@dereekb/firebase-server 13.11.2 → 13.11.4

package/oidc/index.cjs.js

@@ -1,12 +1,14 @@
 'use strict';
 
 var common = require('@nestjs/common');
+var oidcProvider = require('oidc-provider');
+var util = require('@dereekb/util');
 var node_crypto = require('node:crypto');
 var nestjs = require('@dereekb/nestjs');
 var firebase = require('@dereekb/firebase');
-var util = require('@dereekb/util');
 var firebaseServer = require('@dereekb/firebase-server');
 var nanoid = require('nanoid');
+var date = require('@dereekb/date');
 var fetch = require('@dereekb/util/fetch');
 var config = require('@nestjs/config');
 
@@ -79,12 +81,20 @@ function _define_property$f(obj, key, value) {
     return obj;
 }
 /**
- * Default token lifetimes: 15 min access tokens, 30-day refresh tokens, 60 s auth codes.
+ * Default global ceiling for a client-requested login duration, in seconds. 90 days.
+ */ var DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS = 90 * util.SECONDS_IN_DAY;
+/**
+ * Default global floor for a client-requested login duration, in seconds. 1 hour.
+ */ var DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS = 60 * util.SECONDS_IN_MINUTE;
+/**
+ * Default token lifetimes: 15 min access tokens, 30-day refresh tokens, 30-day sessions/grants, 60 s auth codes.
  */ var DEFAULT_OIDC_TOKEN_LIFETIMES = {
-    accessToken: 900,
-    idToken: 3600,
-    refreshToken: 30 * 24 * 60 * 60,
-    authorizationCode: 60
+    accessToken: 15 * util.SECONDS_IN_MINUTE,
+    idToken: 60 * util.SECONDS_IN_MINUTE,
+    refreshToken: 30 * util.SECONDS_IN_DAY,
+    authorizationCode: util.SECONDS_IN_MINUTE,
+    session: 30 * util.SECONDS_IN_DAY,
+    grant: 30 * util.SECONDS_IN_DAY
 };
 // MARK: Config
 /**
@@ -120,6 +130,26 @@ function _define_property$f(obj, key, value) {
      * Token lifetime configuration.
      */ _define_property$f(this, "tokenLifetimes", void 0);
         /**
+     * Maximum login duration (seconds) a client may request via the `dbx_session_ttl` auth-URL param.
+     *
+     * Acts as the global server cap for any per-request duration. A registered client can declare its own
+     * lower ceiling via the `dbx_max_session_ttl` client metadata field; the effective ceiling is
+     * `min(client.dbx_max_session_ttl, this)`.
+     *
+     * Defaults to {@link DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS} (90 days).
+     */ _define_property$f(this, "maxRequestedLoginDuration", void 0);
+        /**
+     * Minimum login duration (seconds) a client may request via the `dbx_session_ttl` auth-URL param.
+     *
+     * Requested values below this floor are clamped up. Prevents pathological 30-second sessions.
+     *
+     * Defaults to {@link DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS} (1 hour).
+     */ _define_property$f(this, "minRequestedLoginDuration", void 0);
+        /**
+     * Default login duration (seconds) used when a client does NOT pass the `dbx_session_ttl`
+     * auth-URL param. When undefined, falls back to {@link OidcTokenLifetimes.refreshToken}.
+     */ _define_property$f(this, "defaultRequestedLoginDuration", void 0);
+        /**
      * JWKS service configuration (encryption secret, rotated key max age).
      */ _define_property$f(this, "jwksServiceConfig", void 0);
         /**
@@ -168,6 +198,33 @@ function _define_property$f(obj, key, value) {
      *
      * Defaults to `false`.
      */ _define_property$f(this, "registrationEnabled", void 0);
+        /**
+     * Whether the oidc-provider should trust upstream proxy headers
+     * (`X-Forwarded-Host`, `X-Forwarded-Proto`) when computing the request URL
+     * used to build resume/return URLs and discovery metadata absolute paths.
+     *
+     * Required when running behind a reverse proxy such as Firebase Hosting →
+     * Cloud Run / Cloud Functions, where the request `Host` header is the
+     * underlying Cloud Run host (e.g. `api-xxxxx-uc.a.run.app`) and not the
+     * canonical issuer host. Without this, the interaction `returnTo` URL is
+     * built off the Cloud Run host and the browser is redirected away from the
+     * issuer's domain after login — causing the interaction cookies (scoped to
+     * the canonical host) to be missing on the resume request and producing
+     * "authorization request has expired".
+     *
+     * Maps to `provider.proxy = <value>` on the underlying oidc-provider
+     * (which is the Koa `app.proxy` setting).
+     *
+     * Defaults to `'prod_only'` if the environment is `production`, otherwise `false`.
+     */ _define_property$f(this, "trustProxy", void 0);
+        /**
+     * Whether to trust proxy headers in a non-production environment, such as the local environment.
+     *
+     * The dev environment typically does not require proxy headers, and setting
+     * `true` will result in errors.
+     *
+     * Defaults to `false`.
+     */ _define_property$f(this, "trustProxyInNonProduction", void 0);
     }
     _create_class$d(OidcModuleConfig, null, [
         {
@@ -205,6 +262,95 @@ function _define_property$f(obj, key, value) {
 } 
 ();
 
+/**
+ * Custom OIDC auth-URL parameter clients use to request a non-default login duration.
