@dereekb/firebase-server 13.27.1 → 13.29.0

package/oidc/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/oidc",
-  "version": "13.27.1",
+  "version": "13.29.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.27.1",
-    "@dereekb/date": "13.27.1",
-    "@dereekb/firebase": "13.27.1",
-    "@dereekb/firebase-server": "13.27.1",
-    "@dereekb/model": "13.27.1",
-    "@dereekb/nestjs": "13.27.1",
-    "@dereekb/rxjs": "13.27.1",
-    "@dereekb/util": "13.27.1",
-    "@dereekb/zoho": "13.27.1",
+    "@dereekb/analytics": "13.29.0",
+    "@dereekb/date": "13.29.0",
+    "@dereekb/firebase": "13.29.0",
+    "@dereekb/firebase-server": "13.29.0",
+    "@dereekb/model": "13.29.0",
+    "@dereekb/nestjs": "13.29.0",
+    "@dereekb/rxjs": "13.29.0",
+    "@dereekb/util": "13.29.0",
+    "@dereekb/zoho": "13.29.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "express": "^5.2.1",

package/oidc/src/lib/index.d.ts

@@ -3,5 +3,6 @@ export * from './model';
 export * from './oidc.config';
 export * from './controller';
 export * from './oidc.module';
+export * from './profile';
 export * from './scope';
 export * from './service';

package/oidc/src/lib/middleware/oauth-cors.module.d.ts

@@ -1,6 +1,33 @@
 import { type INestApplication } from '@nestjs/common';
+import { type Maybe } from '@dereekb/util';
+import { type OidcCorsConfig } from '../oidc.config';
 /**
- * Enables CORS on the NestJS app for OIDC cross-origin requests originating from the frontend.
+ * Signature of the `origin` callback the `cors` package (used by NestJS
+ * `enableCors`) invokes per request. Returning a string sets that exact
+ * `Access-Control-Allow-Origin`; returning `false` omits the header entirely.
+ */
+export type OidcCorsOriginDelegate = (requestOrigin: Maybe<string>, callback: (err: Maybe<Error>, origin?: string | boolean) => void) => void;
+/**
+ * Builds the `cors`-package origin delegate implementing the composed OIDC CORS policy.
+ *
+ * - An allowlisted origin (`appUrl` or any {@link OidcCorsConfig.allowOrigins} entry) is
+ *   reflected exactly, which pre-empts oidc-provider's own CORS handling.
+ * - Otherwise, when {@link OidcCorsConfig.clientBased} is enabled, the header is OMITTED so
+ *   oidc-provider runs its `clientBasedCORS` check on client routes (`/token`) and its builtin
+ *   reflect on client-less routes (discovery/JWKS).
+ * - Otherwise (client-based off), `appUrl` is returned unconditionally so oidc-provider stays
+ *   pre-empted and there is never a reflect-any.
+ *
+ * Exported for unit testing without a running Nest application.
+ *
+ * @param appUrl - The authoritative frontend origin (always allowed).
+ * @param cors - The unified CORS configuration.
+ * @returns A `cors`-package origin delegate.
+ */
+export declare function oidcCorsOriginDelegate(appUrl: string, cors: OidcCorsConfig): OidcCorsOriginDelegate;
+/**
+ * Enables CORS on the NestJS app for OIDC cross-origin requests originating from the frontend
+ * and any additional relying-party origins.
  *
  * When the OIDC issuer lives on a different origin than the frontend app (e.g. the frontend is
  * `https://app.example.com` and the OIDC server is at `https://api.example.com`), the frontend's
@@ -8,16 +35,22 @@ import { type INestApplication } from '@nestjs/common';
  * and `/interaction/{uid}/consent`. Because the POST body is `application/json`, the browser
  * sends a CORS preflight. Without an `Access-Control-Allow-Origin` reply the preflight fails,
  * the POST never reaches the server, and the OAuth flow stalls before `finishInteractionByUid`
- * can run.
+ * can run. Browser-based OIDC relying parties (public PKCE clients) likewise need CORS on the
+ * discovery GET and the token POST.
+ *
+ * `appUrl` (from `FirebaseServerEnvService.appUrl`) is always allowed. Additional behavior is
+ * driven by the optional {@link OidcModuleConfig.cors} configuration:
+ * - {@link OidcCorsConfig.allowOrigins} adds an explicit allowlist of relying-party origins.
+ * - {@link OidcCorsConfig.clientBased} defers non-allowlisted origins to oidc-provider's
+ *   `clientBasedCORS`, which trusts each requesting client's registered `redirect_uris`.
  *
- * Origin is sourced from `FirebaseServerEnvService.appUrl`, which is the authoritative frontend
- * origin per environment. Single-origin deployments (e.g. local dev where the frontend and the
- * OIDC server share `http://localhost:9010`) still benefit: their cross-origin requests are
- * actually same-origin and CORS is a no-op.
+ * When `cors` is unset, this preserves the legacy single-origin behavior exactly:
+ * `Access-Control-Allow-Origin: <appUrl>` on every response, which pre-empts oidc-provider's
+ * own CORS handling.
  *
  * Credentials are intentionally NOT enabled (`Access-Control-Allow-Credentials` stays off). The
- * `/interaction/{uid}/*` POSTs carry the Firebase ID token in the JSON body, not in cookies, so
- * we keep the CORS surface minimal.
+ * `/interaction/{uid}/*` POSTs and the token exchange carry their bearer material in the request
+ * body, not in cookies, so we keep the CORS surface minimal.
  *
  * @param nestApp - The NestJS application to configure.
  *

