@dereekb/firebase-server 13.27.1 → 13.28.0

package/mailgun/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/mailgun",
-  "version": "13.27.1",
+  "version": "13.28.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.27.1",
-    "@dereekb/firebase": "13.27.1",
-    "@dereekb/firebase-server": "13.27.1",
-    "@dereekb/date": "13.27.1",
-    "@dereekb/nestjs": "13.27.1",
-    "@dereekb/model": "13.27.1",
-    "@dereekb/rxjs": "13.27.1",
-    "@dereekb/util": "13.27.1"
+    "@dereekb/analytics": "13.28.0",
+    "@dereekb/firebase": "13.28.0",
+    "@dereekb/firebase-server": "13.28.0",
+    "@dereekb/date": "13.28.0",
+    "@dereekb/nestjs": "13.28.0",
+    "@dereekb/model": "13.28.0",
+    "@dereekb/rxjs": "13.28.0",
+    "@dereekb/util": "13.28.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/mcp/package.json

@@ -1,17 +1,17 @@
 {
   "name": "@dereekb/firebase-server/mcp",
-  "version": "13.27.1",
+  "version": "13.28.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.27.1",
-    "@dereekb/date": "13.27.1",
-    "@dereekb/firebase": "13.27.1",
-    "@dereekb/firebase-server": "13.27.1",
-    "@dereekb/firebase-server/oidc": "13.27.1",
-    "@dereekb/model": "13.27.1",
-    "@dereekb/nestjs": "13.27.1",
-    "@dereekb/rxjs": "13.27.1",
-    "@dereekb/util": "13.27.1",
-    "@dereekb/zoho": "13.27.1",
+    "@dereekb/analytics": "13.28.0",
+    "@dereekb/date": "13.28.0",
+    "@dereekb/firebase": "13.28.0",
+    "@dereekb/firebase-server": "13.28.0",
+    "@dereekb/firebase-server/oidc": "13.28.0",
+    "@dereekb/model": "13.28.0",
+    "@dereekb/nestjs": "13.28.0",
+    "@dereekb/rxjs": "13.28.0",
+    "@dereekb/util": "13.28.0",
+    "@dereekb/zoho": "13.28.0",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/core": "^11.1.19",

package/model/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/model",
-  "version": "13.27.1",
+  "version": "13.28.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.27.1",
-    "@dereekb/date": "13.27.1",
-    "@dereekb/firebase": "13.27.1",
-    "@dereekb/firebase-server": "13.27.1",
-    "@dereekb/model": "13.27.1",
-    "@dereekb/nestjs": "13.27.1",
-    "@dereekb/rxjs": "13.27.1",
-    "@dereekb/util": "13.27.1",
+    "@dereekb/analytics": "13.28.0",
+    "@dereekb/date": "13.28.0",
+    "@dereekb/firebase": "13.28.0",
+    "@dereekb/firebase-server": "13.28.0",
+    "@dereekb/model": "13.28.0",
+    "@dereekb/nestjs": "13.28.0",
+    "@dereekb/rxjs": "13.28.0",
+    "@dereekb/util": "13.28.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "archiver": "^7.0.1",

package/oidc/index.cjs.js

@@ -344,6 +344,14 @@ function _define_property$g(obj, key, value) {
      *
      * Defaults to `false`.
      */ _define_property$g(this, "trustProxyInNonProduction", void 0);
+        /**
+     * Unified CORS configuration for the cross-origin browser OIDC endpoints
+     * (discovery GET, token POST). When unset, the Express CORS layer preserves the
+     * pre-existing behavior: `Access-Control-Allow-Origin: <appUrl>` on every
+     * response, which pre-empts oidc-provider's own CORS handling.
+     *
+     * @see OidcCorsConfig
+     */ _define_property$g(this, "cors", void 0);
     }
     _create_class$e(OidcModuleConfig, null, [
         {
@@ -3225,13 +3233,13 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
     return FirestoreAdapter;
 }
 
-function _array_like_to_array$5(arr, len) {
+function _array_like_to_array$6(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$5(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$5(arr);
+function _array_without_holes$6(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$6(arr);
 }
 function _class_call_check$a(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
@@ -3264,22 +3272,22 @@ function _define_property$a(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$5(iter) {
+function _iterable_to_array$6(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$5() {
+function _non_iterable_spread$6() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$5(arr) {
-    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$5(arr) || _non_iterable_spread$5();
+function _to_consumable_array$6(arr) {
+    return _array_without_holes$6(arr) || _iterable_to_array$6(arr) || _unsupported_iterable_to_array$6(arr) || _non_iterable_spread$6();
 }
-function _unsupported_iterable_to_array$5(o, minLen) {
+function _unsupported_iterable_to_array$6(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$5(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$6(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$5(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$6(o, minLen);
 }
 // MARK: Encrypted Fields
 /**
@@ -3307,7 +3315,7 @@ function _unsupported_iterable_to_array$5(o, minLen) {
         this.provider = nestjs.createAesStringEncryptionProvider(config.jwksKeyConverterConfig.encryptionSecret);
         this.adapterPayloadEncryptor = util.selectiveFieldEncryptor({
             provider: this.provider,
-            fields: _to_consumable_array$5(OIDC_ENCRYPTED_PAYLOAD_FIELDS)
+            fields: _to_consumable_array$6(OIDC_ENCRYPTED_PAYLOAD_FIELDS)
         });
     }
     _create_class$8(OidcEncryptionService, [
@@ -3343,13 +3351,13 @@ exports.OidcEncryptionService = __decorate([
     __param(0, common.Inject(OidcModuleConfig))
 ], exports.OidcEncryptionService);
 