+ *
+ * Value is integer seconds. Subject to per-client and global server caps via {@link resolveLoginDurationSeconds}.
+ */ var DBX_FIREBASE_SERVER_OIDC_SESSION_TTL_PARAM = 'dbx_session_ttl';
+/**
+ * Custom oidc-provider client metadata field for a client's maximum requestable login duration (seconds).
+ */ var DBX_FIREBASE_SERVER_OIDC_MAX_SESSION_TTL_CLIENT_METADATA = 'dbx_max_session_ttl';
+/**
+ * Clamps a requested login duration into the allowed range.
+ *
+ * Resolution order:
+ * 1. Pick the requested value, falling back to the configured default when omitted.
+ * 2. Compute the effective ceiling as `min(serverMax, clientMax-or-Infinity)`.
+ * 3. Clamp the value to `[serverMin, ceiling]`.
+ *
+ * @param input - The clamp inputs (requested value, client cap, server bounds, default).
+ * @returns The clamped duration in seconds.
+ *
+ * @example
+ * ```typescript
+ * resolveLoginDurationSeconds({
+ *   requestedSeconds: 60 * 24 * 60 * 60, // 60 days
+ *   clientMaxSeconds: 30 * 24 * 60 * 60, // 30 days client cap
+ *   serverMaxSeconds: 90 * 24 * 60 * 60, // 90 days global cap
+ *   serverMinSeconds: 60 * 60,           // 1 hour floor
+ *   defaultSeconds: 30 * 24 * 60 * 60
+ * }); // → 30 * 24 * 60 * 60 (clamped to client max)
+ * ```
+ */ function resolveLoginDurationSeconds(input) {
+    var _input_requestedSeconds, _input_clientMaxSeconds;
+    var raw = (_input_requestedSeconds = input.requestedSeconds) !== null && _input_requestedSeconds !== void 0 ? _input_requestedSeconds : input.defaultSeconds;
+    var ceiling = Math.min(input.serverMaxSeconds, (_input_clientMaxSeconds = input.clientMaxSeconds) !== null && _input_clientMaxSeconds !== void 0 ? _input_clientMaxSeconds : Infinity);
+    return Math.max(input.serverMinSeconds, Math.min(raw, ceiling));
+}
+// MARK: Param parsing
+/**
+ * Parses a raw `dbx_session_ttl` value (string or number, from URL query / form / persisted interaction params)
+ * into a positive integer number of seconds. Returns `undefined` when missing or invalid so the caller falls
+ * back to a default.
+ *
+ * @param raw - The raw value to parse.
+ * @returns The parsed positive integer seconds, or `undefined` when absent/invalid.
+ */ function parseRequestedSessionTtlSeconds(raw) {
+    var result;
+    if (typeof raw === 'string' && raw.length > 0) {
+        var parsed = Number(raw);
+        if (Number.isFinite(parsed) && Number.isInteger(parsed) && parsed > 0) {
+            result = parsed;
+        }
+    } else if (typeof raw === 'number' && Number.isFinite(raw) && Number.isInteger(raw) && raw > 0) {
+        result = raw;
+    }
+    return result;
+}
+/**
+ * Reads {@link DBX_FIREBASE_SERVER_OIDC_SESSION_TTL_PARAM} from a KoaContextWithOIDC and parses it to a positive integer
+ * number of seconds. Returns `undefined` when missing or invalid (so the caller falls back to a default).
+ *
+ * @param ctx - The OIDC Koa context, or undefined.
+ * @returns The parsed positive integer seconds, or `undefined` when absent/invalid.
+ */ function readRequestedSessionTtlSeconds(ctx) {
+    var _ctx_oidc;
+    var params = ctx === null || ctx === void 0 ? void 0 : (_ctx_oidc = ctx.oidc) === null || _ctx_oidc === void 0 ? void 0 : _ctx_oidc.params;
+    var raw = params != null ? params[DBX_FIREBASE_SERVER_OIDC_SESSION_TTL_PARAM] : undefined;
+    return parseRequestedSessionTtlSeconds(raw);
+}
+// MARK: Grant remaining time
+/**
+ * Inspects oidc-provider entities on the context to find the resolved Grant expiry.
+ *
+ * Returns the remaining seconds until the Grant expires, or `undefined` when no Grant is bound to the context.
+ *
+ * @param ctx - The OIDC Koa context, or undefined.
+ * @returns The remaining seconds until grant expiry, or `undefined` when no grant is bound or it has expired.
+ */ function readRemainingGrantSeconds(ctx) {
+    var _ctx_oidc_entities, _ctx_oidc;
+    var grant = ctx === null || ctx === void 0 ? void 0 : (_ctx_oidc = ctx.oidc) === null || _ctx_oidc === void 0 ? void 0 : (_ctx_oidc_entities = _ctx_oidc.entities) === null || _ctx_oidc_entities === void 0 ? void 0 : _ctx_oidc_entities.Grant;
+    var result;
+    if ((grant === null || grant === void 0 ? void 0 : grant.exp) != null && Number.isFinite(grant.exp)) {
+        var now = Math.floor(Date.now() / 1000);
+        var remaining = grant.exp - now;
+        if (remaining > 0) {
+            result = remaining;
+        }
+    }
+    return result;
+}
+
 /**
  * Query for JwksKey documents with a specific status.