package/oidc/src/lib/oidc.config.d.ts

@@ -1,6 +1,6 @@
 import type { Configuration } from 'oidc-provider';
 import { type WebsitePath, type SlashPath, type Seconds } from '@dereekb/util';
-import { type OidcScope, type OidcTokenEndpointAuthMethod } from '@dereekb/firebase';
+import { type OidcProviderProfile, type OidcScope, type OidcTokenEndpointAuthMethod } from '@dereekb/firebase';
 import { type JwksServiceConfig } from './service/oidc.jwks.service';
 import { type JwksKeyConverterConfig } from './model';
 /**
@@ -104,6 +104,19 @@ export interface OidcProviderConfig<S extends OidcScope = OidcScope> {
      * All other grants keep oidc-provider's default rotation behavior.
      */
     readonly nonRotatingScopes?: readonly string[];
+    /**
+     * Named provider profiles that unlock (and optionally force-require) scopes for the OIDC clients
+     * they are assigned to. Any scope referenced by a profile is treated as restricted: a client may
+     * only obtain it when one of its assigned profiles (persisted as `dbx_provider_profiles` client
+     * metadata) unlocks it. A profile scope marked `require: 'required'` is force-required — surfaced
+     * as a required scope at consent and hard-rejected if not granted.
+     *
+     * Keeps the generic package app-agnostic: apps declare their profiles statically and list them
+     * here, rather than the package hard-coding any profile or scope name. This gate is independent of
+     * {@link adminOnlyScopes} (which gates by the resolving user's admin status); a scope may be
+     * subject to both.
+     */
+    readonly providerProfiles?: readonly OidcProviderProfile<S>[];
 }
 /**
  * Returns the space-delimited list of every scope declared on `providerConfig.claims`.
@@ -184,6 +197,44 @@ export declare const DEFAULT_MAX_SERVICE_TOKEN_LOGIN_DURATION_SECONDS: number;
  * Default token lifetimes: 15 min access tokens, 30-day refresh tokens, 30-day sessions/grants, 60 s auth codes.
  */
 export declare const DEFAULT_OIDC_TOKEN_LIFETIMES: OidcTokenLifetimes;
+/**
+ * Unified CORS configuration for the cross-origin browser OIDC endpoints (the
+ * discovery GET and the token POST). Supports two independent, composable modes;
+ * both, either, or neither may be used.
+ *
+ * When the whole {@link OidcModuleConfig.cors} object is unset, the Express-level
+ * {@link applyOidcCorsMiddleware} preserves the pre-existing behavior: it emits
+ * `Access-Control-Allow-Origin: <appUrl>` unconditionally on every response, which
+ * pre-empts oidc-provider's own CORS handling.
+ */
+export interface OidcCorsConfig {
+    /**
+     * Explicit allowlist of additional browser origins (beyond `appUrl`, which is
+     * ALWAYS allowed) permitted to make cross-origin requests to the OIDC endpoints.
+     *
+     * Each entry must be a bare origin (scheme + host + optional port, no path or
+     * trailing slash), e.g. `'https://lms.app.example.com'`. When a request's `Origin`
+     * matches, the Express CORS layer reflects that exact origin
+     * (`Access-Control-Allow-Origin: <origin>`), pre-empting oidc-provider's own CORS.
+     */