-function _array_like_to_array$4(arr, len) {
+function _array_like_to_array$5(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$4(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$4(arr);
+function _array_without_holes$5(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$5(arr);
 }
 function _class_call_check$9(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
@@ -3382,22 +3390,22 @@ function _define_property$9(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$4(iter) {
+function _iterable_to_array$5(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$4() {
+function _non_iterable_spread$5() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$4(arr) {
-    return _array_without_holes$4(arr) || _iterable_to_array$4(arr) || _unsupported_iterable_to_array$4(arr) || _non_iterable_spread$4();
+function _to_consumable_array$5(arr) {
+    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$5(arr) || _non_iterable_spread$5();
 }
-function _unsupported_iterable_to_array$4(o, minLen) {
+function _unsupported_iterable_to_array$5(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$4(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$5(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$4(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$5(o, minLen);
 }
 // MARK: Routes
 /**
@@ -3474,7 +3482,7 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
         this.providerConfig = accountService.providerConfig;
         this.scopesSupported = Object.keys(this.providerConfig.claims);
         this.claimsSupported = Array.from(new Set(Object.values(this.providerConfig.claims).flat()));
-        this.tokenEndpointAuthMethodsSupported = (_this_config_tokenEndpointAuthMethods = this.config.tokenEndpointAuthMethods) !== null && _this_config_tokenEndpointAuthMethods !== void 0 ? _this_config_tokenEndpointAuthMethods : _to_consumable_array$4(DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS);
+        this.tokenEndpointAuthMethodsSupported = (_this_config_tokenEndpointAuthMethods = this.config.tokenEndpointAuthMethods) !== null && _this_config_tokenEndpointAuthMethods !== void 0 ? _this_config_tokenEndpointAuthMethods : _to_consumable_array$5(DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS);
         var appUrl = envService.appUrl;
         this.appLoginUrl = util.websiteUrlFromPaths(appUrl, [
             this.config.appOAuthInteractionPath,
@@ -3507,16 +3515,16 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
                     jwks_uri: jwksUri !== null && jwksUri !== void 0 ? jwksUri : "".concat(issuer).concat(routes.jwks),
                     registration_endpoint: this.oidcRegistrationRouteEnabled ? "".concat(issuer).concat(routes.registration) : undefined,
                     scopes_supported: this.scopesSupported,
-                    response_types_supported: _to_consumable_array$4(providerConfig.responseTypes),
+                    response_types_supported: _to_consumable_array$5(providerConfig.responseTypes),
                     response_modes_supported: [
                         'query'
                     ],
-                    grant_types_supported: _to_consumable_array$4(providerConfig.grantTypes),
-                    subject_types_supported: _to_consumable_array$4(DEFAULT_OIDC_SUBJECT_TYPES),
-                    id_token_signing_alg_values_supported: _to_consumable_array$4(DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES),
-                    token_endpoint_auth_methods_supported: _to_consumable_array$4(this.tokenEndpointAuthMethodsSupported),
+                    grant_types_supported: _to_consumable_array$5(providerConfig.grantTypes),
+                    subject_types_supported: _to_consumable_array$5(DEFAULT_OIDC_SUBJECT_TYPES),
+                    id_token_signing_alg_values_supported: _to_consumable_array$5(DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES),
+                    token_endpoint_auth_methods_supported: _to_consumable_array$5(this.tokenEndpointAuthMethodsSupported),
                     claims_supported: this.claimsSupported,
-                    code_challenge_methods_supported: _to_consumable_array$4(DEFAULT_OIDC_CODE_CHALLENGE_METHODS)
+                    code_challenge_methods_supported: _to_consumable_array$5(DEFAULT_OIDC_CODE_CHALLENGE_METHODS)
                 };
             }
         }
@@ -3530,13 +3538,13 @@ exports.OidcProviderConfigService = __decorate([
     __param(2, common.Inject(firebaseServer.FirebaseServerEnvService))
 ], exports.OidcProviderConfigService);
 
-function _array_like_to_array$3(arr, len) {
+function _array_like_to_array$4(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$3(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$3(arr);
+function _array_without_holes$4(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$4(arr);
 }
 function asyncGeneratorStep$5(gen, resolve, reject, _next, _throw, key, arg) {
     try {
@@ -3598,10 +3606,10 @@ function _define_property$8(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$3(iter) {
+function _iterable_to_array$4(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$3() {
+function _non_iterable_spread$4() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _object_spread$3(target) {
@@ -3674,16 +3682,16 @@ function _object_without_properties_loose(source, excluded) {
     }
     return target;
 }
-function _to_consumable_array$3(arr) {
-    return _array_without_holes$3(arr) || _iterable_to_array$3(arr) || _unsupported_iterable_to_array$3(arr) || _non_iterable_spread$3();
+function _to_consumable_array$4(arr) {
+    return _array_without_holes$4(arr) || _iterable_to_array$4(arr) || _unsupported_iterable_to_array$4(arr) || _non_iterable_spread$4();
 }
-function _unsupported_iterable_to_array$3(o, minLen) {
+function _unsupported_iterable_to_array$4(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$3(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$4(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$3(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$4(o, minLen);
 }
 function _ts_generator$5(thisArg, body) {
     var f, y, t, _ = {
@@ -4060,6 +4068,7 @@ function _ts_generator$5(thisArg, body) {
             value: function buildProviderConfiguration(cookieKeys) {
                 var _this = this;
                 var _config_maxRequestedLoginDuration, _config_minRequestedLoginDuration;
+                var _config_cors;
                 var config = this.config;
                 var providerConfig = this.providerConfigService.providerConfig;
                 var serverMaxSeconds = (_config_maxRequestedLoginDuration = config.maxRequestedLoginDuration) !== null && _config_maxRequestedLoginDuration !== void 0 ? _config_maxRequestedLoginDuration : DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS;
@@ -4077,7 +4086,7 @@ function _ts_generator$5(thisArg, body) {
                 return _object_spread_props(_object_spread$3({
                     routes: _object_spread$3({}, this.providerConfigService.routes),
                     claims: _object_spread$3({}, providerConfig.claims),
-                    responseTypes: _to_consumable_array$3(providerConfig.responseTypes),
+                    responseTypes: _to_consumable_array$4(providerConfig.responseTypes),
                     pkce: {
                         required: function required() {
                             return true;
@@ -4233,6 +4242,19 @@ function _ts_generator$5(thisArg, body) {
                     }
                 }, config.renderError ? {
                     renderError: config.renderError
+                } : {}, ((_config_cors = config.cors) === null || _config_cors === void 0 ? void 0 : _config_cors.clientBased) ? {
+                    clientBasedCORS: function clientBasedCORS(_ctx, origin, client) {
+                        var _client_redirectUris;
+                        return ((_client_redirectUris = client.redirectUris) !== null && _client_redirectUris !== void 0 ? _client_redirectUris : []).some(function(uri) {
+                            var matches = false;
+                            try {
+                                matches = new URL(uri).origin === origin;
+                            } catch (unused) {
+                            // malformed persisted redirect_uri — treat as non-matching
+                            }
+                            return matches;
+                        });
+                    }
                 } : {}), {
                     // Setting `rotateRefreshToken` disables oidc-provider's built-in default, so we both honor the
                     // dbx-components `nonRotatingScopes` extension (service tokens never rotate, keeping a stable
@@ -4862,9 +4884,69 @@ exports.OidcAuthBearerTokenMiddleware = __decorate([
     __param(1, common.Inject(OidcAuthMiddlewareConfig))
 ], exports.OidcAuthBearerTokenMiddleware);
 
