n8n 2.43.4 → 2.44.1

package/dist/modules/inbound-auth-core/authentication.service.js

@@ -0,0 +1,86 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2AuthenticationService = void 0;
+const di_1 = require("@n8n/di");
+const inbound_auth_1 = require("@n8n/inbound-auth");
+const oauth2_bearer_driver_1 = require("./oauth2-bearer.driver");
+let OAuth2AuthenticationService = class OAuth2AuthenticationService extends inbound_auth_1.AuthenticationService {
+    constructor(store, bearer, drivers = [bearer]) {
+        super();
+        this.store = store;
+        this.drivers = drivers;
+    }
+    async authenticate(extracted) {
+        const { kind } = extracted.credential;
+        const candidates = this.drivers.filter((driver) => driver.credentialKind === kind);
+        if (candidates.length === 0) {
+            return {
+                ok: false,
+                reason: 'source-unusable',
+                detail: `No suitable authentication driver found for the credential kind "${kind}"`,
+            };
+        }
+        let selected;
+        for (const driver of candidates) {
+            const source = await driver.selectSource(extracted);
+            if (source) {
+                selected = { driver, source };
+                break;
+            }
+        }
+        if (!selected) {
+            return {
+                ok: false,
+                reason: 'unknown-issuer',
+            };
+        }
+        const { driver, source } = selected;
+        if (source.config.surfaces[extracted.surface] === undefined)
+            return { ok: false, reason: 'source-not-accepted' };
+        if (extracted.acceptedSourceIds && !extracted.acceptedSourceIds.includes(source.id))
+            return { ok: false, reason: 'source-not-accepted' };
+        if (source.status !== 'healthy')
+            return { ok: false, reason: 'source-unusable', detail: `source status is ${source.status}` };
+        if (!driver.sourceTypes.includes(source.type))
+            return {
+                ok: false,
+                reason: 'source-unusable',
+                detail: `source type ${source.type} not handled`,
+            };
+        if (source.metadata === null)
+            return { ok: false, reason: 'source-unusable', detail: 'source not discovered yet' };
+        return await driver.verify(extracted, source);
+    }
+    async advertise(resource) {
+        const onSurface = await this.store.listBySurface(resource.surface);
+        const { acceptedSourceIds } = resource;
+        const accepted = acceptedSourceIds
+            ? onSurface.filter((s) => acceptedSourceIds.includes(s.id))
+            : onSurface;
+        const authorizationServers = new Set();
+        const challenges = [];
+        for (const driver of this.drivers) {
+            const advertised = driver.advertise(resource, accepted);
+            for (const issuer of advertised.authorizationServers ?? [])
+                authorizationServers.add(issuer);
+            if (advertised.challenge)
+                challenges.push(advertised.challenge);
+        }
+        return { authorizationServers: [...authorizationServers], challenges };
+    }
+};
+exports.OAuth2AuthenticationService = OAuth2AuthenticationService;
+exports.OAuth2AuthenticationService = OAuth2AuthenticationService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [inbound_auth_1.TrustedSourceStore, oauth2_bearer_driver_1.Oauth2BearerDriver, Array])
+], OAuth2AuthenticationService);
+//# sourceMappingURL=authentication.service.js.map

package/dist/modules/inbound-auth-core/authentication.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.service.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/authentication.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAAkC;AAClC,oDAS2B;AAE3B,iEAA4D;AAIrD,IAAM,2BAA2B,GAAjC,MAAM,2BAA4B,SAAQ,oCAAqB;IAGrE,YACkB,KAAyB,EAC1C,MAA0B,EACT,OAAO,GAA2B,CAAC,MAAM,CAAC;QAE3D,KAAK,EAAE,CAAC;qBAJS,KAAK;uBAEL,OAAO;IAGzB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAoB;QACtC,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC;QAEtC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC;QAEnF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,iBAAiB;gBACzB,MAAM,EAAE,oEAAoE,IAAI,GAAG;aACnF,CAAC;QACH,CAAC;QAED,IAAI,QAKQ,CAAC;QAEb,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,MAAM,EAAE,CAAC;gBACZ,QAAQ,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBAC9B,MAAM;YACP,CAAC;QACF,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,gBAAgB;aACxB,CAAC;QACH,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;QAEpC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,SAAS;YAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QAErD,IAAI,SAAS,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAClF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QAErD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAE9F,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;YAC5C,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,iBAAiB;gBACzB,MAAM,EAAE,eAAe,MAAM,CAAC,IAAI,cAAc;aAChD,CAAC;QACH,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;YAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;QAEtF,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,SAAS,CACd,QAA4B;QAE5B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,EAAE,iBAAiB,EAAE,GAAG,QAAQ,CAAC;QACvC,MAAM,QAAQ,GAAG,iBAAiB;YACjC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3D,CAAC,CAAC,SAAS,CAAC;QACb,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/C,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACxD,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,oBAAoB,IAAI,EAAE;gBAAE,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7F,IAAI,UAAU,CAAC,SAAS;gBAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,oBAAoB,EAAE,CAAC,GAAG,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;IACxE,CAAC;CACD,CAAA;;sCAtFY,2BAA2B;IADvC,IAAA,YAAO,GAAE;qCAKgB,iCAAkB,EAClC,yCAAkB;GALf,2BAA2B,CAsFvC"}

package/dist/modules/inbound-auth-core/database/entities/trusted-source.entity.d.ts

