n8n 2.33.2 → 2.34.0

package/dist/modules/oauth-server/protected-resource-resolvers/utils.js

@@ -1,10 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WORKFLOW_MCP_TRIGGER_SCOPES = void 0;
+exports.WEBHOOK_TRIGGER_SCOPES = exports.FORM_TRIGGER_SCOPES = exports.WORKFLOW_MCP_TRIGGER_SCOPES = void 0;
 exports.trimTrailingSlash = trimTrailingSlash;
 exports.trimSlashes = trimSlashes;
 exports.resourceUrlToWebhookPath = resourceUrlToWebhookPath;
+exports.webhookResourcePath = webhookResourcePath;
+exports.methodQueryString = methodQueryString;
+exports.parseMethodParam = parseMethodParam;
 exports.WORKFLOW_MCP_TRIGGER_SCOPES = [];
+exports.FORM_TRIGGER_SCOPES = [];
+exports.WEBHOOK_TRIGGER_SCOPES = [];
 function trimTrailingSlash(path) {
     if (path.endsWith('/')) {
         path = path.slice(0, -1);
@@ -38,4 +43,14 @@ function resourceUrlToWebhookPath(resourceUrl, webhookBaseUrl) {
     }
     return url.pathname.slice(basePath.length);
 }
+function webhookResourcePath(webhookPath, webhookId) {
+    return webhookId ? `${webhookId}/${webhookPath}` : webhookPath;
+}
+function methodQueryString(method) {
+    return `?method=${method.toUpperCase()}`;
+}
+function parseMethodParam(value) {
+    const method = value?.trim().toUpperCase();
+    return method === '' ? undefined : method;
+}
 //# sourceMappingURL=utils.js.map

package/dist/modules/oauth-server/protected-resource-resolvers/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../../src/modules/oauth-server/protected-resource-resolvers/utils.ts"],"names":[],"mappings":";;;;;;AAKa,QAAA,2BAA2B,GAAa,EAAE,CAAC;AAExD,2BAAkC,IAAY;IAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,qBAA4B,IAAY;IACvC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAYD,kCACC,WAAmB,EACnB,cAAsB;IAEtB,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../../src/modules/oauth-server/protected-resource-resolvers/utils.ts"],"names":[],"mappings":";;;;;;;;;AAKa,QAAA,2BAA2B,GAAa,EAAE,CAAC;AAG3C,QAAA,mBAAmB,GAAa,EAAE,CAAC;AAGnC,QAAA,sBAAsB,GAAa,EAAE,CAAC;AAEnD,2BAAkC,IAAY;IAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,qBAA4B,IAAY;IACvC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAeD,kCACC,WAAmB,EACnB,cAAsB;IAEtB,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC;AAQD,6BAAoC,WAAmB,EAAE,SAAkB;IAC1E,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;AAChE,CAAC;AASD,2BAAkC,MAAc;IAC/C,OAAO,WAAW,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;AAC1C,CAAC;AAGD,0BAAiC,KAAgC;IAChE,MAAM,MAAM,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;AAC3C,CAAC"}

package/dist/modules/oauth-server/protected-resource-resolvers/workflow-webhook-test-trigger-resource.resolver.d.ts

@@ -0,0 +1,19 @@
+import { Logger } from '@n8n/backend-common';
+import { GlobalConfig } from '@n8n/config';
+import type { ProtectedResource, ProtectedResourceResolver } from '../../../services/protected-resource.registry';
+import { UrlService } from '../../../services/url.service';
+import { TestWebhooks } from '../../../webhooks/test-webhooks';
+import { WorkflowFinderService } from '../../../workflows/workflow-finder.service';
+export declare class WorkflowWebhookTestTriggerResourceResolver implements ProtectedResourceResolver {
+    private readonly config;
+    private readonly testWebhooks;
+    private readonly urlService;
+    private readonly logger;
+    private readonly workflowFinderService;
+    constructor(config: GlobalConfig, testWebhooks: TestWebhooks, urlService: UrlService, logger: Logger, workflowFinderService: WorkflowFinderService);
+    readonly id = "workflow-webhook-test-trigger";
+    readonly scopes: string[];
+    resolveByUrl(resourceUrl: string): Promise<ProtectedResource | undefined>;
+    resolveByPath(pathname: string, search?: string): Promise<ProtectedResource | undefined>;
+    private resolveWebhookNode;
+}

package/dist/modules/oauth-server/protected-resource-resolvers/workflow-webhook-test-trigger-resource.resolver.js

