n8n 2.44.3 → 2.45.0

package/dist/modules/oauth-server/oauth-flow.service.js

@@ -13,64 +13,201 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OAuth2FlowService = void 0;
+exports.encodeRefreshGrant = encodeRefreshGrant;
+exports.decodeRefreshGrant = decodeRefreshGrant;
 const errors_js_1 = require("@modelcontextprotocol/sdk/server/auth/errors.js");
+const backend_common_1 = require("@n8n/backend-common");
+const backend_network_1 = require("@n8n/backend-network");
+const backend_services_1 = require("@n8n/backend-services");
+const auth_1 = require("@n8n/backend-services/auth");
 const constants_1 = require("@n8n/constants");
 const di_1 = require("@n8n/di");
+const inbound_auth_1 = require("@n8n/inbound-auth");
+const get_jwt_expiry_1 = require("@n8n/utils/get-jwt-expiry");
+const is_record_1 = require("@n8n/utils/is-record");
 const n8n_workflow_1 = require("n8n-workflow");
 const node_crypto_1 = require("node:crypto");
 const pkce_challenge_1 = __importDefault(require("pkce-challenge"));
-const backend_services_1 = require("@n8n/backend-services");
-const oauth_token_verifier_proxy_service_1 = require("../../services/oauth-token-verifier-proxy.service");
-const protected_resource_registry_1 = require("../../services/protected-resource.registry");
+const zod_1 = require("zod");
+const constants_2 = require("../../modules/inbound-auth-core/constants");
 const oauth_server_service_1 = require("./oauth-server.service");
 const FLOW_STATE_PREFIX = 'oauth-flow:';
 const FLOW_STATE_TTL = 5 * constants_1.Time.minutes.toMilliseconds;
+const TOKEN_REQUEST_TIMEOUT_MS = 10 * constants_1.Time.seconds.toMilliseconds;
+const REDIRECT_LOGIN = 'redirect-login';
+function acceptedSourceOf(resource) {
+    const accepted = resource.getAcceptedSourceIds?.() ?? [constants_2.SYSTEM_TRUSTED_SOURCE_ID];
+    if (accepted.length !== 1) {
+        throw new n8n_workflow_1.UnexpectedError(`A redirect login needs exactly one accepted trusted source, resource ${resource.id} has ${accepted.length}`);
+    }
+    return accepted[0];
+}
+function encodeRefreshGrant(sourceId, refreshToken) {
+    return Buffer.from(JSON.stringify({ sourceId, refreshToken })).toString('base64url');
+}
+function decodeRefreshGrant(grant) {
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(grant, 'base64url').toString());
+    }
+    catch {
+        return undefined;
+    }
+    if (!(0, is_record_1.isRecord)(parsed) ||
+        typeof parsed.sourceId !== 'string' ||
+        typeof parsed.refreshToken !== 'string') {
+        return undefined;
+    }
+    return { sourceId: parsed.sourceId, refreshToken: parsed.refreshToken };
+}
+const TokenResponseSchema = zod_1.z
+    .object({
+    access_token: zod_1.z.string().min(1),
+    expires_in: zod_1.z.number().int().positive().optional(),
+    refresh_token: zod_1.z.string().min(1).optional(),
+})
+    .passthrough();
+function tokenErrorCode(body) {
+    return (0, is_record_1.isRecord)(body) && typeof body.error === 'string' ? body.error : undefined;
+}
+function secondsUntilExpiry(token) {
+    const exp = (0, get_jwt_expiry_1.getJwtExpiry)(token);
+    return exp === undefined ? undefined : Math.max(0, exp - Math.floor(Date.now() / 1000));
+}
 let OAuth2FlowService = class OAuth2FlowService {
-    constructor(oauthServerService, resourceRegistry, urlService, cacheService, tokenVerifier) {
+    constructor(oauthServerService, resourceRegistry, cacheService, store, admission, outboundHttp, logger) {
         this.oauthServerService = oauthServerService;
         this.resourceRegistry = resourceRegistry;
-        this.urlService = urlService;
         this.cacheService = cacheService;
-        this.tokenVerifier = tokenVerifier;
+        this.store = store;
+        this.admission = admission;
+        this.http = outboundHttp.requests({
+            useDefaultSsrfPolicy: 'enforced',
+            timeout: TOKEN_REQUEST_TIMEOUT_MS,
+        });
+        this.logger = logger.scoped('inbound-auth');
     }
     async begin(resourceUrl, metadata) {
         const resource = await this.resourceRegistry.getByResourceUrl(resourceUrl);
         if (!resource?.isFirstParty) {
             throw new n8n_workflow_1.UserError(`Not a first-party protected resource: ${resourceUrl}`);
         }
+        const login = await this.redirectLoginOf(acceptedSourceOf(resource), resource.surface);
+        if (!login.ok)
+            throw new n8n_workflow_1.UserError(login.reason);
+        const { source, authorizationEndpoint, client } = login.value;
         const { code_verifier, code_challenge } = await (0, pkce_challenge_1.default)();
         const state = (0, node_crypto_1.randomBytes)(32).toString('hex');
-        await this.cacheService.set(FLOW_STATE_PREFIX + state, { codeVerifier: code_verifier, resourceUrl, metadata }, FLOW_STATE_TTL);
-        const url = new URL(`${this.urlService.getInstanceBaseUrl()}/oauth/authorize`);
+        await this.cacheService.set(FLOW_STATE_PREFIX + state, {
+            codeVerifier: code_verifier,
+            resourceUrl,
+            sourceId: source.id,
+            metadata,
+        }, FLOW_STATE_TTL);
+        const url = new URL(authorizationEndpoint);
         url.searchParams.set('response_type', 'code');
-        url.searchParams.set('client_id', resourceUrl);
+        url.searchParams.set('client_id', client.kind === 'virtual' ? resourceUrl : client.clientId);
         url.searchParams.set('redirect_uri', resourceUrl);
         url.searchParams.set('resource', resourceUrl);
         url.searchParams.set('code_challenge', code_challenge);
         url.searchParams.set('code_challenge_method', 'S256');
         url.searchParams.set('state', state);
+        if (client.kind === 'registered' && client.scopes?.length) {
+            url.searchParams.set('scope', client.scopes.join(' '));
+        }
         return url.toString();
     }
-    async complete(code, state) {
+    async complete(code, state, request) {
         const cacheKey = FLOW_STATE_PREFIX + state;
         const flow = await this.cacheService.get(cacheKey);
         if (!flow)
             return { valid: false, reason: 'invalid_state' };
         await this.cacheService.delete(cacheKey);
-        const { codeVerifier, resourceUrl, metadata } = flow;
+        const { codeVerifier, resourceUrl, sourceId, metadata } = flow;
+        const resource = await this.resourceRegistry.getByResourceUrl(resourceUrl);
+        if (!resource?.isFirstParty)
+            return { valid: false, reason: 'invalid_client' };
+        const accepted = acceptedSourceOf(resource);
