n8n 2.44.3 → 2.45.0

package/dist/modules/inbound-auth-core/public-api-protected-resource.d.ts

@@ -0,0 +1,21 @@
+import type { ConsentUiHints } from '@n8n/api-types';
+import { LicenseState } from '@n8n/backend-common';
+import { UrlService } from '@n8n/backend-services';
+import { GlobalConfig } from '@n8n/config';
+import type { ProtectedResource, ResourceUser } from '@n8n/inbound-auth';
+export declare class PublicApiProtectedResource implements ProtectedResource {
+    private readonly urlService;
+    private readonly globalConfig;
+    private readonly licenseState;
+    readonly id = "public-api";
+    readonly surface: 'public-api';
+    readonly displayName = "n8n public API";
+    readonly uiHints: ConsentUiHints;
+    readonly scopes: string[];
+    constructor(urlService: UrlService, globalConfig: GlobalConfig, licenseState: LicenseState);
+    getResourceUrl(): string;
+    getAudiences(): string[];
+    isAvailable(): Promise<boolean>;
+    authorize(): Promise<boolean>;
+    getGrantableScopes(user: ResourceUser): Promise<string[]>;
+}

package/dist/modules/inbound-auth-core/public-api-protected-resource.js

@@ -0,0 +1,51 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PublicApiProtectedResource = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const backend_services_1 = require("@n8n/backend-services");
+const config_1 = require("@n8n/config");
+const di_1 = require("@n8n/di");
+const permissions_1 = require("@n8n/permissions");
+let PublicApiProtectedResource = class PublicApiProtectedResource {
+    constructor(urlService, globalConfig, licenseState) {
+        this.urlService = urlService;
+        this.globalConfig = globalConfig;
+        this.licenseState = licenseState;
+        this.id = 'public-api';
+        this.surface = 'public-api';
+        this.displayName = 'n8n public API';
+        this.uiHints = { icon: 'key-round', consentType: 'api' };
+        this.scopes = [...permissions_1.ALL_API_KEY_SCOPES];
+    }
+    getResourceUrl() {
+        const baseUrl = this.urlService.getInstanceBaseUrl().replace(/\/$/, '');
+        return `${baseUrl}/${this.globalConfig.publicApi.path}/v1`;
+    }
+    getAudiences() {
+        return [this.getResourceUrl()];
+    }
+    async isAvailable() {
+        return !this.globalConfig.publicApi.disabled && !this.licenseState.isAPIDisabled();
+    }
+    async authorize() {
+        return await this.isAvailable();
+    }
+    async getGrantableScopes(user) {
+        return (0, permissions_1.getApiKeyScopesForRole)(user);
+    }
+};
+exports.PublicApiProtectedResource = PublicApiProtectedResource;
+exports.PublicApiProtectedResource = PublicApiProtectedResource = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [backend_services_1.UrlService, config_1.GlobalConfig, backend_common_1.LicenseState])
+], PublicApiProtectedResource);
+//# sourceMappingURL=public-api-protected-resource.js.map

package/dist/modules/inbound-auth-core/public-api-protected-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-api-protected-resource.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/public-api-protected-resource.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,wDAAmD;AACnD,4DAAmD;AACnD,wCAA2C;AAC3C,gCAAkC;AAElC,kDAA8E;AAIvE,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IAWtC,YACkB,UAAsB,EACtB,YAA0B,EAC1B,YAA0B;QAF1B,eAAU,GAAV,UAAU,CAAY;QACtB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,iBAAY,GAAZ,YAAY,CAAc;QAbnC,OAAE,GAAG,YAAY,CAAC;QAElB,YAAO,GAAG,YAAqB,CAAC;QAEhC,gBAAW,GAAG,gBAAgB,CAAC;QAE/B,YAAO,GAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAEpE,WAAM,GAAa,CAAC,GAAG,gCAAkB,CAAC,CAAC;IAMjD,CAAC;IAEJ,cAAc;QACb,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxE,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC;IAC5D,CAAC;IAED,YAAY;QACX,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,WAAW;QAChB,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,SAAS;QACd,OAAO,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,IAAkB;QAC1C,OAAO,IAAA,oCAAsB,EAAC,IAAI,CAAC,CAAC;IACrC,CAAC;CACD,CAAA;;qCArCY,0BAA0B;IADtC,IAAA,YAAO,GAAE;qCAaqB,6BAAU,EACR,qBAAY,EACZ,6BAAY;GAdhC,0BAA0B,CAqCtC"}

package/dist/modules/inbound-auth-core/resource-admission.d.ts

@@ -0,0 +1,12 @@
+import { Logger } from '@n8n/backend-common';
+import { AuthenticationPipeline, AuthenticationService, ResourceAdmission, type AdmissionResult, type Extracted, type Inbound, type ProtectedResource, type Refused } from '@n8n/inbound-auth';
+export declare class InboundResourceAdmission extends ResourceAdmission {
+    private readonly pipeline;
+    private readonly authenticationService;
+    private readonly logger;
+    constructor(pipeline: AuthenticationPipeline, authenticationService: AuthenticationService, logger: Logger);
+    admitBearer(resource: ProtectedResource, request: Omit<Inbound['request'], 'headers'>, token: string): Promise<AdmissionResult>;
+    admit(resource: ProtectedResource, extracted: Extracted): Promise<AdmissionResult>;
+    challenge({ advertised, reason }: Refused): Promise<string>;
+    private refuse;
+}

