n8n 2.43.4 → 2.44.0

package/dist/modules/inbound-auth-core/system-trusted-source.seeder.d.ts

@@ -0,0 +1,52 @@
+import { Logger } from '@n8n/backend-common';
+import { UrlService } from '@n8n/backend-services';
+import { TrustedSourceDbStore } from './trusted-source.store';
+export declare const SYSTEM_TRUSTED_SOURCE_ID = "n8n-internal";
+export declare const SYSTEM_TRUSTED_SOURCE_NAME = "n8n";
+export declare const SYSTEM_TRUSTED_SOURCE_CONFIG: {
+    version: 1;
+    authentication: {
+        type: "oauth2";
+        discovery: {
+            mode: "auto";
+        };
+        keys: {
+            kind: "local-keystore";
+        };
+        verification: {
+            mode: "jwt";
+        };
+        client: {
+            kind: "virtual";
+        };
+    };
+    surfaces: {
+        'public-api': {};
+        'instance-mcp': {};
+        trigger: {};
+    };
+    identity: {
+        subject: "n8n-user-id";
+        claimMapping: {
+            subject: string;
+            clientId: string;
+            scopes: string;
+        };
+        linkByEmail: "off";
+        provision: {
+            human: "off";
+        };
+        roleMapping: {
+            mode: "off";
+            instanceRoleRules: never[];
+            projectRoleRules: never[];
+        };
+    };
+};
+export declare class SystemTrustedSourceSeeder {
+    private readonly store;
+    private readonly urlService;
+    private readonly logger;
+    constructor(store: TrustedSourceDbStore, urlService: UrlService, logger: Logger);
+    seed(): Promise<void>;
+}

package/dist/modules/inbound-auth-core/system-trusted-source.seeder.js

@@ -0,0 +1,74 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SystemTrustedSourceSeeder = exports.SYSTEM_TRUSTED_SOURCE_CONFIG = exports.SYSTEM_TRUSTED_SOURCE_NAME = exports.SYSTEM_TRUSTED_SOURCE_ID = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const backend_services_1 = require("@n8n/backend-services");
+const di_1 = require("@n8n/di");
+const trusted_source_store_1 = require("./trusted-source.store");
+exports.SYSTEM_TRUSTED_SOURCE_ID = 'n8n-internal';
+exports.SYSTEM_TRUSTED_SOURCE_NAME = 'n8n';
+exports.SYSTEM_TRUSTED_SOURCE_CONFIG = {
+    version: 1,
+    authentication: {
+        type: 'oauth2',
+        discovery: { mode: 'auto' },
+        keys: { kind: 'local-keystore' },
+        verification: { mode: 'jwt' },
+        client: { kind: 'virtual' },
+    },
+    surfaces: { 'public-api': {}, 'instance-mcp': {}, trigger: {} },
+    identity: {
+        subject: 'n8n-user-id',
+        claimMapping: { subject: 'sub', clientId: 'client_id', scopes: 'scope' },
+        linkByEmail: 'off',
+        provision: { human: 'off' },
+        roleMapping: { mode: 'off', instanceRoleRules: [], projectRoleRules: [] },
+    },
+};
+let SystemTrustedSourceSeeder = class SystemTrustedSourceSeeder {
+    constructor(store, urlService, logger) {
+        this.store = store;
+        this.urlService = urlService;
+        this.logger = logger;
+        this.logger = this.logger.scoped('inbound-auth');
+    }
+    async seed() {
+        const issuer = this.urlService.getInstanceBaseUrl();
+        const outcome = await this.store.seedSystemSource({
+            id: exports.SYSTEM_TRUSTED_SOURCE_ID,
+            name: exports.SYSTEM_TRUSTED_SOURCE_NAME,
+            issuer,
+            config: exports.SYSTEM_TRUSTED_SOURCE_CONFIG,
+        });
+        const context = { id: exports.SYSTEM_TRUSTED_SOURCE_ID, issuer };
+        switch (outcome) {
+            case 'inserted':
+                this.logger.info('Seeded the system trusted source', context);
+                break;
+            case 'issuer-updated':
+                this.logger.info('Moved the system trusted source to the instance base URL', context);
+                break;
+            case 'unchanged':
+                this.logger.debug('System trusted source is up to date', context);
+                break;
+            case 'conflict':
+                this.logger.error('Could not seed the system trusted source: another trusted source holds its id, name or issuer', { ...context, name: exports.SYSTEM_TRUSTED_SOURCE_NAME });
+                break;
+        }
+    }
+};
+exports.SystemTrustedSourceSeeder = SystemTrustedSourceSeeder;
+exports.SystemTrustedSourceSeeder = SystemTrustedSourceSeeder = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [trusted_source_store_1.TrustedSourceDbStore, backend_services_1.UrlService, backend_common_1.Logger])
+], SystemTrustedSourceSeeder);
+//# sourceMappingURL=system-trusted-source.seeder.js.map