+function _array_like_to_array$3(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes$3(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$3(arr);
+}
+function _iterable_to_array$3(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread$3() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _to_consumable_array$3(arr) {
+    return _array_without_holes$3(arr) || _iterable_to_array$3(arr) || _unsupported_iterable_to_array$3(arr) || _non_iterable_spread$3();
+}
+function _unsupported_iterable_to_array$3(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$3(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$3(o, minLen);
+}
+/**
+ * Builds the `cors`-package origin delegate implementing the composed OIDC CORS policy.
+ *
+ * - An allowlisted origin (`appUrl` or any {@link OidcCorsConfig.allowOrigins} entry) is
+ *   reflected exactly, which pre-empts oidc-provider's own CORS handling.
+ * - Otherwise, when {@link OidcCorsConfig.clientBased} is enabled, the header is OMITTED so
+ *   oidc-provider runs its `clientBasedCORS` check on client routes (`/token`) and its builtin
+ *   reflect on client-less routes (discovery/JWKS).
+ * - Otherwise (client-based off), `appUrl` is returned unconditionally so oidc-provider stays
+ *   pre-empted and there is never a reflect-any.
+ *
+ * Exported for unit testing without a running Nest application.
+ *
+ * @param appUrl - The authoritative frontend origin (always allowed).
+ * @param cors - The unified CORS configuration.
+ * @returns A `cors`-package origin delegate.
+ */ function oidcCorsOriginDelegate(appUrl, cors) {
+    var _cors_allowOrigins;
+    var clientBased = cors.clientBased === true;
+    var allowlist = new Set([
+        appUrl
+    ].concat(_to_consumable_array$3((_cors_allowOrigins = cors.allowOrigins) !== null && _cors_allowOrigins !== void 0 ? _cors_allowOrigins : [])));
+    return function(requestOrigin, callback) {
+        var resolved;
+        if (requestOrigin && allowlist.has(requestOrigin)) {
+            resolved = requestOrigin; // reflect the exact allowlisted origin; pre-empts oidc-provider
+        } else if (clientBased) {
+            resolved = false; // OMIT ACAO → oidc-provider runs clientBasedCORS (token) / builtin reflect (discovery)
+        } else {
+            resolved = appUrl; // legacy fallback: ACAO=appUrl always; no reflect-any
+        }
+        callback(null, resolved);
+    };
+}
 // MARK: Express-Level Helper
 /**
- * Enables CORS on the NestJS app for OIDC cross-origin requests originating from the frontend.
+ * Enables CORS on the NestJS app for OIDC cross-origin requests originating from the frontend
+ * and any additional relying-party origins.
  *
  * When the OIDC issuer lives on a different origin than the frontend app (e.g. the frontend is
  * `https://app.example.com` and the OIDC server is at `https://api.example.com`), the frontend's
@@ -4872,16 +4954,22 @@ exports.OidcAuthBearerTokenMiddleware = __decorate([
  * and `/interaction/{uid}/consent`. Because the POST body is `application/json`, the browser
  * sends a CORS preflight. Without an `Access-Control-Allow-Origin` reply the preflight fails,
  * the POST never reaches the server, and the OAuth flow stalls before `finishInteractionByUid`
- * can run.
+ * can run. Browser-based OIDC relying parties (public PKCE clients) likewise need CORS on the
+ * discovery GET and the token POST.
+ *
+ * `appUrl` (from `FirebaseServerEnvService.appUrl`) is always allowed. Additional behavior is
+ * driven by the optional {@link OidcModuleConfig.cors} configuration:
+ * - {@link OidcCorsConfig.allowOrigins} adds an explicit allowlist of relying-party origins.
+ * - {@link OidcCorsConfig.clientBased} defers non-allowlisted origins to oidc-provider's
+ *   `clientBasedCORS`, which trusts each requesting client's registered `redirect_uris`.
  *
- * Origin is sourced from `FirebaseServerEnvService.appUrl`, which is the authoritative frontend
- * origin per environment. Single-origin deployments (e.g. local dev where the frontend and the
- * OIDC server share `http://localhost:9010`) still benefit: their cross-origin requests are
- * actually same-origin and CORS is a no-op.
+ * When `cors` is unset, this preserves the legacy single-origin behavior exactly:
+ * `Access-Control-Allow-Origin: <appUrl>` on every response, which pre-empts oidc-provider's
+ * own CORS handling.
  *
  * Credentials are intentionally NOT enabled (`Access-Control-Allow-Credentials` stays off). The
- * `/interaction/{uid}/*` POSTs carry the Firebase ID token in the JSON body, not in cookies, so
- * we keep the CORS surface minimal.
+ * `/interaction/{uid}/*` POSTs and the token exchange carry their bearer material in the request
+ * body, not in cookies, so we keep the CORS surface minimal.
  *
  * @param nestApp - The NestJS application to configure.
  *
@@ -4897,18 +4985,40 @@ exports.OidcAuthBearerTokenMiddleware = __decorate([
  * ```
  */ function applyOidcCorsMiddleware(nestApp) {
     var envService = nestApp.get(firebaseServer.FirebaseServerEnvService);
-    var origin = envService.appUrl;
-    if (!origin) {
+    var appUrl = envService.appUrl;
+    if (!appUrl) {
         return;
     }
-    nestApp.enableCors({
-        origin: origin,
-        methods: [
-            'GET',
-            'POST',
-            'OPTIONS'
-        ]
-    });
+    // OidcModuleConfig may be absent (module not registered / out of the resolution scope).
+    var cors;
+    try {
+        var _nestApp_get;
+        cors = (_nestApp_get = nestApp.get(OidcModuleConfig, {
+            strict: false
+        })) === null || _nestApp_get === void 0 ? void 0 : _nestApp_get.cors;
+    } catch (unused) {
+        cors = undefined;
+    }
+    if (cors) {
+        nestApp.enableCors({
+            origin: oidcCorsOriginDelegate(appUrl, cors),
+            methods: [
+                'GET',
+                'POST',
+                'OPTIONS'
+            ]
+        });
+    } else {
+        // No cors config → byte-identical to the legacy behavior: ACAO=appUrl unconditionally.
+        nestApp.enableCors({
+            origin: appUrl,
+            methods: [
+                'GET',
+                'POST',
+                'OPTIONS'
+            ]
+        });
+    }
 }
 
 /**
@@ -7635,6 +7745,7 @@ exports.jwksKeysWithStatusQuery = jwksKeysWithStatusQuery;
 exports.nonRetiredJwksKeysQuery = nonRetiredJwksKeysQuery;
 exports.noopOidcAnalyticsService = noopOidcAnalyticsService;
 exports.oidcCallModelScopePreAssert = oidcCallModelScopePreAssert;
+exports.oidcCorsOriginDelegate = oidcCorsOriginDelegate;
 exports.oidcFirestoreCollectionsFactory = oidcFirestoreCollectionsFactory;
 exports.oidcModelServerActions = oidcModelServerActions;
 exports.oidcModelServerActionsFactory = oidcModelServerActionsFactory;

package/oidc/index.esm.js

@@ -342,6 +342,14 @@ function _define_property$g(obj, key, value) {
      *
      * Defaults to `false`.
      */ _define_property$g(this, "trustProxyInNonProduction", void 0);
+        /**
+     * Unified CORS configuration for the cross-origin browser OIDC endpoints
+     * (discovery GET, token POST). When unset, the Express CORS layer preserves the
+     * pre-existing behavior: `Access-Control-Allow-Origin: <appUrl>` on every
+     * response, which pre-empts oidc-provider's own CORS handling.
+     *
+     * @see OidcCorsConfig
+     */ _define_property$g(this, "cors", void 0);
     }
     _create_class$e(OidcModuleConfig, null, [
         {
@@ -3223,13 +3231,13 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
     return FirestoreAdapter;
 }
 
-function _array_like_to_array$5(arr, len) {
+function _array_like_to_array$6(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$5(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$5(arr);
+function _array_without_holes$6(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$6(arr);
 }
 function _class_call_check$a(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
@@ -3262,22 +3270,22 @@ function _define_property$a(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$5(iter) {
+function _iterable_to_array$6(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$5() {
