@dereekb/firebase-server 13.11.14 → 13.11.16

package/oidc/index.esm.js

@@ -232,7 +232,7 @@ function _define_property$f(obj, key, value) {
      *
      * Called by {@link oidcModuleConfigFactory} after building the config from environment variables.
      *
-     * @param config - the config object to validate
+     * @param config - The config object to validate.
      * @throws {Error} When any required field (`issuer`, `appInteractionPath`, `appLoginUrlPart`, `appConsentUrlPart`, `jwksServiceConfig`, `jwksKeyConverterConfig`) is missing.
      */ function assertValidConfig(config) {
                 if (!config.issuer) {
@@ -352,8 +352,11 @@ function _define_property$f(obj, key, value) {
 /**
  * Query for JwksKey documents with a specific status.
  *
- * @param status - the lifecycle status to filter by
- * @returns Firestore query constraints filtering by the given status
+ * @param status - The lifecycle status to filter by.
+ * @returns Firestore query constraints filtering by the given status.
+ *
+ * @dbxModelFirebaseIndex
+ * @dbxModelFirebaseIndexModel JwksKey
  */ function jwksKeysWithStatusQuery(status) {
     return [
         where('status', '==', status)
@@ -362,14 +365,17 @@ function _define_property$f(obj, key, value) {
 /**
  * Query for active JwksKey documents.
  *
- * @returns Firestore query constraints filtering for active keys
+ * @returns Firestore query constraints filtering for active keys.
  */ function activeJwksKeysQuery() {
     return jwksKeysWithStatusQuery('active');
 }
 /**
  * Query for non-retired JwksKey documents (active + rotated).
  *
- * @returns Firestore query constraints filtering for non-retired keys
+ * @returns Firestore query constraints filtering for non-retired keys.
+ *
+ * @dbxModelFirebaseIndex
+ * @dbxModelFirebaseIndexModel JwksKey
  */ function nonRetiredJwksKeysQuery() {
     return [
         where('status', 'in', [
@@ -381,7 +387,7 @@ function _define_property$f(obj, key, value) {
 /**
  * Query for rotated JwksKey documents.
  *
- * @returns Firestore query constraints filtering for rotated keys
+ * @returns Firestore query constraints filtering for rotated keys.
  */ function rotatedJwksKeysQuery() {
     return jwksKeysWithStatusQuery('rotated');
 }
@@ -694,7 +700,7 @@ var JwksService = /*#__PURE__*/ function() {
      * Returns both the stored {@link JwksKey} and the unencrypted private JWK
      * so callers can use the signing key immediately without a decryption round-trip.
      *
-     * @returns the generated key pair result containing the stored JwksKey and signing key
+     * @returns The generated key pair result containing the stored JwksKey and signing key.
      */ function generateKeyPair() {
                 return _async_to_generator$a(function() {
                     var _generateKeyPairSync, publicKey, privateKey, kid, publicJwk, privateJwk, getKey, encryptedPrivateKey, data, doc;
@@ -757,7 +763,7 @@ var JwksService = /*#__PURE__*/ function() {
             value: /**
      * Returns the currently active signing key's private JWK.
      *
-     * @returns the active signing key's private JWK, or undefined if no active key exists
+     * @returns The active signing key's private JWK, or undefined if no active key exists.
      */ function getActiveSigningKey() {
                 return _async_to_generator$a(function() {
                     var results, result, data, getKey;
@@ -795,7 +801,7 @@ var JwksService = /*#__PURE__*/ function() {
      * Returns undefined if storage is not configured or `serveJwksFromStorage` is false.
      * Returns null if an error occured while trying to setup.
      *
-     * @returns the public URL, or null/undefined if unavailable
+     * @returns The public URL, or null/undefined if unavailable.
      */ function getJwksStoragePublicUrl() {
                 return _async_to_generator$a(function() {
                     return _ts_generator$a(this, function(_state) {
@@ -812,7 +818,7 @@ var JwksService = /*#__PURE__*/ function() {
             value: /**
      * Returns the public JWKS (all non-retired keys) by querying Firestore.
      *
-     * @returns the public JWKS containing all non-retired signing keys
+     * @returns The public JWKS containing all non-retired signing keys.
      */ function getLatestPublicJwks() {
                 return _async_to_generator$a(function() {
                     var keys;
@@ -858,7 +864,7 @@ var JwksService = /*#__PURE__*/ function() {
             value: /**
      * Rotates keys: marks the current active key as rotated and generates a new active key.
      *
-     * @returns the newly generated active JwksKey
+     * @returns The newly generated active JwksKey.
      */ function rotateKeys() {
                 return _async_to_generator$a(function() {
                     var now, expiresAt, _ref, newKey;
@@ -1038,7 +1044,7 @@ var JwksService = /*#__PURE__*/ function() {
             value: /**
      * Retires rotated keys whose expiresAt has passed.
      *
-     * @returns the number of keys retired
+     * @returns The number of keys retired.
      */ function retireExpiredKeys() {
                 return _async_to_generator$a(function() {
                     var now, count;
@@ -1348,10 +1354,10 @@ function _ts_generator$9(thisArg, body) {
      * Returns an {@link OidcAccount} compatible with oidc-provider's `findAccount` interface,
      * or `undefined` if the user does not exist in Firebase Auth.
      *
-     * @returns the OIDC account for this user, or undefined if the user does not exist
+     * @returns The OIDC account for this user, or undefined if the user does not exist.
      */ function findAccount() {
                 return _async_to_generator$9(function() {
-                    var authUserContext, exists, delegate;
+                    var authUserContext, exists, result, delegate;
                     return _ts_generator$9(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -1362,16 +1368,9 @@ function _ts_generator$9(thisArg, body) {
                                 ];
                             case 1:
                                 exists = _state.sent();
-                                if (!exists) {
-                                    return [
-                                        2,
-                                        undefined
-                                    ];
-                                }
-                                delegate = this._service.delegate;
-                                return [
-                                    2,
-                                    {
+                                if (exists) {
+                                    delegate = this._service.delegate;
+                                    result = {
                                         accountId: this._uid,
                                         claims: function claims(_use, scope) {
                                             return _async_to_generator$9(function() {
@@ -1385,7 +1384,11 @@ function _ts_generator$9(thisArg, body) {
                                                 });
                                             })();
                                         }
-                                    }
+                                    };
+                                }
+                                return [
+                                    2,
+                                    result
                                 ];
                         }
                     });
@@ -1417,7 +1420,7 @@ function _ts_generator$9(thisArg, body) {
             get: /**
      * The provider config from the delegate.