@@ -12,4 +12,7 @@ export declare class TrustedSourceEntity extends WithTimestampsAndStringId {
     lastCheckedAt: Date | null;
     configVersion: number;
     config: string;
+    metadata: string | null;
+    discoveryClaimToken: string | null;
+    discoveryClaimedAt: Date | null;
 }

package/dist/modules/inbound-auth-core/database/entities/trusted-source.entity.js

@@ -51,6 +51,18 @@ __decorate([
     (0, typeorm_1.Column)({ type: 'text' }),
     __metadata("design:type", String)
 ], TrustedSourceEntity.prototype, "config", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text', nullable: true }),
+    __metadata("design:type", Object)
+], TrustedSourceEntity.prototype, "metadata", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar', length: 36, nullable: true }),
+    __metadata("design:type", Object)
+], TrustedSourceEntity.prototype, "discoveryClaimToken", void 0);
+__decorate([
+    (0, db_1.DateTimeColumn)({ nullable: true }),
+    __metadata("design:type", Object)
+], TrustedSourceEntity.prototype, "discoveryClaimedAt", void 0);
 exports.TrustedSourceEntity = TrustedSourceEntity = __decorate([
     (0, typeorm_1.Entity)('trusted_source')
 ], TrustedSourceEntity);

package/dist/modules/inbound-auth-core/database/entities/trusted-source.entity.js.map

@@ -1 +1 @@
-{"version":3,"file":"trusted-source.entity.js","sourceRoot":"","sources":["../../../../../src/modules/inbound-auth-core/database/entities/trusted-source.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAAoE;AACpE,0CAA8C;AAUvC,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,8BAAyB;CA4BjE,CAAA;;AA1BA;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;;iDAC1C;AAGb;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;;iDAChB;AAGxB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;;mDAC3B;AAGf;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;;sDACN;AAGlC;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;;mDACZ;AAG5B;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sDAChB;AAGzB;IADC,IAAA,mBAAc,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;0DACR;AAG3B;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;0DACN;AAItB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;mDACV;8BA3BH,mBAAmB;IAD/B,IAAA,gBAAM,EAAC,gBAAgB,CAAC;GACZ,mBAAmB,CA4B/B"}
+{"version":3,"file":"trusted-source.entity.js","sourceRoot":"","sources":["../../../../../src/modules/inbound-auth-core/database/entities/trusted-source.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAAoE;AACpE,0CAA8C;AAUvC,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,8BAAyB;CAwCjE,CAAA;;AAtCA;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;;iDAC1C;AAGb;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;;iDAChB;AAGxB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;;mDAC3B;AAGf;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;;sDACN;AAGlC;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;;mDACZ;AAG5B;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sDAChB;AAGzB;IADC,IAAA,mBAAc,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;0DACR;AAG3B;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;0DACN;AAItB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;mDACV;AAIf;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qDACjB;AAIxB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gEACrB;AAInC;IADC,IAAA,mBAAc,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+DACH;8BAvCpB,mBAAmB;IAD/B,IAAA,gBAAM,EAAC,gBAAgB,CAAC;GACZ,mBAAmB,CAwC/B"}

package/dist/modules/inbound-auth-core/database/repositories/trusted-source-identity.repository.d.ts

@@ -1,7 +1,24 @@
-import { OperationContext, TransactionRunner } from '@n8n/db';
-import { DataSource } from '@n8n/typeorm';
+import { OperationContext, TransactionRunner, User, UserRepository } from '@n8n/db';
+import { DataSource, type DeepPartial } from '@n8n/typeorm';
+import { TrustedSourceIdentityEntity, type TrustedSourceIdentityStatus } from '../entities/trusted-source-identity.entity';
+export type InsertTrustedSourceIdentityRow = Pick<TrustedSourceIdentityEntity, 'sourceId' | 'subject' | 'userId' | 'provenance' | 'status'>;
 export declare class TrustedSourceIdentityRepository {
+    private readonly users;
     private readonly store;
-    constructor(dataSource: DataSource, transactionRunner: TransactionRunner);
+    constructor(dataSource: DataSource, transactionRunner: TransactionRunner, users: UserRepository);
+    findBinding(sourceId: string, subject: string, ctx?: OperationContext): Promise<{
+        userId: string;
+        status: TrustedSourceIdentityStatus;
+    } | null>;
     clearByTrustedSourceId(trustedSourceId: string, ctx?: OperationContext): Promise<void>;
+    findBySubject(sourceId: string, subject: string, ctx?: OperationContext): Promise<TrustedSourceIdentityEntity | null>;
+    findUserByEmail(email: string, ctx?: OperationContext): Promise<User | null>;
+    globalRoleExists(slug: string, ctx?: OperationContext): Promise<boolean>;
+    projectRolesExist(slugs: string[], ctx?: OperationContext): Promise<boolean>;
+    touchLastSeen(sourceId: string, subject: string, seenAt: Date, ctx?: OperationContext): Promise<void>;
+    insertIfAbsent(row: InsertTrustedSourceIdentityRow, ctx?: OperationContext): Promise<void>;
+    createUserWithBinding(ctx: OperationContext, user: DeepPartial<User>, binding: Pick<InsertTrustedSourceIdentityRow, 'sourceId' | 'subject' | 'provenance' | 'status'>, projectRoles?: {
+        projectId: string;
+        role: string;
+    }[]): Promise<User>;
 }

package/dist/modules/inbound-auth-core/database/repositories/trusted-source-identity.repository.js