package/dist/modules/inbound-auth-core/system-trusted-source.seeder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-trusted-source.seeder.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/system-trusted-source.seeder.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;AAC7C,4DAAmD;AACnD,gCAAkC;AAGlC,iEAA8D;AAIjD,QAAA,wBAAwB,GAAG,cAAc,CAAC;AAC1C,QAAA,0BAA0B,GAAG,KAAK,CAAC;AACnC,QAAA,4BAA4B,GAAG;IAC3C,OAAO,EAAE,CAAC;IACV,cAAc,EAAE;QACf,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;QAChC,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;QAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KAC3B;IACD,QAAQ,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;IAC/D,QAAQ,EAAE;QACT,OAAO,EAAE,aAAa;QACtB,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;QACxE,WAAW,EAAE,KAAK;QAClB,SAAS,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QAC3B,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE;KACzE;CACkC,CAAC;AAc9B,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACrC,YACkB,KAA2B,EAC3B,UAAsB,EACtB,MAAc;qBAFd,KAAK;0BACL,UAAU;sBACV,MAAM;QAEvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAClD,CAAC;IAGD,KAAK,CAAC,IAAI;QACT,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACjD,EAAE,EAAE,QAAA,wBAAwB;YAC5B,IAAI,EAAE,QAAA,0BAA0B;YAChC,MAAM;YACN,MAAM,EAAE,QAAA,4BAA4B;SACpC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,EAAE,EAAE,QAAA,wBAAwB,EAAE,MAAM,EAAE,CAAC;QAEzD,QAAQ,OAAO,EAAE,CAAC;YACjB,KAAK,UAAU;gBACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,OAAO,CAAC,CAAC;gBAC9D,MAAM;YACP,KAAK,gBAAgB;gBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0DAA0D,EAAE,OAAO,CAAC,CAAC;gBACtF,MAAM;YACP,KAAK,WAAW;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,OAAO,CAAC,CAAC;gBAClE,MAAM;YACP,KAAK,UAAU;gBACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,+FAA+F,EAC/F,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,QAAA,0BAA0B,EAAE,CAChD,CAAC;gBACF,MAAM;QACR,CAAC;IACF,CAAC;CACD,CAAA;;oCAtCY,yBAAyB;IADrC,IAAA,YAAO,GAAE;qCAGgB,2CAAoB,EACf,6BAAU,EACd,uBAAM;GAJpB,yBAAyB,CAsCrC"}

package/dist/modules/inbound-auth-core/trusted-source-discovery.service.d.ts

@@ -0,0 +1,19 @@
+import { Logger } from '@n8n/backend-common';
+import { OAuthDiscoveryClient } from '@n8n/backend-services';
+import { LocalAuthorizationServer } from '@n8n/inbound-auth';
+import { TrustedSourceDbStore } from './trusted-source.store';
+export declare const DUE_BATCH = 200;
+export declare const CONCURRENCY = 5;
+export declare const RUN_DEADLINE_MS: number;
+export declare class TrustedSourceDiscoveryService {
+    private readonly logger;
+    private readonly store;
+    private readonly client;
+    private readonly localServer;
+    constructor(logger: Logger, store: TrustedSourceDbStore, client: OAuthDiscoveryClient, localServer: LocalAuthorizationServer);
+    refresh(sourceId: string): Promise<void>;
+    refreshDue(signal: AbortSignal): Promise<void>;
+    private refreshSource;
+    private discover;
+    private collect;
+}

