@dereekb/firebase-server 13.30.0 → 13.31.0

package/mailgun/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/mailgun",
-  "version": "13.30.0",
+  "version": "13.31.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.30.0",
-    "@dereekb/firebase": "13.30.0",
-    "@dereekb/firebase-server": "13.30.0",
-    "@dereekb/date": "13.30.0",
-    "@dereekb/nestjs": "13.30.0",
-    "@dereekb/model": "13.30.0",
-    "@dereekb/rxjs": "13.30.0",
-    "@dereekb/util": "13.30.0"
+    "@dereekb/analytics": "13.31.0",
+    "@dereekb/firebase": "13.31.0",
+    "@dereekb/firebase-server": "13.31.0",
+    "@dereekb/date": "13.31.0",
+    "@dereekb/nestjs": "13.31.0",
+    "@dereekb/model": "13.31.0",
+    "@dereekb/rxjs": "13.31.0",
+    "@dereekb/util": "13.31.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/mcp/package.json

@@ -1,17 +1,17 @@
 {
   "name": "@dereekb/firebase-server/mcp",
-  "version": "13.30.0",
+  "version": "13.31.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.30.0",
-    "@dereekb/date": "13.30.0",
-    "@dereekb/firebase": "13.30.0",
-    "@dereekb/firebase-server": "13.30.0",
-    "@dereekb/firebase-server/oidc": "13.30.0",
-    "@dereekb/model": "13.30.0",
-    "@dereekb/nestjs": "13.30.0",
-    "@dereekb/rxjs": "13.30.0",
-    "@dereekb/util": "13.30.0",
-    "@dereekb/zoho": "13.30.0",
+    "@dereekb/analytics": "13.31.0",
+    "@dereekb/date": "13.31.0",
+    "@dereekb/firebase": "13.31.0",
+    "@dereekb/firebase-server": "13.31.0",
+    "@dereekb/firebase-server/oidc": "13.31.0",
+    "@dereekb/model": "13.31.0",
+    "@dereekb/nestjs": "13.31.0",
+    "@dereekb/rxjs": "13.31.0",
+    "@dereekb/util": "13.31.0",
+    "@dereekb/zoho": "13.31.0",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/core": "^11.1.19",

package/model/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/model",
-  "version": "13.30.0",
+  "version": "13.31.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.30.0",
-    "@dereekb/date": "13.30.0",
-    "@dereekb/firebase": "13.30.0",
-    "@dereekb/firebase-server": "13.30.0",
-    "@dereekb/model": "13.30.0",
-    "@dereekb/nestjs": "13.30.0",
-    "@dereekb/rxjs": "13.30.0",
-    "@dereekb/util": "13.30.0",
+    "@dereekb/analytics": "13.31.0",
+    "@dereekb/date": "13.31.0",
+    "@dereekb/firebase": "13.31.0",
+    "@dereekb/firebase-server": "13.31.0",
+    "@dereekb/model": "13.31.0",
+    "@dereekb/nestjs": "13.31.0",
+    "@dereekb/rxjs": "13.31.0",
+    "@dereekb/util": "13.31.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "archiver": "^7.0.1",

package/oidc/index.cjs.js

@@ -3555,11 +3555,18 @@ exports.OidcProviderConfigService = __decorate([
  * Resolves the unlocked + required scope sets for a client from the provider-profile registry and
  * the profile keys assigned to that client.
  *
+ * A client with NO assigned profiles resolves to the registry's default profiles (those marked
+ * `isDefault`), so a registry declaring no default resolves exactly as it would from the assigned
+ * keys alone.
+ *
+ * This is the single choke point for a client's profile resolution — the consent unlock gate, the
+ * consent required gate, and the `requiredScopes` interaction param all read through it.
+ *
  * @param providerProfiles - The provider-profile registry (from {@link OidcProviderConfig.providerProfiles}).
  * @param clientProfileKeys - The profile keys assigned to the client (its `dbx_provider_profiles`).
  * @returns The unlocked and required scope sets for the client.