@@ -23,18 +23,86 @@ class TrustedSourceIdentityStore extends db_1.BaseRepository {
     }
 }
 let TrustedSourceIdentityRepository = class TrustedSourceIdentityRepository {
-    constructor(dataSource, transactionRunner) {
+    constructor(dataSource, transactionRunner, users) {
+        this.users = users;
         this.store = new TrustedSourceIdentityStore(dataSource, transactionRunner);
     }
+    async findBinding(sourceId, subject, ctx = {}) {
+        return await this.store.managerFor(ctx).findOne(trusted_source_identity_entity_1.TrustedSourceIdentityEntity, {
+            select: ['userId', 'status'],
+            where: { sourceId, subject },
+        });
+    }
     async clearByTrustedSourceId(trustedSourceId, ctx = {}) {
         await this.store
             .managerFor(ctx)
             .delete(trusted_source_identity_entity_1.TrustedSourceIdentityEntity, { sourceId: trustedSourceId });
     }
+    async findBySubject(sourceId, subject, ctx = {}) {
+        return await this.store.managerFor(ctx).findOne(trusted_source_identity_entity_1.TrustedSourceIdentityEntity, {
+            where: { sourceId, subject },
+            relations: {
+                user: {
+                    role: true,
+                },
+            },
+        });
+    }
+    async findUserByEmail(email, ctx = {}) {
+        return await this.store
+            .managerFor(ctx)
+            .findOne(db_1.User, { where: { email }, relations: { role: true } });
+    }
+    async globalRoleExists(slug, ctx = {}) {
+        return await this.store.managerFor(ctx).exists(db_1.Role, { where: { slug, roleType: 'global' } });
+    }
+    async projectRolesExist(slugs, ctx = {}) {
+        const unique = [...new Set(slugs)];
+        if (unique.length === 0)
+            return true;
+        const count = await this.store
+            .managerFor(ctx)
+            .count(db_1.Role, { where: { slug: (0, typeorm_1.In)(unique), roleType: 'project' } });
+        return count === unique.length;
+    }
+    async touchLastSeen(sourceId, subject, seenAt, ctx = {}) {
+        await this.store
+            .managerFor(ctx)
+            .update(trusted_source_identity_entity_1.TrustedSourceIdentityEntity, { sourceId, subject }, { lastSeenAt: seenAt });
+    }
+    async insertIfAbsent(row, ctx = {}) {
+        await this.store
+            .managerFor(ctx)
+            .createQueryBuilder()
+            .insert()
+            .into(trusted_source_identity_entity_1.TrustedSourceIdentityEntity)
+            .values(row)
+            .orIgnore()
+            .execute();
+    }
+    async createUserWithBinding(ctx, user, binding, projectRoles = []) {
+        return await this.store.runInTransaction(ctx, async (tx) => {
+            const { user: createdUser } = await this.users.createUserWithProject(user, tx);
+            await tx.insert(trusted_source_identity_entity_1.TrustedSourceIdentityEntity, {
+                ...binding,
+                userId: createdUser.id,
+            });
+            for (const { projectId, role } of projectRoles) {
+                await tx.save(db_1.ProjectRelation, {
+                    userId: createdUser.id,
+                    projectId,
+                    role: {
+                        slug: role,
+                    },
+                });
+            }
+            return createdUser;
+        });
+    }
 };
 exports.TrustedSourceIdentityRepository = TrustedSourceIdentityRepository;
 exports.TrustedSourceIdentityRepository = TrustedSourceIdentityRepository = __decorate([
     (0, di_1.Service)(),
-    __metadata("design:paramtypes", [typeorm_1.DataSource, db_1.TransactionRunner])
+    __metadata("design:paramtypes", [typeorm_1.DataSource, db_1.TransactionRunner, db_1.UserRepository])
 ], TrustedSourceIdentityRepository);
 //# sourceMappingURL=trusted-source-identity.repository.js.map