+        if (accepted !== sourceId) {
+            this.logger.warn('Redirect login completed against another trusted source than it began', {
+                began: sourceId,
+                accepted,
+            });
+            return { valid: false, reason: 'invalid_state' };
+        }
+        const login = await this.redirectLoginOf(sourceId, resource.surface);
+        if (!login.ok) {
+            this.logger.warn('Redirect login cannot complete', { sourceId, reason: login.reason });
+            return { valid: false, reason: 'source_unusable' };
+        }
+        const issued = login.value.client.kind === 'virtual'
+            ? await this.exchangeWithVirtualClient(resourceUrl, code, codeVerifier)
+            : await this.exchangeWithRegisteredClient(login.value, resourceUrl, code, codeVerifier);
+        if (!issued.ok)
+            return { valid: false, reason: issued.reason };
+        const tokens = issued.value;
+        const admitted = await this.admission.admitBearer(resource, {
+            method: request?.method ?? 'GET',
+            url: request?.url ?? resourceUrl,
+            ip: request?.ip ?? '',
+        }, tokens.accessToken);
+        if (!admitted.ok)
+            return { valid: false, reason: admitted.reason };
+        const { context } = admitted;
+        const expiresIn = tokens.expiresIn ?? secondsUntilExpiry(tokens.accessToken);
+        if (expiresIn === undefined)
+            return { valid: false, reason: 'invalid_grant' };
+        const { subject } = context;
+        return {
+            valid: true,
+            token: tokens.accessToken,
+            refreshToken: tokens.refreshToken === undefined
+                ? undefined
+                : encodeRefreshGrant(sourceId, tokens.refreshToken),
+            expiresIn,
+            user: {
+                id: subject.id,
+                email: subject.email ?? '',
+                firstName: subject.firstName ?? '',
+                lastName: subject.lastName ?? '',
+            },
+            metadata,
+        };
+    }
+    async refresh(grant, resourceUrl) {
+        const resource = await this.resourceRegistry.getByResourceUrl(resourceUrl);
+        if (!resource?.isFirstParty) {
+            throw new n8n_workflow_1.UserError(`Not a first-party protected resource: ${resourceUrl}`);
+        }
+        const issued = decodeRefreshGrant(grant);
+        if (!issued)
+            return { valid: false, reason: 'invalid_grant' };
+        const accepted = acceptedSourceOf(resource);
+        if (issued.sourceId !== accepted) {
+            this.logger.warn('Refresh grant presented against another trusted source than issued it', {
+                issued: issued.sourceId,
+                accepted,
+            });
+            return { valid: false, reason: 'invalid_grant' };
+        }
+        const login = await this.redirectLoginOf(accepted, resource.surface);
+        if (!login.ok) {
+            this.logger.warn('Redirect login cannot refresh', { reason: login.reason });
+            return { valid: false, reason: 'source_unusable' };
+        }
+        const refreshed = login.value.client.kind === 'virtual'
+            ? await this.refreshWithVirtualClient(issued.refreshToken, resourceUrl)
+            : await this.refreshWithRegisteredClient(login.value, issued.refreshToken, resourceUrl);
+        if (!refreshed.valid)
+            return refreshed;
+        return { ...refreshed, refreshToken: encodeRefreshGrant(accepted, refreshed.refreshToken) };
+    }
+    async refreshWithVirtualClient(refreshToken, resourceUrl) {
         const client = await this.oauthServerService.clientsStore.getClient(resourceUrl);
         if (!client)
             return { valid: false, reason: 'invalid_client' };
         try {
-            const challenge = await this.oauthServerService.challengeForAuthorizationCode(client, code);
-            if ((0, node_crypto_1.createHash)('sha256').update(codeVerifier).digest('base64url') !== challenge) {
-                return { valid: false, reason: 'invalid_grant' };
-            }
-            const tokens = await this.oauthServerService.exchangeAuthorizationCode(client, code, codeVerifier, resourceUrl, new URL(resourceUrl));
-            const result = await this.tokenVerifier.verifyOAuthAccessToken(tokens.access_token, resourceUrl);
-            if (!result.user) {
-                return { valid: false, reason: result.context?.reason ?? 'invalid_token' };
-            }
+            const tokens = await this.oauthServerService.exchangeRefreshToken(client, refreshToken, undefined, new URL(resourceUrl));
             if (!tokens.refresh_token || tokens.expires_in === undefined) {
                 return { valid: false, reason: 'invalid_grant' };
             }
@@ -79,53 +216,152 @@ let OAuth2FlowService = class OAuth2FlowService {
                 token: tokens.access_token,
                 refreshToken: tokens.refresh_token,
                 expiresIn: tokens.expires_in,
-                user: {
-                    id: result.user.id,
-                    email: result.user.email,
-                    firstName: result.user.firstName,
-                    lastName: result.user.lastName,
-                },
-                metadata,
             };
         }
         catch (error) {
-            if (error instanceof errors_js_1.InvalidGrantError) {
+            if (error instanceof errors_js_1.InvalidGrantError || error instanceof errors_js_1.InvalidTargetError) {
                 return { valid: false, reason: 'invalid_grant' };
             }
             throw error;
         }
     }
-    async refreshVirtualClientToken(refreshToken, resourceUrl) {
-        const resource = await this.resourceRegistry.getByResourceUrl(resourceUrl);
-        if (!resource?.isFirstParty) {
-            throw new n8n_workflow_1.UserError(`Not a first-party protected resource: ${resourceUrl}`);
+    async refreshWithRegisteredClient(login, refreshToken, resourceUrl) {
+        const body = new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+            resource: resourceUrl,
+        });
+        const issued = await this.requestTokens(login, body, 'refresh token');
+        if (!issued.ok)
+            return { valid: false, reason: issued.reason };
+        const { accessToken } = issued.value;
+        const expiresIn = issued.value.expiresIn ?? secondsUntilExpiry(accessToken);
+        if (expiresIn === undefined)
+            return { valid: false, reason: 'invalid_grant' };
+        return {
+            valid: true,