package/dist/modules/inbound-auth-core/resource-admission.js

@@ -0,0 +1,65 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InboundResourceAdmission = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const di_1 = require("@n8n/di");
+const inbound_auth_1 = require("@n8n/inbound-auth");
+let InboundResourceAdmission = class InboundResourceAdmission extends inbound_auth_1.ResourceAdmission {
+    constructor(pipeline, authenticationService, logger) {
+        super();
+        this.pipeline = pipeline;
+        this.authenticationService = authenticationService;
+        this.logger = logger;
+    }
+    async admitBearer(resource, request, token) {
+        const inbound = (0, inbound_auth_1.inboundFrom)(resource, { ...request, headers: {} });
+        if (!token)
+            return this.refuse(inbound, 'no-credential');
+        return await this.admit(resource, { ...inbound, credential: { kind: 'bearer', token } });
+    }
+    async admit(resource, extracted) {
+        const authenticated = await this.pipeline.run(extracted);
+        if (!authenticated.ok) {
+            return { ok: false, reason: authenticated.reason, advertised: advertisedOf(extracted) };
+        }
+        const context = authenticated.value;
+        if (!(await resource.authorize(context.subject))) {
+            return this.refuse(extracted, 'insufficient_scope', context);
+        }
+        return { ok: true, context };
+    }
+    async challenge({ advertised, reason }) {
+        const { challenges } = await this.authenticationService.advertise(advertised);
+        const error = reason === 'insufficient_scope' ? 'insufficient_scope' : 'invalid_token';
+        return `${challenges[0] ?? 'Bearer'}, error="${error}", error_description="${reason}"`;
+    }
+    refuse(inbound, reason, context) {
+        this.logger.warn('Inbound authentication denied', {
+            surface: inbound.surface,
+            resource: inbound.resource.url,
+            sourceId: context?.subjectClaim?.sourceId,
+            authMethod: context?.authMethod,
+            userId: context?.subject.id,
+            reason,
+        });
+        return { ok: false, reason, advertised: advertisedOf(inbound), ...(context && { context }) };
+    }
+};
+exports.InboundResourceAdmission = InboundResourceAdmission;
+exports.InboundResourceAdmission = InboundResourceAdmission = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [inbound_auth_1.AuthenticationPipeline, inbound_auth_1.AuthenticationService, backend_common_1.Logger])
+], InboundResourceAdmission);
+function advertisedOf({ surface, resource, acceptedSourceIds }) {
+    return { surface, resource, ...(acceptedSourceIds !== undefined && { acceptedSourceIds }) };
+}
+//# sourceMappingURL=resource-admission.js.map

package/dist/modules/inbound-auth-core/resource-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-admission.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/resource-admission.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;AAC7C,gCAAkC;AAClC,oDAY2B;AAKpB,IAAM,wBAAwB,GAA9B,MAAM,wBAAyB,SAAQ,gCAAiB;IAC9D,YACkB,QAAgC,EAChC,qBAA4C,EAC5C,MAAc;QAE/B,KAAK,EAAE,CAAC;wBAJS,QAAQ;qCACR,qBAAqB;sBACrB,MAAM;IAGxB,CAAC;IAED,KAAK,CAAC,WAAW,CAChB,QAA2B,EAC3B,OAA4C,EAC5C,KAAa;QAGb,MAAM,OAAO,GAAG,IAAA,0BAAW,EAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAA2B,EAAE,SAAoB;QAE5D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QACzF,CAAC;QAED,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC;QACpC,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAW;QAC9C,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,MAAM,KAAK,oBAAoB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,eAAe,CAAC;QACvF,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,QAAQ,YAAY,KAAK,yBAAyB,MAAM,GAAG,CAAC;IACxF,CAAC;IAMO,MAAM,CAAC,OAAgB,EAAE,MAAqB,EAAE,OAAyB;QAChF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YACjD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG;YAC9B,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ;YACzC,UAAU,EAAE,OAAO,EAAE,UAAU;YAC/B,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;YAC3B,MAAM;SACN,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC9F,CAAC;CACD,CAAA;;mCAvDY,wBAAwB;IADpC,IAAA,YAAO,GAAE;qCAGmB,qCAAsB,EACT,oCAAqB,EACpC,uBAAM;GAJpB,wBAAwB,CAuDpC;AAGD,SAAS,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAW;IACtE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;AAC7F,CAAC"}

