@dereekb/firebase-server 13.30.0 → 13.31.0

package/test/index.esm.js

@@ -1,7 +1,7 @@
 import { randomEmailFactory, randomPhoneNumberFactory, mapGetter, incrementingNumberFactory, asGetter, getValueFromGetter, cachedGetter, asArray, mapObjectMap, unixDateTimeSecondsNumberForNow } from '@dereekb/util';
 import { useTestContextFixture, AbstractChildTestContextFixture, testContextBuilder, AbstractTestContextFixture, useTestFunctionFixture, useTestFunctionMapFixture, ExpectedErrorOfSpecificTypeError } from '@dereekb/util/test';
 import { decode } from 'jsonwebtoken';
-import { flatFirestoreModelKey, twoWayFlatFirestoreModelKey, firestoreContextFactory, firebaseStorageContextFactory, scopesForOidcProviderProfiles } from '@dereekb/firebase';
+import { flatFirestoreModelKey, twoWayFlatFirestoreModelKey, firestoreContextFactory, firebaseStorageContextFactory, adminOnlyScopesForOidcProviderProfiles, assignmentOnlyScopesForOidcProviderProfiles } from '@dereekb/firebase';
 import admin from 'firebase-admin';
 import functions from 'firebase-functions-test';
 import { makeTestingFirestoreDrivers, TestFirestoreInstance, TestFirestoreContextFixture, makeTestingFirebaseStorageDrivers, TestFirebaseStorageInstance, TestFirebaseStorageContextFixture, mockItemFirestoreCollection, testWithMockItemCollectionFixture, testWithMockItemStorageFixture } from '@dereekb/firebase/test';
@@ -73,7 +73,7 @@ function _create_class$6(Constructor, protoProps, staticProps) {
     if (protoProps) _defineProperties$6(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$8(obj, key, value) {
+function _define_property$9(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -105,7 +105,7 @@ function _inherits$9(subClass, superClass) {
     });
     if (superClass) _set_prototype_of$9(subClass, superClass);
 }
-function _object_spread$5(target) {
+function _object_spread$6(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -115,7 +115,7 @@ function _object_spread$5(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$8(target, key, source[key]);
+            _define_property$9(target, key, source[key]);
         });
     }
     return target;
@@ -370,8 +370,8 @@ function _ts_generator$a(thisArg, body) {
  */ var AuthorizedUserTestContextInstance = /*#__PURE__*/ function() {
     function AuthorizedUserTestContextInstance(uid, testContext) {
         _class_call_check$9(this, AuthorizedUserTestContextInstance);
-        _define_property$8(this, "uid", void 0);
-        _define_property$8(this, "testContext", void 0);
+        _define_property$9(this, "uid", void 0);
+        _define_property$9(this, "testContext", void 0);
         this.uid = uid;
         this.testContext = testContext;
     }
@@ -495,7 +495,7 @@ function _ts_generator$a(thisArg, body) {
             value: function callAuthBlockingFunction(input) {
                 var fn = input.fn, userRecord = input.userRecord, eventType = input.eventType, eventOverride = input.eventOverride, _input_skipJsonConversion = input.skipJsonConversion, skipJsonConversion = _input_skipJsonConversion === void 0 ? false : _input_skipJsonConversion;
                 var timestamp = new Date().toISOString();
-                var event = _object_spread_props$3(_object_spread$5({
+                var event = _object_spread_props$3(_object_spread$6({
                     ipAddress: '127.0.0.1',
                     userAgent: 'testing',
                     eventId: '0',
@@ -527,7 +527,7 @@ function _ts_generator$a(thisArg, body) {
                 var skipJsonConversion = arguments.length > 3 && arguments[3] !== void 0 ? arguments[3] : false;
                 var parsedParams = params == null || skipJsonConversion ? params : convertParamsToParsedJsonObjectAndBack(params);
                 return this.makeContextOptions().then(function(options) {
-                    return fn(parsedParams, contextOptions ? _object_spread$5({}, contextOptions, options) : options);
+                    return fn(parsedParams, contextOptions ? _object_spread$6({}, contextOptions, options) : options);
                 });
             }
         }
@@ -602,7 +602,7 @@ function _ts_generator$a(thisArg, body) {
                                 inputUser = _state.sent();
                                 inputTemplate = templateGetter();
                                 uid = (inputUser === null || inputUser === void 0 ? void 0 : inputUser.uid) || makeUid();
-                                _$_object_spread = _object_spread$5({}, makeUserDetails(uid, params), inputTemplate), details = _$_object_spread.details, claims = _$_object_spread.claims, userDetailsAddContactInfo = _$_object_spread.addContactInfo;