+            token: accessToken,
+            refreshToken: issued.value.refreshToken ?? refreshToken,
+            expiresIn,
+        };
+    }
+    async redirectLoginOf(sourceId, surface) {
+        const source = await this.store.getById(sourceId);
+        if (!source)
+            return { ok: false, reason: `Unknown trusted source: ${sourceId}` };
+        if (source.config.surfaces[surface] === undefined) {
+            return {
+                ok: false,
+                reason: `Trusted source "${source.name}" is not accepted on the ${surface} surface`,
+            };
+        }
+        if (!(0, inbound_auth_1.deriveCapabilities)(source.config, source.metadata).has(REDIRECT_LOGIN)) {
+            return {
+                ok: false,
+                reason: `Trusted source "${source.name}" has no ${REDIRECT_LOGIN} capability: it needs an authorization endpoint, a token endpoint and a client`,
+            };
+        }
+        const { authentication } = source.config;
+        const { authorizationEndpoint, tokenEndpoint } = (0, inbound_auth_1.resolveOAuth2Endpoints)(source.config, source.metadata?.documents ?? []);
+        if (authentication.type !== 'oauth2' ||
+            !authentication.client ||
+            !authorizationEndpoint ||
+            !tokenEndpoint) {
+            throw new n8n_workflow_1.UnexpectedError(`Trusted source ${source.id} has ${REDIRECT_LOGIN} without its endpoints`);
         }
+        return {
+            ok: true,
+            value: { source, authorizationEndpoint, tokenEndpoint, client: authentication.client },
+        };
+    }
+    async exchangeWithVirtualClient(resourceUrl, code, codeVerifier) {
         const client = await this.oauthServerService.clientsStore.getClient(resourceUrl);
         if (!client)
-            return { valid: false, reason: 'invalid_client' };
+            return { ok: false, reason: 'invalid_client' };
         try {
-            const tokens = await this.oauthServerService.exchangeRefreshToken(client, refreshToken, undefined, new URL(resourceUrl));
-            if (!tokens.refresh_token || tokens.expires_in === undefined) {
-                return { valid: false, reason: 'invalid_grant' };
+            const challenge = await this.oauthServerService.challengeForAuthorizationCode(client, code);
+            if ((0, node_crypto_1.createHash)('sha256').update(codeVerifier).digest('base64url') !== challenge) {
+                return { ok: false, reason: 'invalid_grant' };
             }
+            const tokens = await this.oauthServerService.exchangeAuthorizationCode(client, code, codeVerifier, resourceUrl, new URL(resourceUrl));
             return {
-                valid: true,
-                token: tokens.access_token,
-                refreshToken: tokens.refresh_token,
-                expiresIn: tokens.expires_in,
+                ok: true,
+                value: {
+                    accessToken: tokens.access_token,
+                    refreshToken: tokens.refresh_token,
+                    expiresIn: tokens.expires_in,
+                },
             };
         }
         catch (error) {
-            if (error instanceof errors_js_1.InvalidGrantError || error instanceof errors_js_1.InvalidTargetError) {
-                return { valid: false, reason: 'invalid_grant' };
+            if (error instanceof errors_js_1.InvalidGrantError) {
+                return { ok: false, reason: 'invalid_grant' };
             }
             throw error;
         }
     }
+    async exchangeWithRegisteredClient(login, resourceUrl, code, codeVerifier) {
+        const body = new URLSearchParams({
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: resourceUrl,
+            code_verifier: codeVerifier,
+            resource: resourceUrl,
+        });
+        return await this.requestTokens(login, body, 'authorization code');
+    }
+    async requestTokens({ source, tokenEndpoint, client }, body, grant) {
+        if (client.kind !== 'registered') {
+            throw new n8n_workflow_1.UnexpectedError('A virtual client cannot request tokens over HTTP');
+        }
+        const headers = {
+            'content-type': 'application/x-www-form-urlencoded',
+            accept: 'application/json',
+        };
+        if (client.clientSecret) {
+            const credentials = `${encodeURIComponent(client.clientId)}:${encodeURIComponent(client.clientSecret)}`;
+            headers.authorization = `Basic ${Buffer.from(credentials).toString('base64')}`;
+        }
+        else {
+            body.set('client_id', client.clientId);
+        }
+        const response = await this.http.request({
+            url: tokenEndpoint,
+            method: 'POST',
+            headers,
+            body: body.toString(),
+            json: true,
+            returnFullResponse: true,
+            ignoreHttpStatusErrors: true,
+        });
+        if (response.statusCode < 200 || response.statusCode >= 300) {
+            this.logger.warn(`Token endpoint refused the ${grant}`, {
+                sourceId: source.id,
+                status: response.statusCode,
+                error: tokenErrorCode(response.body),
+            });
+            return { ok: false, reason: 'invalid_grant' };
+        }
+        const parsed = TokenResponseSchema.safeParse(response.body);
+        if (!parsed.success) {
+            this.logger.warn('Token endpoint answered without an access token', {
+                sourceId: source.id,
+            });
+            return { ok: false, reason: 'invalid_grant' };
+        }
+        return {
+            ok: true,
+            value: {
+                accessToken: parsed.data.access_token,
+                refreshToken: parsed.data.refresh_token,
+                expiresIn: parsed.data.expires_in,
+            },
+        };
+    }
 };
 exports.OAuth2FlowService = OAuth2FlowService;
 exports.OAuth2FlowService = OAuth2FlowService = __decorate([
     (0, di_1.Service)(),
-    __metadata("design:paramtypes", [oauth_server_service_1.OAuthServerService, protected_resource_registry_1.ProtectedResourceRegistry, backend_services_1.UrlService, backend_services_1.CacheService, oauth_token_verifier_proxy_service_1.OAuthTokenVerifierProxy])
+    __metadata("design:paramtypes", [oauth_server_service_1.OAuthServerService, auth_1.ProtectedResourceRegistry, backend_services_1.CacheService, inbound_auth_1.TrustedSourceStore, inbound_auth_1.ResourceAdmission, backend_network_1.OutboundHttp, backend_common_1.Logger])
 ], OAuth2FlowService);
 //# sourceMappingURL=oauth-flow.service.js.map