      *
-     * @returns the OIDC provider configuration from the delegate
+     * @returns The OIDC provider configuration from the delegate.
      */ function get() {
                 return this.delegate.providerConfig;
             }
@@ -1426,8 +1429,8 @@ function _ts_generator$9(thisArg, body) {
             /**
      * Creates a user context for the given user ID.
      *
-     * @param uid - the Firebase Auth user ID
-     * @returns a new user context bound to the given user
+     * @param uid - The Firebase Auth user ID.
+     * @returns A new user context bound to the given user.
      */ key: "userContext",
             value: function userContext(uid) {
                 return new OidcAccountServiceUserContext(this, uid);
@@ -1547,8 +1550,8 @@ function _is_native_reflect_construct() {
  *
  * Requires runtime encryption config since the private key field is encrypted at rest.
  *
- * @param config - encryption configuration for the private key field
- * @returns snapshot converter functions for JwksKey documents
+ * @param config - Encryption configuration for the private key field.
+ * @returns Snapshot converter functions for JwksKey documents.
  */ function jwksKeyConverter(config) {
     return snapshotConverterFunctions({
         fields: {
@@ -1572,16 +1575,16 @@ function _is_native_reflect_construct() {
 /**
  * Returns the Firestore {@link CollectionReference} for {@link JwksKey} documents.
  *
- * @param context - the Firestore context to create the collection reference from
- * @returns the typed collection reference for JwksKey documents
+ * @param context - The Firestore context to create the collection reference from.
+ * @returns The typed collection reference for JwksKey documents.
  */ function jwksKeyCollectionReference(context) {
     return context.collection(jwksKeyIdentity.collectionName);
 }
 /**
  * Creates a {@link JwksKeyFirestoreCollection} with encrypted private key field support.
  *
- * @param config - configuration including the Firestore context and encryption settings
- * @returns the configured JwksKey Firestore collection
+ * @param config - Configuration including the Firestore context and encryption settings.
+ * @returns The configured JwksKey Firestore collection.
  */ function jwksKeyFirestoreCollection(config) {
     var firestoreContext = config.firestoreContext;
     return firestoreContext.firestoreCollection({
@@ -1739,8 +1742,8 @@ function _ts_generator$8(thisArg, body) {
 /**
  * Creates a concrete {@link OidcModelServerActions} implementation wired to the provided context.
  *
- * @param context - the fully assembled OIDC model server actions context
- * @returns the concrete OidcModelServerActions instance
+ * @param context - The fully assembled OIDC model server actions context.
+ * @returns The concrete OidcModelServerActions instance.
  *
  * @example
  * ```ts
@@ -1764,8 +1767,8 @@ function _ts_generator$8(thisArg, body) {
  * Delegates to {@link OidcClientService.createClient} to generate a `client_id` and `client_secret`,
  * create the adapter entry, and return the secret in plaintext (only returned once).
  *
- * @param context - the OIDC model server actions context
- * @returns a transform function factory for creating OIDC clients
+ * @param context - The OIDC model server actions context.
+ * @returns A transform function factory for creating OIDC clients.
  */ function createOidcClientFactory(context) {
     var oidcClientService = context.oidcClientService, firebaseServerActionTransformFunctionFactory = context.firebaseServerActionTransformFunctionFactory;
     return firebaseServerActionTransformFunctionFactory(createOidcClientParamsType, function(params) {
@@ -1793,8 +1796,8 @@ function _ts_generator$8(thisArg, body) {
  *
  * Delegates to {@link OidcClientService.updateClient} to apply plaintext field updates.
  *
- * @param context - the OIDC model server actions context
- * @returns a transform function factory for updating OIDC clients
+ * @param context - The OIDC model server actions context.
+ * @returns A transform function factory for updating OIDC clients.
  */ function updateOidcClientFactory(context) {
     var oidcClientService = context.oidcClientService, firebaseServerActionTransformFunctionFactory = context.firebaseServerActionTransformFunctionFactory;
     return firebaseServerActionTransformFunctionFactory(updateOidcClientParamsType, function(params) {
@@ -1832,8 +1835,8 @@ function _ts_generator$8(thisArg, body) {
  * Delegates to {@link OidcClientService.rotateClientSecret} to generate a new secret
  * and return it in plaintext (only returned once).
  *
- * @param context - the OIDC model server actions context
- * @returns a transform function factory for rotating OIDC client secrets
+ * @param context - The OIDC model server actions context.
+ * @returns A transform function factory for rotating OIDC client secrets.
  */ function rotateOidcClientSecretFactory(context) {
     var oidcClientService = context.oidcClientService, firebaseServerActionTransformFunctionFactory = context.firebaseServerActionTransformFunctionFactory;
     return firebaseServerActionTransformFunctionFactory(rotateOidcClientSecretParamsType, function(_params) {
@@ -1861,8 +1864,8 @@ function _ts_generator$8(thisArg, body) {
  *
  * Delegates to {@link OidcClientService.deleteClient}.
  *
- * @param context - the OIDC model server actions context
- * @returns a transform function factory for deleting OIDC clients
+ * @param context - The OIDC model server actions context.
+ * @returns A transform function factory for deleting OIDC clients.
  */ function deleteOidcClientFactory(context) {
     var oidcClientService = context.oidcClientService, firebaseServerActionTransformFunctionFactory = context.firebaseServerActionTransformFunctionFactory;
     return firebaseServerActionTransformFunctionFactory(deleteOidcClientParamsType, function(_params) {
@@ -1904,8 +1907,8 @@ function _ts_generator$8(thisArg, body) {
  * Per-user authorization (this user owns this Grant) is enforced upstream via the
  * model permission service before this action runs.
  *
- * @param context - the OIDC model server actions context
- * @returns a transform function factory for revoking OIDC grants
+ * @param context - The OIDC model server actions context.
