@dereekb/firebase-server 13.27.1 → 13.29.0

package/index.cjs.js

@@ -5486,6 +5486,31 @@ function resolveAnalyticsFromApiDetails(apiDetails, call, modelType, specifier)
     }
     return result;
 }
+// MARK: Required Scope Resolution
+/**
+ * Resolves the leaf-level per-function required OIDC scope from the aggregated _apiDetails tree.
+ *
+ * Walks: call -> modelType -> specifier (if specifier-level), then reads the `requiredScope`
+ * field from the handler-level {@link OnCallModelFunctionApiDetails}. Mirrors
+ * {@link resolveAnalyticsFromApiDetails}.
+ *
+ * @param apiDetails - The top-level aggregated API details.
+ * @param call - The CRUD operation type to look up.
+ * @param modelType - The Firestore model type to look up.
+ * @param specifier - Optional specifier key for variant handlers.
+ * @returns The per-function required scope for the resolved handler, or undefined.
+ */ // eslint-disable-next-line @typescript-eslint/max-params
+function resolveRequiredScopeFromApiDetails(apiDetails, call, modelType, specifier) {
+    var _apiDetails_call;
+    var modelDetails = (_apiDetails_call = apiDetails[call]) === null || _apiDetails_call === void 0 ? void 0 : _apiDetails_call.modelTypes[modelType];
+    var result;
+    if (modelDetails) {
+        var _modelDetails_specifiers_key;
+        var key = specifier !== null && specifier !== void 0 ? specifier : '_';
+        result = (_modelDetails_specifiers_key = modelDetails.specifiers[key]) === null || _modelDetails_specifiers_key === void 0 ? void 0 : _modelDetails_specifiers_key.requiredScope;
+    }
+    return result;
+}
 /**
  * @deprecated Use {@link isOnCallModelTypeApiDetails} instead.
  */ var isOnCallSpecifierApiDetails = isOnCallModelTypeApiDetails;
@@ -5774,7 +5799,12 @@ function _object_spread_props$c(target, source) {
             data: request.data.data,
             request: request
         };
-        preAssert(context);
+        // Resolve the leaf handler's per-function requiredScope (if any) so the preAssert can enforce
+        // it additively with the per-verb OIDC scope. Same call -> modelType -> specifier walk as analytics.
+        var requiredScope = resolveRequiredScopeFromApiDetails(modelApiDetails, call, modelType, specifier);
+        preAssert(_object_spread_props$c(_object_spread$h({}, context), {
+            requiredScope: requiredScope
+        }));
         var result;
         // Resolve analytics from _apiDetails tree — callWithAnalytics handles undefined details
         var analyticsService = getAnalyticsService(request);
@@ -13282,6 +13312,7 @@ exports.readApiDetails = readApiDetails;
 exports.readModelUnknownModelTypeError = readModelUnknownModelTypeError;
 exports.resolveAdminOnlyValue = resolveAdminOnlyValue;
 exports.resolveAnalyticsFromApiDetails = resolveAnalyticsFromApiDetails;
+exports.resolveRequiredScopeFromApiDetails = resolveRequiredScopeFromApiDetails;
 exports.setNestContextOnRequest = setNestContextOnRequest;
 exports.setNestContextOnScheduleRequest = setNestContextOnScheduleRequest;
 exports.taskQueueFunctionHandlerWithNestContextFactory = taskQueueFunctionHandlerWithNestContextFactory;

package/index.esm.js

@@ -5484,6 +5484,31 @@ function resolveAnalyticsFromApiDetails(apiDetails, call, modelType, specifier)
     }
     return result;
 }
+// MARK: Required Scope Resolution
+/**
+ * Resolves the leaf-level per-function required OIDC scope from the aggregated _apiDetails tree.
+ *
+ * Walks: call -> modelType -> specifier (if specifier-level), then reads the `requiredScope`
+ * field from the handler-level {@link OnCallModelFunctionApiDetails}. Mirrors
+ * {@link resolveAnalyticsFromApiDetails}.
+ *
+ * @param apiDetails - The top-level aggregated API details.
+ * @param call - The CRUD operation type to look up.
+ * @param modelType - The Firestore model type to look up.
+ * @param specifier - Optional specifier key for variant handlers.
+ * @returns The per-function required scope for the resolved handler, or undefined.