package/dist/modules/inbound-auth-core/trusted-source-discovery.service.js

@@ -0,0 +1,141 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TrustedSourceDiscoveryService = exports.RUN_DEADLINE_MS = exports.CONCURRENCY = exports.DUE_BATCH = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const backend_services_1 = require("@n8n/backend-services");
+const constants_1 = require("@n8n/constants");
+const di_1 = require("@n8n/di");
+const inbound_auth_1 = require("@n8n/inbound-auth");
+const ensure_error_1 = require("@n8n/utils/errors/ensure-error");
+const n8n_workflow_1 = require("n8n-workflow");
+const trusted_source_store_1 = require("./trusted-source.store");
+exports.DUE_BATCH = 200;
+exports.CONCURRENCY = 5;
+exports.RUN_DEADLINE_MS = 40 * constants_1.Time.seconds.toMilliseconds;
+let TrustedSourceDiscoveryService = class TrustedSourceDiscoveryService {
+    constructor(logger, store, client, localServer) {
+        this.logger = logger;
+        this.store = store;
+        this.client = client;
+        this.localServer = localServer;
+    }
+    async refresh(sourceId) {
+        const source = await this.store.getById(sourceId);
+        if (source)
+            await this.refreshSource(source);
+    }
+    async refreshDue(signal) {
+        const deadline = Date.now() + exports.RUN_DEADLINE_MS;
+        const queue = await this.store.listDue(exports.DUE_BATCH);
+        const worker = async () => {
+            while (!signal.aborted && Date.now() < deadline) {
+                const source = queue.shift();
+                if (source === undefined)
+                    return;
+                await this.refreshSource(source);
+            }
+        };
+        await Promise.all(Array.from({ length: Math.min(exports.CONCURRENCY, queue.length) }, worker));
+    }
+    async refreshSource(source) {
+        try {
+            const token = await this.store.claimDiscovery(source);
+            if (token === null)
+                return;
+            await this.store.recordDiscovery(source, token, await this.discover(source));
+        }
+        catch (error) {
+            this.logger.error('Could not write the discovery result of a trusted source', {
+                id: source.id,
+                error,
+            });
+        }
+    }
+    async discover(source) {
+        try {
+            const documents = await this.collect(source);
+            const metadata = inbound_auth_1.TrustedSourceMetadataSchema.parse({ version: 1, documents });
+            return { metadata, status: 'healthy', lastError: null };
+        }
+        catch (error) {
+            const lastError = (0, ensure_error_1.ensureError)(error).message;
+            this.logger.warn('Trusted source discovery failed', { id: source.id, reason: lastError });
+            return { status: 'error', lastError };
+        }
+    }
+    async collect(source) {
+        const { issuer, config } = source;
+        const { authentication } = config;
+        const fetchedAt = new Date().toISOString();
+        if (authentication.keys.kind === 'local-keystore') {
+            const document = await this.localServer.getMetadata();
+            if (document.issuer !== issuer) {
+                throw new n8n_workflow_1.OperationalError(`Local server metadata names issuer "${document.issuer}", expected "${issuer}"`);
+            }
+            if (!document.jwks_uri)
+                throw new n8n_workflow_1.OperationalError(`Issuer "${issuer}" has no jwks_uri`);
+            const { keys } = await this.localServer.getJwks();
+            return [
+                { kind: 'oauth2-authorization-server', fetchedAt, document },
+                { kind: 'jwks', fetchedAt, url: document.jwks_uri, keys },
+            ];
+        }
+        const documents = [];
+        const { discovery } = authentication;
+        if (discovery.mode === 'manual') {
+            if (discovery.metadataUrl) {
+                const fetched = await this.client.fetchOAuth2ServerMetadata({
+                    issuer,
+                    url: discovery.metadataUrl,
+                });
+                if (!fetched) {
+                    throw new n8n_workflow_1.OperationalError(`Metadata URL "${discovery.metadataUrl}" offers no document`);
+                }
+                documents.push({
+                    kind: 'oauth2-authorization-server',
+                    fetchedAt,
+                    document: fetched.document,
+                });
+            }
+        }
+        else {
+            const [oidc, oauth2] = await Promise.all([
+                this.client.fetchOpenIdConfiguration(issuer),
+                this.client.fetchOAuth2ServerMetadata({ issuer }),
+            ]);
+            if (oidc)
+                documents.push({ kind: 'openid-configuration', fetchedAt, document: oidc.document });
+            if (oauth2) {
+                documents.push({
+                    kind: 'oauth2-authorization-server',
+                    fetchedAt,
+                    document: oauth2.document,
+                });
+            }
+            if (documents.length === 0) {
+                throw new n8n_workflow_1.OperationalError(`Issuer "${issuer}" offers no OAuth2 metadata document`);
+            }
+        }
+        const { jwksUri } = (0, inbound_auth_1.resolveOAuth2Endpoints)(config, documents);
+        if (!jwksUri)
+            throw new n8n_workflow_1.OperationalError(`Issuer "${issuer}" has no jwks_uri`);
+        const { keys } = await this.client.fetchJwks(jwksUri);
+        documents.push({ kind: 'jwks', fetchedAt, url: jwksUri, keys });
+        return documents;
+    }
+};
+exports.TrustedSourceDiscoveryService = TrustedSourceDiscoveryService;
+exports.TrustedSourceDiscoveryService = TrustedSourceDiscoveryService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [backend_common_1.Logger, trusted_source_store_1.TrustedSourceDbStore, backend_services_1.OAuthDiscoveryClient, inbound_auth_1.LocalAuthorizationServer])
+], TrustedSourceDiscoveryService);
+//# sourceMappingURL=trusted-source-discovery.service.js.map

