@dereekb/dbx-firebase 13.32.0 → 13.34.0

package/lib/modules/externalconnection/_externalconnection.scss

@@ -0,0 +1,19 @@
+@use '../../style/theming';
+
+// MARK: Mixin
+@mixin core() {
+  .dbx-firebase-external-connection-list {
+    // the rows are cards; keep the gap the settings page had before they were a list.
+    --dbx-list-card-items-list-gap: var(--dbx-padding-3);
+  }
+
+  .dbx-firebase-external-connection-item {
+    // `<dbx-avatar>` owns the logo image and its `contain` fit — only the tile size is set here.
+    .dbx-firebase-external-connection-tile {
+      --dbx-avatar-size: 40px;
+    }
+  }
+}
+
+@mixin theme($theme-config) {
+}

package/lib/style/_all-core.scss

@@ -1,8 +1,10 @@
 @use '../auth/login/login';
+@use '../modules/externalconnection/externalconnection';
 @use '../model/model';
 
 // Includes all theming config
 @mixin all-component-core($theme-config) {
   @include login.core();
+  @include externalconnection.core();
   @include model.all-model-core($theme-config);
 }

package/lib/style/_all-theme.scss

@@ -1,8 +1,10 @@
 @use '../auth/login/login';
+@use '../modules/externalconnection/externalconnection';
 @use '../model/model';
 
 // Includes all theming config
 @mixin all-component-themes($theme-config) {
   @include login.theme($theme-config);
+  @include externalconnection.theme($theme-config);
   @include model.all-model-theme($theme-config);
 }

package/package.json

@@ -1,20 +1,20 @@
 {
   "name": "@dereekb/dbx-firebase",
-  "version": "13.32.0",
+  "version": "13.34.0",
   "peerDependencies": {
     "@angular/common": "21.2.11",
     "@angular/core": "21.2.11",
     "@angular/material": "^21.2.9",
-    "@dereekb/date": "13.32.0",
-    "@dereekb/dbx-analytics": "13.32.0",
-    "@dereekb/dbx-core": "13.32.0",
-    "@dereekb/dbx-form": "13.32.0",
-    "@dereekb/dbx-web": "13.32.0",
-    "@dereekb/firebase": "13.32.0",
-    "@dereekb/model": "13.32.0",
-    "@dereekb/rxjs": "13.32.0",
-    "@dereekb/util": "13.32.0",
-    "@dereekb/vitest": "13.32.0",
+    "@dereekb/date": "13.34.0",
+    "@dereekb/dbx-analytics": "13.34.0",
+    "@dereekb/dbx-core": "13.34.0",
+    "@dereekb/dbx-form": "13.34.0",
+    "@dereekb/dbx-web": "13.34.0",
+    "@dereekb/firebase": "13.34.0",
+    "@dereekb/model": "13.34.0",
+    "@dereekb/rxjs": "13.34.0",
+    "@dereekb/util": "13.34.0",
+    "@dereekb/vitest": "13.34.0",
     "@ng-forge/dynamic-forms": "0.10.0-next.4",
     "@ngrx/component-store": "^21.1.0",
     "firebase": "^12.12.1",