+    readonly allowOrigins?: readonly string[];
+    /**
+     * When `true`, enables oidc-provider's `clientBasedCORS` on client-assigned routes
+     * (notably `POST /token`). For a request whose `Origin` is NOT in the explicit
+     * {@link allowOrigins} list, the Express layer OMITS `Access-Control-Allow-Origin`
+     * so oidc-provider runs its per-client check: the request is allowed iff the `Origin`
+     * matches the origin of one of the requesting client's registered `redirect_uris`.
+     * Discovery and JWKS (no client context) fall back to oidc-provider's builtin
+     * reflect (public metadata).
+     *
+     * When `false`/unset, non-allowlisted origins receive `Access-Control-Allow-Origin:
+     * <appUrl>` from the Express layer (pre-empting oidc-provider), so there is no
+     * reflect-any.
+     *
+     * Defaults to `false`.
+     */
+    readonly clientBased?: boolean;
+}
 /**
  * Configuration for the OIDC module.
  *
@@ -411,6 +462,15 @@ export declare abstract class OidcModuleConfig {
      * Defaults to `false`.
      */
     readonly trustProxyInNonProduction?: boolean;
+    /**
+     * Unified CORS configuration for the cross-origin browser OIDC endpoints
+     * (discovery GET, token POST). When unset, the Express CORS layer preserves the
+     * pre-existing behavior: `Access-Control-Allow-Origin: <appUrl>` on every
+     * response, which pre-empts oidc-provider's own CORS handling.
+     *
+     * @see OidcCorsConfig
+     */
+    readonly cors?: OidcCorsConfig;
     /**
      * Validates that all required fields are present on the config.
      *

package/oidc/src/lib/oidc.module.d.ts

@@ -138,7 +138,7 @@ export declare function oidcFirestoreCollectionsFactory(firestoreContext: Firest
  * Subset of {@link OidcModuleConfig} that consumers may override via
  * `oidcModuleMetadata`'s `config` or `configFactory`.
  */
-export type OidcModuleMetadataOverrides = Partial<Pick<OidcModuleConfig, 'issuer' | 'suppressBodyParserWarning' | 'renderError' | 'protectedPaths' | 'appOAuthInteractionPath' | 'appOAuthLoginUrlPart' | 'appOAuthConsentUrlPart' | 'tokenEndpointAuthMethods' | 'registrationEnabled' | 'trustProxy' | 'trustProxyInNonProduction' | 'tokenLifetimes' | 'maxRequestedLoginDuration' | 'minRequestedLoginDuration' | 'defaultRequestedLoginDuration' | 'resourceServers' | 'resourceMetadataUrl' | 'configureMcpResourceServer'>>;
+export type OidcModuleMetadataOverrides = Partial<Pick<OidcModuleConfig, 'issuer' | 'suppressBodyParserWarning' | 'renderError' | 'protectedPaths' | 'appOAuthInteractionPath' | 'appOAuthLoginUrlPart' | 'appOAuthConsentUrlPart' | 'tokenEndpointAuthMethods' | 'registrationEnabled' | 'trustProxy' | 'trustProxyInNonProduction' | 'tokenLifetimes' | 'maxRequestedLoginDuration' | 'minRequestedLoginDuration' | 'defaultRequestedLoginDuration' | 'resourceServers' | 'resourceMetadataUrl' | 'configureMcpResourceServer' | 'cors'>>;
 export interface ProvideAppOidcModuleMetadataConfig extends Pick<ModuleMetadata, 'imports' | 'exports' | 'providers'> {
     /**
      * Module that exports the required dependencies for this module.