+ */ // eslint-disable-next-line @typescript-eslint/max-params
+function resolveRequiredScopeFromApiDetails(apiDetails, call, modelType, specifier) {
+    var _apiDetails_call;
+    var modelDetails = (_apiDetails_call = apiDetails[call]) === null || _apiDetails_call === void 0 ? void 0 : _apiDetails_call.modelTypes[modelType];
+    var result;
+    if (modelDetails) {
+        var _modelDetails_specifiers_key;
+        var key = specifier !== null && specifier !== void 0 ? specifier : '_';
+        result = (_modelDetails_specifiers_key = modelDetails.specifiers[key]) === null || _modelDetails_specifiers_key === void 0 ? void 0 : _modelDetails_specifiers_key.requiredScope;
+    }
+    return result;
+}
 /**
  * @deprecated Use {@link isOnCallModelTypeApiDetails} instead.
  */ var isOnCallSpecifierApiDetails = isOnCallModelTypeApiDetails;
@@ -5772,7 +5797,12 @@ function _object_spread_props$c(target, source) {
             data: request.data.data,
             request: request
         };
-        preAssert(context);
+        // Resolve the leaf handler's per-function requiredScope (if any) so the preAssert can enforce
+        // it additively with the per-verb OIDC scope. Same call -> modelType -> specifier walk as analytics.
+        var requiredScope = resolveRequiredScopeFromApiDetails(modelApiDetails, call, modelType, specifier);
+        preAssert(_object_spread_props$c(_object_spread$h({}, context), {
+            requiredScope: requiredScope
+        }));
         var result;
         // Resolve analytics from _apiDetails tree — callWithAnalytics handles undefined details
         var analyticsService = getAnalyticsService(request);
@@ -13086,4 +13116,4 @@ function _define_property(obj, key, value) {
 } 
 ();
 
-export { AbstractFirebaseNestContext, AbstractFirebaseServerActionsContext, AbstractFirebaseServerAuthContext, AbstractFirebaseServerAuthService, AbstractFirebaseServerAuthUserContext, AbstractFirebaseServerNewUserService, AbstractFirebaseServerUserPasswordResetService, AbstractNestContext, AbstractServerFirebaseNestContext, ConfigureFirebaseAppCheckMiddlewareModule, ConfigureFirebaseWebhookMiddlewareModule, DEFAULT_FIREBASE_PASSWORD_NUMBER_GENERATOR, DEFAULT_RESET_CODE_EXPIRES_IN, DEFAULT_RESET_COM_THROTTLE_TIME, DEFAULT_SERVER_ASSETS_BASE_PATH, DEFAULT_SETUP_COM_THROTTLE_TIME, DefaultFirebaseServerEnvService, FIREBASE_APP_TOKEN, FIREBASE_AUTH_TOKEN, FIREBASE_FIRESTORE_CONTEXT_TOKEN, FIREBASE_FIRESTORE_TOKEN, FIREBASE_SERVER_ENV_TOKEN, FIREBASE_SERVER_VALIDATION_ERROR_CODE, FIREBASE_STORAGE_CONTEXT_FACTORY_CONFIG_TOKEN, FIREBASE_STORAGE_CONTEXT_TOKEN, FIREBASE_STORAGE_TOKEN, FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING, FirebaseAppCheckMiddleware, FirebaseAppCheckMiddlewareConfig, FirebaseNestServerRootModule, FirebaseRawBodyMiddleware, FirebaseServerAnalyticsSegmentListenerService, FirebaseServerAnalyticsSegmentModule, FirebaseServerAnalyticsService, FirebaseServerAnalyticsServiceListener, FirebaseServerAuthModule, FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError, FirebaseServerAuthNewUserSendSetupDetailsSendOnceError, FirebaseServerAuthNewUserSendSetupDetailsThrottleError, FirebaseServerAuthPasswordResetInvalidCodeError, FirebaseServerAuthPasswordResetNoResetConfigError, FirebaseServerAuthPasswordResetSendOnceError, FirebaseServerAuthPasswordResetThrottleError, FirebaseServerAuthService, FirebaseServerAuthUserBadInputError, FirebaseServerAuthUserExistsError, FirebaseServerEnvService, FirebaseServerFirestoreContextModule, FirebaseServerFirestoreModule, FirebaseServerStorageContextModule, FirebaseServerStorageModule, FirebaseServerStorageService, GlobalRoutePrefixConfig, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MODEL_API_NEST_APPLICATION_CONTEXT, ModelApiCallModelDispatchService, ModelApiController, ModelApiDispatchConfig, ModelApiGetService, NO_RUN_NAME_SPECIFIED_FOR_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_CODE, NoContentFirebaseServerUserPasswordResetService, NoSetupContentFirebaseServerNewUserService, ON_CALL_MODEL_ANALYTICS_HANDLER, ON_CALL_MODEL_ANALYTICS_SERVICE, OnCallModelAnalyticsService, PHONE_NUMBER_ALREADY_EXISTS_ERROR_CODE, SkipAppCheck, UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_NAME_CODE, UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_TYPE_CODE, _onCallWithCallTypeFunction, aggregateCrudModelApiDetails, aggregateModelApiDetails, aggregateSpecifierApiDetails, alreadyExistsError, appAnalyticsModuleMetadata, appFirestoreModuleMetadata, assertContextHasAuth, assertDocumentExists, assertHasRolesInRequest, assertHasSignedTosInRequest, assertIsAdminInRequest, assertIsAdminOrTargetUserInRequestData, assertIsContextWithAuthData, assertRequestRequiresAuthForFunction, assertSnapshotData, assertSnapshotDataWithKey, authServicePasswordResetInvalidCodeError, authServicePasswordResetNoConfigError, authServicePasswordResetSendOnceError, authServicePasswordResetThrottleError, badRequestError, blockingFunctionHandlerWithNestContextFactory, buildNestServerRootModule, callWithAnalytics, catchAndThrowPasswordResetServerErrors, cloudEventHandlerWithNestContextFactory, collectionRefForPath, createModelUnknownModelTypeError, decodeFirebaseServerUserPasswordResetOobCode, defaultFirebaseServerActionsTransformFactoryLogErrorFunction, defaultProvideFirebaseServerStorageServiceSimple, deleteModelUnknownModelTypeError, developmentUnknownSpecifierError, docRefForPath, documentModelNotAvailableError, encodeFirebaseServerUserPasswordResetOobCode, executeOnCallQuery, firebaseAuthTokenFromDecodedIdToken, firebaseServerActionsContext, firebaseServerActionsTransformContext, firebaseServerActionsTransformFactory, firebaseServerAppTokenProvider, firebaseServerAuthModuleMetadata, firebaseServerDevFunctions, firebaseServerEnvTokenProvider, firebaseServerEnvTokenProviders, firebaseServerErrorInfo, firebaseServerErrorInfoCodePair, firebaseServerErrorInfoServerErrorCodePair, firebaseServerErrorInfoServerErrorPair, firebaseServerFirestoreContextModuleMetadata, firebaseServerStorageDefaultBucketIdTokenProvider, firebaseServerStorageModuleMetadata, firebaseServerValidationError, firebaseServerValidationServerError, firestoreClientQueryConstraintFunctionsDriver, firestoreEncryptedField, firestoreServerIncrementUpdateToUpdateData, forbiddenError, getAuthUserOrUndefined, getModelApiDetails, googleCloudFileMetadataToStorageMetadata, googleCloudFirebaseStorageContextFactory, googleCloudFirebaseStorageDrivers, googleCloudFirestoreAccessorDriver, googleCloudFirestoreContextFactory, googleCloudFirestoreDrivers, googleCloudFirestoreQueryDriver, googleCloudStorageAccessorFile, googleCloudStorageAccessorFolder, googleCloudStorageBucketForStorageFilePath, googleCloudStorageFileForStorageFilePath, googleCloudStorageFirebaseStorageAccessorDriver, googleCloudStorageFromFirebaseAdminStorage, googleCloudStorageListFilesResultFactory, handleFirebaseAuthError, handleFirebaseError, hasAuthRolesInRequest, hasNewUserSetupPasswordInRequest, hasSignedTosInRequest, inAuthContext, injectNestApplicationContextIntoRequest, injectNestIntoRequest, internalServerError, invokeModelUnknownModelTypeError, isActualSpecifier, isAdminInRequest, isAdminOrTargetUserInRequestData, isContextWithAuthData, isFirebaseError, isFirebaseHttpsError, isOnCallCrudModelApiDetails, isOnCallHandlerApiDetails, isOnCallModelTypeApiDetails, isOnCallSpecifierApiDetails, makeBlockingFunctionWithHandler, makeOnScheduleHandlerWithNestApplicationRequest, makeScheduledFunctionDevelopmentFunction, modelAccessReadErrorFromUseMultipleModelsFailure, modelApiModuleMetadata, modelNotAvailableError, nestAppHasDevelopmentSchedulerEnabled, nestAppIsProductionEnvironment, nestFirebaseDoesNotExistError, nestFirebaseForbiddenPermissionError, nestServerInstance, noRunNameSpecifiedForScheduledFunctionDevelopmentFunction, noopFirebaseServerAnalyticsServiceListener, noopOnCallModelAnalyticsService, notFoundError, onCallAnalyticsEmitterInstance, onCallCreateModel, onCallDeleteModel, onCallDevelopmentFunction, onCallHandlerWithNestApplicationFactory, onCallHandlerWithNestContextFactory, onCallInvokeModel, onCallModel, onCallModelMissingCallTypeError, onCallModelUnknownCallTypeError, onCallQueryModel, onCallReadModel, onCallSpecifierHandler, onCallUpdateModel, onScheduleHandlerWithNestApplicationFactory, onScheduleHandlerWithNestContextFactory, optionalAuthContext, optionalFirestoreEncryptedField, permissionDeniedError, phoneNumberAlreadyExistsError, preconditionConflictError, provideAppFirestoreCollections, provideFirebaseServerAuthService, provideFirebaseServerStorageService, queryModelBadCursorError, queryModelUnknownModelTypeError, readApiDetails, readModelUnknownModelTypeError, resolveAdminOnlyValue, resolveAnalyticsFromApiDetails, setNestContextOnRequest, setNestContextOnScheduleRequest, taskQueueFunctionHandlerWithNestContextFactory, unauthenticatedContextHasNoAuthData, unauthenticatedContextHasNoUidError, unauthenticatedError, unavailableError, unavailableOrDeactivatedFunctionError, unknownModelCrudFunctionSpecifierError, unknownScheduledFunctionDevelopmentFunctionName, unknownScheduledFunctionDevelopmentFunctionType, updateModelUnknownModelTypeError, userContextFromUid, verifyAppCheckInRequest, withApiDetails };
+export { AbstractFirebaseNestContext, AbstractFirebaseServerActionsContext, AbstractFirebaseServerAuthContext, AbstractFirebaseServerAuthService, AbstractFirebaseServerAuthUserContext, AbstractFirebaseServerNewUserService, AbstractFirebaseServerUserPasswordResetService, AbstractNestContext, AbstractServerFirebaseNestContext, ConfigureFirebaseAppCheckMiddlewareModule, ConfigureFirebaseWebhookMiddlewareModule, DEFAULT_FIREBASE_PASSWORD_NUMBER_GENERATOR, DEFAULT_RESET_CODE_EXPIRES_IN, DEFAULT_RESET_COM_THROTTLE_TIME, DEFAULT_SERVER_ASSETS_BASE_PATH, DEFAULT_SETUP_COM_THROTTLE_TIME, DefaultFirebaseServerEnvService, FIREBASE_APP_TOKEN, FIREBASE_AUTH_TOKEN, FIREBASE_FIRESTORE_CONTEXT_TOKEN, FIREBASE_FIRESTORE_TOKEN, FIREBASE_SERVER_ENV_TOKEN, FIREBASE_SERVER_VALIDATION_ERROR_CODE, FIREBASE_STORAGE_CONTEXT_FACTORY_CONFIG_TOKEN, FIREBASE_STORAGE_CONTEXT_TOKEN, FIREBASE_STORAGE_TOKEN, FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING, FirebaseAppCheckMiddleware, FirebaseAppCheckMiddlewareConfig, FirebaseNestServerRootModule, FirebaseRawBodyMiddleware, FirebaseServerAnalyticsSegmentListenerService, FirebaseServerAnalyticsSegmentModule, FirebaseServerAnalyticsService, FirebaseServerAnalyticsServiceListener, FirebaseServerAuthModule, FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError, FirebaseServerAuthNewUserSendSetupDetailsSendOnceError, FirebaseServerAuthNewUserSendSetupDetailsThrottleError, FirebaseServerAuthPasswordResetInvalidCodeError, FirebaseServerAuthPasswordResetNoResetConfigError, FirebaseServerAuthPasswordResetSendOnceError, FirebaseServerAuthPasswordResetThrottleError, FirebaseServerAuthService, FirebaseServerAuthUserBadInputError, FirebaseServerAuthUserExistsError, FirebaseServerEnvService, FirebaseServerFirestoreContextModule, FirebaseServerFirestoreModule, FirebaseServerStorageContextModule, FirebaseServerStorageModule, FirebaseServerStorageService, GlobalRoutePrefixConfig, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MODEL_API_NEST_APPLICATION_CONTEXT, ModelApiCallModelDispatchService, ModelApiController, ModelApiDispatchConfig, ModelApiGetService, NO_RUN_NAME_SPECIFIED_FOR_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_CODE, NoContentFirebaseServerUserPasswordResetService