@dereekb/firebase-server 13.11.4 → 13.11.5

package/mailgun/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/mailgun",
-  "version": "13.11.4",
+  "version": "13.11.5",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.4",
-    "@dereekb/firebase": "13.11.4",
-    "@dereekb/firebase-server": "13.11.4",
-    "@dereekb/date": "13.11.4",
-    "@dereekb/nestjs": "13.11.4",
-    "@dereekb/model": "13.11.4",
-    "@dereekb/rxjs": "13.11.4",
-    "@dereekb/util": "13.11.4"
+    "@dereekb/analytics": "13.11.5",
+    "@dereekb/firebase": "13.11.5",
+    "@dereekb/firebase-server": "13.11.5",
+    "@dereekb/date": "13.11.5",
+    "@dereekb/nestjs": "13.11.5",
+    "@dereekb/model": "13.11.5",
+    "@dereekb/rxjs": "13.11.5",
+    "@dereekb/util": "13.11.5"
   },
   "exports": {
     "./package.json": "./package.json",

package/model/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/model",
-  "version": "13.11.4",
+  "version": "13.11.5",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.4",
-    "@dereekb/date": "13.11.4",
-    "@dereekb/firebase": "13.11.4",
-    "@dereekb/firebase-server": "13.11.4",
-    "@dereekb/model": "13.11.4",
-    "@dereekb/nestjs": "13.11.4",
-    "@dereekb/rxjs": "13.11.4",
-    "@dereekb/util": "13.11.4",
+    "@dereekb/analytics": "13.11.5",
+    "@dereekb/date": "13.11.5",
+    "@dereekb/firebase": "13.11.5",
+    "@dereekb/firebase-server": "13.11.5",
+    "@dereekb/model": "13.11.5",
+    "@dereekb/nestjs": "13.11.5",
+    "@dereekb/rxjs": "13.11.5",
+    "@dereekb/util": "13.11.5",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "archiver": "^7.0.1",

package/oidc/index.cjs.js

@@ -2583,7 +2583,7 @@ function _define_property$a(obj, key, value) {
     }
     return obj;
 }
-function _instanceof$1(left, right) {
+function _instanceof$2(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -2992,7 +2992,7 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
          * @returns the decrypted adapter payload, or undefined if the entry has expired
          */ key: "_toPayload",
                 value: function _toPayload(data) {
-                    var expiresDate = data.expiresAt ? _instanceof$1(data.expiresAt, Date) ? data.expiresAt : data.expiresAt.toDate() : undefined;
+                    var expiresDate = data.expiresAt ? _instanceof$2(data.expiresAt, Date) ? data.expiresAt : data.expiresAt.toDate() : undefined;
                     var isExpired = expiresDate != null && expiresDate < new Date();
                     return isExpired ? undefined : encryptionService.decryptAdapterPayload(data.payload);
                 }
@@ -4160,7 +4160,7 @@ function _define_property$6(obj, key, value) {
     }
     return obj;
 }
-function _instanceof(left, right) {
+function _instanceof$1(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -4324,7 +4324,7 @@ function _ts_generator$4(thisArg, body) {
                                 ];
                             case 3:
                                 err = _state.sent();
-                                if (_instanceof(err, common.UnauthorizedException)) {
+                                if (_instanceof$1(err, common.UnauthorizedException)) {
                                     throw err;
                                 }
                                 this.logger.error('Bearer token verification failed', err);
@@ -4927,6 +4927,14 @@ function _define_property$3(obj, key, value) {
     }
     return obj;
 }
+function _instanceof(left, right) {
+    "@swc/helpers - instanceof";
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
 function _iterable_to_array_limit(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
@@ -5064,6 +5072,14 @@ function _ts_generator$2(thisArg, body) {
         };
     }
 }
+/**
+ * OIDC scopes that the server always grants on consent when they were
+ * requested, regardless of whether the frontend included them in
+ * `grantedOIDCScopes`. `openid` is required for any OIDC flow, so the
+ * UI shows it as non-deselectable and the server enforces it here.