+ * @returns A transform function factory for revoking OIDC grants.
  */ function deleteOidcTokenFactory(context) {
     var oidcService = context.oidcService, firebaseServerActionTransformFunctionFactory = context.firebaseServerActionTransformFunctionFactory;
     return firebaseServerActionTransformFunctionFactory(deleteOidcTokenParamsType, function(_params) {
@@ -2262,7 +2265,7 @@ function _ts_generator$7(thisArg, body) {
      *
      * @param clientId - The client's document/adapter entry ID.
      * @param params - The fields to update.
-     * @throws When the client is not found.
+     * @throws {Error} When the client is not found.
      */ function updateClient(clientId, params) {
                 return _async_to_generator$7(function() {
                     var provider, ProviderClient, existing, updatedMetadata, _params_logo_uri, _params_client_uri, _params_dbx_max_session_ttl, client;
@@ -2329,7 +2332,7 @@ function _ts_generator$7(thisArg, body) {
      *
      * @param clientId - The client's document/adapter entry ID.
      * @returns The client ID and new secret (plaintext, returned only once).
-     * @throws When the client is not found.
+     * @throws {Error} When the client is not found.
      */ function rotateClientSecret(clientId) {
                 return _async_to_generator$7(function() {
                     var provider, ProviderClient, existing, newSecret, updatedMetadata, client;
@@ -2388,7 +2391,7 @@ function _ts_generator$7(thisArg, body) {
      * Deletes an OIDC client through the oidc-provider adapter.
      *
      * @param clientId - The client's document/adapter entry ID.
-     * @throws When the client is not found.
+     * @throws {Error} When the client is not found.
      */ function deleteClient(clientId) {
                 return _async_to_generator$7(function() {
                     var provider, ProviderClient, existing;
@@ -2481,9 +2484,9 @@ function _object_spread_props$1(target, source) {
 /**
  * Factory that creates an {@link OidcModelServerActions} instance from the injected services.
  *
- * @param oidcClientService - the OIDC client service for client CRUD actions
- * @param oidcService - the core OIDC service for grant revocation
- * @returns the configured OidcModelServerActions instance
+ * @param oidcClientService - The OIDC client service for client CRUD actions.
+ * @param oidcService - The core OIDC service for grant revocation.
+ * @returns The configured OidcModelServerActions instance.
  */ function oidcModelServerActionsFactory(oidcClientService, oidcService) {
     var context = _object_spread_props$1(_object_spread$4({}, firebaseServerActionsContext()), {
         oidcClientService: oidcClientService,
@@ -2497,8 +2500,8 @@ function _object_spread_props$1(target, source) {
  * By default this module exports:
  * - OidcModelServerActions
  *
- * @param config - the configuration specifying the OIDC module dependency
- * @returns the NestJS module metadata for the OidcModel module
+ * @param config - The configuration specifying the OIDC module dependency.
+ * @returns The NestJS module metadata for the OidcModel module.
  */ function appOidcModelModuleMetadata(config) {
     var oidcModule = config.oidcModule;
     return {
@@ -2721,15 +2724,15 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
  * Sensitive payload fields (`client_secret`, `registration_access_token`) are selectively
  * encrypted via the {@link OidcEncryptionService}.
  *
+ * @param collections - Firestore collection access for adapter entries.
+ * @param encryptionService - Encryption service for sensitive payload fields.
+ * @returns An oidc-provider adapter constructor backed by Firestore.
+ *
  * @example
  * ```ts
  * const adapter = createAdapterFactory(collections, encryptionService);
  * new Provider('issuer', { adapter });
  * ```
- *
- * @param collections - Firestore collection access for adapter entries.
- * @param encryptionService - Encryption service for sensitive payload fields.
- * @returns an oidc-provider adapter constructor backed by Firestore
  */ function createAdapterFactory(collections, encryptionService) {
     var FirestoreAdapter = /*#__PURE__*/ function() {
         function FirestoreAdapter(name) {
@@ -2986,8 +2989,8 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
          * Converts a Firestore document into an oidc-provider payload,
          * returning `undefined` if the entry has expired.
          *
-         * @param data - the Firestore document data to convert
-         * @returns the decrypted adapter payload, or undefined if the entry has expired
+         * @param data - The Firestore document data to convert.
+         * @returns The decrypted adapter payload, or undefined if the entry has expired.
          */ key: "_toPayload",
                 value: function _toPayload(data) {
                     var expiresDate;
@@ -3095,8 +3098,8 @@ function _unsupported_iterable_to_array$4(o, minLen) {
      * Encrypts sensitive fields in an adapter payload and returns it as a {@link JsonSerializableObject}
      * suitable for storing directly in Firestore.
      *
-     * @param payload - the adapter payload to encrypt
-     * @returns the encrypted payload as a JSON-serializable object
+     * @param payload - The adapter payload to encrypt.
+     * @returns The encrypted payload as a JSON-serializable object.
      */ key: "encryptAdapterPayload",
             value: function encryptAdapterPayload(payload) {
                 var filtered = filterUndefinedValues(payload);
@@ -3107,8 +3110,8 @@ function _unsupported_iterable_to_array$4(o, minLen) {
             /**
      * Decrypts sensitive fields in a Firestore-stored payload object back to an {@link AdapterPayload}.
      *
-     * @param payload - the encrypted Firestore-stored payload
-     * @returns the decrypted adapter payload
+     * @param payload - The encrypted Firestore-stored payload.
+     * @returns The decrypted adapter payload.
      */ key: "decryptAdapterPayload",
             value: function decryptAdapterPayload(payload) {
                 return this.adapterPayloadEncryptor.decrypt(payload);
@@ -3272,7 +3275,7 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
      *
      * @param jwksUri - Optional override for the JWKS URI (e.g., from cloud storage).
      *   Falls back to `{issuer}{routes.jwks}`.
-     * @returns the fully constructed OIDC discovery metadata
+     * @returns The fully constructed OIDC discovery metadata.
