n8n 2.44.5 → 2.45.1

package/dist/modules/inbound-auth-core/public-api-oauth.strategy.js

@@ -0,0 +1,71 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PublicApiOAuthStrategy = void 0;
+const db_1 = require("@n8n/db");
+const di_1 = require("@n8n/di");
+const inbound_auth_1 = require("@n8n/inbound-auth");
+const permissions_1 = require("@n8n/permissions");
+const backend_services_1 = require("@n8n/backend-services");
+const public_api_protected_resource_1 = require("./public-api-protected-resource");
+const isApiKeyScopeName = (scope) => (0, permissions_1.isApiKeyScope)(scope);
+let PublicApiOAuthStrategy = class PublicApiOAuthStrategy {
+    constructor(resource, admission, jwtService, userRepository) {
+        this.resource = resource;
+        this.admission = admission;
+        this.jwtService = jwtService;
+        this.userRepository = userRepository;
+    }
+    async buildTokenGrant() {
+        return null;
+    }
+    isOAuthIssuer(token) {
+        const iss = this.jwtService.decodeUnverified(token)?.iss;
+        return typeof iss === 'string' && URL.canParse(iss) && /^https?:$/.test(new URL(iss).protocol);
+    }
+    async authenticate(req) {
+        const isAvailable = await this.resource.isAvailable();
+        if (!isAvailable) {
+            return null;
+        }
+        const extracted = (0, inbound_auth_1.extractBearer)((0, inbound_auth_1.inboundFrom)(this.resource, (0, inbound_auth_1.inboundRequestOf)(req)));
+        if (!extracted.ok || !this.isOAuthIssuer(extracted.value.credential.token)) {
+            return null;
+        }
+        const admitted = await this.admission.admit(this.resource, extracted.value);
+        if (!admitted.ok) {
+            req.res?.setHeader('WWW-Authenticate', await this.admission.challenge(admitted));
+            return false;
+        }
+        const user = await this.userRepository.findByIdWithRole(admitted.context.subject.id);
+        if (!user) {
+            return false;
+        }
+        const roleScopes = (0, permissions_1.getApiKeyScopesForRole)(user);
+        const requested = (admitted.context.tokenScopes ?? []).filter(isApiKeyScopeName);
+        req.user = user;
+        req.tokenGrant = {
+            scopes: user.role.scopes.map((scope) => scope.slug),
+            apiKeyScopes: requested.length > 0 ? roleScopes.filter((s) => requested.includes(s)) : roleScopes,
+            subject: user,
+        };
+        req.ctx = {
+            security: admitted.context,
+        };
+        return true;
+    }
+};
+exports.PublicApiOAuthStrategy = PublicApiOAuthStrategy;
+exports.PublicApiOAuthStrategy = PublicApiOAuthStrategy = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [public_api_protected_resource_1.PublicApiProtectedResource, inbound_auth_1.ResourceAdmission, backend_services_1.JwtService, db_1.UserRepository])
+], PublicApiOAuthStrategy);
+//# sourceMappingURL=public-api-oauth.strategy.js.map

