@dereekb/firebase-server 13.12.2 → 13.12.4

package/index.cjs.js

@@ -1256,15 +1256,6 @@ function _ts_generator$g(thisArg, body) {
                                     this.updateClaims(passwordClaimsData)
                                 ];
                             case 1:
-                                _state.sent();
-                                // update the user
-                                return [
-                                    4,
-                                    this.updateUser({
-                                        password: password
-                                    })
-                                ];
-                            case 2:
                                 _state.sent();
                                 return [
                                     2,
@@ -2123,6 +2114,50 @@ function _ts_generator$g(thisArg, body) {
     ]);
     return NoSetupContentFirebaseServerNewUserService;
 }(AbstractFirebaseServerNewUserService);
+/**
+ * Builds the composite oob code from a raw reset code (the numeric value stored in
+ * {@link FirebaseServerAuthResetUserPasswordClaims.resetPassword}) and the target user's uid.
+ *
+ * @param uid - The target user's UID.
+ * @param code - The raw reset code from the user's claims.
+ *
+ * @example
+ * ```typescript
+ * const oobCode = encodeFirebaseServerUserPasswordResetOobCode(user.uid, claims.resetPassword);
+ * // e.g. '482910-abcDEF123'
+ * ```
+ */ function encodeFirebaseServerUserPasswordResetOobCode(uid, code) {
+    return "".concat(code, "-").concat(uid);
+}
+/**
+ * Decodes a composite oob code back into its `{ uid, code }` parts. Returns `undefined`
+ * when the token is malformed (missing separator, non-numeric code, empty uid).
+ *
+ * @param token - The composite oob token, typically received from the password-reset email.
+ *
+ * @example
+ * ```typescript
+ * const decoded = decodeFirebaseServerUserPasswordResetOobCode('482910-abcDEF123');
+ * // decoded = { uid: 'abcDEF123', code: '482910' }
+ * ```
+ */ function decodeFirebaseServerUserPasswordResetOobCode(token) {
+    var result;
+    if (typeof token === 'string') {
+        var dashIndex = token.indexOf('-');
+        if (dashIndex > 0 && dashIndex < token.length - 1) {
+            var code = token.slice(0, dashIndex);
+            var uid = token.slice(dashIndex + 1);
+            // Code must be purely digits (matches DEFAULT_FIREBASE_PASSWORD_NUMBER_GENERATOR output).
+            if (/^\d+$/.test(code)) {
+                result = {
+                    uid: uid,
+                    code: code
+                };
+            }
+        }
+    }
+    return result;
+}
 /**
  * Default throttle duration (60 seconds) between reset content re-sends to prevent spam while
  * remaining responsive for legitimate users who didn't receive the first email.
@@ -2171,7 +2206,7 @@ function _ts_generator$g(thisArg, body) {
             key: "beginPasswordReset",
             value: function beginPasswordReset(input) {
                 return _async_to_generator$g(function() {
-                    var uid, email, sendResetContent, sendResetDetailsOnce, sendResetIgnoreThrottle, sendResetThrowErrors, data, sendDetailsInTestEnvironment, resolvedUid, userRecord, userContext, claims;
+                    var uid, email, sendResetContent, sendResetDetailsOnce, sendResetIgnoreThrottle, sendResetThrowErrors, data, sendDetailsInTestEnvironment, resolvedUid, userRecord, userContext, claims, oobCode;
                     return _ts_generator$g(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -2232,9 +2267,13 @@ function _ts_generator$g(thisArg, body) {
                                 _state.sent();
                                 _state.label = 7;
                             case 7:
+                                oobCode = encodeFirebaseServerUserPasswordResetOobCode(resolvedUid, claims.resetPassword);
                                 return [
                                     2,
-                                    claims
+                                    {
+                                        claims: claims,
+                                        oobCode: oobCode
+                                    }
                                 ];
                         }
                     });
@@ -2380,6 +2419,7 @@ function _ts_generator$g(thisArg, body) {
                                             resetCommunicationAt: claims.resetCommunicationAt,
                                             resetExpiresAt: claims.resetExpiresAt
                                         },
+                                        oobCode: encodeFirebaseServerUserPasswordResetOobCode(userContext.uid, claims.resetPassword),
                                         data: config === null || config === void 0 ? void 0 : config.data,
                                         sendDetailsInTestEnvironment: config === null || config === void 0 ? void 0 : config.sendDetailsInTestEnvironment
                                     };
@@ -2422,30 +2462,56 @@ function _ts_generator$g(thisArg, body) {
         },
         {
             key: "completePasswordReset",
-            value: function completePasswordReset(uid, input) {
+            value: function completePasswordReset(input) {
                 return _async_to_generator$g(function() {
-                    var userContext, claims, storedCode, expiresAt, storedBuf, inputBuf;
+                    var decoded, userContext, claims, storedCode, expiresAt, storedBuf, inputBuf;
                     return _ts_generator$g(this, function(_state) {
                         switch(_state.label){
                             case 0:
-                                userContext = this.authService.userContext(uid);
+                                // Decode the composite token. A malformed token is treated identically to every other
+                                // failure mode below — the caller cannot distinguish between "bad encoding", "unknown uid",
+                                // "no active reset", "expired", or "wrong code".