+function _non_iterable_spread$6() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$5(arr) {
-    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$5(arr) || _non_iterable_spread$5();
+function _to_consumable_array$6(arr) {
+    return _array_without_holes$6(arr) || _iterable_to_array$6(arr) || _unsupported_iterable_to_array$6(arr) || _non_iterable_spread$6();
 }
-function _unsupported_iterable_to_array$5(o, minLen) {
+function _unsupported_iterable_to_array$6(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$5(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$6(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$5(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$6(o, minLen);
 }
 // MARK: Encrypted Fields
 /**
@@ -3305,7 +3313,7 @@ function _unsupported_iterable_to_array$5(o, minLen) {
         this.provider = createAesStringEncryptionProvider(config.jwksKeyConverterConfig.encryptionSecret);
         this.adapterPayloadEncryptor = selectiveFieldEncryptor({
             provider: this.provider,
-            fields: _to_consumable_array$5(OIDC_ENCRYPTED_PAYLOAD_FIELDS)
+            fields: _to_consumable_array$6(OIDC_ENCRYPTED_PAYLOAD_FIELDS)
         });
     }
     _create_class$8(OidcEncryptionService, [
@@ -3341,13 +3349,13 @@ OidcEncryptionService = __decorate([
     __param(0, Inject(OidcModuleConfig))
 ], OidcEncryptionService);
 
-function _array_like_to_array$4(arr, len) {
+function _array_like_to_array$5(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$4(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$4(arr);
+function _array_without_holes$5(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$5(arr);
 }
 function _class_call_check$9(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
@@ -3380,22 +3388,22 @@ function _define_property$9(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$4(iter) {
+function _iterable_to_array$5(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$4() {
+function _non_iterable_spread$5() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$4(arr) {
-    return _array_without_holes$4(arr) || _iterable_to_array$4(arr) || _unsupported_iterable_to_array$4(arr) || _non_iterable_spread$4();
+function _to_consumable_array$5(arr) {
+    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$5(arr) || _non_iterable_spread$5();
 }
-function _unsupported_iterable_to_array$4(o, minLen) {
+function _unsupported_iterable_to_array$5(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$4(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$5(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$4(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$5(o, minLen);
 }
 // MARK: Routes
 /**
@@ -3472,7 +3480,7 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
         this.providerConfig = accountService.providerConfig;
         this.scopesSupported = Object.keys(this.providerConfig.claims);
         this.claimsSupported = Array.from(new Set(Object.values(this.providerConfig.claims).flat()));
-        this.tokenEndpointAuthMethodsSupported = (_this_config_tokenEndpointAuthMethods = this.config.tokenEndpointAuthMethods) !== null && _this_config_tokenEndpointAuthMethods !== void 0 ? _this_config_tokenEndpointAuthMethods : _to_consumable_array$4(DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS);
+        this.tokenEndpointAuthMethodsSupported = (_this_config_tokenEndpointAuthMethods = this.config.tokenEndpointAuthMethods) !== null && _this_config_tokenEndpointAuthMethods !== void 0 ? _this_config_tokenEndpointAuthMethods : _to_consumable_array$5(DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS);
         var appUrl = envService.appUrl;
         this.appLoginUrl = websiteUrlFromPaths(appUrl, [
             this.config.appOAuthInteractionPath,
@@ -3505,16 +3513,16 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
                     jwks_uri: jwksUri !== null && jwksUri !== void 0 ? jwksUri : "".concat(issuer).concat(routes.jwks),
                     registration_endpoint: this.oidcRegistrationRouteEnabled ? "".concat(issuer).concat(routes.registration) : undefined,
                     scopes_supported: this.scopesSupported,
-                    response_types_supported: _to_consumable_array$4(providerConfig.responseTypes),
+                    response_types_supported: _to_consumable_array$5(providerConfig.responseTypes),
                     response_modes_supported: [
                         'query'
                     ],
-                    grant_types_supported: _to_consumable_array$4(providerConfig.grantTypes),
-                    subject_types_supported: _to_consumable_array$4(DEFAULT_OIDC_SUBJECT_TYPES),
-                    id_token_signing_alg_values_supported: _to_consumable_array$4(DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES),
-                    token_endpoint_auth_methods_supported: _to_consumable_array$4(this.tokenEndpointAuthMethodsSupported),
+                    grant_types_supported: _to_consumable_array$5(providerConfig.grantTypes),
+                    subject_types_supported: _to_consumable_array$5(DEFAULT_OIDC_SUBJECT_TYPES),
+                    id_token_signing_alg_values_supported: _to_consumable_array$5(DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES),
+                    token_endpoint_auth_methods_supported: _to_consumable_array$5(this.tokenEndpointAuthMethodsSupported),
                     claims_supported: this.claimsSupported,
-                    code_challenge_methods_supported: _to_consumable_array$4(DEFAULT_OIDC_CODE_CHALLENGE_METHODS)
+                    code_challenge_methods_supported: _to_consumable_array$5(DEFAULT_OIDC_CODE_CHALLENGE_METHODS)
                 };
             }
         }
@@ -3528,13 +3536,13 @@ OidcProviderConfigService = __decorate([
     __param(2, Inject(FirebaseServerEnvService))
 ], OidcProviderConfigService);
 
-function _array_like_to_array$3(arr, len) {
+function _array_like_to_array$4(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$3(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$3(arr);
+function _array_without_holes$4(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$4(arr);
 }
 function asyncGeneratorStep$5(gen, resolve, reject, _next, _throw, key, arg) {
     try {
@@ -3596,10 +3604,10 @@ function _define_property$8(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$3(iter) {
+function _iterable_to_array$4(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$3() {
+function _non_iterable_spread$4() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _object_spread$3(target) {
@@ -3672,16 +3680,16 @@ function _object_without_properties_loose(source, excluded) {
     }
     return target;
 }
-function _to_consumable_array$3(arr) {
-    return _array_without_holes$3(arr) || _iterable_to_array$3(arr) || _unsupported_iterable_to_array$3(arr) || _non_iterable_spread$3();
+function _to_consumable_array$4(arr) {
+    return _array_without_holes$4(arr) || _iterable_to_array$4(arr) || _unsupported_iterable_to_array$4(arr) || _non_iterable_spread$4();
 }
-function _unsupported_iterable_to_array$3(o, minLen) {
+function _unsupported_iterable_to_array$4(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$3(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$4(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$3(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$4(o, minLen);
 }
 function _ts_generator$5(thisArg, body) {
     var f, y, t, _ = {
@@ -4058,6 +4066,7 @@ function _ts_generator$5(thisArg, body) {
             value: function buildProviderConfiguration(cookieKeys) {
                 var _this = this;
                 var _config_maxRequestedLoginDuration, _config_minRequestedLoginDuration;
+                var _config_cors;
                 var config = this.config;
                 var providerConfig = this.providerConfigService.providerConfig;
                 var serverMaxSeconds = (_config_maxRequestedLoginDuration = config.maxRequestedLoginDuration) !== null && _config_maxRequestedLoginDuration !== void 0 ? _config_maxRequestedLoginDuration : DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS;
@@ -4075,7 +4084,7 @@ function _ts_generator$5(thisArg, body) {
