@dereekb/firebase-server 13.29.0 → 13.31.0

package/mcp/index.esm.js

@@ -2,12 +2,12 @@ import { Injectable, Inject, Optional, Logger, Post, Req, Res, Controller, Get }
 import { existsSync, readFileSync } from 'node:fs';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import { callModelOidcScopeForCallType, resolveEffectiveOidcScopeTerms, inferKeyFromTwoWayFlatFirestoreModelKey, oidcScopeTermsSatisfied } from '@dereekb/firebase';
 import { getOidcScopesFromRequest, OidcProviderConfigService } from '@dereekb/firebase-server/oidc';
-import { filterMaybeArrayValues, makeValuesGroupMap, IMPERSONATION_URL_QUERY_PARAM, performAsyncTasks, authRolesSetHasRoles } from '@dereekb/util';
+import { makeValuesGroupMap, IMPERSONATION_URL_QUERY_PARAM, performAsyncTasks, authRolesSetHasRoles } from '@dereekb/util';
 import { ModelApiCallModelDispatchService, ModelApiGetService, FirebaseServerStorageService, FirebaseServerEnvService, FirebaseServerAnalyticsService } from '@dereekb/firebase-server';
 import { inspect } from 'node:util';
 import { arktypeToJsonSchemaForExport } from '@dereekb/model';
-import { callModelOidcScopeForCallType, inferKeyFromTwoWayFlatFirestoreModelKey } from '@dereekb/firebase';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 
 function _class_call_check$5(instance, Constructor) {
@@ -165,6 +165,22 @@ function _define_property$9(obj, key, value) {
      * fills with a short justification for the call. The value is forwarded to analytics and stripped
      * from the dispatched handler body. See {@link McpReasonParameterConfig}.
      */ _define_property$9(this, "reasonParameter", void 0);
+    /**
+     * Default OIDC scope group term required on EVERY `callModel` op, mirrored into MCP tool-list
+     * visibility, unless a finer term overrides it (a per-function `requiredScope`, then a
+     * {@link McpModuleConfig.modelRequiredScopes} entry). Threaded into the same
+     * `resolveEffectiveOidcScopeTerms` composition the server-side model-api scope gate
+     * (`assertModelApiOidcScope`) uses, so a tool is advertised only when the caller could actually invoke it.
+     *
+     * Set this to the SAME value passed to `ModelApiDispatchConfig.defaultRequiredScope` to
+     * keep tool visibility and enforcement in lockstep.
+     */ _define_property$9(this, "defaultRequiredScope", void 0);
+    /**
+     * Per-model OIDC scope group-term overrides, keyed by {@link FirestoreModelType}, mirrored into MCP
+     * tool-list visibility. Set this to the SAME value passed to
+     * `ModelApiDispatchConfig.modelRequiredScopes` so per-model / verb-keyed restrictions that
+     * confine a subset client apply identically to the advertised tool list.
+     */ _define_property$9(this, "modelRequiredScopes", void 0);
 };
 /**
  * NestJS injection token for the optional {@link McpAuthRoleReader} provider.
@@ -1398,6 +1414,8 @@ function _unsupported_iterable_to_array$9(o, minLen) {
     var seenNames = new Set();
     var manifest = context === null || context === void 0 ? void 0 : context.manifest;
     var naming = context === null || context === void 0 ? void 0 : context.naming;
+    var defaultRequiredScope = context === null || context === void 0 ? void 0 : context.defaultRequiredScope;
+    var modelRequiredScopes = context === null || context === void 0 ? void 0 : context.modelRequiredScopes;
     var candidates = planMcpToolCandidates(apiDetails, naming);
     var clashCounts = countVisibleAutoNameClashes(candidates);
     var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
@@ -1409,6 +1427,8 @@ function _unsupported_iterable_to_array$9(o, minLen) {
                 clashCounts: clashCounts,
                 options: options,
                 manifest: manifest,
+                defaultRequiredScope: defaultRequiredScope,
+                modelRequiredScopes: modelRequiredScopes,
                 seenNames: seenNames,
                 outTools: tools,
                 outNeverVisibleTools: neverVisibleTools,
@@ -1580,7 +1600,7 @@ function _unsupported_iterable_to_array$9(o, minLen) {
  */ function buildToolFromCandidate(context) {
     var _clashCounts_get, _ref;
     var _handlerDetails_mcp, _handlerDetails_mcp1;
-    var candidate = context.candidate, clashCounts = context.clashCounts, options = context.options, manifest = context.manifest, seenNames = context.seenNames, outTools = context.outTools, outNeverVisibleTools = context.outNeverVisibleTools, outSkipped = context.outSkipped, outWarnings = context.outWarnings;
+    var candidate = context.candidate, clashCounts = context.clashCounts, options = context.options, manifest = context.manifest, defaultRequiredScope = context.defaultRequiredScope, modelRequiredScopes = context.modelRequiredScopes, seenNames = context.seenNames, outTools = context.outTools, outNeverVisibleTools = context.outNeverVisibleTools, outSkipped = context.outSkipped, outWarnings = context.outWarnings;
     var modelType = candidate.modelType, callType = candidate.callType, handlerDetails = candidate.handlerDetails, specifier = candidate.specifier, dispatch = candidate.dispatch, modelSegment = candidate.modelSegment, overrideName = candidate.overrideName, baseName = candidate.baseName, classified = candidate.classified, isVisible = candidate.isVisible;
