n8n 2.43.3 → 2.44.0

package/dist/modules/inbound-auth-core/identity/trusted-source-identity.service.js

@@ -0,0 +1,287 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TrustedSourceIdentityService = void 0;
+const api_types_1 = require("@n8n/api-types");
+const backend_common_1 = require("@n8n/backend-common");
+const backend_services_1 = require("@n8n/backend-services");
+const constants_1 = require("@n8n/constants");
+const db_1 = require("@n8n/db");
+const di_1 = require("@n8n/di");
+const inbound_auth_1 = require("@n8n/inbound-auth");
+const permissions_1 = require("@n8n/permissions");
+const n8n_workflow_1 = require("n8n-workflow");
+const role_mapping_proxy_service_1 = require("../../../services/role-mapping-proxy.service");
+const trusted_source_identity_repository_1 = require("../database/repositories/trusted-source-identity.repository");
+const external_identity_1 = require("./external-identity");
+function isStale(lastSeenAt) {
+    return lastSeenAt === null || Date.now() - lastSeenAt.getTime() > constants_1.Time.days.toMilliseconds;
+}
+const PLACEHOLDER_PASSWORD = '!trusted-source-no-password';
+const MAX_NAME_LENGTH = 32;
+function buildContext(verified, external, subject, actor) {
+    return {
+        ...(actor ? { actor } : {}),
+        subject,
+        authMethod: 'oauth-access-token',
+        subjectClaim: {
+            sourceId: verified.source.id,
+            issuer: verified.source.issuer,
+            subject: external.subject,
+        },
+        clientId: external.clientId,
+        tokenScopes: external.scopes,
+        resource: verified.resource,
+        grant: verified.grant,
+        assurance: external.assurance,
+    };
+}
+let TrustedSourceIdentityService = class TrustedSourceIdentityService extends inbound_auth_1.IdentityService {
+    constructor(logger, identities, users, txRunner, eventService, roleService, roleMapping) {
+        super();
+        this.logger = logger;
+        this.identities = identities;
+        this.users = users;
+        this.txRunner = txRunner;
+        this.eventService = eventService;
+        this.roleService = roleService;
+        this.roleMapping = roleMapping;
+    }
+    async mapRoles(source, claims, ctx) {
+        const provider = this.roleMapping.getProvider();
+        if (provider === null)
+            return { ok: false, reason: 'no-role' };
+        const { instanceRoleRules, projectRoleRules, fallbackInstanceRole } = source.config.identity.roleMapping;
+        const resolved = await provider.resolveRoles({ instanceRoleRules, projectRoleRules, fallbackInstanceRole: fallbackInstanceRole ?? '' }, {
+            $claims: claims,
+            $provider: 'oauth2',
+        }, ctx);
+        const instanceRole = resolved.instanceRole.role;
+        if (instanceRole === api_types_1.BLOCK_ACCESS_ASSIGNMENT ||
+            !(await this.isAssignableInstanceRole(instanceRole, ctx))) {
+            return { ok: false, reason: 'no-role' };
+        }
+        const projectRoles = [...resolved.projectRoles.values()].map(({ projectId, role }) => ({
+            projectId,
+            role,
+        }));
+        if (!(await this.identities.projectRolesExist(projectRoles.map(({ role }) => role), ctx))) {
+            return { ok: false, reason: 'no-role' };
+        }
+        return {
+            ok: true,
+            value: {
+                instanceRole,
+                projectRoles,
+                resolved,
+                managed: {
+                    instanceRole: instanceRoleRules.some((rule) => rule.enabled),
+                    projectRoles: projectRoleRules.some((rule) => rule.enabled),
+                },
+                provider,
+            },
+        };
+    }
+    async mapIfContinuous(source, claims, ctx) {
+        if (source.config.identity.roleMapping.mode !== 'continuous') {
+            return { ok: true, value: undefined };
+        }
+        return await this.mapRoles(source, claims, ctx);
+    }
+    async resolveByUserId(id) {
+        const user = await this.users.findByIdWithRole(id);
+        if (user === null)
+            return { ok: false, reason: 'unknown-subject' };
+        if (user.disabled)
+            return { ok: false, reason: 'user-disabled' };
+        return { ok: true, value: (0, db_1.principalFromUser)(user) };
+    }
+    async acceptBinding(source, binding, claims, ctx, mapped) {
+        if (binding.status !== 'active')
+            return { ok: false, reason: 'binding-inactive' };
+        if (binding.user.disabled)
+            return { ok: false, reason: 'user-disabled' };
+        let mappedRoles = mapped;
+        if (mappedRoles === undefined) {
+            const result = await this.mapIfContinuous(source, claims, ctx);
+            if (!result.ok)
+                return result;
+            mappedRoles = result.value;
+        }
+        if (isStale(binding.lastSeenAt)) {
+            await this.identities.touchLastSeen(binding.sourceId, binding.subject, new Date(), ctx);
+        }
+        const continuous = mappedRoles !== undefined &&
+            binding.provenance === 'jit' &&
+            binding.user.role.slug !== permissions_1.GLOBAL_OWNER_ROLE_SLUG
+            ? mappedRoles
+            : undefined;
+        return {
+            ok: true,
+            value: {
+                principal: (0, db_1.principalFromUser)(binding.user),
+                ...(continuous && {
+                    onCommit: async () => {
+                        await continuous.provider.applyResolvedRoles(binding.user, continuous.resolved, continuous.managed);
+                        if (!continuous.managed.instanceRole ||
+                            binding.user.role.slug === continuous.instanceRole)
+                            return;
+                        const user = await this.users.findByIdWithRole(binding.user.id);
+                        return user === null ? undefined : (0, db_1.principalFromUser)(user);
+                    },
+                }),
+            },
+        };
+    }
+    async link(source, external, user, ctx) {
+        const row = {
+            sourceId: source.id,
+            subject: external.subject,
+            userId: user.id,
+            provenance: 'claim-match',
+            status: 'active',
+        };
+        const mapped = await this.mapIfContinuous(source, external.raw, ctx);
