chore(core): Implement identifiers for resolvers

[afitzek]

Summary

Implements OAuth2 token introspection (RFC 7662) for dynamic credential resolution. The implementation validates and extracts unique identifiers from access tokens using the OAuth2 introspection endpoint, with support for both client_secret_basic and client_secret_post authentication methods. Includes intelligent caching with TTL bounds based on token expiration and comprehensive test coverage.

Related Linear tickets, Github issues, and Community forum posts

closes https://linear.app/n8n/issue/PAY-4226/implement-oauth-token-introspection

Review / Merge checklist

• PR title and summary are descriptive. (conventions)
• Docs updated or follow-up ticket created.
• Tests included.
• PR Labeled with release/backport (if the PR is an urgent fix that needs to be backported)

[codecov]

Codecov Report

❌ Patch coverage is 71.53846% with 37 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...ers/identifiers/oauth2-introspection-identifier.ts	70.16%	37 Missing ⚠️

📢 Thoughts on this report? Let us know!

[currents-bot]

✅

E2E Tests: n8n tests passed after 11m 8s

🟢 573 · 🔴 0 · ⚪️ 37 · 🟣 3

View Run Details

Run Details

• Project: n8n

• Groups: 2

• Framework: Playwright

• Run Status: Passed

• Commit: f67aa29

• Spec files: 122

• Overall tests: 610

• Duration: 11m 8s

• Parallelization: 9

Groups

GroupId	Results	Spec Files Progress
multi-main:ui	🟢 519 · 🔴 0 · ⚪️ 37 · 🟣 3	114 / 114
multi-main:ui:isolated	🟢 54 · 🔴 0 · ⚪️ 0	8 / 8

---

This message was posted automatically by currents.dev | Integration Settings

[cubic-dev-ai]

1 issue found across 5 files

Prompt for AI agents (all 1 issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/cli/src/modules/dynamic-credentials.ee/credential-resolvers/identifiers/oauth2-introspection-identifier.ts">

<violation number="1" location="packages/cli/src/modules/dynamic-credentials.ee/credential-resolvers/identifiers/oauth2-introspection-identifier.ts:179">
P2: RFC 6749 Section 2.3.1 requires URL-encoding client credentials before base64 encoding for HTTP Basic authentication. Special characters in `clientId` or `clientSecret` could cause authentication failures.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}