n8n 2.44.4 → 2.45.0

package/dist/modules/agents/integrations/platforms/teams/teams-catalog.service.d.ts

@@ -0,0 +1,51 @@
+import type { AgentTeamsIntegrationSettings, TeamsCatalogState } from '@n8n/api-types';
+import type { User } from '@n8n/db';
+import { Logger } from '@n8n/backend-common';
+import { CredentialsFinderService } from '@n8n/backend-services';
+import { CredentialsService } from '../../../../../credentials/credentials.service';
+import { TeamsCredentialNotesService } from './teams-credential-notes.service';
+import { TeamsGraphService } from './teams-graph.service';
+import { TeamsManifestService } from './teams-manifest.service';
+import { TeamsManagerTokenService } from './teams-manager-token.service';
+import { TeamsSetupService } from './teams-setup.service';
+export interface TeamsCatalogScope {
+    user: User;
+    projectId: string;
+    agentId: string;
+    managerCredentialId: string;
+    credentialId?: string;
+    teamsAppId?: string;
+}
+export interface PublishTeamsAppOptions extends TeamsCatalogScope {
+    credentialId: string;
+    settings?: AgentTeamsIntegrationSettings;
+}
+export declare class TeamsCatalogService {
+    private readonly graph;
+    private readonly tokens;
+    private readonly setupService;
+    private readonly manifestService;
+    private readonly credentialsFinderService;
+    private readonly credentialsService;
+    private readonly logger;
+    private readonly notes;
+    constructor(graph: TeamsGraphService, tokens: TeamsManagerTokenService, setupService: TeamsSetupService, manifestService: TeamsManifestService, credentialsFinderService: CredentialsFinderService, credentialsService: CredentialsService, logger: Logger, notes: TeamsCredentialNotesService);
+    publish(options: PublishTeamsAppOptions): Promise<TeamsCatalogState>;
+    private publishToCatalog;
+    private createdState;
+    private publishOverConflict;
+    getState(options: TeamsCatalogScope): Promise<TeamsCatalogState>;
+    private rememberPublish;
+    private rememberedPublish;
+    private botCredential;
+    private updateExistingApp;
+    private awaitCatalogApp;
+    private queryCatalog;
+    private findCatalogApp;
+    private toCatalogEntry;
+    private readState;
+    private isPermissionRefusal;
+    private publishError;
+    private graphToken;
+    private managerCredential;
+}

package/dist/modules/agents/integrations/platforms/teams/teams-catalog.service.js