     // A visible auto-named tool whose preferred name is produced by more than one visible tool is
     // re-derived with the abbreviated call type so both survive on the wire. Overrides and hidden tools
@@ -1630,13 +1650,18 @@ function _unsupported_iterable_to_array$9(o, minLen) {
             });
         }
     }
-    // Additive scope set: the per-verb call-type scope (model.<call>) plus any per-function scope
-    // declared via withApiDetails({ requiredScope }). Nullish entries drop out, so a non-CRUD call
-    // type with no per-function scope yields an empty set (no scope gate).
-    var requiredScopes = filterMaybeArrayValues([
-        resolveRequiredScope(callType),
-        handlerDetails.requiredScope
-    ]);
+    // AND-of-ORs scope terms: the per-verb call-type scope (model.<call>) plus the effective group term,
+    // resolved by the same precedence the server model-api scope gate uses (per-function requiredScope > per-model
+    // requirement > module default) via the shared resolveEffectiveOidcScopeTerms — so tool visibility
+    // tracks callability. Empty when no term applies (a non-CRUD call type with no per-function/model/
+    // default term → no scope gate).
+    var requiredScopeTerms = resolveEffectiveOidcScopeTerms({
+        perVerbScope: resolveRequiredScope(callType),
+        requiredScope: handlerDetails.requiredScope,
+        modelRequirement: modelRequiredScopes === null || modelRequiredScopes === void 0 ? void 0 : modelRequiredScopes[modelType],
+        call: callType,
+        defaultRequiredScope: defaultRequiredScope
+    });
     var effectiveReadOnly = resolveEffectiveReadOnly((_handlerDetails_mcp = handlerDetails.mcp) === null || _handlerDetails_mcp === void 0 ? void 0 : _handlerDetails_mcp.readOnly, callType);
     var annotations = resolveMcpToolAnnotations(effectiveReadOnly);
     var description = applyWriteMarker(baseDescription, annotations);
@@ -1645,20 +1670,20 @@ function _unsupported_iterable_to_array$9(o, minLen) {
         filterMetadata = {
             visibilityKind: 'declarative',
             rule: classified.rule,
-            requiredScopes: requiredScopes,
+            requiredScopeTerms: requiredScopeTerms,
             effectiveReadOnly: effectiveReadOnly
         };
     } else if (classified.visibilityKind === 'dynamic') {
         filterMetadata = {
             visibilityKind: 'dynamic',
             visibilityFn: classified.visibilityFn,
-            requiredScopes: requiredScopes,
+            requiredScopeTerms: requiredScopeTerms,
             effectiveReadOnly: effectiveReadOnly
         };
     } else {
         filterMetadata = {
             visibilityKind: classified.visibilityKind,
-            requiredScopes: requiredScopes,
+            requiredScopeTerms: requiredScopeTerms,
             effectiveReadOnly: effectiveReadOnly
         };
     }
@@ -6161,7 +6186,9 @@ var McpServerFactoryService_1;
                     } else {
                         result = generateMcpToolDefinitions(apiDetails, undefined, {
                             manifest: manifest,
-                            naming: this._resolveToolNamingOptions()
+                            naming: this._resolveToolNamingOptions(),
+                            defaultRequiredScope: this.mcpConfig.defaultRequiredScope,
+                            modelRequiredScopes: this.mcpConfig.modelRequiredScopes
                         });
                     }
                     this._cachedTools = result;
@@ -6630,7 +6657,7 @@ var McpServerFactoryService_1;
      * Synthesizes the same `{ auth: { token } }` shape that `getOidcScopesFromRequest`
      * expects post-dispatch, so the upstream helper stays the single source of scope parsing.
      * Returns `undefined` for non-OIDC callers (no `oidcValidatedToken.scope`) — the filter
-     * loop treats that as "skip scope enforcement", matching `oidcCallModelScopePreAssert`.
+     * loop treats that as "skip scope enforcement", matching the model-api scope gate (`assertModelApiOidcScope`).
      *
      * @param ctx - The per-request context carrying the validated auth payload.
      * @returns The set of granted OIDC scopes, or `undefined` when scope enforcement should be skipped.
@@ -6674,9 +6701,7 @@ var McpServerFactoryService_1;
                     for(var _iterator = tools[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
                         var tool = _step.value;
                         var filterMetadata = tool.filterMetadata;
-                        if (scopes != null && filterMetadata.requiredScopes != null && !filterMetadata.requiredScopes.every(function(scope) {
-                            return scopes.has(scope);
-                        })) {
+                        if (scopes != null && filterMetadata.requiredScopeTerms != null && !oidcScopeTermsSatisfied(filterMetadata.requiredScopeTerms, scopes)) {
                             continue;
                         }
                         if (readOnlyMode && filterMetadata.effectiveReadOnly !== true) {