+                                _$_object_spread = _object_spread$6({}, makeUserDetails(uid, params), inputTemplate), details = _$_object_spread.details, claims = _$_object_spread.claims, userDetailsAddContactInfo = _$_object_spread.addContactInfo;
                                 _ref = details !== null && details !== void 0 ? details : {}, detailsPhoneNumber = _ref.phoneNumber, detailsEmail = _ref.email; // keep details if provided
                                 addContactInfo = inputAddContactInfo || userDetailsAddContactInfo;
                                 auth = f.instance.auth;
@@ -615,7 +615,7 @@ function _ts_generator$a(thisArg, body) {
                                 }
                                 return [
                                     4,
-                                    auth.createUser(_object_spread$5(_object_spread_props$3(_object_spread$5({
+                                    auth.createUser(_object_spread$6(_object_spread_props$3(_object_spread$6({
                                         uid: uid,
                                         displayName: 'Test Person'
                                     }, details), {
@@ -807,7 +807,7 @@ function _ts_generator$a(thisArg, body) {
     var _ref;
     var _decoded_claims;
     var decoded = decode(token);
-    var decodedToken = _object_spread_props$3(_object_spread$5({}, decoded, decoded.claims), {
+    var decodedToken = _object_spread_props$3(_object_spread$6({}, decoded, decoded.claims), {
         auth_time: decoded.iat,
         firebase: (_ref = (_decoded_claims = decoded.claims) === null || _decoded_claims === void 0 ? void 0 : _decoded_claims.firebase) !== null && _ref !== void 0 ? _ref : {}
     });
@@ -838,7 +838,7 @@ function _ts_generator$a(thisArg, body) {
         }
     };
     var customClaims = userRecord.customClaims;
-    return _object_spread$5({}, customClaims, baseClaims);
+    return _object_spread$6({}, customClaims, baseClaims);
 }
 
 function _assert_this_initialized$8(self) {
@@ -898,7 +898,7 @@ function _create_class$5(Constructor, protoProps, staticProps) {
     if (protoProps) _defineProperties$5(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$7(obj, key, value) {
+function _define_property$8(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -1119,9 +1119,9 @@ function _ts_generator$9(thisArg, body) {
  */ var ModelTestContextInstance = /*#__PURE__*/ function() {
     function ModelTestContextInstance(collection, ref, testContext) {
         _class_call_check$8(this, ModelTestContextInstance);
-        _define_property$7(this, "collection", void 0);
-        _define_property$7(this, "ref", void 0);
-        _define_property$7(this, "testContext", void 0);
+        _define_property$8(this, "collection", void 0);
+        _define_property$8(this, "ref", void 0);
+        _define_property$8(this, "testContext", void 0);
         this.collection = collection;
         this.ref = ref;
         this.testContext = testContext;
@@ -2008,7 +2008,7 @@ function _create_class$4(Constructor, protoProps, staticProps) {
     if (protoProps) _defineProperties$4(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$6(obj, key, value) {
+function _define_property$7(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -2040,7 +2040,7 @@ function _inherits$5(subClass, superClass) {
     });
     if (superClass) _set_prototype_of$5(subClass, superClass);
 }
-function _object_spread$4(target) {
+function _object_spread$5(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -2050,7 +2050,7 @@ function _object_spread$4(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$6(target, key, source[key]);
+            _define_property$7(target, key, source[key]);
         });
     }
     return target;
@@ -2265,12 +2265,12 @@ function _ts_generator$6(thisArg, body) {
     function FirebaseAdminTestContextInstance(app) {
         var _this = this;
         _class_call_check$5(this, FirebaseAdminTestContextInstance);
-        _define_property$6(this, "app", void 0);
-        _define_property$6(this, "getTestFirestoreInstance", cachedGetter(function() {
+        _define_property$7(this, "app", void 0);
+        _define_property$7(this, "getTestFirestoreInstance", cachedGetter(function() {
             var drivers = makeTestingFirestoreDrivers(googleCloudFirestoreDrivers());
             return new GoogleCloudTestFirestoreInstance(drivers, _this.firestore);
         }));
-        _define_property$6(this, "getTestFirebaseStorageInstance", cachedGetter(function() {