, NoSetupContentFirebaseServerNewUserService, ON_CALL_MODEL_ANALYTICS_HANDLER, ON_CALL_MODEL_ANALYTICS_SERVICE, OnCallModelAnalyticsService, PHONE_NUMBER_ALREADY_EXISTS_ERROR_CODE, SkipAppCheck, UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_NAME_CODE, UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_TYPE_CODE, _onCallWithCallTypeFunction, aggregateCrudModelApiDetails, aggregateModelApiDetails, aggregateSpecifierApiDetails, alreadyExistsError, appAnalyticsModuleMetadata, appFirestoreModuleMetadata, assertContextHasAuth, assertDocumentExists, assertHasRolesInRequest, assertHasSignedTosInRequest, assertIsAdminInRequest, assertIsAdminOrTargetUserInRequestData, assertIsContextWithAuthData, assertRequestRequiresAuthForFunction, assertSnapshotData, assertSnapshotDataWithKey, authServicePasswordResetInvalidCodeError, authServicePasswordResetNoConfigError, authServicePasswordResetSendOnceError, authServicePasswordResetThrottleError, badRequestError, blockingFunctionHandlerWithNestContextFactory, buildNestServerRootModule, callWithAnalytics, catchAndThrowPasswordResetServerErrors, cloudEventHandlerWithNestContextFactory, collectionRefForPath, createModelUnknownModelTypeError, decodeFirebaseServerUserPasswordResetOobCode, defaultFirebaseServerActionsTransformFactoryLogErrorFunction, defaultProvideFirebaseServerStorageServiceSimple, deleteModelUnknownModelTypeError, developmentUnknownSpecifierError, docRefForPath, documentModelNotAvailableError, encodeFirebaseServerUserPasswordResetOobCode, executeOnCallQuery, firebaseAuthTokenFromDecodedIdToken, firebaseServerActionsContext, firebaseServerActionsTransformContext, firebaseServerActionsTransformFactory, firebaseServerAppTokenProvider, firebaseServerAuthModuleMetadata, firebaseServerDevFunctions, firebaseServerEnvTokenProvider, firebaseServerEnvTokenProviders, firebaseServerErrorInfo, firebaseServerErrorInfoCodePair, firebaseServerErrorInfoServerErrorCodePair, firebaseServerErrorInfoServerErrorPair, firebaseServerFirestoreContextModuleMetadata, firebaseServerStorageDefaultBucketIdTokenProvider, firebaseServerStorageModuleMetadata, firebaseServerValidationError, firebaseServerValidationServerError, firestoreClientQueryConstraintFunctionsDriver, firestoreEncryptedField, firestoreServerIncrementUpdateToUpdateData, forbiddenError, getAuthUserOrUndefined, getModelApiDetails, googleCloudFileMetadataToStorageMetadata, googleCloudFirebaseStorageContextFactory, googleCloudFirebaseStorageDrivers, googleCloudFirestoreAccessorDriver, googleCloudFirestoreContextFactory, googleCloudFirestoreDrivers, googleCloudFirestoreQueryDriver, googleCloudStorageAccessorFile, googleCloudStorageAccessorFolder, googleCloudStorageBucketForStorageFilePath, googleCloudStorageFileForStorageFilePath, googleCloudStorageFirebaseStorageAccessorDriver, googleCloudStorageFromFirebaseAdminStorage, googleCloudStorageListFilesResultFactory, handleFirebaseAuthError, handleFirebaseError, hasAuthRolesInRequest, hasNewUserSetupPasswordInRequest, hasSignedTosInRequest, inAuthContext, injectNestApplicationContextIntoRequest, injectNestIntoRequest, internalServerError, invokeModelUnknownModelTypeError, isActualSpecifier, isAdminInRequest, isAdminOrTargetUserInRequestData, isContextWithAuthData, isFirebaseError, isFirebaseHttpsError, isOnCallCrudModelApiDetails, isOnCallHandlerApiDetails, isOnCallModelTypeApiDetails, isOnCallSpecifierApiDetails, makeBlockingFunctionWithHandler, makeOnScheduleHandlerWithNestApplicationRequest, makeScheduledFunctionDevelopmentFunction, modelAccessReadErrorFromUseMultipleModelsFailure, modelApiModuleMetadata, modelNotAvailableError, nestAppHasDevelopmentSchedulerEnabled, nestAppIsProductionEnvironment, nestFirebaseDoesNotExistError, nestFirebaseForbiddenPermissionError, nestServerInstance, noRunNameSpecifiedForScheduledFunctionDevelopmentFunction, noopFirebaseServerAnalyticsServiceListener, noopOnCallModelAnalyticsService, notFoundError, onCallAnalyticsEmitterInstance, onCallCreateModel, onCallDeleteModel, onCallDevelopmentFunction, onCallHandlerWithNestApplicationFactory, onCallHandlerWithNestContextFactory, onCallInvokeModel, onCallModel, onCallModelMissingCallTypeError, onCallModelUnknownCallTypeError, onCallQueryModel, onCallReadModel, onCallSpecifierHandler, onCallUpdateModel, onScheduleHandlerWithNestApplicationFactory, onScheduleHandlerWithNestContextFactory, optionalAuthContext, optionalFirestoreEncryptedField, permissionDeniedError, phoneNumberAlreadyExistsError, preconditionConflictError, provideAppFirestoreCollections, provideFirebaseServerAuthService, provideFirebaseServerStorageService, queryModelBadCursorError, queryModelUnknownModelTypeError, readApiDetails, readModelUnknownModelTypeError, resolveAdminOnlyValue, resolveAnalyticsFromApiDetails, resolveRequiredScopeFromApiDetails, setNestContextOnRequest, setNestContextOnScheduleRequest, taskQueueFunctionHandlerWithNestContextFactory, unauthenticatedContextHasNoAuthData, unauthenticatedContextHasNoUidError, unauthenticatedError, unavailableError, unavailableOrDeactivatedFunctionError, unknownModelCrudFunctionSpecifierError, unknownScheduledFunctionDevelopmentFunctionName, unknownScheduledFunctionDevelopmentFunctionType, updateModelUnknownModelTypeError, userContextFromUid, verifyAppCheckInRequest, withApiDetails };

package/mailgun/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/mailgun",
-  "version": "13.27.1",
+  "version": "13.29.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.27.1",
-    "@dereekb/firebase": "13.27.1",
-    "@dereekb/firebase-server": "13.27.1",
-    "@dereekb/date": "13.27.1",
-    "@dereekb/nestjs": "13.27.1",
-    "@dereekb/model": "13.27.1",
-    "@dereekb/rxjs": "13.27.1",
-    "@dereekb/util": "13.27.1"
+    "@dereekb/analytics": "13.29.0",
+    "@dereekb/firebase": "13.29.0",
+    "@dereekb/firebase-server": "13.29.0",
+    "@dereekb/date": "13.29.0",
+    "@dereekb/nestjs": "13.29.0",
+    "@dereekb/model": "13.29.0",
+    "@dereekb/rxjs": "13.29.0",
+    "@dereekb/util": "13.29.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/mcp/index.cjs.js

@@ -1580,7 +1580,7 @@ function _unsupported_iterable_to_array$9(o, minLen) {
  *
  * @param context - The candidate plus the shared generation accumulators.
  */ function buildToolFromCandidate(context) {
-    var _clashCounts_get, _ref, _resolveRequiredScope;
+    var _clashCounts_get, _ref;
     var _handlerDetails_mcp, _handlerDetails_mcp1;
     var candidate = context.candidate, clashCounts = context.clashCounts, options = context.options, manifest = context.manifest, seenNames = context.seenNames, outTools = context.outTools, outNeverVisibleTools = context.outNeverVisibleTools, outSkipped = context.outSkipped, outWarnings = context.outWarnings;
     var modelType = candidate.modelType, callType = candidate.callType, handlerDetails = candidate.handlerDetails, specifier = candidate.specifier, dispatch = candidate.dispatch, modelSegment = candidate.modelSegment, overrideName = candidate.overrideName, baseName = candidate.baseName, classified = candidate.classified, isVisible = candidate.isVisible;
@@ -1632,7 +1632,13 @@ function _unsupported_iterable_to_array$9(o, minLen) {
             });
         }
     }
-    var requiredScope = (_resolveRequiredScope = resolveRequiredScope(callType)) !== null && _resolveRequiredScope !== void 0 ? _resolveRequiredScope : undefined;
+    // Additive scope set: the per-verb call-type scope (model.<call>) plus any per-function scope
+    // declared via withApiDetails({ requiredScope }). Nullish entries drop out, so a non-CRUD call
+    // type with no per-function scope yields an empty set (no scope gate).