                 return _object_spread_props(_object_spread$3({
                     routes: _object_spread$3({}, this.providerConfigService.routes),
                     claims: _object_spread$3({}, providerConfig.claims),
-                    responseTypes: _to_consumable_array$3(providerConfig.responseTypes),
+                    responseTypes: _to_consumable_array$4(providerConfig.responseTypes),
                     pkce: {
                         required: function required() {
                             return true;
@@ -4231,6 +4240,19 @@ function _ts_generator$5(thisArg, body) {
                     }
                 }, config.renderError ? {
                     renderError: config.renderError
+                } : {}, ((_config_cors = config.cors) === null || _config_cors === void 0 ? void 0 : _config_cors.clientBased) ? {
+                    clientBasedCORS: function clientBasedCORS(_ctx, origin, client) {
+                        var _client_redirectUris;
+                        return ((_client_redirectUris = client.redirectUris) !== null && _client_redirectUris !== void 0 ? _client_redirectUris : []).some(function(uri) {
+                            var matches = false;
+                            try {
+                                matches = new URL(uri).origin === origin;
+                            } catch (unused) {
+                            // malformed persisted redirect_uri — treat as non-matching
+                            }
+                            return matches;
+                        });
+                    }
                 } : {}), {
                     // Setting `rotateRefreshToken` disables oidc-provider's built-in default, so we both honor the
                     // dbx-components `nonRotatingScopes` extension (service tokens never rotate, keeping a stable
@@ -4860,9 +4882,69 @@ OidcAuthBearerTokenMiddleware = __decorate([
     __param(1, Inject(OidcAuthMiddlewareConfig))
 ], OidcAuthBearerTokenMiddleware);
 
+function _array_like_to_array$3(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes$3(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$3(arr);
+}
+function _iterable_to_array$3(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread$3() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _to_consumable_array$3(arr) {
+    return _array_without_holes$3(arr) || _iterable_to_array$3(arr) || _unsupported_iterable_to_array$3(arr) || _non_iterable_spread$3();
+}
+function _unsupported_iterable_to_array$3(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$3(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$3(o, minLen);
+}
+/**
+ * Builds the `cors`-package origin delegate implementing the composed OIDC CORS policy.
+ *
+ * - An allowlisted origin (`appUrl` or any {@link OidcCorsConfig.allowOrigins} entry) is
+ *   reflected exactly, which pre-empts oidc-provider's own CORS handling.
+ * - Otherwise, when {@link OidcCorsConfig.clientBased} is enabled, the header is OMITTED so
+ *   oidc-provider runs its `clientBasedCORS` check on client routes (`/token`) and its builtin
+ *   reflect on client-less routes (discovery/JWKS).
+ * - Otherwise (client-based off), `appUrl` is returned unconditionally so oidc-provider stays
+ *   pre-empted and there is never a reflect-any.
+ *
+ * Exported for unit testing without a running Nest application.
+ *
+ * @param appUrl - The authoritative frontend origin (always allowed).
+ * @param cors - The unified CORS configuration.
+ * @returns A `cors`-package origin delegate.
+ */ function oidcCorsOriginDelegate(appUrl, cors) {
+    var _cors_allowOrigins;
+    var clientBased = cors.clientBased === true;
+    var allowlist = new Set([
+        appUrl
+    ].concat(_to_consumable_array$3((_cors_allowOrigins = cors.allowOrigins) !== null && _cors_allowOrigins !== void 0 ? _cors_allowOrigins : [])));
+    return function(requestOrigin, callback) {
+        var resolved;
+        if (requestOrigin && allowlist.has(requestOrigin)) {
+            resolved = requestOrigin; // reflect the exact allowlisted origin; pre-empts oidc-provider
+        } else if (clientBased) {
+            resolved = false; // OMIT ACAO → oidc-provider runs clientBasedCORS (token) / builtin reflect (discovery)
+        } else {
+            resolved = appUrl; // legacy fallback: ACAO=appUrl always; no reflect-any
+        }
+        callback(null, resolved);
+    };
+}
 // MARK: Express-Level Helper
 /**
- * Enables CORS on the NestJS app for OIDC cross-origin requests originating from the frontend.
+ * Enables CORS on the NestJS app for OIDC cross-origin requests originating from the frontend
+ * and any additional relying-party origins.
  *
  * When the OIDC issuer lives on a different origin than the frontend app (e.g. the frontend is
  * `https://app.example.com` and the OIDC server is at `https://api.example.com`), the frontend's
@@ -4870,16 +4952,22 @@ OidcAuthBearerTokenMiddleware = __decorate([
  * and `/interaction/{uid}/consent`. Because the POST body is `application/json`, the browser
  * sends a CORS preflight. Without an `Access-Control-Allow-Origin` reply the preflight fails,
  * the POST never reaches the server, and the OAuth flow stalls before `finishInteractionByUid`
- * can run.
+ * can run. Browser-based OIDC relying parties (public PKCE clients) likewise need CORS on the
+ * discovery GET and the token POST.
+ *
+ * `appUrl` (from `FirebaseServerEnvService.appUrl`) is always allowed. Additional behavior is
+ * driven by the optional {@link OidcModuleConfig.cors} configuration:
+ * - {@link OidcCorsConfig.allowOrigins} adds an explicit allowlist of relying-party origins.
+ * - {@link OidcCorsConfig.clientBased} defers non-allowlisted origins to oidc-provider's
+ *   `clientBasedCORS`, which trusts each requesting client's registered `redirect_uris`.
  *
- * Origin is sourced from `FirebaseServerEnvService.appUrl`, which is the authoritative frontend
- * origin per environment. Single-origin deployments (e.g. local dev where the frontend and the
- * OIDC server share `http://localhost:9010`) still benefit: their cross-origin requests are
- * actually same-origin and CORS is a no-op.
+ * When `cors` is unset, this preserves the legacy single-origin behavior exactly:
+ * `Access-Control-Allow-Origin: <appUrl>` on every response, which pre-empts oidc-provider's
+ * own CORS handling.
  *
  * Credentials are intentionally NOT enabled (`Access-Control-Allow-Credentials` stays off). The
- * `/interaction/{uid}/*` POSTs carry the Firebase ID token in the JSON body, not in cookies, so
- * we keep the CORS surface minimal.
+ * `/interaction/{uid}/*` POSTs and the token exchange carry their bearer material in the request
+ * body, not in cookies, so we keep the CORS surface minimal.
  *
  * @param nestApp - The NestJS application to configure.
  *
@@ -4895,18 +4983,40 @@ OidcAuthBearerTokenMiddleware = __decorate([
  * ```
  */ function applyOidcCorsMiddleware(nestApp) {
     var envService = nestApp.get(FirebaseServerEnvService);
-    var origin = envService.appUrl;
-    if (!origin) {
+    var appUrl = envService.appUrl;
+    if (!appUrl) {
         return;
     }
-    nestApp.enableCors({
-        origin: origin,
-        methods: [
-            'GET',
-            'POST',
-            'OPTIONS'
-        ]
-    });
+    // OidcModuleConfig may be absent (module not registered / out of the resolution scope).
+    var cors;
+    try {
+        var _nestApp_get;
+        cors = (_nestApp_get = nestApp.get(OidcModuleConfig, {
+            strict: false
+        })) === null || _nestApp_get === void 0 ? void 0 : _nestApp_get.cors;
+    } catch (unused) {
+        cors = undefined;
+    }
+    if (cors) {
+        nestApp.enableCors({
+            origin: oidcCorsOriginDelegate(appUrl, cors),
+            methods: [
+                'GET',
+                'POST',
+                'OPTIONS'
+            ]
+        });
+    } else {
+        // No cors config → byte-identical to the legacy behavior: ACAO=appUrl unconditionally.
+        nestApp.enableCors({
+            origin: appUrl,
+            methods: [
+                'GET',
+                'POST',
+                'OPTIONS'
+            ]
+        });
+    }
 }
 