package/dist/modules/inbound-auth-core/public-api-oauth.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-api-oauth.strategy.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/public-api-oauth.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,gCAAyC;AACzC,gCAAkC;AAClC,oDAAoG;AACpG,kDAK0B;AAG1B,4DAAmD;AAEnD,mFAA6E;AAG7E,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAwB,EAAE,CACjE,IAAA,2BAAa,EAAC,KAA4B,CAAC,CAAC;AAOtC,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAClC,YACkB,QAAoC,EACpC,SAA4B,EAC5B,UAAsB,EACtB,cAA8B;wBAH9B,QAAQ;yBACR,SAAS;0BACT,UAAU;8BACV,cAAc;IAC7B,CAAC;IAEJ,KAAK,CAAC,eAAe;QACpB,OAAO,IAAI,CAAC;IACb,CAAC;IAEO,aAAa,CAAC,KAAa;QAClC,MAAM,GAAG,GAAY,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAA2B,KAAK,CAAC,EAAE,GAAG,CAAC;QAC5F,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChG,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAyB;QAC3C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACtD,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACb,CAAC;QAGD,MAAM,SAAS,GAAG,IAAA,4BAAa,EAAC,IAAA,0BAAW,EAAC,IAAI,CAAC,QAAQ,EAAE,IAAA,+BAAgB,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5E,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACd,CAAC;QAID,MAAM,UAAU,GAAG,IAAA,oCAAsB,EAAC,IAAI,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACjF,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAChB,GAAG,CAAC,UAAU,GAAG;YAChB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;YACnD,YAAY,EACX,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU;YACpF,OAAO,EAAE,IAAI;SACb,CAAC;QACF,GAAG,CAAC,GAAG,GAAG;YACT,QAAQ,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;CACD,CAAA;;iCAxDY,sBAAsB;IADlC,IAAA,YAAO,GAAE;qCAGmB,0DAA0B,EACzB,gCAAiB,EAChB,6BAAU,EACN,mBAAc;GALpC,sBAAsB,CAwDlC"}

package/dist/modules/inbound-auth-core/public-api-protected-resource.d.ts

@@ -0,0 +1,21 @@
+import type { ConsentUiHints } from '@n8n/api-types';
+import { LicenseState } from '@n8n/backend-common';
+import { UrlService } from '@n8n/backend-services';
+import { GlobalConfig } from '@n8n/config';
+import type { ProtectedResource, ResourceUser } from '@n8n/inbound-auth';
+export declare class PublicApiProtectedResource implements ProtectedResource {
+    private readonly urlService;
+    private readonly globalConfig;
+    private readonly licenseState;
+    readonly id = "public-api";
+    readonly surface: 'public-api';
+    readonly displayName = "n8n public API";
+    readonly uiHints: ConsentUiHints;
+    readonly scopes: string[];
+    constructor(urlService: UrlService, globalConfig: GlobalConfig, licenseState: LicenseState);
+    getResourceUrl(): string;
+    getAudiences(): string[];
+    isAvailable(): Promise<boolean>;
+    authorize(): Promise<boolean>;
+    getGrantableScopes(user: ResourceUser): Promise<string[]>;
+}

package/dist/modules/inbound-auth-core/public-api-protected-resource.js

@@ -0,0 +1,51 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PublicApiProtectedResource = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const backend_services_1 = require("@n8n/backend-services");
+const config_1 = require("@n8n/config");
+const di_1 = require("@n8n/di");
+const permissions_1 = require("@n8n/permissions");
+let PublicApiProtectedResource = class PublicApiProtectedResource {
+    constructor(urlService, globalConfig, licenseState) {
+        this.urlService = urlService;
+        this.globalConfig = globalConfig;
+        this.licenseState = licenseState;
+        this.id = 'public-api';
+        this.surface = 'public-api';
+        this.displayName = 'n8n public API';
+        this.uiHints = { icon: 'key-round', consentType: 'api' };
+        this.scopes = [...permissions_1.ALL_API_KEY_SCOPES];
+    }
+    getResourceUrl() {
+        const baseUrl = this.urlService.getInstanceBaseUrl().replace(/\/$/, '');
+        return `${baseUrl}/${this.globalConfig.publicApi.path}/v1`;
+    }
+    getAudiences() {
+        return [this.getResourceUrl()];
+    }
+    async isAvailable() {
+        return !this.globalConfig.publicApi.disabled && !this.licenseState.isAPIDisabled();
+    }
+    async authorize() {
+        return await this.isAvailable();
+    }
+    async getGrantableScopes(user) {
+        return (0, permissions_1.getApiKeyScopesForRole)(user);
+    }
+};
+exports.PublicApiProtectedResource = PublicApiProtectedResource;
+exports.PublicApiProtectedResource = PublicApiProtectedResource = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [backend_services_1.UrlService, config_1.GlobalConfig, backend_common_1.LicenseState])
+], PublicApiProtectedResource);
+//# sourceMappingURL=public-api-protected-resource.js.map