+    var requiredScopes = util.filterMaybeArrayValues([
+        resolveRequiredScope(callType),
+        handlerDetails.requiredScope
+    ]);
     var effectiveReadOnly = resolveEffectiveReadOnly((_handlerDetails_mcp = handlerDetails.mcp) === null || _handlerDetails_mcp === void 0 ? void 0 : _handlerDetails_mcp.readOnly, callType);
     var annotations = resolveMcpToolAnnotations(effectiveReadOnly);
     var description = applyWriteMarker(baseDescription, annotations);
@@ -1641,20 +1647,20 @@ function _unsupported_iterable_to_array$9(o, minLen) {
         filterMetadata = {
             visibilityKind: 'declarative',
             rule: classified.rule,
-            requiredScope: requiredScope,
+            requiredScopes: requiredScopes,
             effectiveReadOnly: effectiveReadOnly
         };
     } else if (classified.visibilityKind === 'dynamic') {
         filterMetadata = {
             visibilityKind: 'dynamic',
             visibilityFn: classified.visibilityFn,
-            requiredScope: requiredScope,
+            requiredScopes: requiredScopes,
             effectiveReadOnly: effectiveReadOnly
         };
     } else {
         filterMetadata = {
             visibilityKind: classified.visibilityKind,
-            requiredScope: requiredScope,
+            requiredScopes: requiredScopes,
             effectiveReadOnly: effectiveReadOnly
         };
     }
@@ -6670,7 +6676,9 @@ var McpServerFactoryService_1;
                     for(var _iterator = tools[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
                         var tool = _step.value;
                         var filterMetadata = tool.filterMetadata;
-                        if (scopes != null && filterMetadata.requiredScope != null && !scopes.has(filterMetadata.requiredScope)) {
+                        if (scopes != null && filterMetadata.requiredScopes != null && !filterMetadata.requiredScopes.every(function(scope) {
+                            return scopes.has(scope);
+                        })) {
                             continue;
                         }
                         if (readOnlyMode && filterMetadata.effectiveReadOnly !== true) {

package/mcp/index.esm.js

@@ -3,7 +3,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { getOidcScopesFromRequest, OidcProviderConfigService } from '@dereekb/firebase-server/oidc';
-import { makeValuesGroupMap, IMPERSONATION_URL_QUERY_PARAM, performAsyncTasks, authRolesSetHasRoles } from '@dereekb/util';
+import { filterMaybeArrayValues, makeValuesGroupMap, IMPERSONATION_URL_QUERY_PARAM, performAsyncTasks, authRolesSetHasRoles } from '@dereekb/util';
 import { ModelApiCallModelDispatchService, ModelApiGetService, FirebaseServerStorageService, FirebaseServerEnvService, FirebaseServerAnalyticsService } from '@dereekb/firebase-server';
 import { inspect } from 'node:util';
 import { arktypeToJsonSchemaForExport } from '@dereekb/model';
@@ -1578,7 +1578,7 @@ function _unsupported_iterable_to_array$9(o, minLen) {
  *
  * @param context - The candidate plus the shared generation accumulators.
  */ function buildToolFromCandidate(context) {
-    var _clashCounts_get, _ref, _resolveRequiredScope;
+    var _clashCounts_get, _ref;
     var _handlerDetails_mcp, _handlerDetails_mcp1;
     var candidate = context.candidate, clashCounts = context.clashCounts, options = context.options, manifest = context.manifest, seenNames = context.seenNames, outTools = context.outTools, outNeverVisibleTools = context.outNeverVisibleTools, outSkipped = context.outSkipped, outWarnings = context.outWarnings;
     var modelType = candidate.modelType, callType = candidate.callType, handlerDetails = candidate.handlerDetails, specifier = candidate.specifier, dispatch = candidate.dispatch, modelSegment = candidate.modelSegment, overrideName = candidate.overrideName, baseName = candidate.baseName, classified = candidate.classified, isVisible = candidate.isVisible;
@@ -1630,7 +1630,13 @@ function _unsupported_iterable_to_array$9(o, minLen) {
             });
         }
     }
-    var requiredScope = (_resolveRequiredScope = resolveRequiredScope(callType)) !== null && _resolveRequiredScope !== void 0 ? _resolveRequiredScope : undefined;
+    // Additive scope set: the per-verb call-type scope (model.<call>) plus any per-function scope
+    // declared via withApiDetails({ requiredScope }). Nullish entries drop out, so a non-CRUD call
+    // type with no per-function scope yields an empty set (no scope gate).