package/oidc/src/lib/profile.d.ts

@@ -0,0 +1,29 @@
+import { type OidcProviderProfile, type OidcScope, type OidcProviderProfileKey } from '@dereekb/firebase';
+/**
+ * Custom oidc-provider client metadata field holding the {@link OidcProviderProfile} keys assigned
+ * to a client. Registered via `extraClientMetadata` and persisted on the client's `OidcEntry` payload.
+ */
+export declare const DBX_FIREBASE_SERVER_OIDC_PROVIDER_PROFILES_CLIENT_METADATA = "dbx_provider_profiles";
+/**
+ * The scopes a client with the given assigned profile keys is allowed/required to obtain, resolved
+ * against the provider-profile registry.
+ */
+export interface OidcClientProviderProfileScopes<S extends OidcScope = OidcScope> {
+    /**
+     * Scopes unlocked for the client (the union of its assigned profiles' scopes).
+     */
+    readonly unlocked: Set<S>;
+    /**
+     * Scopes the client's profiles force-require (`require: 'required'`).
+     */
+    readonly required: Set<S>;
+}
+/**
+ * Resolves the unlocked + required scope sets for a client from the provider-profile registry and
+ * the profile keys assigned to that client.
+ *
+ * @param providerProfiles - The provider-profile registry (from {@link OidcProviderConfig.providerProfiles}).
+ * @param clientProfileKeys - The profile keys assigned to the client (its `dbx_provider_profiles`).
+ * @returns The unlocked and required scope sets for the client.
+ */
+export declare function oidcClientProviderProfileScopes<S extends OidcScope = OidcScope>(providerProfiles: readonly OidcProviderProfile<S>[] | undefined, clientProfileKeys: readonly OidcProviderProfileKey[] | undefined): OidcClientProviderProfileScopes<S>;

package/oidc/src/lib/scope.d.ts

@@ -2,15 +2,20 @@ import { type OnCallTypedModelParams } from '@dereekb/firebase';
 import { type AssertModelCrudRequestFunction } from '@dereekb/firebase-server';
 /**
  * Builds a {@link AssertModelCrudRequestFunction} that rejects callModel requests
- * lacking the OIDC scope mapped from the call type.
+ * lacking the required OIDC scope(s) for the call.
+ *
+ * Enforcement is additive: an OIDC caller must hold BOTH the per-verb scope mapped
+ * from the call type (`model.<call>`) AND any per-function scope a handler declared
+ * via `withApiDetails({ requiredScope })` — surfaced on `context.requiredScope`.
  *
  * Bypasses the check (no-op) when the request is not OIDC-authenticated — i.e.
  * when {@link getOidcScopesFromRequest} returns `undefined` because there is no
  * `auth.token.scope` claim on the request. Regular Firebase ID-token callers are
  * unaffected and continue to be gated by auth roles.
  *
- * Bypasses the check for custom (non-CRUD) call types so app-specific verbs
- * remain unrestricted unless an app wires its own assertion.
+ * Bypasses the check for custom (non-CRUD) call types that declare no per-function
+ * scope, so app-specific verbs remain unrestricted unless an app wires its own
+ * assertion or declares a `requiredScope`.
  *
  * Wire as the `preAssert` of {@link onCallModel}.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/firebase-server",
-  "version": "13.27.1",
+  "version": "13.29.0",
   "sideEffects": false,
   "exports": {
     "./test": {
@@ -57,15 +57,15 @@
   "types": "./src/index.d.ts",
   "peerDependencies": {
     "@cantoo/pdf-lib": "^2.6.5",
-    "@dereekb/analytics": "13.27.1",
-    "@dereekb/date": "13.27.1",
-    "@dereekb/dbx-core": "13.27.1",
-    "@dereekb/firebase": "13.27.1",
-    "@dereekb/model": "13.27.1",
-    "@dereekb/nestjs": "13.27.1",
-    "@dereekb/rxjs": "13.27.1",
-    "@dereekb/util": "13.27.1",
-    "@dereekb/zoho": "13.27.1",
+    "@dereekb/analytics": "13.29.0",
+    "@dereekb/date": "13.29.0",
+    "@dereekb/dbx-core": "13.29.0",
+    "@dereekb/firebase": "13.29.0",
+    "@dereekb/model": "13.29.0",
+    "@dereekb/nestjs": "13.29.0",
+    "@dereekb/rxjs": "13.29.0",
+    "@dereekb/util": "13.29.0",
+    "@dereekb/zoho": "13.29.0",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@modelcontextprotocol/sdk": "1.29.0",