+ */ var ALWAYS_GRANTED_OIDC_SCOPES = [
+    'openid'
+];
 // MARK: Interaction Controller
 /**
  * Controller for OIDC interaction endpoints (login/consent).
@@ -5218,7 +5234,7 @@ function _ts_generator$2(thisArg, body) {
      * @throws {HttpException} 400 when the consent interaction cannot be completed.
      */ function postConsent(uid, body, res) {
                 return _async_to_generator$2(function() {
-                    var _ref, _ref1, redirectTo, interaction, prompt, params, session, clientId, requestedRawTtl, clientPayload, clientMaxSessionTtl, expiresInSeconds, grant, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, _step_value, indicator, scopes, grantId, redirectTo1;
+                    var _ref, _ref1, _prompt_details_missingOIDCScope, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, redirectTo, interaction, prompt, params, session, clientId, requestedRawTtl, clientPayload, clientMaxSessionTtl, expiresInSeconds, grant, missingOIDCScope, _resolveEffectiveSubset, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, missingOIDCClaims, _resolveEffectiveSubset1, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _body_grantedResourceScopes, requestedSubset, _resolveEffectiveSubset2, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, redirectTo1, err;
                     return _ts_generator$2(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -5288,18 +5304,17 @@ function _ts_generator$2(thisArg, body) {
                                 ];
                             case 7:
                                 grant = _state.sent();
-                                if (prompt.details.missingOIDCScope) {
-                                    grant.addOIDCScope(prompt.details.missingOIDCScope.join(' '));
-                                }
-                                if (prompt.details.missingOIDCClaims) {
-                                    grant.addOIDCClaims(prompt.details.missingOIDCClaims);
-                                }
-                                if (prompt.details.missingResourceScopes) {
+                                missingOIDCScope = (_prompt_details_missingOIDCScope = prompt.details.missingOIDCScope) !== null && _prompt_details_missingOIDCScope !== void 0 ? _prompt_details_missingOIDCScope : [];
+                                if (missingOIDCScope.length > 0) {
+                                    _resolveEffectiveSubset = resolveEffectiveSubset(missingOIDCScope, body.grantedOIDCScopes, ALWAYS_GRANTED_OIDC_SCOPES), granted = _resolveEffectiveSubset.granted, rejected = _resolveEffectiveSubset.rejected;
+                                    if (granted.length > 0) {
+                                        grant.addOIDCScope(granted.join(' '));
+                                    }
                                     _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
                                     try {
-                                        for(_iterator = Object.entries(prompt.details.missingResourceScopes)[Symbol.iterator](); !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-                                            _step_value = _sliced_to_array(_step.value, 2), indicator = _step_value[0], scopes = _step_value[1];
-                                            grant.addResourceScope(indicator, scopes.join(' '));
+                                        for(_iterator = rejected[Symbol.iterator](); !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                                            value = _step.value;
+                                            grant.rejectOIDCScope(value);
                                         }
                                     } catch (err) {
                                         _didIteratorError = true;
@@ -5316,6 +5331,62 @@ function _ts_generator$2(thisArg, body) {
                                         }
                                     }
                                 }
+                                missingOIDCClaims = (_prompt_details_missingOIDCClaims = prompt.details.missingOIDCClaims) !== null && _prompt_details_missingOIDCClaims !== void 0 ? _prompt_details_missingOIDCClaims : [];
+                                if (missingOIDCClaims.length > 0) {
+                                    _resolveEffectiveSubset1 = resolveEffectiveSubset(missingOIDCClaims, body.grantedOIDCClaims), granted1 = _resolveEffectiveSubset1.granted, rejected1 = _resolveEffectiveSubset1.rejected;
+                                    if (granted1.length > 0) {
+                                        grant.addOIDCClaims(granted1);
+                                    }
+                                    if (rejected1.length > 0) {
+                                        grant.rejectOIDCClaims(rejected1);
+                                    }
+                                }
+                                missingResourceScopes = (_prompt_details_missingResourceScopes = prompt.details.missingResourceScopes) !== null && _prompt_details_missingResourceScopes !== void 0 ? _prompt_details_missingResourceScopes : {};
+                                _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