package/dist/modules/inbound-auth-core/public-api-protected-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-api-protected-resource.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/public-api-protected-resource.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,wDAAmD;AACnD,4DAAmD;AACnD,wCAA2C;AAC3C,gCAAkC;AAElC,kDAA8E;AAIvE,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IAWtC,YACkB,UAAsB,EACtB,YAA0B,EAC1B,YAA0B;QAF1B,eAAU,GAAV,UAAU,CAAY;QACtB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,iBAAY,GAAZ,YAAY,CAAc;QAbnC,OAAE,GAAG,YAAY,CAAC;QAElB,YAAO,GAAG,YAAqB,CAAC;QAEhC,gBAAW,GAAG,gBAAgB,CAAC;QAE/B,YAAO,GAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAEpE,WAAM,GAAa,CAAC,GAAG,gCAAkB,CAAC,CAAC;IAMjD,CAAC;IAEJ,cAAc;QACb,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxE,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC;IAC5D,CAAC;IAED,YAAY;QACX,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,WAAW;QAChB,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,SAAS;QACd,OAAO,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,IAAkB;QAC1C,OAAO,IAAA,oCAAsB,EAAC,IAAI,CAAC,CAAC;IACrC,CAAC;CACD,CAAA;;qCArCY,0BAA0B;IADtC,IAAA,YAAO,GAAE;qCAaqB,6BAAU,EACR,qBAAY,EACZ,6BAAY;GAdhC,0BAA0B,CAqCtC"}

package/dist/modules/inbound-auth-core/resource-admission.d.ts

@@ -0,0 +1,12 @@
+import { Logger } from '@n8n/backend-common';
+import { AuthenticationPipeline, AuthenticationService, ResourceAdmission, type AdmissionResult, type Extracted, type Inbound, type ProtectedResource, type Refused } from '@n8n/inbound-auth';
+export declare class InboundResourceAdmission extends ResourceAdmission {
+    private readonly pipeline;
+    private readonly authenticationService;
+    private readonly logger;
+    constructor(pipeline: AuthenticationPipeline, authenticationService: AuthenticationService, logger: Logger);
+    admitBearer(resource: ProtectedResource, request: Omit<Inbound['request'], 'headers'>, token: string): Promise<AdmissionResult>;
+    admit(resource: ProtectedResource, extracted: Extracted): Promise<AdmissionResult>;
+    challenge({ advertised, reason }: Refused): Promise<string>;
+    private refuse;
+}

package/dist/modules/inbound-auth-core/resource-admission.js

@@ -0,0 +1,65 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InboundResourceAdmission = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const di_1 = require("@n8n/di");
+const inbound_auth_1 = require("@n8n/inbound-auth");
+let InboundResourceAdmission = class InboundResourceAdmission extends inbound_auth_1.ResourceAdmission {
+    constructor(pipeline, authenticationService, logger) {
+        super();
+        this.pipeline = pipeline;
+        this.authenticationService = authenticationService;
+        this.logger = logger;
+    }
+    async admitBearer(resource, request, token) {
+        const inbound = (0, inbound_auth_1.inboundFrom)(resource, { ...request, headers: {} });
+        if (!token)
+            return this.refuse(inbound, 'no-credential');
+        return await this.admit(resource, { ...inbound, credential: { kind: 'bearer', token } });
+    }
+    async admit(resource, extracted) {
+        const authenticated = await this.pipeline.run(extracted);
+        if (!authenticated.ok) {
+            return { ok: false, reason: authenticated.reason, advertised: advertisedOf(extracted) };
+        }
+        const context = authenticated.value;
+        if (!(await resource.authorize(context.subject))) {
+            return this.refuse(extracted, 'insufficient_scope', context);
+        }
+        return { ok: true, context };
+    }
+    async challenge({ advertised, reason }) {
+        const { challenges } = await this.authenticationService.advertise(advertised);
+        const error = reason === 'insufficient_scope' ? 'insufficient_scope' : 'invalid_token';
+        return `${challenges[0] ?? 'Bearer'}, error="${error}", error_description="${reason}"`;
+    }
+    refuse(inbound, reason, context) {
+        this.logger.warn('Inbound authentication denied', {
+            surface: inbound.surface,
+            resource: inbound.resource.url,
+            sourceId: context?.subjectClaim?.sourceId,
+            authMethod: context?.authMethod,
+            userId: context?.subject.id,
+            reason,
+        });
+        return { ok: false, reason, advertised: advertisedOf(inbound), ...(context && { context }) };
+    }
+};
+exports.InboundResourceAdmission = InboundResourceAdmission;
+exports.InboundResourceAdmission = InboundResourceAdmission = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [inbound_auth_1.AuthenticationPipeline, inbound_auth_1.AuthenticationService, backend_common_1.Logger])
+], InboundResourceAdmission);
+function advertisedOf({ surface, resource, acceptedSourceIds }) {
+    return { surface, resource, ...(acceptedSourceIds !== undefined && { acceptedSourceIds }) };
+}
+//# sourceMappingURL=resource-admission.js.map

