@dereekb/firebase-server 13.31.0 → 13.33.0

package/model/src/lib/userexternalconnection/userexternalconnection.reader.service.d.ts

@@ -0,0 +1,157 @@
+import { type FactoryWithRequiredInput, type Maybe, type Milliseconds } from '@dereekb/util';
+import { type FirebaseAuthUserId, type FirebaseAuthUserIdRef, type UserExternalConnectionErrorCode, type UserExternalConnectionProviderType } from '@dereekb/firebase';
+import { type UserExternalConnectionAccessor, type UserExternalConnectionForProvider, type UserExternalConnectionReadParams } from './userexternalconnection.accessor.service';
+import { type UserExternalConnectionCredentials } from './userexternalconnection.private';
+import { type UserExternalConnectionCredentialsRefresher } from './userexternalconnection.refresh.service';
+import { type UserExternalConnectionCredentialsAndFailureWriter } from './userexternalconnection.action.server';
+/**
+ * How long before its stated expiration a set of credentials is treated as already expired.
+ *
+ * A token that expires mid-flight is indistinguishable from one that was never valid, so the check
+ * needs headroom. One minute matches the `tokenExpirationBuffer` default that the Cal.com and Zoho
+ * token factories already use, so a credential this reader hands out is one those factories would also
+ * consider live.
+ */
+export declare const DEFAULT_USER_EXTERNAL_CONNECTION_CREDENTIALS_EXPIRATION_BUFFER: Milliseconds;
+/**
+ * The error code recorded when a refresh attempt fails.
+ *
+ * `expired` rather than `revoked`: a failed refresh is nearly always `invalid_grant`, which does not
+ * distinguish a revoked grant from a refresh token that was already spent, and claiming the user
+ * revoked access when they did not would send the UI down the wrong path.
+ */
+export declare const DEFAULT_USER_EXTERNAL_CONNECTION_REFRESH_FAILURE_ERROR_CODE: UserExternalConnectionErrorCode;
+/**
+ * Configuration for {@link userExternalConnectionReader}.
+ */
+export interface UserExternalConnectionReaderConfig {
+    /**
+     * The paired read surface this reader adds policy on top of.
+     */
+    readonly accessor: UserExternalConnectionAccessor;
+    /**
+     * Used to persist a refresh and to record a failure. Both go through the paired write.
+     *
+     * Narrowed to those two writes: a full `UserExternalConnectionServerActions` satisfies it, and
+     * a caller wiring a reader over something else does not have to implement writes it never reaches.
+     */
+    readonly actions: UserExternalConnectionCredentialsAndFailureWriter;
+    /**
+     * Optional. Without one, expired credentials cannot be renewed and
+     * {@link UserExternalConnectionReaderProviderInstance.readUsableUserExternalConnectionCredentials}
+     * throws instead.
+     */
+    readonly refresher?: Maybe<UserExternalConnectionCredentialsRefresher>;
+    /**
+     * How long before its stated expiration a credential is treated as expired. Defaults to
+     * {@link DEFAULT_USER_EXTERNAL_CONNECTION_CREDENTIALS_EXPIRATION_BUFFER}.
+     */
+    readonly expirationBuffer?: Maybe<Milliseconds>;
+}
+/**
+ * Why a provider rejected a user's credentials.
+ */
+export interface UserExternalConnectionReportFailureInput {
+    /**
+     * Why the credentials were rejected. Defaults to `unauthorized`, the code for the 401 this is
+     * almost always called in response to.
+     */
+    readonly error?: Maybe<UserExternalConnectionErrorCode>;
+}
+/**
+ * Parameters for reporting that a provider rejected a user's credentials.
+ */
+export interface UserExternalConnectionReportFailureParams extends UserExternalConnectionReadParams, UserExternalConnectionReportFailureInput {
+}
+/**
+ * Input identifying the user a {@link UserExternalConnectionReaderUserInstance} reads for.