  */ function oidcClientProviderProfileScopes(providerProfiles, clientProfileKeys) {
-    var clientProfiles = firebase.oidcProviderProfilesForKeys(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : [], clientProfileKeys);
+    var clientProfiles = firebase.oidcProviderProfilesForClient(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : [], clientProfileKeys);
     return {
         unlocked: firebase.scopesForOidcProviderProfiles(clientProfiles),
         required: firebase.requiredScopesForOidcProviderProfiles(clientProfiles)
@@ -6212,7 +6219,7 @@ var OidcInteractionController_1;
      * @throws {HttpException} HTTP 400 when the consent interaction cannot be completed.
      */ function postConsent(uid, body, res) {
                 return _async_to_generator$2(function() {
-                    var startedAt, clientId, accountId, _ref, _prompt_details_missingOIDCScope, _this_accountService_providerConfig_adminOnlyScopes, _ref1, _ref2, _ref3, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, _ref4, redirectTo, interaction, prompt, params, session, missingOIDCScope, existingGrant, _tmp, encounteredOIDCScopes, clientPayload, requestedOIDCScopeSet, adminOnlyScopes, requestsServiceToken, isAdmin, _tmp1, _ref5, redirectTo1, providerProfiles, _oidcClientProviderProfileScopes, clientUnlockedScopes, clientRequiredScopes, profileGatedScopes, disallowedGatedScopes, _ref6, redirectTo2, missingRequiredScopes, _ref7, redirectTo3, requestedRawTtl, clientMaxSessionTtl, expiresInSeconds, grant, _tmp2, _resolveEffectiveSubset, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset1, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset2, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, _ref8, redirectTo4, err;
+                    var startedAt, clientId, accountId, _ref, _prompt_details_missingOIDCScope, _this_accountService_providerConfig_adminOnlyScopes, _ref1, _ref2, _ref3, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, _ref4, redirectTo, interaction, prompt, params, session, missingOIDCScope, existingGrant, _tmp, encounteredOIDCScopes, clientPayload, requestedOIDCScopeSet, providerProfiles, configAdminOnlyScopes, adminOnlyScopes, requestedAdminOnlyScopes, requestsServiceToken, isAdmin, _tmp1, _ref5, redirectTo1, _oidcClientProviderProfileScopes, clientUnlockedScopes, clientRequiredScopes, profileGatedScopes, disallowedGatedScopes, _ref6, redirectTo2, missingRequiredScopes, _ref7, redirectTo3, requestedRawTtl, clientMaxSessionTtl, expiresInSeconds, grant, _tmp2, _resolveEffectiveSubset, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset1, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset2, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, _ref8, redirectTo4, err;
                     return _ts_generator$2(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -6296,11 +6303,20 @@ var OidcInteractionController_1;
                                 clientPayload = _state.sent();
                                 // Admin-only scope gate. The requested OIDC scope set is `missingOIDCScope ∪ encounteredOIDCScopes`
                                 // (a fresh consent has everything in `missing`; a re-consent may carry already-granted scopes in
-                                // `encountered`). If that set intersects the provider's `adminOnlyScopes` and the resolving user is
-                                // not an admin, hard-reject with `access_denied` rather than silently dropping the scope.
+                                // `encountered`). If that set intersects the admin-only scopes — the provider's `adminOnlyScopes`
+                                // unioned with the scopes of every profile marked `adminOnly` — and the resolving user is not an
+                                // admin, hard-reject with `access_denied` rather than silently dropping the scope.