package/dist/modules/inbound-auth-core/resource-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-admission.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/resource-admission.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;AAC7C,gCAAkC;AAClC,oDAY2B;AAKpB,IAAM,wBAAwB,GAA9B,MAAM,wBAAyB,SAAQ,gCAAiB;IAC9D,YACkB,QAAgC,EAChC,qBAA4C,EAC5C,MAAc;QAE/B,KAAK,EAAE,CAAC;wBAJS,QAAQ;qCACR,qBAAqB;sBACrB,MAAM;IAGxB,CAAC;IAED,KAAK,CAAC,WAAW,CAChB,QAA2B,EAC3B,OAA4C,EAC5C,KAAa;QAGb,MAAM,OAAO,GAAG,IAAA,0BAAW,EAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAA2B,EAAE,SAAoB;QAE5D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QACzF,CAAC;QAED,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC;QACpC,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAW;QAC9C,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,MAAM,KAAK,oBAAoB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,eAAe,CAAC;QACvF,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,QAAQ,YAAY,KAAK,yBAAyB,MAAM,GAAG,CAAC;IACxF,CAAC;IAMO,MAAM,CAAC,OAAgB,EAAE,MAAqB,EAAE,OAAyB;QAChF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YACjD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG;YAC9B,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ;YACzC,UAAU,EAAE,OAAO,EAAE,UAAU;YAC/B,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;YAC3B,MAAM;SACN,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC9F,CAAC;CACD,CAAA;;mCAvDY,wBAAwB;IADpC,IAAA,YAAO,GAAE;qCAGmB,qCAAsB,EACT,oCAAqB,EACpC,uBAAM;GAJpB,wBAAwB,CAuDpC;AAGD,SAAS,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAW;IACtE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;AAC7F,CAAC"}

package/dist/modules/inbound-auth-core/system-trusted-source.seeder.d.ts

@@ -1,48 +1,6 @@
 import { Logger } from '@n8n/backend-common';
 import { UrlService } from '@n8n/backend-services';
 import { TrustedSourceDbStore } from './trusted-source.store';
-export declare const SYSTEM_TRUSTED_SOURCE_ID = "n8n-internal";
-export declare const SYSTEM_TRUSTED_SOURCE_NAME = "n8n";
-export declare const SYSTEM_TRUSTED_SOURCE_CONFIG: {
-    version: 1;
-    authentication: {
-        type: "oauth2";
-        discovery: {
-            mode: "auto";
-        };
-        keys: {
-            kind: "local-keystore";
-        };
-        verification: {
-            mode: "jwt";
-        };
-        client: {
-            kind: "virtual";
-        };
-    };
-    surfaces: {
-        'public-api': {};
-        'instance-mcp': {};
-        trigger: {};
-    };
-    identity: {
-        subject: "n8n-user-id";
-        claimMapping: {
-            subject: string;
-            clientId: string;
-            scopes: string;
-        };
-        linkByEmail: "off";
-        provision: {
-            human: "off";
-        };
-        roleMapping: {
-            mode: "off";
-            instanceRoleRules: never[];
-            projectRoleRules: never[];
-        };
-    };
-};
 export declare class SystemTrustedSourceSeeder {
     private readonly store;
     private readonly urlService;