+        _define_property$7(this, "getTestFirebaseStorageInstance", cachedGetter(function() {
             var drivers = makeTestingFirebaseStorageDrivers(googleCloudFirebaseStorageDrivers());
             var defaultBucketId = _this.app.options.storageBucket;
             return new GoogleCloudTestFirebaseStorageInstance(drivers, _this.storage, defaultBucketId);
@@ -2340,7 +2340,7 @@ function _ts_generator$6(thisArg, body) {
  */ var AbstractFirebaseAdminTestContextInstanceChild = /*#__PURE__*/ function() {
     function AbstractFirebaseAdminTestContextInstanceChild(parent) {
         _class_call_check$5(this, AbstractFirebaseAdminTestContextInstanceChild);
-        _define_property$6(this, "parent", void 0);
+        _define_property$7(this, "parent", void 0);
         this.parent = parent;
     }
     _create_class$4(AbstractFirebaseAdminTestContextInstanceChild, [
@@ -2408,7 +2408,7 @@ function _ts_generator$6(thisArg, body) {
  * This can be used to easily build a testing context that sets up RulesTestEnvironment for tests that sets itself up and tears itself down.
  */ var firebaseAdminTestBuilder = testContextBuilder({
     buildConfig: function buildConfig(input) {
-        var config = _object_spread$4({}, input);
+        var config = _object_spread$5({}, input);
         return config;
     },
     buildFixture: function buildFixture() {
@@ -2535,7 +2535,7 @@ function _async_to_generator$5(fn) {
         });
     };
 }
-function _define_property$5(obj, key, value) {
+function _define_property$6(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -2548,7 +2548,7 @@ function _define_property$5(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$3(target) {
+function _object_spread$4(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -2558,7 +2558,7 @@ function _object_spread$3(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$5(target, key, source[key]);
+            _define_property$6(target, key, source[key]);
         });
     }
     return target;
@@ -2709,7 +2709,7 @@ function _ts_generator$5(thisArg, body) {
             return _async_to_generator$5(function() {
                 var _ref, request;
                 return _ts_generator$5(this, function(_state) {
-                    request = _object_spread_props$2(_object_spread$3({}, context), {
+                    request = _object_spread_props$2(_object_spread$4({}, context), {
                         data: data,
                         // NOTE: These will typically not be used/available as they are express.js properties that are not available or useful to the handlers
                         rawRequest: (_ref = context === null || context === void 0 ? void 0 : context.rawRequest) !== null && _ref !== void 0 ? _ref : {},
@@ -2842,7 +2842,7 @@ function _create_class$3(Constructor, protoProps, staticProps) {
     if (protoProps) _defineProperties$3(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$4(obj, key, value) {
+function _define_property$5(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -2882,7 +2882,7 @@ function _instanceof$1(left, right) {
         return left instanceof right;
     }
 }
-function _object_spread$2(target) {
+function _object_spread$3(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -2892,7 +2892,7 @@ function _object_spread$2(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$4(target, key, source[key]);
+            _define_property$5(target, key, source[key]);
         });
     }
     return target;
@@ -3171,7 +3171,7 @@ var functionsInitialized = false;
         var _this;
         _this = _call_super$4(this, FirebaseAdminFunctionTestContextInstance, [
             app
-        ]), _define_property$4(_this, "instance", void 0), _define_property$4(_this, "_fnWrapper", cachedGetter(function() {
+        ]), _define_property$5(_this, "instance", void 0), _define_property$5(_this, "_fnWrapper", cachedGetter(function() {
             return firebaseAdminCloudFunctionWrapper(_this.instance);
         }));
         _this.instance = instance;
@@ -3214,7 +3214,7 @@ var functionsInitialized = false;
  */ var firebaseAdminFunctionTestBuilder = testContextBuilder({
     buildConfig: function buildConfig(input) {
         var _ref;
-        var config = _object_spread_props$1(_object_spread$2({}, input), {
+        var config = _object_spread_props$1(_object_spread$3({}, input), {
             useFunctionSingletonContext: (_ref = input === null || input === void 0 ? void 0 : input.useFunctionSingletonContext) !== null && _ref !== void 0 ? _ref : DEFAULT_FIREBASE_ADMIN_FUNCTION_TEST_USE_FUNCTION_SINGLETON_CONTEXT