+                                decoded = decodeFirebaseServerUserPasswordResetOobCode(input.oobCode);
+                                if (!decoded) {
+                                    throw new FirebaseServerAuthPasswordResetInvalidCodeError();
+                                }
+                                userContext = this.authService.userContext(decoded.uid);
+                                _state.label = 1;
+                            case 1:
+                                _state.trys.push([
+                                    1,
+                                    3,
+                                    ,
+                                    4
+                                ]);
                                 return [
                                     4,
                                     userContext.loadResetPasswordClaims()
                                 ];
-                            case 1:
+                            case 2:
                                 claims = _state.sent();
+                                return [
+                                    3,
+                                    4
+                                ];
+                            case 3:
+                                _state.sent();
+                                claims = undefined;
+                                return [
+                                    3,
+                                    4
+                                ];
+                            case 4:
                                 storedCode = claims === null || claims === void 0 ? void 0 : claims.resetPassword;
                                 expiresAt = claims === null || claims === void 0 ? void 0 : claims.resetExpiresAt;
                                 // Reject if no active reset OR the stored code is missing/wrong length OR the code is expired.
-                                // All failure cases throw the same opaque error so callers cannot distinguish them.
-                                if (!storedCode || !expiresAt || storedCode.length !== input.resetPassword.length || new Date(expiresAt).getTime() <= Date.now()) {
+                                if (!storedCode || !expiresAt || storedCode.length !== decoded.code.length || new Date(expiresAt).getTime() <= Date.now()) {
                                     throw new FirebaseServerAuthPasswordResetInvalidCodeError();
                                 }
                                 // Constant-time comparison to avoid leaking timing information about how many leading
                                 // characters of the provided code matched. Lengths are equal per the guard above.
                                 storedBuf = Buffer.from(storedCode);
-                                inputBuf = Buffer.from(input.resetPassword);
+                                inputBuf = Buffer.from(decoded.code);
                                 if (!node_crypto.timingSafeEqual(storedBuf, inputBuf)) {
                                     throw new FirebaseServerAuthPasswordResetInvalidCodeError();
                                 }
@@ -12998,12 +13064,14 @@ exports.catchAndThrowPasswordResetServerErrors = catchAndThrowPasswordResetServe
 exports.cloudEventHandlerWithNestContextFactory = cloudEventHandlerWithNestContextFactory;
 exports.collectionRefForPath = collectionRefForPath;
 exports.createModelUnknownModelTypeError = createModelUnknownModelTypeError;
+exports.decodeFirebaseServerUserPasswordResetOobCode = decodeFirebaseServerUserPasswordResetOobCode;
 exports.defaultFirebaseServerActionsTransformFactoryLogErrorFunction = defaultFirebaseServerActionsTransformFactoryLogErrorFunction;
 exports.defaultProvideFirebaseServerStorageServiceSimple = defaultProvideFirebaseServerStorageServiceSimple;
 exports.deleteModelUnknownModelTypeError = deleteModelUnknownModelTypeError;
 exports.developmentUnknownSpecifierError = developmentUnknownSpecifierError;
 exports.docRefForPath = docRefForPath;
 exports.documentModelNotAvailableError = documentModelNotAvailableError;
+exports.encodeFirebaseServerUserPasswordResetOobCode = encodeFirebaseServerUserPasswordResetOobCode;
 exports.executeOnCallQuery = executeOnCallQuery;
 exports.firebaseAuthTokenFromDecodedIdToken = firebaseAuthTokenFromDecodedIdToken;
 exports.firebaseServerActionsContext = firebaseServerActionsContext;

package/index.esm.js

@@ -1254,15 +1254,6 @@ function _ts_generator$g(thisArg, body) {
                                     this.updateClaims(passwordClaimsData)
                                 ];
                             case 1:
-                                _state.sent();
-                                // update the user
-                                return [
-                                    4,
-                                    this.updateUser({
-                                        password: password
-                                    })
-                                ];
-                            case 2:
                                 _state.sent();
                                 return [
                                     2,
@@ -2121,6 +2112,50 @@ function _ts_generator$g(thisArg, body) {
     ]);
     return NoSetupContentFirebaseServerNewUserService;
 }(AbstractFirebaseServerNewUserService);
+/**
+ * Builds the composite oob code from a raw reset code (the numeric value stored in
+ * {@link FirebaseServerAuthResetUserPasswordClaims.resetPassword}) and the target user's uid.