@@ -0,0 +1,241 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TeamsCatalogService = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const di_1 = require("@n8n/di");
+const is_record_1 = require("@n8n/utils/is-record");
+const sleep_1 = require("@n8n/utils/sleep");
+const n8n_workflow_1 = require("n8n-workflow");
+const backend_services_1 = require("@n8n/backend-services");
+const errors_1 = require("@n8n/errors");
+const credentials_service_1 = require("../../../../../credentials/credentials.service");
+const teams_credential_notes_service_1 = require("./teams-credential-notes.service");
+const teams_entra_provisioning_service_1 = require("./teams-entra-provisioning.service");
+const teams_graph_service_1 = require("./teams-graph.service");
+const teams_manifest_service_1 = require("./teams-manifest.service");
+const teams_managed_setup_service_1 = require("./teams-managed-setup.service");
+const teams_manager_token_service_1 = require("./teams-manager-token.service");
+const teams_setup_service_1 = require("./teams-setup.service");
+const integration_helpers_1 = require("../../integration-helpers");
+const PUBLISH_NOTE_TTL_MS = 48 * 60 * 60 * 1000;
+const CATALOG_LOOKUP_ATTEMPTS = 3;
+const CATALOG_LOOKUP_DELAY_MS = 2000;
+let TeamsCatalogService = class TeamsCatalogService {
+    constructor(graph, tokens, setupService, manifestService, credentialsFinderService, credentialsService, logger, notes) {
+        this.graph = graph;
+        this.tokens = tokens;
+        this.setupService = setupService;
+        this.manifestService = manifestService;
+        this.credentialsFinderService = credentialsFinderService;
+        this.credentialsService = credentialsService;
+        this.logger = logger;
+        this.notes = notes;
+    }
+    async publish(options) {
+        const { archive, fingerprint } = await this.setupService.buildPackage(options.user, { projectId: options.projectId, agentId: options.agentId }, options.credentialId, options.settings);
+        const state = await this.publishToCatalog(options, archive);
+        await this.rememberPublish(options, state, fingerprint);
+        return state;
+    }
+    async publishToCatalog(options, archive) {
+        const token = await this.graphToken(options);
+        const existing = await this.findCatalogApp(token, options.agentId);
+        if (existing) {
+            const status = await this.updateExistingApp(token, existing.teamsAppId, archive);
+            return { status, teamsAppId: existing.teamsAppId };
+        }
+        const direct = await this.graph.postZip(token, '/appCatalogs/teamsApps', archive);
+        if (direct.ok) {
+            this.logger.debug('[TeamsCatalog] Published straight to the organisation', {
+                agentId: options.agentId,
+                teamsAppId: (0, integration_helpers_1.stringProperty)(direct.body, 'id') ?? null,
+                externalId: this.manifestService.buildManifestId(options.agentId),
+            });
+            return this.createdState(direct.body, 'published');
+        }
+        if (direct.statusCode === 409 || (0, teams_graph_service_1.graphErrorCode)(direct.body) === 'Conflict') {
+            return await this.publishOverConflict(token, options.agentId, archive, direct.body);
+        }
+        if (!this.isPermissionRefusal(direct.statusCode, (0, teams_graph_service_1.graphErrorCode)(direct.body))) {
+            throw this.publishError(direct.statusCode, direct.body);
+        }
+        const submitted = await this.graph.postZip(token, '/appCatalogs/teamsApps?requiresReview=true', archive);
+        if (submitted.ok) {
+            this.logger.debug('[TeamsCatalog] Sent for review instead of published', {
+                agentId: options.agentId,
+                teamsAppId: (0, integration_helpers_1.stringProperty)(submitted.body, 'id') ?? null,
+                refusedWith: direct.statusCode,
+            });
+            return this.createdState(submitted.body, 'submitted');
+        }
+        if (submitted.statusCode === 409 || (0, teams_graph_service_1.graphErrorCode)(submitted.body) === 'Conflict') {
+            return await this.publishOverConflict(token, options.agentId, archive, submitted.body);
+        }
+        throw this.publishError(submitted.statusCode, submitted.body);
+    }
+    createdState(body, status) {
+        const teamsAppId = (0, integration_helpers_1.stringProperty)(body, 'id');
+        return teamsAppId ? { status, teamsAppId } : { status: 'unknown', teamsAppId: null };
+    }
+    async publishOverConflict(token, agentId, archive, refusal) {
+        const externalId = this.manifestService.buildManifestId(agentId);
+        const ours = ((0, teams_graph_service_1.graphErrorMessage)(refusal) ?? '').includes(externalId);
+        const existing = await this.awaitCatalogApp(token, agentId);
+        if (!existing) {
+            throw ours
+                ? new n8n_workflow_1.UserError('This agent already has an app in the organization catalog, and Microsoft has not listed it yet, so it cannot be updated. Nothing is wrong and nothing was lost — try again in a few minutes.')
+                : new n8n_workflow_1.UserError('An app with this name is already in the organization catalog, and Microsoft has not listed it yet, so it cannot be updated. If an earlier publish made it, try again in a few minutes. If another app holds the name, rename the agent and try again.');
+        }
+        const status = await this.updateExistingApp(token, existing.teamsAppId, archive);
+        return { status, teamsAppId: existing.teamsAppId };
+    }
+    async getState(options) {
+        const token = await this.graphToken(options);
+        const state = await this.readState(token, options.agentId);
+        if (state.status !== 'unknown')
+            return state;
+        return (await this.rememberedPublish(options)) ?? state;
+    }
+    async rememberPublish(options, state, fingerprint) {
+        if (!options.credentialId)
+            return;
+        const notes = { teamsAppFingerprint: fingerprint };
+        if (state.teamsAppId && state.status !== 'unknown') {
+            notes.publishedTeamsAppId = state.teamsAppId;
+            notes.publishedTeamsAppState = state.status;
+            notes.publishedTeamsAppAt = new Date().toISOString();
+        }
+        await this.notes.write(options.user, options.credentialId, notes);
+    }
+    async rememberedPublish(options) {
+        const credential = await this.botCredential(options, 'credential:read');
+        if (!credential)
+            return undefined;