package/mcp/package.json

@@ -1,17 +1,17 @@
 {
   "name": "@dereekb/firebase-server/mcp",
-  "version": "13.29.0",
+  "version": "13.31.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.29.0",
-    "@dereekb/date": "13.29.0",
-    "@dereekb/firebase": "13.29.0",
-    "@dereekb/firebase-server": "13.29.0",
-    "@dereekb/firebase-server/oidc": "13.29.0",
-    "@dereekb/model": "13.29.0",
-    "@dereekb/nestjs": "13.29.0",
-    "@dereekb/rxjs": "13.29.0",
-    "@dereekb/util": "13.29.0",
-    "@dereekb/zoho": "13.29.0",
+    "@dereekb/analytics": "13.31.0",
+    "@dereekb/date": "13.31.0",
+    "@dereekb/firebase": "13.31.0",
+    "@dereekb/firebase-server": "13.31.0",
+    "@dereekb/firebase-server/oidc": "13.31.0",
+    "@dereekb/model": "13.31.0",
+    "@dereekb/nestjs": "13.31.0",
+    "@dereekb/rxjs": "13.31.0",
+    "@dereekb/util": "13.31.0",
+    "@dereekb/zoho": "13.31.0",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/core": "^11.1.19",

package/mcp/src/lib/mcp.config.d.ts

@@ -1,5 +1,5 @@
 import { type AuthClaims, type AuthRoleSet } from '@dereekb/util';
-import { type OidcScope } from '@dereekb/firebase';
+import { type FirestoreModelType, type OidcModelScopeRequirement, type OidcScope, type OidcScopeTerm } from '@dereekb/firebase';
 /**
  * Default path the MCP Streamable HTTP transport is mounted at.
  *
@@ -200,6 +200,24 @@ export declare abstract class McpModuleConfig {
      * from the dispatched handler body. See {@link McpReasonParameterConfig}.
      */
     readonly reasonParameter?: McpReasonParameterConfig | boolean;
+    /**
+     * Default OIDC scope group term required on EVERY `callModel` op, mirrored into MCP tool-list
+     * visibility, unless a finer term overrides it (a per-function `requiredScope`, then a
+     * {@link McpModuleConfig.modelRequiredScopes} entry). Threaded into the same
+     * `resolveEffectiveOidcScopeTerms` composition the server-side model-api scope gate
+     * (`assertModelApiOidcScope`) uses, so a tool is advertised only when the caller could actually invoke it.
+     *
+     * Set this to the SAME value passed to `ModelApiDispatchConfig.defaultRequiredScope` to
+     * keep tool visibility and enforcement in lockstep.
+     */
+    readonly defaultRequiredScope?: OidcScopeTerm;
+    /**
+     * Per-model OIDC scope group-term overrides, keyed by {@link FirestoreModelType}, mirrored into MCP
+     * tool-list visibility. Set this to the SAME value passed to
+     * `ModelApiDispatchConfig.modelRequiredScopes` so per-model / verb-keyed restrictions that
+     * confine a subset client apply identically to the advertised tool list.
+     */
+    readonly modelRequiredScopes?: Record<FirestoreModelType, OidcModelScopeRequirement>;
 }
 /**
  * Signature for the optional role reader the MCP module uses when evaluating

package/mcp/src/lib/service/mcp.server.factory.d.ts

@@ -152,7 +152,7 @@ export declare class McpServerFactoryService {
      * Synthesizes the same `{ auth: { token } }` shape that `getOidcScopesFromRequest`
      * expects post-dispatch, so the upstream helper stays the single source of scope parsing.
      * Returns `undefined` for non-OIDC callers (no `oidcValidatedToken.scope`) — the filter
-     * loop treats that as "skip scope enforcement", matching `oidcCallModelScopePreAssert`.
+     * loop treats that as "skip scope enforcement", matching the model-api scope gate (`assertModelApiOidcScope`).
      *
      * @param ctx - The per-request context carrying the validated auth payload.
      * @returns The set of granted OIDC scopes, or `undefined` when scope enforcement should be skipped.

package/mcp/src/lib/service/mcp.tool-generator.d.ts

@@ -1,5 +1,5 @@
 import { type Maybe } from '@dereekb/util';
-import { type KnownOnCallFunctionType } from '@dereekb/firebase';
+import { type FirestoreModelType, type KnownOnCallFunctionType, type OidcModelScopeRequirement, type OidcScopeTerm } from '@dereekb/firebase';
 import { type ModelApiDetailsResult, type OnCallModelFunctionApiDetails, type FirebaseServerAuthData, type McpToolDetailsBuilder, type McpVisibilityRule } from '@dereekb/firebase-server';
 import { type Request } from 'express';
 import { type CallToolResult, type ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';
@@ -452,6 +452,17 @@ export interface GenerateMcpToolDefinitionsContext {
      * Per-model name segment overrides (e.g. collection prefixes).
      */
     readonly naming?: McpToolGenerationNamingOptions;
+    /**
+     * Default OIDC scope group term required on every op unless a finer term overrides it. Mirrors the
+     * model-api layer's `ModelApiDispatchConfig.defaultRequiredScope` so a tool is advertised only when
+     * the caller could invoke it.
+     */
+    readonly defaultRequiredScope?: OidcScopeTerm;
+    /**
+     * Per-model OIDC scope group-term overrides, keyed by {@link FirestoreModelType}. Mirrors the model-api
+     * layer's `ModelApiDispatchConfig.modelRequiredScopes` so per-model / verb-keyed restrictions apply to tool visibility.
+     */
+    readonly modelRequiredScopes?: Record<FirestoreModelType, OidcModelScopeRequirement>;
 }
 /**
  * Generates MCP tool definitions from a model-first API details tree.

