n8n
Version:
n8n Workflow Automation Tool
100 lines • 5.58 kB
JavaScript
;
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
return c > 3 && r && Object.defineProperty(target, key, r), r;
};
var __metadata = (this && this.__metadata) || function (k, v) {
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
};
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.OAuth2FlowService = void 0;
const errors_js_1 = require("@modelcontextprotocol/sdk/server/auth/errors.js");
const constants_1 = require("@n8n/constants");
const di_1 = require("@n8n/di");
const n8n_workflow_1 = require("n8n-workflow");
const node_crypto_1 = require("node:crypto");
const pkce_challenge_1 = __importDefault(require("pkce-challenge"));
const cache_service_1 = require("../../services/cache/cache.service");
const oauth_token_verifier_proxy_service_1 = require("../../services/oauth-token-verifier-proxy.service");
const protected_resource_registry_1 = require("../../services/protected-resource.registry");
const url_service_1 = require("../../services/url.service");
const oauth_server_service_1 = require("./oauth-server.service");
const FLOW_STATE_PREFIX = 'oauth-flow:';
const FLOW_STATE_TTL = 5 * constants_1.Time.minutes.toMilliseconds;
let OAuth2FlowService = class OAuth2FlowService {
constructor(oauthServerService, resourceRegistry, urlService, cacheService, tokenVerifier) {
this.oauthServerService = oauthServerService;
this.resourceRegistry = resourceRegistry;
this.urlService = urlService;
this.cacheService = cacheService;
this.tokenVerifier = tokenVerifier;
}
async begin(resourceUrl, metadata) {
const resource = await this.resourceRegistry.getByResourceUrl(resourceUrl);
if (!resource?.isFirstParty) {
throw new n8n_workflow_1.UserError(`Not a first-party protected resource: ${resourceUrl}`);
}
const { code_verifier, code_challenge } = await (0, pkce_challenge_1.default)();
const state = (0, node_crypto_1.randomBytes)(32).toString('hex');
await this.cacheService.set(FLOW_STATE_PREFIX + state, { codeVerifier: code_verifier, resourceUrl, metadata }, FLOW_STATE_TTL);
const url = new URL(`${this.urlService.getInstanceBaseUrl()}/oauth/authorize`);
url.searchParams.set('response_type', 'code');
url.searchParams.set('client_id', resourceUrl);
url.searchParams.set('redirect_uri', resourceUrl);
url.searchParams.set('resource', resourceUrl);
url.searchParams.set('code_challenge', code_challenge);
url.searchParams.set('code_challenge_method', 'S256');
url.searchParams.set('state', state);
return url.toString();
}
async complete(code, state) {
const cacheKey = FLOW_STATE_PREFIX + state;
const flow = await this.cacheService.get(cacheKey);
if (!flow)
return { valid: false, reason: 'invalid_state' };
await this.cacheService.delete(cacheKey);
const { codeVerifier, resourceUrl, metadata } = flow;
const client = await this.oauthServerService.clientsStore.getClient(resourceUrl);
if (!client)
return { valid: false, reason: 'invalid_client' };
try {
const challenge = await this.oauthServerService.challengeForAuthorizationCode(client, code);
if ((0, node_crypto_1.createHash)('sha256').update(codeVerifier).digest('base64url') !== challenge) {
return { valid: false, reason: 'invalid_grant' };
}
const tokens = await this.oauthServerService.exchangeAuthorizationCode(client, code, codeVerifier, resourceUrl, new URL(resourceUrl));
const result = await this.tokenVerifier.verifyOAuthAccessToken(tokens.access_token, resourceUrl);
if (!result.user) {
return { valid: false, reason: result.context?.reason ?? 'invalid_token' };
}
return {
valid: true,
token: tokens.access_token,
user: {
id: result.user.id,
email: result.user.email,
firstName: result.user.firstName,
lastName: result.user.lastName,
},
metadata,
};
}
catch (error) {
if (error instanceof errors_js_1.InvalidGrantError) {
return { valid: false, reason: 'invalid_grant' };
}
throw error;
}
}
};
exports.OAuth2FlowService = OAuth2FlowService;
exports.OAuth2FlowService = OAuth2FlowService = __decorate([
(0, di_1.Service)(),
__metadata("design:paramtypes", [oauth_server_service_1.OAuthServerService, protected_resource_registry_1.ProtectedResourceRegistry, url_service_1.UrlService, cache_service_1.CacheService, oauth_token_verifier_proxy_service_1.OAuthTokenVerifierProxy])
], OAuth2FlowService);
//# sourceMappingURL=oauth-flow.service.js.map