+        const data = await this.credentialsService.decrypt(credential, true);
+        const teamsAppId = (0, integration_helpers_1.stringProperty)(data, 'publishedTeamsAppId');
+        const status = (0, integration_helpers_1.stringProperty)(data, 'publishedTeamsAppState');
+        if (!teamsAppId || (status !== 'published' && status !== 'submitted'))
+            return undefined;
+        const writtenAt = Date.parse((0, integration_helpers_1.stringProperty)(data, 'publishedTeamsAppAt') ?? '');
+        if (Number.isNaN(writtenAt) || Date.now() - writtenAt > PUBLISH_NOTE_TTL_MS) {
+            return undefined;
+        }
+        return { status, teamsAppId };
+    }
+    async botCredential(options, scope) {
+        if (!options.credentialId)
+            return undefined;
+        const credential = await this.credentialsFinderService.findCredentialForUser(options.credentialId, options.user, [scope]);
+        return credential?.type === teams_entra_provisioning_service_1.BOT_CREDENTIAL_TYPE ? credential : undefined;
+    }
+    async updateExistingApp(token, teamsAppId, archive) {
+        const path = `/appCatalogs/teamsApps/${teamsAppId}/appDefinitions`;
+        const direct = await this.graph.postZip(token, path, archive);
+        if (direct.ok)
+            return 'published';
+        if (!this.isPermissionRefusal(direct.statusCode, (0, teams_graph_service_1.graphErrorCode)(direct.body))) {
+            throw this.publishError(direct.statusCode, direct.body);
+        }
+        const submitted = await this.graph.postZip(token, `${path}?requiresReview=true`, archive);
+        if (!submitted.ok) {
+            throw this.publishError(submitted.statusCode, submitted.body);
+        }
+        return 'submitted';
+    }
+    async awaitCatalogApp(token, agentId) {
+        for (let attempt = 0; attempt < CATALOG_LOOKUP_ATTEMPTS; attempt++) {
+            if (attempt > 0)
+                await (0, sleep_1.sleep)(CATALOG_LOOKUP_DELAY_MS);
+            const byExternalId = await this.queryCatalog(token, `externalId eq '${this.manifestService.buildManifestId(agentId)}'`);
+            if (byExternalId)
+                return byExternalId;
+            this.logger.debug('[TeamsCatalog] Catalogue has not listed the app yet', {
+                agentId,
+                attempt: attempt + 1,
+                of: CATALOG_LOOKUP_ATTEMPTS,
+            });
+        }
+        return undefined;
+    }
+    async queryCatalog(token, filter) {
+        const query = new URLSearchParams({ $filter: filter, $expand: 'appDefinitions' });
+        const response = await this.graph.request(token, 'GET', `/appCatalogs/teamsApps?${query.toString()}`);
+        if (!response.ok) {
+            this.logger.debug('[TeamsCatalog] Could not read the catalogue', {
+                statusCode: response.statusCode,
+                error: (0, teams_graph_service_1.graphErrorCode)(response.body),
+            });
+            return undefined;
+        }
+        const value = (0, is_record_1.isRecord)(response.body) ? response.body.value : undefined;
+        return this.toCatalogEntry(Array.isArray(value) ? value[0] : undefined);
+    }
+    async findCatalogApp(token, agentId) {
+        return await this.queryCatalog(token, `externalId eq '${this.manifestService.buildManifestId(agentId)}'`);
+    }
+    toCatalogEntry(entry) {
+        const teamsAppId = (0, integration_helpers_1.stringProperty)(entry, 'id');
+        if (!teamsAppId)
+            return undefined;
+        const definitions = (0, is_record_1.isRecord)(entry) ? entry.appDefinitions : undefined;
+        const latest = Array.isArray(definitions) ? definitions[definitions.length - 1] : undefined;
+        return {
+            teamsAppId,
+            publishingState: (0, integration_helpers_1.stringProperty)(latest, 'publishingState') ?? null,
+        };
+    }
+    async readState(token, agentId) {
+        const app = await this.findCatalogApp(token, agentId);
+        if (!app) {
+            return { status: 'unknown', teamsAppId: null };
+        }
+        switch (app.publishingState) {
+            case 'published':
+                return { status: 'published', teamsAppId: app.teamsAppId };
+            case 'submitted':
+                return { status: 'submitted', teamsAppId: app.teamsAppId };
+            case 'rejected':
+                return { status: 'rejected', teamsAppId: app.teamsAppId };
+            default:
+                return { status: 'unknown', teamsAppId: app.teamsAppId };
+        }
+    }
+    isPermissionRefusal(statusCode, code) {
+        return statusCode === 403 || code === 'Forbidden' || code === 'UnauthorizedAccessException';
+    }
+    publishError(statusCode, body) {
+        if (statusCode === 409 || (0, teams_graph_service_1.graphErrorCode)(body) === 'Conflict') {
+            return new n8n_workflow_1.UserError('An app with this name is already in the organization catalog.');
+        }
+        if (this.isPermissionRefusal(statusCode, (0, teams_graph_service_1.graphErrorCode)(body))) {
+            return new n8n_workflow_1.UserError('This account may not put the app in the organization catalog. A Teams administrator has to publish it.');
+        }
+        return new n8n_workflow_1.OperationalError('Microsoft would not accept the Teams app. Try again in a few minutes.');
+    }
+    async graphToken(options) {
+        const credential = await this.managerCredential(options);
+        return await this.tokens.acquire(credential, teams_manager_token_service_1.GRAPH_RESOURCE);
+    }
+    async managerCredential(options) {
+        const credential = await this.credentialsFinderService.findCredentialForUser(options.managerCredentialId, options.user, ['credential:use']);
+        if (!credential || credential.type !== teams_managed_setup_service_1.TEAMS_MANAGER_CREDENTIAL_TYPE) {
+            throw new errors_1.BadRequestError('Sign in with Microsoft before publishing the Teams app.');
+        }
+        return credential;
+    }
+};
+exports.TeamsCatalogService = TeamsCatalogService;
+exports.TeamsCatalogService = TeamsCatalogService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [teams_graph_service_1.TeamsGraphService, teams_manager_token_service_1.TeamsManagerTokenService, teams_setup_service_1.TeamsSetupService, teams_manifest_service_1.TeamsManifestService, backend_services_1.CredentialsFinderService, credentials_service_1.CredentialsService, backend_common_1.Logger, teams_credential_notes_service_1.TeamsCredentialNotesService])
+], TeamsCatalogService);
+//# sourceMappingURL=teams-catalog.service.js.map