         });
         return config;
@@ -3421,7 +3421,7 @@ function _create_class$2(Constructor, protoProps, staticProps) {
     if (protoProps) _defineProperties$2(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$3(obj, key, value) {
+function _define_property$4(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3459,7 +3459,7 @@ function _iterable_to_array$1(iter) {
 function _non_iterable_spread$1() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$1(target) {
+function _object_spread$2(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -3469,7 +3469,7 @@ function _object_spread$1(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$3(target, key, source[key]);
+            _define_property$4(target, key, source[key]);
         });
     }
     return target;
@@ -3696,9 +3696,9 @@ function _ts_generator$3(thisArg, body) {
         var _this1;
         _this = _call_super$3(this, FirebaseAdminNestTestContextInstance, [
             parent
-        ]), _this1 = _this, _define_property$3(_this, "nest", void 0), _define_property$3(_this, "nestAppPromiseGetter", function() {
+        ]), _this1 = _this, _define_property$4(_this, "nest", void 0), _define_property$4(_this, "nestAppPromiseGetter", function() {
             return Promise.resolve(_this.nest);
-        }), _define_property$3(_this, "_loadInitializedNestApplication", cachedGetter(function() {
+        }), _define_property$4(_this, "_loadInitializedNestApplication", cachedGetter(function() {
             return _async_to_generator$3(function() {
                 var app;
                 return _ts_generator$3(this, function(_state) {
@@ -3811,7 +3811,7 @@ function _ts_generator$3(thisArg, body) {
                     switch(_state.label){
                         case 0:
                             additionalProviders = (_makeProviders = makeProviders(f.instance)) !== null && _makeProviders !== void 0 ? _makeProviders : [];
-                            rootModule = buildNestServerRootModule(_object_spread_props(_object_spread$1({}, serverInstanceConfig), {
+                            rootModule = buildNestServerRootModule(_object_spread_props(_object_spread$2({}, serverInstanceConfig), {
                                 modules: _to_consumable_array$1(asArray(nestModules)).concat(_to_consumable_array$1(asArray(serverInstanceConfig === null || serverInstanceConfig === void 0 ? void 0 : serverInstanceConfig.modules))),
                                 firebaseAppGetter: config.injectFirebaseServerAppTokenProvider ? asGetter(f.instance.app) : undefined,
                                 providers: additionalProviders,
@@ -3959,7 +3959,7 @@ function _create_class$1(Constructor, protoProps, staticProps) {
     if (protoProps) _defineProperties$1(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$2(obj, key, value) {
+function _define_property$3(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3991,7 +3991,7 @@ function _inherits$2(subClass, superClass) {
     });
     if (superClass) _set_prototype_of$2(subClass, superClass);
 }
-function _object_spread(target) {
+function _object_spread$1(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -4001,7 +4001,7 @@ function _object_spread(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$2(target, key, source[key]);
+            _define_property$3(target, key, source[key]);
         });
     }
     return target;
@@ -4160,7 +4160,7 @@ function _is_native_reflect_construct$2() {
  * @param buildTests - Callback that receives the child fixture and registers test cases.
  * @returns Whatever {@link firebaseAdminNestContextWithFixture} returns after registering the merged child fixture (typically `void`).
  */ function firebaseAdminFunctionNestContextWithFixture(config, f, buildTests) {
-    var mergedConfig = _object_spread({
+    var mergedConfig = _object_spread$1({
         makeFixture: function makeFixture(parent) {
             return new FirebaseAdminFunctionNestTestContextFixture(parent);
         },
@@ -4502,7 +4502,7 @@ function _class_call_check$1(instance, Constructor) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _define_property$1(obj, key, value) {
+function _define_property$2(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -4577,7 +4577,7 @@ function _is_native_reflect_construct$1() {
         var code = httpError.details.code;
         _this = _call_super$1(this, ExpectedHttpErrorWithSpecificServerErrorCode, [
             'Expected HttpError with an error code of "'.concat(expectedErrorCode, '", but recieved "').concat(code, '" instead.')