      */ key: "buildDiscoveryMetadata",
             value: function buildDiscoveryMetadata(jwksUri) {
                 var issuer = this.config.issuer;
@@ -3592,7 +3595,7 @@ function _ts_generator$5(thisArg, body) {
             /**
      * Returns the oidc-provider instance, initializing it on first access.
      *
-     * @returns the lazily-initialized oidc-provider instance
+     * @returns The lazily-initialized oidc-provider instance.
      */ key: "getProvider",
             value: function getProvider() {
                 return this._getProvider();
@@ -3641,7 +3644,7 @@ function _ts_generator$5(thisArg, body) {
      * @returns The auth context, or `undefined` if the token is invalid or expired.
      */ function verifyAccessToken(rawToken) {
                 return _async_to_generator$5(function() {
-                    var _accessToken_extra, _accessToken_exp, provider, accessToken, accountClaims, token;
+                    var provider, accessToken, result, _accessToken_extra, _accessToken_exp, accountClaims, token;
                     return _ts_generator$5(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -3657,39 +3660,32 @@ function _ts_generator$5(thisArg, body) {
                                 ];
                             case 2:
                                 accessToken = _state.sent();
-                                if (!accessToken) {
-                                    return [
-                                        2,
-                                        undefined
-                                    ];
-                                }
-                                // Extract account claims baked into the access token at issuance time.
-                                // These are the claims built by OidcAccountServiceDelegate.buildClaimsForUser()
-                                // (e.g., `a` for admin, `o` for onboarded) based on the granted scopes.
-                                // Read the account claims baked into the token at issuance time via extraAccessTokenClaims.
-                                accountClaims = (_accessToken_extra = accessToken.extra) !== null && _accessToken_extra !== void 0 ? _accessToken_extra : {};
-                                token = _object_spread_props(_object_spread$2({}, accountClaims), {
-                                    // Standard JWT claims — sourced from the access token
-                                    aud: firstValue(accessToken.aud),
-                                    iss: this.config.issuer,
-                                    sub: accessToken.accountId,
-                                    iat: accessToken.iat,
-                                    exp: (_accessToken_exp = accessToken.exp) !== null && _accessToken_exp !== void 0 ? _accessToken_exp : unixDateTimeSecondsNumberForNow() + accessToken.expiration,
-                                    auth_time: accessToken.iat,
-                                    // Firebase UID (copied from sub)
-                                    uid: accessToken.accountId,
-                                    // OIDC-specific claims carried on the token
-                                    scope: accessToken.scope,
-                                    client_id: accessToken.clientId,
-                                    // Firebase sign-in info — marked as OIDC provider
-                                    firebase: {
-                                        identities: {},
-                                        sign_in_provider: 'dbx_oidc'
-                                    }
-                                });
-                                return [
-                                    2,
-                                    {
+                                if (accessToken) {
+                                    // Extract account claims baked into the access token at issuance time.
+                                    // These are the claims built by OidcAccountServiceDelegate.buildClaimsForUser()
+                                    // (e.g., `a` for admin, `o` for onboarded) based on the granted scopes.
+                                    // Read the account claims baked into the token at issuance time via extraAccessTokenClaims.
+                                    accountClaims = (_accessToken_extra = accessToken.extra) !== null && _accessToken_extra !== void 0 ? _accessToken_extra : {};
+                                    token = _object_spread_props(_object_spread$2({}, accountClaims), {
+                                        // Standard JWT claims — sourced from the access token
+                                        aud: firstValue(accessToken.aud),
+                                        iss: this.config.issuer,
+                                        sub: accessToken.accountId,
+                                        iat: accessToken.iat,
+                                        exp: (_accessToken_exp = accessToken.exp) !== null && _accessToken_exp !== void 0 ? _accessToken_exp : unixDateTimeSecondsNumberForNow() + accessToken.expiration,
+                                        auth_time: accessToken.iat,
+                                        // Firebase UID (copied from sub)
+                                        uid: accessToken.accountId,
+                                        // OIDC-specific claims carried on the token
+                                        scope: accessToken.scope,
+                                        client_id: accessToken.clientId,
+                                        // Firebase sign-in info — marked as OIDC provider
+                                        firebase: {
+                                            identities: {},
+                                            sign_in_provider: 'dbx_oidc'
+                                        }
+                                    });
+                                    result = {
                                         uid: accessToken.accountId,
                                         token: token,
                                         rawToken: rawToken,
@@ -3698,7 +3694,11 @@ function _ts_generator$5(thisArg, body) {
                                             scope: accessToken.scope,
                                             client_id: accessToken.clientId
                                         }, accountClaims)
-                                    }
+                                    };
+                                }
+                                return [
+                                    2,
+                                    result
                                 ];
                         }
                     });
@@ -3718,8 +3718,8 @@ function _ts_generator$5(thisArg, body) {
      * referencing the grant is gone — `verifyAccessToken` returns `undefined`
      * and a `grant_type=refresh_token` exchange fails with `invalid_grant`.
      *
-     * @param grantId - the grant id (and Grant adapter entry id) to revoke
-     * @throws when the Grant entry does not exist
+     * @param grantId - The grant id (and Grant adapter entry id) to revoke.
+     * @throws {Error} When the Grant entry does not exist.
      */ function revokeGrant(grantId) {
                 return _async_to_generator$5(function() {
                     var provider, ProviderGrant, existing;
@@ -3823,8 +3823,8 @@ function _ts_generator$5(thisArg, body) {
      * Does NOT include `adapter`, `findAccount`, or `jwks` — those require async
      * setup and are handled by {@link OidcService}.
      *
-     * @param cookieKeys - the signing keys for oidc-provider session cookies
-     * @returns the oidc-provider configuration options
+     * @param cookieKeys - The signing keys for oidc-provider session cookies.
+     * @returns The oidc-provider configuration options.