package/dist/modules/inbound-auth-core/system-trusted-source.seeder.d.ts

@@ -1,48 +1,6 @@
 import { Logger } from '@n8n/backend-common';
 import { UrlService } from '@n8n/backend-services';
 import { TrustedSourceDbStore } from './trusted-source.store';
-export declare const SYSTEM_TRUSTED_SOURCE_ID = "n8n-internal";
-export declare const SYSTEM_TRUSTED_SOURCE_NAME = "n8n";
-export declare const SYSTEM_TRUSTED_SOURCE_CONFIG: {
-    version: 1;
-    authentication: {
-        type: "oauth2";
-        discovery: {
-            mode: "auto";
-        };
-        keys: {
-            kind: "local-keystore";
-        };
-        verification: {
-            mode: "jwt";
-        };
-        client: {
-            kind: "virtual";
-        };
-    };
-    surfaces: {
-        'public-api': {};
-        'instance-mcp': {};
-        trigger: {};
-    };
-    identity: {
-        subject: "n8n-user-id";
-        claimMapping: {
-            subject: string;
-            clientId: string;
-            scopes: string;
-        };
-        linkByEmail: "off";
-        provision: {
-            human: "off";
-        };
-        roleMapping: {
-            mode: "off";
-            instanceRoleRules: never[];
-            projectRoleRules: never[];
-        };
-    };
-};
 export declare class SystemTrustedSourceSeeder {
     private readonly store;
     private readonly urlService;

package/dist/modules/inbound-auth-core/system-trusted-source.seeder.js

@@ -9,31 +9,12 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SystemTrustedSourceSeeder = exports.SYSTEM_TRUSTED_SOURCE_CONFIG = exports.SYSTEM_TRUSTED_SOURCE_NAME = exports.SYSTEM_TRUSTED_SOURCE_ID = void 0;
+exports.SystemTrustedSourceSeeder = void 0;
 const backend_common_1 = require("@n8n/backend-common");
 const backend_services_1 = require("@n8n/backend-services");
 const di_1 = require("@n8n/di");
+const constants_1 = require("./constants");
 const trusted_source_store_1 = require("./trusted-source.store");
-exports.SYSTEM_TRUSTED_SOURCE_ID = 'n8n-internal';
-exports.SYSTEM_TRUSTED_SOURCE_NAME = 'n8n';
-exports.SYSTEM_TRUSTED_SOURCE_CONFIG = {
-    version: 1,
-    authentication: {
-        type: 'oauth2',
-        discovery: { mode: 'auto' },
-        keys: { kind: 'local-keystore' },
-        verification: { mode: 'jwt' },
-        client: { kind: 'virtual' },
-    },
-    surfaces: { 'public-api': {}, 'instance-mcp': {}, trigger: {} },
-    identity: {
-        subject: 'n8n-user-id',
-        claimMapping: { subject: 'sub', clientId: 'client_id', scopes: 'scope' },
-        linkByEmail: 'off',
-        provision: { human: 'off' },
-        roleMapping: { mode: 'off', instanceRoleRules: [], projectRoleRules: [] },
-    },
-};
 let SystemTrustedSourceSeeder = class SystemTrustedSourceSeeder {
     constructor(store, urlService, logger) {
         this.store = store;
@@ -44,12 +25,12 @@ let SystemTrustedSourceSeeder = class SystemTrustedSourceSeeder {
     async seed() {
         const issuer = this.urlService.getInstanceBaseUrl();
         const outcome = await this.store.seedSystemSource({
-            id: exports.SYSTEM_TRUSTED_SOURCE_ID,
-            name: exports.SYSTEM_TRUSTED_SOURCE_NAME,
+            id: constants_1.SYSTEM_TRUSTED_SOURCE_ID,
+            name: constants_1.SYSTEM_TRUSTED_SOURCE_NAME,
             issuer,
-            config: exports.SYSTEM_TRUSTED_SOURCE_CONFIG,
+            config: constants_1.SYSTEM_TRUSTED_SOURCE_CONFIG,
         });
-        const context = { id: exports.SYSTEM_TRUSTED_SOURCE_ID, issuer };
+        const context = { id: constants_1.SYSTEM_TRUSTED_SOURCE_ID, issuer };
         switch (outcome) {
             case 'inserted':
                 this.logger.info('Seeded the system trusted source', context);
@@ -61,7 +42,7 @@ let SystemTrustedSourceSeeder = class SystemTrustedSourceSeeder {
                 this.logger.debug('System trusted source is up to date', context);
                 break;
             case 'conflict':
-                this.logger.error('Could not seed the system trusted source: another trusted source holds its id, name or issuer', { ...context, name: exports.SYSTEM_TRUSTED_SOURCE_NAME });
+                this.logger.error('Could not seed the system trusted source: another trusted source holds its id, name or issuer', { ...context, name: constants_1.SYSTEM_TRUSTED_SOURCE_NAME });
                 break;
         }
     }