package/dist/modules/agents/integrations/platforms/teams/teams-catalog.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams-catalog.service.js","sourceRoot":"","sources":["../../../../../../src/modules/agents/integrations/platforms/teams/teams-catalog.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,wDAA6C;AAC7C,gCAAkC;AAClC,oDAAgD;AAChD,4CAAyC;AACzC,+CAA2D;AAE3D,4DAAiE;AACjE,wCAA8C;AAE9C,2EAAuE;AAEvE,qFAA+E;AAC/E,yFAAyE;AACzE,+DAA6F;AAC7F,qEAAgE;AAChE,+EAA8E;AAC9E,+EAAyF;AACzF,+DAA0D;AAC1D,mEAA2D;AAQ3D,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAkBhD,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAClC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAqB9B,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC/B,YACkB,KAAwB,EACxB,MAAgC,EAChC,YAA+B,EAC/B,eAAqC,EACrC,wBAAkD,EAClD,kBAAsC,EACtC,MAAc,EACd,KAAkC;qBAPlC,KAAK;sBACL,MAAM;4BACN,YAAY;+BACZ,eAAe;wCACf,wBAAwB;kCACxB,kBAAkB;sBAClB,MAAM;qBACN,KAAK;IACpB,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,OAA+B;QAC5C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CACpE,OAAO,CAAC,IAAI,EACZ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAC1D,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,QAAQ,CAChB,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QACxD,OAAO,KAAK,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC7B,OAA+B,EAC/B,OAAe;QAEf,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,IAAI,QAAQ,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACjF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;QACpD,CAAC;QAKD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,wBAAwB,EAAE,OAAO,CAAC,CAAC;QAClF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE;gBAC1E,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,IAAA,oCAAc,EAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI;gBACrD,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC;aACjE,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,GAAG,IAAI,IAAA,oCAAc,EAAC,MAAM,CAAC,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YAC7E,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,EAAE,IAAA,oCAAc,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CACzC,KAAK,EACL,4CAA4C,EAC5C,OAAO,CACP,CAAC;QACF,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;YAGlB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE;gBACxE,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,IAAA,oCAAc,EAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI;gBACxD,WAAW,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,SAAS,CAAC,UAAU,KAAK,GAAG,IAAI,IAAA,oCAAc,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YACnF,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;IAQO,YAAY,CAAC,IAAa,EAAE,MAAiC;QACpE,MAAM,UAAU,GAAG,IAAA,oCAAc,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9C,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACtF,CAAC;IAQO,KAAK,CAAC,mBAAmB,CAChC,KAAa,EACb,OAAe,EACf,OAAe,EACf,OAAgB;QAOhB,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,CAAC,IAAA,uCAAiB,EAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAErE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI;gBACT,CAAC,CAAC,IAAI,wBAAS,CACb,8LAA8L,CAC9L;gBACF,CAAC,CAAC,IAAI,wBAAS,CACb,uPAAuP,CACvP,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACjF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;IACpD,CAAC;IAMD,KAAK,CAAC,QAAQ,CAAC,OAA0B;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAO7C,OAAO,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC;IACzD,CAAC;IAOO,KAAK,CAAC,eAAe,CAC5B,OAA+B,EAC/B,KAAwB,EACxB,WAAmB;QAEnB,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,OAAO;QAGlC,MAAM,KAAK,GAA2B,EAAE,mBAAmB,EAAE,WAAW,EAAE,CAAC;QAC3E,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAGpD,KAAK,CAAC,mBAAmB,GAAG,KAAK,CAAC,UAAU,CAAC;YAC7C,KAAK,CAAC,sBAAsB,GAAG,KAAK,CAAC,MAAM,CAAC;YAC5C,KAAK,CAAC,mBAAmB,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACtD,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACnE,CAAC;IAGO,KAAK,CAAC,iBAAiB,CAC9B,OAA0B;QAE1B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACxE,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAElC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACrE,MAAM,UAAU,GAAG,IAAA,oCAAc,EAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAA,oCAAc,EAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,WAAW,CAAC;YAAE,OAAO,SAAS,CAAC;QAQxF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,oCAAc,EAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC;QAChF,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,mBAAmB,EAAE,CAAC;YAC7E,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,aAAa,CAC1B,OAA0B,EAC1B,KAA8C;QAE9C,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,qBAAqB,CAC3E,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,IAAI,EACZ,CAAC,KAAK,CAAC,CACP,CAAC;QACF,OAAO,UAAU,EAAE,IAAI,KAAK,sDAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,CAAC;IAWO,KAAK,CAAC,iBAAiB,CAC9B,KAAa,EACb,UAAkB,EAClB,OAAe;QAEf,MAAM,IAAI,GAAG,0BAA0B,UAAU,iBAAiB,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,EAAE;YAAE,OAAO,WAAW,CAAC;QAElC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,EAAE,IAAA,oCAAc,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,sBAAsB,EAAE,OAAO,CAAC,CAAC;QAC1F,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,WAAW,CAAC;IACpB,CAAC;IAQO,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,OAAe;QAC3D,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,uBAAuB,EAAE,OAAO,EAAE,EAAE,CAAC;YACpE,IAAI,OAAO,GAAG,CAAC;gBAAE,MAAM,IAAA,aAAK,EAAC,uBAAuB,CAAC,CAAC;YAEtD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAC3C,KAAK,EACL,kBAAkB,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAClE,CAAC;YACF,IAAI,YAAY;gBAAE,OAAO,YAAY,CAAC;YAEtC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE;gBACxE,OAAO;gBACP,OAAO,EAAE,OAAO,GAAG,CAAC;gBACpB,EAAE,EAAE,uBAAuB;aAC3B,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,MAAc;QACvD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAClF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CACxC,KAAK,EACL,KAAK,EACL,0BAA0B,KAAK,CAAC,QAAQ,EAAE,EAAE,CAC5C,CAAC;QAIF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;gBAChE,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,KAAK,EAAE,IAAA,oCAAc,EAAC,QAAQ,CAAC,IAAI,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,KAAK,GAAG,IAAA,oBAAQ,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACzE,CAAC;IAMO,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,OAAe;QAC1D,OAAO,MAAM,IAAI,CAAC,YAAY,CAC7B,KAAK,EACL,kBAAkB,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAClE,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,KAAc;QACpC,MAAM,UAAU,GAAG,IAAA,oCAAc,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAElC,MAAM,WAAW,GAAG,IAAA,oBAAQ,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,OAAO;YACN,UAAU;YACV,eAAe,EAAE,IAAA,oCAAc,EAAC,MAAM,EAAE,iBAAiB,CAAC,IAAI,IAAI;SAClE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,OAAe;QACrD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,GAAG,EAAE,CAAC;YAIV,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAChD,CAAC;QAED,QAAQ,GAAG,CAAC,eAAe,EAAE,CAAC;YAC7B,KAAK,WAAW;gBACf,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;YAC5D,KAAK,WAAW;gBACf,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;YAC5D,KAAK,UAAU;gBACd,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;YAC3D;gBACC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;QAC3D,CAAC;IACF,CAAC;IAGO,mBAAmB,CAAC,UAAkB,EAAE,IAAwB;QACvE,OAAO,UAAU,KAAK,GAAG,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,6BAA6B,CAAC;IAC7F,CAAC;IAQO,YAAY,CAAC,UAAkB,EAAE,IAAa;QACrD,IAAI,UAAU,KAAK,GAAG,IAAI,IAAA,oCAAc,EAAC,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YAC/D,OAAO,IAAI,wBAAS,CAAC,+DAA+D,CAAC,CAAC;QACvF,CAAC;QAGD,IAAI,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,IAAA,oCAAc,EAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,wBAAS,CACnB,wGAAwG,CACxG,CAAC;QACH,CAAC;QACD,OAAO,IAAI,+BAAgB,CAC1B,uEAAuE,CACvE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,OAA0B;QAClD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,4CAAc,CAAC,CAAC;IAC9D,CAAC;IAOO,KAAK,CAAC,iBAAiB,CAAC,OAA0B;QACzD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,qBAAqB,CAC3E,OAAO,CAAC,mBAAmB,EAC3B,OAAO,CAAC,IAAI,EACZ,CAAC,gBAAgB,CAAC,CAClB,CAAC;QACF,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,2DAA6B,EAAE,CAAC;YACtE,MAAM,IAAI,wBAAe,CAAC,yDAAyD,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,UAAU,CAAC;IACnB,CAAC;CACD,CAAA;;8BAlXY,mBAAmB;IAD/B,IAAA,YAAO,GAAE;qCAGgB,uCAAiB,EAChB,sDAAwB,EAClB,uCAAiB,EACd,6CAAoB,EACX,2CAAwB,EAC9B,wCAAkB,EAC9B,uBAAM,EACP,4DAA2B;GATxC,mBAAmB,CAkX/B"}