package/mcp/src/lib/service/mcp.visibility.d.ts

@@ -1,5 +1,5 @@
 import { type Maybe } from '@dereekb/util';
-import { type CallModelOidcScope, type OidcScope } from '@dereekb/firebase';
+import { type CallModelOidcScope, type OidcScopeTerm } from '@dereekb/firebase';
 import { type McpToolVisibility, type McpVisibilityContext, type McpVisibilityRule } from '@dereekb/firebase-server';
 import { type ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';
 /**
@@ -41,12 +41,15 @@ export interface ClassifiedMcpToolVisibilityDynamic {
 export type McpToolFilterMetadata = McpToolFilterMetadataAlways | McpToolFilterMetadataNever | McpToolFilterMetadataDeclarative | McpToolFilterMetadataDynamic;
 interface McpToolFilterMetadataBase {
     /**
-     * OIDC scopes required to invoke this tool (AND-semantics — the caller must hold every entry).
-     * Precomputed from the dispatch call type's per-verb scope (`model.<call>`) plus any per-function
-     * scope declared via `withApiDetails({ requiredScope })`. Empty when no scope is enforced (a
-     * non-CRUD call type with no per-function scope); apps gate custom verbs via their own preAssert.
+     * OIDC scope TERMS required to invoke this tool, evaluated AND-of-ORs — the caller must satisfy
+     * EVERY term, and an array term (OR-group) is satisfied by holding ANY member. Checked with the
+     * shared `oidcScopeTermsSatisfied` so tool-list visibility matches the server-side `callModel` gate
+     * exactly. Precomputed from the dispatch call type's per-verb scope (`model.<call>`) plus the
+     * effective group term (per-function `requiredScope` > per-model requirement > module default).
+     * Empty when no scope is enforced (a non-CRUD call type with no per-function/model/default term);
+     * apps gate custom verbs via their own preAssert.
      */
-    readonly requiredScopes?: readonly OidcScope[];
+    readonly requiredScopeTerms?: readonly OidcScopeTerm[];
     /**
      * Effective read-only classification used by the module-level `readOnly` filter.
      *

package/model/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/model",
-  "version": "13.29.0",
+  "version": "13.31.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.29.0",
-    "@dereekb/date": "13.29.0",
-    "@dereekb/firebase": "13.29.0",
-    "@dereekb/firebase-server": "13.29.0",
-    "@dereekb/model": "13.29.0",
-    "@dereekb/nestjs": "13.29.0",
-    "@dereekb/rxjs": "13.29.0",
-    "@dereekb/util": "13.29.0",
+    "@dereekb/analytics": "13.31.0",
+    "@dereekb/date": "13.31.0",
+    "@dereekb/firebase": "13.31.0",
+    "@dereekb/firebase-server": "13.31.0",
+    "@dereekb/model": "13.31.0",
+    "@dereekb/nestjs": "13.31.0",
+    "@dereekb/rxjs": "13.31.0",
+    "@dereekb/util": "13.31.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "archiver": "^7.0.1",