package/dist/modules/inbound-auth-core/system-trusted-source.seeder.js.map

@@ -1 +1 @@
-{"version":3,"file":"system-trusted-source.seeder.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/system-trusted-source.seeder.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;AAC7C,4DAAmD;AACnD,gCAAkC;AAGlC,iEAA8D;AAIjD,QAAA,wBAAwB,GAAG,cAAc,CAAC;AAC1C,QAAA,0BAA0B,GAAG,KAAK,CAAC;AACnC,QAAA,4BAA4B,GAAG;IAC3C,OAAO,EAAE,CAAC;IACV,cAAc,EAAE;QACf,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;QAChC,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;QAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KAC3B;IACD,QAAQ,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;IAC/D,QAAQ,EAAE;QACT,OAAO,EAAE,aAAa;QACtB,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;QACxE,WAAW,EAAE,KAAK;QAClB,SAAS,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QAC3B,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE;KACzE;CACkC,CAAC;AAc9B,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACrC,YACkB,KAA2B,EAC3B,UAAsB,EACtB,MAAc;qBAFd,KAAK;0BACL,UAAU;sBACV,MAAM;QAEvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAClD,CAAC;IAGD,KAAK,CAAC,IAAI;QACT,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACjD,EAAE,EAAE,QAAA,wBAAwB;YAC5B,IAAI,EAAE,QAAA,0BAA0B;YAChC,MAAM;YACN,MAAM,EAAE,QAAA,4BAA4B;SACpC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,EAAE,EAAE,QAAA,wBAAwB,EAAE,MAAM,EAAE,CAAC;QAEzD,QAAQ,OAAO,EAAE,CAAC;YACjB,KAAK,UAAU;gBACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,OAAO,CAAC,CAAC;gBAC9D,MAAM;YACP,KAAK,gBAAgB;gBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0DAA0D,EAAE,OAAO,CAAC,CAAC;gBACtF,MAAM;YACP,KAAK,WAAW;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,OAAO,CAAC,CAAC;gBAClE,MAAM;YACP,KAAK,UAAU;gBACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,+FAA+F,EAC/F,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,QAAA,0BAA0B,EAAE,CAChD,CAAC;gBACF,MAAM;QACR,CAAC;IACF,CAAC;CACD,CAAA;;oCAtCY,yBAAyB;IADrC,IAAA,YAAO,GAAE;qCAGgB,2CAAoB,EACf,6BAAU,EACd,uBAAM;GAJpB,yBAAyB,CAsCrC"}
+{"version":3,"file":"system-trusted-source.seeder.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/system-trusted-source.seeder.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;AAC7C,4DAAmD;AACnD,gCAAkC;AAElC,2CAIqB;AACrB,iEAA8D;AAcvD,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACrC,YACkB,KAA2B,EAC3B,UAAsB,EACtB,MAAc;qBAFd,KAAK;0BACL,UAAU;sBACV,MAAM;QAEvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAClD,CAAC;IAGD,KAAK,CAAC,IAAI;QACT,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACjD,EAAE,EAAE,oCAAwB;YAC5B,IAAI,EAAE,sCAA0B;YAChC,MAAM;YACN,MAAM,EAAE,wCAA4B;SACpC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,EAAE,EAAE,oCAAwB,EAAE,MAAM,EAAE,CAAC;QAEzD,QAAQ,OAAO,EAAE,CAAC;YACjB,KAAK,UAAU;gBACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,OAAO,CAAC,CAAC;gBAC9D,MAAM;YACP,KAAK,gBAAgB;gBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0DAA0D,EAAE,OAAO,CAAC,CAAC;gBACtF,MAAM;YACP,KAAK,WAAW;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,OAAO,CAAC,CAAC;gBAClE,MAAM;YACP,KAAK,UAAU;gBACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,+FAA+F,EAC/F,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,sCAA0B,EAAE,CAChD,CAAC;gBACF,MAAM;QACR,CAAC;IACF,CAAC;CACD,CAAA;;oCAtCY,yBAAyB;IADrC,IAAA,YAAO,GAAE;qCAGgB,2CAAoB,EACf,6BAAU,EACd,uBAAM;GAJpB,yBAAyB,CAsCrC"}

package/dist/modules/inbound-auth-core/trusted-source-directory.service.d.ts

@@ -0,0 +1,7 @@
+import { TrustedSourceStore } from '@n8n/inbound-auth';
+import type { TrustedSourceDirectory, TrustedSourceFilter, TrustedSourceOption } from 'n8n-workflow';
+export declare class TrustedSourceDbDirectory implements TrustedSourceDirectory {
+    private readonly store;
+    constructor(store: TrustedSourceStore);
+    listTrustedSources({ surface, capability, }: TrustedSourceFilter): Promise<TrustedSourceOption[]>;
+}

package/dist/modules/inbound-auth-core/trusted-source-directory.service.js

@@ -0,0 +1,32 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TrustedSourceDbDirectory = void 0;
+const di_1 = require("@n8n/di");
+const inbound_auth_1 = require("@n8n/inbound-auth");
+let TrustedSourceDbDirectory = class TrustedSourceDbDirectory {
+    constructor(store) {
+        this.store = store;
+    }
+    async listTrustedSources({ surface, capability, }) {
+        const sources = await this.store.listBySurface(surface);
+        return sources
+            .filter((source) => capability === undefined ||
+            (0, inbound_auth_1.deriveCapabilities)(source.config, source.metadata).has(capability))
+            .map(({ id, name }) => ({ id, name }));
+    }
+};
+exports.TrustedSourceDbDirectory = TrustedSourceDbDirectory;
+exports.TrustedSourceDbDirectory = TrustedSourceDbDirectory = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [inbound_auth_1.TrustedSourceStore])
+], TrustedSourceDbDirectory);
+//# sourceMappingURL=trusted-source-directory.service.js.map