                                 requestedOIDCScopeSet = new Set(_to_consumable_array$1(missingOIDCScope).concat(_to_consumable_array$1(encounteredOIDCScopes)));
-                                adminOnlyScopes = (_this_accountService_providerConfig_adminOnlyScopes = this.accountService.providerConfig.adminOnlyScopes) !== null && _this_accountService_providerConfig_adminOnlyScopes !== void 0 ? _this_accountService_providerConfig_adminOnlyScopes : [];
-                                requestsServiceToken = adminOnlyScopes.some(function(scope) {
+                                providerProfiles = this.accountService.providerConfig.providerProfiles;
+                                configAdminOnlyScopes = (_this_accountService_providerConfig_adminOnlyScopes = this.accountService.providerConfig.adminOnlyScopes) !== null && _this_accountService_providerConfig_adminOnlyScopes !== void 0 ? _this_accountService_providerConfig_adminOnlyScopes : [];
+                                adminOnlyScopes = new Set(_to_consumable_array$1(configAdminOnlyScopes).concat(_to_consumable_array$1(firebase.adminOnlyScopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []))));
+                                requestedAdminOnlyScopes = Array.from(adminOnlyScopes).filter(function(scope) {
+                                    return requestedOIDCScopeSet.has(scope);
+                                });
+                                // Deliberately sourced from the provider config's `adminOnlyScopes` ALONE, unlike the gate above:
+                                // this flag also selects the (highest) service-token TTL tier further down, and a profile marked
+                                // `adminOnly` must gate by admin status WITHOUT widening its grant's lifetime to that tier.
+                                requestsServiceToken = configAdminOnlyScopes.some(function(scope) {
                                     return requestedOIDCScopeSet.has(scope);
                                 });
                                 if (!accountId) return [
@@ -6322,7 +6338,7 @@ var OidcInteractionController_1;
                                 _state.label = 12;
                             case 12:
                                 isAdmin = _tmp1;
-                                if (!(requestsServiceToken && !isAdmin)) return [
+                                if (!(requestedAdminOnlyScopes.length > 0 && !isAdmin)) return [
                                     3,
                                     14
                                 ];
@@ -6330,7 +6346,7 @@ var OidcInteractionController_1;
                                     4,
                                     this.oidcInteractionService.finishInteractionByUid(uid, {
                                         error: 'access_denied',
-                                        error_description: 'token.service is restricted to admins.'
+                                        error_description: "The following scope(s) are restricted to admins: ".concat(requestedAdminOnlyScopes.join(', '), ".")
                                     }, {
                                         mergeWithLastSubmission: true
                                     })
@@ -6342,7 +6358,7 @@ var OidcInteractionController_1;
                                     isSuccessful: false,
                                     uid: accountId,
                                     clientId: clientId,
-                                    serviceToken: true,
+                                    serviceToken: requestsServiceToken,
                                     isAdmin: false,
                                     reason: 'service_token_non_admin',
                                     durationMs: Date.now() - startedAt
@@ -6355,9 +6371,9 @@ var OidcInteractionController_1;
                                 ];
                             case 14:
                                 // Provider-profile scope gate. Any scope referenced by a provider profile is "gated" — available
-                                // only to clients whose assigned profiles unlock it. Independent of the admin-only gate above; a
-                                // scope may be subject to both.
-                                providerProfiles = this.accountService.providerConfig.providerProfiles;
+                                // only to clients whose assigned profiles unlock it (a client with NO assigned profiles resolves
+                                // to the registry's default profiles). Independent of the admin-only gate above; a scope may be
+                                // subject to both.
                                 _oidcClientProviderProfileScopes = oidcClientProviderProfileScopes(providerProfiles, (_ref2 = clientPayload === null || clientPayload === void 0 ? void 0 : clientPayload.dbx_provider_profiles) !== null && _ref2 !== void 0 ? _ref2 : undefined), clientUnlockedScopes = _oidcClientProviderProfileScopes.unlocked, clientRequiredScopes = _oidcClientProviderProfileScopes.required;
                                 profileGatedScopes = firebase.scopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []);
                                 // Unlock gate: reject any requested gated scope this client's profiles do not unlock.

