@dereekb/dbx-firebase 13.28.0 → 13.29.0

package/fesm2022/dereekb-dbx-firebase-oidc.mjs

@@ -6,7 +6,7 @@ import { readableError, SPACE_STRING_SPLIT_JOIN, separateValues, generatePkceCod
 import { DbxInjectionComponent, DbxActionDirective, DbxActionHandlerDirective, DbxActionValueDirective, DbxActionButtonDirective, DBX_INJECTION_COMPONENT_DATA, DbxRouterService, clean, dbxRouteParamReaderInstance, completeOnDestroy, DbxActionEnforceModifiedDirective, DbxAppAuthRouterService } from '@dereekb/dbx-core';
 import { of, map, first, switchMap, tap, BehaviorSubject } from 'rxjs';
 import * as i1$1 from '@dereekb/dbx-form';
-import { dbxForgeListSelectionField, AbstractConfigAsyncForgeFormDirective, DbxForgeFormComponentImportsModule, dbxForgeFormComponentProviders, DBX_FORGE_FORM_COMPONENT_TEMPLATE, DbxActionFormDirective, dbxForgeValueSelectionField, dbxForgeTextField, dbxForgeSearchableStringChipField, isWebsiteUrlValidator, dbxForgeContainer, dbxForgePickableChipField, pickableValueFieldValuesConfigForStaticLabeledValues, DbxFormSourceDirective, DbxFormValueChangeDirective } from '@dereekb/dbx-form';
+import { dbxForgeListSelectionField, AbstractConfigAsyncForgeFormDirective, DbxForgeFormComponentImportsModule, dbxForgeFormComponentProviders, DBX_FORGE_FORM_COMPONENT_TEMPLATE, DbxActionFormDirective, dbxForgePickableChipField, pickableValueFieldValuesConfigForStaticLabeledValues, dbxForgeValueSelectionField, dbxForgeTextField, dbxForgeSearchableStringChipField, isWebsiteUrlValidator, dbxForgeContainer, DbxFormSourceDirective, DbxFormValueChangeDirective } from '@dereekb/dbx-form';
 import { successResult } from '@dereekb/rxjs';
 import { toSignal } from '@angular/core/rxjs-interop';
 import { DbxFirebaseAuthService, AbstractDbxFirebaseDocumentStore, firebaseDocumentStoreCreateFunction, firebaseDocumentStoreUpdateFunction, firebaseDocumentStoreDeleteFunction, AbstractDbxFirebaseCollectionStore, DbxFirebaseCollectionStoreDirective, provideDbxFirebaseCollectionStoreDirective, DbxFirebaseCollectionListDirective, DbxFirebaseCollectionChangeDirective, DbxFirebaseDocumentStoreDirective, provideDbxFirebaseDocumentStoreDirective } from '@dereekb/dbx-firebase';
@@ -480,6 +480,7 @@ const DEFAULT_OIDC_CLIENT_NAME_PARAM_KEY = 'client_name';
 const DEFAULT_OIDC_CLIENT_URI_PARAM_KEY = 'client_uri';
 const DEFAULT_OIDC_LOGO_URI_PARAM_KEY = 'logo_uri';
 const DEFAULT_OIDC_SCOPES_PARAM_KEY = 'scopes';
+const DEFAULT_OIDC_REQUIRED_SCOPES_PARAM_KEY = 'requiredScopes';
 const DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS = ['client_secret_post', 'client_secret_basic'];
 /**
  * Abstract configuration class used as a DI token for app-level OIDC settings.
@@ -487,6 +488,11 @@ const DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS = ['client_secret_post', 'client_
  * Apps provide a concrete implementation via `provideDbxFirebaseOidc()`.
  */
 class DbxFirebaseOidcConfig {
+    /**
+     * Available provider profiles for admin assignment on the client form. When set, the client form
+     * renders a provider-profile multi-select. Leave unset when the app defines no provider profiles.