package/dist/modules/inbound-auth-core/trusted-source-directory.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-source-directory.service.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/trusted-source-directory.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAAkC;AAClC,oDAA2E;AAapE,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACpC,YAA6B,KAAyB;qBAAzB,KAAK;IAAuB,CAAC;IAE1D,KAAK,CAAC,kBAAkB,CAAC,EACxB,OAAO,EACP,UAAU,GACW;QACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACxD,OAAO,OAAO;aACZ,MAAM,CACN,CAAC,MAAM,EAAE,EAAE,CACV,UAAU,KAAK,SAAS;YACxB,IAAA,iCAAkB,EAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CACnE;aACA,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;CACD,CAAA;;mCAhBY,wBAAwB;IADpC,IAAA,YAAO,GAAE;qCAE2B,iCAAkB;GAD1C,wBAAwB,CAgBpC"}

package/dist/modules/inbound-auth-core/trusted-source-discovery.task.d.ts

@@ -1,12 +1,11 @@
 import { SystemTask } from '@n8n/decorators';
-import type { SystemTaskEffects, SystemTaskPlacement, SystemTaskSchedule } from '@n8n/decorators';
+import type { SystemTaskSchedule } from '@n8n/decorators';
 import { TrustedSourceDiscoveryService } from './trusted-source-discovery.service';
 export declare class TrustedSourceDiscoveryTask implements SystemTask {
     private readonly discovery;
     readonly name = "trusted-source-discovery";
     readonly schedule: SystemTaskSchedule;
-    readonly effects: SystemTaskEffects;
-    readonly placement: SystemTaskPlacement;
+    readonly target: import("@n8n/decorators").ClusterTarget;
     constructor(discovery: TrustedSourceDiscoveryService);
     run(signal: AbortSignal): Promise<void>;
 }

package/dist/modules/inbound-auth-core/trusted-source-discovery.task.js

@@ -18,8 +18,7 @@ let TrustedSourceDiscoveryTask = class TrustedSourceDiscoveryTask {
         this.discovery = discovery;
         this.name = 'trusted-source-discovery';
         this.schedule = (0, decorators_1.intervalFromSeconds)(DISCOVERY_POLL_INTERVAL_SECONDS);
-        this.effects = 'idempotent';
-        this.placement = { scope: 'cluster', durable: true };
+        this.target = (0, decorators_1.clusterTarget)({ scheduler: { retryOnFailure: true } });
     }
     async run(signal) {
         await this.discovery.refreshDue(signal);

package/dist/modules/inbound-auth-core/trusted-source-discovery.task.js.map

@@ -1 +1 @@
-{"version":3,"file":"trusted-source-discovery.task.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/trusted-source-discovery.task.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gDAAkE;AAGlE,yFAAmF;AAGnF,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAOpC,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IAStC,YAA6B,SAAwC;QAAxC,cAAS,GAAT,SAAS,CAA+B;QAR5D,SAAI,GAAG,0BAA0B,CAAC;QAElC,aAAQ,GAAuB,IAAA,gCAAmB,EAAC,+BAA+B,CAAC,CAAC;QAEpF,YAAO,GAAsB,YAAY,CAAC;QAE1C,cAAS,GAAwB,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEN,CAAC;IAEzE,KAAK,CAAC,GAAG,CAAC,MAAmB;QAC5B,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;CACD,CAAA;;qCAdY,0BAA0B;IADtC,IAAA,uBAAU,GAAE;qCAU4B,gEAA6B;GATzD,0BAA0B,CActC"}
+{"version":3,"file":"trusted-source-discovery.task.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/trusted-source-discovery.task.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gDAAiF;AAGjF,yFAAmF;AAGnF,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAOpC,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IAOtC,YAA6B,SAAwC;QAAxC,cAAS,GAAT,SAAS,CAA+B;QAN5D,SAAI,GAAG,0BAA0B,CAAC;QAElC,aAAQ,GAAuB,IAAA,gCAAmB,EAAC,+BAA+B,CAAC,CAAC;QAEpF,WAAM,GAAG,IAAA,0BAAa,EAAC,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAED,CAAC;IAEzE,KAAK,CAAC,GAAG,CAAC,MAAmB;QAC5B,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;CACD,CAAA;;qCAZY,0BAA0B;IADtC,IAAA,uBAAU,GAAE;qCAQ4B,gEAA6B;GAPzD,0BAA0B,CAYtC"}

