protected_resource_registry_1.ProtectedResourceRegistry])
 ], OAuthTokenService);
 //# sourceMappingURL=oauth-token.service.js.map