n8n
Version:
n8n Workflow Automation Tool
148 lines • 6.95 kB
JavaScript
;
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
return c > 3 && r && Object.defineProperty(target, key, r), r;
};
var __metadata = (this && this.__metadata) || function (k, v) {
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.OAuth2UserInfoIdentifier = exports.UserInfoResponseSchema = exports.OAuth2UserInfoOptionsSchema = void 0;
const backend_common_1 = require("@n8n/backend-common");
const constants_1 = require("@n8n/constants");
const di_1 = require("@n8n/di");
const zod_1 = require("zod");
const cache_service_1 = require("../../../../services/cache/cache.service");
const identifier_interface_1 = require("./identifier-interface");
const oauth2_metadata_http_client_1 = require("./oauth2-metadata-http-client");
const oauth2_utils_1 = require("./oauth2-utils");
const MIN_TOKEN_CACHE_TIMEOUT = 30 * constants_1.Time.seconds.toMilliseconds;
const MAX_TOKEN_CACHE_TIMEOUT = 5 * constants_1.Time.minutes.toMilliseconds;
const DEFAULT_CACHE_TIMEOUT = 60 * constants_1.Time.seconds.toMilliseconds;
exports.OAuth2UserInfoOptionsSchema = zod_1.z.object({
...oauth2_utils_1.OAuth2OptionsSchema.shape,
validation: zod_1.z.literal('oauth2-userinfo'),
});
const OAuth2MetadataSchema = zod_1.z.object({
issuer: zod_1.z.string().url(),
userinfo_endpoint: zod_1.z.string().url(),
});
exports.UserInfoResponseSchema = zod_1.z
.object({
sub: zod_1.z.string().optional(),
})
.passthrough();
const CACHE_PREFIX = 'oauth2-userinfo-identifier';
let OAuth2UserInfoIdentifier = class OAuth2UserInfoIdentifier {
constructor(logger, cache, http) {
this.logger = logger;
this.cache = cache;
this.http = http;
}
async validateOptions(identifierOptions) {
const options = this.parseOptions(identifierOptions);
let metadata;
try {
metadata = await this.fetchMetadata(options, true);
}
catch (error) {
if (error instanceof identifier_interface_1.IdentifierValidationError) {
throw error;
}
this.logger.error(`Failed to reach OAuth2 metadata URL ${options.metadataUri}`, {
error,
});
throw new identifier_interface_1.IdentifierValidationError(`Could not reach metadata URL: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
}
if (!metadata.userinfo_endpoint) {
this.logger.error('Metadata does not contain an userinfo endpoint');
throw new identifier_interface_1.IdentifierValidationError('Metadata does not contain an userinfo endpoint');
}
}
async resolve(context, identifierOptions) {
const options = this.parseOptions(identifierOptions);
const metadata = await this.fetchMetadata(options);
const hashedToken = (0, oauth2_utils_1.sha256)(context.identity);
const identifierCacheKey = `${CACHE_PREFIX}:subject:${metadata.issuer}:${hashedToken}`;
const cached = await this.cache.get(identifierCacheKey);
if (cached) {
return cached;
}
let ttl = DEFAULT_CACHE_TIMEOUT;
const { subject, ttl: ttlOverwrite } = await this.resolveBasedOnUserInfo(metadata, options, context);
if (ttlOverwrite) {
ttl = ttlOverwrite;
}
await this.cache.set(identifierCacheKey, subject, ttl);
return subject;
}
parseOptions(options) {
try {
return exports.OAuth2UserInfoOptionsSchema.parse(options);
}
catch (error) {
this.logger.error('Invalid OAuth2 identifier options', { error });
throw new identifier_interface_1.IdentifierValidationError('Invalid OAuth2 identifier options', {
cause: error,
});
}
}
async fetchMetadata(options, skipCache = false) {
return await this.http.fetchMetadata(OAuth2MetadataSchema, {
metadataUri: options.metadataUri,
cachePrefix: CACHE_PREFIX,
skipCache,
});
}
parseUserInfoResponse(data) {
try {
return exports.UserInfoResponseSchema.parse(data);
}
catch (error) {
this.logger.error('Invalid userinfo response format', { error });
throw new identifier_interface_1.IdentifierValidationError('Invalid userinfo response format');
}
}
async resolveBasedOnUserInfo(metadata, options, context) {
const response = await this.http.requestFull({
url: metadata.userinfo_endpoint,
method: 'GET',
headers: { authorization: `Bearer ${context.identity}` },
json: true,
});
if (response.statusCode !== 200) {
this.logger.error('UserInfo failed', {
status: response.statusCode,
data: response.body,
});
throw new identifier_interface_1.IdentifierValidationError('UserInfo query failed');
}
const userData = this.parseUserInfoResponse(response.body);
const subject = userData[options.subjectClaim];
if (!subject) {
this.logger.error(`UserInfo response missing subject claim (${options.subjectClaim})`);
throw new identifier_interface_1.IdentifierValidationError(`UserInfo response missing subject claim (${options.subjectClaim})`);
}
const subjectStr = String(subject);
this.logger.debug('UserInfo successfully', { subject: subjectStr });
let ttl = undefined;
if (userData.exp && typeof userData.exp === 'number') {
const expiresIn = userData.exp * 1000 - Date.now();
if (expiresIn > 0) {
ttl = Math.max(MIN_TOKEN_CACHE_TIMEOUT, Math.min(expiresIn, MAX_TOKEN_CACHE_TIMEOUT));
}
else {
ttl = MIN_TOKEN_CACHE_TIMEOUT;
}
}
return { subject: subjectStr, ttl };
}
};
exports.OAuth2UserInfoIdentifier = OAuth2UserInfoIdentifier;
exports.OAuth2UserInfoIdentifier = OAuth2UserInfoIdentifier = __decorate([
(0, di_1.Service)(),
__metadata("design:paramtypes", [backend_common_1.Logger, cache_service_1.CacheService, oauth2_metadata_http_client_1.OAuth2MetadataHttpClient])
], OAuth2UserInfoIdentifier);
//# sourceMappingURL=oauth2-userinfo-identifier.js.map