package/src/lib/nest/model/api.details.d.ts

@@ -1,5 +1,5 @@
 import { type AuthRole, type Maybe, type PromiseOrValue } from '@dereekb/util';
-import { type OnCallFunctionType, type OnCallTypedModelParams, type FirestoreModelType, type ModelFirebaseCrudFunctionSpecifier } from '@dereekb/firebase';
+import { type OnCallFunctionType, type OnCallTypedModelParams, type FirestoreModelType, type ModelFirebaseCrudFunctionSpecifier, type OidcScope } from '@dereekb/firebase';
 import { type FirebaseServerAuthData } from '../controller/auth.context.server';
 import { type OnCallModelFunctionAnalyticsDetails } from './analytics.details';
 /**
@@ -302,6 +302,16 @@ export interface OnCallModelFunctionApiDetails<R = unknown, M = unknown> {
      * When provided, the dispatch chain will call lifecycle hooks around handler execution.
      */
     readonly analytics?: OnCallModelFunctionAnalyticsDetails;
+    /**
+     * Optional per-function OIDC scope an OIDC-authenticated caller must additionally hold to
+     * invoke this handler, on top of the per-verb `model.<call>` scope.
+     *
+     * Composes additively with the CRUD-verb scope enforced by `oidcCallModelScopePreAssert`: an
+     * OIDC caller still needs `model.<call>` AND this scope. Non-OIDC callers (Firebase ID tokens)
+     * bypass scope enforcement entirely and are unaffected. Also folded into the MCP tool-list
+     * visibility filter, so a tool the caller lacks this scope for is neither listed nor callable.
+     */
+    readonly requiredScope?: OidcScope;
 }
 /**
  * Ref interface for objects (functions) that carry handler-level _apiDetails.
@@ -564,6 +574,20 @@ export declare function getModelApiDetails(callModelFn: Maybe<OnCallApiDetailsRe
  * @returns The analytics details for the resolved handler, or undefined.
  */
 export declare function resolveAnalyticsFromApiDetails(apiDetails: OnCallModelApiDetails, call: OnCallFunctionType, modelType: FirestoreModelType, specifier?: ModelFirebaseCrudFunctionSpecifier): Maybe<OnCallModelFunctionAnalyticsDetails>;
+/**
+ * Resolves the leaf-level per-function required OIDC scope from the aggregated _apiDetails tree.
+ *
+ * Walks: call -> modelType -> specifier (if specifier-level), then reads the `requiredScope`
+ * field from the handler-level {@link OnCallModelFunctionApiDetails}. Mirrors
+ * {@link resolveAnalyticsFromApiDetails}.
+ *
+ * @param apiDetails - The top-level aggregated API details.
+ * @param call - The CRUD operation type to look up.
+ * @param modelType - The Firestore model type to look up.
+ * @param specifier - Optional specifier key for variant handlers.
+ * @returns The per-function required scope for the resolved handler, or undefined.
+ */
+export declare function resolveRequiredScopeFromApiDetails(apiDetails: OnCallModelApiDetails, call: OnCallFunctionType, modelType: FirestoreModelType, specifier?: ModelFirebaseCrudFunctionSpecifier): Maybe<OidcScope>;
 /**
  * @deprecated Use {@link OnCallModelTypeApiDetails} instead.
  */