-        ]), _define_property$1(_this, "httpError", void 0), _define_property$1(_this, "expectedErrorCode", void 0);
+        ]), _define_property$2(_this, "httpError", void 0), _define_property$2(_this, "expectedErrorCode", void 0);
         _this.httpError = httpError;
         _this.expectedErrorCode = expectedErrorCode;
         return _this;
@@ -4674,6 +4674,19 @@ function _async_to_generator$1(fn) {
         });
     };
 }
+function _define_property$1(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
 function _iterable_to_array(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
@@ -4707,6 +4720,21 @@ function _non_iterable_rest() {
 function _non_iterable_spread() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
+function _object_spread(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$1(target, key, source[key]);
+        });
+    }
+    return target;
+}
 function _sliced_to_array(arr, i) {
     return _array_with_holes(arr) || _iterable_to_array_limit(arr, i) || _unsupported_iterable_to_array(arr, i) || _non_iterable_rest();
 }
@@ -4926,27 +4954,32 @@ function _ts_generator$1(thisArg, body) {
  * Admin-only scopes (e.g. `token.service`) are dropped from the default "all scopes" request because
  * the provider hard-rejects them for non-admin users, and this default flow logs in an arbitrary
  * (often non-admin) user. Tests that need an admin-only scope pass it explicitly via `config.scopes`.
+ * Both sources of the gate are excluded: the provider config's `adminOnlyScopes` and the scopes of any
+ * profile marked `adminOnly`.
  *
- * Provider-profile-gated scopes (e.g. `lms`, `reports`) are dropped for the same reason: they are
- * unlocked only for a client an admin has assigned the corresponding profile to, and this flow creates
- * a fresh client with no profiles — so the consent unlock gate hard-rejects them (finishing the
+ * Assignment-only profile-gated scopes (e.g. `lms`, `reports`) are dropped for the same reason: they
+ * are unlocked only for a client an admin has assigned the corresponding profile to, and this flow
+ * creates a fresh client with no profiles — so the consent unlock gate hard-rejects them (finishing the
  * interaction with `access_denied` and no `code`). Tests that need a gated scope create a client with
- * the profile and pass the scope explicitly via `config.scopes`.
+ * the profile and pass the scope explicitly via `config.scopes`. A scope unlocked by a DEFAULT profile
+ * is deliberately kept: a client with no profiles assigned resolves to the default profiles, so it can
+ * obtain that scope.
  *
  * @param nestApp - Initialized NestJS application used to resolve {@link OidcAccountService} when no scopes override is given.
  * @param config - Optional flow config; when `config.scopes` is set, it is returned verbatim.
  * @returns The space-separated scope string to pass to the `/oidc/auth` endpoint.
  */ function resolveScopes(nestApp, config) {
     return _async_to_generator$1(function() {
-        var result, _providerConfig_adminOnlyScopes, _providerConfig_providerProfiles, accountService, providerConfig, adminOnlyScopes, profileGatedScopes;
+        var result, _providerConfig_providerProfiles, _providerConfig_adminOnlyScopes, accountService, providerConfig, providerProfiles, adminOnlyScopes, profileGatedScopes;
         return _ts_generator$1(this, function(_state) {
             if (config === null || config === void 0 ? void 0 : config.scopes) {
                 result = config.scopes;
             } else {
                 accountService = nestApp.get(OidcAccountService);
                 providerConfig = accountService.providerConfig;
-                adminOnlyScopes = new Set((_providerConfig_adminOnlyScopes = providerConfig.adminOnlyScopes) !== null && _providerConfig_adminOnlyScopes !== void 0 ? _providerConfig_adminOnlyScopes : []);
-                profileGatedScopes = scopesForOidcProviderProfiles((_providerConfig_providerProfiles = providerConfig.providerProfiles) !== null && _providerConfig_providerProfiles !== void 0 ? _providerConfig_providerProfiles : []);
+                providerProfiles = (_providerConfig_providerProfiles = providerConfig.providerProfiles) !== null && _providerConfig_providerProfiles !== void 0 ? _providerConfig_providerProfiles : [];
+                adminOnlyScopes = new Set(_to_consumable_array((_providerConfig_adminOnlyScopes = providerConfig.adminOnlyScopes) !== null && _providerConfig_adminOnlyScopes !== void 0 ? _providerConfig_adminOnlyScopes : []).concat(_to_consumable_array(adminOnlyScopesForOidcProviderProfiles(providerProfiles))));
+                profileGatedScopes = assignmentOnlyScopesForOidcProviderProfiles(providerProfiles);
                 result = Object.keys(providerConfig.claims).filter(function(scope) {
                     return !adminOnlyScopes.has(scope) && !profileGatedScopes.has(scope);
                 }).join(' ');
@@ -4968,12 +5001,12 @@ function _ts_generator$1(thisArg, body) {
  * @param input.oidcClientService - Service used to create the OAuth client whose credentials drive the flow.