+                                try {
+                                    for(_iterator1 = Object.entries(missingResourceScopes)[Symbol.iterator](); !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+                                        _step_value = _sliced_to_array(_step1.value, 2), indicator = _step_value[0], scopes = _step_value[1];
+                                        ;
+                                        requestedSubset = (_body_grantedResourceScopes = body.grantedResourceScopes) === null || _body_grantedResourceScopes === void 0 ? void 0 : _body_grantedResourceScopes[indicator];
+                                        _resolveEffectiveSubset2 = resolveEffectiveSubset(scopes, requestedSubset), granted2 = _resolveEffectiveSubset2.granted, rejected2 = _resolveEffectiveSubset2.rejected;
+                                        if (granted2.length > 0) {
+                                            grant.addResourceScope(indicator, granted2.join(' '));
+                                        }
+                                        _iteratorNormalCompletion2 = true, _didIteratorError2 = false, _iteratorError2 = undefined;
+                                        try {
+                                            for(_iterator2 = rejected2[Symbol.iterator](); !(_iteratorNormalCompletion2 = (_step2 = _iterator2.next()).done); _iteratorNormalCompletion2 = true){
+                                                value1 = _step2.value;
+                                                grant.rejectResourceScope(indicator, value1);
+                                            }
+                                        } catch (err) {
+                                            _didIteratorError2 = true;
+                                            _iteratorError2 = err;
+                                        } finally{
+                                            try {
+                                                if (!_iteratorNormalCompletion2 && _iterator2.return != null) {
+                                                    _iterator2.return();
+                                                }
+                                            } finally{
+                                                if (_didIteratorError2) {
+                                                    throw _iteratorError2;
+                                                }
+                                            }
+                                        }
+                                    }
+                                } catch (err) {
+                                    _didIteratorError1 = true;
+                                    _iteratorError1 = err;
+                                } finally{
+                                    try {
+                                        if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
+                                            _iterator1.return();
+                                        }
+                                    } finally{
+                                        if (_didIteratorError1) {
+                                            throw _iteratorError1;
+                                        }
+                                    }
+                                }
                                 return [
                                     4,
                                     grant.save()
@@ -5342,7 +5413,10 @@ function _ts_generator$2(thisArg, body) {
                                     11
                                 ];
                             case 10:
-                                _state.sent();
+                                err = _state.sent();
+                                if (_instanceof(err, common.HttpException)) {
+                                    throw err;
+                                }
                                 throw new common.HttpException('Consent interaction failed', common.HttpStatus.BAD_REQUEST);
                             case 11:
                                 return [
@@ -5426,6 +5500,105 @@ exports.OidcInteractionController = __decorate([
     __param(2, common.Inject(OidcAccountService)),
     __param(3, common.Inject(exports.OidcService))
 ], exports.OidcInteractionController);
+/**
+ * Resolves the effective set to grant — and the complementary set to
+ * reject — from a missing set, an optional caller-provided subset, and
+ * an optional list of always-granted entries.
+ *
+ * Throws `400 BAD_REQUEST` if the requested subset contains entries that
+ * are not in the missing set (no privilege escalation).
+ *
+ * - When `requestedSubset` is undefined → grants everything in `missing` (back-compat); rejects nothing.
+ * - When `requestedSubset` is provided → grants exactly that subset; rejects every other missing entry so
+ *   oidc-provider does not re-prompt for them.
+ * - Always-granted entries are union'd into `granted` (clamped to `missing`).
+ *
+ * @param missing - Entries the OIDC prompt indicated were missing for this consent.
+ * @param requestedSubset - Optional subset the caller wants to grant; must be a subset of `missing`.