 /**
@@ -7571,4 +7681,4 @@ function _unsupported_iterable_to_array(o, minLen) {
     return fn;
 }
 
-export { DEFAULT_APP_OAUTH_CONSENT_PATH_PART, DEFAULT_APP_OAUTH_INTERACTION_PATH, DEFAULT_APP_OAUTH_LOGIN_PATH_PART, DEFAULT_MAX_ADMIN_LOGIN_DURATION_SECONDS, DEFAULT_MAX_NONADMIN_LOGIN_DURATION_SECONDS, DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_MAX_SERVICE_TOKEN_LOGIN_DURATION_SECONDS, DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_OIDC_ANALYTICS_EVENT_NAMES, DEFAULT_OIDC_ANALYTICS_EVENT_NAME_PREFIX, DEFAULT_OIDC_CODE_CHALLENGE_METHODS, DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES, DEFAULT_OIDC_ISSUER_PATH, DEFAULT_OIDC_ROUTES, DEFAULT_OIDC_SUBJECT_TYPES, DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, DEFAULT_OIDC_TOKEN_LIFETIMES, DEFAULT_ROTATED_KEY_MAX_AGE, FIREBASE_SERVER_OIDC_ANALYTICS_CONFIG, FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, FirebaseServerOidcAnalyticsService, GRANTABLE_MODEL_NAMES, JwksFirestoreCollections, JwksKeyDocument, JwksService, JwksServiceConfig, JwksServiceStorageConfig, OIDC_ANALYTICS_SERVICE, OIDC_ENCRYPTED_PAYLOAD_FIELDS, OIDC_JSON_RENDER_ERROR_FUNCTION, OIDC_JWKS_ENCRYPTION_SECRET_ENV_KEY, OidcAccountService, OidcAccountServiceDelegate, OidcAccountServiceUserContext, OidcAnalyticsService, OidcAuth, OidcAuthBearerTokenMiddleware, OidcAuthMiddlewareConfig, OidcClientService, OidcEncryptionService, OidcInteractionController, OidcInteractionService, OidcModelServerActions, OidcModuleConfig, OidcProviderConfigService, OidcProviderController, OidcServerFirestoreCollections, OidcService, OidcWellKnownController, activeJwksKeysQuery, allOidcScopesStringForProviderConfig, appOidcAnalyticsModuleMetadata, appOidcModelModuleMetadata, applyOidcAuthMiddleware, applyOidcCorsMiddleware, buildBearerChallenge, buildFirebaseServerMcpResourceServer, createAdapterFactory, createOidcClientFactory, deleteOidcClientFactory, deleteOidcTokenFactory, deriveResourceMetadataUrlFromEnv, emitOidcAnalyticsEvent, getOidcScopesFromRequest, jwksKeyCollectionReference, jwksKeyConverter, jwksKeyFirestoreCollection, jwksKeyIdentity, jwksKeysWithStatusQuery, nonRetiredJwksKeysQuery, noopOidcAnalyticsService, oidcCallModelScopePreAssert, oidcFirestoreCollectionsFactory, oidcModelServerActions, oidcModelServerActionsFactory, oidcModuleConfigFactory, oidcModuleMetadata, resolveEffectiveSubset, rotateOidcClientSecretFactory, rotatedJwksKeysQuery, updateOidcClientFactory };
+export { DEFAULT_APP_OAUTH_CONSENT_PATH_PART, DEFAULT_APP_OAUTH_INTERACTION_PATH, DEFAULT_APP_OAUTH_LOGIN_PATH_PART, DEFAULT_MAX_ADMIN_LOGIN_DURATION_SECONDS, DEFAULT_MAX_NONADMIN_LOGIN_DURATION_SECONDS, DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_MAX_SERVICE_TOKEN_LOGIN_DURATION_SECONDS, DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_OIDC_ANALYTICS_EVENT_NAMES, DEFAULT_OIDC_ANALYTICS_EVENT_NAME_PREFIX, DEFAULT_OIDC_CODE_CHALLENGE_METHODS, DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES, DEFAULT_OIDC_ISSUER_PATH, DEFAULT_OIDC_ROUTES, DEFAULT_OIDC_SUBJECT_TYPES, DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, DEFAULT_OIDC_TOKEN_LIFETIMES, DEFAULT_ROTATED_KEY_MAX_AGE, FIREBASE_SERVER_OIDC_ANALYTICS_CONFIG, FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, FirebaseServerOidcAnalyticsService, GRANTABLE_MODEL_NAMES, JwksFirestoreCollections, JwksKeyDocument, JwksService, JwksServiceConfig, JwksServiceStorageConfig, OIDC_ANALYTICS_SERVICE, OIDC_ENCRYPTED_PAYLOAD_FIELDS, OIDC_JSON_RENDER_ERROR_FUNCTION, OIDC_JWKS_ENCRYPTION_SECRET_ENV_KEY, OidcAccountService, OidcAccountServiceDelegate, OidcAccountServiceUserContext, OidcAnalyticsService, OidcAuth, OidcAuthBearerTokenMiddleware, OidcAuthMiddlewareConfig, OidcClientService, OidcEncryptionService, OidcInteractionController, OidcInteractionService, OidcModelServerActions, OidcModuleConfig, OidcProviderConfigService, OidcProviderController, OidcServerFirestoreCollections, OidcService, OidcWellKnownController, activeJwksKeysQuery, allOidcScopesStringForProviderConfig, appOidcAnalyticsModuleMetadata, appOidcModelModuleMetadata, applyOidcAuthMiddleware, applyOidcCorsMiddleware, buildBearerChallenge, buildFirebaseServerMcpResourceServer, createAdapterFactory, createOidcClientFactory, deleteOidcClientFactory, deleteOidcTokenFactory, deriveResourceMetadataUrlFromEnv, emitOidcAnalyticsEvent, getOidcScopesFromRequest, jwksKeyCollectionReference, jwksKeyConverter, jwksKeyFirestoreCollection, jwksKeyIdentity, jwksKeysWithStatusQuery, nonRetiredJwksKeysQuery, noopOidcAnalyticsService, oidcCallModelScopePreAssert, oidcCorsOriginDelegate, oidcFirestoreCollectionsFactory, oidcModelServerActions, oidcModelServerActionsFactory, oidcModuleConfigFactory, oidcModuleMetadata, resolveEffectiveSubset, rotateOidcClientSecretFactory, rotatedJwksKeysQuery, updateOidcClientFactory };