package/oidc/index.cjs.js

@@ -3555,11 +3555,18 @@ exports.OidcProviderConfigService = __decorate([
  * Resolves the unlocked + required scope sets for a client from the provider-profile registry and
  * the profile keys assigned to that client.
  *
+ * A client with NO assigned profiles resolves to the registry's default profiles (those marked
+ * `isDefault`), so a registry declaring no default resolves exactly as it would from the assigned
+ * keys alone.
+ *
+ * This is the single choke point for a client's profile resolution — the consent unlock gate, the
+ * consent required gate, and the `requiredScopes` interaction param all read through it.
+ *
  * @param providerProfiles - The provider-profile registry (from {@link OidcProviderConfig.providerProfiles}).
  * @param clientProfileKeys - The profile keys assigned to the client (its `dbx_provider_profiles`).
  * @returns The unlocked and required scope sets for the client.
  */ function oidcClientProviderProfileScopes(providerProfiles, clientProfileKeys) {
-    var clientProfiles = firebase.oidcProviderProfilesForKeys(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : [], clientProfileKeys);
+    var clientProfiles = firebase.oidcProviderProfilesForClient(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : [], clientProfileKeys);
     return {
         unlocked: firebase.scopesForOidcProviderProfiles(clientProfiles),
         required: firebase.requiredScopesForOidcProviderProfiles(clientProfiles)
@@ -5395,7 +5402,7 @@ function _unsupported_iterable_to_array$2(o, minLen) {
  * `request.auth.token.scope` for OIDC callers and is `undefined` for non-OIDC
  * (regular Firebase ID-token) callers.
  *
- * Returning `undefined` for non-OIDC callers lets callers (e.g. `oidcCallModelScopePreAssert`)
+ * Returning `undefined` for non-OIDC callers lets consumers (e.g. the MCP tool-visibility filter)
  * skip scope enforcement instead of falsely treating the missing claim as "no scopes granted".
  *
  * The parameter is intentionally typed as `unknown` because `DecodedIdToken` (Firebase
@@ -5407,10 +5414,7 @@ function _unsupported_iterable_to_array$2(o, minLen) {
  */ function getOidcScopesFromRequest(request) {
     var _request_auth_token, _request_auth;
     var scope = request === null || request === void 0 ? void 0 : (_request_auth = request.auth) === null || _request_auth === void 0 ? void 0 : (_request_auth_token = _request_auth.token) === null || _request_auth_token === void 0 ? void 0 : _request_auth_token.scope;
-    var result = typeof scope === 'string' ? new Set(scope.split(' ').filter(function(value) {
-        return value.length > 0;
-    })) : undefined;
-    return result;
+    return firebase.oidcScopesFromScopeClaim(scope);
 }
 
