@dereekb/firebase-server 13.11.6 → 13.11.8

package/mailgun/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/mailgun",
-  "version": "13.11.6",
+  "version": "13.11.8",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.6",
-    "@dereekb/firebase": "13.11.6",
-    "@dereekb/firebase-server": "13.11.6",
-    "@dereekb/date": "13.11.6",
-    "@dereekb/nestjs": "13.11.6",
-    "@dereekb/model": "13.11.6",
-    "@dereekb/rxjs": "13.11.6",
-    "@dereekb/util": "13.11.6"
+    "@dereekb/analytics": "13.11.8",
+    "@dereekb/firebase": "13.11.8",
+    "@dereekb/firebase-server": "13.11.8",
+    "@dereekb/date": "13.11.8",
+    "@dereekb/nestjs": "13.11.8",
+    "@dereekb/model": "13.11.8",
+    "@dereekb/rxjs": "13.11.8",
+    "@dereekb/util": "13.11.8"
   },
   "exports": {
     "./package.json": "./package.json",

package/model/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/model",
-  "version": "13.11.6",
+  "version": "13.11.8",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.6",
-    "@dereekb/date": "13.11.6",
-    "@dereekb/firebase": "13.11.6",
-    "@dereekb/firebase-server": "13.11.6",
-    "@dereekb/model": "13.11.6",
-    "@dereekb/nestjs": "13.11.6",
-    "@dereekb/rxjs": "13.11.6",
-    "@dereekb/util": "13.11.6",
+    "@dereekb/analytics": "13.11.8",
+    "@dereekb/date": "13.11.8",
+    "@dereekb/firebase": "13.11.8",
+    "@dereekb/firebase-server": "13.11.8",
+    "@dereekb/model": "13.11.8",
+    "@dereekb/nestjs": "13.11.8",
+    "@dereekb/rxjs": "13.11.8",
+    "@dereekb/util": "13.11.8",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "archiver": "^7.0.1",

package/oidc/index.cjs.js

@@ -4452,6 +4452,55 @@ var _logger = new common.Logger('applyOidcAuthMiddleware');
     _logger.debug("Applied OAuth bearer token middleware for paths: ".concat(protectedPaths.join(', ')));
 }
 
