@dereekb/firebase-server 13.32.0 → 13.33.0

package/oidc/index.cjs.js

@@ -6219,7 +6219,7 @@ var OidcInteractionController_1;
      * @throws {HttpException} HTTP 400 when the consent interaction cannot be completed.
      */ function postConsent(uid, body, res) {
                 return _async_to_generator$2(function() {
-                    var startedAt, clientId, accountId, _ref, _prompt_details_missingOIDCScope, _this_accountService_providerConfig_adminOnlyScopes, _ref1, _ref2, _ref3, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, _ref4, redirectTo, interaction, prompt, params, session, missingOIDCScope, existingGrant, _tmp, encounteredOIDCScopes, clientPayload, requestedOIDCScopeSet, providerProfiles, configAdminOnlyScopes, adminOnlyScopes, requestedAdminOnlyScopes, requestsServiceToken, isAdmin, _tmp1, _ref5, redirectTo1, _oidcClientProviderProfileScopes, clientUnlockedScopes, clientRequiredScopes, profileGatedScopes, disallowedGatedScopes, _ref6, redirectTo2, missingRequiredScopes, _ref7, redirectTo3, requestedRawTtl, clientMaxSessionTtl, expiresInSeconds, grant, _tmp2, _resolveEffectiveSubset, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset1, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset2, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, _ref8, redirectTo4, err;
+                    var startedAt, clientId, accountId, _ref, _prompt_details_missingOIDCScope, _ref1, _this_accountService_providerConfig_adminOnlyScopes, _ref2, _ref3, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, _ref4, redirectTo, interaction, prompt, params, session, missingOIDCScope, existingGrant, _tmp, encounteredOIDCScopes, clientPayload, requestedOIDCScopeSet, providerProfiles, _oidcClientProviderProfileScopes, clientUnlockedScopes, clientRequiredScopes, profileGatedScopes, disallowedGatedScopes, _ref5, redirectTo1, missingRequiredScopes, _ref6, redirectTo2, effectiveOIDCScopes, heldOIDCScopes, consentedOIDCScopeSet, configAdminOnlyScopes, adminOnlyScopes, consentedAdminOnlyScopes, requestsServiceToken, isAdmin, _tmp1, _ref7, redirectTo3, requestedRawTtl, clientMaxSessionTtl, expiresInSeconds, grant, _tmp2, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _ref8, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset1, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, _ref9, redirectTo4, err;
                     return _ts_generator$2(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -6301,66 +6301,44 @@ var OidcInteractionController_1;
                                 ];
                             case 9:
                                 clientPayload = _state.sent();
-                                // Admin-only scope gate. The requested OIDC scope set is `missingOIDCScope ∪ encounteredOIDCScopes`
-                                // (a fresh consent has everything in `missing`; a re-consent may carry already-granted scopes in
-                                // `encountered`). If that set intersects the admin-only scopes — the provider's `adminOnlyScopes`
-                                // unioned with the scopes of every profile marked `adminOnly` — and the resolving user is not an
-                                // admin, hard-reject with `access_denied` rather than silently dropping the scope.
+                                // The requested OIDC scope set is `missingOIDCScope ∪ encounteredOIDCScopes` (a fresh consent has
+                                // everything in `missing`; a re-consent may carry already-granted scopes in `encountered`). The two
+                                // provider-profile gates below judge the REQUEST — what this client may ask for at all — so they
+                                // read this set. The admin-only gate further down judges what the user actually consented to
+                                // instead, and reads `consentedOIDCScopeSet`.
                                 requestedOIDCScopeSet = new Set(_to_consumable_array$1(missingOIDCScope).concat(_to_consumable_array$1(encounteredOIDCScopes)));
                                 providerProfiles = this.accountService.providerConfig.providerProfiles;
-                                configAdminOnlyScopes = (_this_accountService_providerConfig_adminOnlyScopes = this.accountService.providerConfig.adminOnlyScopes) !== null && _this_accountService_providerConfig_adminOnlyScopes !== void 0 ? _this_accountService_providerConfig_adminOnlyScopes : [];
-                                adminOnlyScopes = new Set(_to_consumable_array$1(configAdminOnlyScopes).concat(_to_consumable_array$1(firebase.adminOnlyScopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []))));
-                                requestedAdminOnlyScopes = Array.from(adminOnlyScopes).filter(function(scope) {
-                                    return requestedOIDCScopeSet.has(scope);
-                                });
-                                // Deliberately sourced from the provider config's `adminOnlyScopes` ALONE, unlike the gate above:
-                                // this flag also selects the (highest) service-token TTL tier further down, and a profile marked
-                                // `adminOnly` must gate by admin status WITHOUT widening its grant's lifetime to that tier.