package/dist/modules/inbound-auth-core/trusted-source.controller.d.ts

@@ -0,0 +1,27 @@
+import { CreateTrustedSourceDto, UpdateTrustedSourceDto } from '@n8n/api-types';
+import { EventService } from '@n8n/backend-services';
+import { type AuthenticatedRequest } from '@n8n/db';
+import { type Capability, type TrustedSource } from '@n8n/inbound-auth';
+import type { Response } from 'express';
+import { TrustedSourceDiscoveryService } from './trusted-source-discovery.service';
+import { TrustedSourceDbStore } from './trusted-source.store';
+type TrustedSourceSummary = {
+    id: string;
+    name: string;
+    capabilities: Capability[];
+    surfaces: string[];
+};
+export declare class TrustedSourceController {
+    private readonly store;
+    private readonly discovery;
+    private readonly eventService;
+    constructor(store: TrustedSourceDbStore, discovery: TrustedSourceDiscoveryService, eventService: EventService);
+    list(): Promise<TrustedSourceSummary[]>;
+    get(_req: AuthenticatedRequest, _res: Response, id: string): Promise<TrustedSource>;
+    create(req: AuthenticatedRequest, _res: Response, dto: CreateTrustedSourceDto): Promise<TrustedSource>;
+    update(req: AuthenticatedRequest, _res: Response, id: string, dto: UpdateTrustedSourceDto): Promise<TrustedSource>;
+    delete(req: AuthenticatedRequest, _res: Response, id: string): Promise<void>;
+    check(_req: AuthenticatedRequest, _res: Response, id: string): Promise<TrustedSource>;
+    private require;
+}
+export {};

package/dist/modules/inbound-auth-core/trusted-source.controller.js

@@ -0,0 +1,190 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TrustedSourceController = void 0;
+const api_types_1 = require("@n8n/api-types");
+const backend_services_1 = require("@n8n/backend-services");
+const db_1 = require("@n8n/db");
+const decorators_1 = require("@n8n/decorators");
+const errors_1 = require("@n8n/errors");
+const inbound_auth_1 = require("@n8n/inbound-auth");
+const n8n_workflow_1 = require("n8n-workflow");
+const trusted_source_discovery_service_1 = require("./trusted-source-discovery.service");
+const trusted_source_store_1 = require("./trusted-source.store");
+function toSummary(source) {
+    return {
+        id: source.id,
+        name: source.name,
+        capabilities: [...(0, inbound_auth_1.deriveCapabilities)(source.config, source.metadata)],
+        surfaces: Object.keys(source.config.surfaces),
+    };
+}
+function redact(source) {
+    const { client } = source.config.authentication;
+    if (client?.kind !== 'registered' || client.clientSecret === undefined)
+        return source;
+    return {
+        ...source,
+        config: {
+            ...source.config,
+            authentication: {
+                ...source.config.authentication,
+                client: { ...client, clientSecret: n8n_workflow_1.CREDENTIAL_BLANKING_VALUE },
+            },
+        },
+    };
+}
+function restoreSecret(config, current) {
+    const { client } = config.authentication;
+    if (client?.kind !== 'registered' || client.clientSecret !== n8n_workflow_1.CREDENTIAL_BLANKING_VALUE) {
+        return config;
+    }
+    const storedClient = current.authentication.client;
+    const { clientSecret: _, ...withoutSecret } = client;
+    const restored = storedClient?.kind === 'registered' && storedClient.clientSecret !== undefined
+        ? { ...withoutSecret, clientSecret: storedClient.clientSecret }
+        : withoutSecret;
+    return { ...config, authentication: { ...config.authentication, client: restored } };
+}
+async function wrapConflict(write) {
+    try {
+        return await write();
+    }
+    catch (error) {
+        if ((0, db_1.isUniqueConstraintError)(error)) {
+            throw new errors_1.ConflictError('A trusted source with this name or issuer already exists');
+        }
+        throw error;
+    }
+}
+let TrustedSourceController = class TrustedSourceController {
+    constructor(store, discovery, eventService) {
+        this.store = store;
+        this.discovery = discovery;
+        this.eventService = eventService;
+    }
+    async list() {
+        return (await this.store.listAll()).map(toSummary);
+    }
+    async get(_req, _res, id) {
+        return redact(await this.require(id));
+    }
+    async create(req, _res, dto) {
+        const { client } = dto.config.authentication;
+        if (client?.kind === 'registered' && client.clientSecret === n8n_workflow_1.CREDENTIAL_BLANKING_VALUE) {
+            throw new errors_1.BadRequestError('clientSecret must be a real secret on create, not the blanking value');
+        }
+        const source = await wrapConflict(async () => await this.store.create(dto));
+        this.eventService.emit('trusted-source-created', {
+            user: req.user,
+            sourceId: source.id,
+            issuer: source.issuer,
+        });
+        return redact(source);
+    }
+    async update(req, _res, id, dto) {
+        const current = await this.require(id);
+        const { clearBindings = false, config, ...rest } = dto;
+        if (rest.name === undefined &&
+            rest.issuer === undefined &&
+            config === undefined &&
+            !clearBindings) {
+            return redact(current);
+        }
+        await wrapConflict(async () => await this.store.update(id, { ...rest, ...(config && { config: restoreSecret(config, current.config) }) }, { clearBindings }));
+        const updated = await this.require(id);
+        this.eventService.emit('trusted-source-updated', {
+            user: req.user,
+            sourceId: updated.id,
+            issuer: updated.issuer,
+        });
+        return redact(updated);
+    }
+    async delete(req, _res, id) {
+        const source = await this.require(id);
+        await this.store.delete(id);
+        this.eventService.emit('trusted-source-deleted', {
+            user: req.user,
+            sourceId: source.id,
+            issuer: source.issuer,
+        });
+    }
+    async check(_req, _res, id) {
+        await this.require(id);
+        await this.discovery.refresh(id);
+        return redact(await this.require(id));
+    }
+    async require(id) {
+        const source = await this.store.getById(id);
+        if (!source)
+            throw new errors_1.NotFoundError(`Trusted source "${id}" not found`);
+        return source;
+    }
+};
+exports.TrustedSourceController = TrustedSourceController;
+__decorate([
+    (0, decorators_1.Get)('/'),
+    (0, decorators_1.GlobalScope)('trustedSource:list'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], TrustedSourceController.prototype, "list", null);
+__decorate([
+    (0, decorators_1.Get)('/:id'),
+    (0, decorators_1.GlobalScope)('trustedSource:read'),
+    __param(2, (0, decorators_1.Param)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, String]),
+    __metadata("design:returntype", Promise)
+], TrustedSourceController.prototype, "get", null);
+__decorate([
+    (0, decorators_1.Post)('/'),
+    (0, decorators_1.Licensed)('feat:trustedSourceManage'),
+    (0, decorators_1.GlobalScope)('trustedSource:create'),
+    __param(2, decorators_1.Body),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, api_types_1.CreateTrustedSourceDto]),
+    __metadata("design:returntype", Promise)
+], TrustedSourceController.prototype, "create", null);
+__decorate([
+    (0, decorators_1.Patch)('/:id'),
+    (0, decorators_1.Licensed)('feat:trustedSourceManage'),
+    (0, decorators_1.GlobalScope)('trustedSource:update'),
+    __param(2, (0, decorators_1.Param)('id')),
+    __param(3, decorators_1.Body),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, String, api_types_1.UpdateTrustedSourceDto]),
+    __metadata("design:returntype", Promise)
+], TrustedSourceController.prototype, "update", null);
+__decorate([
+    (0, decorators_1.Delete)('/:id'),
+    (0, decorators_1.GlobalScope)('trustedSource:delete'),
+    __param(2, (0, decorators_1.Param)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, String]),
+    __metadata("design:returntype", Promise)
+], TrustedSourceController.prototype, "delete", null);
+__decorate([
+    (0, decorators_1.Post)('/:id/check'),
+    (0, decorators_1.GlobalScope)('trustedSource:update'),
+    __param(2, (0, decorators_1.Param)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, String]),
+    __metadata("design:returntype", Promise)
+], TrustedSourceController.prototype, "check", null);
+exports.TrustedSourceController = TrustedSourceController = __decorate([
+    (0, decorators_1.RestController)('/trusted-sources'),
+    __metadata("design:paramtypes", [trusted_source_store_1.TrustedSourceDbStore, trusted_source_discovery_service_1.TrustedSourceDiscoveryService, backend_services_1.EventService])
+], TrustedSourceController);
+//# sourceMappingURL=trusted-source.controller.js.map