@@ -0,0 +1,107 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkflowWebhookTestTriggerResourceResolver = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const config_1 = require("@n8n/config");
+const di_1 = require("@n8n/di");
+const n8n_workflow_1 = require("n8n-workflow");
+const oauth2_triggers_1 = require("../../../constants/oauth2-triggers");
+const url_service_1 = require("../../../services/url.service");
+const test_webhooks_1 = require("../../../webhooks/test-webhooks");
+const workflow_finder_service_1 = require("../../../workflows/workflow-finder.service");
+const utils_1 = require("./utils");
+let WorkflowWebhookTestTriggerResourceResolver = class WorkflowWebhookTestTriggerResourceResolver {
+    constructor(config, testWebhooks, urlService, logger, workflowFinderService) {
+        this.config = config;
+        this.testWebhooks = testWebhooks;
+        this.urlService = urlService;
+        this.logger = logger;
+        this.workflowFinderService = workflowFinderService;
+        this.id = 'workflow-webhook-test-trigger';
+        this.scopes = utils_1.WEBHOOK_TRIGGER_SCOPES;
+    }
+    async resolveByUrl(resourceUrl) {
+        const pathname = (0, utils_1.resourceUrlToWebhookPath)(resourceUrl, this.urlService.getTestWebhookBaseUrl());
+        if (pathname === undefined) {
+            this.logger.debug(`Resource URL is not under the test webhook base URL: ${resourceUrl}`);
+            return undefined;
+        }
+        return await this.resolveByPath(pathname, new URL(resourceUrl).search);
+    }
+    async resolveByPath(pathname, search) {
+        if (!(0, oauth2_triggers_1.isWebhookOAuth2Enabled)()) {
+            return undefined;
+        }
+        if (!pathname.startsWith(`/${this.config.endpoints.webhookTest}/`)) {
+            return undefined;
+        }
+        const requestedMethod = (0, utils_1.parseMethodParam)(new URLSearchParams(search).get('method'));
+        const path = (0, utils_1.trimSlashes)(pathname.slice(this.config.endpoints.webhookTest.length + 1));
+        this.logger.debug(`Resolving workflow webhook test trigger resource for path: ${path}`);
+        const registrations = await this.testWebhooks.getRegistrationsFromPath(path);
+        if (registrations.length === 0) {
+            this.logger.debug(`No test webhook registration found for path: ${path}`);
+            return undefined;
+        }
+        const winner = requestedMethod
+            ? registrations.find((r) => r.webhook.httpMethod === requestedMethod)
+            : registrations.length === 1
+                ? registrations[0]
+                : undefined;
+        if (!winner) {
+            this.logger.debug(`No test webhook at path ${path} for method ${requestedMethod ?? '(unspecified)'}`);
+            return undefined;
+        }
+        const triggerMethods = registrations
+            .filter((r) => r.webhook.workflowId === winner.webhook.workflowId &&
+            r.webhook.node === winner.webhook.node)
+            .map((r) => r.webhook.httpMethod);
+        const resourcePath = (0, utils_1.webhookResourcePath)(winner.webhook.path, winner.webhook.webhookId);
+        return this.resolveWebhookNode(winner, resourcePath, winner.webhook.httpMethod, triggerMethods);
+    }
+    resolveWebhookNode({ workflowEntity, webhook }, resourcePath, requestedMethod, triggerMethods) {
+        const node = workflowEntity.nodes.find((n) => n.name === webhook.node);
+        if (!node) {
+            this.logger.debug(`No node found with name ${webhook.node} in test registration for workflow with ID: ${workflowEntity.id}`);
+            return undefined;
+        }
+        if (node.type === n8n_workflow_1.WEBHOOK_NODE_TYPE &&
+            !node.disabled &&
+            node.parameters.authentication === 'n8nOAuth2') {
+            const baseUrl = `${(0, utils_1.trimTrailingSlash)(this.urlService.getTestWebhookBaseUrl())}/${this.config.endpoints.webhookTest}/${resourcePath}`;
+            const urlFor = (method) => `${baseUrl}${(0, utils_1.methodQueryString)(method)}`;
+            const methods = [...new Set(triggerMethods.map((method) => method.toUpperCase()))].sort();
+            const requireExecute = node.parameters.requireExecuteAccess !== false;
+            return {
+                id: `workflow-webhook-test:${workflowEntity.id}:${resourcePath}`,
+                getResourceUrl: () => urlFor(requestedMethod),
+                getAudiences: () => methods.map(urlFor),
+                scopes: utils_1.WEBHOOK_TRIGGER_SCOPES,
+                displayName: workflowEntity.name,
+                authorize: async (user) => {
+                    if (requireExecute) {
+                        return (await this.workflowFinderService.findWorkflowIdsWithScopeForUser([workflowEntity.id], user, ['workflow:execute'])).has(workflowEntity.id);
+                    }
+                    return true;
+                },
+            };
+        }
+        this.logger.debug(`Node with name ${webhook.node} in test registration for workflow with ID: ${workflowEntity.id} is not an enabled webhook trigger with n8nOAuth2 authentication`);
+        return undefined;
+    }
+};
+exports.WorkflowWebhookTestTriggerResourceResolver = WorkflowWebhookTestTriggerResourceResolver;
+exports.WorkflowWebhookTestTriggerResourceResolver = WorkflowWebhookTestTriggerResourceResolver = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [config_1.GlobalConfig, test_webhooks_1.TestWebhooks, url_service_1.UrlService, backend_common_1.Logger, workflow_finder_service_1.WorkflowFinderService])
+], WorkflowWebhookTestTriggerResourceResolver);
+//# sourceMappingURL=workflow-webhook-test-trigger-resource.resolver.js.map

package/dist/modules/oauth-server/protected-resource-resolvers/workflow-webhook-test-trigger-resource.resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-webhook-test-trigger-resource.resolver.js","sourceRoot":"","sources":["../../../../src/modules/oauth-server/protected-resource-resolvers/workflow-webhook-test-trigger-resource.resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;AAC7C,wCAA2C;AAE3C,gCAAkC;AAClC,+CAAiD;AAEjD,iEAAqE;AAKrE,wDAAoD;AACpD,4DAAwD;AAExD,iFAA4E;AAE5E,mCAQiB;AAeV,IAAM,0CAA0C,GAAhD,MAAM,0CAA0C;IACtD,YACkB,MAAoB,EACpB,YAA0B,EAC1B,UAAsB,EACtB,MAAc,EACd,qBAA4C;QAJ5C,WAAM,GAAN,MAAM,CAAc;QACpB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,eAAU,GAAV,UAAU,CAAY;QACtB,WAAM,GAAN,MAAM,CAAQ;QACd,0BAAqB,GAArB,qBAAqB,CAAuB;QAGrD,OAAE,GAAG,+BAA+B,CAAC;QACrC,WAAM,GAAG,8BAAsB,CAAC;IAHtC,CAAC;IAKJ,KAAK,CAAC,YAAY,CAAC,WAAmB;QACrC,MAAM,QAAQ,GAAG,IAAA,gCAAwB,EAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC,CAAC;QAChG,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wDAAwD,WAAW,EAAE,CAAC,CAAC;YACzF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,MAAe;QACpD,IAAI,CAAC,IAAA,wCAAsB,GAAE,EAAE,CAAC;YAC/B,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;YAEpE,OAAO,SAAS,CAAC;QAClB,CAAC;QAGD,MAAM,eAAe,GAAG,IAAA,wBAAgB,EAAC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEpF,MAAM,IAAI,GAAG,IAAA,mBAAW,EAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAEvF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8DAA8D,IAAI,EAAE,CAAC,CAAC;QAExF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAE7E,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,IAAI,EAAE,CAAC,CAAC;YAC1E,OAAO,SAAS,CAAC;QAClB,CAAC;QAMD,MAAM,MAAM,GAAG,eAAe;YAC7B,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,KAAK,eAAe,CAAC;YACrE,CAAC,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;gBAC3B,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;gBAClB,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,2BAA2B,IAAI,eAAe,eAAe,IAAI,eAAe,EAAE,CAClF,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QAID,MAAM,cAAc,GAAG,aAAa;aAClC,MAAM,CACN,CAAC,CAAC,EAAE,EAAE,CACL,CAAC,CAAC,OAAO,CAAC,UAAU,KAAK,MAAM,CAAC,OAAO,CAAC,UAAU;YAClD,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,CACvC;aACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAMnC,MAAM,YAAY,GAAG,IAAA,2BAAmB,EAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAExF,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACjG,CAAC;IAEO,kBAAkB,CACzB,EAAE,cAAc,EAAE,OAAO,EAA2B,EACpD,YAAoB,EACpB,eAAuB,EACvB,cAAwB;QAExB,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAEvE,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,2BAA2B,OAAO,CAAC,IAAI,+CAA+C,cAAc,CAAC,EAAE,EAAE,CACzG,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,IACC,IAAI,CAAC,IAAI,KAAK,gCAAiB;YAC/B,CAAC,IAAI,CAAC,QAAQ;YACd,IAAI,CAAC,UAAU,CAAC,cAAc,KAAK,WAAW,EAC7C,CAAC;YACF,MAAM,OAAO,GAAG,GAAG,IAAA,yBAAiB,EAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,IAAI,YAAY,EAAE,CAAC;YACrI,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,GAAG,OAAO,GAAG,IAAA,yBAAiB,EAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1F,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,oBAAoB,KAAK,KAAK,CAAC;YACtE,OAAO;gBACN,EAAE,EAAE,yBAAyB,cAAc,CAAC,EAAE,IAAI,YAAY,EAAE;gBAChE,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC;gBAC7C,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gBACvC,MAAM,EAAE,8BAAsB;gBAC9B,WAAW,EAAE,cAAc,CAAC,IAAI;gBAChC,SAAS,EAAE,KAAK,EAAE,IAAU,EAAE,EAAE;oBAC/B,IAAI,cAAc,EAAE,CAAC;wBACpB,OAAO,CACN,MAAM,IAAI,CAAC,qBAAqB,CAAC,+BAA+B,CAC/D,CAAC,cAAc,CAAC,EAAE,CAAC,EACnB,IAAI,EACJ,CAAC,kBAAkB,CAAC,CACpB,CACD,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;oBAC1B,CAAC;oBACD,OAAO,IAAI,CAAC;gBACb,CAAC;aACD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,kBAAkB,OAAO,CAAC,IAAI,+CAA+C,cAAc,CAAC,EAAE,kEAAkE,CAChK,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;CACD,CAAA;;qDApIY,0CAA0C;IADtD,IAAA,YAAO,GAAE;qCAGiB,qBAAY,EACN,4BAAY,EACd,wBAAU,EACd,uBAAM,EACS,+CAAqB;GANlD,0CAA0C,CAoItD"}