package/oidc/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/oidc",
-  "version": "13.27.1",
+  "version": "13.28.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.27.1",
-    "@dereekb/date": "13.27.1",
-    "@dereekb/firebase": "13.27.1",
-    "@dereekb/firebase-server": "13.27.1",
-    "@dereekb/model": "13.27.1",
-    "@dereekb/nestjs": "13.27.1",
-    "@dereekb/rxjs": "13.27.1",
-    "@dereekb/util": "13.27.1",
-    "@dereekb/zoho": "13.27.1",
+    "@dereekb/analytics": "13.28.0",
+    "@dereekb/date": "13.28.0",
+    "@dereekb/firebase": "13.28.0",
+    "@dereekb/firebase-server": "13.28.0",
+    "@dereekb/model": "13.28.0",
+    "@dereekb/nestjs": "13.28.0",
+    "@dereekb/rxjs": "13.28.0",
+    "@dereekb/util": "13.28.0",
+    "@dereekb/zoho": "13.28.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "express": "^5.2.1",

package/oidc/src/lib/middleware/oauth-cors.module.d.ts

@@ -1,6 +1,33 @@
 import { type INestApplication } from '@nestjs/common';
+import { type Maybe } from '@dereekb/util';
+import { type OidcCorsConfig } from '../oidc.config';
 /**
- * Enables CORS on the NestJS app for OIDC cross-origin requests originating from the frontend.
+ * Signature of the `origin` callback the `cors` package (used by NestJS
+ * `enableCors`) invokes per request. Returning a string sets that exact
+ * `Access-Control-Allow-Origin`; returning `false` omits the header entirely.
+ */
+export type OidcCorsOriginDelegate = (requestOrigin: Maybe<string>, callback: (err: Maybe<Error>, origin?: string | boolean) => void) => void;
+/**
+ * Builds the `cors`-package origin delegate implementing the composed OIDC CORS policy.
+ *
+ * - An allowlisted origin (`appUrl` or any {@link OidcCorsConfig.allowOrigins} entry) is
+ *   reflected exactly, which pre-empts oidc-provider's own CORS handling.
+ * - Otherwise, when {@link OidcCorsConfig.clientBased} is enabled, the header is OMITTED so
+ *   oidc-provider runs its `clientBasedCORS` check on client routes (`/token`) and its builtin
+ *   reflect on client-less routes (discovery/JWKS).
+ * - Otherwise (client-based off), `appUrl` is returned unconditionally so oidc-provider stays
+ *   pre-empted and there is never a reflect-any.
+ *
+ * Exported for unit testing without a running Nest application.
+ *
+ * @param appUrl - The authoritative frontend origin (always allowed).
+ * @param cors - The unified CORS configuration.
+ * @returns A `cors`-package origin delegate.
+ */
+export declare function oidcCorsOriginDelegate(appUrl: string, cors: OidcCorsConfig): OidcCorsOriginDelegate;
+/**
+ * Enables CORS on the NestJS app for OIDC cross-origin requests originating from the frontend
+ * and any additional relying-party origins.
  *
  * When the OIDC issuer lives on a different origin than the frontend app (e.g. the frontend is
  * `https://app.example.com` and the OIDC server is at `https://api.example.com`), the frontend's
@@ -8,16 +35,22 @@ import { type INestApplication } from '@nestjs/common';
  * and `/interaction/{uid}/consent`. Because the POST body is `application/json`, the browser
  * sends a CORS preflight. Without an `Access-Control-Allow-Origin` reply the preflight fails,
  * the POST never reaches the server, and the OAuth flow stalls before `finishInteractionByUid`
- * can run.
+ * can run. Browser-based OIDC relying parties (public PKCE clients) likewise need CORS on the
+ * discovery GET and the token POST.
+ *
+ * `appUrl` (from `FirebaseServerEnvService.appUrl`) is always allowed. Additional behavior is
+ * driven by the optional {@link OidcModuleConfig.cors} configuration:
+ * - {@link OidcCorsConfig.allowOrigins} adds an explicit allowlist of relying-party origins.
+ * - {@link OidcCorsConfig.clientBased} defers non-allowlisted origins to oidc-provider's
+ *   `clientBasedCORS`, which trusts each requesting client's registered `redirect_uris`.
  *
- * Origin is sourced from `FirebaseServerEnvService.appUrl`, which is the authoritative frontend
- * origin per environment. Single-origin deployments (e.g. local dev where the frontend and the
- * OIDC server share `http://localhost:9010`) still benefit: their cross-origin requests are
- * actually same-origin and CORS is a no-op.
+ * When `cors` is unset, this preserves the legacy single-origin behavior exactly:
+ * `Access-Control-Allow-Origin: <appUrl>` on every response, which pre-empts oidc-provider's
+ * own CORS handling.
  *
  * Credentials are intentionally NOT enabled (`Access-Control-Allow-Credentials` stays off). The
- * `/interaction/{uid}/*` POSTs carry the Firebase ID token in the JSON body, not in cookies, so
- * we keep the CORS surface minimal.
+ * `/interaction/{uid}/*` POSTs and the token exchange carry their bearer material in the request
+ * body, not in cookies, so we keep the CORS surface minimal.
  *
  * @param nestApp - The NestJS application to configure.
  *

package/oidc/src/lib/oidc.config.d.ts

@@ -184,6 +184,44 @@ export declare const DEFAULT_MAX_SERVICE_TOKEN_LOGIN_DURATION_SECONDS: number;
  * Default token lifetimes: 15 min access tokens, 30-day refresh tokens, 30-day sessions/grants, 60 s auth codes.
  */
 export declare const DEFAULT_OIDC_TOKEN_LIFETIMES: OidcTokenLifetimes;
+/**
+ * Unified CORS configuration for the cross-origin browser OIDC endpoints (the
+ * discovery GET and the token POST). Supports two independent, composable modes;
+ * both, either, or neither may be used.
+ *
+ * When the whole {@link OidcModuleConfig.cors} object is unset, the Express-level
+ * {@link applyOidcCorsMiddleware} preserves the pre-existing behavior: it emits
+ * `Access-Control-Allow-Origin: <appUrl>` unconditionally on every response, which
+ * pre-empts oidc-provider's own CORS handling.
+ */
+export interface OidcCorsConfig {
+    /**
+     * Explicit allowlist of additional browser origins (beyond `appUrl`, which is
+     * ALWAYS allowed) permitted to make cross-origin requests to the OIDC endpoints.
+     *
+     * Each entry must be a bare origin (scheme + host + optional port, no path or
+     * trailing slash), e.g. `'https://lms.app.example.com'`. When a request's `Origin`
+     * matches, the Express CORS layer reflects that exact origin
+     * (`Access-Control-Allow-Origin: <origin>`), pre-empting oidc-provider's own CORS.
+     */
+    readonly allowOrigins?: readonly string[];
+    /**
+     * When `true`, enables oidc-provider's `clientBasedCORS` on client-assigned routes
+     * (notably `POST /token`). For a request whose `Origin` is NOT in the explicit
+     * {@link allowOrigins} list, the Express layer OMITS `Access-Control-Allow-Origin`
+     * so oidc-provider runs its per-client check: the request is allowed iff the `Origin`
+     * matches the origin of one of the requesting client's registered `redirect_uris`.
+     * Discovery and JWKS (no client context) fall back to oidc-provider's builtin
+     * reflect (public metadata).
+     *
+     * When `false`/unset, non-allowlisted origins receive `Access-Control-Allow-Origin:
+     * <appUrl>` from the Express layer (pre-empting oidc-provider), so there is no
+     * reflect-any.
+     *
+     * Defaults to `false`.
+     */
+    readonly clientBased?: boolean;
+}
 /**
  * Configuration for the OIDC module.
  *
@@ -411,6 +449,15 @@ export declare abstract class OidcModuleConfig {
      * Defaults to `false`.
      */
     readonly trustProxyInNonProduction?: boolean;
+    /**
+     * Unified CORS configuration for the cross-origin browser OIDC endpoints
+     * (discovery GET, token POST). When unset, the Express CORS layer preserves the
+     * pre-existing behavior: `Access-Control-Allow-Origin: <appUrl>` on every
+     * response, which pre-empts oidc-provider's own CORS handling.
+     *
+     * @see OidcCorsConfig
+     */
+    readonly cors?: OidcCorsConfig;
     /**
      * Validates that all required fields are present on the config.
      *