package/types/dereekb-dbx-firebase-oidc.d.ts

@@ -3,12 +3,12 @@ import { Signal, OnDestroy, Type, OnInit, EnvironmentProviders } from '@angular/
 import * as _dereekb_util from '@dereekb/util';
 import { Maybe, ErrorInput } from '@dereekb/util';
 import * as _dereekb_dbx_core from '@dereekb/dbx-core';
-import { DbxInjectionComponentConfig, SegueRefOrSegueRefRouterLink } from '@dereekb/dbx-core';
+import { DbxInjectionComponentConfig, ClickableAnchor, SegueRefOrSegueRefRouterLink } from '@dereekb/dbx-core';
 import { WorkUsingContext } from '@dereekb/rxjs';
 import * as _dereekb_firebase from '@dereekb/firebase';
 import { OidcScope, OAuthInteractionLoginDetails, OAuthInteractionConsentResponse, OidcInteractionUid, OidcTokenEndpointAuthMethod, OidcProviderProfileDetails, OidcRedirectUri, OidcScopeDetails, CreateOidcClientParams, UpdateOidcClientFieldParams, OidcEntry, OidcEntryDocument, OidcModelFunctions, CreateOidcClientResult, RotateOidcClientSecretResult, FirestoreQueryConstraint, OidcModelFirestoreCollections, OAuthInteractionLoginResponse, OAuthInteractionConsentRequest } from '@dereekb/firebase';
 import { FormConfig, ContainerField, RegisteredFieldTypes } from '@ng-forge/dynamic-forms';
-import { AbstractDbxSelectionListWrapperDirective, AbstractDbxValueListViewItemComponent, AbstractDbxSelectionListViewDirective, DbxSelectionValueListViewConfig, DbxActionConfirmConfig, DbxValueAsListItem } from '@dereekb/dbx-web';
+import { AbstractDbxSelectionListWrapperDirective, AbstractDbxValueListViewItemComponent, AbstractDbxSelectionListViewDirective, DbxSelectionValueListViewConfig, DbxContentPitScrollableInput, DbxActionConfirmConfig, DbxValueAsListItem } from '@dereekb/dbx-web';
 import * as _dereekb_dbx_form from '@dereekb/dbx-form';
 import { AbstractConfigAsyncForgeFormDirective } from '@dereekb/dbx-form';
 import * as rxjs from 'rxjs';
@@ -53,6 +53,12 @@ declare class DbxFirebaseOAuthLoginViewComponent {
 interface OAuthConsentScope<T extends OidcScope = OidcScope> {
     readonly name: T;
     readonly description: string;
+    /**
+     * Whether the scope is always granted and cannot be deselected. Required scopes still render as
+     * rows in the consent list — selected and disabled — so their description stays visible, but the
+     * server enforces them regardless of the submitted payload.
+     */
+    readonly required?: boolean;
 }
 