package/dist/modules/oauth-server/protected-resource-resolvers/workflow-webhook-trigger-resource.resolver.d.ts

@@ -0,0 +1,21 @@
+import { Logger } from '@n8n/backend-common';
+import { GlobalConfig } from '@n8n/config';
+import { WorkflowRepository } from '@n8n/db';
+import type { ProtectedResource, ProtectedResourceResolver } from '../../../services/protected-resource.registry';
+import { UrlService } from '../../../services/url.service';
+import { WebhookService } from '../../../webhooks/webhook.service';
+import { WorkflowFinderService } from '../../../workflows/workflow-finder.service';
+export declare class WorkflowWebhookTriggerResourceResolver implements ProtectedResourceResolver {
+    private readonly config;
+    private readonly webhookService;
+    private readonly workflowRepository;
+    private readonly urlService;
+    private readonly logger;
+    private readonly workflowFinderService;
+    constructor(config: GlobalConfig, webhookService: WebhookService, workflowRepository: WorkflowRepository, urlService: UrlService, logger: Logger, workflowFinderService: WorkflowFinderService);
+    readonly id = "workflow-webhook-trigger";
+    readonly scopes: string[];
+    resolveByUrl(resourceUrl: string): Promise<ProtectedResource | undefined>;
+    resolveByPath(pathname: string, search?: string): Promise<ProtectedResource | undefined>;
+    private resolveWebhookNode;
+}

package/dist/modules/oauth-server/protected-resource-resolvers/workflow-webhook-trigger-resource.resolver.js

@@ -0,0 +1,109 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkflowWebhookTriggerResourceResolver = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const config_1 = require("@n8n/config");
+const db_1 = require("@n8n/db");
+const di_1 = require("@n8n/di");
+const n8n_workflow_1 = require("n8n-workflow");
+const oauth2_triggers_1 = require("../../../constants/oauth2-triggers");
+const url_service_1 = require("../../../services/url.service");
+const webhook_service_1 = require("../../../webhooks/webhook.service");
+const workflow_finder_service_1 = require("../../../workflows/workflow-finder.service");
+const utils_1 = require("./utils");
+let WorkflowWebhookTriggerResourceResolver = class WorkflowWebhookTriggerResourceResolver {
+    constructor(config, webhookService, workflowRepository, urlService, logger, workflowFinderService) {
+        this.config = config;
+        this.webhookService = webhookService;
+        this.workflowRepository = workflowRepository;
+        this.urlService = urlService;
+        this.logger = logger;
+        this.workflowFinderService = workflowFinderService;
+        this.id = 'workflow-webhook-trigger';
+        this.scopes = utils_1.WEBHOOK_TRIGGER_SCOPES;
+    }
+    async resolveByUrl(resourceUrl) {
+        const pathname = (0, utils_1.resourceUrlToWebhookPath)(resourceUrl, this.urlService.getWebhookBaseUrl());
+        if (pathname === undefined) {
+            this.logger.debug(`Resource URL is not under the webhook base URL: ${resourceUrl}`);
+            return undefined;
+        }
+        return await this.resolveByPath(pathname, new URL(resourceUrl).search);
+    }
+    async resolveByPath(pathname, search) {
+        if (!(0, oauth2_triggers_1.isWebhookOAuth2Enabled)()) {
+            return undefined;
+        }
+        if (!pathname.startsWith(`/${this.config.endpoints.webhook}/`)) {
+            return undefined;
+        }
+        const requestedMethod = (0, utils_1.parseMethodParam)(new URLSearchParams(search).get('method'));
+        const path = (0, utils_1.trimSlashes)(pathname.slice(this.config.endpoints.webhook.length + 1));
+        this.logger.debug(`Resolving workflow webhook trigger resource for path: ${path}`);
+        const webhooks = await this.webhookService.findTriggerWebhooksByPath(path, requestedMethod);
+        const row = requestedMethod
+            ? webhooks.find((webhook) => webhook.method === requestedMethod)
+            : webhooks.length === 1
+                ? webhooks[0]
+                : undefined;
+        if (!row) {
+            this.logger.debug(`No webhook at path ${path} for method ${requestedMethod ?? '(unspecified)'}`);
+            return undefined;
+        }
+        const triggerMethods = webhooks.map((webhook) => webhook.method);
+        return await this.resolveWebhookNode(row.workflowId, row.node, (0, utils_1.webhookResourcePath)(row.webhookPath, row.webhookId), row.method, triggerMethods);
+    }
+    async resolveWebhookNode(workflowId, nodeName, resourcePath, requestedMethod, triggerMethods) {
+        const workflow = await this.workflowRepository.findOne({
+            where: { id: workflowId },
+            relations: { activeVersion: true },
+        });
+        if (!workflow?.activeVersion) {
+            this.logger.debug(`No active version found for workflow with ID: ${workflowId}`);
+            return undefined;
+        }
+        const node = workflow.activeVersion.nodes.find((n) => n.name === nodeName);
+        if (!node) {
+            this.logger.debug(`No node found with name ${nodeName} in active version of workflow with ID: ${workflowId}`);
+            return undefined;
+        }
+        if (node.type === n8n_workflow_1.WEBHOOK_NODE_TYPE &&
+            !node.disabled &&
+            node.parameters.authentication === 'n8nOAuth2') {
+            const baseUrl = `${(0, utils_1.trimTrailingSlash)(this.urlService.getWebhookBaseUrl())}/${this.config.endpoints.webhook}/${resourcePath}`;
+            const urlFor = (method) => `${baseUrl}${(0, utils_1.methodQueryString)(method)}`;
+            const methods = [...new Set(triggerMethods.map((method) => method.toUpperCase()))].sort();
+            const requireExecute = node.parameters.requireExecuteAccess !== false;
+            return {
+                id: `workflow-webhook:${workflow.id}:${resourcePath}`,
+                getResourceUrl: () => urlFor(requestedMethod),
+                getAudiences: () => methods.map(urlFor),
+                scopes: utils_1.WEBHOOK_TRIGGER_SCOPES,
+                displayName: workflow.name,
+                authorize: async (user) => {
+                    if (requireExecute) {
+                        return (await this.workflowFinderService.findWorkflowIdsWithScopeForUser([workflow.id], user, ['workflow:execute'])).has(workflow.id);
+                    }
+                    return true;
+                },
+            };
+        }
+        this.logger.debug(`Node with name ${nodeName} in active version of workflow with ID: ${workflowId} is not an enabled webhook trigger with n8nOAuth2 authentication`);
+        return undefined;
+    }
+};
+exports.WorkflowWebhookTriggerResourceResolver = WorkflowWebhookTriggerResourceResolver;
+exports.WorkflowWebhookTriggerResourceResolver = WorkflowWebhookTriggerResourceResolver = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [config_1.GlobalConfig, webhook_service_1.WebhookService, db_1.WorkflowRepository, url_service_1.UrlService, backend_common_1.Logger, workflow_finder_service_1.WorkflowFinderService])
+], WorkflowWebhookTriggerResourceResolver);
+//# sourceMappingURL=workflow-webhook-trigger-resource.resolver.js.map