      */ key: "buildProviderConfiguration",
             value: function buildProviderConfiguration(cookieKeys) {
                 var _this = this;
@@ -3871,17 +3871,13 @@ function _ts_generator$5(thisArg, body) {
                             DBX_FIREBASE_SERVER_OIDC_MAX_SESSION_TTL_CLIENT_METADATA
                         ],
                         validator: function validator(_ctx, key, value) {
-                            if (key !== DBX_FIREBASE_SERVER_OIDC_MAX_SESSION_TTL_CLIENT_METADATA) {
-                                return;
-                            }
-                            if (value === undefined || value === null) {
-                                return;
-                            }
-                            if (typeof value !== 'number' || !Number.isInteger(value) || value <= 0) {
-                                throw new errors.InvalidClientMetadata("".concat(DBX_FIREBASE_SERVER_OIDC_MAX_SESSION_TTL_CLIENT_METADATA, " must be a positive integer (seconds)."));
-                            }
-                            if (value > serverMaxSeconds) {
-                                throw new errors.InvalidClientMetadata("".concat(DBX_FIREBASE_SERVER_OIDC_MAX_SESSION_TTL_CLIENT_METADATA, " cannot exceed the server max of ").concat(serverMaxSeconds, " seconds."));
+                            if (key === DBX_FIREBASE_SERVER_OIDC_MAX_SESSION_TTL_CLIENT_METADATA && value !== undefined && value !== null) {
+                                if (typeof value !== 'number' || !Number.isInteger(value) || value <= 0) {
+                                    throw new errors.InvalidClientMetadata("".concat(DBX_FIREBASE_SERVER_OIDC_MAX_SESSION_TTL_CLIENT_METADATA, " must be a positive integer (seconds)."));
+                                }
+                                if (value > serverMaxSeconds) {
+                                    throw new errors.InvalidClientMetadata("".concat(DBX_FIREBASE_SERVER_OIDC_MAX_SESSION_TTL_CLIENT_METADATA, " cannot exceed the server max of ").concat(serverMaxSeconds, " seconds."));
+                                }
                             }
                         }
                     },
@@ -3970,12 +3966,13 @@ function _ts_generator$5(thisArg, body) {
                     // available via `accessToken.extra` during verification without an extra DB call.
                     extraTokenClaims: function extraTokenClaims(_ctx, token) {
                         return _async_to_generator$5(function() {
-                            var accountId, scope, account, claims, extraClaims;
+                            var accountId, scope, result, account, claims, extraClaims;
                             return _ts_generator$5(this, function(_state) {
                                 switch(_state.label){
                                     case 0:
                                         accountId = token.accountId;
                                         scope = token.scope;
+                                        result = {};
                                         if (!(accountId && scope)) return [
                                             3,
                                             3
@@ -4000,14 +3997,12 @@ function _ts_generator$5(thisArg, body) {
                                             "sub"
                                         ]);
                                         // Filter out undefined values — the Firestore adapter cannot serialize them.
-                                        return [
-                                            2,
-                                            filterUndefinedValues(extraClaims)
-                                        ];
+                                        result = filterUndefinedValues(extraClaims);
+                                        _state.label = 3;
                                     case 3:
                                         return [
                                             2,
-                                            {}
+                                            result
                                         ];
                                 }
                             });
@@ -4420,35 +4415,36 @@ var _logger = new Logger('applyOidcAuthMiddleware');
         var isProtected = protectedPaths.some(function(prefix) {
             return req.path.startsWith(prefix);
         });
-        if (!isProtected) {
-            return next();
-        }
-        var authHeader = req.headers.authorization;
-        if (!(authHeader === null || authHeader === void 0 ? void 0 : authHeader.startsWith('Bearer '))) {
-            res.status(401).json({
-                statusCode: 401,
-                message: 'Missing or invalid Authorization header'
-            });
-            return;
-        }
-        var token = authHeader.slice(7);
-        oidcService.verifyAccessToken(token).then(function(oauthAuth) {
-            if (!oauthAuth) {
+        if (isProtected) {
+            var authHeader = req.headers.authorization;
+            if (authHeader === null || authHeader === void 0 ? void 0 : authHeader.startsWith('Bearer ')) {
+                var token = authHeader.slice(7);
+                oidcService.verifyAccessToken(token).then(function(oauthAuth) {
+                    if (oauthAuth) {
+                        req.auth = oauthAuth;
+                        next();
+                    } else {
+                        res.status(401).json({
+                            statusCode: 401,
+                            message: 'Invalid or expired access token'
+                        });
+                    }
+                }).catch(function(err) {
+                    logger.error('Bearer token verification failed', err);
+                    res.status(401).json({
+                        statusCode: 401,
+                        message: 'Token verification failed'
+                    });
+                });
+            } else {
                 res.status(401).json({
                     statusCode: 401,
-                    message: 'Invalid or expired access token'
+                    message: 'Missing or invalid Authorization header'
                 });
-                return;
             }
-            req.auth = oauthAuth;
+        } else {
             next();
-        }).catch(function(err) {
-            logger.error('Bearer token verification failed', err);
-            res.status(401).json({
-                statusCode: 401,
-                message: 'Token verification failed'
-            });
-        });
+        }
     });
     _logger.debug("Applied OAuth bearer token middleware for paths: ".concat(protectedPaths.join(', ')));
 }
@@ -4474,7 +4470,7 @@ var _logger = new Logger('applyOidcAuthMiddleware');
  * `/interaction/{uid}/*` POSTs carry the Firebase ID token in the JSON body, not in cookies, so
  * we keep the CORS surface minimal.
  *
- * @param nestApp - the NestJS application to configure.
+ * @param nestApp - The NestJS application to configure.
  *
  * @example
  * ```ts
@@ -4722,9 +4718,9 @@ function _ts_generator$3(thisArg, body) {
      *
      * Requires the oidc-provider interaction cookie to be present on the request.
      *
-     * @param req - the Express request containing the interaction cookie
-     * @param res - the Express response
-     * @returns the oidc-provider interaction details
+     * @param req - The Express request containing the interaction cookie.
+     * @param res - The Express response.
+     * @returns The oidc-provider interaction details.
      */ function getInteractionDetails(req, res) {
                 return _async_to_generator$3(function() {
                     var provider;
@@ -4755,8 +4751,8 @@ function _ts_generator$3(thisArg, body) {
      * This is necessary when the interaction cookie is scoped to a different path
      * (e.g., the frontend) and is not sent with backend API requests.
      *
-     * @param uid - the interaction UID to look up
-     * @returns the interaction details for the given UID
+     * @param uid - The interaction UID to look up.