  * @param input.nestApp - Initialized NestJS application; used to resolve {@link OidcAccountService} for project-id-derived ID tokens and default scopes.
  * @param input.uid - Firebase user ID for whom the test ID token is minted and the OAuth flow is authorized.
- * @param input.config - Optional flow overrides (scopes, redirect URI, client name, token endpoint auth method).
+ * @param input.config - Optional flow overrides (scopes, redirect URI, client name, token endpoint auth method, provider profiles).
  * @returns The exchanged access token and ID token from the OIDC `/token` endpoint.
  * @throws {Error} When the token exchange step fails (the response body and status are included in the message).
  */ function performFullOAuthFlow(input) {
     return _async_to_generator$1(function() {
-        var _ref, _ref1, _ref2, server, oidcClientService, nestApp, uid, config, _createCookieJar, collectCookies, cookieHeader, redirectUri, clientName, tokenEndpointAuthMethod, scopes, _ref3, client_id, client_secret, codeVerifier, codeChallenge, authRes, loginUid, idToken, loginRes, resumeAfterLoginPath, consentRedirectRes, consentUid, consentRes, resumeAfterConsentPath, callbackRedirectRes, callbackUrl, authorizationCode, tokenRes;
+        var _ref, _ref1, _ref2, server, oidcClientService, nestApp, uid, config, _createCookieJar, collectCookies, cookieHeader, redirectUri, clientName, tokenEndpointAuthMethod, providerProfiles, scopes, _ref3, client_id, client_secret, codeVerifier, codeChallenge, authRes, loginUid, idToken, loginRes, resumeAfterLoginPath, consentRedirectRes, consentUid, consentRes, resumeAfterConsentPath, callbackRedirectRes, callbackUrl, authorizationCode, tokenRes;
         return _ts_generator$1(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -4982,6 +5015,7 @@ function _ts_generator$1(thisArg, body) {
                     redirectUri = (_ref = config === null || config === void 0 ? void 0 : config.redirectUri) !== null && _ref !== void 0 ? _ref : 'https://example.com/callback';
                     clientName = (_ref1 = config === null || config === void 0 ? void 0 : config.clientName) !== null && _ref1 !== void 0 ? _ref1 : 'test-oauth-context';
                     tokenEndpointAuthMethod = (_ref2 = config === null || config === void 0 ? void 0 : config.tokenEndpointAuthMethod) !== null && _ref2 !== void 0 ? _ref2 : 'client_secret_post';
+                    providerProfiles = config === null || config === void 0 ? void 0 : config.providerProfiles;
                     return [
                         4,
                         resolveScopes(nestApp, config)
@@ -4990,13 +5024,15 @@ function _ts_generator$1(thisArg, body) {
                     scopes = _state.sent();
                     return [
                         4,
-                        oidcClientService.createClient({
+                        oidcClientService.createClient(_object_spread({
                             client_name: clientName,
                             redirect_uris: [
                                 redirectUri
                             ],
                             token_endpoint_auth_method: tokenEndpointAuthMethod
-                        })
+                        }, providerProfiles == null ? {} : {
+                            dbx_provider_profiles: _to_consumable_array(providerProfiles)
+                        }))
                     ];
                 case 2:
                     _ref3 = _state.sent(), client_id = _ref3.client_id, client_secret = _ref3.client_secret;
@@ -5099,7 +5135,7 @@ function _ts_generator$1(thisArg, body) {
  *
  * @param nestApp - Initialized NestJS application from which {@link JwksService} and {@link OidcClientService} are resolved.
  * @param uid - Firebase user ID for whom the OAuth flow is authorized.
- * @param config - Optional flow overrides (scopes, redirect URI, client name, token endpoint auth method).
+ * @param config - Optional flow overrides (scopes, redirect URI, client name, token endpoint auth method, provider profiles).