+ * @param alwaysGranted - Entries that must be granted whenever they appear in `missing`, regardless of `requestedSubset`.
+ * @returns `granted` to add to the grant and `rejected` to record on the grant.
+ */ function resolveEffectiveSubset(missing, requestedSubset) {
+    var alwaysGranted = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : [];
+    var missingSet = new Set(missing);
+    var baseSelection;
+    if (requestedSubset === undefined) {
+        baseSelection = missing;
+    } else {
+        var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+        try {
+            for(var _iterator = requestedSubset[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                var value = _step.value;
+                if (!missingSet.has(value)) {
+                    throw new common.HttpException('Granted value "'.concat(value, '" is not in the requested set.'), common.HttpStatus.BAD_REQUEST);
+                }
+            }
+        } catch (err) {
+            _didIteratorError = true;
+            _iteratorError = err;
+        } finally{
+            try {
+                if (!_iteratorNormalCompletion && _iterator.return != null) {
+                    _iterator.return();
+                }
+            } finally{
+                if (_didIteratorError) {
+                    throw _iteratorError;
+                }
+            }
+        }
+        baseSelection = requestedSubset;
+    }
+    var grantedSet = new Set(baseSelection);
+    var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
+    try {
+        for(var _iterator1 = alwaysGranted[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+            var value1 = _step1.value;
+            if (missingSet.has(value1)) {
+                grantedSet.add(value1);
+            }
+        }
+    } catch (err) {
+        _didIteratorError1 = true;
+        _iteratorError1 = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
+                _iterator1.return();
+            }
+        } finally{
+            if (_didIteratorError1) {
+                throw _iteratorError1;
+            }
+        }
+    }
+    var rejected = [];
+    var _iteratorNormalCompletion2 = true, _didIteratorError2 = false, _iteratorError2 = undefined;
+    try {
+        for(var _iterator2 = missing[Symbol.iterator](), _step2; !(_iteratorNormalCompletion2 = (_step2 = _iterator2.next()).done); _iteratorNormalCompletion2 = true){
+            var value2 = _step2.value;
+            if (!grantedSet.has(value2)) {
+                rejected.push(value2);
+            }
+        }
+    } catch (err) {
+        _didIteratorError2 = true;
+        _iteratorError2 = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion2 && _iterator2.return != null) {
+                _iterator2.return();
+            }
+        } finally{
+            if (_didIteratorError2) {
+                throw _iteratorError2;
+            }
+        }
+    }
+    return {
+        granted: Array.from(grantedSet),
+        rejected: rejected
+    };
+}
 
 function asyncGeneratorStep$1(gen, resolve, reject, _next, _throw, key, arg) {
     try {

package/oidc/index.esm.js

@@ -2581,7 +2581,7 @@ function _define_property$a(obj, key, value) {
     }
     return obj;
 }
-function _instanceof$1(left, right) {
+function _instanceof$2(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -2990,7 +2990,7 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
          * @returns the decrypted adapter payload, or undefined if the entry has expired
          */ key: "_toPayload",
                 value: function _toPayload(data) {
-                    var expiresDate = data.expiresAt ? _instanceof$1(data.expiresAt, Date) ? data.expiresAt : data.expiresAt.toDate() : undefined;
+                    var expiresDate = data.expiresAt ? _instanceof$2(data.expiresAt, Date) ? data.expiresAt : data.expiresAt.toDate() : undefined;
                     var isExpired = expiresDate != null && expiresDate < new Date();
                     return isExpired ? undefined : encryptionService.decryptAdapterPayload(data.payload);
                 }
@@ -4158,7 +4158,7 @@ function _define_property$6(obj, key, value) {
     }
     return obj;
 }
-function _instanceof(left, right) {
+function _instanceof$1(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -4322,7 +4322,7 @@ function _ts_generator$4(thisArg, body) {
                                 ];
                             case 3:
                                 err = _state.sent();
-                                if (_instanceof(err, UnauthorizedException)) {
+                                if (_instanceof$1(err, UnauthorizedException)) {
                                     throw err;
                                 }
                                 this.logger.error('Bearer token verification failed', err);
@@ -4925,6 +4925,14 @@ function _define_property$3(obj, key, value) {
     }
     return obj;
 }
+function _instanceof(left, right) {
+    "@swc/helpers - instanceof";
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
 function _iterable_to_array_limit(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
@@ -5062,6 +5070,14 @@ function _ts_generator$2(thisArg, body) {
         };
     }
 }
+/**
+ * OIDC scopes that the server always grants on consent when they were
+ * requested, regardless of whether the frontend included them in
+ * `grantedOIDCScopes`. `openid` is required for any OIDC flow, so the
+ * UI shows it as non-deselectable and the server enforces it here.