  *
@@ -1609,7 +1755,8 @@ function _ts_generator$8(thisArg, body) {
         createOidcClient: createOidcClientFactory(context),
         updateOidcClient: updateOidcClientFactory(context),
         rotateOidcClientSecret: rotateOidcClientSecretFactory(context),
-        deleteOidcClient: deleteOidcClientFactory(context)
+        deleteOidcClient: deleteOidcClientFactory(context),
+        deleteOidcToken: deleteOidcTokenFactory(context)
     };
 }
 // MARK: Actions
@@ -1748,6 +1895,59 @@ function _ts_generator$8(thisArg, body) {
         })();
     });
 }
+/**
+ * Factory for the `deleteOidcToken` action.
+ *
+ * Asserts the target {@link OidcEntryDocument} is of type `Grant`, then delegates to
+ * {@link OidcService.revokeGrant} so all grantable token entries (`AccessToken`,
+ * `RefreshToken`, `AuthorizationCode`, `DeviceCode`, `BackchannelAuthenticationRequest`)
+ * sharing the grant id are deleted along with the Grant entry itself.
+ *
+ * Per-user authorization (this user owns this Grant) is enforced upstream via the
+ * model permission service before this action runs.
+ *
+ * @param context - the OIDC model server actions context
+ * @returns a transform function factory for revoking OIDC grants
+ */ function deleteOidcTokenFactory(context) {
+    var oidcService = context.oidcService, firebaseServerActionTransformFunctionFactory = context.firebaseServerActionTransformFunctionFactory;
+    return firebaseServerActionTransformFunctionFactory(firebase.deleteOidcTokenParamsType, function(_params) {
+        return _async_to_generator$8(function() {
+            return _ts_generator$8(this, function(_state) {
+                return [
+                    2,
+                    function(document) {
+                        return _async_to_generator$8(function() {
+                            var data;
+                            return _ts_generator$8(this, function(_state) {
+                                switch(_state.label){
+                                    case 0:
+                                        return [
+                                            4,
+                                            document.snapshotData()
+                                        ];
+                                    case 1:
+                                        data = _state.sent();
+                                        if ((data === null || data === void 0 ? void 0 : data.type) !== 'Grant') {
+                                            throw new Error('Only Grant entries can be revoked through this endpoint.');
+                                        }
+                                        return [
+                                            4,
+                                            oidcService.revokeGrant(document.id)
+                                        ];
+                                    case 2:
+                                        _state.sent();
+                                        return [
+                                            2
+                                        ];
+                                }
+                            });
+                        })();
+                    }
+                ];
+            });
+        })();
+    });
+}
 
 function asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, key, arg) {
     try {
@@ -2007,6 +2207,9 @@ function _ts_generator$7(thisArg, body) {
                                 if (params.jwks_uri) {
                                     properties.jwks_uri = params.jwks_uri;
                                 }
+                                if (params.dbx_max_session_ttl != null) {
+                                    properties.dbx_max_session_ttl = params.dbx_max_session_ttl;
+                                }
                                 // Merge any pre-validated metadata (e.g., inline jwks for private_key_jwt in tests)
                                 if (validatedMetadata === null || validatedMetadata === void 0 ? void 0 : validatedMetadata.jwks) {
                                     properties.jwks = validatedMetadata.jwks;
@@ -2064,7 +2267,7 @@ function _ts_generator$7(thisArg, body) {
      * @throws When the client is not found.
      */ function updateClient(clientId, params) {
                 return _async_to_generator$7(function() {
-                    var provider, ProviderClient, existing, updatedMetadata, _params_logo_uri, _params_client_uri, client;
+                    var provider, ProviderClient, existing, updatedMetadata, _params_logo_uri, _params_client_uri, _params_dbx_max_session_ttl, client;
                     return _ts_generator$7(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -2093,6 +2296,9 @@ function _ts_generator$7(thisArg, body) {
                                 if (params.client_uri !== undefined) {
                                     updatedMetadata.client_uri = (_params_client_uri = params.client_uri) !== null && _params_client_uri !== void 0 ? _params_client_uri : undefined;
                                 }
+                                if (params.dbx_max_session_ttl !== undefined) {
+                                    updatedMetadata.dbx_max_session_ttl = (_params_dbx_max_session_ttl = params.dbx_max_session_ttl) !== null && _params_dbx_max_session_ttl !== void 0 ? _params_dbx_max_session_ttl : undefined;
+                                }
                                 // Mirrors oidc-provider's lib/helpers/add_client.js: re-validates and persists.
                                 return [
                                     4,
@@ -2275,13 +2481,15 @@ function _object_spread_props$1(target, source) {
 }
 // MARK: Provider Factories
 /**
- * Factory that creates an {@link OidcModelServerActions} instance from the injected {@link OidcClientService}.
+ * Factory that creates an {@link OidcModelServerActions} instance from the injected services.