+ */
+export interface UserExternalConnectionReaderUserInput extends FirebaseAuthUserIdRef {
+}
+/**
+ * A {@link UserExternalConnectionReader} narrowed to ONE user and ONE provider.
+ *
+ * The reader's entire read surface, with `{ uid, providerType }` already applied — so a consumer acting
+ * as one user against one provider, the normal case for code making provider API calls, states that
+ * pair once instead of at every call and cannot accidentally mix two providers up.
+ */
+export interface UserExternalConnectionReaderProviderInstance {
+    readonly uid: FirebaseAuthUserId;
+    readonly providerType: UserExternalConnectionProviderType;
+    /**
+     * Loads both halves of the pair, applying no policy. Never throws for an absent or unusable
+     * connection.
+     */
+    readUserExternalConnectionForProvider(): Promise<UserExternalConnectionForProvider>;
+    /**
+     * Loads the stored credentials as-is, applying no policy. They may be expired.
+     */
+    readUserExternalConnectionCredentials(): Promise<Maybe<UserExternalConnectionCredentials>>;
+    /**
+     * Returns credentials that are safe to attempt a provider call with, renewing them first if needed.
+     *
+     * @throws When the user is not connected to the provider, or the credentials have expired and could
+     *   not be renewed.
+     */
+    readUsableUserExternalConnectionCredentials(): Promise<UserExternalConnectionCredentials>;
+    /**
+     * Records that the provider rejected these credentials, moving the entry to the `error` status.
+     *
+     * Exists so a caller that gets a 401 mid-call can report it without reaching for the write surface.
+     * Never throws — a failure to record a failure is logged and swallowed, because the caller is already
+     * handling an error and losing that error to this one would be worse.
+     *
+     * @param input - Why the credentials were rejected. Defaults to `unauthorized`.
+     */
+    reportUserExternalConnectionFailure(input?: Maybe<UserExternalConnectionReportFailureInput>): Promise<void>;
+}
+/**
+ * A {@link UserExternalConnectionReader} narrowed to one user, awaiting the provider to target.
+ *
+ * The second of the reader's two factory levels. Splitting them this way is what lets ONE reader — the
+ * app has a single provider-agnostic instance — be narrowed to a user once and then used against any
+ * number of that user's providers.
+ */
+export type UserExternalConnectionReaderUserInstance = FactoryWithRequiredInput<UserExternalConnectionReaderProviderInstance, UserExternalConnectionProviderType>;
+/**
+ * Reads a user's third-party credentials for a specific provider, and keeps them usable.
+ *
+ * The read surface a consumer should reach for. It wraps a {@link UserExternalConnectionAccessor} and
+ * adds the policy that would otherwise be re-implemented at every call site: whether the connection is
+ * usable, whether the credentials are near enough to expiring to renew, renewing them, persisting the
+ * result, and recording a failure.
+ *
+ * A consumer that has this does not need `UserExternalConnectionServerActions` at all, which is
+ * the point — that class is the write surface.
+ */
+export declare abstract class UserExternalConnectionReader {
+    /**
+     * Narrows this reader to one user, returning a factory that narrows it further to one provider.
+     *
+     * The reader's only entry point. Every read and the failure report live on the narrowed instance, so
+     * a caller states the user and provider it is acting for once instead of threading that pair through
+     * each call:
+     *
+     * ```ts
+     * const connections = reader.readerForUser({ uid });
+     * const credentials = await connections(CALCOM).readUsableUserExternalConnectionCredentials();
+     * ```
+     *
+     * @param input - The user to read for.
+     * @returns A factory producing a reader for whichever of that user's providers is needed.
+     */
+    abstract readerForUser(input: UserExternalConnectionReaderUserInput): UserExternalConnectionReaderUserInstance;
+}
+/**
+ * Reference to a {@link UserExternalConnectionReader} instance.
+ */
+export interface UserExternalConnectionReaderRef {
+    readonly userExternalConnectionReader: UserExternalConnectionReader;
+}
+/**
+ * Creates a {@link UserExternalConnectionReader}.