package/dist/modules/inbound-auth-core/trusted-source.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-source.controller.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/trusted-source.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,8CAAgF;AAChF,4DAAqD;AACrD,gCAA6E;AAC7E,gDAUyB;AACzB,wCAA4E;AAC5E,oDAM2B;AAE3B,+CAAyD;AAEzD,yFAAmF;AACnF,iEAA8D;AAU9D,SAAS,SAAS,CAAC,MAAqB;IACvC,OAAO;QACN,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,CAAC,GAAG,IAAA,iCAAkB,EAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;KAC7C,CAAC;AACH,CAAC;AAGD,SAAS,MAAM,CAAC,MAAqB;IACpC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;IAChD,IAAI,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACtF,OAAO;QACN,GAAG,MAAM;QACT,MAAM,EAAE;YACP,GAAG,MAAM,CAAC,MAAM;YAChB,cAAc,EAAE;gBACf,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc;gBAC/B,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,wCAAyB,EAAE;aAC9D;SACD;KACD,CAAC;AACH,CAAC;AAMD,SAAS,aAAa,CACrB,MAAgC,EAChC,OAAkC;IAElC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC;IACzC,IAAI,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,YAAY,KAAK,wCAAyB,EAAE,CAAC;QACxF,OAAO,MAAM,CAAC;IACf,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC;IACnD,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC;IACrD,MAAM,QAAQ,GACb,YAAY,EAAE,IAAI,KAAK,YAAY,IAAI,YAAY,CAAC,YAAY,KAAK,SAAS;QAC7E,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,YAAY,EAAE,YAAY,CAAC,YAAY,EAAE;QAC/D,CAAC,CAAC,aAAa,CAAC;IAClB,OAAO,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC;AACtF,CAAC;AAED,KAAK,UAAU,YAAY,CAAI,KAAuB;IACrD,IAAI,CAAC;QACJ,OAAO,MAAM,KAAK,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,IAAA,4BAAuB,EAAC,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,sBAAa,CAAC,0DAA0D,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IACnC,YACkB,KAA2B,EAC3B,SAAwC,EACxC,YAA0B;qBAF1B,KAAK;yBACL,SAAS;4BACT,YAAY;IAC3B,CAAC;IAIE,AAAN,KAAK,CAAC,IAAI;QACT,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAIK,AAAN,KAAK,CAAC,GAAG,CAAC,IAA0B,EAAE,IAAc,EAAe,EAAU;QAC5E,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CAAC,GAAyB,EAAE,IAAc,EAAQ,GAA2B;QACxF,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC;QAE7C,IAAI,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,YAAY,KAAK,wCAAyB,EAAE,CAAC;YACxF,MAAM,IAAI,wBAAe,CACxB,sEAAsE,CACtE,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,wBAAwB,EAAE;YAChD,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CACX,GAAyB,EACzB,IAAc,EACD,EAAU,EACjB,GAA2B;QAEjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,EAAE,aAAa,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;QAEvD,IACC,IAAI,CAAC,IAAI,KAAK,SAAS;YACvB,IAAI,CAAC,MAAM,KAAK,SAAS;YACzB,MAAM,KAAK,SAAS;YACpB,CAAC,aAAa,EACb,CAAC;YACF,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QACD,MAAM,YAAY,CACjB,KAAK,IAAI,EAAE,CACV,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CACtB,EAAE,EACF,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAC7E,EAAE,aAAa,EAAE,CACjB,CACF,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,wBAAwB,EAAE;YAChD,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,OAAO,CAAC,EAAE;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;SACtB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAIK,AAAN,KAAK,CAAC,MAAM,CAAC,GAAyB,EAAE,IAAc,EAAe,EAAU;QAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,wBAAwB,EAAE;YAChD,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;SACrB,CAAC,CAAC;IACJ,CAAC;IAIK,AAAN,KAAK,CAAC,KAAK,CAAC,IAA0B,EAAE,IAAc,EAAe,EAAU;QAC9E,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAGvB,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,EAAU;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,aAAa,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC;IACf,CAAC;CACD,CAAA;;AA9FM;IAFL,IAAA,gBAAG,EAAC,GAAG,CAAC;IACR,IAAA,wBAAW,EAAC,oBAAoB,CAAC;;;;mDAGjC;AAIK;IAFL,IAAA,gBAAG,EAAC,MAAM,CAAC;IACX,IAAA,wBAAW,EAAC,oBAAoB,CAAC;IACqB,WAAA,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAA;;;;kDAEjE;AAKK;IAHL,IAAA,iBAAI,EAAC,GAAG,CAAC;IACT,IAAA,qBAAQ,EAAC,0BAA0B,CAAC;IACpC,IAAA,wBAAW,EAAC,sBAAsB,CAAC;IACqB,WAAA,iBAAI,CAAA;;qDAAM,kCAAsB;;qDAexF;AAKK;IAHL,IAAA,kBAAK,EAAC,MAAM,CAAC;IACb,IAAA,qBAAQ,EAAC,0BAA0B,CAAC;IACpC,IAAA,wBAAW,EAAC,sBAAsB,CAAC;IAIlC,WAAA,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAA;IACX,WAAA,iBAAI,CAAA;;6DAAM,kCAAsB;;qDA4BjC;AAIK;IAFL,IAAA,mBAAM,EAAC,MAAM,CAAC;IACd,IAAA,wBAAW,EAAC,sBAAsB,CAAC;IACqB,WAAA,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAA;;;;qDAQnE;AAIK;IAFL,IAAA,iBAAI,EAAC,YAAY,CAAC;IAClB,IAAA,wBAAW,EAAC,sBAAsB,CAAC;IACqB,WAAA,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAA;;;;oDAMnE;kCAhGW,uBAAuB;IADnC,IAAA,2BAAc,EAAC,kBAAkB,CAAC;qCAGT,2CAAoB,EAChB,gEAA6B,EAC1B,+BAAY;GAJhC,uBAAuB,CAuGnC"}