+        if (!mapped.ok)
+            return mapped;
+        await this.identities.insertIfAbsent(row, ctx);
+        const binding = await this.identities.findBySubject(source.id, external.subject, ctx);
+        if (binding === null)
+            throw new n8n_workflow_1.UnexpectedError('Binding missing after insert');
+        const accepted = await this.acceptBinding(source, binding, external.raw, ctx, mapped.value);
+        if (accepted.ok && binding.user.id === user.id) {
+            return {
+                ok: true,
+                value: {
+                    principal: accepted.value.principal,
+                    onCommit: async () => {
+                        const refreshed = await accepted.value.onCommit?.();
+                        this.eventService.emit('trusted-source-identity-linked', {
+                            userId: user.id,
+                            sourceId: source.id,
+                            subject: external.subject,
+                            issuer: source.issuer,
+                            provenance: 'claim-match',
+                        });
+                        return refreshed;
+                    },
+                },
+            };
+        }
+        return accepted;
+    }
+    async provision(source, external, ctx) {
+        const { provision } = source.config.identity;
+        if (provision.human === 'off')
+            return { ok: false, reason: 'provision-refused' };
+        const email = external.email;
+        if (email === undefined || !(0, db_1.isValidEmail)(email))
+            return { ok: false, reason: 'provision-refused' };
+        if (source.config.identity.roleMapping.mode === 'off')
+            return { ok: false, reason: 'no-role' };
+        const mapped = await this.mapRoles(source, external.raw, ctx);
+        if (!mapped.ok)
+            return mapped;
+        const { instanceRole: role, projectRoles } = mapped.value;
+        const [firstName = '', ...rest] = (external.displayName ?? '').trim().split(/\s+/);
+        const user = await this.identities.createUserWithBinding(ctx, {
+            email,
+            firstName: firstName.slice(0, MAX_NAME_LENGTH),
+            lastName: rest.join(' ').slice(0, MAX_NAME_LENGTH),
+            role: {
+                slug: role,
+            },
+            password: PLACEHOLDER_PASSWORD,
+        }, {
+            sourceId: source.id,
+            subject: external.subject,
+            provenance: 'jit',
+            status: 'active',
+        }, projectRoles);
+        return {
+            ok: true,
+            value: {
+                principal: (0, db_1.principalFromUser)(user),
+                onCommit: async () => {
+                    this.eventService.emit('trusted-source-user-provisioned', {
+                        userId: user.id,
+                        sourceId: source.id,
+                        subject: external.subject,
+                        issuer: source.issuer,
+                        role,
+                    });
+                    return undefined;
+                },
+            },
+        };
+    }
+    async isAssignableInstanceRole(slug, ctx) {
+        if (slug === permissions_1.GLOBAL_OWNER_ROLE_SLUG)
+            return false;
+        if (!(await this.identities.globalRoleExists(slug, ctx)))
+            return false;
+        return this.roleService.isRoleLicensed(slug);
+    }
+    async linkOrProvision(source, external, ctx) {
+        const { linkByEmail } = source.config.identity;
+        if (linkByEmail === 'off')
+            return { ok: false, reason: 'link-refused' };
+        const mayUseEmail = linkByEmail === 'any' || (linkByEmail === 'verified-only' && external.emailVerified === true);
+        const email = mayUseEmail ? external.email : undefined;
+        if (email !== undefined) {
+            const user = await this.identities.findUserByEmail(email, ctx);
+            if (user !== null) {
+                if (user.disabled)
+                    return { ok: false, reason: 'user-disabled' };
+                if (user.role.slug === permissions_1.GLOBAL_OWNER_ROLE_SLUG)
+                    return { ok: false, reason: 'link-refused' };
+                return await this.link(source, external, user, ctx);
+            }
+        }
+        return await this.provision(source, { ...external, email }, ctx);
+    }
+    async resolveBinding(source, external) {
+        const result = await this.txRunner.run({}, async (ctx) => {
+            const binding = await this.identities.findBySubject(source.id, external.subject, ctx);
+            if (binding !== null)
+                return await this.acceptBinding(source, binding, external.raw, ctx);
+            return await this.linkOrProvision(source, external, ctx);
+        });
+        if (result.ok) {
+            const refreshed = await result.value.onCommit?.();
+            return { ok: true, value: refreshed ?? result.value.principal };
+        }
+        return result;
+    }
+    async identify(verified) {
+        const { source } = verified;
+        const identity = source.config.identity;
+        const translated = (0, external_identity_1.translateClaims)(verified.claims, identity.claimMapping, this.logger);
+        if (!translated.ok)
+            return translated;
+        const externalIdentity = translated.value;
+        const resolved = identity.subject === 'n8n-user-id'
+            ? await this.resolveByUserId(externalIdentity.subject)
+            : await this.resolveBinding(source, externalIdentity);
+        if (!resolved.ok)
+            return resolved;
+        return {
+            ok: true,
+            value: buildContext(verified, externalIdentity, resolved.value),
+        };
+    }
+};
+exports.TrustedSourceIdentityService = TrustedSourceIdentityService;
+exports.TrustedSourceIdentityService = TrustedSourceIdentityService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [backend_common_1.Logger, trusted_source_identity_repository_1.TrustedSourceIdentityRepository, db_1.UserRepository, db_1.TransactionRunner, backend_services_1.EventService, backend_services_1.RoleService, role_mapping_proxy_service_1.RoleMappingProxyService])
+], TrustedSourceIdentityService);
+//# sourceMappingURL=trusted-source-identity.service.js.map