package/oidc/index.esm.js

@@ -3,7 +3,7 @@ import { errors } from 'oidc-provider';
 import { SECONDS_IN_MINUTE, SECONDS_IN_DAY, cachedGetter, unixDateTimeSecondsNumberToDate, unixDateTimeSecondsNumberForNow, selectiveFieldEncryptor, filterUndefinedValues, websiteUrlFromPaths, firstValue, hasHttpPrefix } from '@dereekb/util';
 import { generateKeyPairSync, randomBytes } from 'node:crypto';
 import { resolveEncryptionKey, encryptValue, decryptValue, createAesStringEncryptionProvider, isValidAES256GCMEncryptionSecret } from '@dereekb/nestjs';
-import { where, iterateFirestoreDocumentSnapshotPairs, firestoreModelIdentity, snapshotConverterFunctions, optionalFirestoreDate, firestoreDate, firestoreEnum, firestorePassThroughField, AbstractFirestoreDocument, createOidcClientParamsType, deleteOidcClientParamsType, deleteOidcTokenParamsType, rotateOidcClientSecretParamsType, updateOidcClientParamsType, firestoreModelKey, oidcEntryIdentity, PUBLIC_PKCE_TOKEN_ENDPOINT_AUTH_METHOD, OIDC_ENTRY_CLIENT_TYPE, oidcEntriesByUserCodeQuery, oidcEntriesByUidQuery, oidcEntriesByGrantIdQuery, oidcProviderProfilesForKeys, requiredScopesForOidcProviderProfiles, scopesForOidcProviderProfiles, oidcScopesFromScopeClaim, oidcEntryFirestoreCollection } from '@dereekb/firebase';
+import { where, iterateFirestoreDocumentSnapshotPairs, firestoreModelIdentity, snapshotConverterFunctions, optionalFirestoreDate, firestoreDate, firestoreEnum, firestorePassThroughField, AbstractFirestoreDocument, createOidcClientParamsType, deleteOidcClientParamsType, deleteOidcTokenParamsType, rotateOidcClientSecretParamsType, updateOidcClientParamsType, firestoreModelKey, oidcEntryIdentity, PUBLIC_PKCE_TOKEN_ENDPOINT_AUTH_METHOD, OIDC_ENTRY_CLIENT_TYPE, oidcEntriesByUserCodeQuery, oidcEntriesByUidQuery, oidcEntriesByGrantIdQuery, oidcProviderProfilesForClient, requiredScopesForOidcProviderProfiles, scopesForOidcProviderProfiles, oidcScopesFromScopeClaim, adminOnlyScopesForOidcProviderProfiles, oidcEntryFirestoreCollection } from '@dereekb/firebase';
 import { firestoreEncryptedField, firebaseServerActionsContext, FirebaseServerEnvService, FirebaseServerAnalyticsService, FIREBASE_FIRESTORE_CONTEXT_TOKEN, FirebaseServerFirestoreContextModule } from '@dereekb/firebase-server';
 import { nanoid } from 'nanoid';
 import { safeToJsDate } from '@dereekb/date';
@@ -3553,11 +3553,18 @@ OidcProviderConfigService = __decorate([
  * Resolves the unlocked + required scope sets for a client from the provider-profile registry and
  * the profile keys assigned to that client.
  *
+ * A client with NO assigned profiles resolves to the registry's default profiles (those marked
+ * `isDefault`), so a registry declaring no default resolves exactly as it would from the assigned
+ * keys alone.
+ *
+ * This is the single choke point for a client's profile resolution — the consent unlock gate, the
+ * consent required gate, and the `requiredScopes` interaction param all read through it.
+ *
  * @param providerProfiles - The provider-profile registry (from {@link OidcProviderConfig.providerProfiles}).
  * @param clientProfileKeys - The profile keys assigned to the client (its `dbx_provider_profiles`).
  * @returns The unlocked and required scope sets for the client.
  */ function oidcClientProviderProfileScopes(providerProfiles, clientProfileKeys) {
-    var clientProfiles = oidcProviderProfilesForKeys(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : [], clientProfileKeys);
+    var clientProfiles = oidcProviderProfilesForClient(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : [], clientProfileKeys);
     return {
         unlocked: scopesForOidcProviderProfiles(clientProfiles),
         required: requiredScopesForOidcProviderProfiles(clientProfiles)
@@ -6210,7 +6217,7 @@ var OidcInteractionController_1;
      * @throws {HttpException} HTTP 400 when the consent interaction cannot be completed.