  * @returns The exchanged access token and ID token from {@link performFullOAuthFlow}.
  */ function setupAndPerformFullOAuthFlow(nestApp, uid, config) {
     return _async_to_generator$1(function() {
@@ -5504,7 +5540,7 @@ function _ts_generator(thisArg, body) {
  * The returned factory function performs a full OAuth authorization code flow
  * and provides an authenticated supertest agent and helper methods.
  *
- * @param config - Optional flow overrides (scopes, redirect URI, client name, timeout) and custom fixture/instance constructors.
+ * @param config - Optional flow overrides (scopes, redirect URI, client name, provider profiles, timeout) and custom fixture/instance constructors.
  * @returns Function that, given parent fixtures and a `buildTests` callback, registers a `describe('(oauth)', ...)` block which performs the full OAuth flow and exposes the authenticated supertest fixture.
  *
  * @example
@@ -5533,7 +5569,7 @@ function _ts_generator(thisArg, body) {
         "makeFixture",
         "makeInstance"
     ]);
-    var flowConfig = flowConfigOverrides.scopes || flowConfigOverrides.redirectUri || flowConfigOverrides.clientName ? flowConfigOverrides : undefined;
+    var flowConfig = flowConfigOverrides.scopes || flowConfigOverrides.redirectUri || flowConfigOverrides.clientName || flowConfigOverrides.providerProfiles ? flowConfigOverrides : undefined;
     return function(params, buildTests) {
         var f = params.f, u = params.u;
         describe('(oauth)', function() {

package/test/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/test",
-  "version": "13.30.0",
+  "version": "13.31.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.30.0",
-    "@dereekb/date": "13.30.0",
-    "@dereekb/firebase": "13.30.0",
-    "@dereekb/firebase-server": "13.30.0",
-    "@dereekb/firebase-server/oidc": "13.30.0",
-    "@dereekb/model": "13.30.0",
-    "@dereekb/nestjs": "13.30.0",
-    "@dereekb/rxjs": "13.30.0",
-    "@dereekb/util": "13.30.0",
+    "@dereekb/analytics": "13.31.0",
+    "@dereekb/date": "13.31.0",
+    "@dereekb/firebase": "13.31.0",
+    "@dereekb/firebase-server": "13.31.0",
+    "@dereekb/firebase-server/oidc": "13.31.0",
+    "@dereekb/model": "13.31.0",
+    "@dereekb/nestjs": "13.31.0",
+    "@dereekb/rxjs": "13.31.0",
+    "@dereekb/util": "13.31.0",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@nestjs/common": "^11.1.19",
@@ -23,7 +23,7 @@
     "supertest": "^7.2.2"
   },
   "devDependencies": {
-    "@dereekb/nestjs": "13.30.0"
+    "@dereekb/nestjs": "13.31.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/test/src/lib/oidc/oidc.test.fixture.d.ts

@@ -1,5 +1,6 @@
 import request from 'supertest';
 import { type INestApplication } from '@nestjs/common';
+import { type OidcProviderProfileKey } from '@dereekb/firebase';
 import { AbstractTestContextFixture } from '@dereekb/util/test';
 import { type FirebaseAdminNestTestContextFixture } from '../firebase/firebase.admin.nest';
 import { type AuthorizedUserTestContextFixture } from '../firebase';
@@ -20,6 +21,13 @@ export interface OAuthAuthorizedSuperTestContextFactoryConfig {
      * Client name. Defaults to `'test-oauth-context'`.
      */
     readonly clientName?: string;
+    /**
+     * Provider profile keys assigned to the created OAuth client. Defaults to none.
+     *
+     * Needed to issue a token carrying an assignment-only profile-gated scope (e.g. `lms`); pair it
+     * with an explicit `scopes` string that requests that scope.
+     */
+    readonly providerProfiles?: readonly OidcProviderProfileKey[];
     /**
      * Vitest hook/test timeout in milliseconds. Defaults to `30_000`.
      */
@@ -120,7 +128,7 @@ export declare class OAuthAuthorizedSuperTestFixture extends AbstractTestContext
  * The returned factory function performs a full OAuth authorization code flow
  * and provides an authenticated supertest agent and helper methods.
  *
- * @param config - Optional flow overrides (scopes, redirect URI, client name, timeout) and custom fixture/instance constructors.