+ *
+ * @param config - The accessor and actions to build over, plus the optional refresher.
+ * @returns A concrete UserExternalConnectionReader implementation.
+ */
+export declare function userExternalConnectionReader(config: UserExternalConnectionReaderConfig): UserExternalConnectionReader;

package/model/src/lib/userexternalconnection/userexternalconnection.refresh.service.d.ts

@@ -0,0 +1,46 @@
+import { type Maybe } from '@dereekb/util';
+import { type FirebaseAuthUserId, type UserExternalConnectionProviderType } from '@dereekb/firebase';
+import { type UserExternalConnectionCredentials } from './userexternalconnection.private';
+/**
+ * Input for {@link UserExternalConnectionCredentialsRefresher.refreshUserExternalConnectionCredentials}.
+ */
+export interface UserExternalConnectionRefreshCredentialsInput {
+    readonly uid: FirebaseAuthUserId;
+    readonly providerType: UserExternalConnectionProviderType;
+    /**
+     * The credentials currently stored for this provider.
+     *
+     * Passed whole rather than as a bare refresh token because a refresh can need more than that:
+     * Zoho's refresh must be sent to the datacenter that issued the grant, which is only recorded on
+     * `extra`.
+     */
+    readonly credentials: UserExternalConnectionCredentials;
+}
+/**
+ * Exchanges a user's stored credentials for fresh ones.
+ *
+ * Declared here rather than beside the OAuth registry on purpose: {@link UserExternalConnectionReader}
+ * takes a refresher as OPTIONAL configuration, and if the reader could only be configured with a
+ * registry-backed one it would have to import the OAuth layer — whose provider services depend on the
+ * accessor the reader is built over. Keeping this an interface in the middle is what keeps that graph
+ * acyclic, and it also lets a caller supply a refresher that has nothing to do with OAuth.
+ *
+ * Implementations return the credentials the provider issued, and are NOT responsible for carrying
+ * forward values the provider's response omits — see `mergeRefreshedUserExternalConnectionCredentials`,
+ * which the reader applies to every result.
+ */
+export declare abstract class UserExternalConnectionCredentialsRefresher {
+    /**
+     * Refreshes one provider's credentials.
+     *
+     * @param input - The acting user, the provider, and the credentials currently stored.
+     * @returns The refreshed credentials, or null when this provider has no refresh path at all.
+     */
+    abstract refreshUserExternalConnectionCredentials(input: UserExternalConnectionRefreshCredentialsInput): Promise<Maybe<UserExternalConnectionCredentials>>;
+}
+/**
+ * Reference to a {@link UserExternalConnectionCredentialsRefresher} instance.
+ */
+export interface UserExternalConnectionCredentialsRefresherRef {
+    readonly userExternalConnectionCredentialsRefresher: UserExternalConnectionCredentialsRefresher;
+}

package/oidc/index.cjs.js

@@ -6219,7 +6219,7 @@ var OidcInteractionController_1;
      * @throws {HttpException} HTTP 400 when the consent interaction cannot be completed.