 function asyncGeneratorStep$3(gen, resolve, reject, _next, _throw, key, arg) {
@@ -6215,7 +6219,7 @@ var OidcInteractionController_1;
      * @throws {HttpException} HTTP 400 when the consent interaction cannot be completed.
      */ function postConsent(uid, body, res) {
                 return _async_to_generator$2(function() {
-                    var startedAt, clientId, accountId, _ref, _prompt_details_missingOIDCScope, _this_accountService_providerConfig_adminOnlyScopes, _ref1, _ref2, _ref3, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, _ref4, redirectTo, interaction, prompt, params, session, missingOIDCScope, existingGrant, _tmp, encounteredOIDCScopes, clientPayload, requestedOIDCScopeSet, adminOnlyScopes, requestsServiceToken, isAdmin, _tmp1, _ref5, redirectTo1, providerProfiles, _oidcClientProviderProfileScopes, clientUnlockedScopes, clientRequiredScopes, profileGatedScopes, disallowedGatedScopes, _ref6, redirectTo2, missingRequiredScopes, _ref7, redirectTo3, requestedRawTtl, clientMaxSessionTtl, expiresInSeconds, grant, _tmp2, _resolveEffectiveSubset, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset1, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset2, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, _ref8, redirectTo4, err;
+                    var startedAt, clientId, accountId, _ref, _prompt_details_missingOIDCScope, _this_accountService_providerConfig_adminOnlyScopes, _ref1, _ref2, _ref3, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, _ref4, redirectTo, interaction, prompt, params, session, missingOIDCScope, existingGrant, _tmp, encounteredOIDCScopes, clientPayload, requestedOIDCScopeSet, providerProfiles, configAdminOnlyScopes, adminOnlyScopes, requestedAdminOnlyScopes, requestsServiceToken, isAdmin, _tmp1, _ref5, redirectTo1, _oidcClientProviderProfileScopes, clientUnlockedScopes, clientRequiredScopes, profileGatedScopes, disallowedGatedScopes, _ref6, redirectTo2, missingRequiredScopes, _ref7, redirectTo3, requestedRawTtl, clientMaxSessionTtl, expiresInSeconds, grant, _tmp2, _resolveEffectiveSubset, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset1, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset2, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, _ref8, redirectTo4, err;
                     return _ts_generator$2(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -6299,11 +6303,20 @@ var OidcInteractionController_1;
                                 clientPayload = _state.sent();
                                 // Admin-only scope gate. The requested OIDC scope set is `missingOIDCScope ∪ encounteredOIDCScopes`
                                 // (a fresh consent has everything in `missing`; a re-consent may carry already-granted scopes in
-                                // `encountered`). If that set intersects the provider's `adminOnlyScopes` and the resolving user is
-                                // not an admin, hard-reject with `access_denied` rather than silently dropping the scope.
+                                // `encountered`). If that set intersects the admin-only scopes — the provider's `adminOnlyScopes`
+                                // unioned with the scopes of every profile marked `adminOnly` — and the resolving user is not an
+                                // admin, hard-reject with `access_denied` rather than silently dropping the scope.
                                 requestedOIDCScopeSet = new Set(_to_consumable_array$1(missingOIDCScope).concat(_to_consumable_array$1(encounteredOIDCScopes)));
-                                adminOnlyScopes = (_this_accountService_providerConfig_adminOnlyScopes = this.accountService.providerConfig.adminOnlyScopes) !== null && _this_accountService_providerConfig_adminOnlyScopes !== void 0 ? _this_accountService_providerConfig_adminOnlyScopes : [];
-                                requestsServiceToken = adminOnlyScopes.some(function(scope) {
+                                providerProfiles = this.accountService.providerConfig.providerProfiles;
+                                configAdminOnlyScopes = (_this_accountService_providerConfig_adminOnlyScopes = this.accountService.providerConfig.adminOnlyScopes) !== null && _this_accountService_providerConfig_adminOnlyScopes !== void 0 ? _this_accountService_providerConfig_adminOnlyScopes : [];