package/dist/modules/inbound-auth-core/trusted-source-discovery.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-source-discovery.service.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/trusted-source-discovery.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;AAC7C,4DAA6D;AAC7D,8CAAsC;AACtC,gCAAkC;AAClC,oDAM2B;AAC3B,iEAA6D;AAC7D,+CAAgD;AAEhD,iEAAoF;AAGvE,QAAA,SAAS,GAAG,GAAG,CAAC;AAEhB,QAAA,WAAW,GAAG,CAAC,CAAC;AAEhB,QAAA,eAAe,GAAG,EAAE,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,CAAC;AAOzD,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IACzC,YACkB,MAAc,EACd,KAA2B,EAC3B,MAA4B,EAC5B,WAAqC;sBAHrC,MAAM;qBACN,KAAK;sBACL,MAAM;2BACN,WAAW;IAC1B,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,MAAM;YAAE,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAmB;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAA,eAAe,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAA,SAAS,CAAC,CAAC;QAElD,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;YACzB,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBACjD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;gBAC7B,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO;gBACjC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAClC,CAAC;QACF,CAAC,CAAC;QACF,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAA,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACxF,CAAC;IAGO,KAAK,CAAC,aAAa,CAAC,MAAqB;QAChD,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YACtD,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO;YAC3B,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0DAA0D,EAAE;gBAC7E,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,KAAK;aACL,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAGO,KAAK,CAAC,QAAQ,CAAC,MAAqB;QAC3C,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,0CAA2B,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9E,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,IAAA,0BAAW,EAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1F,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QACvC,CAAC;IACF,CAAC;IAGO,KAAK,CAAC,OAAO,CAAC,MAAqB;QAC1C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAClC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3C,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACnD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;YAEtD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChC,MAAM,IAAI,+BAAgB,CACzB,uCAAuC,QAAQ,CAAC,MAAM,gBAAgB,MAAM,GAAG,CAC/E,CAAC;YACH,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBAAE,MAAM,IAAI,+BAAgB,CAAC,WAAW,MAAM,mBAAmB,CAAC,CAAC;YACzF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YAClD,OAAO;gBACN,EAAE,IAAI,EAAE,6BAA6B,EAAE,SAAS,EAAE,QAAQ,EAAE;gBAC5D,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE;aACzD,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAwB,EAAE,CAAC;QAC1C,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC;QACrC,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;gBAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC;oBAC3D,MAAM;oBACN,GAAG,EAAE,SAAS,CAAC,WAAW;iBAC1B,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,EAAE,CAAC;oBACd,MAAM,IAAI,+BAAgB,CAAC,iBAAiB,SAAS,CAAC,WAAW,sBAAsB,CAAC,CAAC;gBAC1F,CAAC;gBACD,SAAS,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,6BAA6B;oBACnC,SAAS;oBACT,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC1B,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACxC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,CAAC;gBAC5C,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAC;aACjD,CAAC,CAAC;YACH,IAAI,IAAI;gBACP,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACtF,IAAI,MAAM,EAAE,CAAC;gBACZ,SAAS,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,6BAA6B;oBACnC,SAAS;oBACT,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBACzB,CAAC,CAAC;YACJ,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,+BAAgB,CAAC,WAAW,MAAM,sCAAsC,CAAC,CAAC;YACrF,CAAC;QACF,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,IAAA,qCAAsB,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,+BAAgB,CAAC,WAAW,MAAM,mBAAmB,CAAC,CAAC;QAC/E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACtD,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,OAAO,SAAS,CAAC;IAClB,CAAC;CACD,CAAA;;wCAtHY,6BAA6B;IADzC,IAAA,YAAO,GAAE;qCAGiB,uBAAM,EACP,2CAAoB,EACnB,uCAAoB,EACf,uCAAwB;GAL3C,6BAA6B,CAsHzC"}