      */ function postConsent(uid, body, res) {
                 return _async_to_generator$2(function() {
-                    var startedAt, clientId, accountId, _ref, _prompt_details_missingOIDCScope, _this_accountService_providerConfig_adminOnlyScopes, _ref1, _ref2, _ref3, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, _ref4, redirectTo, interaction, prompt, params, session, missingOIDCScope, existingGrant, _tmp, encounteredOIDCScopes, clientPayload, requestedOIDCScopeSet, providerProfiles, configAdminOnlyScopes, adminOnlyScopes, requestedAdminOnlyScopes, requestsServiceToken, isAdmin, _tmp1, _ref5, redirectTo1, _oidcClientProviderProfileScopes, clientUnlockedScopes, clientRequiredScopes, profileGatedScopes, disallowedGatedScopes, _ref6, redirectTo2, missingRequiredScopes, _ref7, redirectTo3, requestedRawTtl, clientMaxSessionTtl, expiresInSeconds, grant, _tmp2, _resolveEffectiveSubset, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset1, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset2, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, _ref8, redirectTo4, err;
+                    var startedAt, clientId, accountId, _ref, _prompt_details_missingOIDCScope, _ref1, _this_accountService_providerConfig_adminOnlyScopes, _ref2, _ref3, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, _ref4, redirectTo, interaction, prompt, params, session, missingOIDCScope, existingGrant, _tmp, encounteredOIDCScopes, clientPayload, requestedOIDCScopeSet, providerProfiles, _oidcClientProviderProfileScopes, clientUnlockedScopes, clientRequiredScopes, profileGatedScopes, disallowedGatedScopes, _ref5, redirectTo1, missingRequiredScopes, _ref6, redirectTo2, effectiveOIDCScopes, heldOIDCScopes, consentedOIDCScopeSet, configAdminOnlyScopes, adminOnlyScopes, consentedAdminOnlyScopes, requestsServiceToken, isAdmin, _tmp1, _ref7, redirectTo3, requestedRawTtl, clientMaxSessionTtl, expiresInSeconds, grant, _tmp2, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _ref8, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset1, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, _ref9, redirectTo4, err;
                     return _ts_generator$2(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -6301,66 +6301,44 @@ var OidcInteractionController_1;
                                 ];
                             case 9:
                                 clientPayload = _state.sent();
-                                // Admin-only scope gate. The requested OIDC scope set is `missingOIDCScope ∪ encounteredOIDCScopes`
-                                // (a fresh consent has everything in `missing`; a re-consent may carry already-granted scopes in
-                                // `encountered`). If that set intersects the admin-only scopes — the provider's `adminOnlyScopes`
-                                // unioned with the scopes of every profile marked `adminOnly` — and the resolving user is not an
-                                // admin, hard-reject with `access_denied` rather than silently dropping the scope.
+                                // The requested OIDC scope set is `missingOIDCScope ∪ encounteredOIDCScopes` (a fresh consent has
+                                // everything in `missing`; a re-consent may carry already-granted scopes in `encountered`). The two
+                                // provider-profile gates below judge the REQUEST — what this client may ask for at all — so they
+                                // read this set. The admin-only gate further down judges what the user actually consented to
+                                // instead, and reads `consentedOIDCScopeSet`.
                                 requestedOIDCScopeSet = new Set(_to_consumable_array$1(missingOIDCScope).concat(_to_consumable_array$1(encounteredOIDCScopes)));
                                 providerProfiles = this.accountService.providerConfig.providerProfiles;
-                                configAdminOnlyScopes = (_this_accountService_providerConfig_adminOnlyScopes = this.accountService.providerConfig.adminOnlyScopes) !== null && _this_accountService_providerConfig_adminOnlyScopes !== void 0 ? _this_accountService_providerConfig_adminOnlyScopes : [];
-                                adminOnlyScopes = new Set(_to_consumable_array$1(configAdminOnlyScopes).concat(_to_consumable_array$1(firebase.adminOnlyScopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []))));
-                                requestedAdminOnlyScopes = Array.from(adminOnlyScopes).filter(function(scope) {
-                                    return requestedOIDCScopeSet.has(scope);
-                                });
-                                // Deliberately sourced from the provider config's `adminOnlyScopes` ALONE, unlike the gate above:
-                                // this flag also selects the (highest) service-token TTL tier further down, and a profile marked
-                                // `adminOnly` must gate by admin status WITHOUT widening its grant's lifetime to that tier.
-                                requestsServiceToken = configAdminOnlyScopes.some(function(scope) {
-                                    return requestedOIDCScopeSet.has(scope);
+                                // Provider-profile scope gate. Any scope referenced by a provider profile is "gated" — available
+                                // only to clients whose assigned profiles unlock it (a client with NO assigned profiles resolves
+                                // to the registry's default profiles). Independent of the admin-only gate below; a scope may be
+                                // subject to both.