+ */ var ALWAYS_GRANTED_OIDC_SCOPES = [
+    'openid'
+];
 // MARK: Interaction Controller
 /**
  * Controller for OIDC interaction endpoints (login/consent).
@@ -5216,7 +5232,7 @@ function _ts_generator$2(thisArg, body) {
      * @throws {HttpException} 400 when the consent interaction cannot be completed.
      */ function postConsent(uid, body, res) {
                 return _async_to_generator$2(function() {
-                    var _ref, _ref1, redirectTo, interaction, prompt, params, session, clientId, requestedRawTtl, clientPayload, clientMaxSessionTtl, expiresInSeconds, grant, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, _step_value, indicator, scopes, grantId, redirectTo1;
+                    var _ref, _ref1, _prompt_details_missingOIDCScope, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, redirectTo, interaction, prompt, params, session, clientId, requestedRawTtl, clientPayload, clientMaxSessionTtl, expiresInSeconds, grant, missingOIDCScope, _resolveEffectiveSubset, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, missingOIDCClaims, _resolveEffectiveSubset1, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _body_grantedResourceScopes, requestedSubset, _resolveEffectiveSubset2, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, redirectTo1, err;
                     return _ts_generator$2(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -5286,18 +5302,17 @@ function _ts_generator$2(thisArg, body) {
                                 ];
                             case 7:
                                 grant = _state.sent();
-                                if (prompt.details.missingOIDCScope) {
-                                    grant.addOIDCScope(prompt.details.missingOIDCScope.join(' '));
-                                }
-                                if (prompt.details.missingOIDCClaims) {
-                                    grant.addOIDCClaims(prompt.details.missingOIDCClaims);
-                                }
-                                if (prompt.details.missingResourceScopes) {
+                                missingOIDCScope = (_prompt_details_missingOIDCScope = prompt.details.missingOIDCScope) !== null && _prompt_details_missingOIDCScope !== void 0 ? _prompt_details_missingOIDCScope : [];
+                                if (missingOIDCScope.length > 0) {
+                                    _resolveEffectiveSubset = resolveEffectiveSubset(missingOIDCScope, body.grantedOIDCScopes, ALWAYS_GRANTED_OIDC_SCOPES), granted = _resolveEffectiveSubset.granted, rejected = _resolveEffectiveSubset.rejected;
+                                    if (granted.length > 0) {
+                                        grant.addOIDCScope(granted.join(' '));
+                                    }
                                     _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
                                     try {
-                                        for(_iterator = Object.entries(prompt.details.missingResourceScopes)[Symbol.iterator](); !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-                                            _step_value = _sliced_to_array(_step.value, 2), indicator = _step_value[0], scopes = _step_value[1];
-                                            grant.addResourceScope(indicator, scopes.join(' '));
+                                        for(_iterator = rejected[Symbol.iterator](); !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                                            value = _step.value;
+                                            grant.rejectOIDCScope(value);
                                         }
                                     } catch (err) {
                                         _didIteratorError = true;
@@ -5314,6 +5329,62 @@ function _ts_generator$2(thisArg, body) {
                                         }
                                     }
                                 }
+                                missingOIDCClaims = (_prompt_details_missingOIDCClaims = prompt.details.missingOIDCClaims) !== null && _prompt_details_missingOIDCClaims !== void 0 ? _prompt_details_missingOIDCClaims : [];
+                                if (missingOIDCClaims.length > 0) {
+                                    _resolveEffectiveSubset1 = resolveEffectiveSubset(missingOIDCClaims, body.grantedOIDCClaims), granted1 = _resolveEffectiveSubset1.granted, rejected1 = _resolveEffectiveSubset1.rejected;
+                                    if (granted1.length > 0) {
+                                        grant.addOIDCClaims(granted1);
+                                    }
+                                    if (rejected1.length > 0) {
+                                        grant.rejectOIDCClaims(rejected1);
+                                    }