package/dist/modules/inbound-auth-core/database/repositories/trusted-source-identity.repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"trusted-source-identity.repository.js","sourceRoot":"","sources":["../../../../../src/modules/inbound-auth-core/database/repositories/trusted-source-identity.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAA8E;AAC9E,gCAAkC;AAClC,0CAA0C;AAE1C,+FAAyF;AAEzF,MAAM,0BAA2B,SAAQ,mBAA2C;IACnF,YAAY,UAAsB,EAAE,iBAAoC;QACvE,KAAK,CAAC,4DAA2B,EAAE,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC3E,CAAC;IAEQ,UAAU,CAAC,GAAqB;QACxC,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;CACD;AAGM,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAG3C,YAAY,UAAsB,EAAE,iBAAoC;QACvE,IAAI,CAAC,KAAK,GAAG,IAAI,0BAA0B,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,eAAuB,EAAE,GAAG,GAAqB,EAAE;QAC/E,MAAM,IAAI,CAAC,KAAK;aACd,UAAU,CAAC,GAAG,CAAC;aACf,MAAM,CAAC,4DAA2B,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;IACtE,CAAC;CACD,CAAA;;0CAZY,+BAA+B;IAD3C,IAAA,YAAO,GAAE;qCAIe,oBAAU,EAAqB,sBAAiB;GAH5D,+BAA+B,CAY3C"}
+{"version":3,"file":"trusted-source-identity.repository.js","sourceRoot":"","sources":["../../../../../src/modules/inbound-auth-core/database/repositories/trusted-source-identity.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAQiB;AACjB,gCAAkC;AAClC,0CAAgE;AAEhE,+FAGoD;AAEpD,MAAM,0BAA2B,SAAQ,mBAA2C;IACnF,YAAY,UAAsB,EAAE,iBAAoC;QACvE,KAAK,CAAC,4DAA2B,EAAE,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC3E,CAAC;IAEQ,UAAU,CAAC,GAAqB;QACxC,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;CACD;AAQM,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAG3C,YACC,UAAsB,EACtB,iBAAoC,EACnB,KAAqB;qBAArB,KAAK;QAEtB,IAAI,CAAC,KAAK,GAAG,IAAI,0BAA0B,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAC5E,CAAC;IAGD,KAAK,CAAC,WAAW,CAChB,QAAgB,EAChB,OAAe,EACf,GAAG,GAAqB,EAAE;QAE1B,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,4DAA2B,EAAE;YAC5E,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAC5B,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE;SAC5B,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,eAAuB,EAAE,GAAG,GAAqB,EAAE;QAC/E,MAAM,IAAI,CAAC,KAAK;aACd,UAAU,CAAC,GAAG,CAAC;aACf,MAAM,CAAC,4DAA2B,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;IACtE,CAAC;IAGD,KAAK,CAAC,aAAa,CAClB,QAAgB,EAChB,OAAe,EACf,GAAG,GAAqB,EAAE;QAE1B,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,4DAA2B,EAAE;YAC5E,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE;YAC5B,SAAS,EAAE;gBACV,IAAI,EAAE;oBACL,IAAI,EAAE,IAAI;iBACV;aACD;SACD,CAAC,CAAC;IACJ,CAAC;IAGD,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,GAAG,GAAqB,EAAE;QAC9D,OAAO,MAAM,IAAI,CAAC,KAAK;aACrB,UAAU,CAAC,GAAG,CAAC;aACf,OAAO,CAAC,SAAI,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,GAAG,GAAqB,EAAE;QAC9D,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,SAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC;IAGD,KAAK,CAAC,iBAAiB,CAAC,KAAe,EAAE,GAAG,GAAqB,EAAE;QAClE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK;aAC5B,UAAU,CAAC,GAAG,CAAC;aACf,KAAK,CAAC,SAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAA,YAAE,EAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACpE,OAAO,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,aAAa,CAClB,QAAgB,EAChB,OAAe,EACf,MAAY,EACZ,GAAG,GAAqB,EAAE;QAE1B,MAAM,IAAI,CAAC,KAAK;aACd,UAAU,CAAC,GAAG,CAAC;aACf,MAAM,CAAC,4DAA2B,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IAGD,KAAK,CAAC,cAAc,CACnB,GAAmC,EACnC,GAAG,GAAqB,EAAE;QAE1B,MAAM,IAAI,CAAC,KAAK;aACd,UAAU,CAAC,GAAG,CAAC;aACf,kBAAkB,EAAE;aACpB,MAAM,EAAE;aACR,IAAI,CAAC,4DAA2B,CAAC;aACjC,MAAM,CAAC,GAAG,CAAC;aACX,QAAQ,EAAE;aACV,OAAO,EAAE,CAAC;IACb,CAAC;IAOD,KAAK,CAAC,qBAAqB,CAC1B,GAAqB,EACrB,IAAuB,EACvB,OAA+F,EAC/F,YAAY,GAA0C,EAAE;QAExD,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YAC1D,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAE/E,MAAM,EAAE,CAAC,MAAM,CAAC,4DAA2B,EAAE;gBAC5C,GAAG,OAAO;gBACV,MAAM,EAAE,WAAW,CAAC,EAAE;aACtB,CAAC,CAAC;YAEH,KAAK,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,YAAY,EAAE,CAAC;gBAChD,MAAM,EAAE,CAAC,IAAI,CAAC,oBAAe,EAAE;oBAC9B,MAAM,EAAE,WAAW,CAAC,EAAE;oBACtB,SAAS;oBACT,IAAI,EAAE;wBACL,IAAI,EAAE,IAAI;qBACV;iBACD,CAAC,CAAC;YACJ,CAAC;YAED,OAAO,WAAW,CAAC;QACpB,CAAC,CAAC,CAAC;IACJ,CAAC;CACD,CAAA;;0CA5HY,+BAA+B;IAD3C,IAAA,YAAO,GAAE;qCAKI,oBAAU,EACH,sBAAiB,EACZ,mBAAc;GAN3B,+BAA+B,CA4H3C"}

package/dist/modules/inbound-auth-core/database/repositories/trusted-source.repository.d.ts