+                                _oidcClientProviderProfileScopes = oidcClientProviderProfileScopes(providerProfiles, (_ref1 = clientPayload === null || clientPayload === void 0 ? void 0 : clientPayload.dbx_provider_profiles) !== null && _ref1 !== void 0 ? _ref1 : undefined), clientUnlockedScopes = _oidcClientProviderProfileScopes.unlocked, clientRequiredScopes = _oidcClientProviderProfileScopes.required;
+                                profileGatedScopes = firebase.scopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []);
+                                // Unlock gate: reject any requested gated scope this client's profiles do not unlock.
+                                disallowedGatedScopes = Array.from(requestedOIDCScopeSet).filter(function(scope) {
+                                    return profileGatedScopes.has(scope) && !clientUnlockedScopes.has(scope);
                                 });
-                                if (!accountId) return [
+                                if (!(disallowedGatedScopes.length > 0)) return [
                                     3,
                                     11
                                 ];
-                                return [
-                                    4,
-                                    (_ref1 = (_this_accountService_delegate_isAdminUser = (_this_accountService_delegate = this.accountService.delegate).isAdminUser) === null || _this_accountService_delegate_isAdminUser === void 0 ? void 0 : _this_accountService_delegate_isAdminUser.call(_this_accountService_delegate, this.accountService.userContext(accountId).authUserContext)) !== null && _ref1 !== void 0 ? _ref1 : false
-                                ];
-                            case 10:
-                                _tmp1 = _state.sent();
-                                return [
-                                    3,
-                                    12
-                                ];
-                            case 11:
-                                _tmp1 = false;
-                                _state.label = 12;
-                            case 12:
-                                isAdmin = _tmp1;
-                                if (!(requestedAdminOnlyScopes.length > 0 && !isAdmin)) return [
-                                    3,
-                                    14
-                                ];
                                 return [
                                     4,
                                     this.oidcInteractionService.finishInteractionByUid(uid, {
                                         error: 'access_denied',
-                                        error_description: "The following scope(s) are restricted to admins: ".concat(requestedAdminOnlyScopes.join(', '), ".")
+                                        error_description: "The following scope(s) are not available to this client: ".concat(disallowedGatedScopes.join(', '), ".")
                                     }, {
                                         mergeWithLastSubmission: true
                                     })
                                 ];
-                            case 13:
+                            case 10:
                                 _ref5 = _state.sent(), redirectTo1 = _ref5.returnTo;
                                 emitOidcAnalyticsEvent(this._analytics, {
                                     type: 'consent',
                                     isSuccessful: false,
                                     uid: accountId,
                                     clientId: clientId,
-                                    serviceToken: requestsServiceToken,
-                                    isAdmin: false,
-                                    reason: 'service_token_non_admin',
+                                    reason: 'scope_not_unlocked_for_client',
                                     durationMs: Date.now() - startedAt
                                 }, this._logger);
                                 res.json({
@@ -6369,38 +6347,33 @@ var OidcInteractionController_1;
                                 return [
                                     2
                                 ];
-                            case 14:
-                                // Provider-profile scope gate. Any scope referenced by a provider profile is "gated" — available
-                                // only to clients whose assigned profiles unlock it (a client with NO assigned profiles resolves
-                                // to the registry's default profiles). Independent of the admin-only gate above; a scope may be
-                                // subject to both.
-                                _oidcClientProviderProfileScopes = oidcClientProviderProfileScopes(providerProfiles, (_ref2 = clientPayload === null || clientPayload === void 0 ? void 0 : clientPayload.dbx_provider_profiles) !== null && _ref2 !== void 0 ? _ref2 : undefined), clientUnlockedScopes = _oidcClientProviderProfileScopes.unlocked, clientRequiredScopes = _oidcClientProviderProfileScopes.required;
-                                profileGatedScopes = firebase.scopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []);
-                                // Unlock gate: reject any requested gated scope this client's profiles do not unlock.