package/dist/modules/agents/integrations/platforms/teams/teams-cleanup.service.d.ts

@@ -0,0 +1,13 @@
+import type { AgentIntegrationDisconnectWarning } from '@n8n/api-types';
+import type { User } from '@n8n/db';
+import { AgentCredentialLookupService } from '../../agent-credential-lookup.service';
+export interface TeamsCleanupContext {
+    user: User;
+    projectId: string;
+    credentialId: string;
+}
+export declare class TeamsCleanupService {
+    private readonly credentialLookup;
+    constructor(credentialLookup: AgentCredentialLookupService);
+    describeLeftovers(ctx: TeamsCleanupContext): Promise<AgentIntegrationDisconnectWarning | undefined>;
+}

package/dist/modules/agents/integrations/platforms/teams/teams-cleanup.service.js

@@ -0,0 +1,43 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TeamsCleanupService = void 0;
+const di_1 = require("@n8n/di");
+const agent_credential_lookup_service_1 = require("../../agent-credential-lookup.service");
+const integration_helpers_1 = require("../../integration-helpers");
+const BOT_CREDENTIAL_TYPE = 'microsoftEntraServicePrincipalApi';
+const TEAMS_MANAGE_APPS_URL = 'https://admin.teams.microsoft.com/policies/manage-apps';
+let TeamsCleanupService = class TeamsCleanupService {
+    constructor(credentialLookup) {
+        this.credentialLookup = credentialLookup;
+    }
+    async describeLeftovers(ctx) {
+        if (!ctx.credentialId)
+            return undefined;
+        const data = await this.credentialLookup.decryptForUser(ctx.user, ctx.projectId, ctx.credentialId, BOT_CREDENTIAL_TYPE);
+        if (!data || !(0, integration_helpers_1.stringProperty)(data, 'entraAppObjectId'))
+            return undefined;
+        return {
+            integrationType: 'teams',
+            code: 'resources_not_deleted',
+            action: { type: 'open_url', url: TEAMS_MANAGE_APPS_URL },
+            details: {
+                appId: (0, integration_helpers_1.stringProperty)(data, 'clientId') ?? '',
+            },
+        };
+    }
+};
+exports.TeamsCleanupService = TeamsCleanupService;
+exports.TeamsCleanupService = TeamsCleanupService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [agent_credential_lookup_service_1.AgentCredentialLookupService])
+], TeamsCleanupService);
+//# sourceMappingURL=teams-cleanup.service.js.map

package/dist/modules/agents/integrations/platforms/teams/teams-cleanup.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams-cleanup.service.js","sourceRoot":"","sources":["../../../../../../src/modules/agents/integrations/platforms/teams/teams-cleanup.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gCAAkC;AAElC,2FAAqF;AACrF,mEAA2D;AAE3D,MAAM,mBAAmB,GAAG,mCAAmC,CAAC;AAChE,MAAM,qBAAqB,GAAG,wDAAwD,CAAC;AAkBhF,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC/B,YAA6B,gBAA8C;gCAA9C,gBAAgB;IAAiC,CAAC;IAE/E,KAAK,CAAC,iBAAiB,CACtB,GAAwB;QAExB,IAAI,CAAC,GAAG,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QAIxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CACtD,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,YAAY,EAChB,mBAAmB,CACnB,CAAC;QAGF,IAAI,CAAC,IAAI,IAAI,CAAC,IAAA,oCAAc,EAAC,IAAI,EAAE,kBAAkB,CAAC;YAAE,OAAO,SAAS,CAAC;QAEzE,OAAO;YACN,eAAe,EAAE,OAAO;YACxB,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,qBAAqB,EAAE;YACxD,OAAO,EAAE;gBACR,KAAK,EAAE,IAAA,oCAAc,EAAC,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE;aAC7C;SACD,CAAC;IACH,CAAC;CACD,CAAA;;8BA7BY,mBAAmB;IAD/B,IAAA,YAAO,GAAE;qCAEsC,8DAA4B;GAD/D,mBAAmB,CA6B/B"}

package/dist/modules/agents/integrations/platforms/teams/teams-credential-check.service.d.ts

@@ -1,4 +1,4 @@
-import type { TeamsCredentialCheck } from '@n8n/api-types';
+import type { TeamsCredentialCheck, TeamsFileAccessCheck } from '@n8n/api-types';
 import { Logger } from '@n8n/backend-common';
 import { OutboundHttp } from '@n8n/backend-network';
 import type { User } from '@n8n/db';
@@ -9,4 +9,6 @@ export declare class TeamsCredentialCheckService {
     private readonly logger;
     constructor(credentialLookup: AgentCredentialLookupService, outboundHttp: OutboundHttp, logger: Logger);
     check(user: User, projectId: string, credentialId: string): Promise<TeamsCredentialCheck>;
+    checkFileAccess(user: User, projectId: string, credentialId: string): Promise<TeamsFileAccessCheck>;
+    private requestToken;
 }

package/dist/modules/agents/integrations/platforms/teams/teams-credential-check.service.js