  *
- * @param oidcClientService - the OIDC client service to wire into the server actions
+ * @param oidcClientService - the OIDC client service for client CRUD actions
+ * @param oidcService - the core OIDC service for grant revocation
  * @returns the configured OidcModelServerActions instance
- */ function oidcModelServerActionsFactory(oidcClientService) {
+ */ function oidcModelServerActionsFactory(oidcClientService, oidcService) {
     var context = _object_spread_props$1(_object_spread$4({}, firebaseServer.firebaseServerActionsContext()), {
-        oidcClientService: oidcClientService
+        oidcClientService: oidcClientService,
+        oidcService: oidcService
     });
     return oidcModelServerActions(context);
 }
@@ -2307,7 +2515,8 @@ function _object_spread_props$1(target, source) {
                 provide: OidcModelServerActions,
                 useFactory: oidcModelServerActionsFactory,
                 inject: [
-                    OidcClientService
+                    OidcClientService,
+                    exports.OidcService
                 ]
             }
         ]
@@ -2499,13 +2708,14 @@ function _ts_generator$6(thisArg, body) {
 // MARK: Adapter
 /**
  * Model types that support grantId-based revocation.
- */ var GRANTABLE_MODELS = new Set([
+ */ var GRANTABLE_MODEL_NAMES = [
     'AccessToken',
     'AuthorizationCode',
     'RefreshToken',
     'DeviceCode',
     'BackchannelAuthenticationRequest'
-]);
+];
+var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
 /**
  * Creates an oidc-provider adapter constructor backed by Firestore via {@link OidcServerFirestoreCollections}.
  *
@@ -2536,22 +2746,44 @@ function _ts_generator$6(thisArg, body) {
                 key: "upsert",
                 value: function upsert(id, payload, expiresIn) {
                     return _async_to_generator$6(function() {
-                        var o, data, doc;
+                        var _payload_uid, _payload_clientId, o, uid, clientId, iat, createdAtIso, createdAt, data, doc;
                         return _ts_generator$6(this, function(_state) {
                             switch(_state.label){
                                 case 0:
                                     // Set ownership key for Client entries so firestore rules can restrict reads by owner.
                                     // The firestoreOwnerKey is passed through the payload metadata by OidcClientService.
                                     o = this.name === firebase.OIDC_ENTRY_CLIENT_TYPE ? payload.firestoreOwnerKey : undefined;
+                                    // oidc-provider uses `accountId` as the user identifier on Grant, AccessToken,
+                                    // RefreshToken, etc. — `payload.uid` is only populated on Session/Interaction.
+                                    // Fall back to `accountId` so the indexed `uid` column works for all entry types.
+                                    uid = (_payload_uid = payload.uid) !== null && _payload_uid !== void 0 ? _payload_uid : payload.accountId;
+                                    // oidc-provider stores the OAuth client id as `clientId` on every grantable
+                                    // model (Grant, AccessToken, RefreshToken, AuthorizationCode, DeviceCode, etc.).
+                                    // Client entries themselves use `client_id` in the payload, so we read both.
+                                    clientId = (_payload_clientId = payload.clientId) !== null && _payload_clientId !== void 0 ? _payload_clientId : payload.client_id;
+                                    // Derive a stable `createdAt` from the payload so it survives upserts
+                                    // (e.g. `consume`). Grant/AccessToken/RefreshToken/AuthorizationCode all
+                                    // inherit `iat` (epoch seconds) from BaseToken; Client entries use
+                                    // `created_at` (ISO string).
+                                    iat = payload.iat;
+                                    createdAtIso = payload.created_at;
+                                    if (typeof iat === 'number') {
+                                        createdAt = util.unixDateTimeSecondsNumberToDate(iat);
+                                    } else if (createdAtIso) {
+                                        createdAt = date.safeToJsDate(createdAtIso);
+                                    }
                                     data = _object_spread$3({
                                         type: this.name,
                                         payload: encryptionService.encryptAdapterPayload(payload),
                                         o: o,
-                                        uid: payload.uid,
+                                        uid: uid,
                                         grantId: payload.grantId,
+                                        clientId: clientId,
                                         userCode: payload.userCode,
                                         consumed: payload.consumed
-                                    }, expiresIn ? {
+                                    }, createdAt ? {
+                                        createdAt: createdAt
+                                    } : undefined, expiresIn ? {
                                         expiresAt: util.unixDateTimeSecondsNumberToDate(util.unixDateTimeSecondsNumberForNow() + expiresIn)
                                     } : undefined);
                                     doc = this.collection.documentAccessor().loadDocumentForId(id);
@@ -3365,6 +3597,36 @@ function _ts_generator$5(thisArg, body) {
                 return this._getProvider();
             }
         },
+        {
+            // MARK: Login Duration
+            /**
+     * Resolves the login-duration TTL (seconds) for a Grant being created from a fresh consent submission.
+     *
+     * The Grant TTL configured on the oidc-provider only fires when oidc-provider's koa middleware drives
+     * `grant.save()` (so `AsyncLocalStorage` carries the request context). Our consent flow saves grants
+     * from a NestJS controller, so we resolve the TTL up-front and pre-set `grant.expiresIn` before saving.
+     *
+     * Mirrors the resolution used by the `Grant`/`Session` TTL functions in {@link buildProviderConfiguration}.
+     *
+     * @param requestedRawTtl - The raw `dbx_session_ttl` value from `interaction.params`, if any.
+     * @param clientPayload - The persisted client metadata, used to read the per-client `dbx_max_session_ttl` cap.
+     * @returns The resolved Grant TTL in seconds.