+ *
+ * @param uid - The target user's UID.
+ * @param code - The raw reset code from the user's claims.
+ *
+ * @example
+ * ```typescript
+ * const oobCode = encodeFirebaseServerUserPasswordResetOobCode(user.uid, claims.resetPassword);
+ * // e.g. '482910-abcDEF123'
+ * ```
+ */ function encodeFirebaseServerUserPasswordResetOobCode(uid, code) {
+    return "".concat(code, "-").concat(uid);
+}
+/**
+ * Decodes a composite oob code back into its `{ uid, code }` parts. Returns `undefined`
+ * when the token is malformed (missing separator, non-numeric code, empty uid).
+ *
+ * @param token - The composite oob token, typically received from the password-reset email.
+ *
+ * @example
+ * ```typescript
+ * const decoded = decodeFirebaseServerUserPasswordResetOobCode('482910-abcDEF123');
+ * // decoded = { uid: 'abcDEF123', code: '482910' }
+ * ```
+ */ function decodeFirebaseServerUserPasswordResetOobCode(token) {
+    var result;
+    if (typeof token === 'string') {
+        var dashIndex = token.indexOf('-');
+        if (dashIndex > 0 && dashIndex < token.length - 1) {
+            var code = token.slice(0, dashIndex);
+            var uid = token.slice(dashIndex + 1);
+            // Code must be purely digits (matches DEFAULT_FIREBASE_PASSWORD_NUMBER_GENERATOR output).
+            if (/^\d+$/.test(code)) {
+                result = {
+                    uid: uid,
+                    code: code
+                };
+            }
+        }
+    }
+    return result;
+}
 /**
  * Default throttle duration (60 seconds) between reset content re-sends to prevent spam while
  * remaining responsive for legitimate users who didn't receive the first email.
@@ -2169,7 +2204,7 @@ function _ts_generator$g(thisArg, body) {
             key: "beginPasswordReset",
             value: function beginPasswordReset(input) {
                 return _async_to_generator$g(function() {
-                    var uid, email, sendResetContent, sendResetDetailsOnce, sendResetIgnoreThrottle, sendResetThrowErrors, data, sendDetailsInTestEnvironment, resolvedUid, userRecord, userContext, claims;
+                    var uid, email, sendResetContent, sendResetDetailsOnce, sendResetIgnoreThrottle, sendResetThrowErrors, data, sendDetailsInTestEnvironment, resolvedUid, userRecord, userContext, claims, oobCode;
                     return _ts_generator$g(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -2230,9 +2265,13 @@ function _ts_generator$g(thisArg, body) {
                                 _state.sent();
                                 _state.label = 7;
                             case 7:
+                                oobCode = encodeFirebaseServerUserPasswordResetOobCode(resolvedUid, claims.resetPassword);
                                 return [
                                     2,
-                                    claims
+                                    {
+                                        claims: claims,
+                                        oobCode: oobCode
+                                    }
                                 ];
                         }
                     });
@@ -2378,6 +2417,7 @@ function _ts_generator$g(thisArg, body) {
                                             resetCommunicationAt: claims.resetCommunicationAt,
                                             resetExpiresAt: claims.resetExpiresAt
                                         },
+                                        oobCode: encodeFirebaseServerUserPasswordResetOobCode(userContext.uid, claims.resetPassword),
                                         data: config === null || config === void 0 ? void 0 : config.data,
                                         sendDetailsInTestEnvironment: config === null || config === void 0 ? void 0 : config.sendDetailsInTestEnvironment
                                     };
@@ -2420,30 +2460,56 @@ function _ts_generator$g(thisArg, body) {
         },
         {
             key: "completePasswordReset",
-            value: function completePasswordReset(uid, input) {
+            value: function completePasswordReset(input) {
                 return _async_to_generator$g(function() {
-                    var userContext, claims, storedCode, expiresAt, storedBuf, inputBuf;
+                    var decoded, userContext, claims, storedCode, expiresAt, storedBuf, inputBuf;
                     return _ts_generator$g(this, function(_state) {
                         switch(_state.label){
                             case 0:
-                                userContext = this.authService.userContext(uid);
+                                // Decode the composite token. A malformed token is treated identically to every other
+                                // failure mode below — the caller cannot distinguish between "bad encoding", "unknown uid",
+                                // "no active reset", "expired", or "wrong code".