package/dist/modules/inbound-auth-core/system-trusted-source.seeder.js

@@ -9,31 +9,12 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SystemTrustedSourceSeeder = exports.SYSTEM_TRUSTED_SOURCE_CONFIG = exports.SYSTEM_TRUSTED_SOURCE_NAME = exports.SYSTEM_TRUSTED_SOURCE_ID = void 0;
+exports.SystemTrustedSourceSeeder = void 0;
 const backend_common_1 = require("@n8n/backend-common");
 const backend_services_1 = require("@n8n/backend-services");
 const di_1 = require("@n8n/di");
+const constants_1 = require("./constants");
 const trusted_source_store_1 = require("./trusted-source.store");
-exports.SYSTEM_TRUSTED_SOURCE_ID = 'n8n-internal';
-exports.SYSTEM_TRUSTED_SOURCE_NAME = 'n8n';
-exports.SYSTEM_TRUSTED_SOURCE_CONFIG = {
-    version: 1,
-    authentication: {
-        type: 'oauth2',
-        discovery: { mode: 'auto' },
-        keys: { kind: 'local-keystore' },
-        verification: { mode: 'jwt' },
-        client: { kind: 'virtual' },
-    },
-    surfaces: { 'public-api': {}, 'instance-mcp': {}, trigger: {} },
-    identity: {
-        subject: 'n8n-user-id',
-        claimMapping: { subject: 'sub', clientId: 'client_id', scopes: 'scope' },
-        linkByEmail: 'off',
-        provision: { human: 'off' },
-        roleMapping: { mode: 'off', instanceRoleRules: [], projectRoleRules: [] },
-    },
-};
 let SystemTrustedSourceSeeder = class SystemTrustedSourceSeeder {
     constructor(store, urlService, logger) {
         this.store = store;
@@ -44,12 +25,12 @@ let SystemTrustedSourceSeeder = class SystemTrustedSourceSeeder {
     async seed() {
         const issuer = this.urlService.getInstanceBaseUrl();
         const outcome = await this.store.seedSystemSource({
-            id: exports.SYSTEM_TRUSTED_SOURCE_ID,
-            name: exports.SYSTEM_TRUSTED_SOURCE_NAME,
+            id: constants_1.SYSTEM_TRUSTED_SOURCE_ID,
+            name: constants_1.SYSTEM_TRUSTED_SOURCE_NAME,
             issuer,
-            config: exports.SYSTEM_TRUSTED_SOURCE_CONFIG,
+            config: constants_1.SYSTEM_TRUSTED_SOURCE_CONFIG,
         });
-        const context = { id: exports.SYSTEM_TRUSTED_SOURCE_ID, issuer };
+        const context = { id: constants_1.SYSTEM_TRUSTED_SOURCE_ID, issuer };
         switch (outcome) {
             case 'inserted':
                 this.logger.info('Seeded the system trusted source', context);
@@ -61,7 +42,7 @@ let SystemTrustedSourceSeeder = class SystemTrustedSourceSeeder {
                 this.logger.debug('System trusted source is up to date', context);
                 break;
             case 'conflict':
-                this.logger.error('Could not seed the system trusted source: another trusted source holds its id, name or issuer', { ...context, name: exports.SYSTEM_TRUSTED_SOURCE_NAME });
+                this.logger.error('Could not seed the system trusted source: another trusted source holds its id, name or issuer', { ...context, name: constants_1.SYSTEM_TRUSTED_SOURCE_NAME });
                 break;
         }
     }