+     */ key: "resolveLoginDurationForGrant",
+            value: function resolveLoginDurationForGrant(requestedRawTtl, clientPayload) {
+                var _config_maxRequestedLoginDuration, _config_minRequestedLoginDuration, _config_defaultRequestedLoginDuration;
+                var config = this.config;
+                var serverMaxSeconds = (_config_maxRequestedLoginDuration = config.maxRequestedLoginDuration) !== null && _config_maxRequestedLoginDuration !== void 0 ? _config_maxRequestedLoginDuration : DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS;
+                var serverMinSeconds = (_config_minRequestedLoginDuration = config.minRequestedLoginDuration) !== null && _config_minRequestedLoginDuration !== void 0 ? _config_minRequestedLoginDuration : DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS;
+                var defaultSeconds = (_config_defaultRequestedLoginDuration = config.defaultRequestedLoginDuration) !== null && _config_defaultRequestedLoginDuration !== void 0 ? _config_defaultRequestedLoginDuration : config.tokenLifetimes.grant;
+                return resolveLoginDurationSeconds({
+                    requestedSeconds: parseRequestedSessionTtlSeconds(requestedRawTtl),
+                    clientMaxSeconds: clientPayload === null || clientPayload === void 0 ? void 0 : clientPayload.dbx_max_session_ttl,
+                    serverMaxSeconds: serverMaxSeconds,
+                    serverMinSeconds: serverMinSeconds,
+                    defaultSeconds: defaultSeconds
+                });
+            }
+        },
         {
             key: "verifyAccessToken",
             value: // MARK: Token Verification
@@ -3442,6 +3704,67 @@ function _ts_generator$5(thisArg, body) {
                 }).call(this);
             }
         },
+        {
+            key: "revokeGrant",
+            value: // MARK: Grant Revocation
+            /**
+     * Revokes a Grant entry and every grantable token entry that references it.
+     *
+     * Iterates through every grantable model (`AccessToken`, `AuthorizationCode`,
+     * `RefreshToken`, `DeviceCode`, `BackchannelAuthenticationRequest`) and calls
+     * the adapter's `revokeByGrantId` to delete all matching entries, then
+     * deletes the Grant adapter entry itself. After this resolves, any token
+     * referencing the grant is gone — `verifyAccessToken` returns `undefined`
+     * and a `grant_type=refresh_token` exchange fails with `invalid_grant`.
+     *
+     * @param grantId - the grant id (and Grant adapter entry id) to revoke
+     * @throws when the Grant entry does not exist
+     */ function revokeGrant(grantId) {
+                return _async_to_generator$5(function() {
+                    var provider, ProviderGrant, existing;
+                    return _ts_generator$5(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                return [
+                                    4,
+                                    this.getProvider()
+                                ];
+                            case 1:
+                                provider = _state.sent();
+                                ProviderGrant = provider.Grant;
+                                return [
+                                    4,
+                                    ProviderGrant.adapter.find(grantId)
+                                ];
+                            case 2:
+                                existing = _state.sent();
+                                if (!existing) {
+                                    throw new Error('Grant not found.');
+                                }
+                                return [
+                                    4,
+                                    Promise.all(GRANTABLE_MODEL_NAMES.map(function(modelName) {
+                                        var _Model_adapter_revokeByGrantId, _Model_adapter;
+                                        var Model = provider[modelName];
+                                        return Model === null || Model === void 0 ? void 0 : (_Model_adapter = Model.adapter) === null || _Model_adapter === void 0 ? void 0 : (_Model_adapter_revokeByGrantId = _Model_adapter.revokeByGrantId) === null || _Model_adapter_revokeByGrantId === void 0 ? void 0 : _Model_adapter_revokeByGrantId.call(_Model_adapter, grantId);
+                                    }))
+                                ];
+                            case 3:
+                                _state.sent();
+                                return [
+                                    4,
+                                    ProviderGrant.adapter.destroy(grantId)
+                                ];
+                            case 4:
+                                _state.sent();
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
         {
             key: "findClientPayload",
             value: /**
@@ -3478,7 +3801,8 @@ function _ts_generator$5(thisArg, body) {
                                         token_endpoint_auth_method: existing.token_endpoint_auth_method,
                                         logo_uri: existing.logo_uri,
                                         client_uri: existing.client_uri,
-                                        created_at: existing.created_at
+                                        created_at: existing.created_at,
+                                        dbx_max_session_ttl: existing.dbx_max_session_ttl
                                     };
                                 }
                                 return [
@@ -3503,8 +3827,21 @@ function _ts_generator$5(thisArg, body) {
      */ key: "buildProviderConfiguration",
             value: function buildProviderConfiguration(cookieKeys) {
                 var _this = this;
+                var _config_maxRequestedLoginDuration, _config_minRequestedLoginDuration;
                 var config = this.config;
                 var providerConfig = this.providerConfigService.providerConfig;
+                var serverMaxSeconds = (_config_maxRequestedLoginDuration = config.maxRequestedLoginDuration) !== null && _config_maxRequestedLoginDuration !== void 0 ? _config_maxRequestedLoginDuration : DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS;