package/dist/modules/inbound-auth-core/identity/trusted-source-identity.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-source-identity.service.js","sourceRoot":"","sources":["../../../../src/modules/inbound-auth-core/identity/trusted-source-identity.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,8CAAyD;AACzD,wDAA6C;AAC7C,4DAAkE;AAClE,8CAAsC;AACtC,gCAOiB;AACjB,gCAAkC;AAClC,oDAM2B;AAC3B,kDAAgG;AAChG,+CAA+C;AAE/C,sFAI+C;AAG/C,oHAGqE;AACrE,2DAAsD;AAGtD,SAAS,OAAO,CAAC,UAAuB;IACvC,OAAO,UAAU,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,gBAAI,CAAC,IAAI,CAAC,cAAc,CAAC;AAC5F,CAAC;AAID,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAE3D,MAAM,eAAe,GAAG,EAAE,CAAC;AAW3B,SAAS,YAAY,CACpB,QAAkB,EAClB,QAA0B,EAC1B,OAAkB,EAClB,KAAiB;IAEjB,OAAO;QACN,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,OAAO;QACP,UAAU,EAAE,oBAAoB;QAChC,YAAY,EAAE;YACb,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE;YAC5B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM;YAC9B,OAAO,EAAE,QAAQ,CAAC,OAAO;SACzB;QACD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,WAAW,EAAE,QAAQ,CAAC,MAAM;QAC5B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC7B,CAAC;AACH,CAAC;AAYM,IAAM,4BAA4B,GAAlC,MAAM,4BAA6B,SAAQ,8BAAe;IAChE,YACkB,MAAc,EACd,UAA2C,EAC3C,KAAqB,EACrB,QAA2B,EAC3B,YAA0B,EAC1B,WAAwB,EACxB,WAAoC;QAErD,KAAK,EAAE,CAAC;sBARS,MAAM;0BACN,UAAU;qBACV,KAAK;wBACL,QAAQ;4BACR,YAAY;2BACZ,WAAW;2BACX,WAAW;IAG7B,CAAC;IAGO,KAAK,CAAC,QAAQ,CACrB,MAAqB,EACrB,MAAyC,EACzC,GAAqB;QAGrB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;QAChD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAE/D,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,GAClE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;QAEpC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAC3C,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,oBAAoB,IAAI,EAAE,EAAE,EACzF;YACC,OAAO,EAAE,MAAM;YAEf,SAAS,EAAE,QAAQ;SACnB,EACD,GAAG,CACH,CAAC;QAEF,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC;QAEhD,IACC,YAAY,KAAK,mCAAuB;YACxC,CAAC,CAAC,MAAM,IAAI,CAAC,wBAAwB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,EACxD,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACtF,SAAS;YACT,IAAI;SACJ,CAAC,CAAC,CAAC;QAEJ,IACC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,iBAAiB,CACxC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EACpC,GAAG,CACH,CAAC,EACD,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACzC,CAAC;QAED,OAAO;YACN,EAAE,EAAE,IAAI;YACR,KAAK,EAAE;gBACN,YAAY;gBACZ,YAAY;gBACZ,QAAQ;gBACR,OAAO,EAAE;oBACR,YAAY,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;oBAC5D,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;iBAC3D;gBACD,QAAQ;aACR;SACD,CAAC;IACH,CAAC;IAGO,KAAK,CAAC,eAAe,CAC5B,MAAqB,EACrB,MAAyC,EACzC,GAAqB;QAErB,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QACvC,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,EAAU;QACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACnE,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAA,sBAAiB,EAAC,IAAI,CAAC,EAAE,CAAC;IACrD,CAAC;IAEO,KAAK,CAAC,aAAa,CAC1B,MAAqB,EACrB,OAAoC,EACpC,MAAyC,EACzC,GAAqB,EACrB,MAAoB;QAEpB,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAClF,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAGzE,IAAI,WAAW,GAAG,MAAM,CAAC;QACzB,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC;YAC9B,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5B,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QACzF,CAAC;QAGD,MAAM,UAAU,GACf,WAAW,KAAK,SAAS;YACzB,OAAO,CAAC,UAAU,KAAK,KAAK;YAC5B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,oCAAsB;YAChD,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO;YACN,EAAE,EAAE,IAAI;YACR,KAAK,EAAE;gBACN,SAAS,EAAE,IAAA,sBAAiB,EAAC,OAAO,CAAC,IAAI,CAAC;gBAE1C,GAAG,CAAC,UAAU,IAAI;oBACjB,QAAQ,EAAE,KAAK,IAAI,EAAE;wBACpB,MAAM,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CAC3C,OAAO,CAAC,IAAI,EACZ,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,OAAO,CAClB,CAAC;wBAEF,IACC,CAAC,UAAU,CAAC,OAAO,CAAC,YAAY;4BAChC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,YAAY;4BAElD,OAAO;wBACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;wBAChE,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,sBAAiB,EAAC,IAAI,CAAC,CAAC;oBAC5D,CAAC;iBACD,CAAC;aACF;SACD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CACjB,MAAqB,EACrB,QAA0B,EAC1B,IAAU,EACV,GAAqB;QAErB,MAAM,GAAG,GAAmC;YAC3C,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,UAAU,EAAE,aAAa;YACzB,MAAM,EAAE,QAAQ;SAChB,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAG9B,MAAM,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAE/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACtF,IAAI,OAAO,KAAK,IAAI;YAAE,MAAM,IAAI,8BAAe,CAAC,8BAA8B,CAAC,CAAC;QAEhF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAE5F,IAAI,QAAQ,CAAC,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YAChD,OAAO;gBACN,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE;oBACN,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS;oBACnC,QAAQ,EAAE,KAAK,IAAI,EAAE;wBACpB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;wBACpD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,EAAE;4BACxD,MAAM,EAAE,IAAI,CAAC,EAAE;4BACf,QAAQ,EAAE,MAAM,CAAC,EAAE;4BACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;4BACzB,MAAM,EAAE,MAAM,CAAC,MAAM;4BACrB,UAAU,EAAE,aAAa;yBACzB,CAAC,CAAC;wBACH,OAAO,SAAS,CAAC;oBAClB,CAAC;iBACD;aACD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,SAAS,CACtB,MAAqB,EACrB,QAA0B,EAC1B,GAAqB;QAErB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAE7C,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QAEjF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;QAE7B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,IAAA,iBAAY,EAAC,KAAK,CAAC;YAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QAGnD,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAE/F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;QAE1D,MAAM,CAAC,SAAS,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEnF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,qBAAqB,CACvD,GAAG,EACH;YACC,KAAK;YACL,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;YAC9C,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;YAClD,IAAI,EAAE;gBACL,IAAI,EAAE,IAAI;aACV;YACD,QAAQ,EAAE,oBAAoB;SAC9B,EACD;YACC,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,QAAQ;SAChB,EACD,YAAY,CACZ,CAAC;QAEF,OAAO;YACN,EAAE,EAAE,IAAI;YACR,KAAK,EAAE;gBACN,SAAS,EAAE,IAAA,sBAAiB,EAAC,IAAI,CAAC;gBAClC,QAAQ,EAAE,KAAK,IAAI,EAAE;oBACpB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,EAAE;wBACzD,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,QAAQ,EAAE,MAAM,CAAC,EAAE;wBACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;wBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,IAAI;qBACJ,CAAC,CAAC;oBACH,OAAO,SAAS,CAAC;gBAClB,CAAC;aACD;SACD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,wBAAwB,CAAC,IAAY,EAAE,GAAqB;QACzE,IAAI,IAAI,KAAK,oCAAsB;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACvE,OAAO,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAEO,KAAK,CAAC,eAAe,CAC5B,MAAqB,EACrB,QAA0B,EAC1B,GAAqB;QAErB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAE/C,IAAI,WAAW,KAAK,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAGxE,MAAM,WAAW,GAChB,WAAW,KAAK,KAAK,IAAI,CAAC,WAAW,KAAK,eAAe,IAAI,QAAQ,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC;QAC/F,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAEvD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACnB,IAAI,IAAI,CAAC,QAAQ;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;gBACjE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,oCAAsB;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;gBAE5F,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;QACF,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IAEO,KAAK,CAAC,cAAc,CAC3B,MAAqB,EACrB,QAA0B;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACtF,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1F,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;YAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACjE,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAkB;QAChC,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAExC,MAAM,UAAU,GAAG,IAAA,mCAAe,EAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAExF,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC;QAEtC,MAAM,gBAAgB,GAAG,UAAU,CAAC,KAAK,CAAC;QAE1C,MAAM,QAAQ,GACb,QAAQ,CAAC,OAAO,KAAK,aAAa;YACjC,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACtD,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAExD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QAElC,OAAO;YACN,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,YAAY,CAAC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC;SAC/D,CAAC;IACH,CAAC;CACD,CAAA;;uCAxUY,4BAA4B;IADxC,IAAA,YAAO,GAAE;qCAGiB,uBAAM,EACF,oEAA+B,EACpC,mBAAc,EACX,sBAAiB,EACb,+BAAY,EACb,8BAAW,EACX,oDAAuB;GAR1C,4BAA4B,CAwUxC"}