package/dist/modules/inbound-auth-core/system-trusted-source.seeder.js.map

@@ -1 +1 @@
-{"version":3,"file":"system-trusted-source.seeder.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/system-trusted-source.seeder.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;AAC7C,4DAAmD;AACnD,gCAAkC;AAGlC,iEAA8D;AAIjD,QAAA,wBAAwB,GAAG,cAAc,CAAC;AAC1C,QAAA,0BAA0B,GAAG,KAAK,CAAC;AACnC,QAAA,4BAA4B,GAAG;IAC3C,OAAO,EAAE,CAAC;IACV,cAAc,EAAE;QACf,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;QAChC,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;QAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KAC3B;IACD,QAAQ,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;IAC/D,QAAQ,EAAE;QACT,OAAO,EAAE,aAAa;QACtB,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;QACxE,WAAW,EAAE,KAAK;QAClB,SAAS,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QAC3B,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE;KACzE;CACkC,CAAC;AAc9B,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACrC,YACkB,KAA2B,EAC3B,UAAsB,EACtB,MAAc;qBAFd,KAAK;0BACL,UAAU;sBACV,MAAM;QAEvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAClD,CAAC;IAGD,KAAK,CAAC,IAAI;QACT,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACjD,EAAE,EAAE,QAAA,wBAAwB;YAC5B,IAAI,EAAE,QAAA,0BAA0B;YAChC,MAAM;YACN,MAAM,EAAE,QAAA,4BAA4B;SACpC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,EAAE,EAAE,QAAA,wBAAwB,EAAE,MAAM,EAAE,CAAC;QAEzD,QAAQ,OAAO,EAAE,CAAC;YACjB,KAAK,UAAU;gBACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,OAAO,CAAC,CAAC;gBAC9D,MAAM;YACP,KAAK,gBAAgB;gBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0DAA0D,EAAE,OAAO,CAAC,CAAC;gBACtF,MAAM;YACP,KAAK,WAAW;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,OAAO,CAAC,CAAC;gBAClE,MAAM;YACP,KAAK,UAAU;gBACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,+FAA+F,EAC/F,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,QAAA,0BAA0B,EAAE,CAChD,CAAC;gBACF,MAAM;QACR,CAAC;IACF,CAAC;CACD,CAAA;;oCAtCY,yBAAyB;IADrC,IAAA,YAAO,GAAE;qCAGgB,2CAAoB,EACf,6BAAU,EACd,uBAAM;GAJpB,yBAAyB,CAsCrC"}
+{"version":3,"file":"system-trusted-source.seeder.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/system-trusted-source.seeder.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;AAC7C,4DAAmD;AACnD,gCAAkC;AAElC,2CAIqB;AACrB,iEAA8D;AAcvD,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACrC,YACkB,KAA2B,EAC3B,UAAsB,EACtB,MAAc;qBAFd,KAAK;0BACL,UAAU;sBACV,MAAM;QAEvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAClD,CAAC;IAGD,KAAK,CAAC,IAAI;QACT,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACjD,EAAE,EAAE,oCAAwB;YAC5B,IAAI,EAAE,sCAA0B;YAChC,MAAM;YACN,MAAM,EAAE,wCAA4B;SACpC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,EAAE,EAAE,oCAAwB,EAAE,MAAM,EAAE,CAAC;QAEzD,QAAQ,OAAO,EAAE,CAAC;YACjB,KAAK,UAAU;gBACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,OAAO,CAAC,CAAC;gBAC9D,MAAM;YACP,KAAK,gBAAgB;gBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0DAA0D,EAAE,OAAO,CAAC,CAAC;gBACtF,MAAM;YACP,KAAK,WAAW;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,OAAO,CAAC,CAAC;gBAClE,MAAM;YACP,KAAK,UAAU;gBACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,+FAA+F,EAC/F,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,sCAA0B,EAAE,CAChD,CAAC;gBACF,MAAM;QACR,CAAC;IACF,CAAC;CACD,CAAA;;oCAtCY,yBAAyB;IADrC,IAAA,YAAO,GAAE;qCAGgB,2CAAoB,EACf,6BAAU,EACd,uBAAM;GAJpB,yBAAyB,CAsCrC"}