+// MARK: Express-Level Helper
+/**
+ * Enables CORS on the NestJS app for OIDC cross-origin requests originating from the frontend.
+ *
+ * When the OIDC issuer lives on a different origin than the frontend app (e.g. the frontend is
+ * `https://app.example.com` and the OIDC server is at `https://api.example.com`), the frontend's
+ * `DbxFirebaseOidcInteractionService` issues cross-origin POSTs to `/interaction/{uid}/login`
+ * and `/interaction/{uid}/consent`. Because the POST body is `application/json`, the browser
+ * sends a CORS preflight. Without an `Access-Control-Allow-Origin` reply the preflight fails,
+ * the POST never reaches the server, and the OAuth flow stalls before `finishInteractionByUid`
+ * can run.
+ *
+ * Origin is sourced from `FirebaseServerEnvService.appUrl`, which is the authoritative frontend
+ * origin per environment. Single-origin deployments (e.g. local dev where the frontend and the
+ * OIDC server share `http://localhost:9010`) still benefit: their cross-origin requests are
+ * actually same-origin and CORS is a no-op.
+ *
+ * Credentials are intentionally NOT enabled (`Access-Control-Allow-Credentials` stays off). The
+ * `/interaction/{uid}/*` POSTs carry the Firebase ID token in the JSON body, not in cookies, so
+ * we keep the CORS surface minimal.
+ *
+ * @param nestApp - the NestJS application to configure.
+ *
+ * @example
+ * ```ts
+ * export const APP_NEST_SERVER_CONFIG: NestServerInstanceConfig<AppModule> = {
+ *   moduleClass: AppModule,
+ *   configureNestServerInstance: (nestApp) => {
+ *     applyOidcCorsMiddleware(nestApp);
+ *     applyOidcAuthMiddleware(nestApp);
+ *   }
+ * };
+ * ```
+ */ function applyOidcCorsMiddleware(nestApp) {
+    var envService = nestApp.get(firebaseServer.FirebaseServerEnvService);
+    var origin = envService.appUrl;
+    if (!origin) {
+        return;
+    }
+    nestApp.enableCors({
+        origin: origin,
+        methods: [
+            'GET',
+            'POST',
+            'OPTIONS'
+        ]
+    });
+}
+
 // MARK: Scopes
 /**
  * Reads the set of OIDC scopes carried by a callable request's bearer token.
@@ -6233,27 +6282,76 @@ function _unsupported_iterable_to_array(o, minLen) {
     'interaction/{*path}'
 ];
 // MARK: Provider Factories
+/**
+ * Extracts the origin (protocol + host + port) from `envService.appApiUrl`, when it points at a
+ * different origin than `envService.appUrl`. Used to root the OIDC issuer at the API host when
+ * the frontend and the OIDC server live on different origins.
+ *
+ * Returns `undefined` if `appApiUrl` is missing, equal to `appUrl`, or shares its origin — the
+ * caller then falls back to `appUrl` (the single-origin default). The compare is on the parsed
+ * URL origin so a default `appApiUrl = "${appUrl}/api"` is treated as the same origin.
+ *
+ * @param envService - the Firebase server environment service.
+ * @returns The API origin (no trailing slash) when distinct from the frontend origin, otherwise `undefined`.
+ *
+ * @example
+ * ```typescript
+ * // appUrl = 'https://app.example.com', appApiUrl = 'https://app.example.com/api'
+ * // → undefined (same origin; fall back to appUrl)
+ *
+ * // appUrl = 'https://app.example.com', appApiUrl = 'https://api.example.com'
+ * // → 'https://api.example.com'
+ * ```
+ */ function resolveOidcIssuerOriginFromEnv(envService) {
+    var appUrl = envService.appUrl;
+    var appApiUrl = envService.appApiUrl;
+    var result;
+    if (appUrl && appApiUrl) {
+        try {
+            var appOrigin = new URL(appUrl).origin;
+            var apiOrigin = new URL(appApiUrl).origin;
+            if (apiOrigin !== appOrigin) {
+                result = apiOrigin;
+            }
+        } catch (unused) {
+        // appUrl / appApiUrl validity is enforced elsewhere; ignore parse errors here so the