-                                disallowedGatedScopes = Array.from(requestedOIDCScopeSet).filter(function(scope) {
-                                    return profileGatedScopes.has(scope) && !clientUnlockedScopes.has(scope);
+                            case 11:
+                                // Required gate: a scope a client's profiles force-require (`require: 'required'`) must be present
+                                // in the request. Reject when the client did not request a required scope.
+                                missingRequiredScopes = Array.from(clientRequiredScopes).filter(function(scope) {
+                                    return !requestedOIDCScopeSet.has(scope);
                                 });
-                                if (!(disallowedGatedScopes.length > 0)) return [
+                                if (!(missingRequiredScopes.length > 0)) return [
                                     3,
-                                    16
+                                    13
                                 ];
                                 return [
                                     4,
                                     this.oidcInteractionService.finishInteractionByUid(uid, {
                                         error: 'access_denied',
-                                        error_description: "The following scope(s) are not available to this client: ".concat(disallowedGatedScopes.join(', '), ".")
+                                        error_description: "This client must request the required scope(s): ".concat(missingRequiredScopes.join(', '), ".")
                                     }, {
                                         mergeWithLastSubmission: true
                                     })
                                 ];
-                            case 15:
+                            case 12:
                                 _ref6 = _state.sent(), redirectTo2 = _ref6.returnTo;
                                 emitOidcAnalyticsEvent(this._analytics, {
                                     type: 'consent',
                                     isSuccessful: false,
                                     uid: accountId,
                                     clientId: clientId,
-                                    reason: 'scope_not_unlocked_for_client',
+                                    reason: 'required_scope_missing',
                                     durationMs: Date.now() - startedAt
                                 }, this._logger);
                                 res.json({
@@ -6409,13 +6382,62 @@ var OidcInteractionController_1;
                                 return [
                                     2
                                 ];
-                            case 16:
-                                // Required gate: a scope a client's profiles force-require (`require: 'required'`) must be present
-                                // in the request. Reject when the client did not request a required scope.
-                                missingRequiredScopes = Array.from(clientRequiredScopes).filter(function(scope) {
-                                    return !requestedOIDCScopeSet.has(scope);
+                            case 13:
+                                // The scopes this consent actually puts in force. Resolved once here and re-applied to the grant
+                                // further down, so the admin-only gate below judges exactly the set that will be granted.
+                                //
+                                // Force-grants the client's required profile scopes (in addition to `openid`) so they cannot be
+                                // dropped at consent — the required gate above already guarantees they were requested.
+                                effectiveOIDCScopes = resolveEffectiveSubset({
+                                    missing: missingOIDCScope,
+                                    requestedSubset: body.grantedOIDCScopes,
+                                    alwaysGranted: _to_consumable_array$1(ALWAYS_GRANTED_OIDC_SCOPES).concat(_to_consumable_array$1(clientRequiredScopes)),
+                                    alreadyEncountered: encounteredOIDCScopes
                                 });
-                                if (!(missingRequiredScopes.length > 0)) return [
+                                // Scopes the existing Grant already holds (granted, minus any it rejected). Nothing here revokes
+                                // them, so they stay in force through this consent and the gate below has to count them too.
+                                heldOIDCScopes = existingGrant ? existingGrant.getOIDCScope().split(' ').filter(Boolean) : [];
+                                consentedOIDCScopeSet = new Set(_to_consumable_array$1(heldOIDCScopes).concat(_to_consumable_array$1(effectiveOIDCScopes.granted)));
+                                // Admin-only scope gate. If the consented set intersects the admin-only scopes — the provider's
+                                // `adminOnlyScopes` unioned with the scopes of every profile marked `adminOnly` — and the resolving
+                                // user is not an admin, hard-reject with `access_denied` rather than silently dropping the scope.
+                                //
+                                // Deliberately gated on what the user CONSENTED to rather than on what the client requested: the
+                                // consent UI renders a deselectable checkbox for every scope in the auth request, and a client
+                                // cannot know the caller's admin status when it builds that request. Gating on the request would
+                                // make an admin-only scope in `scopes_supported` fatal for every non-admin — deselecting it at
+                                // consent has to be a way through.