package/dist/modules/oauth-server/protected-resource-resolvers/workflow-webhook-trigger-resource.resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-webhook-trigger-resource.resolver.js","sourceRoot":"","sources":["../../../../src/modules/oauth-server/protected-resource-resolvers/workflow-webhook-trigger-resource.resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;AAC7C,wCAA2C;AAC3C,gCAAmD;AACnD,gCAAkC;AAClC,+CAAiD;AAEjD,iEAAqE;AAKrE,wDAAoD;AACpD,gEAA4D;AAC5D,iFAA4E;AAE5E,mCAQiB;AAgCV,IAAM,sCAAsC,GAA5C,MAAM,sCAAsC;IAClD,YACkB,MAAoB,EACpB,cAA8B,EAC9B,kBAAsC,EACtC,UAAsB,EACtB,MAAc,EACd,qBAA4C;QAL5C,WAAM,GAAN,MAAM,CAAc;QACpB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,eAAU,GAAV,UAAU,CAAY;QACtB,WAAM,GAAN,MAAM,CAAQ;QACd,0BAAqB,GAArB,qBAAqB,CAAuB;QAGrD,OAAE,GAAG,0BAA0B,CAAC;QAChC,WAAM,GAAG,8BAAsB,CAAC;IAHtC,CAAC;IAKJ,KAAK,CAAC,YAAY,CAAC,WAAmB;QACrC,MAAM,QAAQ,GAAG,IAAA,gCAAwB,EAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC5F,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,WAAW,EAAE,CAAC,CAAC;YACpF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,MAAe;QACpD,IAAI,CAAC,IAAA,wCAAsB,GAAE,EAAE,CAAC;YAC/B,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YAEhE,OAAO,SAAS,CAAC;QAClB,CAAC;QAGD,MAAM,eAAe,GAAG,IAAA,wBAAgB,EAAC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEpF,MAAM,IAAI,GAAG,IAAA,mBAAW,EAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAEnF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yDAAyD,IAAI,EAAE,CAAC,CAAC;QAGnF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,yBAAyB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAI5F,MAAM,GAAG,GAAG,eAAe;YAC1B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,eAAe,CAAC;YAChE,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBACtB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACb,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,sBAAsB,IAAI,eAAe,eAAe,IAAI,eAAe,EAAE,CAC7E,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QAGD,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjE,OAAO,MAAM,IAAI,CAAC,kBAAkB,CACnC,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,IAAI,EACR,IAAA,2BAAmB,EAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,EACnD,GAAG,CAAC,MAAM,EACV,cAAc,CACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC/B,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,eAAuB,EACvB,cAAwB;QAExB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;YACtD,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;YACzB,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,UAAU,EAAE,CAAC,CAAC;YACjF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAE3E,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,2BAA2B,QAAQ,2CAA2C,UAAU,EAAE,CAC1F,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,IACC,IAAI,CAAC,IAAI,KAAK,gCAAiB;YAC/B,CAAC,IAAI,CAAC,QAAQ;YACd,IAAI,CAAC,UAAU,CAAC,cAAc,KAAK,WAAW,EAC7C,CAAC;YACF,MAAM,OAAO,GAAG,GAAG,IAAA,yBAAiB,EAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,IAAI,YAAY,EAAE,CAAC;YAC7H,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,GAAG,OAAO,GAAG,IAAA,yBAAiB,EAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1F,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,oBAAoB,KAAK,KAAK,CAAC;YACtE,OAAO;gBAKN,EAAE,EAAE,oBAAoB,QAAQ,CAAC,EAAE,IAAI,YAAY,EAAE;gBAGrD,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC;gBAI7C,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gBACvC,MAAM,EAAE,8BAAsB;gBAC9B,WAAW,EAAE,QAAQ,CAAC,IAAI;gBAC1B,SAAS,EAAE,KAAK,EAAE,IAAU,EAAE,EAAE;oBAC/B,IAAI,cAAc,EAAE,CAAC;wBACpB,OAAO,CACN,MAAM,IAAI,CAAC,qBAAqB,CAAC,+BAA+B,CAC/D,CAAC,QAAQ,CAAC,EAAE,CAAC,EACb,IAAI,EACJ,CAAC,kBAAkB,CAAC,CACpB,CACD,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBACpB,CAAC;oBACD,OAAO,IAAI,CAAC;gBACb,CAAC;aACD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,kBAAkB,QAAQ,2CAA2C,UAAU,kEAAkE,CACjJ,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;CACD,CAAA;;iDA5IY,sCAAsC;IADlD,IAAA,YAAO,GAAE;qCAGiB,qBAAY,EACJ,gCAAc,EACV,uBAAkB,EAC1B,wBAAU,EACd,uBAAM,EACS,+CAAqB;GAPlD,sCAAsC,CA4IlD"}