      */ function postConsent(uid, body, res) {
                 return _async_to_generator$2(function() {
-                    var startedAt, clientId, accountId, _ref, _prompt_details_missingOIDCScope, _this_accountService_providerConfig_adminOnlyScopes, _ref1, _ref2, _ref3, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, _ref4, redirectTo, interaction, prompt, params, session, missingOIDCScope, existingGrant, _tmp, encounteredOIDCScopes, clientPayload, requestedOIDCScopeSet, adminOnlyScopes, requestsServiceToken, isAdmin, _tmp1, _ref5, redirectTo1, providerProfiles, _oidcClientProviderProfileScopes, clientUnlockedScopes, clientRequiredScopes, profileGatedScopes, disallowedGatedScopes, _ref6, redirectTo2, missingRequiredScopes, _ref7, redirectTo3, requestedRawTtl, clientMaxSessionTtl, expiresInSeconds, grant, _tmp2, _resolveEffectiveSubset, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset1, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset2, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, _ref8, redirectTo4, err;
+                    var startedAt, clientId, accountId, _ref, _prompt_details_missingOIDCScope, _this_accountService_providerConfig_adminOnlyScopes, _ref1, _ref2, _ref3, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, _ref4, redirectTo, interaction, prompt, params, session, missingOIDCScope, existingGrant, _tmp, encounteredOIDCScopes, clientPayload, requestedOIDCScopeSet, providerProfiles, configAdminOnlyScopes, adminOnlyScopes, requestedAdminOnlyScopes, requestsServiceToken, isAdmin, _tmp1, _ref5, redirectTo1, _oidcClientProviderProfileScopes, clientUnlockedScopes, clientRequiredScopes, profileGatedScopes, disallowedGatedScopes, _ref6, redirectTo2, missingRequiredScopes, _ref7, redirectTo3, requestedRawTtl, clientMaxSessionTtl, expiresInSeconds, grant, _tmp2, _resolveEffectiveSubset, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset1, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset2, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, _ref8, redirectTo4, err;
                     return _ts_generator$2(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -6294,11 +6301,20 @@ var OidcInteractionController_1;
                                 clientPayload = _state.sent();
                                 // Admin-only scope gate. The requested OIDC scope set is `missingOIDCScope ∪ encounteredOIDCScopes`
                                 // (a fresh consent has everything in `missing`; a re-consent may carry already-granted scopes in
-                                // `encountered`). If that set intersects the provider's `adminOnlyScopes` and the resolving user is
-                                // not an admin, hard-reject with `access_denied` rather than silently dropping the scope.
+                                // `encountered`). If that set intersects the admin-only scopes — the provider's `adminOnlyScopes`
+                                // unioned with the scopes of every profile marked `adminOnly` — and the resolving user is not an
+                                // admin, hard-reject with `access_denied` rather than silently dropping the scope.
                                 requestedOIDCScopeSet = new Set(_to_consumable_array$1(missingOIDCScope).concat(_to_consumable_array$1(encounteredOIDCScopes)));
-                                adminOnlyScopes = (_this_accountService_providerConfig_adminOnlyScopes = this.accountService.providerConfig.adminOnlyScopes) !== null && _this_accountService_providerConfig_adminOnlyScopes !== void 0 ? _this_accountService_providerConfig_adminOnlyScopes : [];
-                                requestsServiceToken = adminOnlyScopes.some(function(scope) {
+                                providerProfiles = this.accountService.providerConfig.providerProfiles;
+                                configAdminOnlyScopes = (_this_accountService_providerConfig_adminOnlyScopes = this.accountService.providerConfig.adminOnlyScopes) !== null && _this_accountService_providerConfig_adminOnlyScopes !== void 0 ? _this_accountService_providerConfig_adminOnlyScopes : [];
+                                adminOnlyScopes = new Set(_to_consumable_array$1(configAdminOnlyScopes).concat(_to_consumable_array$1(adminOnlyScopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []))));
+                                requestedAdminOnlyScopes = Array.from(adminOnlyScopes).filter(function(scope) {
+                                    return requestedOIDCScopeSet.has(scope);
+                                });
+                                // Deliberately sourced from the provider config's `adminOnlyScopes` ALONE, unlike the gate above:
+                                // this flag also selects the (highest) service-token TTL tier further down, and a profile marked
+                                // `adminOnly` must gate by admin status WITHOUT widening its grant's lifetime to that tier.