+                                configAdminOnlyScopes = (_this_accountService_providerConfig_adminOnlyScopes = this.accountService.providerConfig.adminOnlyScopes) !== null && _this_accountService_providerConfig_adminOnlyScopes !== void 0 ? _this_accountService_providerConfig_adminOnlyScopes : [];
+                                adminOnlyScopes = new Set(_to_consumable_array$1(configAdminOnlyScopes).concat(_to_consumable_array$1(firebase.adminOnlyScopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []))));
+                                consentedAdminOnlyScopes = Array.from(adminOnlyScopes).filter(function(scope) {
+                                    return consentedOIDCScopeSet.has(scope);
+                                });
+                                // Deliberately sourced from the provider config's `adminOnlyScopes` ALONE, unlike the gate above:
+                                // this flag also selects the (highest) service-token TTL tier further down, and a profile marked
+                                // `adminOnly` must gate by admin status WITHOUT widening its grant's lifetime to that tier.
+                                requestsServiceToken = configAdminOnlyScopes.some(function(scope) {
+                                    return consentedOIDCScopeSet.has(scope);
+                                });
+                                if (!accountId) return [
+                                    3,
+                                    15
+                                ];
+                                return [
+                                    4,
+                                    (_ref2 = (_this_accountService_delegate_isAdminUser = (_this_accountService_delegate = this.accountService.delegate).isAdminUser) === null || _this_accountService_delegate_isAdminUser === void 0 ? void 0 : _this_accountService_delegate_isAdminUser.call(_this_accountService_delegate, this.accountService.userContext(accountId).authUserContext)) !== null && _ref2 !== void 0 ? _ref2 : false
+                                ];
+                            case 14:
+                                _tmp1 = _state.sent();
+                                return [
+                                    3,
+                                    16
+                                ];
+                            case 15:
+                                _tmp1 = false;
+                                _state.label = 16;
+                            case 16:
+                                isAdmin = _tmp1;
+                                if (!(consentedAdminOnlyScopes.length > 0 && !isAdmin)) return [
                                     3,
                                     18
                                 ];
@@ -6423,7 +6445,7 @@ var OidcInteractionController_1;
                                     4,
                                     this.oidcInteractionService.finishInteractionByUid(uid, {
                                         error: 'access_denied',
-                                        error_description: "This client must request the required scope(s): ".concat(missingRequiredScopes.join(', '), ".")
+                                        error_description: "The following scope(s) are restricted to admins: ".concat(consentedAdminOnlyScopes.join(', '), ".")
                                     }, {
                                         mergeWithLastSubmission: true
                                     })
@@ -6435,7 +6457,9 @@ var OidcInteractionController_1;
                                     isSuccessful: false,
                                     uid: accountId,
                                     clientId: clientId,
-                                    reason: 'required_scope_missing',
+                                    serviceToken: requestsServiceToken,
+                                    isAdmin: false,
+                                    reason: 'service_token_non_admin',
                                     durationMs: Date.now() - startedAt
                                 }, this._logger);
                                 res.json({
@@ -6478,14 +6502,7 @@ var OidcInteractionController_1;
                             case 21:
                                 grant = _tmp2;
                                 if (missingOIDCScope.length > 0) {
-                                    // Force-grant the client's required profile scopes (in addition to `openid`) so they cannot be
-                                    // dropped at consent — the required gate above already guarantees they were requested.