+                                }
+                                missingResourceScopes = (_prompt_details_missingResourceScopes = prompt.details.missingResourceScopes) !== null && _prompt_details_missingResourceScopes !== void 0 ? _prompt_details_missingResourceScopes : {};
+                                _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
+                                try {
+                                    for(_iterator1 = Object.entries(missingResourceScopes)[Symbol.iterator](); !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+                                        _step_value = _sliced_to_array(_step1.value, 2), indicator = _step_value[0], scopes = _step_value[1];
+                                        ;
+                                        requestedSubset = (_body_grantedResourceScopes = body.grantedResourceScopes) === null || _body_grantedResourceScopes === void 0 ? void 0 : _body_grantedResourceScopes[indicator];
+                                        _resolveEffectiveSubset2 = resolveEffectiveSubset(scopes, requestedSubset), granted2 = _resolveEffectiveSubset2.granted, rejected2 = _resolveEffectiveSubset2.rejected;
+                                        if (granted2.length > 0) {
+                                            grant.addResourceScope(indicator, granted2.join(' '));
+                                        }
+                                        _iteratorNormalCompletion2 = true, _didIteratorError2 = false, _iteratorError2 = undefined;
+                                        try {
+                                            for(_iterator2 = rejected2[Symbol.iterator](); !(_iteratorNormalCompletion2 = (_step2 = _iterator2.next()).done); _iteratorNormalCompletion2 = true){
+                                                value1 = _step2.value;
+                                                grant.rejectResourceScope(indicator, value1);
+                                            }
+                                        } catch (err) {
+                                            _didIteratorError2 = true;
+                                            _iteratorError2 = err;
+                                        } finally{
+                                            try {
+                                                if (!_iteratorNormalCompletion2 && _iterator2.return != null) {
+                                                    _iterator2.return();
+                                                }
+                                            } finally{
+                                                if (_didIteratorError2) {
+                                                    throw _iteratorError2;
+                                                }
+                                            }
+                                        }
+                                    }
+                                } catch (err) {
+                                    _didIteratorError1 = true;
+                                    _iteratorError1 = err;
+                                } finally{
+                                    try {
+                                        if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
+                                            _iterator1.return();
+                                        }
+                                    } finally{
+                                        if (_didIteratorError1) {
+                                            throw _iteratorError1;
+                                        }
+                                    }
+                                }
                                 return [
                                     4,
                                     grant.save()
@@ -5340,7 +5411,10 @@ function _ts_generator$2(thisArg, body) {
                                     11
                                 ];
                             case 10:
-                                _state.sent();
+                                err = _state.sent();
+                                if (_instanceof(err, HttpException)) {
+                                    throw err;
+                                }
                                 throw new HttpException('Consent interaction failed', HttpStatus.BAD_REQUEST);
                             case 11:
                                 return [
@@ -5424,6 +5498,105 @@ OidcInteractionController = __decorate([
     __param(2, Inject(OidcAccountService)),
     __param(3, Inject(OidcService))
 ], OidcInteractionController);
+/**
+ * Resolves the effective set to grant — and the complementary set to
+ * reject — from a missing set, an optional caller-provided subset, and
+ * an optional list of always-granted entries.