@@ -1,15 +1,27 @@
+import { DatabaseConfig } from '@n8n/config';
 import { OperationContext, TransactionRunner } from '@n8n/db';
 import { DataSource } from '@n8n/typeorm';
 import { TrustedSourceEntity } from '../entities/trusted-source.entity';
-export type NewTrustedSourceRow = Pick<TrustedSourceEntity, 'name' | 'type' | 'issuer' | 'managedBy' | 'status' | 'lastError' | 'lastCheckedAt' | 'configVersion' | 'config'>;
-export type TrustedSourceRowChanges = Partial<Pick<TrustedSourceEntity, 'name' | 'issuer' | 'configVersion' | 'config'>>;
+export type NewTrustedSourceRow = Pick<TrustedSourceEntity, 'name' | 'type' | 'issuer' | 'managedBy' | 'status' | 'lastError' | 'lastCheckedAt' | 'configVersion' | 'config' | 'metadata'>;
+export type TrustedSourceRowChanges = Partial<Pick<TrustedSourceEntity, 'name' | 'issuer' | 'configVersion' | 'config' | 'metadata' | 'status' | 'lastError' | 'lastCheckedAt' | 'discoveryClaimToken' | 'discoveryClaimedAt'>>;
+export type DiscoveryRowChanges = Pick<TrustedSourceRowChanges, 'metadata' | 'status' | 'lastError'>;
+export type DueQuery = {
+    errorRetrySeconds: number;
+    healthyRefreshSeconds: number;
+    limit: number;
+};
 export declare class TrustedSourceRepository {
     private readonly table;
-    constructor(dataSource: DataSource, transactionRunner: TransactionRunner);
+    private readonly isPostgres;
+    constructor(dataSource: DataSource, transactionRunner: TransactionRunner, config: DatabaseConfig);
     findById(id: string, ctx?: OperationContext): Promise<TrustedSourceEntity | null>;
     findByIssuer(issuer: string, ctx?: OperationContext): Promise<TrustedSourceEntity | null>;
     findAll(ctx?: OperationContext): Promise<TrustedSourceEntity[]>;
+    findDue({ errorRetrySeconds, healthyRefreshSeconds, limit }: DueQuery, ctx?: OperationContext): Promise<TrustedSourceEntity[]>;
     insertRow(row: NewTrustedSourceRow, ctx?: OperationContext): Promise<TrustedSourceEntity>;
+    insertIfAbsent(row: NewTrustedSourceRow & Pick<TrustedSourceEntity, 'id'>, ctx?: OperationContext): Promise<void>;
     updateById(id: string, changes: TrustedSourceRowChanges, ctx?: OperationContext): Promise<void>;
     deleteById(id: string, ctx?: OperationContext): Promise<void>;
+    claimForDiscovery(id: string, token: string, leaseSeconds: number, ctx?: OperationContext): Promise<boolean>;
+    recordDiscovery(id: string, token: string, changes: DiscoveryRowChanges, ctx?: OperationContext): Promise<boolean>;
 }

package/dist/modules/inbound-auth-core/database/repositories/trusted-source.repository.js

@@ -10,6 +10,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TrustedSourceRepository = void 0;
+const config_1 = require("@n8n/config");
 const db_1 = require("@n8n/db");
 const di_1 = require("@n8n/di");
 const typeorm_1 = require("@n8n/typeorm");
@@ -23,8 +24,9 @@ class TrustedSourceTable extends db_1.BaseRepository {
     }
 }
 let TrustedSourceRepository = class TrustedSourceRepository {
-    constructor(dataSource, transactionRunner) {
+    constructor(dataSource, transactionRunner, config) {
         this.table = new TrustedSourceTable(dataSource, transactionRunner);
+        this.isPostgres = config.type === 'postgresdb';
     }
     async findById(id, ctx = {}) {
         return await this.table.managerFor(ctx).findOneBy(trusted_source_entity_1.TrustedSourceEntity, { id });
@@ -35,19 +37,73 @@ let TrustedSourceRepository = class TrustedSourceRepository {
     async findAll(ctx = {}) {
         return await this.table.managerFor(ctx).find(trusted_source_entity_1.TrustedSourceEntity, { order: { name: 'ASC' } });
     }
+    async findDue({ errorRetrySeconds, healthyRefreshSeconds, limit }, ctx = {}) {
+        const errorCutoff = (0, db_1.dbNowPlusMsLiteral)(this.isPostgres, -errorRetrySeconds * 1000);
+        const healthyCutoff = (0, db_1.dbNowPlusMsLiteral)(this.isPostgres, -healthyRefreshSeconds * 1000);
+        return await this.table
+            .managerFor(ctx)
+            .createQueryBuilder(trusted_source_entity_1.TrustedSourceEntity, 'source')
+            .where(`source.status = :unchecked OR source.lastCheckedAt IS NULL
+					OR (source.status = :error AND source.lastCheckedAt < ${errorCutoff})
+					OR (source.status = :healthy AND source.lastCheckedAt < ${healthyCutoff})`, { unchecked: 'unchecked', error: 'error', healthy: 'healthy' })
+            .orderBy("CASE WHEN source.status = 'unchecked' THEN 0 ELSE 1 END", 'ASC')
+            .addOrderBy('CASE WHEN source.lastCheckedAt IS NULL THEN 0 ELSE 1 END', 'ASC')
+            .addOrderBy('source.lastCheckedAt', 'ASC')
+            .take(limit)
+            .getMany();
+    }
     async insertRow(row, ctx = {}) {
         return await this.table.managerFor(ctx).save(trusted_source_entity_1.TrustedSourceEntity, this.table.create(row));
     }
+    async insertIfAbsent(row, ctx = {}) {
+        await this.table
+            .managerFor(ctx)
+            .createQueryBuilder()
+            .insert()
+            .into(trusted_source_entity_1.TrustedSourceEntity)
+            .values(row)
+            .orIgnore()
+            .execute();
+    }
     async updateById(id, changes, ctx = {}) {
         await this.table.managerFor(ctx).update(trusted_source_entity_1.TrustedSourceEntity, { id }, changes);
     }
     async deleteById(id, ctx = {}) {
         await this.table.managerFor(ctx).delete(trusted_source_entity_1.TrustedSourceEntity, { id });
     }
+    async claimForDiscovery(id, token, leaseSeconds, ctx = {}) {
+        const staleBefore = (0, db_1.dbNowPlusMsLiteral)(this.isPostgres, -leaseSeconds * 1000);
+        const result = await this.table
+            .managerFor(ctx)
+            .createQueryBuilder()
+            .update(trusted_source_entity_1.TrustedSourceEntity)
+            .set({
+            discoveryClaimToken: token,
+            discoveryClaimedAt: () => (0, db_1.dbNowLiteral)(this.isPostgres),
+        })
+            .where(`id = :id AND ("discoveryClaimedAt" IS NULL OR "discoveryClaimedAt" < ${staleBefore})`, { id })
+            .execute();
+        return result.affected === 1;
+    }
+    async recordDiscovery(id, token, changes, ctx = {}) {
+        const result = await this.table
+            .managerFor(ctx)
+            .createQueryBuilder()
+            .update(trusted_source_entity_1.TrustedSourceEntity)
+            .set({
+            ...changes,
+            lastCheckedAt: () => (0, db_1.dbNowLiteral)(this.isPostgres),
+            discoveryClaimToken: null,
+            discoveryClaimedAt: null,
+        })
+            .where('id = :id AND "discoveryClaimToken" = :token', { id, token })
+            .execute();
+        return result.affected === 1;
+    }
 };
 exports.TrustedSourceRepository = TrustedSourceRepository;
 exports.TrustedSourceRepository = TrustedSourceRepository = __decorate([
     (0, di_1.Service)(),
-    __metadata("design:paramtypes", [typeorm_1.DataSource, db_1.TransactionRunner])
+    __metadata("design:paramtypes", [typeorm_1.DataSource, db_1.TransactionRunner, config_1.DatabaseConfig])
 ], TrustedSourceRepository);
 //# sourceMappingURL=trusted-source.repository.js.map