@@ -13,10 +13,14 @@ exports.TeamsCredentialCheckService = void 0;
 const backend_common_1 = require("@n8n/backend-common");
 const backend_network_1 = require("@n8n/backend-network");
 const di_1 = require("@n8n/di");
+const is_record_1 = require("@n8n/utils/is-record");
+const n8n_workflow_1 = require("n8n-workflow");
 const agent_credential_lookup_service_1 = require("../../agent-credential-lookup.service");
 const integration_helpers_1 = require("../../integration-helpers");
+const teams_graph_permissions_1 = require("./teams-graph-permissions");
 const TEAMS_CREDENTIAL_TYPE = 'microsoftEntraServicePrincipalApi';
 const BOT_FRAMEWORK_SCOPE = 'https://api.botframework.com/.default';
+const GRAPH_SCOPE = 'https://graph.microsoft.com/.default';
 const GLOBAL_GRAPH_API_BASE_URL = 'https://graph.microsoft.com';
 const CHECK_TIMEOUT_MS = 30_000;
 let TeamsCredentialCheckService = class TeamsCredentialCheckService {
@@ -36,32 +40,12 @@ let TeamsCredentialCheckService = class TeamsCredentialCheckService {
         if (graphApiBaseUrl && graphApiBaseUrl.replace(/\/+$/, '') !== GLOBAL_GRAPH_API_BASE_URL) {
             return { status: 'failed', reason: 'cloud' };
         }
-        const tenantId = (0, integration_helpers_1.stringProperty)(data, 'tenantId')?.trim();
-        const clientId = (0, integration_helpers_1.stringProperty)(data, 'clientId')?.trim();
-        const clientSecret = (0, integration_helpers_1.stringProperty)(data, 'clientSecret')?.trim();
-        if (!tenantId || !clientId || !clientSecret) {
+        const secret = clientSecretOf(data);
+        if (!secret)
             return { status: 'failed', reason: 'incomplete' };
-        }
         try {
-            const response = await this.outboundHttp
-                .requests({ useDefaultSsrfPolicy: 'unsafe' })
-                .request({
-                method: 'POST',
-                url: `https://login.microsoftonline.com/${encodeURIComponent(tenantId)}/oauth2/v2.0/token`,
-                headers: { 'content-type': 'application/x-www-form-urlencoded' },
-                body: new URLSearchParams({
-                    grant_type: 'client_credentials',
-                    client_id: clientId,
-                    client_secret: clientSecret,
-                    scope: BOT_FRAMEWORK_SCOPE,
-                }).toString(),
-                returnFullResponse: true,
-                ignoreHttpStatusErrors: true,
-                timeout: CHECK_TIMEOUT_MS,
-            });
-            const body = response.body;
-            const token = (0, integration_helpers_1.stringProperty)(body, 'access_token');
-            if (response.statusCode === 200 && token)
+            const response = await this.requestToken(secret, BOT_FRAMEWORK_SCOPE);
+            if (response.token)
                 return { status: 'ok' };
             this.logger.debug('[TeamsCredentialCheck] Microsoft refused the credential', {
                 statusCode: response.statusCode,
@@ -73,10 +57,67 @@ let TeamsCredentialCheckService = class TeamsCredentialCheckService {
             return { status: 'failed', reason: 'unreachable' };
         }
     }
+    async checkFileAccess(user, projectId, credentialId) {
+        const data = await this.credentialLookup.decryptForUser(user, projectId, credentialId, TEAMS_CREDENTIAL_TYPE);
+        const secret = clientSecretOf(data);
+        if (!secret)
+            return { status: 'unknown' };
+        try {
+            const { token } = await this.requestToken(secret, GRAPH_SCOPE);
+            if (!token)
+                return { status: 'unknown' };
+            const granted = rolesOf(token);
+            const approved = teams_graph_permissions_1.GRAPH_APP_ROLES.every(({ permission }) => granted.includes(permission));
+            return { status: approved ? 'approved' : 'notApproved' };
+        }
+        catch (error) {
+            this.logger.debug('[TeamsCredentialCheck] Could not read the Graph permission grant', {
+                error,
+            });
+            return { status: 'unknown' };
+        }
+    }
+    async requestToken({ tenantId, clientId, clientSecret }, scope) {
+        const response = await this.outboundHttp
+            .requests({ useDefaultSsrfPolicy: 'unsafe' })
+            .request({
+            method: 'POST',
+            url: `https://login.microsoftonline.com/${encodeURIComponent(tenantId)}/oauth2/v2.0/token`,
+            headers: { 'content-type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'client_credentials',
+                client_id: clientId,
+                client_secret: clientSecret,
+                scope,
+            }).toString(),
+            returnFullResponse: true,
+            ignoreHttpStatusErrors: true,
+            timeout: CHECK_TIMEOUT_MS,
+        });
+        const body = response.body;
+        const token = (0, integration_helpers_1.stringProperty)(body, 'access_token');
+        return {
+            statusCode: response.statusCode,
+            token: response.statusCode === 200 ? token : undefined,
+        };
+    }
 };
 exports.TeamsCredentialCheckService = TeamsCredentialCheckService;
 exports.TeamsCredentialCheckService = TeamsCredentialCheckService = __decorate([
     (0, di_1.Service)(),
     __metadata("design:paramtypes", [agent_credential_lookup_service_1.AgentCredentialLookupService, backend_network_1.OutboundHttp, backend_common_1.Logger])
 ], TeamsCredentialCheckService);
+function clientSecretOf(data) {
+    const tenantId = (0, integration_helpers_1.stringProperty)(data, 'tenantId')?.trim();
+    const clientId = (0, integration_helpers_1.stringProperty)(data, 'clientId')?.trim();
+    const clientSecret = (0, integration_helpers_1.stringProperty)(data, 'clientSecret')?.trim();
+    return tenantId && clientId && clientSecret ? { tenantId, clientId, clientSecret } : undefined;
+}
+function rolesOf(token) {
+    const payload = (0, n8n_workflow_1.jsonParse)(Buffer.from(token.split('.')[1] ?? '', 'base64url').toString('utf8'), { fallbackValue: {} });
+    const roles = (0, is_record_1.isRecord)(payload) ? payload.roles : undefined;
+    return Array.isArray(roles)
+        ? roles.filter((role) => typeof role === 'string')
+        : [];
+}
 //# sourceMappingURL=teams-credential-check.service.js.map