+ *
+ * Throws `400 BAD_REQUEST` if the requested subset contains entries that
+ * are not in the missing set (no privilege escalation).
+ *
+ * - When `requestedSubset` is undefined → grants everything in `missing` (back-compat); rejects nothing.
+ * - When `requestedSubset` is provided → grants exactly that subset; rejects every other missing entry so
+ *   oidc-provider does not re-prompt for them.
+ * - Always-granted entries are union'd into `granted` (clamped to `missing`).
+ *
+ * @param missing - Entries the OIDC prompt indicated were missing for this consent.
+ * @param requestedSubset - Optional subset the caller wants to grant; must be a subset of `missing`.
+ * @param alwaysGranted - Entries that must be granted whenever they appear in `missing`, regardless of `requestedSubset`.
+ * @returns `granted` to add to the grant and `rejected` to record on the grant.
+ */ function resolveEffectiveSubset(missing, requestedSubset) {
+    var alwaysGranted = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : [];
+    var missingSet = new Set(missing);
+    var baseSelection;
+    if (requestedSubset === undefined) {
+        baseSelection = missing;
+    } else {
+        var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+        try {
+            for(var _iterator = requestedSubset[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                var value = _step.value;
+                if (!missingSet.has(value)) {
+                    throw new HttpException('Granted value "'.concat(value, '" is not in the requested set.'), HttpStatus.BAD_REQUEST);
+                }
+            }
+        } catch (err) {
+            _didIteratorError = true;
+            _iteratorError = err;
+        } finally{
+            try {
+                if (!_iteratorNormalCompletion && _iterator.return != null) {
+                    _iterator.return();
+                }
+            } finally{
+                if (_didIteratorError) {
+                    throw _iteratorError;
+                }
+            }
+        }
+        baseSelection = requestedSubset;
+    }
+    var grantedSet = new Set(baseSelection);
+    var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
+    try {
+        for(var _iterator1 = alwaysGranted[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+            var value1 = _step1.value;
+            if (missingSet.has(value1)) {
+                grantedSet.add(value1);
+            }
+        }
+    } catch (err) {
+        _didIteratorError1 = true;
+        _iteratorError1 = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
+                _iterator1.return();
+            }
+        } finally{
+            if (_didIteratorError1) {
+                throw _iteratorError1;
+            }
+        }
+    }
+    var rejected = [];
+    var _iteratorNormalCompletion2 = true, _didIteratorError2 = false, _iteratorError2 = undefined;
+    try {
+        for(var _iterator2 = missing[Symbol.iterator](), _step2; !(_iteratorNormalCompletion2 = (_step2 = _iterator2.next()).done); _iteratorNormalCompletion2 = true){
+            var value2 = _step2.value;
+            if (!grantedSet.has(value2)) {
+                rejected.push(value2);
+            }
+        }
+    } catch (err) {
+        _didIteratorError2 = true;
+        _iteratorError2 = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion2 && _iterator2.return != null) {
+                _iterator2.return();
+            }
+        } finally{
+            if (_didIteratorError2) {
+                throw _iteratorError2;
+            }
+        }
+    }
+    return {
+        granted: Array.from(grantedSet),
+        rejected: rejected
+    };
+}
 
 function asyncGeneratorStep$1(gen, resolve, reject, _next, _throw, key, arg) {