package/dist/modules/oauth-server/oauth-flow.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-flow.service.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth-flow.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,+EAGyD;AACzD,8CAAsC;AACtC,gCAAkC;AAClC,+CAAgG;AAChG,6CAAsD;AACtD,oEAA2C;AAE3C,4DAAiE;AACjE,sGAAwF;AAExF,wFAAmF;AAEnF,iEAA4D;AAE5D,MAAM,iBAAiB,GAAG,aAAa,CAAC;AACxC,MAAM,cAAc,GAAG,CAAC,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,CAAC;AAKhD,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC7B,YACkB,kBAAsC,EACtC,gBAA2C,EAC3C,UAAsB,EACtB,YAA0B,EAC1B,aAAsC;kCAJtC,kBAAkB;gCAClB,gBAAgB;0BAChB,UAAU;4BACV,YAAY;6BACZ,aAAa;IAC5B,CAAC;IAWJ,KAAK,CAAC,KAAK,CAAC,WAAmB,EAAE,QAAiC;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC3E,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;YAC7B,MAAM,IAAI,wBAAS,CAAC,yCAAyC,WAAW,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,MAAM,IAAA,wBAAa,GAAE,CAAC;QAChE,MAAM,KAAK,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAC1B,iBAAiB,GAAG,KAAK,EACzB,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAsB,EAC1E,cAAc,CACd,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;QAC/E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACvB,CAAC;IAQD,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,KAAa;QACzC,MAAM,QAAQ,GAAG,iBAAiB,GAAG,KAAK,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAY,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAC5D,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEzC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAErD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAE/D,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5F,IAAI,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YAClD,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,yBAAyB,CACrE,MAAM,EACN,IAAI,EACJ,YAAY,EACZ,WAAW,EACX,IAAI,GAAG,CAAC,WAAW,CAAC,CACpB,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,sBAAsB,CAC7D,MAAM,CAAC,YAAY,EACnB,WAAW,CACX,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAClB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,eAAe,EAAE,CAAC;YAC5E,CAAC;YAID,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC9D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YAClD,CAAC;YACD,OAAO;gBACN,KAAK,EAAE,IAAI;gBACX,KAAK,EAAE,MAAM,CAAC,YAAY;gBAC1B,YAAY,EAAE,MAAM,CAAC,aAAa;gBAClC,SAAS,EAAE,MAAM,CAAC,UAAU;gBAC5B,IAAI,EAAE;oBACL,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;oBAClB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;oBACxB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;oBAChC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;iBAC9B;gBACD,QAAQ;aACR,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAKhB,IAAI,KAAK,YAAY,6BAAiB,EAAE,CAAC;gBACxC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YAClD,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAWD,KAAK,CAAC,yBAAyB,CAC9B,YAAoB,EACpB,WAAmB;QAEnB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC3E,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;YAC7B,MAAM,IAAI,wBAAS,CAAC,yCAAyC,WAAW,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAE/D,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAChE,MAAM,EACN,YAAY,EACZ,SAAS,EACT,IAAI,GAAG,CAAC,WAAW,CAAC,CACpB,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC9D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YAClD,CAAC;YACD,OAAO;gBACN,KAAK,EAAE,IAAI;gBACX,KAAK,EAAE,MAAM,CAAC,YAAY;gBAC1B,YAAY,EAAE,MAAM,CAAC,aAAa;gBAClC,SAAS,EAAE,MAAM,CAAC,UAAU;aAC5B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAKhB,IAAI,KAAK,YAAY,6BAAiB,IAAI,KAAK,YAAY,8BAAkB,EAAE,CAAC;gBAC/E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YAClD,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;CACD,CAAA;;4BAhKY,iBAAiB;IAD7B,IAAA,YAAO,GAAE;qCAG6B,yCAAkB,EACpB,uDAAyB,EAC/B,6BAAU,EACR,+BAAY,EACX,4DAAuB;GAN5C,iBAAiB,CAgK7B"}
+{"version":3,"file":"oauth-flow.service.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth-flow.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,+EAGyD;AACzD,wDAA6C;AAC7C,0DAA4E;AAC5E,4DAAqD;AACrD,qDAKoC;AACpC,8CAAsC;AACtC,gCAAkC;AAClC,oDAS2B;AAC3B,8DAAyD;AACzD,oDAAgD;AAChD,+CAKsB;AACtB,6CAAsD;AACtD,oEAA2C;AAC3C,6BAAwB;AAExB,qEAAiF;AAEjF,iEAA4D;AAE5D,MAAM,iBAAiB,GAAG,aAAa,CAAC;AACxC,MAAM,cAAc,GAAG,CAAC,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,CAAC;AACvD,MAAM,wBAAwB,GAAG,EAAE,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,CAAC;AAClE,MAAM,cAAc,GAAe,gBAAgB,CAAC;AAiBpD,SAAS,gBAAgB,CAAC,QAA2B;IACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,oCAAwB,CAAC,CAAC;IACjF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,8BAAe,CACxB,wEAAwE,QAAQ,CAAC,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAC5G,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAiBD,4BAAmC,QAAgB,EAAE,YAAoB;IACxE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtF,CAAC;AAED,4BACC,KAAa;IAEb,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IACC,CAAC,IAAA,oBAAQ,EAAC,MAAM,CAAC;QACjB,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnC,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,EACtC,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;AACzE,CAAC;AASD,MAAM,mBAAmB,GAAG,OAAC;KAC3B,MAAM,CAAC;IACP,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,WAAW,EAAE,CAAC;AAGhB,SAAS,cAAc,CAAC,IAAa;IACpC,OAAO,IAAA,oBAAQ,EAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAClF,CAAC;AAMD,SAAS,kBAAkB,CAAC,KAAa;IACxC,MAAM,GAAG,GAAG,IAAA,6BAAY,EAAC,KAAK,CAAC,CAAC;IAChC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AACzF,CAAC;AAGM,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAK7B,YACkB,kBAAsC,EACtC,gBAA2C,EAC3C,YAA0B,EAC1B,KAAyB,EACzB,SAA4B,EAC7C,YAA0B,EAC1B,MAAc;kCANG,kBAAkB;gCAClB,gBAAgB;4BAChB,YAAY;qBACZ,KAAK;yBACL,SAAS;QAM1B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC;YACjC,oBAAoB,EAAE,UAAU;YAChC,OAAO,EAAE,wBAAwB;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC;IAgBD,KAAK,CAAC,KAAK,CAAC,WAAmB,EAAE,QAAiC;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC3E,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;YAC7B,MAAM,IAAI,wBAAS,CAAC,yCAAyC,WAAW,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvF,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,MAAM,IAAI,wBAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC;QAE9D,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,MAAM,IAAA,wBAAa,GAAE,CAAC;QAChE,MAAM,KAAK,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAC1B,iBAAiB,GAAG,KAAK,EACzB;YACC,YAAY,EAAE,aAAa;YAC3B,WAAW;YACX,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;SACY,EACrB,cAAc,CACd,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7F,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACvB,CAAC;IAYD,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,KAAa,EACb,OAA2B;QAE3B,MAAM,QAAQ,GAAG,iBAAiB,GAAG,KAAK,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAY,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAC5D,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEzC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAE/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC3E,IAAI,CAAC,QAAQ,EAAE,YAAY;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAE/E