+                                adminOnlyScopes = new Set(_to_consumable_array$1(configAdminOnlyScopes).concat(_to_consumable_array$1(firebase.adminOnlyScopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []))));
+                                requestedAdminOnlyScopes = Array.from(adminOnlyScopes).filter(function(scope) {
+                                    return requestedOIDCScopeSet.has(scope);
+                                });
+                                // Deliberately sourced from the provider config's `adminOnlyScopes` ALONE, unlike the gate above:
+                                // this flag also selects the (highest) service-token TTL tier further down, and a profile marked
+                                // `adminOnly` must gate by admin status WITHOUT widening its grant's lifetime to that tier.
+                                requestsServiceToken = configAdminOnlyScopes.some(function(scope) {
                                     return requestedOIDCScopeSet.has(scope);
                                 });
                                 if (!accountId) return [
@@ -6325,7 +6338,7 @@ var OidcInteractionController_1;
                                 _state.label = 12;
                             case 12:
                                 isAdmin = _tmp1;
-                                if (!(requestsServiceToken && !isAdmin)) return [
+                                if (!(requestedAdminOnlyScopes.length > 0 && !isAdmin)) return [
                                     3,
                                     14
                                 ];
@@ -6333,7 +6346,7 @@ var OidcInteractionController_1;
                                     4,
                                     this.oidcInteractionService.finishInteractionByUid(uid, {
                                         error: 'access_denied',
-                                        error_description: 'token.service is restricted to admins.'
+                                        error_description: "The following scope(s) are restricted to admins: ".concat(requestedAdminOnlyScopes.join(', '), ".")
                                     }, {
                                         mergeWithLastSubmission: true
                                     })
@@ -6345,7 +6358,7 @@ var OidcInteractionController_1;
                                     isSuccessful: false,
                                     uid: accountId,
                                     clientId: clientId,
-                                    serviceToken: true,
+                                    serviceToken: requestsServiceToken,
                                     isAdmin: false,
                                     reason: 'service_token_non_admin',
                                     durationMs: Date.now() - startedAt
@@ -6358,9 +6371,9 @@ var OidcInteractionController_1;
                                 ];
                             case 14:
                                 // Provider-profile scope gate. Any scope referenced by a provider profile is "gated" — available
-                                // only to clients whose assigned profiles unlock it. Independent of the admin-only gate above; a
-                                // scope may be subject to both.
-                                providerProfiles = this.accountService.providerConfig.providerProfiles;
+                                // only to clients whose assigned profiles unlock it (a client with NO assigned profiles resolves
+                                // to the registry's default profiles). Independent of the admin-only gate above; a scope may be
+                                // subject to both.
                                 _oidcClientProviderProfileScopes = oidcClientProviderProfileScopes(providerProfiles, (_ref2 = clientPayload === null || clientPayload === void 0 ? void 0 : clientPayload.dbx_provider_profiles) !== null && _ref2 !== void 0 ? _ref2 : undefined), clientUnlockedScopes = _oidcClientProviderProfileScopes.unlocked, clientRequiredScopes = _oidcClientProviderProfileScopes.required;
                                 profileGatedScopes = firebase.scopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []);
                                 // Unlock gate: reject any requested gated scope this client's profiles do not unlock.
@@ -7781,53 +7794,6 @@ function _unsupported_iterable_to_array(o, minLen) {
     };
 }
 