+     * @returns The interaction details for the given UID.
      * @throws {Error} When the interaction is not found or has expired.
      */ function findInteractionByUid(uid) {
                 return _async_to_generator$3(function() {
@@ -4796,10 +4792,10 @@ function _ts_generator$3(thisArg, body) {
      * Looks up the interaction directly by UID, applies the result, saves it,
      * and returns the `returnTo` URL for the client to redirect to.
      *
-     * @param uid - the interaction UID to complete
-     * @param result - the interaction results to apply
-     * @param options - optional settings for merging with the last submission
-     * @param options.mergeWithLastSubmission - whether to merge with the last submission (defaults to true)
+     * @param uid - The interaction UID to complete.
+     * @param result - The interaction results to apply.
+     * @param options - Optional settings for merging with the last submission.
+     * @param options.mergeWithLastSubmission - Whether to merge with the last submission (defaults to true)
      * @returns The `returnTo` URL that the client should redirect to.
      */ function finishInteractionByUid(uid, result, options) {
                 return _async_to_generator$3(function() {
@@ -4844,11 +4840,11 @@ function _ts_generator$3(thisArg, body) {
      * `dbx_session_ttl` request param when save is driven from a NestJS controller — see
      * {@link OidcService#resolveLoginDurationForGrant}).
      *
-     * @param grantId - the existing grant ID to look up, or undefined to create a new grant
-     * @param accountId - the account ID for creating a new grant
-     * @param clientId - the client ID for creating a new grant
-     * @param expiresInSeconds - optional TTL (seconds) to assign to a newly-created grant
-     * @returns the found or newly created grant
+     * @param grantId - The existing grant ID to look up, or undefined to create a new grant.
+     * @param accountId - The account ID for creating a new grant.
+     * @param clientId - The client ID for creating a new grant.
+     * @param expiresInSeconds - Optional TTL (seconds) to assign to a newly-created grant.
+     * @returns The found or newly created grant.
      */ // eslint-disable-next-line @typescript-eslint/max-params -- positional args mirror the existing call sites
             function findOrCreateGrant(grantId, accountId, clientId, expiresInSeconds) {
                 return _async_to_generator$3(function() {
@@ -5156,18 +5152,18 @@ function _ts_generator$2(thisArg, body) {
         {
             key: "getInteraction",
             value: /**
-     * GET /interaction/:uid
+     * GET /interaction/:uid.
      *
      * Detects the interaction type and redirects to the appropriate frontend page.
      *
-     * @param uid - the interaction UID from the URL path
-     * @param req - the incoming Express request
-     * @param res - the Express response used for redirecting
-     * @returns a redirect response to the appropriate frontend page
-     * @throws {HttpException} 404 when the interaction UID is not found or has expired.
+     * @param uid - The interaction UID from the URL path.
+     * @param req - The incoming Express request.
+     * @param res - The Express response used for redirecting.
+     * @returns A redirect response to the appropriate frontend page.
+     * @throws {HttpException} HTTP 404 when the interaction UID is not found or has expired.
      */ function getInteraction(uid, req, res) {
                 return _async_to_generator$2(function() {
-                    var interaction, prompt;
+                    var interaction, prompt, redirectUrl;
                     return _ts_generator$2(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -5184,15 +5180,10 @@ function _ts_generator$2(thisArg, body) {
                             case 1:
                                 interaction = _state.sent();
                                 prompt = interaction.prompt;
-                                if (prompt.name === 'login') {
-                                    return [
-                                        2,
-                                        res.redirect("".concat(this.oidcProviderConfigService.appLoginUrl, "?uid=").concat(uid))
-                                    ];
-                                }
+                                redirectUrl = prompt.name === 'login' ? "".concat(this.oidcProviderConfigService.appLoginUrl, "?uid=").concat(uid) : "".concat(this.oidcProviderConfigService.appConsentUrl, "?uid=").concat(uid);
                                 return [
                                     2,
-                                    res.redirect("".concat(this.oidcProviderConfigService.appConsentUrl, "?uid=").concat(uid))
+                                    res.redirect(redirectUrl)
                                 ];
                             case 2:
                                 _state.sent();
@@ -5209,16 +5200,16 @@ function _ts_generator$2(thisArg, body) {
         {
             key: "postLogin",
             value: /**
-     * POST /interaction/:uid/login
+     * POST /interaction/:uid/login.
      *
      * Verifies the Firebase Auth ID token sent by the frontend, extracts the
      * user's UID, and completes the oidc-provider login interaction.
      *
-     * @param uid - the interaction UID from the URL path
-     * @param body - the login request containing the Firebase ID token
-     * @param res - the Express response used for sending JSON
-     * @throws {HttpException} 401 when the Firebase ID token is invalid.
-     * @throws {HttpException} 400 when the login interaction cannot be completed.
+     * @param uid - The interaction UID from the URL path.
+     * @param body - The login request containing the Firebase ID token.
+     * @param res - The Express response used for sending JSON.
+     * @throws {HttpException} HTTP 401 when the Firebase ID token is invalid.
+     * @throws {HttpException} HTTP 400 when the login interaction cannot be completed.
      */ function postLogin(uid, body, res) {
                 return _async_to_generator$2(function() {
                     var accountId, redirectTo;
@@ -5273,15 +5264,15 @@ function _ts_generator$2(thisArg, body) {
         {
             key: "postConsent",
             value: /**
-     * POST /interaction/:uid/consent
+     * POST /interaction/:uid/consent.
      *
      * Receives consent decision from frontend. Grants missing OIDC scopes and claims
      * when approved, or returns `access_denied` when rejected.
      *
-     * @param uid - the interaction UID from the URL path
-     * @param body - the consent request containing approval decision and Firebase ID token
-     * @param res - the Express response used for sending JSON
-     * @throws {HttpException} 400 when the consent interaction cannot be completed.
+     * @param uid - The interaction UID from the URL path.
+     * @param body - The consent request containing approval decision and Firebase ID token.
+     * @param res - The Express response used for sending JSON.
+     * @throws {HttpException} HTTP 400 when the consent interaction cannot be completed.