package/dist/modules/agents/integrations/platforms/teams/teams-credential-check.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"teams-credential-check.service.js","sourceRoot":"","sources":["../../../../../../src/modules/agents/integrations/platforms/teams/teams-credential-check.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,wDAA6C;AAC7C,0DAAoD;AAEpD,gCAAkC;AAClC,2FAAqF;AACrF,mEAA2D;AAE3D,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAGlE,MAAM,mBAAmB,GAAG,uCAAuC,CAAC;AAGpE,MAAM,yBAAyB,GAAG,6BAA6B,CAAC;AAMhE,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAGzB,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IACvC,YACkB,gBAA8C,EAC9C,YAA0B,EAC1B,MAAc;gCAFd,gBAAgB;4BAChB,YAAY;sBACZ,MAAM;IACrB,CAAC;IAOJ,KAAK,CAAC,KAAK,CAAC,IAAU,EAAE,SAAiB,EAAE,YAAoB;QAG9D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CACtD,IAAI,EACJ,SAAS,EACT,YAAY,EACZ,qBAAqB,CACrB,CAAC;QACF,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAI7D,IAAI,IAAA,oCAAc,EAAC,IAAI,EAAE,gBAAgB,CAAC,KAAK,aAAa,EAAE,CAAC;YAC9D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACpD,CAAC;QAID,MAAM,eAAe,GAAG,IAAA,oCAAc,EAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAChE,IAAI,eAAe,IAAI,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,yBAAyB,EAAE,CAAC;YAC1F,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9C,CAAC;QAID,MAAM,QAAQ,GAAG,IAAA,oCAAc,EAAC,IAAI,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAA,oCAAc,EAAC,IAAI,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC;QAC1D,MAAM,YAAY,GAAG,IAAA,oCAAc,EAAC,IAAI,EAAE,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;QAClE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QACnD,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY;iBAEtC,QAAQ,CAAC,EAAE,oBAAoB,EAAE,QAAQ,EAAE,CAAC;iBAC5C,OAAO,CAAC;gBACR,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,qCAAqC,kBAAkB,CAAC,QAAQ,CAAC,oBAAoB;gBAC1F,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;oBACzB,UAAU,EAAE,oBAAoB;oBAChC,SAAS,EAAE,QAAQ;oBACnB,aAAa,EAAE,YAAY;oBAC3B,KAAK,EAAE,mBAAmB;iBAC1B,CAAC,CAAC,QAAQ,EAAE;gBACb,kBAAkB,EAAE,IAAI;gBACxB,sBAAsB,EAAE,IAAI;gBAC5B,OAAO,EAAE,gBAAgB;aACzB,CAAC,CAAC;YAEJ,MAAM,IAAI,GAAY,QAAQ,CAAC,IAAI,CAAC;YACpC,MAAM,KAAK,GAAG,IAAA,oCAAc,EAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACnD,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,IAAI,KAAK;gBAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAElE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yDAAyD,EAAE;gBAC5E,UAAU,EAAE,QAAQ,CAAC,UAAU;aAC/B,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACjF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACpD,CAAC;IACF,CAAC;CACD,CAAA;;sCA7EY,2BAA2B;IADvC,IAAA,YAAO,GAAE;qCAG2B,8DAA4B,EAChC,8BAAY,EAClB,uBAAM;GAJpB,2BAA2B,CA6EvC"}
+{"version":3,"file":"teams-credential-check.service.js","sourceRoot":"","sources":["../../../../../../src/modules/agents/integrations/platforms/teams/teams-credential-check.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,wDAA6C;AAC7C,0DAAoD;AAEpD,gCAAkC;AAClC,oDAAgD;AAChD,+CAAyC;AAEzC,2FAAqF;AACrF,mEAA2D;AAC3D,uEAA4D;AAE5D,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAGlE,MAAM,mBAAmB,GAAG,uCAAuC,CAAC;AAGpE,MAAM,WAAW,GAAG,sCAAsC,CAAC;AAG3D,MAAM,yBAAyB,GAAG,6BAA6B,CAAC;AAMhE,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAGzB,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IACvC,YACkB,gBAA8C,EAC9C,YAA0B,EAC1B,MAAc;gCAFd,gBAAgB;4BAChB,YAAY;sBACZ,MAAM;IACrB,CAAC;IAOJ,KAAK,CAAC,KAAK,CAAC,IAAU,EAAE,SAAiB,EAAE,YAAoB;QAG9D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CACtD,IAAI,EACJ,SAAS,EACT,YAAY,EACZ,qBAAqB,CACrB,CAAC;QACF,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAI7D,IAAI,IAAA,oCAAc,EAAC,IAAI,EAAE,gBAAgB,CAAC,KAAK,aAAa,EAAE,CAAC;YAC9D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACpD,CAAC;QAID,MAAM,eAAe,GAAG,IAAA,oCAAc,EAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAChE,IAAI,eAAe,IAAI,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,yBAAyB,EAAE,CAAC;YAC1F,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAE/D,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;YACtE,IAAI,QAAQ,CAAC,KAAK;gBAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAE5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yDAAyD,EAAE;gBAC5E,UAAU,EAAE,QAAQ,CAAC,UAAU;aAC/B,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACjF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACpD,CAAC;IACF,CAAC;IAMD,KAAK,CAAC,eAAe,CACpB,IAAU,EACV,SAAiB,EACjB,YAAoB;QAEpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CACtD,IAAI,EACJ,SAAS,EACT,YAAY,EACZ,qBAAqB,CACrB,CAAC;QACF,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAE1C,IAAI,CAAC;YACJ,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAC/D,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/B,MAAM,QAAQ,GAAG,yCAAe,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;YACzF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kEAAkE,EAAE;gBACrF,KAAK;aACL,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC9B,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,YAAY,CACzB,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAgB,EAClD,KAAa;QAEb,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY;aAEtC,QAAQ,CAAC,EAAE,oBAAoB,EAAE,QAAQ,EAAE,CAAC;aAC5C,OAAO,CAAC;YACR,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,qCAAqC,kBAAkB,CAAC,QAAQ,CAAC,oBAAoB;YAC1F,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,QAAQ;gBACnB,aAAa,EAAE,YAAY;gBAC3B,KAAK;aACL,CAAC,CAAC,QAAQ,EAAE;YACb,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,IAAI;YAC5B,OAAO,EAAE,gBAAgB;SACzB,CAAC,CAAC;QACJ,MAAM,IAAI,GAAY,QAAQ,CAAC,IAAI,CAAC;QACpC,MAAM,KAAK,GAAG,IAAA,oCAAc,EAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACnD,OAAO;YACN,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,KAAK,EAAE,QAAQ,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SACtD,CAAC;IACH,CAAC;CACD,CAAA;;sCAjHY,2BAA2B;IADvC,IAAA,YAAO,GAAE;qCAG2B,8DAA4B,EAChC,8BAAY,EAClB,uBAAM;GAJpB,2BAA2B,CAiHvC;AASD,SAAS,cAAc,CAAC,IAAa;IACpC,MAAM,QAAQ,GAAG,IAAA,oCAAc,EAAC,IAAI,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAA,oCAAc,EAAC,IAAI,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAA,oCAAc,EAAC,IAAI,EAAE,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;IAClE,OAAO,QAAQ,IAAI,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChG,CAAC;AAMD,SAAS,OAAO,CAAC,KAAa;IAC7B,MAAM,OAAO,GAAY,IAAA,wBAAS,EACjC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EACpE,EAAE,aAAa,EAAE,EAAE,EAAE,CACrB,CAAC;IACF,MAAM,KAAK,GAAG,IAAA,oBAAQ,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,EAAE,CAAC;AACP,CAAC"}