+    var requiredScopes = filterMaybeArrayValues([
+        resolveRequiredScope(callType),
+        handlerDetails.requiredScope
+    ]);
     var effectiveReadOnly = resolveEffectiveReadOnly((_handlerDetails_mcp = handlerDetails.mcp) === null || _handlerDetails_mcp === void 0 ? void 0 : _handlerDetails_mcp.readOnly, callType);
     var annotations = resolveMcpToolAnnotations(effectiveReadOnly);
     var description = applyWriteMarker(baseDescription, annotations);
@@ -1639,20 +1645,20 @@ function _unsupported_iterable_to_array$9(o, minLen) {
         filterMetadata = {
             visibilityKind: 'declarative',
             rule: classified.rule,
-            requiredScope: requiredScope,
+            requiredScopes: requiredScopes,
             effectiveReadOnly: effectiveReadOnly
         };
     } else if (classified.visibilityKind === 'dynamic') {
         filterMetadata = {
             visibilityKind: 'dynamic',
             visibilityFn: classified.visibilityFn,
-            requiredScope: requiredScope,
+            requiredScopes: requiredScopes,
             effectiveReadOnly: effectiveReadOnly
         };
     } else {
         filterMetadata = {
             visibilityKind: classified.visibilityKind,
-            requiredScope: requiredScope,
+            requiredScopes: requiredScopes,
             effectiveReadOnly: effectiveReadOnly
         };
     }
@@ -6668,7 +6674,9 @@ var McpServerFactoryService_1;
                     for(var _iterator = tools[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
                         var tool = _step.value;
                         var filterMetadata = tool.filterMetadata;
-                        if (scopes != null && filterMetadata.requiredScope != null && !scopes.has(filterMetadata.requiredScope)) {
+                        if (scopes != null && filterMetadata.requiredScopes != null && !filterMetadata.requiredScopes.every(function(scope) {
+                            return scopes.has(scope);
+                        })) {
                             continue;
                         }
                         if (readOnlyMode && filterMetadata.effectiveReadOnly !== true) {

package/mcp/package.json

@@ -1,17 +1,17 @@
 {
   "name": "@dereekb/firebase-server/mcp",
-  "version": "13.27.1",
+  "version": "13.29.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.27.1",
-    "@dereekb/date": "13.27.1",
-    "@dereekb/firebase": "13.27.1",
-    "@dereekb/firebase-server": "13.27.1",
-    "@dereekb/firebase-server/oidc": "13.27.1",
-    "@dereekb/model": "13.27.1",
-    "@dereekb/nestjs": "13.27.1",
-    "@dereekb/rxjs": "13.27.1",
-    "@dereekb/util": "13.27.1",
-    "@dereekb/zoho": "13.27.1",
+    "@dereekb/analytics": "13.29.0",
+    "@dereekb/date": "13.29.0",
+    "@dereekb/firebase": "13.29.0",
+    "@dereekb/firebase-server": "13.29.0",
+    "@dereekb/firebase-server/oidc": "13.29.0",
+    "@dereekb/model": "13.29.0",
+    "@dereekb/nestjs": "13.29.0",
+    "@dereekb/rxjs": "13.29.0",
+    "@dereekb/util": "13.29.0",
+    "@dereekb/zoho": "13.29.0",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/core": "^11.1.19",

package/mcp/src/lib/service/mcp.visibility.d.ts

@@ -1,5 +1,5 @@
 import { type Maybe } from '@dereekb/util';
-import { type CallModelOidcScope } from '@dereekb/firebase';
+import { type CallModelOidcScope, type OidcScope } from '@dereekb/firebase';
 import { type McpToolVisibility, type McpVisibilityContext, type McpVisibilityRule } from '@dereekb/firebase-server';
 import { type ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';
 /**
@@ -41,10 +41,12 @@ export interface ClassifiedMcpToolVisibilityDynamic {
 export type McpToolFilterMetadata = McpToolFilterMetadataAlways | McpToolFilterMetadataNever | McpToolFilterMetadataDeclarative | McpToolFilterMetadataDynamic;
 interface McpToolFilterMetadataBase {
     /**
-     * OIDC scope required to invoke this tool. Precomputed from the dispatch call type.
-     * `undefined` for non-CRUD call types (apps gate those via their own preAssert if needed).
+     * OIDC scopes required to invoke this tool (AND-semantics — the caller must hold every entry).
+     * Precomputed from the dispatch call type's per-verb scope (`model.<call>`) plus any per-function
+     * scope declared via `withApiDetails({ requiredScope })`. Empty when no scope is enforced (a
+     * non-CRUD call type with no per-function scope); apps gate custom verbs via their own preAssert.
      */
-    readonly requiredScope?: CallModelOidcScope;
+    readonly requiredScopes?: readonly OidcScope[];
     /**
      * Effective read-only classification used by the module-level `readOnly` filter.
      *

package/model/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/model",
-  "version": "13.27.1",
+  "version": "13.29.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.27.1",
-    "@dereekb/date": "13.27.1",
-    "@dereekb/firebase": "13.27.1",
-    "@dereekb/firebase-server": "13.27.1",
-    "@dereekb/model": "13.27.1",
-    "@dereekb/nestjs": "13.27.1",
-    "@dereekb/rxjs": "13.27.1",
-    "@dereekb/util": "13.27.1",
+    "@dereekb/analytics": "13.29.0",
+    "@dereekb/date": "13.29.0",
+    "@dereekb/firebase": "13.29.0",
+    "@dereekb/firebase-server": "13.29.0",
+    "@dereekb/model": "13.29.0",
+    "@dereekb/nestjs": "13.29.0",
+    "@dereekb/rxjs": "13.29.0",
+    "@dereekb/util": "13.29.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "archiver": "^7.0.1",