package/dist/modules/otel/otel-lifecycle-handler.d.ts

@@ -15,7 +15,6 @@ export declare class OtelLifecycleHandler {
     private readonly licenseState;
     constructor(tracer: ExecutionLevelTracer, traceContextService: TraceContextService, otelService: OtelService, otelSettingsService: OtelSettingsService, ownershipService: OwnershipService, logger: Logger, licenseState: LicenseState);
     onReloadOtelConfig(): Promise<void>;
-    private isPublishedWorkflow;
     private shouldTrace;
     onWorkflowStart(ctx: WorkflowExecuteBeforeContext): Promise<void>;
     onWorkflowResume(ctx: WorkflowExecuteResumeContext): Promise<void>;

package/dist/modules/otel/otel-lifecycle-handler.js

@@ -50,14 +50,11 @@ let OtelLifecycleHandler = class OtelLifecycleHandler {
         await this.otelService.restart();
         this.tracer.refreshTracer();
     }
-    isPublishedWorkflow(workflow) {
-        return !!(workflow.activeVersionId ?? workflow.active);
-    }
     shouldTrace(ctx) {
         const { enabled, productionExecutionsOnly, includeNodeSpans } = this.otelSettingsService.getSettings();
         if (!enabled)
             return false;
-        if (productionExecutionsOnly && !this.isPublishedWorkflow(ctx.workflow))
+        if (productionExecutionsOnly && ctx.mode === 'manual')
             return false;
         if ((ctx.type === 'nodeExecuteBefore' || ctx.type === 'nodeExecuteAfter') && !includeNodeSpans)
             return false;