package/dist/modules/inbound-auth-core/trusted-source-discovery.task.d.ts

@@ -0,0 +1,12 @@
+import { SystemTask } from '@n8n/decorators';
+import type { SystemTaskEffects, SystemTaskPlacement, SystemTaskSchedule } from '@n8n/decorators';
+import { TrustedSourceDiscoveryService } from './trusted-source-discovery.service';
+export declare class TrustedSourceDiscoveryTask implements SystemTask {
+    private readonly discovery;
+    readonly name = "trusted-source-discovery";
+    readonly schedule: SystemTaskSchedule;
+    readonly effects: SystemTaskEffects;
+    readonly placement: SystemTaskPlacement;
+    constructor(discovery: TrustedSourceDiscoveryService);
+    run(signal: AbortSignal): Promise<void>;
+}

package/dist/modules/{insights/insights-compaction.task.js → inbound-auth-core/trusted-source-discovery.task.js}

@@ -9,27 +9,25 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.InsightsCompactionTask = void 0;
-const constants_1 = require("@n8n/constants");
+exports.TrustedSourceDiscoveryTask = void 0;
 const decorators_1 = require("@n8n/decorators");
-const insights_compaction_service_1 = require("./insights-compaction.service");
-const insights_config_1 = require("./insights.config");
-let InsightsCompactionTask = class InsightsCompactionTask {
-    constructor(insightsConfig, compactionService) {
-        this.insightsConfig = insightsConfig;
-        this.compactionService = compactionService;
-        this.name = 'insights-compaction';
-        this.schedule = (0, decorators_1.intervalFromSeconds)(this.insightsConfig.compactionIntervalMinutes * constants_1.Time.minutes.toSeconds);
+const trusted_source_discovery_service_1 = require("./trusted-source-discovery.service");
+const DISCOVERY_POLL_INTERVAL_SECONDS = 60;
+let TrustedSourceDiscoveryTask = class TrustedSourceDiscoveryTask {
+    constructor(discovery) {
+        this.discovery = discovery;
+        this.name = 'trusted-source-discovery';
+        this.schedule = (0, decorators_1.intervalFromSeconds)(DISCOVERY_POLL_INTERVAL_SECONDS);
         this.effects = 'idempotent';
         this.placement = { scope: 'cluster', durable: true };
     }
     async run(signal) {
-        await this.compactionService.compactInsights(signal);
+        await this.discovery.refreshDue(signal);
     }
 };
-exports.InsightsCompactionTask = InsightsCompactionTask;
-exports.InsightsCompactionTask = InsightsCompactionTask = __decorate([
+exports.TrustedSourceDiscoveryTask = TrustedSourceDiscoveryTask;
+exports.TrustedSourceDiscoveryTask = TrustedSourceDiscoveryTask = __decorate([
     (0, decorators_1.SystemTask)(),
-    __metadata("design:paramtypes", [insights_config_1.InsightsConfig, insights_compaction_service_1.InsightsCompactionService])
-], InsightsCompactionTask);
-//# sourceMappingURL=insights-compaction.task.js.map
+    __metadata("design:paramtypes", [trusted_source_discovery_service_1.TrustedSourceDiscoveryService])
+], TrustedSourceDiscoveryTask);
+//# sourceMappingURL=trusted-source-discovery.task.js.map