+     */
+    availableProviderProfiles;
     /**
      * Optional API origin (scheme + host, e.g. `https://api.example.com`) prepended to the OIDC
      * authorization and interaction endpoint paths when set.
@@ -543,6 +549,9 @@ class DbxFirebaseOidcConfigService {
     get availableScopes() {
         return this.config.availableScopes;
     }
+    get availableProviderProfiles() {
+        return this.config.availableProviderProfiles;
+    }
     get oidcAuthorizationEndpointApiPath() {
         const origin = this.config.oidcApiOrigin ?? '';
         return `${origin}${this.config.oidcAuthorizationEndpointApiPath ?? DEFAULT_OIDC_AUTHORIZATION_ENDPOINT_PATH}`;
@@ -841,6 +850,7 @@ class DbxOAuthConsentComponent {
     clientUriParamReader = dbxRouteParamReaderInstance(this.dbxRouterService, DEFAULT_OIDC_CLIENT_URI_PARAM_KEY);
     logoUriParamReader = dbxRouteParamReaderInstance(this.dbxRouterService, DEFAULT_OIDC_LOGO_URI_PARAM_KEY);
     scopesParamReader = dbxRouteParamReaderInstance(this.dbxRouterService, DEFAULT_OIDC_SCOPES_PARAM_KEY);
+    requiredScopesParamReader = dbxRouteParamReaderInstance(this.dbxRouterService, DEFAULT_OIDC_REQUIRED_SCOPES_PARAM_KEY);
     // Signals from route params
     routeUid = toSignal(this.interactionUidParamReader.value$);
     routeClientId = toSignal(this.clientIdParamReader.value$);
@@ -848,6 +858,7 @@ class DbxOAuthConsentComponent {
     routeClientUri = toSignal(this.clientUriParamReader.value$);
     routeLogoUri = toSignal(this.logoUriParamReader.value$);
     routeScopes = toSignal(this.scopesParamReader.value$);
+    routeRequiredScopes = toSignal(this.requiredScopesParamReader.value$);
     // Auth state — undefined until Firebase resolves to avoid a flash between 'unknown' → 'no_user'/'user'
     isLoggedIn = toSignal(this.dbxFirebaseAuthService.isLoggedIn$);
     // Resolved values
@@ -871,10 +882,15 @@ class DbxOAuthConsentComponent {
         componentClass: this.config()?.consentScopeListViewClass ?? this.oidcConfigService.consentScopeListViewClass ?? DbxFirebaseOAuthConsentScopeDefaultViewComponent
     }), ...(ngDevMode ? [{ debugName: "scopeInjectionConfigSignal" }] : /* istanbul ignore next */ []));
     /**
-     * Scopes the user cannot deselect. Forwarded to the view, which shows
-     * them as a static "Always granted" hint above the selection list.
+     * Scopes the user cannot deselect. `openid` is always required; any scopes the client's assigned
+     * provider profiles force-require are appended (the server surfaces them via the `requiredScopes`
+     * interaction param). Forwarded to the view, which shows them as a static "Always granted" hint
+     * above the selection list.