+                var serverMinSeconds = (_config_minRequestedLoginDuration = config.minRequestedLoginDuration) !== null && _config_minRequestedLoginDuration !== void 0 ? _config_minRequestedLoginDuration : DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS;
+                var overrideDefaultSeconds = config.defaultRequestedLoginDuration;
+                var resolveDurationFromCtx = function resolveDurationFromCtx(ctx, client, perModelDefaultSeconds) {
+                    return resolveLoginDurationSeconds({
+                        requestedSeconds: readRequestedSessionTtlSeconds(ctx),
+                        clientMaxSeconds: client === null || client === void 0 ? void 0 : client.dbx_max_session_ttl,
+                        serverMaxSeconds: serverMaxSeconds,
+                        serverMinSeconds: serverMinSeconds,
+                        defaultSeconds: overrideDefaultSeconds !== null && overrideDefaultSeconds !== void 0 ? overrideDefaultSeconds : perModelDefaultSeconds
+                    });
+                };
                 return _object_spread_props(_object_spread$2({
                     routes: _object_spread$2({}, this.providerConfigService.routes),
                     claims: _object_spread$2({}, providerConfig.claims),
@@ -3525,13 +3862,46 @@ function _ts_generator$5(thisArg, body) {
                             enabled: this.providerConfigService.oidcRegistrationRouteEnabled
                         }
                     },
+                    extraParams: [
+                        DBX_FIREBASE_SERVER_OIDC_SESSION_TTL_PARAM
+                    ],
+                    extraClientMetadata: {
+                        properties: [
+                            DBX_FIREBASE_SERVER_OIDC_MAX_SESSION_TTL_CLIENT_METADATA
+                        ],
+                        validator: function validator(_ctx, key, value) {
+                            if (key !== DBX_FIREBASE_SERVER_OIDC_MAX_SESSION_TTL_CLIENT_METADATA) {
+                                return;
+                            }
+                            if (value === undefined || value === null) {
+                                return;
+                            }
+                            if (typeof value !== 'number' || !Number.isInteger(value) || value <= 0) {
+                                throw new oidcProvider.errors.InvalidClientMetadata("".concat(DBX_FIREBASE_SERVER_OIDC_MAX_SESSION_TTL_CLIENT_METADATA, " must be a positive integer (seconds)."));
+                            }
+                            if (value > serverMaxSeconds) {
+                                throw new oidcProvider.errors.InvalidClientMetadata("".concat(DBX_FIREBASE_SERVER_OIDC_MAX_SESSION_TTL_CLIENT_METADATA, " cannot exceed the server max of ").concat(serverMaxSeconds, " seconds."));
+                            }
+                        }
+                    },
                     ttl: {
                         AccessToken: config.tokenLifetimes.accessToken,
                         IdToken: config.tokenLifetimes.idToken,
                         AuthorizationCode: config.tokenLifetimes.authorizationCode,
-                        RefreshToken: config.tokenLifetimes.refreshToken,
-                        Session: 14 * 24 * 60 * 60,
-                        Grant: 14 * 24 * 60 * 60,
+                        RefreshToken: function RefreshToken(ctx, _refreshToken, _client) {
+                            // The token endpoint's ctx.oidc.params holds the token-request body (code, code_verifier, …),
+                            // not the original auth params — `dbx_session_ttl` is no longer reachable here. The Grant
+                            // entity is bound on both initial issuance (authorization_code → token) and rotation
+                            // (refresh_token → token), and its `exp` already encodes the resolved login duration.
+                            var remaining = readRemainingGrantSeconds(ctx);
+                            return Math.min(remaining !== null && remaining !== void 0 ? remaining : config.tokenLifetimes.refreshToken, config.tokenLifetimes.refreshToken);
+                        },
+                        Session: function Session(ctx, _session) {
+                            return resolveDurationFromCtx(ctx, undefined, config.tokenLifetimes.session);
+                        },
+                        Grant: function Grant(ctx, _grant, client) {
+                            return resolveDurationFromCtx(ctx, client, config.tokenLifetimes.grant);
+                        },
                         Interaction: 60 * 60,
                         DeviceCode: 10 * 60
                     },
@@ -3650,7 +4020,7 @@ function _ts_generator$5(thisArg, body) {
             value: // MARK: Internal
             function _buildProvider() {
                 return _async_to_generator$5(function() {
-                    var _this, config, findAccount, signingKey, result, getEncryptionKey, cookieKey, adapterFactory, providerConfiguration, _ref, ProviderClass, provider;
+                    var _this, _config_trustProxy, config, findAccount, signingKey, result, getEncryptionKey, cookieKey, adapterFactory, providerConfiguration, _ref, ProviderClass, provider;
                     return _ts_generator$5(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -3701,6 +4071,12 @@ function _ts_generator$5(thisArg, body) {
                                         ]
                                     }
                                 }));
+                                // Trust upstream X-Forwarded-* headers when running behind a reverse proxy
+                                // (e.g. Firebase Hosting → Cloud Run). Without this, oidc-provider builds
+                                // the interaction `returnTo` URL off the Cloud Run host instead of the
+                                // issuer's canonical host, so cookies set on the issuer host are not sent
+                                // on resume → "authorization request has expired".
+                                provider.proxy = (_config_trustProxy = config.trustProxy) !== null && _config_trustProxy !== void 0 ? _config_trustProxy : true;
                                 if (config.suppressBodyParserWarning) ;
                                 return [
                                     2,
@@ -4413,13 +4789,20 @@ function _ts_generator$3(thisArg, body) {
             value: /**
      * Finds an existing grant by ID, or creates a new one.