package/dist/modules/inbound-auth-core/trusted-source-discovery.task.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-source-discovery.task.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/trusted-source-discovery.task.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gDAAkE;AAGlE,yFAAmF;AAGnF,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAOpC,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IAStC,YAA6B,SAAwC;QAAxC,cAAS,GAAT,SAAS,CAA+B;QAR5D,SAAI,GAAG,0BAA0B,CAAC;QAElC,aAAQ,GAAuB,IAAA,gCAAmB,EAAC,+BAA+B,CAAC,CAAC;QAEpF,YAAO,GAAsB,YAAY,CAAC;QAE1C,cAAS,GAAwB,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEN,CAAC;IAEzE,KAAK,CAAC,GAAG,CAAC,MAAmB;QAC5B,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;CACD,CAAA;;qCAdY,0BAA0B;IADtC,IAAA,uBAAU,GAAE;qCAU4B,gEAA6B;GATzD,0BAA0B,CActC"}

package/dist/modules/inbound-auth-core/trusted-source.gate.d.ts

@@ -0,0 +1,13 @@
+import { Logger } from '@n8n/backend-common';
+import { UserRepository } from '@n8n/db';
+import { TrustedSourceGate } from '@n8n/inbound-auth';
+import { WorkflowFinderService } from '../../workflows/workflow-finder.service';
+import { TrustedSourceIdentityRepository } from './database/repositories/trusted-source-identity.repository';
+export declare class TrustedSourceDbGate extends TrustedSourceGate {
+    private readonly logger;
+    private readonly userRepository;
+    private readonly workflowFinderService;
+    private readonly identityRepository;
+    constructor(logger: Logger, userRepository: UserRepository, workflowFinderService: WorkflowFinderService, identityRepository: TrustedSourceIdentityRepository);
+    authorizeSealed({ userId, grant, binding, }: Parameters<TrustedSourceGate['authorizeSealed']>[0]): Promise<boolean>;
+}

package/dist/modules/inbound-auth-core/trusted-source.gate.js

@@ -0,0 +1,53 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TrustedSourceDbGate = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const db_1 = require("@n8n/db");
+const di_1 = require("@n8n/di");
+const inbound_auth_1 = require("@n8n/inbound-auth");
+const workflow_finder_service_1 = require("../../workflows/workflow-finder.service");
+const trusted_source_identity_repository_1 = require("./database/repositories/trusted-source-identity.repository");
+const grant_authorization_1 = require("./grant-authorization");
+let TrustedSourceDbGate = class TrustedSourceDbGate extends inbound_auth_1.TrustedSourceGate {
+    constructor(logger, userRepository, workflowFinderService, identityRepository) {
+        super();
+        this.logger = logger;
+        this.userRepository = userRepository;
+        this.workflowFinderService = workflowFinderService;
+        this.identityRepository = identityRepository;
+    }
+    async authorizeSealed({ userId, grant, binding, }) {
+        const user = await this.userRepository.findByIdWithRole(userId);
+        if (!user || user.disabled) {
+            this.logger.debug('Sealed identity denied: the user is missing or disabled', { userId });
+            return false;
+        }
+        if (binding) {
+            const row = await this.identityRepository.findBinding(binding.sourceId, binding.subject);
+            if (row?.status !== 'active' || row.userId !== userId) {
+                this.logger.debug('Sealed identity denied: the binding is not active for this user', {
+                    userId,
+                    sourceId: binding.sourceId,
+                    status: row?.status ?? 'missing',
+                });
+                return false;
+            }
+        }
+        return await (0, grant_authorization_1.authorizeAgainstGrant)(this.workflowFinderService, grant, user);
+    }
+};
+exports.TrustedSourceDbGate = TrustedSourceDbGate;
+exports.TrustedSourceDbGate = TrustedSourceDbGate = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [backend_common_1.Logger, db_1.UserRepository, workflow_finder_service_1.WorkflowFinderService, trusted_source_identity_repository_1.TrustedSourceIdentityRepository])
+], TrustedSourceDbGate);
+//# sourceMappingURL=trusted-source.gate.js.map