+        // caller's appUrl-based fallback path still runs.
+        }
+    }
+    return result;
+}
 /**
  * Factory that builds {@link OidcModuleConfig} from environment variables and the app's {@link FirebaseServerEnvService}.
  *
- * Derives the issuer URL from `appUrl` + the optional `OIDC_ISSUER_PATH` env var (defaults to `/oidc`).
- * Reads the JWKS encryption secret from `OIDC_JWKS_ENCRYPTION_SECRET`; in test environments,
- * a deterministic fallback is used.
+ * Derives the issuer URL from `appUrl` (or, when set to a distinct origin, the origin of `appApiUrl`)
+ * plus {@link DEFAULT_OIDC_ISSUER_PATH} (defaults to `/oidc`). Reads the JWKS encryption secret from
+ * `OIDC_JWKS_ENCRYPTION_SECRET`; in test environments, a deterministic fallback is used.
+ *
+ * The issuer can also be overridden directly by passing `issuer` on the `config` block to
+ * {@link oidcModuleMetadata}; the override wins over the factory-derived value.
  *
  * @param configService - the NestJS ConfigService for reading environment variables
  * @param envService - the Firebase server environment service for app URL and env detection
  * @returns the constructed OidcModuleConfig
- * @throws {Error} When `appUrl` is missing, lacks an HTTP prefix, or the encryption secret is invalid.
+ * @throws {Error} When `appUrl` is missing, the resolved issuer lacks an HTTP prefix, or the encryption secret is invalid.
  */ function oidcModuleConfigFactory(configService, envService) {
-    var _configService_get;
+    var _resolveOidcIssuerOriginFromEnv, _configService_get;
     var appUrl = envService.appUrl;
     if (!appUrl) {
         throw new Error('oidcModuleConfigFactory: appUrl is required on the server environment config.');
     }
     var issuerPath = DEFAULT_OIDC_ISSUER_PATH;
-    var issuer = "".concat(appUrl).concat(issuerPath);
+    // The issuer base is the origin where the OIDC server lives. When `appApiUrl` is set on
+    // a different origin from `appUrl` (e.g., the frontend lives on `https://app.example.com`
+    // while the OIDC server lives on `https://api.example.com`), use its origin so cookies
+    // emitted by oidc-provider are scoped to the API host. Otherwise fall back to `appUrl` —
+    // the common single-origin case where both the frontend and the OIDC server share a host.
+    // Consumers can still override the resolved issuer entirely via the `config.issuer` field
+    // on `oidcModuleMetadata({ config: { issuer: ... } })`.
+    var issuerBase = (_resolveOidcIssuerOriginFromEnv = resolveOidcIssuerOriginFromEnv(envService)) !== null && _resolveOidcIssuerOriginFromEnv !== void 0 ? _resolveOidcIssuerOriginFromEnv : appUrl;
+    var issuer = "".concat(issuerBase).concat(issuerPath);
     if (!util.hasHttpPrefix(issuer)) {
-        throw new Error("oidcModuleConfigFactory: appUrl must have an http(s) prefix. Received: ".concat(appUrl));
+        throw new Error("oidcModuleConfigFactory: issuer must have an http(s) prefix. Received: ".concat(issuer));
     }
     var encryptionSecret = (_configService_get = configService.get(OIDC_JWKS_ENCRYPTION_SECRET_ENV_KEY)) !== null && _configService_get !== void 0 ? _configService_get : '';
     if (!nestjs.isValidAES256GCMEncryptionSecret(encryptionSecret)) {
@@ -6466,6 +6564,7 @@ exports.OidcServerFirestoreCollections = OidcServerFirestoreCollections;
 exports.activeJwksKeysQuery = activeJwksKeysQuery;
 exports.appOidcModelModuleMetadata = appOidcModelModuleMetadata;
 exports.applyOidcAuthMiddleware = applyOidcAuthMiddleware;
+exports.applyOidcCorsMiddleware = applyOidcCorsMiddleware;
 exports.createAdapterFactory = createAdapterFactory;
 exports.createOidcClientFactory = createOidcClientFactory;
 exports.deleteOidcClientFactory = deleteOidcClientFactory;