package/dist/modules/inbound-auth-core/trusted-source-directory.service.d.ts

@@ -0,0 +1,7 @@
+import { TrustedSourceStore } from '@n8n/inbound-auth';
+import type { TrustedSourceDirectory, TrustedSourceFilter, TrustedSourceOption } from 'n8n-workflow';
+export declare class TrustedSourceDbDirectory implements TrustedSourceDirectory {
+    private readonly store;
+    constructor(store: TrustedSourceStore);
+    listTrustedSources({ surface, capability, }: TrustedSourceFilter): Promise<TrustedSourceOption[]>;
+}

package/dist/modules/inbound-auth-core/trusted-source-directory.service.js

@@ -0,0 +1,32 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TrustedSourceDbDirectory = void 0;
+const di_1 = require("@n8n/di");
+const inbound_auth_1 = require("@n8n/inbound-auth");
+let TrustedSourceDbDirectory = class TrustedSourceDbDirectory {
+    constructor(store) {
+        this.store = store;
+    }
+    async listTrustedSources({ surface, capability, }) {
+        const sources = await this.store.listBySurface(surface);
+        return sources
+            .filter((source) => capability === undefined ||
+            (0, inbound_auth_1.deriveCapabilities)(source.config, source.metadata).has(capability))
+            .map(({ id, name }) => ({ id, name }));
+    }
+};
+exports.TrustedSourceDbDirectory = TrustedSourceDbDirectory;
+exports.TrustedSourceDbDirectory = TrustedSourceDbDirectory = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [inbound_auth_1.TrustedSourceStore])
+], TrustedSourceDbDirectory);
+//# sourceMappingURL=trusted-source-directory.service.js.map

package/dist/modules/inbound-auth-core/trusted-source-directory.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-source-directory.service.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/trusted-source-directory.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAAkC;AAClC,oDAA2E;AAapE,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACpC,YAA6B,KAAyB;qBAAzB,KAAK;IAAuB,CAAC;IAE1D,KAAK,CAAC,kBAAkB,CAAC,EACxB,OAAO,EACP,UAAU,GACW;QACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACxD,OAAO,OAAO;aACZ,MAAM,CACN,CAAC,MAAM,EAAE,EAAE,CACV,UAAU,KAAK,SAAS;YACxB,IAAA,iCAAkB,EAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CACnE;aACA,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;CACD,CAAA;;mCAhBY,wBAAwB;IADpC,IAAA,YAAO,GAAE;qCAE2B,iCAAkB;GAD1C,wBAAwB,CAgBpC"}

package/dist/modules/inbound-auth-core/trusted-source-discovery.task.d.ts

@@ -1,12 +1,11 @@
 import { SystemTask } from '@n8n/decorators';
-import type { SystemTaskEffects, SystemTaskPlacement, SystemTaskSchedule } from '@n8n/decorators';
+import type { SystemTaskSchedule } from '@n8n/decorators';
 import { TrustedSourceDiscoveryService } from './trusted-source-discovery.service';
 export declare class TrustedSourceDiscoveryTask implements SystemTask {
     private readonly discovery;
     readonly name = "trusted-source-discovery";
     readonly schedule: SystemTaskSchedule;
-    readonly effects: SystemTaskEffects;
-    readonly placement: SystemTaskPlacement;
+    readonly target: import("@n8n/decorators").ClusterTarget;
     constructor(discovery: TrustedSourceDiscoveryService);
     run(signal: AbortSignal): Promise<void>;
 }

package/dist/modules/inbound-auth-core/trusted-source-discovery.task.js

@@ -18,8 +18,7 @@ let TrustedSourceDiscoveryTask = class TrustedSourceDiscoveryTask {
         this.discovery = discovery;
         this.name = 'trusted-source-discovery';
         this.schedule = (0, decorators_1.intervalFromSeconds)(DISCOVERY_POLL_INTERVAL_SECONDS);
-        this.effects = 'idempotent';
-        this.placement = { scope: 'cluster', durable: true };
+        this.target = (0, decorators_1.clusterTarget)({ scheduler: { retryOnFailure: true } });
     }
     async run(signal) {
         await this.discovery.refreshDue(signal);