package/dist/modules/inbound-auth-core/trusted-source.gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-source.gate.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/trusted-source.gate.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;AAC7C,gCAAyC;AACzC,gCAAkC;AAClC,oDAAsD;AAEtD,iFAA4E;AAE5E,mHAA6G;AAC7G,+DAA8D;AAQvD,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,gCAAiB;IACzD,YACkB,MAAc,EACd,cAA8B,EAC9B,qBAA4C,EAC5C,kBAAmD;QAEpE,KAAK,EAAE,CAAC;sBALS,MAAM;8BACN,cAAc;qCACd,qBAAqB;kCACrB,kBAAkB;IAGpC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,EACrB,MAAM,EACN,KAAK,EACL,OAAO,GAC8C;QAErD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yDAAyD,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACzF,OAAO,KAAK,CAAC;QACd,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACzF,IAAI,GAAG,EAAE,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iEAAiE,EAAE;oBACpF,MAAM;oBACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,MAAM,EAAE,GAAG,EAAE,MAAM,IAAI,SAAS;iBAChC,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACd,CAAC;QACF,CAAC;QAED,OAAO,MAAM,IAAA,2CAAqB,EAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7E,CAAC;CACD,CAAA;;8BApCY,mBAAmB;IAD/B,IAAA,YAAO,GAAE;qCAGiB,uBAAM,EACE,mBAAc,EACP,+CAAqB,EACxB,oEAA+B;GALzD,mBAAmB,CAoC/B"}

package/dist/modules/inbound-auth-core/trusted-source.store.d.ts

@@ -1,35 +1,32 @@
 import { Logger } from '@n8n/backend-common';
-import { type SurfaceId, type TrustedSourceConfigInput, type TrustedSourceConfigLatest } from '@n8n/inbound-auth';
+import { TrustedSourceStore, type SurfaceId, type TrustedSource, type TrustedSourceConfigInput, type TrustedSourceMetadata, type TrustedSourceStatus } from '@n8n/inbound-auth';
 import { Cipher } from 'n8n-core';
 import { UserError } from 'n8n-workflow';
-import type { TrustedSourceManagedBy, TrustedSourceStatus, TrustedSourceType } from './database/entities/trusted-source.entity';
 import { TrustedSourceIdentityRepository } from './database/repositories/trusted-source-identity.repository';
 import { TrustedSourceRepository } from './database/repositories/trusted-source.repository';
 import { TransactionRunner } from '@n8n/db';
 import { CacheService } from '@n8n/backend-services';
-export type TrustedSource = {
-    id: string;
-    name: string;
-    type: TrustedSourceType;
-    issuer: string;
-    managedBy: TrustedSourceManagedBy;
-    status: TrustedSourceStatus;
-    lastError: string | null;
-    lastCheckedAt: string | null;
-    createdAt: string;
-    updatedAt: string;
-    config: TrustedSourceConfigLatest;
-};
 export type CreateTrustedSourceInput = {
     name: string;
     issuer: string;
     config: TrustedSourceConfigInput;
 };
 export type UpdateTrustedSourceInput = Partial<CreateTrustedSourceInput>;
+export type SeedSystemSourceInput = CreateTrustedSourceInput & {
+    id: string;
+};
+export type SeedSystemSourceOutcome = 'inserted' | 'issuer-updated' | 'unchanged' | 'conflict';
 export declare class SystemTrustedSourceModificationError extends UserError {
     constructor(action: 'update' | 'delete');
 }
-export declare class TrustedSourceStore {
+export declare const ERROR_RETRY_SECONDS: number;
+export declare const HEALTHY_REFRESH_SECONDS: number;
+export type DiscoveryResult = {
+    metadata?: TrustedSourceMetadata;
+    status: TrustedSourceStatus;
+    lastError: string | null;
+};
+export declare class TrustedSourceDbStore extends TrustedSourceStore {
     private readonly logger;
     private readonly trustedSourceRepository;
     private readonly cipher;
@@ -40,14 +37,19 @@ export declare class TrustedSourceStore {
     getById(id: string): Promise<TrustedSource | undefined>;
     getByIssuer(issuer: string): Promise<TrustedSource | undefined>;
     listBySurface(surface: SurfaceId): Promise<TrustedSource[]>;
+    listDue(limit: number): Promise<TrustedSource[]>;
+    claimDiscovery(source: TrustedSource): Promise<string | null>;
+    recordDiscovery(source: TrustedSource, token: string, result: DiscoveryResult): Promise<boolean>;
     create(input: CreateTrustedSourceInput): Promise<TrustedSource>;
     update(id: string, input: UpdateTrustedSourceInput, options?: {
         clearBindings: boolean;
     }): Promise<void>;
     delete(id: string): Promise<void>;
+    seedSystemSource(input: SeedSystemSourceInput): Promise<SeedSystemSourceOutcome>;
     private loadAdminRow;
     private invalidateCache;
     private load;
     private loadAll;
     private toRuntime;
+    private parseMetadata;
 }