      */
-    requiredScopes = OAUTH_CONSENT_REQUIRED_SCOPES;
+    requiredScopesSignal = computed(() => {
+        const serverRequiredScopes = (this.routeRequiredScopes() ?? '').split(' ').filter(Boolean);
+        return Array.from(new Set([...OAUTH_CONSENT_REQUIRED_SCOPES, ...serverRequiredScopes]));
+    }, ...(ngDevMode ? [{ debugName: "requiredScopesSignal" }] : /* istanbul ignore next */ []));
     consentStateCaseSignal = computed(() => {
         const isLoggedIn = this.isLoggedIn();
         let result;
@@ -896,6 +912,7 @@ class DbxOAuthConsentComponent {
         this.clientUriParamReader.destroy();
         this.logoUriParamReader.destroy();
         this.scopesParamReader.destroy();
+        this.requiredScopesParamReader.destroy();
     }
     /**
      * Handles the Approve action. Pulls the form's selected scope array
@@ -940,7 +957,7 @@ class DbxOAuthConsentComponent {
     };
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.11", ngImport: i0, type: DbxOAuthConsentComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
     static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.1.0", version: "21.2.11", type: DbxOAuthConsentComponent, isStandalone: true, selector: "dbx-firebase-oauth-consent", inputs: { config: { classPropertyName: "config", publicName: "config", isSignal: true, isRequired: false, transformFunction: null } }, host: { classAttribute: "d-block dbx-firebase-oauth-consent" }, ngImport: i0, template: `
-    <dbx-firebase-oauth-consent-view [details]="resolvedDetailsSignal()" [consentStateCase]="consentStateCaseSignal()" [scopeInjectionConfig]="scopeInjectionConfigSignal()" [requiredScopes]="requiredScopes" [approveHandler]="handleApprove" [denyHandler]="handleDeny">
+    <dbx-firebase-oauth-consent-view [details]="resolvedDetailsSignal()" [consentStateCase]="consentStateCaseSignal()" [scopeInjectionConfig]="scopeInjectionConfigSignal()" [requiredScopes]="requiredScopesSignal()" [approveHandler]="handleApprove" [denyHandler]="handleDeny">
       <ng-content />
     </dbx-firebase-oauth-consent-view>
   `, isInline: true, dependencies: [{ kind: "component", type: DbxFirebaseOAuthConsentViewComponent, selector: "dbx-firebase-oauth-consent-view", inputs: ["details", "consentStateCase", "scopeInjectionConfig", "requiredScopes", "approveHandler", "denyHandler"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
@@ -952,7 +969,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.11", ngImpo
                     standalone: true,
                     imports: [DbxFirebaseOAuthConsentViewComponent],
                     template: `
-    <dbx-firebase-oauth-consent-view [details]="resolvedDetailsSignal()" [consentStateCase]="consentStateCaseSignal()" [scopeInjectionConfig]="scopeInjectionConfigSignal()" [requiredScopes]="requiredScopes" [approveHandler]="handleApprove" [denyHandler]="handleDeny">
+    <dbx-firebase-oauth-consent-view [details]="resolvedDetailsSignal()" [consentStateCase]="consentStateCaseSignal()" [scopeInjectionConfig]="scopeInjectionConfigSignal()" [requiredScopes]="requiredScopesSignal()" [approveHandler]="handleApprove" [denyHandler]="handleDeny">
       <ng-content />
     </dbx-firebase-oauth-consent-view>
   `,
@@ -977,8 +994,31 @@ function oidcEntryClientForgeFormFields(config) {
         fields.push(oidcClientTokenEndpointAuthMethodForgeField(config));
     }
     fields.push(...oidcEntryClientUpdateForgeFormFields());
+    if (config?.providerProfiles?.length) {
+        fields.push(oidcClientProviderProfilesForgeField(config.providerProfiles));
+    }
     return { fields };
 }
+/**
+ * Creates a forge pickable chip field for assigning provider profiles to the client.
+ *
+ * Admin-only in effect: the server strips `dbx_provider_profiles` from non-admin create/update
+ * requests, so a non-admin's selection is ignored.
+ *
+ * @param providerProfiles - The available provider profiles to display as selectable options.
+ * @returns A forge pickable chip field for provider profile assignment.
+ */
+function oidcClientProviderProfilesForgeField(providerProfiles) {
+    return dbxForgePickableChipField({
+        key: 'dbx_provider_profiles',
+        label: 'Provider Profiles',
+        hint: 'Admin-only. Assign provider profiles to unlock otherwise-restricted scopes for this client.',
+        props: {
+            showSelectAllButton: false,
+            ...pickableValueFieldValuesConfigForStaticLabeledValues(providerProfiles)
+        }
+    });
+}
 /**
  * Creates a forge value selection field for choosing the token endpoint authentication method.