package/dist/modules/inbound-auth-core/trusted-source-discovery.task.js.map

@@ -1 +1 @@
-{"version":3,"file":"trusted-source-discovery.task.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/trusted-source-discovery.task.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gDAAkE;AAGlE,yFAAmF;AAGnF,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAOpC,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IAStC,YAA6B,SAAwC;QAAxC,cAAS,GAAT,SAAS,CAA+B;QAR5D,SAAI,GAAG,0BAA0B,CAAC;QAElC,aAAQ,GAAuB,IAAA,gCAAmB,EAAC,+BAA+B,CAAC,CAAC;QAEpF,YAAO,GAAsB,YAAY,CAAC;QAE1C,cAAS,GAAwB,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEN,CAAC;IAEzE,KAAK,CAAC,GAAG,CAAC,MAAmB;QAC5B,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;CACD,CAAA;;qCAdY,0BAA0B;IADtC,IAAA,uBAAU,GAAE;qCAU4B,gEAA6B;GATzD,0BAA0B,CActC"}
+{"version":3,"file":"trusted-source-discovery.task.js","sourceRoot":"","sources":["../../../src/modules/inbound-auth-core/trusted-source-discovery.task.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gDAAiF;AAGjF,yFAAmF;AAGnF,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAOpC,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IAOtC,YAA6B,SAAwC;QAAxC,cAAS,GAAT,SAAS,CAA+B;QAN5D,SAAI,GAAG,0BAA0B,CAAC;QAElC,aAAQ,GAAuB,IAAA,gCAAmB,EAAC,+BAA+B,CAAC,CAAC;QAEpF,WAAM,GAAG,IAAA,0BAAa,EAAC,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAED,CAAC;IAEzE,KAAK,CAAC,GAAG,CAAC,MAAmB;QAC5B,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;CACD,CAAA;;qCAZY,0BAA0B;IADtC,IAAA,uBAAU,GAAE;qCAQ4B,gEAA6B;GAPzD,0BAA0B,CAYtC"}

package/dist/modules/inbound-auth-core/trusted-source.controller.d.ts

@@ -0,0 +1,27 @@
+import { CreateTrustedSourceDto, UpdateTrustedSourceDto } from '@n8n/api-types';
+import { EventService } from '@n8n/backend-services';
+import { type AuthenticatedRequest } from '@n8n/db';
+import { type Capability, type TrustedSource } from '@n8n/inbound-auth';
+import type { Response } from 'express';
+import { TrustedSourceDiscoveryService } from './trusted-source-discovery.service';
+import { TrustedSourceDbStore } from './trusted-source.store';
+type TrustedSourceSummary = {
+    id: string;
+    name: string;
+    capabilities: Capability[];
+    surfaces: string[];
+};
+export declare class TrustedSourceController {
+    private readonly store;
+    private readonly discovery;
+    private readonly eventService;
+    constructor(store: TrustedSourceDbStore, discovery: TrustedSourceDiscoveryService, eventService: EventService);
+    list(): Promise<TrustedSourceSummary[]>;
+    get(_req: AuthenticatedRequest, _res: Response, id: string): Promise<TrustedSource>;
+    create(req: AuthenticatedRequest, _res: Response, dto: CreateTrustedSourceDto): Promise<TrustedSource>;
+    update(req: AuthenticatedRequest, _res: Response, id: string, dto: UpdateTrustedSourceDto): Promise<TrustedSource>;
+    delete(req: AuthenticatedRequest, _res: Response, id: string): Promise<void>;
+    check(_req: AuthenticatedRequest, _res: Response, id: string): Promise<TrustedSource>;
+    private require;
+}
+export {};