package/dist/modules/inbound-auth-core/inbound-auth-core.module.d.ts

@@ -1,5 +1,6 @@
 import type { ModuleInterface } from '@n8n/decorators';
 export declare class InboundAuthCoreModule implements ModuleInterface {
     init(): Promise<void>;
+    systemTasks(): Promise<typeof import("./trusted-source-discovery.task.js").TrustedSourceDiscoveryTask[]>;
     entities(): Promise<(typeof import("./database/entities/trusted-source.entity.js").TrustedSourceEntity | typeof import("./database/entities/trusted-source-identity.entity.js").TrustedSourceIdentityEntity)[]>;
 }

package/dist/modules/inbound-auth-core/inbound-auth-core.module.js

@@ -10,35 +10,45 @@ exports.InboundAuthCoreModule = void 0;
 const decorators_1 = require("@n8n/decorators");
 const di_1 = require("@n8n/di");
 const inbound_auth_1 = require("@n8n/inbound-auth");
-class UnregisteredAuthenticationService extends inbound_auth_1.AuthenticationService {
-    async authenticate(_extracted) {
-        return { ok: false, reason: 'source-unusable' };
+const n8n_core_1 = require("n8n-core");
+const n8n_workflow_1 = require("n8n-workflow");
+class UnregisteredLocalAuthorizationServer extends inbound_auth_1.LocalAuthorizationServer {
+    async getMetadata() {
+        throw new n8n_workflow_1.OperationalError('No local authorization server is registered');
     }
-    async advertise() {
-        return { authorizationServers: [], challenges: [] };
-    }
-}
-class UnregisteredIdentityService extends inbound_auth_1.IdentityService {
-    async identify(_verified) {
-        return { ok: false, reason: 'source-unusable' };
-    }
-}
-class UnregisteredTrustedSourceGate extends inbound_auth_1.TrustedSourceGate {
-    async authorizeSealed() {
-        return false;
+    async getJwks() {
+        throw new n8n_workflow_1.OperationalError('No local authorization server is registered');
     }
 }
 let InboundAuthCoreModule = class InboundAuthCoreModule {
     async init() {
-        if (!di_1.Container.has(inbound_auth_1.AuthenticationService)) {
-            di_1.Container.set(inbound_auth_1.AuthenticationService, new UnregisteredAuthenticationService());
+        if (!di_1.Container.has(inbound_auth_1.LocalAuthorizationServer)) {
+            di_1.Container.set(inbound_auth_1.LocalAuthorizationServer, new UnregisteredLocalAuthorizationServer());
         }
-        if (!di_1.Container.has(inbound_auth_1.IdentityService)) {
-            di_1.Container.set(inbound_auth_1.IdentityService, new UnregisteredIdentityService());
+        const { TrustedSourceDbStore } = await import('./trusted-source.store.js');
+        if (!di_1.Container.has(inbound_auth_1.TrustedSourceStore)) {
+            di_1.Container.set(inbound_auth_1.TrustedSourceStore, di_1.Container.get(TrustedSourceDbStore));
         }
+        const { TrustedSourceDbGate } = await import('./trusted-source.gate.js');
         if (!di_1.Container.has(inbound_auth_1.TrustedSourceGate)) {
-            di_1.Container.set(inbound_auth_1.TrustedSourceGate, new UnregisteredTrustedSourceGate());
+            di_1.Container.set(inbound_auth_1.TrustedSourceGate, di_1.Container.get(TrustedSourceDbGate));
         }
+        if (di_1.Container.get(n8n_core_1.InstanceSettings).instanceType === 'main') {
+            const { SystemTrustedSourceSeeder } = await import('./system-trusted-source.seeder.js');
+            await di_1.Container.get(SystemTrustedSourceSeeder).seed();
+        }
+        const { OAuth2AuthenticationService } = await import('./authentication.service.js');
+        di_1.Container.set(inbound_auth_1.AuthenticationService, di_1.Container.get(OAuth2AuthenticationService));
+        const { TrustedSourceIdentityService } = await import('./identity/trusted-source-identity.service.js');
+        if (!di_1.Container.has(inbound_auth_1.IdentityService)) {
+            di_1.Container.set(inbound_auth_1.IdentityService, di_1.Container.get(TrustedSourceIdentityService));
+        }
+        const { InboundAuthPipeline } = await import('./authentication-pipeline.js');
+        di_1.Container.set(inbound_auth_1.AuthenticationPipeline, di_1.Container.get(InboundAuthPipeline));
+    }
+    async systemTasks() {
+        const { TrustedSourceDiscoveryTask } = await import('./trusted-source-discovery.task.js');
+        return [TrustedSourceDiscoveryTask];
     }
     async entities() {
         const { TrustedSourceEntity } = await import('./database/entities/trusted-source.entity.js');