package/oidc/index.esm.js

@@ -4450,6 +4450,55 @@ var _logger = new Logger('applyOidcAuthMiddleware');
     _logger.debug("Applied OAuth bearer token middleware for paths: ".concat(protectedPaths.join(', ')));
 }
 
+// MARK: Express-Level Helper
+/**
+ * Enables CORS on the NestJS app for OIDC cross-origin requests originating from the frontend.
+ *
+ * When the OIDC issuer lives on a different origin than the frontend app (e.g. the frontend is
+ * `https://app.example.com` and the OIDC server is at `https://api.example.com`), the frontend's
+ * `DbxFirebaseOidcInteractionService` issues cross-origin POSTs to `/interaction/{uid}/login`
+ * and `/interaction/{uid}/consent`. Because the POST body is `application/json`, the browser
+ * sends a CORS preflight. Without an `Access-Control-Allow-Origin` reply the preflight fails,
+ * the POST never reaches the server, and the OAuth flow stalls before `finishInteractionByUid`
+ * can run.
+ *
+ * Origin is sourced from `FirebaseServerEnvService.appUrl`, which is the authoritative frontend
+ * origin per environment. Single-origin deployments (e.g. local dev where the frontend and the
+ * OIDC server share `http://localhost:9010`) still benefit: their cross-origin requests are
+ * actually same-origin and CORS is a no-op.
+ *
+ * Credentials are intentionally NOT enabled (`Access-Control-Allow-Credentials` stays off). The
+ * `/interaction/{uid}/*` POSTs carry the Firebase ID token in the JSON body, not in cookies, so
+ * we keep the CORS surface minimal.
+ *
+ * @param nestApp - the NestJS application to configure.
+ *
+ * @example
+ * ```ts
+ * export const APP_NEST_SERVER_CONFIG: NestServerInstanceConfig<AppModule> = {
+ *   moduleClass: AppModule,
+ *   configureNestServerInstance: (nestApp) => {
+ *     applyOidcCorsMiddleware(nestApp);
+ *     applyOidcAuthMiddleware(nestApp);
+ *   }
+ * };
+ * ```
+ */ function applyOidcCorsMiddleware(nestApp) {
+    var envService = nestApp.get(FirebaseServerEnvService);
+    var origin = envService.appUrl;
+    if (!origin) {
+        return;
+    }
+    nestApp.enableCors({
+        origin: origin,
+        methods: [
+            'GET',
+            'POST',
+            'OPTIONS'
+        ]
+    });
+}
+
 // MARK: Scopes
 /**
  * Reads the set of OIDC scopes carried by a callable request's bearer token.
@@ -6231,27 +6280,76 @@ function _unsupported_iterable_to_array(o, minLen) {
     'interaction/{*path}'
 ];
 // MARK: Provider Factories
+/**
+ * Extracts the origin (protocol + host + port) from `envService.appApiUrl`, when it points at a
+ * different origin than `envService.appUrl`. Used to root the OIDC issuer at the API host when
+ * the frontend and the OIDC server live on different origins.
+ *
+ * Returns `undefined` if `appApiUrl` is missing, equal to `appUrl`, or shares its origin — the
+ * caller then falls back to `appUrl` (the single-origin default). The compare is on the parsed
+ * URL origin so a default `appApiUrl = "${appUrl}/api"` is treated as the same origin.
+ *
+ * @param envService - the Firebase server environment service.
+ * @returns The API origin (no trailing slash) when distinct from the frontend origin, otherwise `undefined`.
+ *
+ * @example
+ * ```typescript
+ * // appUrl = 'https://app.example.com', appApiUrl = 'https://app.example.com/api'
+ * // → undefined (same origin; fall back to appUrl)
+ *
+ * // appUrl = 'https://app.example.com', appApiUrl = 'https://api.example.com'
+ * // → 'https://api.example.com'
+ * ```
+ */ function resolveOidcIssuerOriginFromEnv(envService) {
+    var appUrl = envService.appUrl;
+    var appApiUrl = envService.appApiUrl;
+    var result;
+    if (appUrl && appApiUrl) {
+        try {
+            var appOrigin = new URL(appUrl).origin;
+            var apiOrigin = new URL(appApiUrl).origin;
+            if (apiOrigin !== appOrigin) {
+                result = apiOrigin;
+            }
+        } catch (unused) {
+        // appUrl / appApiUrl validity is enforced elsewhere; ignore parse errors here so the
+        // caller's appUrl-based fallback path still runs.
+        }
+    }
+    return result;
+}
 /**
  * Factory that builds {@link OidcModuleConfig} from environment variables and the app's {@link FirebaseServerEnvService}.
  *
- * Derives the issuer URL from `appUrl` + the optional `OIDC_ISSUER_PATH` env var (defaults to `/oidc`).
- * Reads the JWKS encryption secret from `OIDC_JWKS_ENCRYPTION_SECRET`; in test environments,
- * a deterministic fallback is used.
+ * Derives the issuer URL from `appUrl` (or, when set to a distinct origin, the origin of `appApiUrl`)
+ * plus {@link DEFAULT_OIDC_ISSUER_PATH} (defaults to `/oidc`). Reads the JWKS encryption secret from
+ * `OIDC_JWKS_ENCRYPTION_SECRET`; in test environments, a deterministic fallback is used.
+ *
+ * The issuer can also be overridden directly by passing `issuer` on the `config` block to
+ * {@link oidcModuleMetadata}; the override wins over the factory-derived value.
  *
  * @param configService - the NestJS ConfigService for reading environment variables
  * @param envService - the Firebase server environment service for app URL and env detection
  * @returns the constructed OidcModuleConfig
- * @throws {Error} When `appUrl` is missing, lacks an HTTP prefix, or the encryption secret is invalid.
+ * @throws {Error} When `appUrl` is missing, the resolved issuer lacks an HTTP prefix, or the encryption secret is invalid.
  */ function oidcModuleConfigFactory(configService, envService) {
-    var _configService_get;
+    var _resolveOidcIssuerOriginFromEnv, _configService_get;
     var appUrl = envService.appUrl;
     if (!appUrl) {
         throw new Error('oidcModuleConfigFactory: appUrl is required on the server environment config.');
     }
     var issuerPath = DEFAULT_OIDC_ISSUER_PATH;
-    var issuer = "".concat(appUrl).concat(issuerPath);
+    // The issuer base is the origin where the OIDC server lives. When `appApiUrl` is set on
+    // a different origin from `appUrl` (e.g., the frontend lives on `https://app.example.com`
+    // while the OIDC server lives on `https://api.example.com`), use its origin so cookies
+    // emitted by oidc-provider are scoped to the API host. Otherwise fall back to `appUrl` —
+    // the common single-origin case where both the frontend and the OIDC server share a host.
+    // Consumers can still override the resolved issuer entirely via the `config.issuer` field
+    // on `oidcModuleMetadata({ config: { issuer: ... } })`.
+    var issuerBase = (_resolveOidcIssuerOriginFromEnv = resolveOidcIssuerOriginFromEnv(envService)) !== null && _resolveOidcIssuerOriginFromEnv !== void 0 ? _resolveOidcIssuerOriginFromEnv : appUrl;
+    var issuer = "".concat(issuerBase).concat(issuerPath);
     if (!hasHttpPrefix(issuer)) {
-        throw new Error("oidcModuleConfigFactory: appUrl must have an http(s) prefix. Received: ".concat(appUrl));
+        throw new Error("oidcModuleConfigFactory: issuer must have an http(s) prefix. Received: ".concat(issuer));
     }
     var encryptionSecret = (_configService_get = configService.get(OIDC_JWKS_ENCRYPTION_SECRET_ENV_KEY)) !== null && _configService_get !== void 0 ? _configService_get : '';
     if (!isValidAES256GCMEncryptionSecret(encryptionSecret)) {
@@ -6431,4 +6529,4 @@ function _unsupported_iterable_to_array(o, minLen) {
     return fn;
 }
 