      *
+     * For new grants, optionally pre-set `expiresIn` so {@link Grant#save} writes the requested TTL
+     * instead of falling through to the configured Grant TTL function (which cannot read the original
+     * `dbx_session_ttl` request param when save is driven from a NestJS controller — see
+     * {@link OidcService#resolveLoginDurationForGrant}).
+     *
      * @param grantId - the existing grant ID to look up, or undefined to create a new grant
      * @param accountId - the account ID for creating a new grant
      * @param clientId - the client ID for creating a new grant
+     * @param expiresInSeconds - optional TTL (seconds) to assign to a newly-created grant
      * @returns the found or newly created grant
-     */ function findOrCreateGrant(grantId, accountId, clientId) {
+     */ // eslint-disable-next-line @typescript-eslint/max-params -- positional args mirror the existing call sites
+            function findOrCreateGrant(grantId, accountId, clientId, expiresInSeconds) {
                 return _async_to_generator$3(function() {
-                    var provider, grant, found;
+                    var provider, grant, found, grantInit;
                     return _ts_generator$3(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -4448,10 +4831,14 @@ function _ts_generator$3(thisArg, body) {
                                     4
                                 ];
                             case 3:
-                                grant = new provider.Grant({
+                                grantInit = {
                                     accountId: accountId,
                                     clientId: clientId
-                                });
+                                };
+                                if (expiresInSeconds != null) {
+                                    grantInit.expiresIn = expiresInSeconds;
+                                }
+                                grant = new provider.Grant(grantInit);
                                 _state.label = 4;
                             case 4:
                                 return [
@@ -4688,14 +5075,16 @@ function _ts_generator$2(thisArg, body) {
  * Firebase Auth ID token and bypass the oidc-provider interaction cookie
  * (which is scoped to the frontend path set by `interactions.url`).
  */ exports.OidcInteractionController = /*#__PURE__*/ function() {
-    function OidcInteractionController(oidcInteractionService, oidcProviderConfigService, accountService) {
+    function OidcInteractionController(oidcInteractionService, oidcProviderConfigService, accountService, oidcService) {
         _class_call_check$2(this, OidcInteractionController);
         _define_property$3(this, "oidcInteractionService", void 0);
         _define_property$3(this, "oidcProviderConfigService", void 0);
         _define_property$3(this, "accountService", void 0);
+        _define_property$3(this, "oidcService", void 0);
         this.oidcInteractionService = oidcInteractionService;
         this.oidcProviderConfigService = oidcProviderConfigService;
         this.accountService = accountService;
+        this.oidcService = oidcService;
     }
     _create_class$2(OidcInteractionController, [
         {
@@ -4829,7 +5218,7 @@ function _ts_generator$2(thisArg, body) {
      * @throws {HttpException} 400 when the consent interaction cannot be completed.
      */ function postConsent(uid, body, res) {
                 return _async_to_generator$2(function() {
-                    var _ref, redirectTo, interaction, prompt, params, session, grant, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, _step_value, indicator, scopes, grantId, redirectTo1;
+                    var _ref, _ref1, redirectTo, interaction, prompt, params, session, clientId, requestedRawTtl, clientPayload, clientMaxSessionTtl, expiresInSeconds, grant, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, _step_value, indicator, scopes, grantId, redirectTo1;
                     return _ts_generator$2(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -4843,9 +5232,9 @@ function _ts_generator$2(thisArg, body) {
                             case 2:
                                 _state.trys.push([
                                     2,
-                                    9,
+                                    10,
                                     ,
-                                    10
+                                    11
                                 ]);
                                 if (!!body.approved) return [
                                     3,
@@ -4876,11 +5265,28 @@ function _ts_generator$2(thisArg, body) {
                             case 5:
                                 interaction = _state.sent();
                                 prompt = interaction.prompt, params = interaction.params, session = interaction.session;
+                                clientId = params.client_id;
+                                // Resolve the requested login duration up-front. The configured Grant TTL function (in
+                                // OidcService.buildProviderConfiguration) only fires when oidc-provider's koa middleware
+                                // drives `grant.save()`, so its `ctx.oidc.params` lookup of `dbx_session_ttl` returns
+                                // undefined when the consent submit runs in this controller. We pre-set `expiresIn` on
+                                // newly-created grants so they persist with the correct TTL.