package/dist/modules/inbound-auth-core/inbound-auth-core.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"inbound-auth-core.module.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/inbound-auth-core.module.ts"],"names":[],"mappings":";;;;;;;;;AACA,gDAAgD;AAChD,gCAAoC;AACpC,oDAO2B;AAK3B,MAAM,iCAAkC,SAAQ,oCAAqB;IACpE,KAAK,CAAC,YAAY,CAAC,UAAqB;QACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,SAAS;QACd,OAAO,EAAE,oBAAoB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACrD,CAAC;CACD;AAED,MAAM,2BAA4B,SAAQ,8BAAe;IACxD,KAAK,CAAC,QAAQ,CAAC,SAAmB;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACjD,CAAC;CACD;AAED,MAAM,6BAA8B,SAAQ,gCAAiB;IAC5D,KAAK,CAAC,eAAe;QACpB,OAAO,KAAK,CAAC;IACd,CAAC;CACD;AAQM,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IACjC,KAAK,CAAC,IAAI;QAET,IAAI,CAAC,cAAS,CAAC,GAAG,CAAC,oCAAqB,CAAC,EAAE,CAAC;YAC3C,cAAS,CAAC,GAAG,CAAC,oCAAqB,EAAE,IAAI,iCAAiC,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,cAAS,CAAC,GAAG,CAAC,8BAAe,CAAC,EAAE,CAAC;YACrC,cAAS,CAAC,GAAG,CAAC,8BAAe,EAAE,IAAI,2BAA2B,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,cAAS,CAAC,GAAG,CAAC,gCAAiB,CAAC,EAAE,CAAC;YACvC,cAAS,CAAC,GAAG,CAAC,gCAAiB,EAAE,IAAI,6BAA6B,EAAE,CAAC,CAAC;QACvE,CAAC;IACF,CAAC;IAED,KAAK,CAAC,QAAQ;QACb,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,8CAA8C,CAAC,CAAC;QAC7F,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CACnD,uDAAuD,CACvD,CAAC;QAEF,OAAO,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;IAC3D,CAAC;CACD,CAAA;;gCAtBY,qBAAqB;IADjC,IAAA,0BAAa,EAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;GAC9E,qBAAqB,CAsBjC"}
+{"version":3,"file":"inbound-auth-core.module.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/inbound-auth-core.module.ts"],"names":[],"mappings":";;;;;;;;;AACA,gDAAgD;AAChD,gCAAoC;AACpC,oDAS2B;AAC3B,uCAA4C;AAC5C,+CAAgD;AAGhD,MAAM,oCAAqC,SAAQ,uCAAwB;IAC1E,KAAK,CAAC,WAAW;QAChB,MAAM,IAAI,+BAAgB,CAAC,6CAA6C,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,MAAM,IAAI,+BAAgB,CAAC,6CAA6C,CAAC,CAAC;IAC3E,CAAC;CACD;AASM,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IACjC,KAAK,CAAC,IAAI;QAET,IAAI,CAAC,cAAS,CAAC,GAAG,CAAC,uCAAwB,CAAC,EAAE,CAAC;YAC9C,cAAS,CAAC,GAAG,CAAC,uCAAwB,EAAE,IAAI,oCAAoC,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QAC3E,IAAI,CAAC,cAAS,CAAC,GAAG,CAAC,iCAAkB,CAAC,EAAE,CAAC;YACxC,cAAS,CAAC,GAAG,CAAC,iCAAkB,EAAE,cAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACzE,IAAI,CAAC,cAAS,CAAC,GAAG,CAAC,gCAAiB,CAAC,EAAE,CAAC;YACvC,cAAS,CAAC,GAAG,CAAC,gCAAiB,EAAE,cAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,cAAS,CAAC,GAAG,CAAC,2BAAgB,CAAC,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YAC7D,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAC;YACxF,MAAM,cAAS,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,CAAC;QAED,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QACpF,cAAS,CAAC,GAAG,CAAC,oCAAqB,EAAE,cAAS,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;QAEjF,MAAM,EAAE,4BAA4B,EAAE,GAAG,MAAM,MAAM,CACpD,+CAA+C,CAC/C,CAAC;QACF,IAAI,CAAC,cAAS,CAAC,GAAG,CAAC,8BAAe,CAAC,EAAE,CAAC;YACrC,cAAS,CAAC,GAAG,CAAC,8BAAe,EAAE,cAAS,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QAC7E,cAAS,CAAC,GAAG,CAAC,qCAAsB,EAAE,cAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC3E,CAAC;IAGD,KAAK,CAAC,WAAW;QAChB,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAC;QAC1F,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,QAAQ;QACb,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,8CAA8C,CAAC,CAAC;QAC7F,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CACnD,uDAAuD,CACvD,CAAC;QAEF,OAAO,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;IAC3D,CAAC;CACD,CAAA;;gCAlDY,qBAAqB;IADjC,IAAA,0BAAa,EAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;GAC9E,qBAAqB,CAkDjC"}

package/dist/modules/inbound-auth-core/key.utils.d.ts

@@ -0,0 +1,2 @@
+import { type Jwk } from '@n8n/inbound-auth';
+export declare const getPublicKeyFromJwk: (jwks: Array<Jwk>, kid: string, usage?: string) => import("crypto").KeyObject | undefined;

package/dist/modules/inbound-auth-core/key.utils.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPublicKeyFromJwk = void 0;
+const node_crypto_1 = require("node:crypto");
+const getPublicKeyFromJwk = (jwks, kid, usage = 'sig') => {
+    const foundKey = jwks
+        .filter((key) => key.use === usage || !key.use)
+        .find((key) => key.kid === kid);
+    if (!foundKey) {
+        return undefined;
+    }
+    return (0, node_crypto_1.createPublicKey)({
+        key: foundKey,
+        format: 'jwk',
+    });
+};
+exports.getPublicKeyFromJwk = getPublicKeyFromJwk;
+//# sourceMappingURL=key.utils.js.map

package/dist/modules/inbound-auth-core/key.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.utils.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/key.utils.ts"],"names":[],"mappings":";;;AAEA,6CAA8C;AAEvC,MAAM,mBAAmB,GAAG,CAAC,IAAgB,EAAE,GAAW,EAAE,KAAK,GAAW,KAAK,EAAE,EAAE;IAC3F,MAAM,QAAQ,GAAG,IAAI;SACnB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;SAC9C,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAEjC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,IAAA,6BAAe,EAAC;QACtB,GAAG,EAAE,QAAQ;QACb,MAAM,EAAE,KAAK;KACb,CAAC,CAAC;AACJ,CAAC,CAAC;AAZW,QAAA,mBAAmB,GAAnB,mBAAmB,CAY9B"}

package/dist/modules/inbound-auth-core/oauth2-bearer.driver.d.ts

@@ -0,0 +1,16 @@
+import { AuthenticationDriver, TrustedSourceStore, type AdvertisedResource, type Extracted, type Result, type TrustedSource, type Verified } from '@n8n/inbound-auth';
+import { Logger } from '@n8n/backend-common';
+export declare class Oauth2BearerDriver extends AuthenticationDriver {
+    private readonly store;
+    readonly credentialKind: 'bearer';
+    readonly sourceTypes: Array<TrustedSource['type']>;
+    private readonly logger;
+    constructor(store: TrustedSourceStore, logger: Logger);
+    selectSource(extracted: Extracted): Promise<TrustedSource | undefined>;
+    private reject;
+    verify(extracted: Extracted, source: TrustedSource): Promise<Result<Verified>>;
+    advertise(resource: AdvertisedResource, sources: TrustedSource[]): {
+        authorizationServers?: string[];
+        challenge?: string;
+    };
+}