+                                decoded = decodeFirebaseServerUserPasswordResetOobCode(input.oobCode);
+                                if (!decoded) {
+                                    throw new FirebaseServerAuthPasswordResetInvalidCodeError();
+                                }
+                                userContext = this.authService.userContext(decoded.uid);
+                                _state.label = 1;
+                            case 1:
+                                _state.trys.push([
+                                    1,
+                                    3,
+                                    ,
+                                    4
+                                ]);
                                 return [
                                     4,
                                     userContext.loadResetPasswordClaims()
                                 ];
-                            case 1:
+                            case 2:
                                 claims = _state.sent();
+                                return [
+                                    3,
+                                    4
+                                ];
+                            case 3:
+                                _state.sent();
+                                claims = undefined;
+                                return [
+                                    3,
+                                    4
+                                ];
+                            case 4:
                                 storedCode = claims === null || claims === void 0 ? void 0 : claims.resetPassword;
                                 expiresAt = claims === null || claims === void 0 ? void 0 : claims.resetExpiresAt;
                                 // Reject if no active reset OR the stored code is missing/wrong length OR the code is expired.
-                                // All failure cases throw the same opaque error so callers cannot distinguish them.
-                                if (!storedCode || !expiresAt || storedCode.length !== input.resetPassword.length || new Date(expiresAt).getTime() <= Date.now()) {
+                                if (!storedCode || !expiresAt || storedCode.length !== decoded.code.length || new Date(expiresAt).getTime() <= Date.now()) {
                                     throw new FirebaseServerAuthPasswordResetInvalidCodeError();
                                 }
                                 // Constant-time comparison to avoid leaking timing information about how many leading
                                 // characters of the provided code matched. Lengths are equal per the guard above.
                                 storedBuf = Buffer.from(storedCode);
-                                inputBuf = Buffer.from(input.resetPassword);
+                                inputBuf = Buffer.from(decoded.code);
                                 if (!timingSafeEqual(storedBuf, inputBuf)) {
                                     throw new FirebaseServerAuthPasswordResetInvalidCodeError();
                                 }
@@ -12914,4 +12980,4 @@ function _define_property(obj, key, value) {
 } 
 ();
 
-export { AbstractFirebaseNestContext, AbstractFirebaseServerActionsContext, AbstractFirebaseServerAuthContext, AbstractFirebaseServerAuthService, AbstractFirebaseServerAuthUserContext, AbstractFirebaseServerNewUserService, AbstractFirebaseServerUserPasswordResetService, AbstractNestContext, AbstractServerFirebaseNestContext, ConfigureFirebaseAppCheckMiddlewareModule, ConfigureFirebaseWebhookMiddlewareModule, DEFAULT_FIREBASE_PASSWORD_NUMBER_GENERATOR, DEFAULT_RESET_CODE_EXPIRES_IN, DEFAULT_RESET_COM_THROTTLE_TIME, DEFAULT_SERVER_ASSETS_BASE_PATH, DEFAULT_SETUP_COM_THROTTLE_TIME, DefaultFirebaseServerEnvService, FIREBASE_APP_TOKEN, FIREBASE_AUTH_TOKEN, FIREBASE_FIRESTORE_CONTEXT_TOKEN, FIREBASE_FIRESTORE_TOKEN, FIREBASE_SERVER_ENV_TOKEN, FIREBASE_SERVER_VALIDATION_ERROR_CODE, FIREBASE_STORAGE_CONTEXT_FACTORY_CONFIG_TOKEN, FIREBASE_STORAGE_CONTEXT_TOKEN, FIREBASE_STORAGE_TOKEN, FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING, FirebaseAppCheckMiddleware, FirebaseAppCheckMiddlewareConfig, FirebaseNestServerRootModule, FirebaseRawBodyMiddleware, FirebaseServerAnalyticsSegmentListenerService, FirebaseServerAnalyticsSegmentModule, FirebaseServerAnalyticsService, FirebaseServerAnalyticsServiceListener, FirebaseServerAuthModule, FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError, FirebaseServerAuthNewUserSendSetupDetailsSendOnceError, FirebaseServerAuthNewUserSendSetupDetailsThrottleError, FirebaseServerAuthPasswordResetInvalidCodeError, FirebaseServerAuthPasswordResetNoResetConfigError, FirebaseServerAuthPasswordResetSendOnceError, FirebaseServerAuthPasswordResetThrottleError, FirebaseServerAuthService, FirebaseServerAuthUserBadInputError, FirebaseServerAuthUserExistsError, FirebaseServerEnvService, FirebaseServerFirestoreContextModule, FirebaseServerFirestoreModule, FirebaseServerStorageContextModule, FirebaseServerStorageModule, FirebaseServerStorageService, GlobalRoutePrefixConfig, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MODEL_API_NEST_APPLICATION_CONTEXT, ModelApiCallModelDispatchService, ModelApiController, ModelApiDispatchConfig, ModelApiGetService, NO_RUN_NAME_SPECIFIED_FOR_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_CODE, NoContentFirebaseServerUserPasswordResetService, NoSetupContentFirebaseServerNewUserService, ON_CALL_MODEL_ANALYTICS_HANDLER, ON_CALL_MODEL_ANALYTICS_SERVICE, OnCallModelAnalyticsService, PHONE_NUMBER_ALREADY_EXISTS_ERROR_CODE, SkipAppCheck, UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_NAME_CODE, UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_TYPE_CODE, _onCallWithCallTypeFunction, aggregateCrudModelApiDetails, aggregateModelApiDetails, aggregateSpecifierApiDetails, alreadyExistsError, appAnalyticsModuleMetadata, appFirestoreModuleMetadata, assertContextHasAuth, assertDocumentExists, assertHasRolesInRequest, assertHasSignedTosInRequest, assertIsAdminInRequest, assertIsAdminOrTargetUserInRequestData, assertIsContextWithAuthData, assertRequestRequiresAuthForFunction, assertSnapshotData, assertSnapshotDataWithKey, authServicePasswordResetInvalidCodeError, authServicePasswordResetNoConfigError, authServicePasswordResetSendOnceError, authServicePasswordResetThrottleError, badRequestError, blockingFunctionHandlerWithNestContextFactory, buildNestServerRootModule, callWithAnalytics, catchAndThrowPasswordResetServerErrors, cloudEventHandlerWithNestContextFactory, collectionRefForPath, createModelUnknownModelTypeError, defaultFirebaseServerActionsTransformFactoryLogErrorFunction, defaultProvideFirebaseServerStorageServiceSimple, deleteModelUnknownModelTypeError, developmentUnknownSpecifierError, docRefForPath, documentModelNotAvailableError, executeOnCallQuery, firebaseAuthTokenFromDecodedIdToken, firebaseServerActionsContext, firebaseServerActionsTransformContext, firebaseServerActionsTransformFactory, firebaseServerAppTokenProvider, firebaseServerAuthModuleMetadata, firebaseServerDevFunctions, firebaseServerEnvTokenProvider, firebaseServerEnvTokenProviders, firebaseServerErrorInfo, firebaseServerErrorInfoCodePair, firebaseServerErrorInfoServerErrorCodePair, firebaseServerErrorInfoServerErrorPair, firebaseServerFirestoreContextModuleMetadata, firebaseServerStorageDefaultBucketIdTokenProvider, firebaseServerStorageModuleMetadata, firebaseServerValidationError, firebaseServerValidationServerError, firestoreClientQueryConstraintFunctionsDriver, firestoreEncryptedField, firestoreServerIncrementUpdateToUpdateData, forbiddenError, getAuthUserOrUndefined, getModelApiDetails, googleCloudFileMetadataToStorageMetadata, googleCloudFirebaseStorageContextFactory, googleCloudFirebaseStorageDrivers, googleCloudFirestoreAccessorDriver, googleCloudFirestoreContextFactory, googleCloudFirestoreDrivers, googleCloudFirestoreQueryDriver, googleCloudStorageAccessorFile, googleCloudStorageAccessorFolder, googleCloudStorageBucketForStorageFilePath, googleCloudStorageFileForStorageFilePath, googleCloudStorageFirebaseStorageAccessorDriver, googleCloudStorageFromFirebaseAdminStorage, googleCloudStorageListFilesResultFactory, handleFirebaseAuthError, handleFirebaseError, hasAuthRolesInRequest, hasNewUserSetupPasswordInRequest, hasSignedTosInRequest, inAuthContext, injectNestApplicationContextIntoRequest, injectNestIntoRequest, internalServerError, invokeModelUnknownModelTypeError, isActualSpecifier, isAdminInRequest, isAdminOrTargetUserInRequestData, isContextWithAuthData, isFirebaseError, isFirebaseHttpsError, isOnCallCrudModelApiDetails, isOnCallHandlerApiDetails, isOnCallModelTypeApiDetails, isOnCallSpecifierApiDetails, makeBlockingFunctionWithHandler, makeOnScheduleHandlerWithNestApplicationRequest, makeScheduledFunctionDevelopmentFunction, modelAccessReadErrorFromUseMultipleModelsFailure, modelApiModuleMetadata, modelNotAvailableError, nestAppHasDevelopmentSchedulerEnabled, nestAppIsProductionEnvironment, nestFirebaseDoesNotExistError, nestFirebaseForbiddenPermissionError, nestServerInstance, noRunNameSpecifiedForScheduledFunctionDevelopmentFunction, noopFirebaseServerAnalyticsServiceListener, noopOnCallModelAnalyticsService, notFoundError, onCallAnalyticsEmitterInstance, onCallCreateModel, onCallDeleteModel, onCallDevelopmentFunction, onCallHandlerWithNestApplicationFactory, onCallHandlerWithNestContextFactory, onCallInvokeModel, onCallModel, onCallModelMissingCallTypeError, onCallModelUnknownCallTypeError, onCallQueryModel, onCallReadModel, onCallSpecifierHandler, onCallUpdateModel, onScheduleHandlerWithNestApplicationFactory, onScheduleHandlerWithNestContextFactory, optionalAuthContext, optionalFirestoreEncryptedField, permissionDeniedError, phoneNumberAlreadyExistsError, preconditionConflictError, provideAppFirestoreCollections, provideFirebaseServerAuthService, provideFirebaseServerStorageService, queryModelBadCursorError, queryModelUnknownModelTypeError, readApiDetails, readModelUnknownModelTypeError, resolveAdminOnlyValue, resolveAnalyticsFromApiDetails, setNestContextOnRequest, setNestContextOnScheduleRequest, taskQueueFunctionHandlerWithNestContextFactory, unauthenticatedContextHasNoAuthData, unauthenticatedContextHasNoUidError, unauthenticatedError, unavailableError, unavailableOrDeactivatedFunctionError, unknownModelCrudFunctionSpecifierError, unknownScheduledFunctionDevelopmentFunctionName, unknownScheduledFunctionDevelopmentFunctionType, updateModelUnknownModelTypeError, userContextFromUid, verifyAppCheckInRequest, withApiDetails };
+export { AbstractFirebaseNestContext, AbstractFirebaseServerActionsContext, AbstractFirebaseServerAuthContext, AbstractFirebaseServerAuthService, AbstractFirebaseServerAuthUserContext, AbstractFirebaseServerNewUserService, AbstractFirebaseServerUserPasswordResetService, AbstractNestContext, AbstractServerFirebaseNestContext, ConfigureFirebaseAppCheckMiddlewareModule, ConfigureFirebaseWebhookMiddlewareModule, DEFAULT_FIREBASE_PASSWORD_NUMBER_GENERATOR, DEFAULT_RESET_CODE_EXPIRES_IN, DEFAULT_RESET_COM_THROTTLE_TIME, DEFAULT_SERVER_ASSETS_BASE_PATH, DEFAULT_SETUP_COM_THROTTLE_TIME, DefaultFirebaseServerEnvService, FIREBASE_APP_TOKEN, FIREBASE_AUTH_TOKEN, FIREBASE_FIRESTORE_CONTEXT_TOKEN, FIREBASE_FIRESTORE_TOKEN, FIREBASE_SERVER_ENV_TOKEN, FIREBASE_SERVER_VALIDATION_ERROR_CODE, FIREBASE_STORAGE_CONTEXT_FACTORY_CONFIG_TOKEN, FIREBASE_STORAGE_CONTEXT_TOKEN, FIREBASE_STORAGE_TOKEN, FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING, FirebaseAppCheckMiddleware, FirebaseAppCheckMiddlewareConfig, FirebaseNestServerRootModule, FirebaseRawBodyMiddleware, FirebaseServerAnalyticsSegmentListenerService, FirebaseServerAnalyticsSegmentModule, FirebaseServerAnalyticsService, FirebaseServerAnalyticsServiceListener, FirebaseServerAuthModule, FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError, FirebaseServerAuthNewUserSendSetupDetailsSendOnceError, FirebaseServerAuthNewUserSendSetupDetailsThrottleError, FirebaseServerAuthPasswordResetInvalidCodeError, FirebaseServerAuthPasswordResetNoResetConfigError, FirebaseServerAuthPasswordResetSendOnceError, FirebaseServerAuthPasswordResetThrottleError, FirebaseServerAuthService, FirebaseServerAuthUserBadInputError, FirebaseServerAuthUserExistsError, FirebaseServerEnvService, FirebaseServerFirestoreContextModule, FirebaseServerFirestoreModule, FirebaseServerStorageContextModule, FirebaseServerStorageModule, FirebaseServerStorageService, GlobalRoutePrefixConfig, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MODEL_API_NEST_APPLICATION_CONTEXT, ModelApiCallModelDispatchService, ModelApiController, ModelApiDispatchConfig, ModelApiGetService, NO_RUN_NAME_SPECIFIED_FOR_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_CODE, NoContentFirebaseServerUserPasswordResetService, NoSetupContentFirebaseServerNewUserService, ON_CALL_MODEL_ANALYTICS_HANDLER, ON_CALL_MODEL_ANALYTICS_SERVICE, OnCallModelAnalyticsService, PHONE_NUMBER_ALREADY_EXISTS_ERROR_CODE, SkipAppCheck, UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_NAME_CODE, UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_TYPE_CODE, _onCallWithCallTypeFunction, aggregateCrudModelApiDetails, aggregateModelApiDetails, aggregateSpecifierApiDetails, alreadyExistsError, appAnalyticsModuleMetadata, appFirestoreModuleMetadata, assertContextHasAuth, assertDocumentExists, assertHasRolesInRequest, assertHasSignedTosInRequest, assertIsAdminInRequest, assertIsAdminOrTargetUserInRequestData, assertIsContextWithAuthData, assertRequestRequiresAuthForFunction, assertSnapshotData, assertSnapshotDataWithKey, authServicePasswordResetInvalidCodeError, authServicePasswordResetNoConfigError, authServicePasswordResetSendOnceError, authServicePasswordResetThrottleError, badRequestError, blockingFunctionHandlerWithNestContextFactory, buildNestServerRootModule, callWithAnalytics, catchAndThrowPasswordResetServerErrors, cloudEventHandlerWithNestContextFactory, collectionRefForPath, createModelUnknownModelTypeError, decodeFirebaseServerUserPasswordResetOobCode, defaultFirebaseServerActionsTransformFactoryLogErrorFunction, defaultProvideFirebaseServerStorageServiceSimple, deleteModelUnknownModelTypeError, developmentUnknownSpecifierError, docRefForPath, documentModelNotAvailableError, encodeFirebaseServerUserPasswordResetOobCode, executeOnCallQuery, firebaseAuthTokenFromDecodedIdToken, firebaseServerActionsContext, firebaseServerActionsTransformContext, firebaseServerActionsTransformFactory, firebaseServerAppTokenProvider, firebaseServerAuthModuleMetadata, firebaseServerDevFunctions, firebaseServerEnvTokenProvider, firebaseServerEnvTokenProviders, firebaseServerErrorInfo, firebaseServerErrorInfoCodePair, firebaseServerErrorInfoServerErrorCodePair, firebaseServerErrorInfoServerErrorPair, firebaseServerFirestoreContextModuleMetadata, firebaseServerStorageDefaultBucketIdTokenProvider, firebaseServerStorageModuleMetadata, firebaseServerValidationError, firebaseServerValidationServerError, firestoreClientQueryConstraintFunctionsDriver, firestoreEncryptedField, firestoreServerIncrementUpdateToUpdateData, forbiddenError, getAuthUserOrUndefined, getModelApiDetails, googleCloudFileMetadataToStorageMetadata, googleCloudFirebaseStorageContextFactory, googleCloudFirebaseStorageDrivers, googleCloudFirestoreAccessorDriver, googleCloudFirestoreContextFactory, googleCloudFirestoreDrivers, googleCloudFirestoreQueryDriver, googleCloudStorageAccessorFile, googleCloudStorageAccessorFolder, googleCloudStorageBucketForStorageFilePath, googleCloudStorageFileForStorageFilePath, googleCloudStorageFirebaseStorageAccessorDriver, googleCloudStorageFromFirebaseAdminStorage, googleCloudStorageListFilesResultFactory, handleFirebaseAuthError, handleFirebaseError, hasAuthRolesInRequest, hasNewUserSetupPasswordInRequest, hasSignedTosInRequest, inAuthContext, injectNestApplicationContextIntoRequest, injectNestIntoRequest, internalServerError, invokeModelUnknownModelTypeError, isActualSpecifier, isAdminInRequest, isAdminOrTargetUserInRequestData, isContextWithAuthData, isFirebaseError, isFirebaseHttpsError, isOnCallCrudModelApiDetails, isOnCallHandlerApiDetails, isOnCallModelTypeApiDetails, isOnCallSpecifierApiDetails, makeBlockingFunctionWithHandler, makeOnScheduleHandlerWithNestApplicationRequest, makeScheduledFunctionDevelopmentFunction, modelAccessReadErrorFromUseMultipleModelsFailure, modelApiModuleMetadata, modelNotAvailableError, nestAppHasDevelopmentSchedulerEnabled, nestAppIsProductionEnvironment, nestFirebaseDoesNotExistError, nestFirebaseForbiddenPermissionError, nestServerInstance, noRunNameSpecifiedForScheduledFunctionDevelopmentFunction, noopFirebaseServerAnalyticsServiceListener, noopOnCallModelAnalyticsService, notFoundError, onCallAnalyticsEmitterInstance, onCallCreateModel, onCallDeleteModel, onCallDevelopmentFunction, onCallHandlerWithNestApplicationFactory, onCallHandlerWithNestContextFactory, onCallInvokeModel, onCallModel, onCallModelMissingCallTypeError, onCallModelUnknownCallTypeError, onCallQueryModel, onCallReadModel, onCallSpecifierHandler, onCallUpdateModel, onScheduleHandlerWithNestApplicationFactory, onScheduleHandlerWithNestContextFactory, optionalAuthContext, optionalFirestoreEncryptedField, permissionDeniedError, phoneNumberAlreadyExistsError, preconditionConflictError, provideAppFirestoreCollections, provideFirebaseServerAuthService, provideFirebaseServerStorageService, queryModelBadCursorError, queryModelUnknownModelTypeError, readApiDetails, readModelUnknownModelTypeError, resolveAdminOnlyValue, resolveAnalyticsFromApiDetails, setNestContextOnRequest, setNestContextOnScheduleRequest, taskQueueFunctionHandlerWithNestContextFactory, unauthenticatedContextHasNoAuthData, unauthenticatedContextHasNoUidError, unauthenticatedError, unavailableError, unavailableOrDeactivatedFunctionError, unknownModelCrudFunctionSpecifierError, unknownScheduledFunctionDevelopmentFunctionName, unknownScheduledFunctionDevelopmentFunctionType, updateModelUnknownModelTypeError, userContextFromUid, verifyAppCheckInRequest, withApiDetails };

package/mailgun/index.cjs.js

@@ -374,7 +374,7 @@ function _ts_generator(thisArg, body) {
             key: "sendPasswordResetContentToUser",
             value: function sendPasswordResetContentToUser(details) {
                 return _async_to_generator(function() {
-                    var userRecord, resetPassword, uid, displayName, email, baseRequest, baseRequestTo;
+                    var userRecord, oobCode, uid, displayName, email, baseRequest, baseRequestTo;
                     return _ts_generator(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -384,7 +384,10 @@ function _ts_generator(thisArg, body) {
                                 ];
                             case 1:
                                 userRecord = _state.sent();
-                                resetPassword = details.claims.resetPassword;
+                                // Inject the encoded oob code (carries both the raw code and the target uid) so the link
+                                // embedded in the email is self-sufficient — the recipient does not need to be signed in
+                                // to complete the reset.