-export { DEFAULT_APP_OAUTH_CONSENT_PATH_PART, DEFAULT_APP_OAUTH_INTERACTION_PATH, DEFAULT_APP_OAUTH_LOGIN_PATH_PART, DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_OIDC_CODE_CHALLENGE_METHODS, DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES, DEFAULT_OIDC_ISSUER_PATH, DEFAULT_OIDC_ROUTES, DEFAULT_OIDC_SUBJECT_TYPES, DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, DEFAULT_OIDC_TOKEN_LIFETIMES, DEFAULT_ROTATED_KEY_MAX_AGE, FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, GRANTABLE_MODEL_NAMES, JwksFirestoreCollections, JwksKeyDocument, JwksService, JwksServiceConfig, JwksServiceStorageConfig, OIDC_ENCRYPTED_PAYLOAD_FIELDS, OIDC_JWKS_ENCRYPTION_SECRET_ENV_KEY, OidcAccountService, OidcAccountServiceDelegate, OidcAccountServiceUserContext, OidcAuth, OidcAuthBearerTokenMiddleware, OidcAuthMiddlewareConfig, OidcClientService, OidcEncryptionService, OidcInteractionController, OidcInteractionService, OidcModelServerActions, OidcModuleConfig, OidcProviderConfigService, OidcProviderController, OidcServerFirestoreCollections, OidcService, OidcWellKnownController, activeJwksKeysQuery, appOidcModelModuleMetadata, applyOidcAuthMiddleware, createAdapterFactory, createOidcClientFactory, deleteOidcClientFactory, deleteOidcTokenFactory, getOidcScopesFromRequest, jwksKeyCollectionReference, jwksKeyConverter, jwksKeyFirestoreCollection, jwksKeyIdentity, jwksKeysWithStatusQuery, nonRetiredJwksKeysQuery, oidcCallModelScopePreAssert, oidcFirestoreCollectionsFactory, oidcModelServerActions, oidcModelServerActionsFactory, oidcModuleConfigFactory, oidcModuleMetadata, rotateOidcClientSecretFactory, rotatedJwksKeysQuery, updateOidcClientFactory };
+export { DEFAULT_APP_OAUTH_CONSENT_PATH_PART, DEFAULT_APP_OAUTH_INTERACTION_PATH, DEFAULT_APP_OAUTH_LOGIN_PATH_PART, DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_OIDC_CODE_CHALLENGE_METHODS, DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES, DEFAULT_OIDC_ISSUER_PATH, DEFAULT_OIDC_ROUTES, DEFAULT_OIDC_SUBJECT_TYPES, DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, DEFAULT_OIDC_TOKEN_LIFETIMES, DEFAULT_ROTATED_KEY_MAX_AGE, FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, GRANTABLE_MODEL_NAMES, JwksFirestoreCollections, JwksKeyDocument, JwksService, JwksServiceConfig, JwksServiceStorageConfig, OIDC_ENCRYPTED_PAYLOAD_FIELDS, OIDC_JWKS_ENCRYPTION_SECRET_ENV_KEY, OidcAccountService, OidcAccountServiceDelegate, OidcAccountServiceUserContext, OidcAuth, OidcAuthBearerTokenMiddleware, OidcAuthMiddlewareConfig, OidcClientService, OidcEncryptionService, OidcInteractionController, OidcInteractionService, OidcModelServerActions, OidcModuleConfig, OidcProviderConfigService, OidcProviderController, OidcServerFirestoreCollections, OidcService, OidcWellKnownController, activeJwksKeysQuery, appOidcModelModuleMetadata, applyOidcAuthMiddleware, applyOidcCorsMiddleware, createAdapterFactory, createOidcClientFactory, deleteOidcClientFactory, deleteOidcTokenFactory, getOidcScopesFromRequest, jwksKeyCollectionReference, jwksKeyConverter, jwksKeyFirestoreCollection, jwksKeyIdentity, jwksKeysWithStatusQuery, nonRetiredJwksKeysQuery, oidcCallModelScopePreAssert, oidcFirestoreCollectionsFactory, oidcModelServerActions, oidcModelServerActionsFactory, oidcModuleConfigFactory, oidcModuleMetadata, rotateOidcClientSecretFactory, rotatedJwksKeysQuery, updateOidcClientFactory };