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uEAAuE,EAAE;gBACzF,KAAK,EAAE,QAAQ;gBACf,QAAQ;aACR,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACvF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,MAAM,GACX,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;YACpC,CAAC,CAAC,MAAM,IAAI,CAAC,yBAAyB,CAAC,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC;YACvE,CAAC,CAAC,MAAM,IAAI,CAAC,4BAA4B,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;QAC1F,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAE5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAChD,QAAQ,EACR;YACC,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,KAAK;YAChC,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,WAAW;YAChC,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE;SACrB,EACD,MAAM,CAAC,WAAW,CAClB,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnE,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;QAK7B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7E,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAE9E,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAC5B,OAAO;YACN,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,MAAM,CAAC,WAAW;YACzB,YAAY,EACX,MAAM,CAAC,YAAY,KAAK,SAAS;gBAChC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC;YACrD,SAAS;YACT,IAAI,EAAE;gBACL,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;gBAC1B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE;gBAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;aAChC;YACD,QAAQ;SACR,CAAC;IACH,CAAC;IASD,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,WAAmB;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC3E,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;YAC7B,MAAM,IAAI,wBAAS,CAAC,yCAAyC,WAAW,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAE9D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uEAAuE,EAAE;gBACzF,MAAM,EAAE,MAAM,CAAC,QAAQ;gBACvB,QAAQ;aACR,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,SAAS,GACd,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;YACpC,CAAC,CAAC,MAAM,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC;YACvE,CAAC,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAC1F,IAAI,CAAC,SAAS,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QACvC,OAAO,EAAE,GAAG,SAAS,EAAE,YAAY,EAAE,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC;IAC7F,CAAC;IAGO,KAAK,CAAC,wBAAwB,CACrC,YAAoB,EACpB,WAAmB;QAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAE/D,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAChE,MAAM,EACN,YAAY,EACZ,SAAS,EACT,IAAI,GAAG,CAAC,WAAW,CAAC,CACpB,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC9D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YAClD,CAAC;YACD,OAAO;gBACN,KAAK,EAAE,IAAI;gBACX,KAAK,EAAE,MAAM,CAAC,YAAY;gBAC1B,YAAY,EAAE,MAAM,CAAC,aAAa;gBAClC,SAAS,EAAE,MAAM,CAAC,UAAU;aAC5B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAKhB,IAAI,KAAK,YAAY,6BAAiB,IAAI,KAAK,YAAY,8BAAkB,EAAE,CAAC;gBAC/E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YAClD,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAMO,KAAK,CAAC,2BAA2B,CACxC,KAAoB,EACpB,YAAoB,EACpB,WAAmB;QAEnB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAChC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,QAAQ,EAAE,WAAW;SACrB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAE/D,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;QACrC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC5E,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAE9E,OAAO;YACN,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,WAAW;YAClB,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,YAAY;YACvD,SAAS;SACT,CAAC;IACH,CAAC;IAMO,KAAK,CAAC,eAAe,CAC5B,QAAgB,EAChB,OAAkB;QAElB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,QAAQ,EAAE,EAAE,CAAC;QAEjF,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YACnD,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,mBAAmB,MAAM,CAAC,IAAI,4BAA4B,OAAO,UAAU;aACnF,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAA,iCAAkB,EAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7E,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,mBAAmB,MAAM,CAAC,IAAI,YAAY,cAAc,gFAAgF;aAChJ,CAAC;QACH,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QACzC,MAAM,EAAE,qBAAqB,EAAE,aAAa,EAAE,GAAG,IAAA,qCAAsB,EACtE,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAChC,CAAC;QAEF,IACC,cAAc,CAAC,IAAI,KAAK,QAAQ;YAChC,CAAC,cAAc,CAAC,MAAM;YACtB,CAAC,qBAAqB;YACtB,CAAC,aAAa,EACb,CAAC;YACF,MAAM,IAAI,8BAAe,CACxB,kBAAkB,MAAM,CAAC,EAAE,QAAQ,cAAc,wBAAwB,CACzE,CAAC;QACH,CAAC;QAED,OAAO;YACN,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE;SACtF,CAAC;IACH,CAAC;IAOO,KAAK,CAAC,yBAAyB,CACtC,WAAmB,EACnB,IAAY,EACZ,YAAoB;QAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAE5D,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5F,IAAI,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YAC/C,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,yBAAyB,CACrE,MAAM,EACN,IAAI,EACJ,YAAY,EACZ,WAAW,EACX,IAAI,GAAG,CAAC,WAAW,CAAC,CACpB,CAAC;YACF,OAAO;gBACN,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE;oBACN,WAAW,EAAE,MAAM,CAAC,YAAY;oBAChC,YAAY,EAAE,MAAM,CAAC,aAAa;oBAClC,SAAS,EAAE,MAAM,CAAC,UAAU;iBAC5B;aACD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAKhB,IAAI,KAAK,YAAY,6BAAiB,EAAE,CAAC;gBACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YAC/C,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAMO,KAAK,CAAC,4BAA4B,CACzC,KAAoB,EACpB,WAAmB,EACnB,IAAY,EACZ,YAAoB;QAEpB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAChC,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,YAAY;YAC3B,QAAQ,EAAE,WAAW;SACrB,CAAC,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;IACpE,CAAC;IAOO,KAAK,CAAC,aAAa,CAC1B,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAiB,EAChD,IAAqB,EACrB,KAAa;QAEb,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAClC,MAAM,IAAI,8BAAe,CAAC,kDAAkD,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,OAAO,GAA2B;YACvC,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC1B,CAAC;QACF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACxG,OAAO,CAAC,aAAa,GAAG,SAAS,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,CAAC;aAAM,CAAC;YACP,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAU;YACjD,GAAG,EAAE,aAAa;YAClB,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,IAAI,EAAE,IAAI;YACV,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,IAAI;SAC5B,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,KAAK,EAAE,EAAE;gBACvD,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,MAAM,EAAE,QAAQ,CAAC,UAAU;gBAC3B,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAC/C,CAAC;QAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE;gBACnE,QAAQ,EAAE,MAAM,CAAC,EAAE;aACnB,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAC/C,CAAC;QAED,OAAO;YACN,EAAE,EAAE,IAAI;YACR,KAAK,EAAE;gBACN,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;gBACrC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa;gBACvC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;aACjC;SACD,CAAC;IACH,CAAC;CACD,CAAA;;4BArbY,iBAAiB;IAD7B,IAAA,YAAO,GAAE;qCAO6B,yCAAkB,EACpB,gCAAyB,EAC7B,+BAAY,EACnB,iCAAkB,EACd,gCAAiB,EAC/B,8BAAY,EAClB,uBAAM;GAZH,iBAAiB,CAqb7B"}