package/dist/modules/inbound-auth-core/trusted-source.store.d.ts

@@ -36,6 +36,7 @@ export declare class TrustedSourceDbStore extends TrustedSourceStore {
     constructor(logger: Logger, trustedSourceRepository: TrustedSourceRepository, cipher: Cipher, cacheService: CacheService, trustedSourceIdentityRepository: TrustedSourceIdentityRepository, transactionRunner: TransactionRunner);
     getById(id: string): Promise<TrustedSource | undefined>;
     getByIssuer(issuer: string): Promise<TrustedSource | undefined>;
+    listAll(): Promise<TrustedSource[]>;
     listBySurface(surface: SurfaceId): Promise<TrustedSource[]>;
     listDue(limit: number): Promise<TrustedSource[]>;
     claimDiscovery(source: TrustedSource): Promise<string | null>;

package/dist/modules/inbound-auth-core/trusted-source.store.js

@@ -58,11 +58,14 @@ let TrustedSourceDbStore = class TrustedSourceDbStore extends inbound_auth_1.Tru
             refreshFn: async () => await this.load(await this.trustedSourceRepository.findByIssuer(issuer)),
         });
     }
-    async listBySurface(surface) {
-        const all = (await this.cacheService.get(ALL_KEY, {
+    async listAll() {
+        return ((await this.cacheService.get(ALL_KEY, {
             ttl: CACHE_TTL,
             refreshFn: async () => await this.loadAll(),
-        })) ?? [];
+        })) ?? []);
+    }
+    async listBySurface(surface) {
+        const all = await this.listAll();
         return all.filter((source) => source.config.surfaces[surface] !== undefined);
     }
     async listDue(limit) {