package/dist/modules/inbound-auth-core/database/repositories/trusted-source.repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"trusted-source.repository.js","sourceRoot":"","sources":["../../../../../src/modules/inbound-auth-core/database/repositories/trusted-source.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAA8E;AAC9E,gCAAkC;AAClC,0CAA0C;AAE1C,6EAAwE;AAExE,MAAM,kBAAmB,SAAQ,mBAAmC;IACnE,YAAY,UAAsB,EAAE,iBAAoC;QACvE,KAAK,CAAC,2CAAmB,EAAE,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACnE,CAAC;IAEQ,UAAU,CAAC,GAAqB;QACxC,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;CACD;AAoBM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAGnC,YAAY,UAAsB,EAAE,iBAAoC;QACvE,IAAI,CAAC,KAAK,GAAG,IAAI,kBAAkB,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU,EAAE,GAAG,GAAqB,EAAE;QACpD,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,2CAAmB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,GAAG,GAAqB,EAAE;QAC5D,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,2CAAmB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAG,GAAqB,EAAE;QACvC,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,2CAAmB,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC;IAGD,KAAK,CAAC,SAAS,CAAC,GAAwB,EAAE,GAAG,GAAqB,EAAE;QACnE,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,2CAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,OAAgC,EAAE,GAAG,GAAqB,EAAE;QACxF,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,2CAAmB,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,GAAG,GAAqB,EAAE;QACtD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,2CAAmB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;CACD,CAAA;;kCA/BY,uBAAuB;IADnC,IAAA,YAAO,GAAE;qCAIe,oBAAU,EAAqB,sBAAiB;GAH5D,uBAAuB,CA+BnC"}
+{"version":3,"file":"trusted-source.repository.js","sourceRoot":"","sources":["../../../../../src/modules/inbound-auth-core/database/repositories/trusted-source.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wCAA6C;AAC7C,gCAMiB;AACjB,gCAAkC;AAClC,0CAA0C;AAE1C,6EAAwE;AAExE,MAAM,kBAAmB,SAAQ,mBAAmC;IACnE,YAAY,UAAsB,EAAE,iBAAoC;QACvE,KAAK,CAAC,2CAAmB,EAAE,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACnE,CAAC;IAEQ,UAAU,CAAC,GAAqB;QACxC,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;CACD;AA6CM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAMnC,YACC,UAAsB,EACtB,iBAAoC,EACpC,MAAsB;QAEtB,IAAI,CAAC,KAAK,GAAG,IAAI,kBAAkB,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QACnE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU,EAAE,GAAG,GAAqB,EAAE;QACpD,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,2CAAmB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,GAAG,GAAqB,EAAE;QAC5D,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,2CAAmB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAG,GAAqB,EAAE;QACvC,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,2CAAmB,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC;IAOD,KAAK,CAAC,OAAO,CACZ,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,KAAK,EAAY,EAC7D,GAAG,GAAqB,EAAE;QAE1B,MAAM,WAAW,GAAG,IAAA,uBAAkB,EAAC,IAAI,CAAC,UAAU,EAAE,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;QACnF,MAAM,aAAa,GAAG,IAAA,uBAAkB,EAAC,IAAI,CAAC,UAAU,EAAE,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;QACzF,OAAO,MAAM,IAAI,CAAC,KAAK;aACrB,UAAU,CAAC,GAAG,CAAC;aACf,kBAAkB,CAAC,2CAAmB,EAAE,QAAQ,CAAC;aACjD,KAAK,CACL;6DACyD,WAAW;+DACT,aAAa,GAAG,EAC3E,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAC9D;aACA,OAAO,CAAC,yDAAyD,EAAE,KAAK,CAAC;aACzE,UAAU,CAAC,0DAA0D,EAAE,KAAK,CAAC;aAC7E,UAAU,CAAC,sBAAsB,EAAE,KAAK,CAAC;aACzC,IAAI,CAAC,KAAK,CAAC;aACX,OAAO,EAAE,CAAC;IACb,CAAC;IAGD,KAAK,CAAC,SAAS,CAAC,GAAwB,EAAE,GAAG,GAAqB,EAAE;QACnE,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,2CAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3F,CAAC;IAOD,KAAK,CAAC,cAAc,CACnB,GAA0D,EAC1D,GAAG,GAAqB,EAAE;QAE1B,MAAM,IAAI,CAAC,KAAK;aACd,UAAU,CAAC,GAAG,CAAC;aACf,kBAAkB,EAAE;aACpB,MAAM,EAAE;aACR,IAAI,CAAC,2CAAmB,CAAC;aACzB,MAAM,CAAC,GAAG,CAAC;aACX,QAAQ,EAAE;aACV,OAAO,EAAE,CAAC;IACb,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,OAAgC,EAAE,GAAG,GAAqB,EAAE;QACxF,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,2CAAmB,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,GAAG,GAAqB,EAAE;QACtD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,2CAAmB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;IAGD,KAAK,CAAC,iBAAiB,CACtB,EAAU,EACV,KAAa,EACb,YAAoB,EACpB,GAAG,GAAqB,EAAE;QAE1B,MAAM,WAAW,GAAG,IAAA,uBAAkB,EAAC,IAAI,CAAC,UAAU,EAAE,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK;aAC7B,UAAU,CAAC,GAAG,CAAC;aACf,kBAAkB,EAAE;aACpB,MAAM,CAAC,2CAAmB,CAAC;aAC3B,GAAG,CAAC;YACJ,mBAAmB,EAAE,KAAK;YAC1B,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAA,iBAAY,EAAC,IAAI,CAAC,UAAU,CAAC;SACvD,CAAC;aACD,KAAK,CACL,wEAAwE,WAAW,GAAG,EACtF,EAAE,EAAE,EAAE,CACN;aACA,OAAO,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC9B,CAAC;IAGD,KAAK,CAAC,eAAe,CACpB,EAAU,EACV,KAAa,EACb,OAA4B,EAC5B,GAAG,GAAqB,EAAE;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK;aAC7B,UAAU,CAAC,GAAG,CAAC;aACf,kBAAkB,EAAE;aACpB,MAAM,CAAC,2CAAmB,CAAC;aAC3B,GAAG,CAAC;YACJ,GAAG,OAAO;YACV,aAAa,EAAE,GAAG,EAAE,CAAC,IAAA,iBAAY,EAAC,IAAI,CAAC,UAAU,CAAC;YAClD,mBAAmB,EAAE,IAAI;YACzB,kBAAkB,EAAE,IAAI;SACxB,CAAC;aACD,KAAK,CAAC,6CAA6C,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;aACnE,OAAO,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC9B,CAAC;CACD,CAAA;;kCAnIY,uBAAuB;IADnC,IAAA,YAAO,GAAE;qCAQI,oBAAU,EACH,sBAAiB,EAC5B,uBAAc;GATX,uBAAuB,CAmInC"}