package/dist/modules/agents/integrations/platforms/teams/teams-credential-notes.service.d.ts

@@ -0,0 +1,11 @@
+import { Logger } from '@n8n/backend-common';
+import { CredentialsFinderService } from '@n8n/backend-services';
+import type { User } from '@n8n/db';
+import { CredentialsService } from '../../../../../credentials/credentials.service';
+export declare class TeamsCredentialNotesService {
+    private readonly credentialsFinderService;
+    private readonly credentialsService;
+    private readonly logger;
+    constructor(credentialsFinderService: CredentialsFinderService, credentialsService: CredentialsService, logger: Logger);
+    write(user: User, credentialId: string, notes: Record<string, string>): Promise<void>;
+}

package/dist/modules/agents/integrations/platforms/teams/teams-credential-notes.service.js

@@ -0,0 +1,58 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TeamsCredentialNotesService = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const backend_services_1 = require("@n8n/backend-services");
+const di_1 = require("@n8n/di");
+const credentials_service_1 = require("../../../../../credentials/credentials.service");
+const teams_entra_provisioning_service_1 = require("./teams-entra-provisioning.service");
+const integration_helpers_1 = require("../../integration-helpers");
+let TeamsCredentialNotesService = class TeamsCredentialNotesService {
+    constructor(credentialsFinderService, credentialsService, logger) {
+        this.credentialsFinderService = credentialsFinderService;
+        this.credentialsService = credentialsService;
+        this.logger = logger;
+    }
+    async write(user, credentialId, notes) {
+        try {
+            const credential = await this.credentialsFinderService.findCredentialForUser(credentialId, user, ['credential:update']);
+            if (credential?.type !== teams_entra_provisioning_service_1.BOT_CREDENTIAL_TYPE)
+                return;
+            const current = await this.credentialsService.decrypt(credential, true);
+            if (!(0, integration_helpers_1.stringProperty)(current, 'clientId'))
+                return;
+            if (Object.entries(notes).every(([key, value]) => current[key] === value))
+                return;
+            const updated = { ...current, ...notes };
+            const encrypted = await this.credentialsService.createEncryptedData({
+                id: credential.id,
+                name: credential.name,
+                type: credential.type,
+                data: updated,
+            });
+            await this.credentialsService.update(credential.id, encrypted, { kind: 'user', user }, updated);
+        }
+        catch (error) {
+            this.logger.warn('[Teams] Could not write a note on the channel credential', {
+                credentialId,
+                notes: Object.keys(notes),
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+};
+exports.TeamsCredentialNotesService = TeamsCredentialNotesService;
+exports.TeamsCredentialNotesService = TeamsCredentialNotesService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [backend_services_1.CredentialsFinderService, credentials_service_1.CredentialsService, backend_common_1.Logger])
+], TeamsCredentialNotesService);
+//# sourceMappingURL=teams-credential-notes.service.js.map

package/dist/modules/agents/integrations/platforms/teams/teams-credential-notes.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams-credential-notes.service.js","sourceRoot":"","sources":["../../../../../../src/modules/agents/integrations/platforms/teams/teams-credential-notes.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;AAC7C,4DAAiE;AAEjE,gCAAkC;AAElC,2EAAuE;AAEvE,yFAAyE;AACzE,mEAA2D;AAQpD,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IACvC,YACkB,wBAAkD,EAClD,kBAAsC,EACtC,MAAc;wCAFd,wBAAwB;kCACxB,kBAAkB;sBAClB,MAAM;IACrB,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,IAAU,EAAE,YAAoB,EAAE,KAA6B;QAC1E,IAAI,CAAC;YACJ,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,qBAAqB,CAC3E,YAAY,EACZ,IAAI,EACJ,CAAC,mBAAmB,CAAC,CACrB,CAAC;YACF,IAAI,UAAU,EAAE,IAAI,KAAK,sDAAmB;gBAAE,OAAO;YAErD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAExE,IAAI,CAAC,IAAA,oCAAc,EAAC,OAAO,EAAE,UAAU,CAAC;gBAAE,OAAO;YACjD,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC;gBAAE,OAAO;YAElF,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,mBAAmB,CAAC;gBACnE,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,IAAI,EAAE,OAAO;aACb,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CACnC,UAAU,CAAC,EAAE,EACb,SAAS,EACT,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EACtB,OAAO,CACP,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0DAA0D,EAAE;gBAC5E,YAAY;gBACZ,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;gBACzB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7D,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;CACD,CAAA;;sCA1CY,2BAA2B;IADvC,IAAA,YAAO,GAAE;qCAGmC,2CAAwB,EAC9B,wCAAkB,EAC9B,uBAAM;GAJpB,2BAA2B,CA0CvC"}