      */ function postConsent(uid, body, res) {
                 return _async_to_generator$2(function() {
                     var _ref, _ref1, _prompt_details_missingOIDCScope, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, redirectTo, interaction, prompt, params, session, clientId, requestedRawTtl, clientPayload, clientMaxSessionTtl, expiresInSeconds, grant, encounteredOIDCScopes, missingOIDCScope, _resolveEffectiveSubset, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset1, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset2, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, redirectTo1, err;
@@ -5362,7 +5353,12 @@ function _ts_generator$2(thisArg, body) {
                                 encounteredOIDCScopes = grant.getOIDCScopeEncountered().split(' ').filter(Boolean);
                                 missingOIDCScope = (_prompt_details_missingOIDCScope = prompt.details.missingOIDCScope) !== null && _prompt_details_missingOIDCScope !== void 0 ? _prompt_details_missingOIDCScope : [];
                                 if (missingOIDCScope.length > 0) {
-                                    _resolveEffectiveSubset = resolveEffectiveSubset(missingOIDCScope, body.grantedOIDCScopes, ALWAYS_GRANTED_OIDC_SCOPES, encounteredOIDCScopes), granted = _resolveEffectiveSubset.granted, rejected = _resolveEffectiveSubset.rejected;
+                                    _resolveEffectiveSubset = resolveEffectiveSubset({
+                                        missing: missingOIDCScope,
+                                        requestedSubset: body.grantedOIDCScopes,
+                                        alwaysGranted: ALWAYS_GRANTED_OIDC_SCOPES,
+                                        alreadyEncountered: encounteredOIDCScopes
+                                    }), granted = _resolveEffectiveSubset.granted, rejected = _resolveEffectiveSubset.rejected;
                                     if (granted.length > 0) {
                                         grant.addOIDCScope(granted.join(' '));
                                     }
@@ -5390,7 +5386,11 @@ function _ts_generator$2(thisArg, body) {
                                 encounteredOIDCClaims = grant.getOIDCClaimsEncountered();
                                 missingOIDCClaims = (_prompt_details_missingOIDCClaims = prompt.details.missingOIDCClaims) !== null && _prompt_details_missingOIDCClaims !== void 0 ? _prompt_details_missingOIDCClaims : [];
                                 if (missingOIDCClaims.length > 0) {
-                                    _resolveEffectiveSubset1 = resolveEffectiveSubset(missingOIDCClaims, body.grantedOIDCClaims, [], encounteredOIDCClaims), granted1 = _resolveEffectiveSubset1.granted, rejected1 = _resolveEffectiveSubset1.rejected;
+                                    _resolveEffectiveSubset1 = resolveEffectiveSubset({
+                                        missing: missingOIDCClaims,
+                                        requestedSubset: body.grantedOIDCClaims,
+                                        alreadyEncountered: encounteredOIDCClaims
+                                    }), granted1 = _resolveEffectiveSubset1.granted, rejected1 = _resolveEffectiveSubset1.rejected;
                                     if (granted1.length > 0) {
                                         grant.addOIDCClaims(granted1);
                                     }
@@ -5406,7 +5406,11 @@ function _ts_generator$2(thisArg, body) {
                                         ;
                                         requestedSubset = (_body_grantedResourceScopes = body.grantedResourceScopes) === null || _body_grantedResourceScopes === void 0 ? void 0 : _body_grantedResourceScopes[indicator];
                                         encounteredResourceScopes = grant.getResourceScopeEncountered(indicator).split(' ').filter(Boolean);
-                                        _resolveEffectiveSubset2 = resolveEffectiveSubset(scopes, requestedSubset, [], encounteredResourceScopes), granted2 = _resolveEffectiveSubset2.granted, rejected2 = _resolveEffectiveSubset2.rejected;
+                                        _resolveEffectiveSubset2 = resolveEffectiveSubset({
+                                            missing: scopes,
+                                            requestedSubset: requestedSubset,
+                                            alreadyEncountered: encounteredResourceScopes
+                                        }), granted2 = _resolveEffectiveSubset2.granted, rejected2 = _resolveEffectiveSubset2.rejected;
                                         if (granted2.length > 0) {
                                             grant.addResourceScope(indicator, granted2.join(' '));
                                         }
@@ -5491,9 +5495,9 @@ function _ts_generator$2(thisArg, body) {
             /**
      * Verifies a Firebase Auth ID token and returns the user's UID.
      *
-     * @param idToken - the Firebase Auth ID token to verify
-     * @returns the user's UID extracted from the decoded token
-     * @throws {HttpException} 401 when the token is invalid or expired.
+     * @param idToken - The Firebase Auth ID token to verify.
+     * @returns The user's UID extracted from the decoded token.
+     * @throws {HttpException} HTTP 401 when the token is invalid or expired.
      */ function _verifyIdToken(idToken) {
                 return _async_to_generator$2(function() {
                     var decodedToken;
@@ -5574,13 +5578,11 @@ OidcInteractionController = __decorate([
  *   are not re-applied to the grant (no-op).
  * - Always-granted entries are union'd into `granted` (clamped to `missing`).
  *
- * @param missing - Entries the OIDC prompt indicated were missing for this consent.
- * @param requestedSubset - Optional subset the caller wants to grant; each value must be in `missing` or `alreadyEncountered`.
- * @param alwaysGranted - Entries that must be granted whenever they appear in `missing`, regardless of `requestedSubset`.
- * @param alreadyEncountered - Entries the existing Grant has previously granted or rejected. Tolerated as no-ops on re-consent.
+ * @param input - Missing entries plus optional subset, always-granted, and already-encountered lists.
  * @returns `granted` to add to the grant and `rejected` to record on the grant.
- */ function resolveEffectiveSubset(missing, requestedSubset) {
-    var alwaysGranted = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : [], alreadyEncountered = arguments.length > 3 && arguments[3] !== void 0 ? arguments[3] : [];
+ * @throws {HttpException} `400 BAD_REQUEST` when `requestedSubset` includes a value that is neither missing nor already-encountered.