package/dist/modules/inbound-auth-core/oauth2-bearer.driver.js

@@ -0,0 +1,171 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Oauth2BearerDriver = void 0;
+const di_1 = require("@n8n/di");
+const inbound_auth_1 = require("@n8n/inbound-auth");
+const jsonwebtoken_1 = require("jsonwebtoken");
+const backend_common_1 = require("@n8n/backend-common");
+const key_utils_1 = require("./key.utils");
+const isJwtFailure = (error) => typeof error === 'object' && error !== null && 'name' in error && typeof error.name === 'string';
+const normalizeAudiences = (aud) => {
+    if (typeof aud === 'string')
+        return [aud];
+    if (Array.isArray(aud))
+        return aud.filter((entry) => typeof entry === 'string');
+    return [];
+};
+let Oauth2BearerDriver = class Oauth2BearerDriver extends inbound_auth_1.AuthenticationDriver {
+    constructor(store, logger) {
+        super();
+        this.store = store;
+        this.credentialKind = 'bearer';
+        this.sourceTypes = ['oauth2'];
+        this.logger = logger.scoped('inbound-auth');
+    }
+    async selectSource(extracted) {
+        let issuer;
+        try {
+            const decoded = (0, jsonwebtoken_1.decode)(extracted.credential.token);
+            issuer =
+                typeof decoded === 'object' && decoded !== null && typeof decoded.iss === 'string'
+                    ? decoded.iss
+                    : undefined;
+        }
+        catch (error) {
+            this.logger.warn('Failed to decode JWT', { error });
+        }
+        return issuer ? await this.store.getByIssuer(issuer) : undefined;
+    }
+    reject(error) {
+        if (!isJwtFailure(error))
+            return { ok: false, reason: 'signature-invalid' };
+        switch (error.name) {
+            case 'TokenExpiredError':
+                return { ok: false, reason: 'expired', detail: error.message };
+            case 'JsonWebTokenError':
+                if (error.message === 'jwt must be provided')
+                    return { ok: false, reason: 'not-an-access-token' };
+                if (error.message.startsWith('jwt audience invalid'))
+                    return { ok: false, reason: 'audience-mismatch', detail: error.message };
+                return { ok: false, reason: 'signature-invalid', detail: error.message };
+            case 'NotBeforeError':
+                return { ok: false, reason: 'expired', detail: error.message };
+            default:
+                return { ok: false, reason: 'signature-invalid', detail: error.name };
+        }
+    }
+    async verify(extracted, source) {
+        const { authentication } = source.config;
+        const jwks = source.metadata?.documents.find((doc) => doc.kind === 'jwks');
+        if (!jwks) {
+            return {
+                ok: false,
+                reason: 'source-unusable',
+                detail: 'JWKS document not found',
+            };
+        }
+        const allowedAudiences = source.config.surfaces[extracted.surface]?.audiences ?? extracted.resource.acceptedAudiences;
+        let token;
+        try {
+            token = await new Promise((resolve, reject) => {
+                (0, jsonwebtoken_1.verify)(extracted.credential.token, (header, keyCallback) => {
+                    if (!header.kid) {
+                        return keyCallback(new Error('Missing kid in JWT header'));
+                    }
+                    const key = (0, key_utils_1.getPublicKeyFromJwk)(jwks.keys, header.kid);
+                    if (!key) {
+                        return keyCallback(new Error('Public key not found for the given kid'));
+                    }
+                    keyCallback(null, key);
+                }, {
+                    issuer: source.issuer,
+                    algorithms: authentication.algorithms,
+                    clockTolerance: authentication.clockSkewSeconds,
+                    complete: true,
+                }, (jwtError, decoded) => {
+                    if (jwtError) {
+                        reject(jwtError);
+                    }
+                    else {
+                        if (!decoded) {
+                            reject(new Error('Decoded JWT is undefined'));
+                            return;
+                        }
+                        resolve(decoded);
+                    }
+                });
+            });
+        }
+        catch (error) {
+            return this.reject(error);
+        }
+        const { typ } = token.header;
+        const allowedTokenTypes = authentication.allowedTokenTypes;
+        if (!typ || !allowedTokenTypes.includes(typ)) {
+            return { ok: false, reason: 'not-an-access-token' };
+        }
+        const payload = typeof token.payload === 'object' && token.payload !== null ? token.payload : {};
+        const { exp, iat } = payload;
+        if (typeof exp !== 'number' || typeof iat !== 'number')
+            return { ok: false, reason: 'expired' };
+        const max = authentication.maxTokenLifetimeSeconds;
+        if (exp - iat > max)
+            return {
+                ok: false,
+                reason: 'expired',
+                detail: `lifetime ${exp - iat}s exceeds the source maximum of ${max}s`,
+            };
+        if (iat > Math.floor(Date.now() / 1000) + authentication.clockSkewSeconds) {
+            return { ok: false, reason: 'expired', detail: 'Token is not yet valid' };
+        }
+        const tokenAudiences = normalizeAudiences(payload.aud);
+        if (!tokenAudiences.some((aud) => allowedAudiences.includes(aud))) {
+            return {
+                ok: false,
+                reason: 'audience-mismatch',
+                detail: 'JWT audience is not allowed',
+            };
+        }
+        const { credential, request: { headers: _headers, ...request }, ...rest } = extracted;
+        return {
+            ok: true,
+            value: {
+                ...rest,
+                request,
+                credentialKind: credential.kind,
+                source,
+                claims: payload,
+                expiresAt: new Date(exp * 1000),
+            },
+        };
+    }
+    advertise(resource, sources) {
+        try {
+            const url = new URL(resource.resource.url);
+            const path = url.pathname === '/' ? '' : url.pathname;
+            return {
+                authorizationServers: sources.filter((s) => s.type === 'oauth2').map((s) => s.issuer),
+                challenge: `Bearer resource_metadata="${url.origin}/.well-known/oauth-protected-resource${path}"`,
+            };
+        }
+        catch (error) {
+            this.logger.warn('Failed to advertise resource', { error });
+            return {};
+        }
+    }
+};
+exports.Oauth2BearerDriver = Oauth2BearerDriver;
+exports.Oauth2BearerDriver = Oauth2BearerDriver = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [inbound_auth_1.TrustedSourceStore, backend_common_1.Logger])
+], Oauth2BearerDriver);
+//# sourceMappingURL=oauth2-bearer.driver.js.map