package/src/lib/nest/model/crud.assert.function.d.ts

@@ -1,6 +1,6 @@
 import { type Maybe } from '@dereekb/util';
 import { type NestContextCallableRequest } from '../function/nest';
-import { type OnCallFunctionType, type FirestoreModelType } from '@dereekb/firebase';
+import { type OnCallFunctionType, type FirestoreModelType, type OidcScope } from '@dereekb/firebase';
 /**
  * Discriminator for the category of CRUD operation being asserted.
  *
@@ -34,6 +34,14 @@ export interface AssertModelCrudRequestFunctionContext<N, I = unknown> {
      * The optional sub-operation specifier (e.g., 'username', 'fromUpload').
      */
     readonly specifier: Maybe<string>;
+    /**
+     * The per-function required OIDC scope declared via `withApiDetails({ requiredScope })`, when present.
+     *
+     * Resolved from the handler's `_apiDetails` at dispatch and handed to the pre-assert so
+     * `oidcCallModelScopePreAssert` can require it additively alongside the per-verb `model.<call>`
+     * scope. `undefined` when the handler declares no extra scope.
+     */
+    readonly requiredScope?: Maybe<OidcScope>;
 }
 /**
  * Pre-assertion hook invoked before a model CRUD handler executes.

package/test/index.cjs.js

@@ -4922,18 +4922,24 @@ function _ts_generator$1(thisArg, body) {
 }
 /**
  * Resolves the scopes string from config, or falls back to all registered scopes
- * from the provider config — excluding any `adminOnlyScopes`.
+ * from the provider config — excluding any `adminOnlyScopes` or provider-profile-gated scopes.
  *
  * Admin-only scopes (e.g. `token.service`) are dropped from the default "all scopes" request because
  * the provider hard-rejects them for non-admin users, and this default flow logs in an arbitrary
  * (often non-admin) user. Tests that need an admin-only scope pass it explicitly via `config.scopes`.
  *
+ * Provider-profile-gated scopes (e.g. `lms`, `reports`) are dropped for the same reason: they are
+ * unlocked only for a client an admin has assigned the corresponding profile to, and this flow creates
+ * a fresh client with no profiles — so the consent unlock gate hard-rejects them (finishing the
+ * interaction with `access_denied` and no `code`). Tests that need a gated scope create a client with
+ * the profile and pass the scope explicitly via `config.scopes`.
+ *
  * @param nestApp - Initialized NestJS application used to resolve {@link OidcAccountService} when no scopes override is given.
  * @param config - Optional flow config; when `config.scopes` is set, it is returned verbatim.
  * @returns The space-separated scope string to pass to the `/oidc/auth` endpoint.
  */ function resolveScopes(nestApp, config) {
     return _async_to_generator$1(function() {
-        var result, _providerConfig_adminOnlyScopes, accountService, providerConfig, adminOnlyScopes;
+        var result, _providerConfig_adminOnlyScopes, _providerConfig_providerProfiles, accountService, providerConfig, adminOnlyScopes, profileGatedScopes;
         return _ts_generator$1(this, function(_state) {
             if (config === null || config === void 0 ? void 0 : config.scopes) {
                 result = config.scopes;
@@ -4941,8 +4947,9 @@ function _ts_generator$1(thisArg, body) {
                 accountService = nestApp.get(oidc.OidcAccountService);
                 providerConfig = accountService.providerConfig;
                 adminOnlyScopes = new Set((_providerConfig_adminOnlyScopes = providerConfig.adminOnlyScopes) !== null && _providerConfig_adminOnlyScopes !== void 0 ? _providerConfig_adminOnlyScopes : []);
+                profileGatedScopes = firebase.scopesForOidcProviderProfiles((_providerConfig_providerProfiles = providerConfig.providerProfiles) !== null && _providerConfig_providerProfiles !== void 0 ? _providerConfig_providerProfiles : []);
                 result = Object.keys(providerConfig.claims).filter(function(scope) {
-                    return !adminOnlyScopes.has(scope);
+                    return !adminOnlyScopes.has(scope) && !profileGatedScopes.has(scope);
                 }).join(' ');
             }
             return [