+ */ function resolveEffectiveSubset(input) {
+    var missing = input.missing, requestedSubset = input.requestedSubset, _input_alwaysGranted = input.alwaysGranted, alwaysGranted = _input_alwaysGranted === void 0 ? [] : _input_alwaysGranted, _input_alreadyEncountered = input.alreadyEncountered, alreadyEncountered = _input_alreadyEncountered === void 0 ? [] : _input_alreadyEncountered;
     var missingSet = new Set(missing);
     var encounteredSet = new Set(alreadyEncountered);
     var baseSelection;
@@ -5851,7 +5853,7 @@ function _ts_generator$1(thisArg, body) {
     _create_class$1(OidcProviderController, [
         {
             /**
-     * GET /oidc/login/client
+     * GET /oidc/login/client.
      *
      * Convenience redirect from the API issuer path back to the frontend app's
      * OAuth login page. Lets a user who lands on the API host get bounced to the
@@ -5923,16 +5925,20 @@ OidcProviderController = __decorate([
  * @returns The base URL with the original URL's query string appended using the appropriate `?`/`&` separator.
  */ function mergeQueryParamsFromOriginalUrl(input) {
     var queryIndex = input.originalUrl.indexOf('?');
+    var result;
     if (queryIndex < 0) {
-        return input.baseUrl;
-    }
-    var incomingSearch = input.originalUrl.slice(queryIndex + 1);
-    if (incomingSearch.length === 0) {
-        return input.baseUrl;
+        result = input.baseUrl;
+    } else {
+        var incomingSearch = input.originalUrl.slice(queryIndex + 1);
+        if (incomingSearch.length === 0) {
+            result = input.baseUrl;
+        } else {
+            var baseQueryIndex = input.baseUrl.indexOf('?');
+            var separator = baseQueryIndex < 0 ? '?' : '&';
+            result = "".concat(input.baseUrl).concat(separator).concat(incomingSearch);
+        }
     }
-    var baseQueryIndex = input.baseUrl.indexOf('?');
-    var separator = baseQueryIndex < 0 ? '?' : '&';
-    return "".concat(input.baseUrl).concat(separator).concat(incomingSearch);
+    return result;
 }
 
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
@@ -6116,7 +6122,7 @@ function _ts_generator(thisArg, body) {
      * Returns the provider metadata so clients can auto-discover endpoints,
      * supported scopes, signing algorithms, etc.
      *
-     * @returns the OIDC discovery metadata document
+     * @returns The OIDC discovery metadata document.
      */ function getOpenIdConfiguration() {
                 return _async_to_generator(function() {
                     var _ref, jwksUri;
@@ -6145,7 +6151,7 @@ function _ts_generator(thisArg, body) {
      *
      * This endpoint is typically skipped if the JwksServiceStorageConfig is provided.
      *
-     * @returns the public JWKS containing all non-retired signing keys
+     * @returns The public JWKS containing all non-retired signing keys.
      */ function getJwks() {
                 return _async_to_generator(function() {
                     return _ts_generator(this, function(_state) {
@@ -6164,7 +6170,7 @@ function _ts_generator(thisArg, body) {
      * Returns the authorization server(s) that protect this resource,
      * allowing clients to discover which authorization server to use.
      *
-     * @returns the protected resource metadata with authorization server URLs
+     * @returns The protected resource metadata with authorization server URLs.
      */ key: "getProtectedResource",
             value: function getProtectedResource() {
                 return {
@@ -6309,7 +6315,7 @@ function _unsupported_iterable_to_array(o, minLen) {
  * caller then falls back to `appUrl` (the single-origin default). The compare is on the parsed
  * URL origin so a default `appApiUrl = "${appUrl}/api"` is treated as the same origin.
  *
- * @param envService - the Firebase server environment service.
+ * @param envService - The Firebase server environment service.
  * @returns The API origin (no trailing slash) when distinct from the frontend origin, otherwise `undefined`.
  *
  * @example
@@ -6348,9 +6354,9 @@ function _unsupported_iterable_to_array(o, minLen) {
  * The issuer can also be overridden directly by passing `issuer` on the `config` block to
  * {@link oidcModuleMetadata}; the override wins over the factory-derived value.
  *
- * @param configService - the NestJS ConfigService for reading environment variables
- * @param envService - the Firebase server environment service for app URL and env detection
- * @returns the constructed OidcModuleConfig
+ * @param configService - The NestJS ConfigService for reading environment variables.
+ * @param envService - The Firebase server environment service for app URL and env detection.
+ * @returns The constructed OidcModuleConfig.
  * @throws {Error} When `appUrl` is missing, the resolved issuer lacks an HTTP prefix, or the encryption secret is invalid.
  */ function oidcModuleConfigFactory(configService, envService) {
     var _resolveOidcIssuerOriginFromEnv, _configService_get;
@@ -6401,9 +6407,9 @@ function _unsupported_iterable_to_array(o, minLen) {
  * Factory that creates {@link OidcServerFirestoreCollections} using the provided Firestore context
  * and JWKS encryption config from {@link OidcModuleConfig}.
  *
- * @param firestoreContext - the Firestore context for collection creation
- * @param oidcModuleConfig - the OIDC module config containing JWKS encryption settings
- * @returns the configured OidcServerFirestoreCollections
+ * @param firestoreContext - The Firestore context for collection creation.
+ * @param oidcModuleConfig - The OIDC module config containing JWKS encryption settings.
+ * @returns The configured OidcServerFirestoreCollections.
  */ function oidcFirestoreCollectionsFactory(firestoreContext, oidcModuleConfig) {
     return {
         jwksKeyCollection: jwksKeyFirestoreCollection(_object_spread({
@@ -6424,8 +6430,8 @@ function _unsupported_iterable_to_array(o, minLen) {
  * Additionally, the following may be optionally provided:
  * - JwksServiceStorageConfig
  *
- * @param metadataConfig - the configuration for generating the OIDC module metadata
- * @returns the NestJS module metadata for the OIDC module
+ * @param metadataConfig - The configuration for generating the OIDC module metadata.
+ * @returns The NestJS module metadata for the OIDC module.
  */ function oidcModuleMetadata(metadataConfig) {
     var dependencyModule = metadataConfig.dependencyModule, config = metadataConfig.config, imports = metadataConfig.imports, exports = metadataConfig.exports, providers = metadataConfig.providers;
     var dependencyModuleImport = [