package/oidc/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/oidc",
-  "version": "13.11.6",
+  "version": "13.11.8",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.6",
-    "@dereekb/date": "13.11.6",
-    "@dereekb/firebase": "13.11.6",
-    "@dereekb/firebase-server": "13.11.6",
-    "@dereekb/model": "13.11.6",
-    "@dereekb/nestjs": "13.11.6",
-    "@dereekb/rxjs": "13.11.6",
-    "@dereekb/util": "13.11.6",
-    "@dereekb/zoho": "13.11.6",
+    "@dereekb/analytics": "13.11.8",
+    "@dereekb/date": "13.11.8",
+    "@dereekb/firebase": "13.11.8",
+    "@dereekb/firebase-server": "13.11.8",
+    "@dereekb/model": "13.11.8",
+    "@dereekb/nestjs": "13.11.8",
+    "@dereekb/rxjs": "13.11.8",
+    "@dereekb/util": "13.11.8",
+    "@dereekb/zoho": "13.11.8",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "express": "^5.2.1",

package/oidc/src/lib/middleware/index.d.ts

@@ -1,3 +1,4 @@
 export * from './oauth-auth.decorator';
 export * from './oauth-auth.middleware';
 export * from './oauth-auth.module';
+export * from './oauth-cors.module';

package/oidc/src/lib/middleware/oauth-cors.module.d.ts

@@ -0,0 +1,35 @@
+import { type INestApplication } from '@nestjs/common';
+/**
+ * Enables CORS on the NestJS app for OIDC cross-origin requests originating from the frontend.
+ *
+ * When the OIDC issuer lives on a different origin than the frontend app (e.g. the frontend is
+ * `https://app.example.com` and the OIDC server is at `https://api.example.com`), the frontend's
+ * `DbxFirebaseOidcInteractionService` issues cross-origin POSTs to `/interaction/{uid}/login`
+ * and `/interaction/{uid}/consent`. Because the POST body is `application/json`, the browser
+ * sends a CORS preflight. Without an `Access-Control-Allow-Origin` reply the preflight fails,
+ * the POST never reaches the server, and the OAuth flow stalls before `finishInteractionByUid`
+ * can run.
+ *
+ * Origin is sourced from `FirebaseServerEnvService.appUrl`, which is the authoritative frontend
+ * origin per environment. Single-origin deployments (e.g. local dev where the frontend and the
+ * OIDC server share `http://localhost:9010`) still benefit: their cross-origin requests are
+ * actually same-origin and CORS is a no-op.
+ *
+ * Credentials are intentionally NOT enabled (`Access-Control-Allow-Credentials` stays off). The
+ * `/interaction/{uid}/*` POSTs carry the Firebase ID token in the JSON body, not in cookies, so
+ * we keep the CORS surface minimal.
+ *
+ * @param nestApp - the NestJS application to configure.
+ *
+ * @example
+ * ```ts
+ * export const APP_NEST_SERVER_CONFIG: NestServerInstanceConfig<AppModule> = {
+ *   moduleClass: AppModule,
+ *   configureNestServerInstance: (nestApp) => {
+ *     applyOidcCorsMiddleware(nestApp);
+ *     applyOidcAuthMiddleware(nestApp);
+ *   }
+ * };
+ * ```
+ */
+export declare function applyOidcCorsMiddleware(nestApp: INestApplication): void;

package/oidc/src/lib/oidc.module.d.ts

@@ -61,14 +61,17 @@ export declare const FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE: strin
 /**
  * Factory that builds {@link OidcModuleConfig} from environment variables and the app's {@link FirebaseServerEnvService}.
  *
- * Derives the issuer URL from `appUrl` + the optional `OIDC_ISSUER_PATH` env var (defaults to `/oidc`).
- * Reads the JWKS encryption secret from `OIDC_JWKS_ENCRYPTION_SECRET`; in test environments,
- * a deterministic fallback is used.
+ * Derives the issuer URL from `appUrl` (or, when set to a distinct origin, the origin of `appApiUrl`)