+                                requestedRawTtl = params[DBX_FIREBASE_SERVER_OIDC_SESSION_TTL_PARAM];
                                 return [
                                     4,
-                                    this.oidcInteractionService.findOrCreateGrant(interaction.grantId, (_ref = session === null || session === void 0 ? void 0 : session.accountId) !== null && _ref !== void 0 ? _ref : '', params.client_id)
+                                    this.oidcService.findClientPayload(clientId)
                                 ];
                             case 6:
+                                clientPayload = _state.sent();
+                                clientMaxSessionTtl = (_ref = clientPayload === null || clientPayload === void 0 ? void 0 : clientPayload.dbx_max_session_ttl) !== null && _ref !== void 0 ? _ref : undefined;
+                                expiresInSeconds = this.oidcService.resolveLoginDurationForGrant(requestedRawTtl, {
+                                    dbx_max_session_ttl: clientMaxSessionTtl
+                                });
+                                return [
+                                    4,
+                                    this.oidcInteractionService.findOrCreateGrant(interaction.grantId, (_ref1 = session === null || session === void 0 ? void 0 : session.accountId) !== null && _ref1 !== void 0 ? _ref1 : '', clientId, expiresInSeconds)
+                                ];
+                            case 7:
                                 grant = _state.sent();
                                 if (prompt.details.missingOIDCScope) {
                                     grant.addOIDCScope(prompt.details.missingOIDCScope.join(' '));
@@ -4914,7 +5320,7 @@ function _ts_generator$2(thisArg, body) {
                                     4,
                                     grant.save()
                                 ];
-                            case 7:
+                            case 8:
                                 grantId = _state.sent();
                                 return [
                                     4,
@@ -4926,19 +5332,19 @@ function _ts_generator$2(thisArg, body) {
                                         mergeWithLastSubmission: true
                                     })
                                 ];
-                            case 8:
+                            case 9:
                                 redirectTo1 = _state.sent();
                                 res.json({
                                     redirectTo: redirectTo1
                                 });
                                 return [
                                     3,
-                                    10
+                                    11
                                 ];
-                            case 9:
+                            case 10:
                                 _state.sent();
                                 throw new common.HttpException('Consent interaction failed', common.HttpStatus.BAD_REQUEST);
-                            case 10:
+                            case 11:
                                 return [
                                     2
                                 ];
@@ -5017,7 +5423,8 @@ exports.OidcInteractionController = __decorate([
     common.Controller('interaction'),
     __param(0, common.Inject(exports.OidcInteractionService)),
     __param(1, common.Inject(exports.OidcProviderConfigService)),
-    __param(2, common.Inject(OidcAccountService))
+    __param(2, common.Inject(OidcAccountService)),
+    __param(3, common.Inject(exports.OidcService))
 ], exports.OidcInteractionController);
 
 function asyncGeneratorStep$1(gen, resolve, reject, _next, _throw, key, arg) {
@@ -5689,6 +6096,8 @@ function _unsupported_iterable_to_array(o, minLen) {
         appOAuthConsentUrlPart: DEFAULT_APP_OAUTH_CONSENT_PATH_PART,
         appOAuthInteractionPath: DEFAULT_APP_OAUTH_INTERACTION_PATH,
         tokenLifetimes: DEFAULT_OIDC_TOKEN_LIFETIMES,
+        trustProxy: envService.isProduction,
+        trustProxyInNonProduction: false,
         jwksServiceConfig: {
             encryptionSecret: encryptionSecret
         },
@@ -5745,6 +6154,7 @@ function _unsupported_iterable_to_array(o, minLen) {
         ],
         exports: [
             OidcClientService,
+            exports.OidcService,
             OidcModuleConfig,
             OidcAuthMiddlewareConfig,
             OidcServerFirestoreCollections
@@ -5761,6 +6171,9 @@ function _unsupported_iterable_to_array(o, minLen) {
                     var result = moduleConfig;
                     if (config$1) {
                         result = _object_spread({}, moduleConfig, config$1);
+                        if (config$1.trustProxyInNonProduction && !envService.isProduction) {
+                            result.trustProxy = true;
+                        }
                     }
                     return result;
                 }
@@ -5850,6 +6263,8 @@ function _unsupported_iterable_to_array(o, minLen) {
 exports.DEFAULT_APP_OAUTH_CONSENT_PATH_PART = DEFAULT_APP_OAUTH_CONSENT_PATH_PART;
 exports.DEFAULT_APP_OAUTH_INTERACTION_PATH = DEFAULT_APP_OAUTH_INTERACTION_PATH;
 exports.DEFAULT_APP_OAUTH_LOGIN_PATH_PART = DEFAULT_APP_OAUTH_LOGIN_PATH_PART;
+exports.DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS = DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS;
+exports.DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS = DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS;
 exports.DEFAULT_OIDC_CODE_CHALLENGE_METHODS = DEFAULT_OIDC_CODE_CHALLENGE_METHODS;
 exports.DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES = DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES;
 exports.DEFAULT_OIDC_ISSUER_PATH = DEFAULT_OIDC_ISSUER_PATH;
@@ -5859,6 +6274,7 @@ exports.DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS = DEFAULT_OIDC_TOKEN_ENDPOINT_A
 exports.DEFAULT_OIDC_TOKEN_LIFETIMES = DEFAULT_OIDC_TOKEN_LIFETIMES;
 exports.DEFAULT_ROTATED_KEY_MAX_AGE = DEFAULT_ROTATED_KEY_MAX_AGE;
 exports.FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE = FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE;
+exports.GRANTABLE_MODEL_NAMES = GRANTABLE_MODEL_NAMES;
 exports.JwksFirestoreCollections = JwksFirestoreCollections;
 exports.JwksKeyDocument = JwksKeyDocument;
 exports.JwksServiceConfig = JwksServiceConfig;
@@ -5880,6 +6296,7 @@ exports.applyOidcAuthMiddleware = applyOidcAuthMiddleware;
 exports.createAdapterFactory = createAdapterFactory;
 exports.createOidcClientFactory = createOidcClientFactory;
 exports.deleteOidcClientFactory = deleteOidcClientFactory;
+exports.deleteOidcTokenFactory = deleteOidcTokenFactory;
 exports.getOidcScopesFromRequest = getOidcScopesFromRequest;
 exports.jwksKeyCollectionReference = jwksKeyCollectionReference;
 exports.jwksKeyConverter = jwksKeyConverter;