 /**
@@ -77,17 +83,19 @@ interface OAuthConsentScopesFormValue {
 /**
  * Configuration for the consent scopes form.
  *
- * Required scopes are filtered out by the caller before being passed in —
- * required scopes are surfaced separately as a static "Always granted" line
- * because they are not user-selectable.
+ * Required scopes are included in the list rather than filtered out — they render as
+ * selected-and-disabled rows so their description stays visible while remaining
+ * non-deselectable. They are always part of the submitted value; the server force-grants them
+ * regardless.
  */
 interface OAuthConsentScopesFormFieldsConfig {
     /**
-     * Optional scopes the user can choose to grant.
+     * Scopes to render. Entries flagged `required` are selected and locked on.
      */
-    readonly optionalScopes: readonly OAuthConsentScope[];
+    readonly scopes: readonly OAuthConsentScope[];
     /**
-     * Initial selection set. Defaults to every optional scope being selected.
+     * Initial selection set. Defaults to every scope being selected. Required scopes are always
+     * selected regardless of what is passed here.
      */
     readonly initiallySelected?: readonly OidcScope[];
 }
@@ -100,6 +108,11 @@ interface OAuthConsentScopesFormFieldsConfig {
  * The list renders bare (no Material form-field wrapper) and without the
  * default 300px height cap so it grows to fit the scope list.
  *
+ * Required scopes are seeded into the initial value and rendered as disabled rows, so they cannot
+ * be deselected. Because they are always present in the value, the "select at least one" validator
+ * compares against the required count rather than zero — and is skipped entirely when every
+ * requested scope is required (there would be nothing left to select).
+ *
  * @param config - The consent scopes form fields configuration.
  * @returns A `FormConfig` whose single field selects an `OidcScope[]` of granted scopes.
  */
@@ -249,6 +262,10 @@ declare class DbxFirebaseOAuthConsentScopeListComponent extends AbstractDbxSelec
  * Selection list view that pairs with `DbxFirebaseOAuthConsentScopeListComponent`.
  * Maps each `OAuthConsentScope` to a `DbxValueListItem` keyed by the scope name
  * and renders it through `DbxFirebaseOAuthConsentScopeListItemComponent`.
+ *
+ * Scopes flagged `required` map to disabled rows so they render selected but cannot be toggled
+ * off — the surrounding `dbxListItemIsSelectedModifier` owns the `selected` flag (driven by the
+ * form value), and only `disabled` is set here.
  */
 declare class DbxFirebaseOAuthConsentScopeListViewComponent extends AbstractDbxSelectionListViewDirective<OAuthConsentScope> {
     readonly config: DbxSelectionValueListViewConfig<OAuthConsentScope>;
@@ -260,10 +277,14 @@ declare class DbxFirebaseOAuthConsentScopeListViewComponent extends AbstractDbxS
  * row for both selected and unselected scopes — the selection chrome (the
  * leading checkbox/highlight) is provided by the wrapping
  * `dbx-selection-list-view`.
+ *
+ * Required scopes get an extra "Always granted" note so the row explains why its checkbox is
+ * locked on.
  */
 declare class DbxFirebaseOAuthConsentScopeListItemComponent extends AbstractDbxValueListViewItemComponent<OAuthConsentScope> {
     get name(): string;
     get description(): string;
+    get required(): boolean;
     static ɵfac: i0.ɵɵFactoryDeclaration<DbxFirebaseOAuthConsentScopeListItemComponent, never>;
     static ɵcmp: i0.ɵɵComponentDeclaration<DbxFirebaseOAuthConsentScopeListItemComponent, "ng-component", never, {}, {}, never, never, true, never>;
 }
@@ -294,9 +315,21 @@ declare class DbxFirebaseOAuthConsentScopeFormComponent extends AbstractConfigAs
  * form's value participates in the surrounding `dbxAction` (the consent
  * view's outer Approve action).
  *
- * Required scopes are not user-selectable. They are surfaced as an "Always
- * granted" hint above the form because the server enforces them regardless
- * of payload — including them in the selection list would just add noise.
+ * The scopes live inside a `dbx-content-pit` that starts collapsed to a single
+ * underlined summary line ("N permissions are being requested. Click here to
+ * edit requested permissions."). Clicking it expands the pit to reveal the
+ * selection list so the user can customize which scopes they grant. Starting
+ * collapsed keeps the consent screen short enough that Approve/Deny are visible
+ * without scrolling even when a client requests many scopes, and the expanded
+ * pit is height-capped and scrollable for the same reason.
+ *
+ * The form itself is always mounted (hidden rather than removed while
+ * collapsed) so `dbxActionForm` keeps supplying the granted-scope value to the
+ * consent action even when the user never expands the pit.
+ *
+ * Required scopes are listed first and render as selected-and-disabled rows carrying an "Always
+ * granted" note, so their description is visible alongside every other scope while staying
+ * non-deselectable. The server force-grants them regardless of the submitted payload.
  *
  * Apps can override this default via
  * `DbxFirebaseOidcConfig.consentScopeListViewClass` or
@@ -307,10 +340,25 @@ declare class DbxFirebaseOAuthConsentScopeFormComponent extends AbstractConfigAs
 declare class DbxFirebaseOAuthConsentScopeDefaultViewComponent {
     private readonly _oidcConfigService;
     private readonly _data;
+    private readonly _customizing;
+    /**
+     * Every requested scope paired with its human-readable description, required ones first so the
+     * always-granted rows head the list.
+     */
     readonly mappedScopesSignal: i0.Signal<OAuthConsentScope<string>[]>;
-    readonly optionalScopesSignal: i0.Signal<OAuthConsentScope<string>[]>;
-    readonly alwaysGrantedLabelSignal: i0.Signal<Maybe<string>>;
     readonly formFieldsConfigSignal: i0.Signal<OAuthConsentScopesFormFieldsConfig>;
+    /**
+     * Leading sentence of the collapsed summary — the number of scopes the client is requesting,
+     * counting the always-granted ones since the expanded pit accounts for them too.
+     */
+    readonly requestedScopesSummarySignal: i0.Signal<string>;
+    /**
+     * True once the user has expanded the pit to review/customize the requested scopes.
+     */
+    readonly customizingSignal: i0.Signal<boolean>;
+    readonly pitScrollableSignal: i0.Signal<Maybe<DbxContentPitScrollableInput>>;
+    readonly customizeAnchor: ClickableAnchor;
+    showScopeCustomization(): void;
     static ɵfac: i0.ɵɵFactoryDeclaration<DbxFirebaseOAuthConsentScopeDefaultViewComponent, never>;
     static ɵcmp: i0.ɵɵComponentDeclaration<DbxFirebaseOAuthConsentScopeDefaultViewComponent, "dbx-firebase-oauth-consent-scope-default-view", never, {}, {}, never, never, true, never>;
 }