package/oidc/src/lib/oidc.module.d.ts

@@ -138,7 +138,7 @@ export declare function oidcFirestoreCollectionsFactory(firestoreContext: Firest
  * Subset of {@link OidcModuleConfig} that consumers may override via
  * `oidcModuleMetadata`'s `config` or `configFactory`.
  */
-export type OidcModuleMetadataOverrides = Partial<Pick<OidcModuleConfig, 'issuer' | 'suppressBodyParserWarning' | 'renderError' | 'protectedPaths' | 'appOAuthInteractionPath' | 'appOAuthLoginUrlPart' | 'appOAuthConsentUrlPart' | 'tokenEndpointAuthMethods' | 'registrationEnabled' | 'trustProxy' | 'trustProxyInNonProduction' | 'tokenLifetimes' | 'maxRequestedLoginDuration' | 'minRequestedLoginDuration' | 'defaultRequestedLoginDuration' | 'resourceServers' | 'resourceMetadataUrl' | 'configureMcpResourceServer'>>;
+export type OidcModuleMetadataOverrides = Partial<Pick<OidcModuleConfig, 'issuer' | 'suppressBodyParserWarning' | 'renderError' | 'protectedPaths' | 'appOAuthInteractionPath' | 'appOAuthLoginUrlPart' | 'appOAuthConsentUrlPart' | 'tokenEndpointAuthMethods' | 'registrationEnabled' | 'trustProxy' | 'trustProxyInNonProduction' | 'tokenLifetimes' | 'maxRequestedLoginDuration' | 'minRequestedLoginDuration' | 'defaultRequestedLoginDuration' | 'resourceServers' | 'resourceMetadataUrl' | 'configureMcpResourceServer' | 'cors'>>;
 export interface ProvideAppOidcModuleMetadataConfig extends Pick<ModuleMetadata, 'imports' | 'exports' | 'providers'> {
     /**
      * Module that exports the required dependencies for this module.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/firebase-server",
-  "version": "13.27.1",
+  "version": "13.28.0",
   "sideEffects": false,
   "exports": {
     "./test": {
@@ -57,15 +57,15 @@
   "types": "./src/index.d.ts",
   "peerDependencies": {
     "@cantoo/pdf-lib": "^2.6.5",
-    "@dereekb/analytics": "13.27.1",
-    "@dereekb/date": "13.27.1",
-    "@dereekb/dbx-core": "13.27.1",
-    "@dereekb/firebase": "13.27.1",
-    "@dereekb/model": "13.27.1",
-    "@dereekb/nestjs": "13.27.1",
-    "@dereekb/rxjs": "13.27.1",
-    "@dereekb/util": "13.27.1",
-    "@dereekb/zoho": "13.27.1",
+    "@dereekb/analytics": "13.28.0",
+    "@dereekb/date": "13.28.0",
+    "@dereekb/dbx-core": "13.28.0",
+    "@dereekb/firebase": "13.28.0",
+    "@dereekb/model": "13.28.0",
+    "@dereekb/nestjs": "13.28.0",
+    "@dereekb/rxjs": "13.28.0",
+    "@dereekb/util": "13.28.0",
+    "@dereekb/zoho": "13.28.0",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@modelcontextprotocol/sdk": "1.29.0",

package/test/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/test",
-  "version": "13.27.1",
+  "version": "13.28.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.27.1",
-    "@dereekb/date": "13.27.1",
-    "@dereekb/firebase": "13.27.1",
-    "@dereekb/firebase-server": "13.27.1",
-    "@dereekb/firebase-server/oidc": "13.27.1",
-    "@dereekb/model": "13.27.1",
-    "@dereekb/nestjs": "13.27.1",
-    "@dereekb/rxjs": "13.27.1",
-    "@dereekb/util": "13.27.1",
+    "@dereekb/analytics": "13.28.0",
+    "@dereekb/date": "13.28.0",
+    "@dereekb/firebase": "13.28.0",
+    "@dereekb/firebase-server": "13.28.0",
+    "@dereekb/firebase-server/oidc": "13.28.0",
+    "@dereekb/model": "13.28.0",
+    "@dereekb/nestjs": "13.28.0",
+    "@dereekb/rxjs": "13.28.0",
+    "@dereekb/util": "13.28.0",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@nestjs/common": "^11.1.19",
@@ -23,7 +23,7 @@
     "supertest": "^7.2.2"
   },
   "devDependencies": {
-    "@dereekb/nestjs": "13.27.1"
+    "@dereekb/nestjs": "13.28.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/twilio/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@dereekb/firebase-server/twilio",
-  "version": "13.27.1",
+  "version": "13.28.0",
   "peerDependencies": {
-    "@dereekb/date": "13.27.1",
-    "@dereekb/firebase": "13.27.1",
-    "@dereekb/firebase-server": "13.27.1",
-    "@dereekb/model": "13.27.1",
-    "@dereekb/nestjs": "13.27.1",
-    "@dereekb/rxjs": "13.27.1",
-    "@dereekb/util": "13.27.1"
+    "@dereekb/date": "13.28.0",
+    "@dereekb/firebase": "13.28.0",
+    "@dereekb/firebase-server": "13.28.0",
+    "@dereekb/model": "13.28.0",
+    "@dereekb/nestjs": "13.28.0",
+    "@dereekb/rxjs": "13.28.0",
+    "@dereekb/util": "13.28.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/zoho/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/zoho",
-  "version": "13.27.1",
+  "version": "13.28.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.27.1",
-    "@dereekb/date": "13.27.1",
-    "@dereekb/model": "13.27.1",
-    "@dereekb/nestjs": "13.27.1",
-    "@dereekb/rxjs": "13.27.1",
-    "@dereekb/firebase": "13.27.1",
-    "@dereekb/util": "13.27.1",
-    "@dereekb/zoho": "13.27.1"
+    "@dereekb/analytics": "13.28.0",
+    "@dereekb/date": "13.28.0",
+    "@dereekb/model": "13.28.0",
+    "@dereekb/nestjs": "13.28.0",
+    "@dereekb/rxjs": "13.28.0",
+    "@dereekb/firebase": "13.28.0",
+    "@dereekb/util": "13.28.0",
+    "@dereekb/zoho": "13.28.0"
   },
   "exports": {
     "./package.json": "./package.json",