package/test/index.esm.js

@@ -1,7 +1,7 @@
 import { randomEmailFactory, randomPhoneNumberFactory, mapGetter, incrementingNumberFactory, asGetter, getValueFromGetter, cachedGetter, asArray, mapObjectMap, unixDateTimeSecondsNumberForNow } from '@dereekb/util';
 import { useTestContextFixture, AbstractChildTestContextFixture, testContextBuilder, AbstractTestContextFixture, useTestFunctionFixture, useTestFunctionMapFixture, ExpectedErrorOfSpecificTypeError } from '@dereekb/util/test';
 import { decode } from 'jsonwebtoken';
-import { flatFirestoreModelKey, twoWayFlatFirestoreModelKey, firestoreContextFactory, firebaseStorageContextFactory } from '@dereekb/firebase';
+import { flatFirestoreModelKey, twoWayFlatFirestoreModelKey, firestoreContextFactory, firebaseStorageContextFactory, scopesForOidcProviderProfiles } from '@dereekb/firebase';
 import admin from 'firebase-admin';
 import functions from 'firebase-functions-test';
 import { makeTestingFirestoreDrivers, TestFirestoreInstance, TestFirestoreContextFixture, makeTestingFirebaseStorageDrivers, TestFirebaseStorageInstance, TestFirebaseStorageContextFixture, mockItemFirestoreCollection, testWithMockItemCollectionFixture, testWithMockItemStorageFixture } from '@dereekb/firebase/test';
@@ -4921,18 +4921,24 @@ function _ts_generator$1(thisArg, body) {
 }
 /**
  * Resolves the scopes string from config, or falls back to all registered scopes
- * from the provider config — excluding any `adminOnlyScopes`.
+ * from the provider config — excluding any `adminOnlyScopes` or provider-profile-gated scopes.
  *
  * Admin-only scopes (e.g. `token.service`) are dropped from the default "all scopes" request because
  * the provider hard-rejects them for non-admin users, and this default flow logs in an arbitrary
  * (often non-admin) user. Tests that need an admin-only scope pass it explicitly via `config.scopes`.
  *
+ * Provider-profile-gated scopes (e.g. `lms`, `reports`) are dropped for the same reason: they are
+ * unlocked only for a client an admin has assigned the corresponding profile to, and this flow creates
+ * a fresh client with no profiles — so the consent unlock gate hard-rejects them (finishing the
+ * interaction with `access_denied` and no `code`). Tests that need a gated scope create a client with
+ * the profile and pass the scope explicitly via `config.scopes`.
+ *
  * @param nestApp - Initialized NestJS application used to resolve {@link OidcAccountService} when no scopes override is given.
  * @param config - Optional flow config; when `config.scopes` is set, it is returned verbatim.
  * @returns The space-separated scope string to pass to the `/oidc/auth` endpoint.
  */ function resolveScopes(nestApp, config) {
     return _async_to_generator$1(function() {
-        var result, _providerConfig_adminOnlyScopes, accountService, providerConfig, adminOnlyScopes;
+        var result, _providerConfig_adminOnlyScopes, _providerConfig_providerProfiles, accountService, providerConfig, adminOnlyScopes, profileGatedScopes;
         return _ts_generator$1(this, function(_state) {
             if (config === null || config === void 0 ? void 0 : config.scopes) {
                 result = config.scopes;
@@ -4940,8 +4946,9 @@ function _ts_generator$1(thisArg, body) {
                 accountService = nestApp.get(OidcAccountService);
                 providerConfig = accountService.providerConfig;
                 adminOnlyScopes = new Set((_providerConfig_adminOnlyScopes = providerConfig.adminOnlyScopes) !== null && _providerConfig_adminOnlyScopes !== void 0 ? _providerConfig_adminOnlyScopes : []);
+                profileGatedScopes = scopesForOidcProviderProfiles((_providerConfig_providerProfiles = providerConfig.providerProfiles) !== null && _providerConfig_providerProfiles !== void 0 ? _providerConfig_providerProfiles : []);
                 result = Object.keys(providerConfig.claims).filter(function(scope) {
-                    return !adminOnlyScopes.has(scope);
+                    return !adminOnlyScopes.has(scope) && !profileGatedScopes.has(scope);
                 }).join(' ');
             }
             return [