-                                    _resolveEffectiveSubset = resolveEffectiveSubset({
-                                        missing: missingOIDCScope,
-                                        requestedSubset: body.grantedOIDCScopes,
-                                        alwaysGranted: _to_consumable_array$1(ALWAYS_GRANTED_OIDC_SCOPES).concat(_to_consumable_array$1(clientRequiredScopes)),
-                                        alreadyEncountered: encounteredOIDCScopes
-                                    }), granted = _resolveEffectiveSubset.granted, rejected = _resolveEffectiveSubset.rejected;
+                                    granted = effectiveOIDCScopes.granted, rejected = effectiveOIDCScopes.rejected;
                                     if (granted.length > 0) {
                                         grant.addOIDCScope(granted.join(' '));
                                     }
@@ -6513,11 +6530,11 @@ var OidcInteractionController_1;
                                 encounteredOIDCClaims = grant.getOIDCClaimsEncountered();
                                 missingOIDCClaims = (_prompt_details_missingOIDCClaims = prompt.details.missingOIDCClaims) !== null && _prompt_details_missingOIDCClaims !== void 0 ? _prompt_details_missingOIDCClaims : [];
                                 if (missingOIDCClaims.length > 0) {
-                                    _resolveEffectiveSubset1 = resolveEffectiveSubset({
+                                    _resolveEffectiveSubset = resolveEffectiveSubset({
                                         missing: missingOIDCClaims,
                                         requestedSubset: body.grantedOIDCClaims,
                                         alreadyEncountered: encounteredOIDCClaims
-                                    }), granted1 = _resolveEffectiveSubset1.granted, rejected1 = _resolveEffectiveSubset1.rejected;
+                                    }), granted1 = _resolveEffectiveSubset.granted, rejected1 = _resolveEffectiveSubset.rejected;
                                     if (granted1.length > 0) {
                                         grant.addOIDCClaims(granted1);
                                     }
@@ -6531,13 +6548,22 @@ var OidcInteractionController_1;
                                     for(_iterator1 = Object.entries(missingResourceScopes)[Symbol.iterator](); !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
                                         _step_value = _sliced_to_array(_step1.value, 2), indicator = _step_value[0], scopes = _step_value[1];
                                         ;
-                                        requestedSubset = (_body_grantedResourceScopes = body.grantedResourceScopes) === null || _body_grantedResourceScopes === void 0 ? void 0 : _body_grantedResourceScopes[indicator];
+                                        ;
+                                        // A submission with no explicit per-resource selection falls back to the OIDC scope selection
+                                        // rather than granting everything the resource server declares. A resource server's scope list
+                                        // is drawn from the same provider scopes the consent UI renders as one checkbox list, so a scope
+                                        // deselected there must not reappear on the resource-bound access token — otherwise deselecting
+                                        // an admin-only scope would clear the gate above while the token still carried it.
+                                        // `grantedOIDCScopes` being absent still means "grant everything requested".
+                                        requestedSubset = (_ref8 = (_body_grantedResourceScopes = body.grantedResourceScopes) === null || _body_grantedResourceScopes === void 0 ? void 0 : _body_grantedResourceScopes[indicator]) !== null && _ref8 !== void 0 ? _ref8 : body.grantedOIDCScopes ? scopes.filter(function(scope) {
+                                            return consentedOIDCScopeSet.has(scope);
+                                        }) : undefined;
                                         encounteredResourceScopes = grant.getResourceScopeEncountered(indicator).split(' ').filter(Boolean);
-                                        _resolveEffectiveSubset2 = resolveEffectiveSubset({
+                                        _resolveEffectiveSubset1 = resolveEffectiveSubset({
                                             missing: scopes,
                                             requestedSubset: requestedSubset,
                                             alreadyEncountered: encounteredResourceScopes
-                                        }), granted2 = _resolveEffectiveSubset2.granted, rejected2 = _resolveEffectiveSubset2.rejected;
+                                        }), granted2 = _resolveEffectiveSubset1.granted, rejected2 = _resolveEffectiveSubset1.rejected;
                                         if (granted2.length > 0) {
                                             grant.addResourceScope(indicator, granted2.join(' '));
                                         }
@@ -6593,7 +6619,7 @@ var OidcInteractionController_1;
                                     })
                                 ];
                             case 23:
-                                _ref8 = _state.sent(), redirectTo4 = _ref8.returnTo;
+                                _ref9 = _state.sent(), redirectTo4 = _ref9.returnTo;
                                 emitOidcAnalyticsEvent(this._analytics, {
                                     type: 'consent',
                                     isSuccessful: true,