package/dist/modules/inbound-auth-core/grant-authorization.d.ts

@@ -0,0 +1,4 @@
+import type { ResourceUser } from '@n8n/inbound-auth';
+import type { OAuthResourceGrant } from 'n8n-workflow';
+import type { WorkflowFinderService } from '../../workflows/workflow-finder.service';
+export declare function authorizeAgainstGrant(workflowFinderService: WorkflowFinderService, grant: OAuthResourceGrant, user: ResourceUser): Promise<boolean>;

package/dist/modules/inbound-auth-core/grant-authorization.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorizeAgainstGrant = authorizeAgainstGrant;
+async function authorizeAgainstGrant(workflowFinderService, grant, user) {
+    if (!grant.executeAccessWorkflowId)
+        return true;
+    const allowed = await workflowFinderService.findWorkflowIdsWithScopeForUser([grant.executeAccessWorkflowId], user, ['workflow:execute']);
+    return allowed.has(grant.executeAccessWorkflowId);
+}
+//# sourceMappingURL=grant-authorization.js.map

package/dist/modules/inbound-auth-core/grant-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-authorization.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/grant-authorization.ts"],"names":[],"mappings":";;;AAUO,KAAK,gCACX,qBAA4C,EAC5C,KAAyB,EACzB,IAAkB;IAElB,IAAI,CAAC,KAAK,CAAC,uBAAuB;QAAE,OAAO,IAAI,CAAC;IAEhD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,+BAA+B,CAC1E,CAAC,KAAK,CAAC,uBAAuB,CAAC,EAC/B,IAAI,EACJ,CAAC,kBAAkB,CAAC,CACpB,CAAC;IAEF,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AACnD,CAAC"}

package/dist/modules/inbound-auth-core/identity/external-identity.d.ts

@@ -0,0 +1,3 @@
+import type { Logger } from '@n8n/backend-common';
+import type { ClaimMapping, ExternalIdentity, Result } from '@n8n/inbound-auth';
+export declare function translateClaims(claims: Readonly<Record<string, unknown>>, mapping: ClaimMapping, logger: Logger): Result<ExternalIdentity>;