package/test/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/test",
-  "version": "13.27.1",
+  "version": "13.29.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.27.1",
-    "@dereekb/date": "13.27.1",
-    "@dereekb/firebase": "13.27.1",
-    "@dereekb/firebase-server": "13.27.1",
-    "@dereekb/firebase-server/oidc": "13.27.1",
-    "@dereekb/model": "13.27.1",
-    "@dereekb/nestjs": "13.27.1",
-    "@dereekb/rxjs": "13.27.1",
-    "@dereekb/util": "13.27.1",
+    "@dereekb/analytics": "13.29.0",
+    "@dereekb/date": "13.29.0",
+    "@dereekb/firebase": "13.29.0",
+    "@dereekb/firebase-server": "13.29.0",
+    "@dereekb/firebase-server/oidc": "13.29.0",
+    "@dereekb/model": "13.29.0",
+    "@dereekb/nestjs": "13.29.0",
+    "@dereekb/rxjs": "13.29.0",
+    "@dereekb/util": "13.29.0",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@nestjs/common": "^11.1.19",
@@ -23,7 +23,7 @@
     "supertest": "^7.2.2"
   },
   "devDependencies": {
-    "@dereekb/nestjs": "13.27.1"
+    "@dereekb/nestjs": "13.29.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/test/src/lib/oidc/oidc.test.flow.d.ts

@@ -1,5 +1,5 @@
 import { type INestApplication } from '@nestjs/common';
-import type { OidcTokenEndpointAuthMethod } from '@dereekb/firebase';
+import { type OidcTokenEndpointAuthMethod } from '@dereekb/firebase';
 import { OidcClientService } from '@dereekb/firebase-server/oidc';
 /**
  * Configuration for {@link performFullOAuthFlow}.

package/twilio/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@dereekb/firebase-server/twilio",
-  "version": "13.27.1",
+  "version": "13.29.0",
   "peerDependencies": {
-    "@dereekb/date": "13.27.1",
-    "@dereekb/firebase": "13.27.1",
-    "@dereekb/firebase-server": "13.27.1",
-    "@dereekb/model": "13.27.1",
-    "@dereekb/nestjs": "13.27.1",
-    "@dereekb/rxjs": "13.27.1",
-    "@dereekb/util": "13.27.1"
+    "@dereekb/date": "13.29.0",
+    "@dereekb/firebase": "13.29.0",
+    "@dereekb/firebase-server": "13.29.0",
+    "@dereekb/model": "13.29.0",
+    "@dereekb/nestjs": "13.29.0",
+    "@dereekb/rxjs": "13.29.0",
+    "@dereekb/util": "13.29.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/zoho/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/zoho",
-  "version": "13.27.1",
+  "version": "13.29.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.27.1",
-    "@dereekb/date": "13.27.1",
-    "@dereekb/model": "13.27.1",
-    "@dereekb/nestjs": "13.27.1",
-    "@dereekb/rxjs": "13.27.1",
-    "@dereekb/firebase": "13.27.1",
-    "@dereekb/util": "13.27.1",
-    "@dereekb/zoho": "13.27.1"
+    "@dereekb/analytics": "13.29.0",
+    "@dereekb/date": "13.29.0",
+    "@dereekb/model": "13.29.0",
+    "@dereekb/nestjs": "13.29.0",
+    "@dereekb/rxjs": "13.29.0",
+    "@dereekb/firebase": "13.29.0",
+    "@dereekb/util": "13.29.0",
+    "@dereekb/zoho": "13.29.0"
   },
   "exports": {
     "./package.json": "./package.json",