+ * plus {@link DEFAULT_OIDC_ISSUER_PATH} (defaults to `/oidc`). Reads the JWKS encryption secret from
+ * `OIDC_JWKS_ENCRYPTION_SECRET`; in test environments, a deterministic fallback is used.
+ *
+ * The issuer can also be overridden directly by passing `issuer` on the `config` block to
+ * {@link oidcModuleMetadata}; the override wins over the factory-derived value.
  *
  * @param configService - the NestJS ConfigService for reading environment variables
  * @param envService - the Firebase server environment service for app URL and env detection
  * @returns the constructed OidcModuleConfig
- * @throws {Error} When `appUrl` is missing, lacks an HTTP prefix, or the encryption secret is invalid.
+ * @throws {Error} When `appUrl` is missing, the resolved issuer lacks an HTTP prefix, or the encryption secret is invalid.
  */
 export declare function oidcModuleConfigFactory(configService: ConfigService, envService: FirebaseServerEnvService): OidcModuleConfig;
 /**
@@ -88,8 +91,13 @@ export interface ProvideAppOidcModuleMetadataConfig extends Pick<ModuleMetadata,
     readonly dependencyModule: Required<ModuleMetadata>['imports']['0'];
     /**
      * Optional overrides to merge into the {@link OidcModuleConfig} produced by the factory.
+     *
+     * The `issuer` override is honored verbatim and takes precedence over the factory-derived issuer
+     * (which is normally built from `envService.appApiUrl` origin ?? `envService.appUrl`). Pass an
+     * explicit `issuer` when the consumer wants a canonical issuer URL that does not match either
+     * environment URL — e.g., when serving OIDC behind a non-`/oidc` path or under a vanity host.
      */
-    readonly config?: Partial<Pick<OidcModuleConfig, 'suppressBodyParserWarning' | 'renderError' | 'protectedPaths' | 'appOAuthInteractionPath' | 'appOAuthLoginUrlPart' | 'appOAuthConsentUrlPart' | 'tokenEndpointAuthMethods' | 'registrationEnabled' | 'trustProxy' | 'trustProxyInNonProduction' | 'tokenLifetimes' | 'maxRequestedLoginDuration' | 'minRequestedLoginDuration' | 'defaultRequestedLoginDuration'>>;
+    readonly config?: Partial<Pick<OidcModuleConfig, 'issuer' | 'suppressBodyParserWarning' | 'renderError' | 'protectedPaths' | 'appOAuthInteractionPath' | 'appOAuthLoginUrlPart' | 'appOAuthConsentUrlPart' | 'tokenEndpointAuthMethods' | 'registrationEnabled' | 'trustProxy' | 'trustProxyInNonProduction' | 'tokenLifetimes' | 'maxRequestedLoginDuration' | 'minRequestedLoginDuration' | 'defaultRequestedLoginDuration'>>;
 }
 /**
  * Convenience function used to generate ModuleMetadata for an app's OidcModule.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/firebase-server",
-  "version": "13.11.6",
+  "version": "13.11.8",
   "sideEffects": false,
   "exports": {
     "./test": {
@@ -44,15 +44,15 @@
   "main": "./index.cjs.js",
   "types": "./src/index.d.ts",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.6",
-    "@dereekb/date": "13.11.6",
-    "@dereekb/dbx-core": "13.11.6",
-    "@dereekb/firebase": "13.11.6",
-    "@dereekb/model": "13.11.6",
-    "@dereekb/nestjs": "13.11.6",
-    "@dereekb/rxjs": "13.11.6",
-    "@dereekb/util": "13.11.6",
-    "@dereekb/zoho": "13.11.6",
+    "@dereekb/analytics": "13.11.8",
+    "@dereekb/date": "13.11.8",
+    "@dereekb/dbx-core": "13.11.8",
+    "@dereekb/firebase": "13.11.8",
+    "@dereekb/model": "13.11.8",
+    "@dereekb/nestjs": "13.11.8",
+    "@dereekb/rxjs": "13.11.8",
+    "@dereekb/util": "13.11.8",
+    "@dereekb/zoho": "13.11.8",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@nestjs/common": "^11.1.19",