+                                oobCode = details.oobCode;
                                 uid = userRecord.uid, displayName = userRecord.displayName, email = userRecord.email;
                                 if (!email) {
                                     throw new Error('Email is not present/available for the user record "'.concat(userRecord.uid, '"'));
@@ -405,7 +408,7 @@ function _ts_generator(thisArg, body) {
                                             name: baseRequestTo === null || baseRequestTo === void 0 ? void 0 : baseRequestTo.name,
                                             email: email,
                                             userVariables: _object_spread_props(_object_spread({
-                                                resetPassword: resetPassword
+                                                resetPassword: oobCode
                                             }, baseRequestTo === null || baseRequestTo === void 0 ? void 0 : baseRequestTo.userVariables), {
                                                 displayName: displayName,
                                                 uid: uid

package/mailgun/index.esm.js

@@ -372,7 +372,7 @@ function _ts_generator(thisArg, body) {
             key: "sendPasswordResetContentToUser",
             value: function sendPasswordResetContentToUser(details) {
                 return _async_to_generator(function() {
-                    var userRecord, resetPassword, uid, displayName, email, baseRequest, baseRequestTo;
+                    var userRecord, oobCode, uid, displayName, email, baseRequest, baseRequestTo;
                     return _ts_generator(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -382,7 +382,10 @@ function _ts_generator(thisArg, body) {
                                 ];
                             case 1:
                                 userRecord = _state.sent();
-                                resetPassword = details.claims.resetPassword;
+                                // Inject the encoded oob code (carries both the raw code and the target uid) so the link
+                                // embedded in the email is self-sufficient — the recipient does not need to be signed in
+                                // to complete the reset.
+                                oobCode = details.oobCode;
                                 uid = userRecord.uid, displayName = userRecord.displayName, email = userRecord.email;
                                 if (!email) {
                                     throw new Error('Email is not present/available for the user record "'.concat(userRecord.uid, '"'));
@@ -403,7 +406,7 @@ function _ts_generator(thisArg, body) {
                                             name: baseRequestTo === null || baseRequestTo === void 0 ? void 0 : baseRequestTo.name,
                                             email: email,
                                             userVariables: _object_spread_props(_object_spread({
-                                                resetPassword: resetPassword
+                                                resetPassword: oobCode
                                             }, baseRequestTo === null || baseRequestTo === void 0 ? void 0 : baseRequestTo.userVariables), {
                                                 displayName: displayName,
                                                 uid: uid

package/mailgun/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/mailgun",
-  "version": "13.12.2",
+  "version": "13.12.4",
   "peerDependencies": {
-    "@dereekb/analytics": "13.12.2",
-    "@dereekb/firebase": "13.12.2",
-    "@dereekb/firebase-server": "13.12.2",
-    "@dereekb/date": "13.12.2",
-    "@dereekb/nestjs": "13.12.2",
-    "@dereekb/model": "13.12.2",
-    "@dereekb/rxjs": "13.12.2",
-    "@dereekb/util": "13.12.2"
+    "@dereekb/analytics": "13.12.4",
+    "@dereekb/firebase": "13.12.4",
+    "@dereekb/firebase-server": "13.12.4",
+    "@dereekb/date": "13.12.4",
+    "@dereekb/nestjs": "13.12.4",
+    "@dereekb/model": "13.12.4",
+    "@dereekb/rxjs": "13.12.4",
+    "@dereekb/util": "13.12.4"
   },
   "exports": {
     "./package.json": "./package.json",