package/dist/modules/otel/otel-lifecycle-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"otel-lifecycle-handler.js","sourceRoot":"","sources":["../../../src/modules/otel/otel-lifecycle-handler.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAAA,wDAA2D;AAC3D,gDAAkE;AAQlE,gCAAkC;AAGlC,qEAAgE;AAEhE,mEAA8D;AAC9D,iDAA6C;AAC7C,uDAAwD;AACxD,wEAAoE;AAEpE,MAAM,oBAAoB,GAAG,CAAC,KAAc,EAAgC,EAAE,CAC7E,OAAO,KAAK,KAAK,QAAQ;IACzB,KAAK,KAAK,IAAI;IACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IACrB,KAAK,IAAI,KAAK;IACd,OAAO,IAAI,KAAK;IAChB,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;IAC7B,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC;AAEjC,MAAM,sBAAsB,GAAG,CAAC,KAAc,EAAqC,EAAE;IACpF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IACtB,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC,CAAC;AAGK,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAChC,YACkB,MAA4B,EAC5B,mBAAwC,EACxC,WAAwB,EACxB,mBAAwC,EACxC,gBAAkC,EAClC,MAAc,EACd,YAA0B;sBAN1B,MAAM;mCACN,mBAAmB;2BACnB,WAAW;mCACX,mBAAmB;gCACnB,gBAAgB;sBAChB,MAAM;4BACN,YAAY;IAC3B,CAAC;IAGE,AAAN,KAAK,CAAC,kBAAkB;QACvB,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;IAC7B,CAAC;IAEO,mBAAmB,CAAC,QAAuB;QAClD,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;IAEO,WAAW,CAAC,GAA8C;QACjE,MAAM,EAAE,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,GAC5D,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,wBAAwB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QACtF,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,mBAAmB,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB,CAAC,IAAI,CAAC,gBAAgB;YAC7F,OAAO,KAAK,CAAC;QACd,OAAO,IAAI,CAAC;IACb,CAAC;IAGK,AAAN,KAAK,CAAC,eAAe,CAAC,GAAiC;QACtD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO;QAEnC,MAAM,iBAAiB,GAAG,GAAG,CAAC,aAAa,EAAE,eAAe,EAAE,WAAW,CAAC;QAC1E,MAAM,cAAc,GAAG,iBAAiB;YACvC,CAAC;gBACA,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACtD,CAAC;gBACA,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAEtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB;aACzC,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;aACzC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;gBACzD,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE;gBAC3B,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7D,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QAClB,CAAC,CAAC,CAAC;QAEJ,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YAC7C,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,cAAc;YACd,OAAO,EAAE,OAAO;gBACf,CAAC,CAAC;oBACA,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,gBAAgB,EAAE,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,mBAAmB,CAAC;iBAChF;gBACF,CAAC,CAAC,SAAS;YACZ,QAAQ,EAAE;gBACT,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE;gBACnB,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI;gBACvB,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS;gBACjC,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM;gBACpC,gBAAgB,EAAE,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC;aACzD;SACD,CAAC,CAAC;QAIH,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACtE,CAAC;IAGK,AAAN,KAAK,CAAC,gBAAgB,CAAC,GAAiC;QACvD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO;QAEnC,MAAM,yBAAyB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAEtF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB;aACzC,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;aACzC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;gBACzD,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE;gBAC3B,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7D,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QAClB,CAAC,CAAC,CAAC;QAEJ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YACzB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,MAAM,EAAE,yBAAyB;YACjC,OAAO,EAAE,OAAO;gBACf,CAAC,CAAC;oBACA,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,gBAAgB,EAAE,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,mBAAmB,CAAC;iBAChF;gBACF,CAAC,CAAC,SAAS;YACZ,QAAQ,EAAE;gBACT,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE;gBACnB,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI;gBACvB,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS;gBACjC,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM;gBACpC,gBAAgB,EAAE,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC;aACzD;SACD,CAAC,CAAC;IACJ,CAAC;IAGD,aAAa,CAAC,GAAgC;QAC7C,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YACvB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;YAC1B,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;YACtB,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK;YACxC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO;YACrC,OAAO,EAAE,GAAG,CAAC,OAAO;SACpB,CAAC,CAAC;IACJ,CAAC;IAGD,WAAW,CAAC,GAA6B;QACxC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO;QAEnC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YACrB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,IAAI;SACJ,CAAC,CAAC;IACJ,CAAC;IAGD,SAAS,CAAC,GAA4B;QACrC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO;QAEnC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YACnB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,IAAI;YACJ,cAAc,EAAE,eAAe,CAAC,GAAG,CAAC;YACpC,eAAe,EAAE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YACpD,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,SAAS;YACtC,gBAAgB,EAAE,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC;SACrD,CAAC,CAAC;IACJ,CAAC;IAEO,+BAA+B;QACtC,OAAO,IAAI,CAAC,YAAY,CAAC,kCAAkC,EAAE,CAAC;IAC/D,CAAC;IAEO,6BAA6B,CACpC,GAAgE;QAEhE,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,EAAE,MAAM;YAAE,OAAO;QAC1B,IAAI,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAAE,OAAO;QAEpD,MAAM,gBAAgB,GAAqB,EAAE,CAAC;QAE9C,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,UAAU;gBAAE,SAAS;YAE1B,gBAAgB,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;QACtC,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEvD,OAAO,gBAAgB,CAAC;IACzB,CAAC;IAEO,4BAA4B,CACnC,IAAuD;QAEvD,IAAI,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAAE,OAAO,SAAS,CAAC;QAC9D,IAAI,CAAC,IAAI,EAAE,MAAM;YAAE,OAAO,SAAS,CAAC;QAEpC,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;YACnC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAEO,yBAAyB,CAAC,GAA4B;QAC7D,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAAE,OAAO,SAAS,CAAC;QAE9D,OAAO,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CACzF,CAAC;IACH,CAAC;CACD,CAAA;;AA5LM;IADL,IAAA,0BAAa,EAAC,oBAAoB,CAAC;;;;8DAInC;AAiBK;IADL,IAAA,6BAAgB,EAAC,uBAAuB,CAAC;;;;2DA2CzC;AAGK;IADL,IAAA,6BAAgB,EAAC,uBAAuB,CAAC;;;;4DAkCzC;AAGD;IADC,IAAA,6BAAgB,EAAC,sBAAsB,CAAC;;;;yDAUxC;AAGD;IADC,IAAA,6BAAgB,EAAC,mBAAmB,CAAC;;;;uDAWrC;AAGD;IADC,IAAA,6BAAgB,EAAC,kBAAkB,CAAC;;;;qDAepC;+BAxJW,oBAAoB;IADhC,IAAA,YAAO,GAAE;qCAGiB,6CAAoB,EACP,qCAAmB,EAC3B,0BAAW,EACH,2CAAmB,EACtB,oCAAgB,EAC1B,uBAAM,EACA,6BAAY;GARhC,oBAAoB,CAwMhC;AAED,0BAAiC,IAAiD;IACjF,IAAI,CAAC,IAAI,EAAE,IAAI;QAAE,OAAO,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,yBAAgC,GAA4B;IAC3D,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC;IACrD,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU;YAAE,SAAS;QAE1B,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI;YAAE,SAAS;QAE/B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAAC;QAC7D,KAAK,IAAI,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC"}