package/dist/modules/oauth-server/oauth-local-authorization-server.d.ts

@@ -1,14 +1,17 @@
 import { UrlService } from '@n8n/backend-services';
+import { ProtectedResourceRegistry } from '@n8n/backend-services/auth';
 import { LocalAuthorizationServer, type AuthorizationServerMetadata, type Jwk } from '@n8n/inbound-auth';
-import { ProtectedResourceRegistry } from '../../services/protected-resource.registry';
+import { AccessTokenRepository } from './database/repositories/oauth-access-token.repository';
 import { OAuthSigningJwksProvider } from './oauth-signing-jwks.provider';
 export declare class OAuthServerLocalAuthorizationServer extends LocalAuthorizationServer {
     private readonly urlService;
     private readonly resourceRegistry;
     private readonly jwksProvider;
-    constructor(urlService: UrlService, resourceRegistry: ProtectedResourceRegistry, jwksProvider: OAuthSigningJwksProvider);
+    private readonly accessTokens;
+    constructor(urlService: UrlService, resourceRegistry: ProtectedResourceRegistry, jwksProvider: OAuthSigningJwksProvider, accessTokens: AccessTokenRepository);
     getMetadata(): Promise<AuthorizationServerMetadata>;
     getJwks(): Promise<{
         keys: Jwk[];
     }>;
+    isAccessTokenActive(token: string): Promise<boolean>;
 }

package/dist/modules/oauth-server/oauth-local-authorization-server.js

@@ -11,16 +11,18 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OAuthServerLocalAuthorizationServer = void 0;
 const backend_services_1 = require("@n8n/backend-services");
+const auth_1 = require("@n8n/backend-services/auth");
 const di_1 = require("@n8n/di");
 const inbound_auth_1 = require("@n8n/inbound-auth");
-const protected_resource_registry_1 = require("../../services/protected-resource.registry");
+const oauth_access_token_repository_1 = require("./database/repositories/oauth-access-token.repository");
 const oauth_signing_jwks_provider_1 = require("./oauth-signing-jwks.provider");
 let OAuthServerLocalAuthorizationServer = class OAuthServerLocalAuthorizationServer extends inbound_auth_1.LocalAuthorizationServer {
-    constructor(urlService, resourceRegistry, jwksProvider) {
+    constructor(urlService, resourceRegistry, jwksProvider, accessTokens) {
         super();
         this.urlService = urlService;
         this.resourceRegistry = resourceRegistry;
         this.jwksProvider = jwksProvider;
+        this.accessTokens = accessTokens;
     }
     async getMetadata() {
         const baseUrl = this.urlService.getInstanceBaseUrl();
@@ -46,10 +48,13 @@ let OAuthServerLocalAuthorizationServer = class OAuthServerLocalAuthorizationSer
     async getJwks() {
         return { keys: inbound_auth_1.JwkSchema.array().parse(await this.jwksProvider.getPublicJwks()) };
     }
+    async isAccessTokenActive(token) {
+        return await this.accessTokens.isActive(token);
+    }
 };
 exports.OAuthServerLocalAuthorizationServer = OAuthServerLocalAuthorizationServer;
 exports.OAuthServerLocalAuthorizationServer = OAuthServerLocalAuthorizationServer = __decorate([
     (0, di_1.Service)(),
-    __metadata("design:paramtypes", [backend_services_1.UrlService, protected_resource_registry_1.ProtectedResourceRegistry, oauth_signing_jwks_provider_1.OAuthSigningJwksProvider])
+    __metadata("design:paramtypes", [backend_services_1.UrlService, auth_1.ProtectedResourceRegistry, oauth_signing_jwks_provider_1.OAuthSigningJwksProvider, oauth_access_token_repository_1.AccessTokenRepository])
 ], OAuthServerLocalAuthorizationServer);
 //# sourceMappingURL=oauth-local-authorization-server.js.map

package/dist/modules/oauth-server/oauth-local-authorization-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-local-authorization-server.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth-local-authorization-server.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,4DAAmD;AACnD,gCAAkC;AAClC,oDAK2B;AAE3B,wFAAmF;AAEnF,+EAAyE;AAOlE,IAAM,mCAAmC,GAAzC,MAAM,mCAAoC,SAAQ,uCAAwB;IAChF,YACkB,UAAsB,EACtB,gBAA2C,EAC3C,YAAsC;QAEvD,KAAK,EAAE,CAAC;0BAJS,UAAU;gCACV,gBAAgB;4BAChB,YAAY;IAG9B,CAAC;IAWD,KAAK,CAAC,WAAW;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAgC;YAC7C,MAAM,EAAE,OAAO;YACf,sBAAsB,EAAE,GAAG,OAAO,sBAAsB;YACxD,cAAc,EAAE,GAAG,OAAO,kBAAkB;YAC5C,qBAAqB,EAAE,GAAG,OAAO,qBAAqB;YACtD,mBAAmB,EAAE,GAAG,OAAO,mBAAmB;YAElD,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE;YAC9C,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC9D,qCAAqC,EAAE,CAAC,MAAM,EAAE,oBAAoB,EAAE,qBAAqB,CAAC;YAC5F,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAE1C,8CAA8C,EAAE,IAAI;SACpD,CAAC;QAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,gBAAgB,GAAG,SAAS,CAAC;QACvC,CAAC;QAED,OAAO,QAAQ,CAAC;IACjB,CAAC;IAGD,KAAK,CAAC,OAAO;QACZ,OAAO,EAAE,IAAI,EAAE,wBAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC;IACnF,CAAC;CACD,CAAA;;8CAhDY,mCAAmC;IAD/C,IAAA,YAAO,GAAE;qCAGqB,6BAAU,EACJ,uDAAyB,EAC7B,sDAAwB;GAJ5C,mCAAmC,CAgD/C"}
+{"version":3,"file":"oauth-local-authorization-server.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth-local-authorization-server.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,4DAAmD;AACnD,qDAAuE;AACvE,gCAAkC;AAClC,oDAK2B;AAE3B,yGAA8F;AAC9F,+EAAyE;AAOlE,IAAM,mCAAmC,GAAzC,MAAM,mCAAoC,SAAQ,uCAAwB;IAChF,YACkB,UAAsB,EACtB,gBAA2C,EAC3C,YAAsC,EACtC,YAAmC;QAEpD,KAAK,EAAE,CAAC;0BALS,UAAU;gCACV,gBAAgB;4BAChB,YAAY;4BACZ,YAAY;IAG9B,CAAC;IAWD,KAAK,CAAC,WAAW;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAgC;YAC7C,MAAM,EAAE,OAAO;YACf,sBAAsB,EAAE,GAAG,OAAO,sBAAsB;YACxD,cAAc,EAAE,GAAG,OAAO,kBAAkB;YAC5C,qBAAqB,EAAE,GAAG,OAAO,qBAAqB;YACtD,mBAAmB,EAAE,GAAG,OAAO,mBAAmB;YAElD,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE;YAC9C,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC9D,qCAAqC,EAAE,CAAC,MAAM,EAAE,oBAAoB,EAAE,qBAAqB,CAAC;YAC5F,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAE1C,8CAA8C,EAAE,IAAI;SACpD,CAAC;QAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,gBAAgB,GAAG,SAAS,CAAC;QACvC,CAAC;QAED,OAAO,QAAQ,CAAC;IACjB,CAAC;IAGD,KAAK,CAAC,OAAO;QACZ,OAAO,EAAE,IAAI,EAAE,wBAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC;IACnF,CAAC;IAGD,KAAK,CAAC,mBAAmB,CAAC,KAAa;QACtC,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;CACD,CAAA;;8CAtDY,mCAAmC;IAD/C,IAAA,YAAO,GAAE;qCAGqB,6BAAU,EACJ,gCAAyB,EAC7B,sDAAwB,EACxB,qDAAqB;GALzC,mCAAmC,CAsD/C"}