+                                requestsServiceToken = configAdminOnlyScopes.some(function(scope) {
                                     return requestedOIDCScopeSet.has(scope);
                                 });
                                 if (!accountId) return [
@@ -6320,7 +6336,7 @@ var OidcInteractionController_1;
                                 _state.label = 12;
                             case 12:
                                 isAdmin = _tmp1;
-                                if (!(requestsServiceToken && !isAdmin)) return [
+                                if (!(requestedAdminOnlyScopes.length > 0 && !isAdmin)) return [
                                     3,
                                     14
                                 ];
@@ -6328,7 +6344,7 @@ var OidcInteractionController_1;
                                     4,
                                     this.oidcInteractionService.finishInteractionByUid(uid, {
                                         error: 'access_denied',
-                                        error_description: 'token.service is restricted to admins.'
+                                        error_description: "The following scope(s) are restricted to admins: ".concat(requestedAdminOnlyScopes.join(', '), ".")
                                     }, {
                                         mergeWithLastSubmission: true
                                     })
@@ -6340,7 +6356,7 @@ var OidcInteractionController_1;
                                     isSuccessful: false,
                                     uid: accountId,
                                     clientId: clientId,
-                                    serviceToken: true,
+                                    serviceToken: requestsServiceToken,
                                     isAdmin: false,
                                     reason: 'service_token_non_admin',
                                     durationMs: Date.now() - startedAt
@@ -6353,9 +6369,9 @@ var OidcInteractionController_1;
                                 ];
                             case 14:
                                 // Provider-profile scope gate. Any scope referenced by a provider profile is "gated" — available
-                                // only to clients whose assigned profiles unlock it. Independent of the admin-only gate above; a
-                                // scope may be subject to both.
-                                providerProfiles = this.accountService.providerConfig.providerProfiles;
+                                // only to clients whose assigned profiles unlock it (a client with NO assigned profiles resolves
+                                // to the registry's default profiles). Independent of the admin-only gate above; a scope may be
+                                // subject to both.
                                 _oidcClientProviderProfileScopes = oidcClientProviderProfileScopes(providerProfiles, (_ref2 = clientPayload === null || clientPayload === void 0 ? void 0 : clientPayload.dbx_provider_profiles) !== null && _ref2 !== void 0 ? _ref2 : undefined), clientUnlockedScopes = _oidcClientProviderProfileScopes.unlocked, clientRequiredScopes = _oidcClientProviderProfileScopes.required;
                                 profileGatedScopes = scopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []);
                                 // Unlock gate: reject any requested gated scope this client's profiles do not unlock.

package/oidc/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/oidc",
-  "version": "13.30.0",
+  "version": "13.31.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.30.0",
-    "@dereekb/date": "13.30.0",
-    "@dereekb/firebase": "13.30.0",
-    "@dereekb/firebase-server": "13.30.0",
-    "@dereekb/model": "13.30.0",
-    "@dereekb/nestjs": "13.30.0",
-    "@dereekb/rxjs": "13.30.0",
-    "@dereekb/util": "13.30.0",
-    "@dereekb/zoho": "13.30.0",
+    "@dereekb/analytics": "13.31.0",
+    "@dereekb/date": "13.31.0",
+    "@dereekb/firebase": "13.31.0",
+    "@dereekb/firebase-server": "13.31.0",
+    "@dereekb/model": "13.31.0",
+    "@dereekb/nestjs": "13.31.0",
+    "@dereekb/rxjs": "13.31.0",
+    "@dereekb/util": "13.31.0",
+    "@dereekb/zoho": "13.31.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "express": "^5.2.1",

package/oidc/src/lib/oidc.config.d.ts

@@ -94,6 +94,11 @@ export interface OidcProviderConfig<S extends OidcScope = OidcScope> {
      *
      * Keeps the generic package app-agnostic: apps opt a scope (e.g. `token.service`) into admin-only
      * behavior by listing it here, rather than the package hard-coding any scope name.