+{"version":3,"file":"otel-lifecycle-handler.js","sourceRoot":"","sources":["../../../src/modules/otel/otel-lifecycle-handler.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAAA,wDAA2D;AAC3D,gDAAkE;AAQlE,gCAAkC;AAGlC,qEAAgE;AAEhE,mEAA8D;AAC9D,iDAA6C;AAC7C,uDAAwD;AACxD,wEAAoE;AAEpE,MAAM,oBAAoB,GAAG,CAAC,KAAc,EAAgC,EAAE,CAC7E,OAAO,KAAK,KAAK,QAAQ;IACzB,KAAK,KAAK,IAAI;IACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IACrB,KAAK,IAAI,KAAK;IACd,OAAO,IAAI,KAAK;IAChB,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;IAC7B,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC;AAEjC,MAAM,sBAAsB,GAAG,CAAC,KAAc,EAAqC,EAAE;IACpF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IACtB,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC,CAAC;AAGK,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAChC,YACkB,MAA4B,EAC5B,mBAAwC,EACxC,WAAwB,EACxB,mBAAwC,EACxC,gBAAkC,EAClC,MAAc,EACd,YAA0B;sBAN1B,MAAM;mCACN,mBAAmB;2BACnB,WAAW;mCACX,mBAAmB;gCACnB,gBAAgB;sBAChB,MAAM;4BACN,YAAY;IAC3B,CAAC;IAGE,AAAN,KAAK,CAAC,kBAAkB;QACvB,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;IAC7B,CAAC;IAEO,WAAW,CAAC,GAAgD;QACnE,MAAM,EAAE,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,GAC5D,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,wBAAwB,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACpE,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,mBAAmB,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB,CAAC,IAAI,CAAC,gBAAgB;YAC7F,OAAO,KAAK,CAAC;QACd,OAAO,IAAI,CAAC;IACb,CAAC;IAGK,AAAN,KAAK,CAAC,eAAe,CAAC,GAAiC;QACtD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO;QAEnC,MAAM,iBAAiB,GAAG,GAAG,CAAC,aAAa,EAAE,eAAe,EAAE,WAAW,CAAC;QAC1E,MAAM,cAAc,GAAG,iBAAiB;YACvC,CAAC;gBACA,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACtD,CAAC;gBACA,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAEtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB;aACzC,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;aACzC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;gBACzD,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE;gBAC3B,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7D,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QAClB,CAAC,CAAC,CAAC;QAEJ,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YAC7C,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,cAAc;YACd,OAAO,EAAE,OAAO;gBACf,CAAC,CAAC;oBACA,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,gBAAgB,EAAE,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,mBAAmB,CAAC;iBAChF;gBACF,CAAC,CAAC,SAAS;YACZ,QAAQ,EAAE;gBACT,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE;gBACnB,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI;gBACvB,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS;gBACjC,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM;gBACpC,gBAAgB,EAAE,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC;aACzD;SACD,CAAC,CAAC;QAIH,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACtE,CAAC;IAGK,AAAN,KAAK,CAAC,gBAAgB,CAAC,GAAiC;QACvD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO;QAEnC,MAAM,yBAAyB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAEtF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB;aACzC,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;aACzC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;gBACzD,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE;gBAC3B,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7D,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QAClB,CAAC,CAAC,CAAC;QAEJ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YACzB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,MAAM,EAAE,yBAAyB;YACjC,OAAO,EAAE,OAAO;gBACf,CAAC,CAAC;oBACA,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,gBAAgB,EAAE,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,mBAAmB,CAAC;iBAChF;gBACF,CAAC,CAAC,SAAS;YACZ,QAAQ,EAAE;gBACT,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE;gBACnB,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI;gBACvB,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS;gBACjC,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM;gBACpC,gBAAgB,EAAE,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC;aACzD;SACD,CAAC,CAAC;IACJ,CAAC;IAGD,aAAa,CAAC,GAAgC;QAC7C,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YACvB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;YAC1B,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;YACtB,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK;YACxC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO;YACrC,OAAO,EAAE,GAAG,CAAC,OAAO;SACpB,CAAC,CAAC;IACJ,CAAC;IAGD,WAAW,CAAC,GAA6B;QACxC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO;QAEnC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YACrB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,IAAI;SACJ,CAAC,CAAC;IACJ,CAAC;IAGD,SAAS,CAAC,GAA4B;QACrC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO;QAEnC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YACnB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,IAAI;YACJ,cAAc,EAAE,eAAe,CAAC,GAAG,CAAC;YACpC,eAAe,EAAE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YACpD,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,SAAS;YACtC,gBAAgB,EAAE,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC;SACrD,CAAC,CAAC;IACJ,CAAC;IAEO,+BAA+B;QACtC,OAAO,IAAI,CAAC,YAAY,CAAC,kCAAkC,EAAE,CAAC;IAC/D,CAAC;IAEO,6BAA6B,CACpC,GAAgE;QAEhE,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,EAAE,MAAM;YAAE,OAAO;QAC1B,IAAI,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAAE,OAAO;QAEpD,MAAM,gBAAgB,GAAqB,EAAE,CAAC;QAE9C,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,UAAU;gBAAE,SAAS;YAE1B,gBAAgB,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;QACtC,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEvD,OAAO,gBAAgB,CAAC;IACzB,CAAC;IAEO,4BAA4B,CACnC,IAAuD;QAEvD,IAAI,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAAE,OAAO,SAAS,CAAC;QAC9D,IAAI,CAAC,IAAI,EAAE,MAAM;YAAE,OAAO,SAAS,CAAC;QAEpC,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;YACnC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAEO,yBAAyB,CAAC,GAA4B;QAC7D,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAAE,OAAO,SAAS,CAAC;QAE9D,OAAO,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CACzF,CAAC;IACH,CAAC;CACD,CAAA;;AAxLM;IADL,IAAA,0BAAa,EAAC,oBAAoB,CAAC;;;;8DAInC;AAaK;IADL,IAAA,6BAAgB,EAAC,uBAAuB,CAAC;;;;2DA2CzC;AAGK;IADL,IAAA,6BAAgB,EAAC,uBAAuB,CAAC;;;;4DAkCzC;AAGD;IADC,IAAA,6BAAgB,EAAC,sBAAsB,CAAC;;;;yDAUxC;AAGD;IADC,IAAA,6BAAgB,EAAC,mBAAmB,CAAC;;;;uDAWrC;AAGD;IADC,IAAA,6BAAgB,EAAC,kBAAkB,CAAC;;;;qDAepC;+BApJW,oBAAoB;IADhC,IAAA,YAAO,GAAE;qCAGiB,6CAAoB,EACP,qCAAmB,EAC3B,0BAAW,EACH,2CAAmB,EACtB,oCAAgB,EAC1B,uBAAM,EACA,6BAAY;GARhC,oBAAoB,CAoMhC;AAED,0BAAiC,IAAiD;IACjF,IAAI,CAAC,IAAI,EAAE,IAAI;QAAE,OAAO,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,yBAAgC,GAA4B;IAC3D,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC;IACrD,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU;YAAE,SAAS;QAE1B,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI;YAAE,SAAS;QAE/B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAAC;QAC7D,KAAK,IAAI,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/modules/provisioning.ee/provisioning.service.ee.d.ts