+ * @param config - Optional flow overrides (scopes, redirect URI, client name, provider profiles, timeout) and custom fixture/instance constructors.
  * @returns Function that, given parent fixtures and a `buildTests` callback, registers a `describe('(oauth)', ...)` block which performs the full OAuth flow and exposes the authenticated supertest fixture.
  *
  * @example

package/test/src/lib/oidc/oidc.test.flow.d.ts

@@ -1,5 +1,5 @@
 import { type INestApplication } from '@nestjs/common';
-import { type OidcTokenEndpointAuthMethod } from '@dereekb/firebase';
+import { type OidcProviderProfileKey, type OidcTokenEndpointAuthMethod } from '@dereekb/firebase';
 import { OidcClientService } from '@dereekb/firebase-server/oidc';
 /**
  * Configuration for {@link performFullOAuthFlow}.
@@ -23,6 +23,16 @@ export interface OAuthTestFlowConfig {
      * Token endpoint auth method. Defaults to `'client_secret_post'`.
      */
     readonly tokenEndpointAuthMethod?: OidcTokenEndpointAuthMethod;
+    /**
+     * Provider profile keys to assign to the test client (persisted as its `dbx_provider_profiles`
+     * client metadata). Defaults to none.
+     *
+     * Required to obtain an assignment-only profile-gated scope (e.g. `lms`): the consent unlock gate
+     * rejects any gated scope the client's assigned profiles do not unlock. Pair this with an explicit
+     * {@link OAuthTestFlowConfig.scopes} string containing the gated scope, since the default
+     * "all registered scopes" resolution deliberately drops assignment-only scopes.
+     */
+    readonly providerProfiles?: readonly OidcProviderProfileKey[];
 }
 export interface PerformFullOAuthFlowResult {
     readonly accessToken: string;
@@ -48,7 +58,7 @@ export interface PerformFullOAuthFlowInput {
  * @param input.oidcClientService - Service used to create the OAuth client whose credentials drive the flow.
  * @param input.nestApp - Initialized NestJS application; used to resolve {@link OidcAccountService} for project-id-derived ID tokens and default scopes.
  * @param input.uid - Firebase user ID for whom the test ID token is minted and the OAuth flow is authorized.
- * @param input.config - Optional flow overrides (scopes, redirect URI, client name, token endpoint auth method).
+ * @param input.config - Optional flow overrides (scopes, redirect URI, client name, token endpoint auth method, provider profiles).
  * @returns The exchanged access token and ID token from the OIDC `/token` endpoint.
  * @throws {Error} When the token exchange step fails (the response body and status are included in the message).
  */
@@ -61,7 +71,7 @@ export declare function performFullOAuthFlow(input: PerformFullOAuthFlowInput):
  *
  * @param nestApp - Initialized NestJS application from which {@link JwksService} and {@link OidcClientService} are resolved.
  * @param uid - Firebase user ID for whom the OAuth flow is authorized.
- * @param config - Optional flow overrides (scopes, redirect URI, client name, token endpoint auth method).
+ * @param config - Optional flow overrides (scopes, redirect URI, client name, token endpoint auth method, provider profiles).
  * @returns The exchanged access token and ID token from {@link performFullOAuthFlow}.
  */
 export declare function setupAndPerformFullOAuthFlow(nestApp: INestApplication, uid: string, config?: OAuthTestFlowConfig): Promise<PerformFullOAuthFlowResult>;

package/twilio/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@dereekb/firebase-server/twilio",
-  "version": "13.30.0",
+  "version": "13.31.0",
   "peerDependencies": {
-    "@dereekb/date": "13.30.0",
-    "@dereekb/firebase": "13.30.0",
-    "@dereekb/firebase-server": "13.30.0",
-    "@dereekb/model": "13.30.0",
-    "@dereekb/nestjs": "13.30.0",
-    "@dereekb/rxjs": "13.30.0",
-    "@dereekb/util": "13.30.0"
+    "@dereekb/date": "13.31.0",
+    "@dereekb/firebase": "13.31.0",
+    "@dereekb/firebase-server": "13.31.0",
+    "@dereekb/model": "13.31.0",
+    "@dereekb/nestjs": "13.31.0",
+    "@dereekb/rxjs": "13.31.0",
+    "@dereekb/util": "13.31.0"
   },
   "exports": {
     "./package.json": "./package.json",