+     *
+     * The consent gate applies this list UNIONED with the scopes of every {@link providerProfiles} entry
+     * marked `adminOnly`. Only the scopes listed HERE additionally select the (highest) service-token
+     * login-duration tier — a profile marked `adminOnly` gates by admin status without widening its
+     * grant's lifetime.
      */
     readonly adminOnlyScopes?: readonly string[];
     /**
@@ -111,6 +116,12 @@ export interface OidcProviderConfig<S extends OidcScope = OidcScope> {
      * metadata) unlocks it. A profile scope marked `require: 'required'` is force-required — surfaced
      * as a required scope at consent and hard-rejected if not granted.
      *
+     * A profile marked `isDefault` applies to a client with NO profiles assigned, so an app can make a
+     * coarse, broadly-available scope profile-gated without breaking already-registered clients. The
+     * fallback is exclusive — assigning any other profile does not additionally confer the default's
+     * scopes. A profile marked `adminOnly` has its scopes unioned into {@link adminOnlyScopes} for the
+     * consent gate.
+     *
      * Keeps the generic package app-agnostic: apps declare their profiles statically and list them
      * here, rather than the package hard-coding any profile or scope name. This gate is independent of
      * {@link adminOnlyScopes} (which gates by the resolving user's admin status); a scope may be

package/oidc/src/lib/profile.d.ts

@@ -22,6 +22,13 @@ export interface OidcClientProviderProfileScopes<S extends OidcScope = OidcScope
  * Resolves the unlocked + required scope sets for a client from the provider-profile registry and
  * the profile keys assigned to that client.
  *
+ * A client with NO assigned profiles resolves to the registry's default profiles (those marked
+ * `isDefault`), so a registry declaring no default resolves exactly as it would from the assigned
+ * keys alone.
+ *
+ * This is the single choke point for a client's profile resolution — the consent unlock gate, the
+ * consent required gate, and the `requiredScopes` interaction param all read through it.
+ *
  * @param providerProfiles - The provider-profile registry (from {@link OidcProviderConfig.providerProfiles}).
  * @param clientProfileKeys - The profile keys assigned to the client (its `dbx_provider_profiles`).
  * @returns The unlocked and required scope sets for the client.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/firebase-server",
-  "version": "13.30.0",
+  "version": "13.31.0",
   "sideEffects": false,
   "exports": {
     "./test": {
@@ -57,15 +57,15 @@
   "types": "./src/index.d.ts",
   "peerDependencies": {
     "@cantoo/pdf-lib": "^2.6.5",
-    "@dereekb/analytics": "13.30.0",
-    "@dereekb/date": "13.30.0",
-    "@dereekb/dbx-core": "13.30.0",
-    "@dereekb/firebase": "13.30.0",
-    "@dereekb/model": "13.30.0",
-    "@dereekb/nestjs": "13.30.0",
-    "@dereekb/rxjs": "13.30.0",
-    "@dereekb/util": "13.30.0",
-    "@dereekb/zoho": "13.30.0",
+    "@dereekb/analytics": "13.31.0",
+    "@dereekb/date": "13.31.0",
+    "@dereekb/dbx-core": "13.31.0",
+    "@dereekb/firebase": "13.31.0",
+    "@dereekb/model": "13.31.0",
+    "@dereekb/nestjs": "13.31.0",
+    "@dereekb/rxjs": "13.31.0",
+    "@dereekb/util": "13.31.0",
+    "@dereekb/zoho": "13.31.0",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@modelcontextprotocol/sdk": "1.29.0",