package/dist/modules/inbound-auth-core/identity/external-identity.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.translateClaims = translateClaims;
+const n8n_workflow_1 = require("n8n-workflow");
+function readClaim(claims, source, logger) {
+    if (!source.startsWith('=')) {
+        return Object.hasOwn(claims, source) ? claims[source] : undefined;
+    }
+    const expression = source.slice(1);
+    try {
+        const value = n8n_workflow_1.Expression.resolveWithoutWorkflow(expression, {
+            $claims: claims,
+        });
+        const usable = typeof value === 'string' ? value.trim() !== '' : Array.isArray(value);
+        if (!usable)
+            logger.debug('Claim mapping expression yielded no usable value', { source });
+        return value;
+    }
+    catch (error) {
+        logger.debug('Claim mapping expression failed', { source, error });
+        return undefined;
+    }
+}
+function nonEmptyStringExact(value) {
+    return typeof value === 'string' && value.trim() !== '' ? value : undefined;
+}
+function nonEmptyString(value) {
+    return nonEmptyStringExact(value)?.trim();
+}
+function toScopes(value) {
+    const parts = typeof value === 'string'
+        ? value.split(/\s+/).map((scope) => scope.trim())
+        : Array.isArray(value) && value.every((v) => typeof v === 'string' && v.trim() !== '')
+            ? value
+            : [];
+    return [...new Set(parts.filter((scope) => scope !== ''))];
+}
+function toVerified(value) {
+    if (value === true || value === 'true')
+        return true;
+    if (value === false || value === 'false')
+        return false;
+    return undefined;
+}
+function toAuthTime(value) {
+    const seconds = typeof value === 'number'
+        ? value
+        : typeof value === 'string' && value.trim() !== ''
+            ? Number(value)
+            : NaN;
+    if (!Number.isFinite(seconds) || seconds <= 0)
+        return undefined;
+    const date = new Date(seconds * 1000);
+    return Number.isNaN(date.getTime()) ? undefined : date;
+}
+function translateClaims(claims, mapping, logger) {
+    const subject = nonEmptyStringExact(Object.hasOwn(claims, mapping.subject) ? claims[mapping.subject] : undefined);
+    if (subject === undefined) {
+        return {
+            ok: false,
+            reason: 'unknown-subject',
+        };
+    }
+    const read = (source) => readClaim(claims, source, logger);
+    const email = nonEmptyString(read(mapping.email))?.toLowerCase();
+    const acr = nonEmptyString(claims['acr']);
+    const amr = Array.isArray(claims['amr'])
+        ? claims['amr'].filter((v) => typeof v === 'string')
+        : undefined;
+    const authTime = toAuthTime(claims['auth_time']);
+    const assurance = acr || amr || authTime ? { acr, amr, authTime } : undefined;
+    return {
+        ok: true,
+        value: {
+            subject,
+            email,
+            emailVerified: toVerified(read(mapping.emailVerified)),
+            displayName: nonEmptyString(read(mapping.displayName)),
+            clientId: nonEmptyString(read(mapping.clientId)),
+            scopes: toScopes(read(mapping.scopes)),
+            assurance,
+            raw: claims,
+        },
+    };
+}
+//# sourceMappingURL=external-identity.js.map

package/dist/modules/inbound-auth-core/identity/external-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-identity.js","sourceRoot":"","sources":["../../../../src/modules/inbound-auth-core/identity/external-identity.ts"],"names":[],"mappings":";;;AAEA,+CAA0C;AAE1C,SAAS,SAAS,CACjB,MAAyC,EACzC,MAAc,EACd,MAAc;IAEd,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,yBAAU,CAAC,sBAAsB,CAAC,UAAU,EAAE;YAC3D,OAAO,EAAE,MAAM;SACf,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM;YAAE,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1F,OAAO,KAAK,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,OAAO,mBAAmB,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,MAAM,KAAK,GACV,OAAO,KAAK,KAAK,QAAQ;QACxB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACjD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YACrF,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,EAAE,CAAC;IACR,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IACjC,MAAM,OAAO,GACZ,OAAO,KAAK,KAAK,QAAQ;QACxB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;YACjD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACf,CAAC,CAAC,GAAG,CAAC;IAET,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAEhE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,yBACC,MAAyC,EACzC,OAAqB,EACrB,MAAc;IAEd,MAAM,OAAO,GAAG,mBAAmB,CAClC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAC5E,CAAC;IACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iBAAiB;SACzB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAEjE,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACjE,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAEjD,MAAM,SAAS,GAAG,GAAG,IAAI,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAE9E,OAAO;QACN,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACN,OAAO;YACP,KAAK;YACL,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACtD,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACtD,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACtC,SAAS;YACT,GAAG,EAAE,MAAM;SACX;KACD,CAAC;AACH,CAAC"}

package/dist/modules/inbound-auth-core/identity/trusted-source-identity.service.d.ts

@@ -0,0 +1,27 @@
+import { Logger } from '@n8n/backend-common';
+import { EventService, RoleService } from '@n8n/backend-services';
+import { TransactionRunner, UserRepository } from '@n8n/db';
+import { IdentityService, type Result, type Verified } from '@n8n/inbound-auth';
+import { type SecurityContext } from '@n8n/permissions';
+import { RoleMappingProxyService } from '../../../services/role-mapping-proxy.service';
+import { TrustedSourceIdentityRepository } from '../database/repositories/trusted-source-identity.repository';
+export declare class TrustedSourceIdentityService extends IdentityService {
+    private readonly logger;
+    private readonly identities;
+    private readonly users;
+    private readonly txRunner;
+    private readonly eventService;
+    private readonly roleService;
+    private readonly roleMapping;
+    constructor(logger: Logger, identities: TrustedSourceIdentityRepository, users: UserRepository, txRunner: TransactionRunner, eventService: EventService, roleService: RoleService, roleMapping: RoleMappingProxyService);
+    private mapRoles;
+    private mapIfContinuous;
+    private resolveByUserId;
+    private acceptBinding;
+    private link;
+    private provision;
+    private isAssignableInstanceRole;
+    private linkOrProvision;
+    private resolveBinding;
+    identify(verified: Verified): Promise<Result<SecurityContext>>;
+}