package/dist/modules/oauth-server/oauth-server.module.js

@@ -23,21 +23,21 @@ let OAuthServerModule = class OAuthServerModule {
             await di_1.Container.get(OAuthSigningKeyService).initialize();
         }
         if (instanceType === 'main') {
-            const { JwksRegistry } = await import('../../jwks/jwks.registry.js');
+            const { JwksRegistry } = await import('@n8n/backend-services/auth');
             const { OAuthSigningJwksProvider } = await import('./oauth-signing-jwks.provider.js');
             di_1.Container.get(JwksRegistry).register(di_1.Container.get(OAuthSigningJwksProvider));
         }
-        const { LocalAuthorizationServer } = await import('@n8n/inbound-auth');
-        const { OAuthServerLocalAuthorizationServer } = await import('./oauth-local-authorization-server.js');
-        di_1.Container.set(LocalAuthorizationServer, di_1.Container.get(OAuthServerLocalAuthorizationServer));
-        const { OAuthTokenVerifierProxy } = await import('../../services/oauth-token-verifier-proxy.service.js');
+        const { OAuthTokenVerifierProxy } = await import('@n8n/backend-services/auth');
         const { OAuthTokenService } = await import('./oauth-token.service.js');
         di_1.Container.get(OAuthTokenVerifierProxy).registerProvider(di_1.Container.get(OAuthTokenService));
         const { registerProtectedResourceResolvers } = await import('./protected-resource-resolvers/index.js');
         registerProtectedResourceResolvers();
-        const { OAuth2FlowProxy } = await import('../../services/oauth2-flow-proxy.service.js');
+        const { OAuth2FlowProxy } = await import('@n8n/backend-services/auth');
         const { OAuth2FlowService } = await import('./oauth-flow.service.js');
         di_1.Container.get(OAuth2FlowProxy).registerProvider(di_1.Container.get(OAuth2FlowService));
+        const { LocalAuthorizationServerProxy } = await import('../../modules/inbound-auth-core/local-authorization-server.proxy.js');
+        const { OAuthServerLocalAuthorizationServer } = await import('./oauth-local-authorization-server.js');
+        await di_1.Container.get(LocalAuthorizationServerProxy).registerProvider(di_1.Container.get(OAuthServerLocalAuthorizationServer));
     }
     async entities() {
         const { OAuthClient } = await import('./database/entities/oauth-client.entity.js');

package/dist/modules/oauth-server/oauth-server.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-server.module.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth-server.module.ts"],"names":[],"mappings":";;;;;;;;;AACA,gDAAgD;AAChD,gCAAoC;AACpC,uCAA4C;AAerC,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC7B,KAAK,CAAC,IAAI;QACT,MAAM,EAAE,YAAY,EAAE,GAAG,cAAS,CAAC,GAAG,CAAC,2BAAgB,CAAC,CAAC;QAGzD,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YACtC,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;YAC9C,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;QAC/C,CAAC;QAKD,IAAI,YAAY,KAAK,MAAM,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC3D,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;YAClF,MAAM,cAAS,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,UAAU,EAAE,CAAC;QAC1D,CAAC;QAGD,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YACjE,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;YACtF,cAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,cAAS,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAC/E,CAAC;QAGD,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACvE,MAAM,EAAE,mCAAmC,EAAE,GAAG,MAAM,MAAM,CAC3D,uCAAuC,CACvC,CAAC;QACF,cAAS,CAAC,GAAG,CAAC,wBAAwB,EAAE,cAAS,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC,CAAC;QAK5F,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAC/C,kDAAkD,CAClD,CAAC;QACF,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACvE,cAAS,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,gBAAgB,CAAC,cAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAE1F,MAAM,EAAE,kCAAkC,EAAE,GAAG,MAAM,MAAM,CAC1D,yCAAyC,CACzC,CAAC;QACF,kCAAkC,EAAE,CAAC;QAErC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;QACpF,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QACtE,cAAS,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,gBAAgB,CAAC,cAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,QAAQ;QACb,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,4CAA4C,CAAC,CAAC;QACnF,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CACzC,wDAAwD,CACxD,CAAC;QACF,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,kDAAkD,CAAC,CAAC;QACzF,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,mDAAmD,CAAC,CAAC;QAC3F,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,kDAAkD,CAAC,CAAC;QAEzF,OAAO,CAAC,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;IAC1F,CAAC;CACD,CAAA;;4BA/DY,iBAAiB;IAD7B,IAAA,0BAAa,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;GACzE,iBAAiB,CA+D7B"}
+{"version":3,"file":"oauth-server.module.js","sourceRoot":"","sources":["../../../src/modules/oauth-server/oauth-server.module.ts"],"names":[],"mappings":";;;;;;;;;AACA,gDAAgD;AAChD,gCAAoC;AACpC,uCAA4C;AAerC,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC7B,KAAK,CAAC,IAAI;QACT,MAAM,EAAE,YAAY,EAAE,GAAG,cAAS,CAAC,GAAG,CAAC,2BAAgB,CAAC,CAAC;QAGzD,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YACtC,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;YAC9C,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;QAC/C,CAAC;QAKD,IAAI,YAAY,KAAK,MAAM,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC3D,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;YAClF,MAAM,cAAS,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,UAAU,EAAE,CAAC;QAC1D,CAAC;QAGD,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;YACpE,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;YACtF,cAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,cAAS,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAC/E,CAAC;QAKD,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAC/E,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACvE,cAAS,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,gBAAgB,CAAC,cAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAE1F,MAAM,EAAE,kCAAkC,EAAE,GAAG,MAAM,MAAM,CAC1D,yCAAyC,CACzC,CAAC;QACF,kCAAkC,EAAE,CAAC;QAErC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACvE,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QACtE,cAAS,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,gBAAgB,CAAC,cAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAIlF,MAAM,EAAE,6BAA6B,EAAE,GAAG,MAAM,MAAM,CACrD,iEAAiE,CACjE,CAAC;QACF,MAAM,EAAE,mCAAmC,EAAE,GAAG,MAAM,MAAM,CAC3D,uCAAuC,CACvC,CAAC;QACF,MAAM,cAAS,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,gBAAgB,CAClE,cAAS,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAClD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACb,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,4CAA4C,CAAC,CAAC;QACnF,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CACzC,wDAAwD,CACxD,CAAC;QACF,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,kDAAkD,CAAC,CAAC;QACzF,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,mDAAmD,CAAC,CAAC;QAC3F,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,kDAAkD,CAAC,CAAC;QAEzF,OAAO,CAAC,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;IAC1F,CAAC;CACD,CAAA;;4BAlEY,iBAAiB;IAD7B,IAAA,0BAAa,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;GACzE,iBAAiB,CAkE7B"}