@@ -30,8 +30,10 @@ export declare class ProvisioningService {
     init(): Promise<void>;
     getConfig(): Promise<ProvisioningConfigDto>;
     provisionInstanceRoleForUser(user: User, roleSlug: unknown): Promise<void>;
+    private resolveClaimedInstanceRole;
     provisionProjectRolesForUser(userId: string, projectIdToRoles: unknown): Promise<void>;
     patchConfig(rawConfig: unknown): Promise<ProvisioningConfigDto>;
+    private validateDefaultInstanceRole;
     handleReloadSsoProvisioningConfiguration(): Promise<void>;
     loadConfigurationFromDatabase(): Promise<ProvisioningConfigDto | undefined>;
     loadConfig(): Promise<ProvisioningConfigDto>;
@@ -49,5 +51,7 @@ export declare class ProvisioningService {
     private getPreviousProjectRoles;
     private applyExpressionMappedInstanceRole;
     private applyExpressionMappedProjectRoles;
+    assertSsoLoginAllowed(context: RoleResolverContext, instanceRoleClaim: unknown): Promise<void>;
+    private isAssignableGlobalRole;
     provisionExpressionMappedRolesForUser(user: User, context: RoleResolverContext): Promise<void>;
 }

package/dist/modules/provisioning.ee/provisioning.service.ee.js

@@ -22,6 +22,7 @@ const n8n_core_1 = require("n8n-core");
 const n8n_workflow_1 = require("n8n-workflow");
 const zod_1 = require("zod");
 const bad_request_error_1 = require("../../errors/response-errors/bad-request.error");
+const forbidden_error_1 = require("../../errors/response-errors/forbidden.error");
 const event_service_1 = require("../../events/event.service");
 const publisher_service_1 = require("../../scaling/pubsub/publisher.service");
 const project_service_ee_1 = require("../../services/project.service.ee");
@@ -60,27 +61,12 @@ let ProvisioningService = class ProvisioningService {
             return;
         }
         const globalOwnerRoleSlug = permissions_1.GLOBAL_OWNER_ROLE_SLUG;
-        if (typeof roleSlug !== 'string') {
-            this.logger.warn(`skipping instance role provisioning. Invalid role type: expected string, received ${typeof roleSlug}`, {
-                userId: user.id,
-                roleSlug,
-            });
-            return;
-        }
-        let dbRole;
-        try {
-            dbRole = await this.roleRepository.findOneOrFail({ where: { slug: roleSlug } });
-        }
-        catch (error) {
-            this.logger.warn(`Skipping instance role provisioning, a role matching the slug ${roleSlug} was not found`, { userId: user.id, roleSlug, error });
-            return;
-        }
-        if (dbRole.roleType !== 'global') {
-            this.logger.warn(`Skipping instance role provisioning. Role ${roleSlug} is not a global role`, { userId: user.id, roleSlug });
+        const dbRole = await this.resolveClaimedInstanceRole(user, roleSlug);
+        if (!dbRole) {
             return;
         }
         if (dbRole.slug === globalOwnerRoleSlug && user.role.slug !== globalOwnerRoleSlug) {
-            this.logger.warn(`Skipping instance role provisioning. Cannot assign owner role: ${globalOwnerRoleSlug} to user: ${user.id}`, { userId: user.id, roleSlug });
+            this.logger.warn(`Skipping instance role provisioning. Cannot assign owner role: ${globalOwnerRoleSlug} to user: ${user.id}`, { userId: user.id, roleSlug: dbRole.slug });
             return;
         }
         if (user.role.slug === globalOwnerRoleSlug && dbRole.slug !== globalOwnerRoleSlug) {
@@ -88,7 +74,7 @@ let ProvisioningService = class ProvisioningService {
                 where: { role: { slug: globalOwnerRoleSlug }, id: (0, typeorm_1.Not)(user.id) },
             });
             if (otherOwners === 0) {
-                this.logger.warn(`Skipping instance role provisioning. Cannot remove last owner role: ${globalOwnerRoleSlug} from user: ${user.id}`, { userId: user.id, roleSlug });
+                this.logger.warn(`Skipping instance role provisioning. Cannot remove last owner role: ${globalOwnerRoleSlug} from user: ${user.id}`, { userId: user.id, roleSlug: dbRole.slug });
                 return;
             }
         }
@@ -100,6 +86,36 @@ let ProvisioningService = class ProvisioningService {
             });
         }
     }
+    async resolveClaimedInstanceRole(user, roleSlug) {
+        if (typeof roleSlug === 'string') {
+            const dbRole = await this.roleRepository.findOne({ where: { slug: roleSlug } });
+            if (dbRole?.roleType === 'global') {
+                return dbRole;
+            }
+            this.logger.warn(dbRole
+                ? `Instance role claim ${roleSlug} is not a global role`
+                : `A role matching the claimed slug ${roleSlug} was not found`, { userId: user.id, roleSlug });
+        }
+        else if (roleSlug !== undefined && roleSlug !== null) {
+            this.logger.warn(`Invalid instance role claim: expected string, received ${typeof roleSlug}`, { userId: user.id, roleSlug });
+        }
+        const { defaultInstanceRole } = await this.getConfig();
+        if (!defaultInstanceRole || defaultInstanceRole === api_types_1.BLOCK_ACCESS_ASSIGNMENT) {
+            return null;
+        }
+        const fallbackRole = await this.roleRepository.findOne({
+            where: { slug: defaultInstanceRole },
+        });
+        if (fallbackRole?.roleType !== 'global') {
+            this.logger.warn(`Skipping instance role provisioning. Default condition role ${defaultInstanceRole} is not an assignable global role`, { userId: user.id });
+            return null;
+        }
+        this.logger.debug('Applying default condition instance role', {
+            userId: user.id,
+            role: fallbackRole.slug,
+        });
+        return fallbackRole;
+    }
     async provisionProjectRolesForUser(userId, projectIdToRoles) {
         if (!(await this.isProjectRolesProvisioningEnabled())) {
             return;
@@ -208,6 +224,7 @@ let ProvisioningService = class ProvisioningService {
             'scopesInstanceRoleClaimName',
             'scopesProjectsRolesClaimName',
             'scopesUseExpressionMapping',
+            'defaultInstanceRole',
         ];
         const { deleteProjectRules: explicitDeleteProjectRules, ...configPatch } = patchConfig;
         const updatedConfig = {
@@ -224,6 +241,7 @@ let ProvisioningService = class ProvisioningService {
             throw new bad_request_error_1.BadRequestError('Expression-based mapping and direct-claim provisioning cannot both be enabled at the same time.');
         }
         api_types_1.ProvisioningConfigDto.parse(updatedConfig);
+        await this.validateDefaultInstanceRole(updatedConfig.defaultInstanceRole);
         const previousProjectRoleManaged = currentConfig.scopesProvisionProjectRoles || currentConfig.scopesUseExpressionMapping;
         const newProjectRoleManaged = updatedConfig.scopesProvisionProjectRoles ||
             updatedConfig.scopesUseExpressionMapping;
@@ -252,6 +270,16 @@ let ProvisioningService = class ProvisioningService {
         }
         return await this.getConfig();
     }
+    async validateDefaultInstanceRole(value) {
+        if (value === undefined || value === api_types_1.BLOCK_ACCESS_ASSIGNMENT)
+            return;
+        const role = typeof value === 'string'
+            ? await this.roleRepository.findOne({ where: { slug: value } })
+            : null;
+        if (!role || role.roleType !== 'global' || role.slug === permissions_1.GLOBAL_OWNER_ROLE_SLUG) {
+            throw new bad_request_error_1.BadRequestError(`defaultInstanceRole must be "${api_types_1.BLOCK_ACCESS_ASSIGNMENT}" or the slug of an assignable global role`);
+        }
+    }
     async handleReloadSsoProvisioningConfiguration() {
         this.provisioningConfig = await this.loadConfig();
     }
@@ -352,7 +380,12 @@ let ProvisioningService = class ProvisioningService {
                 }
             }
         }
-        return { instanceRoleRules, projectRoleRules, fallbackInstanceRole: 'global:member' };
+        const { defaultInstanceRole } = await this.getConfig();
+        return {
+            instanceRoleRules,
+            projectRoleRules,
+            fallbackInstanceRole: defaultInstanceRole ?? 'global:member',
+        };
     }
     async applyExpressionMappedRoles(user, resolved, managed) {
         if (managed.instanceRole) {
@@ -381,6 +414,9 @@ let ProvisioningService = class ProvisioningService {
         return result;
     }
     async applyExpressionMappedInstanceRole(user, instanceRoleSlug) {
+        if (instanceRoleSlug === api_types_1.BLOCK_ACCESS_ASSIGNMENT) {
+            return;
+        }
         let dbRole;
         try {
             dbRole = await this.roleRepository.findOneOrFail({ where: { slug: instanceRoleSlug } });
@@ -465,6 +501,52 @@ let ProvisioningService = class ProvisioningService {
             userId,
         });
     }
+    async assertSsoLoginAllowed(context, instanceRoleClaim) {
+        if (await this.isExpressionMappingEnabled()) {
+            if (!(await this.hasRoleMappingRulesOfType('instance'))) {
+                const { defaultInstanceRole } = await this.getConfig();
+                if (defaultInstanceRole === api_types_1.BLOCK_ACCESS_ASSIGNMENT) {
+                    this.logger.warn('SSO login blocked by role mapping', {
+                        provider: context.$provider,
+                        matchedRuleId: null,
+                        isFallback: true,
+                    });
+                    throw new forbidden_error_1.ForbiddenError('Access denied by SSO role mapping configuration');
+                }
+                return;
+            }
+            const config = await this.buildRoleMappingConfig();
+            const resolved = await this.roleResolverService.resolveRoles({ ...config, projectRoleRules: [] }, context);
+            if (resolved.instanceRole.role === api_types_1.BLOCK_ACCESS_ASSIGNMENT) {
+                this.logger.warn('SSO login blocked by role mapping', {
+                    provider: context.$provider,
+                    matchedRuleId: resolved.instanceRole.matchedRuleId,
+                    isFallback: resolved.instanceRole.isFallback,
+                });
+                throw new forbidden_error_1.ForbiddenError('Access denied by SSO role mapping configuration');
+            }
+            return;
+        }
+        const config = await this.getConfig();
+        if (!config.scopesProvisionInstanceRole)
+            return;
+        if (config.defaultInstanceRole !== api_types_1.BLOCK_ACCESS_ASSIGNMENT)
+            return;
+        if (!(await this.isAssignableGlobalRole(instanceRoleClaim))) {
+            this.logger.warn('SSO login blocked: no recognised instance role claim', {
+                provider: context.$provider,
+            });
+            throw new forbidden_error_1.ForbiddenError('Access denied by SSO role mapping configuration');
+        }
+    }
+    async isAssignableGlobalRole(roleSlug) {
+        if (typeof roleSlug !== 'string' || roleSlug.length === 0)
+            return false;
+        if (roleSlug === permissions_1.GLOBAL_OWNER_ROLE_SLUG)
+            return false;
+        const role = await this.roleRepository.findOne({ where: { slug: roleSlug } });
+        return role?.roleType === 'global';
+    }
     async provisionExpressionMappedRolesForUser(user, context) {
         if (!(await this.isExpressionMappingEnabled()))
             return;