-/**
- * Builds a {@link AssertModelCrudRequestFunction} that rejects callModel requests
- * lacking the required OIDC scope(s) for the call.
- *
- * Enforcement is additive: an OIDC caller must hold BOTH the per-verb scope mapped
- * from the call type (`model.<call>`) AND any per-function scope a handler declared
- * via `withApiDetails({ requiredScope })` — surfaced on `context.requiredScope`.
- *
- * Bypasses the check (no-op) when the request is not OIDC-authenticated — i.e.
- * when {@link getOidcScopesFromRequest} returns `undefined` because there is no
- * `auth.token.scope` claim on the request. Regular Firebase ID-token callers are
- * unaffected and continue to be gated by auth roles.
- *
- * Bypasses the check for custom (non-CRUD) call types that declare no per-function
- * scope, so app-specific verbs remain unrestricted unless an app wires its own
- * assertion or declares a `requiredScope`.
- *
- * Wire as the `preAssert` of {@link onCallModel}.
- *
- * @returns The pre-assertion function ready to plug into `OnCallModelConfig.preAssert`.
- */ function oidcCallModelScopePreAssert() {
-    var fn = function fn(context) {
-        var requiredScopes = util.filterMaybeArrayValues([
-            firebase.callModelOidcScopeForCallType(context.call),
-            context.requiredScope
-        ]);
-        // No requirement (custom verb + no per-function scope) short-circuits without reading scopes.
-        // A non-OIDC caller yields `undefined` scopes below and bypasses just like the per-verb check.
-        var scopes = requiredScopes.length === 0 ? undefined : getOidcScopesFromRequest(context.request);
-        var missingScopes = scopes == null ? [] : requiredScopes.filter(function(scope) {
-            return !scopes.has(scope);
-        });
-        if (missingScopes.length > 0) {
-            throw firebaseServer.forbiddenError({
-                status: 403,
-                code: firebase.CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE,
-                message: "Missing required OIDC scope for callModel: ".concat(missingScopes.join(', ')),
-                data: {
-                    requiredScopes: missingScopes,
-                    call: context.call
-                }
-            });
-        }
-    };
-    return fn;
-}
-
 exports.DBX_FIREBASE_SERVER_OIDC_PROVIDER_PROFILES_CLIENT_METADATA = DBX_FIREBASE_SERVER_OIDC_PROVIDER_PROFILES_CLIENT_METADATA;
 exports.DEFAULT_APP_OAUTH_CONSENT_PATH_PART = DEFAULT_APP_OAUTH_CONSENT_PATH_PART;
 exports.DEFAULT_APP_OAUTH_INTERACTION_PATH = DEFAULT_APP_OAUTH_INTERACTION_PATH;
@@ -7890,7 +7856,6 @@ exports.jwksKeyIdentity = jwksKeyIdentity;
 exports.jwksKeysWithStatusQuery = jwksKeysWithStatusQuery;
 exports.nonRetiredJwksKeysQuery = nonRetiredJwksKeysQuery;
 exports.noopOidcAnalyticsService = noopOidcAnalyticsService;
-exports.oidcCallModelScopePreAssert = oidcCallModelScopePreAssert;
 exports.oidcClientProviderProfileScopes = oidcClientProviderProfileScopes;
 exports.oidcCorsOriginDelegate = oidcCorsOriginDelegate;
 exports.oidcFirestoreCollectionsFactory = oidcFirestoreCollectionsFactory;