     try {

package/oidc/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/oidc",
-  "version": "13.11.4",
+  "version": "13.11.5",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.4",
-    "@dereekb/date": "13.11.4",
-    "@dereekb/firebase": "13.11.4",
-    "@dereekb/firebase-server": "13.11.4",
-    "@dereekb/model": "13.11.4",
-    "@dereekb/nestjs": "13.11.4",
-    "@dereekb/rxjs": "13.11.4",
-    "@dereekb/util": "13.11.4",
-    "@dereekb/zoho": "13.11.4",
+    "@dereekb/analytics": "13.11.5",
+    "@dereekb/date": "13.11.5",
+    "@dereekb/firebase": "13.11.5",
+    "@dereekb/firebase-server": "13.11.5",
+    "@dereekb/model": "13.11.5",
+    "@dereekb/nestjs": "13.11.5",
+    "@dereekb/rxjs": "13.11.5",
+    "@dereekb/util": "13.11.5",
+    "@dereekb/zoho": "13.11.5",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "express": "^5.2.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/firebase-server",
-  "version": "13.11.4",
+  "version": "13.11.5",
   "sideEffects": false,
   "exports": {
     "./test": {
@@ -44,15 +44,15 @@
   "main": "./index.cjs.js",
   "types": "./src/index.d.ts",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.4",
-    "@dereekb/date": "13.11.4",
-    "@dereekb/dbx-core": "13.11.4",
-    "@dereekb/firebase": "13.11.4",
-    "@dereekb/model": "13.11.4",
-    "@dereekb/nestjs": "13.11.4",
-    "@dereekb/rxjs": "13.11.4",
-    "@dereekb/util": "13.11.4",
-    "@dereekb/zoho": "13.11.4",
+    "@dereekb/analytics": "13.11.5",
+    "@dereekb/date": "13.11.5",
+    "@dereekb/dbx-core": "13.11.5",
+    "@dereekb/firebase": "13.11.5",
+    "@dereekb/model": "13.11.5",
+    "@dereekb/nestjs": "13.11.5",
+    "@dereekb/rxjs": "13.11.5",
+    "@dereekb/util": "13.11.5",
+    "@dereekb/zoho": "13.11.5",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@nestjs/common": "^11.1.19",

package/test/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/test",
-  "version": "13.11.4",
+  "version": "13.11.5",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.4",
-    "@dereekb/date": "13.11.4",
-    "@dereekb/firebase": "13.11.4",
-    "@dereekb/firebase-server": "13.11.4",
-    "@dereekb/firebase-server/oidc": "13.11.4",
-    "@dereekb/model": "13.11.4",
-    "@dereekb/nestjs": "13.11.4",
-    "@dereekb/rxjs": "13.11.4",
-    "@dereekb/util": "13.11.4",
+    "@dereekb/analytics": "13.11.5",
+    "@dereekb/date": "13.11.5",
+    "@dereekb/firebase": "13.11.5",
+    "@dereekb/firebase-server": "13.11.5",
+    "@dereekb/firebase-server/oidc": "13.11.5",
+    "@dereekb/model": "13.11.5",
+    "@dereekb/nestjs": "13.11.5",
+    "@dereekb/rxjs": "13.11.5",
+    "@dereekb/util": "13.11.5",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@nestjs/common": "^11.1.19",
@@ -23,7 +23,7 @@
     "supertest": "^7.2.2"
   },
   "devDependencies": {
-    "@dereekb/nestjs": "13.11.4"
+    "@dereekb/nestjs": "13.11.5"
   },
   "exports": {
     "./package.json": "./package.json",

package/zoho/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/zoho",
-  "version": "13.11.4",
+  "version": "13.11.5",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.4",
-    "@dereekb/date": "13.11.4",
-    "@dereekb/model": "13.11.4",
-    "@dereekb/nestjs": "13.11.4",
-    "@dereekb/rxjs": "13.11.4",
-    "@dereekb/firebase": "13.11.4",
-    "@dereekb/util": "13.11.4",
-    "@dereekb/zoho": "13.11.4"
+    "@dereekb/analytics": "13.11.5",
+    "@dereekb/date": "13.11.5",
+    "@dereekb/model": "13.11.5",
+    "@dereekb/nestjs": "13.11.5",
+    "@dereekb/rxjs": "13.11.5",
+    "@dereekb/firebase": "13.11.5",
+    "@dereekb/util": "13.11.5",
+    "@dereekb/zoho": "13.11.5"
   },
   "exports": {
     "./package.json": "./package.json",