package/dist/modules/oauth-server/oauth-server.service.d.ts

@@ -5,11 +5,11 @@ import type { OAuthClientInformationFull, OAuthTokens, OAuthTokenRevocationReque
 import type { McpClientConnectedPeriod, McpClientTypeFilter } from '@n8n/api-types';
 import { Logger } from '@n8n/backend-common';
 import { EventService, UrlService } from '@n8n/backend-services';
+import { ProtectedResourceRegistry } from '@n8n/backend-services/auth';
 import { GlobalConfig } from '@n8n/config';
 import type { User } from '@n8n/db';
 import type { Response } from 'express';
 import { AuthService } from '../../auth/auth.service';
-import { ProtectedResourceRegistry } from '../../services/protected-resource.registry';
 import { UserManagementMailer } from '../../user-management/email';
 import { OAuthClient } from './database/entities/oauth-client.entity';
 import { OAuthClientRepository } from './database/repositories/oauth-client.repository';

package/dist/modules/oauth-server/oauth-server.service.js

@@ -14,13 +14,13 @@ const errors_js_1 = require("@modelcontextprotocol/sdk/server/auth/errors.js");
 const api_types_1 = require("@n8n/api-types");
 const backend_common_1 = require("@n8n/backend-common");
 const backend_services_1 = require("@n8n/backend-services");
+const auth_1 = require("@n8n/backend-services/auth");
 const config_1 = require("@n8n/config");
 const constants_1 = require("@n8n/constants");
 const di_1 = require("@n8n/di");
 const permissions_1 = require("@n8n/permissions");
 const auth_service_1 = require("../../auth/auth.service");
 const errors_1 = require("@n8n/errors");
-const protected_resource_registry_1 = require("../../services/protected-resource.registry");
 const email_1 = require("../../user-management/email");
 const oauth_client_entity_1 = require("./database/entities/oauth-client.entity");
 const oauth_client_repository_1 = require("./database/repositories/oauth-client.repository");
@@ -286,8 +286,8 @@ let OAuthServerService = class OAuthServerService {
                 res.redirect(autoApproval.redirectUrl);
                 return;
             }
-            this.oauthSessionService.createSession(res, sessionPayload);
-            res.redirect('/oauth/consent');
+            const flowId = this.oauthSessionService.createSession(res, sessionPayload);
+            res.redirect(`/oauth/consent?flow=${flowId}`);
         }
         catch (error) {
             if (error instanceof InvalidResourceIndicatorError) {
@@ -296,7 +296,6 @@ let OAuthServerService = class OAuthServerService {
                     resource: error.resource,
                     expectedResource: error.expectedResource,
                 });
-                this.oauthSessionService.clearSession(res);
                 res.status(400).json({
                     error: 'invalid_target',
                     error_description: 'Invalid resource indicator',
@@ -304,7 +303,6 @@ let OAuthServerService = class OAuthServerService {
                 return;
             }
             this.logger.error('Error in authorize method', { error, clientId: client.client_id });
-            this.oauthSessionService.clearSession(res);
             res.status(500).json({ error: 'server_error', error_description: 'Internal server error' });
         }
     }
@@ -338,6 +336,10 @@ let OAuthServerService = class OAuthServerService {
                 clientName: client.client_name,
             });
         }
+        this.logger.debug('OAuth token exchange succeeded', {
+            clientId: client.client_id,
+            userId: authRecord.userId,
+        });
         return {
             access_token: accessToken,
             token_type: 'Bearer',
@@ -525,7 +527,7 @@ let OAuthServerService = class OAuthServerService {
 exports.OAuthServerService = OAuthServerService;
 exports.OAuthServerService = OAuthServerService = __decorate([
     (0, di_1.Service)(),
-    __metadata("design:paramtypes", [backend_common_1.Logger, config_1.GlobalConfig, oauth_session_service_1.OAuthSessionService, oauth_client_repository_1.OAuthClientRepository, oauth_token_service_1.OAuthTokenService, oauth_authorization_code_service_1.OAuthAuthorizationCodeService, oauth_user_consent_repository_1.UserConsentRepository, protected_resource_registry_1.ProtectedResourceRegistry, email_1.UserManagementMailer, backend_services_1.UrlService, backend_services_1.EventService, auth_service_1.AuthService, oauth_consent_service_1.OAuthConsentService])
+    __metadata("design:paramtypes", [backend_common_1.Logger, config_1.GlobalConfig, oauth_session_service_1.OAuthSessionService, oauth_client_repository_1.OAuthClientRepository, oauth_token_service_1.OAuthTokenService, oauth_authorization_code_service_1.OAuthAuthorizationCodeService, oauth_user_consent_repository_1.UserConsentRepository, auth_1.ProtectedResourceRegistry, email_1.UserManagementMailer, backend_services_1.UrlService, backend_services_1.EventService, auth_service_1.AuthService, oauth_consent_service_1.OAuthConsentService])
 ], OAuthServerService);
 class InvalidResourceIndicatorError extends errors_js_1.InvalidTargetError {
     constructor(resource, expectedResource) {