  *
@@ -1177,7 +1217,8 @@ class DbxFirebaseOidcEntryClientForgeFormComponent extends AbstractConfigAsyncFo
         if (config) {
             result = oidcEntryClientForgeFormFields({
                 ...config,
-                tokenEndpointAuthMethods: this._oidcConfigService.tokenEndpointAuthMethods
+                tokenEndpointAuthMethods: this._oidcConfigService.tokenEndpointAuthMethods,
+                providerProfiles: this._oidcConfigService.availableProviderProfiles ?? undefined
             });
         }
         else {
@@ -1804,7 +1845,8 @@ class DbxFirebaseOidcEntryClientUpdateComponent {
             client_name: payload.client_name ?? '',
             redirect_uris: payload.redirect_uris ?? [],
             logo_uri: payload.logo_uri,
-            client_uri: payload.client_uri
+            client_uri: payload.client_uri,
+            dbx_provider_profiles: payload.dbx_provider_profiles ?? undefined
         };
         return formValue;
     }));
@@ -1988,5 +2030,5 @@ function provideDbxFirebaseOidc(config) {
  * Generated bundle index. Do not edit.
  */
 
-export { AbstractDbxFirebaseOAuthConsentScopeViewComponent, DEFAULT_OAUTH_CONSENT_SCOPES_REQUIRED_VALIDATOR_MESSAGE, DEFAULT_OIDC_AUTHORIZATION_ENDPOINT_PATH, DEFAULT_OIDC_CLIENT_ID_PARAM_KEY, DEFAULT_OIDC_CLIENT_NAME_PARAM_KEY, DEFAULT_OIDC_CLIENT_URI_PARAM_KEY, DEFAULT_OIDC_INTERACTION_ENDPOINT_PATH, DEFAULT_OIDC_INTERACTION_UID_PARAM_KEY, DEFAULT_OIDC_LOGO_URI_PARAM_KEY, DEFAULT_OIDC_SCOPES_PARAM_KEY, DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, DbxFirebaseOAuthConsentScopeDefaultViewComponent, DbxFirebaseOAuthConsentScopeFormComponent, DbxFirebaseOAuthConsentScopeListComponent, DbxFirebaseOAuthConsentScopeListItemComponent, DbxFirebaseOAuthConsentScopeListViewComponent, DbxFirebaseOAuthConsentViewComponent, DbxFirebaseOAuthLoginComponent, DbxFirebaseOAuthLoginViewComponent, DbxFirebaseOidcConfig, DbxFirebaseOidcConfigService, DbxFirebaseOidcEntryClientCreateComponent, DbxFirebaseOidcEntryClientForgeFormComponent, DbxFirebaseOidcEntryClientListComponent, DbxFirebaseOidcEntryClientListViewComponent, DbxFirebaseOidcEntryClientListViewItemClientComponent, DbxFirebaseOidcEntryClientListViewItemComponent, DbxFirebaseOidcEntryClientListViewItemDefaultComponent, DbxFirebaseOidcEntryClientTestComponent, DbxFirebaseOidcEntryClientTestForgeFormComponent, DbxFirebaseOidcEntryClientUpdateComponent, DbxFirebaseOidcEntryClientViewComponent, DbxFirebaseOidcEntryGrantListComponent, DbxFirebaseOidcEntryGrantListContainerComponent, DbxFirebaseOidcEntryGrantListViewComponent, DbxFirebaseOidcEntryGrantListViewItemComponent, DbxFirebaseOidcInteractionService, DbxOAuthConsentComponent, OAUTH_CONSENT_SCOPES_REQUIRED_VALIDATOR_KIND, OidcEntryCollectionStore, OidcEntryCollectionStoreDirective, OidcEntryDocumentStore, OidcEntryDocumentStoreDirective, oauthConsentScopesFormConfig, oidcClientHomepageUriForgeField, oidcClientJwksUriForgeField, oidcClientLogoUriForgeField, oidcClientNameForgeField, oidcClientRedirectUrisForgeField, oidcClientTestClientIdForgeField, oidcClientTestRedirectUriForgeField, oidcClientTestScopesForgeField, oidcClientTokenEndpointAuthMethodForgeField, oidcEntryClientForgeFormFields, oidcEntryClientTestForgeFormFields, oidcEntryClientUpdateForgeFormFields, provideDbxFirebaseOidc, provideOidcModelFirestoreCollections };
+export { AbstractDbxFirebaseOAuthConsentScopeViewComponent, DEFAULT_OAUTH_CONSENT_SCOPES_REQUIRED_VALIDATOR_MESSAGE, DEFAULT_OIDC_AUTHORIZATION_ENDPOINT_PATH, DEFAULT_OIDC_CLIENT_ID_PARAM_KEY, DEFAULT_OIDC_CLIENT_NAME_PARAM_KEY, DEFAULT_OIDC_CLIENT_URI_PARAM_KEY, DEFAULT_OIDC_INTERACTION_ENDPOINT_PATH, DEFAULT_OIDC_INTERACTION_UID_PARAM_KEY, DEFAULT_OIDC_LOGO_URI_PARAM_KEY, DEFAULT_OIDC_REQUIRED_SCOPES_PARAM_KEY, DEFAULT_OIDC_SCOPES_PARAM_KEY, DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, DbxFirebaseOAuthConsentScopeDefaultViewComponent, DbxFirebaseOAuthConsentScopeFormComponent, DbxFirebaseOAuthConsentScopeListComponent, DbxFirebaseOAuthConsentScopeListItemComponent, DbxFirebaseOAuthConsentScopeListViewComponent, DbxFirebaseOAuthConsentViewComponent, DbxFirebaseOAuthLoginComponent, DbxFirebaseOAuthLoginViewComponent, DbxFirebaseOidcConfig, DbxFirebaseOidcConfigService, DbxFirebaseOidcEntryClientCreateComponent, DbxFirebaseOidcEntryClientForgeFormComponent, DbxFirebaseOidcEntryClientListComponent, DbxFirebaseOidcEntryClientListViewComponent, DbxFirebaseOidcEntryClientListViewItemClientComponent, DbxFirebaseOidcEntryClientListViewItemComponent, DbxFirebaseOidcEntryClientListViewItemDefaultComponent, DbxFirebaseOidcEntryClientTestComponent, DbxFirebaseOidcEntryClientTestForgeFormComponent, DbxFirebaseOidcEntryClientUpdateComponent, DbxFirebaseOidcEntryClientViewComponent, DbxFirebaseOidcEntryGrantListComponent, DbxFirebaseOidcEntryGrantListContainerComponent, DbxFirebaseOidcEntryGrantListViewComponent, DbxFirebaseOidcEntryGrantListViewItemComponent, DbxFirebaseOidcInteractionService, DbxOAuthConsentComponent, OAUTH_CONSENT_SCOPES_REQUIRED_VALIDATOR_KIND, OidcEntryCollectionStore, OidcEntryCollectionStoreDirective, OidcEntryDocumentStore, OidcEntryDocumentStoreDirective, oauthConsentScopesFormConfig, oidcClientHomepageUriForgeField, oidcClientJwksUriForgeField, oidcClientLogoUriForgeField, oidcClientNameForgeField, oidcClientProviderProfilesForgeField, oidcClientRedirectUrisForgeField, oidcClientTestClientIdForgeField, oidcClientTestRedirectUriForgeField, oidcClientTestScopesForgeField, oidcClientTokenEndpointAuthMethodForgeField, oidcEntryClientForgeFormFields, oidcEntryClientTestForgeFormFields, oidcEntryClientUpdateForgeFormFields, provideDbxFirebaseOidc, provideOidcModelFirestoreCollections };
 //# sourceMappingURL=dereekb-dbx-firebase-oidc.mjs.map