package/dist/modules/inbound-auth-core/oauth2-bearer.driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-bearer.driver.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/oauth2-bearer.driver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAAkC;AAClC,oDAS2B;AAC3B,+CAAqE;AAErE,wDAA6C;AAC7C,2CAAkD;AAGlD,MAAM,YAAY,GAAG,CAAC,KAAc,EAAuB,EAAE,CAC5D,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAGlG,MAAM,kBAAkB,GAAG,CAAC,GAAY,EAAY,EAAE;IACrD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;IACjG,OAAO,EAAE,CAAC;AACX,CAAC,CAAC;AAIK,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,mCAAoB;IAO3D,YACkB,KAAyB,EAC1C,MAAc;QAEd,KAAK,EAAE,CAAC;QAHS,UAAK,GAAL,KAAK,CAAoB;QAPlC,mBAAc,GAAG,QAAiB,CAAC;QAEnC,gBAAW,GAAiC,CAAC,QAAQ,CAAC,CAAC;QAS/D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAoB;QACtC,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,IAAA,qBAAM,EAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAEnD,MAAM;gBACL,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;oBACjF,CAAC,CAAC,OAAO,CAAC,GAAG;oBACb,CAAC,CAAC,SAAS,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAEO,MAAM,CAAC,KAAc;QAC5B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QAC5E,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,mBAAmB;gBACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAChE,KAAK,mBAAmB;gBACvB,IAAI,KAAK,CAAC,OAAO,KAAK,sBAAsB;oBAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;gBACrD,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC;oBACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAC1E,KAAK,gBAAgB;gBACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAChE;gBACC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACxE,CAAC;IACF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAoB,EAAE,MAAqB;QACvD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QAEzC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;QAE3E,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,iBAAiB;gBACzB,MAAM,EAAE,yBAAyB;aACjC,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GACrB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAE9F,IAAI,KAAU,CAAC;QACf,IAAI,CAAC;YACJ,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC7C,IAAA,qBAAS,EACR,SAAS,CAAC,UAAU,CAAC,KAAK,EAC1B,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;oBACvB,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;wBACjB,OAAO,WAAW,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;oBAC5D,CAAC;oBACD,MAAM,GAAG,GAAG,IAAA,+BAAmB,EAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;oBACvD,IAAI,CAAC,GAAG,EAAE,CAAC;wBACV,OAAO,WAAW,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC,CAAC;oBACzE,CAAC;oBACD,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACxB,CAAC,EACD;oBACC,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,UAAU,EAAE,cAAc,CAAC,UAAU;oBACrC,cAAc,EAAE,cAAc,CAAC,gBAAgB;oBAC/C,QAAQ,EAAE,IAAI;iBACd,EACD,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;oBACrB,IAAI,QAAQ,EAAE,CAAC;wBACd,MAAM,CAAC,QAAQ,CAAC,CAAC;oBAClB,CAAC;yBAAM,CAAC;wBACP,IAAI,CAAC,OAAO,EAAE,CAAC;4BACd,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;4BAC9C,OAAO;wBACR,CAAC;wBACD,OAAO,CAAC,OAAO,CAAC,CAAC;oBAClB,CAAC;gBACF,CAAC,CACD,CAAC;YACH,CAAC,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;QAC7B,MAAM,iBAAiB,GAAG,cAAc,CAAC,iBAAiB,CAAC;QAC3D,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACrD,CAAC;QAED,MAAM,OAAO,GACZ,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAElF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAChG,MAAM,GAAG,GAAG,cAAc,CAAC,uBAAuB,CAAC;QACnD,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG;YAClB,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,YAAY,GAAG,GAAG,GAAG,mCAAmC,GAAG,GAAG;aACtE,CAAC;QAEH,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,cAAc,CAAC,gBAAgB,EAAE,CAAC;YAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QAC3E,CAAC;QAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEvD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,mBAAmB;gBAC3B,MAAM,EAAE,6BAA6B;aACrC,CAAC;QACH,CAAC;QAED,MAAM,EACL,UAAU,EACV,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,EAC1C,GAAG,IAAI,EACP,GAAG,SAAS,CAAC;QACd,OAAO;YACN,EAAE,EAAE,IAAI;YACR,KAAK,EAAE;gBACN,GAAG,IAAI;gBACP,OAAO;gBACP,cAAc,EAAE,UAAU,CAAC,IAAI;gBAC/B,MAAM;gBACN,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;aAC/B;SACD,CAAC;IACH,CAAC;IAED,SAAS,CACR,QAA4B,EAC5B,OAAwB;QAExB,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAE3C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;YACtD,OAAO;gBACN,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;gBACrF,SAAS,EAAE,6BAA6B,GAAG,CAAC,MAAM,wCAAwC,IAAI,GAAG;aACjG,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC;CACD,CAAA;;6BA1KY,kBAAkB;IAD9B,IAAA,YAAO,GAAE;qCASgB,iCAAkB,EAClC,uBAAM;GATH,kBAAkB,CA0K9B"}