package/test/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/test",
-  "version": "13.11.6",
+  "version": "13.11.8",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.6",
-    "@dereekb/date": "13.11.6",
-    "@dereekb/firebase": "13.11.6",
-    "@dereekb/firebase-server": "13.11.6",
-    "@dereekb/firebase-server/oidc": "13.11.6",
-    "@dereekb/model": "13.11.6",
-    "@dereekb/nestjs": "13.11.6",
-    "@dereekb/rxjs": "13.11.6",
-    "@dereekb/util": "13.11.6",
+    "@dereekb/analytics": "13.11.8",
+    "@dereekb/date": "13.11.8",
+    "@dereekb/firebase": "13.11.8",
+    "@dereekb/firebase-server": "13.11.8",
+    "@dereekb/firebase-server/oidc": "13.11.8",
+    "@dereekb/model": "13.11.8",
+    "@dereekb/nestjs": "13.11.8",
+    "@dereekb/rxjs": "13.11.8",
+    "@dereekb/util": "13.11.8",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@nestjs/common": "^11.1.19",
@@ -23,7 +23,7 @@
     "supertest": "^7.2.2"
   },
   "devDependencies": {
-    "@dereekb/nestjs": "13.11.6"
+    "@dereekb/nestjs": "13.11.8"
   },
   "exports": {
     "./package.json": "./package.json",

package/zoho/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/zoho",
-  "version": "13.11.6",
+  "version": "13.11.8",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.6",
-    "@dereekb/date": "13.11.6",
-    "@dereekb/model": "13.11.6",
-    "@dereekb/nestjs": "13.11.6",
-    "@dereekb/rxjs": "13.11.6",
-    "@dereekb/firebase": "13.11.6",
-    "@dereekb/util": "13.11.6",
-    "@dereekb/zoho": "13.11.6"
+    "@dereekb/analytics": "13.11.8",
+    "@dereekb/date": "13.11.8",
+    "@dereekb/model": "13.11.8",
+    "@dereekb/nestjs": "13.11.8",
+    "@dereekb/rxjs": "13.11.8",
+    "@dereekb/firebase": "13.11.8",
+    "@dereekb/util": "13.11.8",
+    "@dereekb/zoho": "13.11.8"
   },
   "exports": {
     "./package.json": "./package.json",