n8n
Version:
n8n Workflow Automation Tool
82 lines • 3.58 kB
JavaScript
;
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
return c > 3 && r && Object.defineProperty(target, key, r), r;
};
var __metadata = (this && this.__metadata) || function (k, v) {
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.ApiKeyAuthStrategy = void 0;
const db_1 = require("@n8n/db");
const di_1 = require("@n8n/di");
const jsonwebtoken_1 = require("jsonwebtoken");
const jwt_service_1 = require("./jwt.service");
const public_api_key_service_1 = require("./public-api-key.service");
const API_KEY_HEADER = 'x-n8n-api-key';
let ApiKeyAuthStrategy = class ApiKeyAuthStrategy {
constructor(apiKeyRepository, jwtService) {
this.apiKeyRepository = apiKeyRepository;
this.jwtService = jwtService;
}
async buildTokenGrant(token, options) {
if (typeof token !== 'string' || !token)
return null;
const issuer = options?.issuer ?? public_api_key_service_1.API_KEY_ISSUER;
const audience = options?.audience ?? public_api_key_service_1.API_KEY_AUDIENCE;
if (!token.startsWith(public_api_key_service_1.PREFIX_LEGACY_API_KEY)) {
const decoded = this.jwtService.decode(token);
if (decoded === null)
return false;
if (decoded.iss !== issuer)
return null;
}
const apiKeyRecord = await this.apiKeyRepository.findOne({
where: { apiKey: token, audience },
relations: { user: { role: true } },
});
if (!apiKeyRecord?.user)
return false;
if (apiKeyRecord.user.disabled)
return false;
if (!token.startsWith(public_api_key_service_1.PREFIX_LEGACY_API_KEY)) {
try {
this.jwtService.verify(token, {
issuer,
audience,
});
}
catch (e) {
if (e instanceof jsonwebtoken_1.TokenExpiredError)
return false;
throw e;
}
}
return {
scopes: apiKeyRecord.user.role.scopes.map((s) => s.slug),
subject: apiKeyRecord.user,
apiKeyScopes: apiKeyRecord.scopes ?? [],
};
}
async authenticate(req) {
const providedApiKey = req.headers[API_KEY_HEADER];
if (typeof providedApiKey !== 'string' || !providedApiKey)
return null;
const tokenGrant = await this.buildTokenGrant(providedApiKey);
if (tokenGrant === false || tokenGrant === null) {
return tokenGrant;
}
req.user = tokenGrant.subject;
req.tokenGrant = tokenGrant;
return true;
}
};
exports.ApiKeyAuthStrategy = ApiKeyAuthStrategy;
exports.ApiKeyAuthStrategy = ApiKeyAuthStrategy = __decorate([
(0, di_1.Service)(),
__metadata("design:paramtypes", [db_1.ApiKeyRepository,
jwt_service_1.JwtService])
], ApiKeyAuthStrategy);
//# sourceMappingURL=api-key-auth.strategy.js.map