-                                requestsServiceToken = configAdminOnlyScopes.some(function(scope) {
-                                    return requestedOIDCScopeSet.has(scope);
+                                // Provider-profile scope gate. Any scope referenced by a provider profile is "gated" — available
+                                // only to clients whose assigned profiles unlock it (a client with NO assigned profiles resolves
+                                // to the registry's default profiles). Independent of the admin-only gate below; a scope may be
+                                // subject to both.
+                                _oidcClientProviderProfileScopes = oidcClientProviderProfileScopes(providerProfiles, (_ref1 = clientPayload === null || clientPayload === void 0 ? void 0 : clientPayload.dbx_provider_profiles) !== null && _ref1 !== void 0 ? _ref1 : undefined), clientUnlockedScopes = _oidcClientProviderProfileScopes.unlocked, clientRequiredScopes = _oidcClientProviderProfileScopes.required;
+                                profileGatedScopes = firebase.scopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []);
+                                // Unlock gate: reject any requested gated scope this client's profiles do not unlock.
+                                disallowedGatedScopes = Array.from(requestedOIDCScopeSet).filter(function(scope) {
+                                    return profileGatedScopes.has(scope) && !clientUnlockedScopes.has(scope);
                                 });
-                                if (!accountId) return [
+                                if (!(disallowedGatedScopes.length > 0)) return [
                                     3,
                                     11
                                 ];
-                                return [
-                                    4,
-                                    (_ref1 = (_this_accountService_delegate_isAdminUser = (_this_accountService_delegate = this.accountService.delegate).isAdminUser) === null || _this_accountService_delegate_isAdminUser === void 0 ? void 0 : _this_accountService_delegate_isAdminUser.call(_this_accountService_delegate, this.accountService.userContext(accountId).authUserContext)) !== null && _ref1 !== void 0 ? _ref1 : false
-                                ];
-                            case 10:
-                                _tmp1 = _state.sent();
-                                return [
-                                    3,
-                                    12
-                                ];
-                            case 11:
-                                _tmp1 = false;
-                                _state.label = 12;
-                            case 12:
-                                isAdmin = _tmp1;
-                                if (!(requestedAdminOnlyScopes.length > 0 && !isAdmin)) return [
-                                    3,
-                                    14
-                                ];
                                 return [
                                     4,
                                     this.oidcInteractionService.finishInteractionByUid(uid, {
                                         error: 'access_denied',
-                                        error_description: "The following scope(s) are restricted to admins: ".concat(requestedAdminOnlyScopes.join(', '), ".")
+                                        error_description: "The following scope(s) are not available to this client: ".concat(disallowedGatedScopes.join(', '), ".")
                                     }, {
                                         mergeWithLastSubmission: true
                                     })
                                 ];
-                            case 13:
+                            case 10:
                                 _ref5 = _state.sent(), redirectTo1 = _ref5.returnTo;
                                 emitOidcAnalyticsEvent(this._analytics, {
                                     type: 'consent',
                                     isSuccessful: false,
                                     uid: accountId,
                                     clientId: clientId,
-                                    serviceToken: requestsServiceToken,
-                                    isAdmin: false,
-                                    reason: 'service_token_non_admin',
+                                    reason: 'scope_not_unlocked_for_client',
                                     durationMs: Date.now() - startedAt
                                 }, this._logger);
                                 res.json({
@@ -6369,38 +6347,33 @@ var OidcInteractionController_1;
                                 return [
                                     2
                                 ];
-                            case 14:
-                                // Provider-profile scope gate. Any scope referenced by a provider profile is "gated" — available
-                                // only to clients whose assigned profiles unlock it (a client with NO assigned profiles resolves
-                                // to the registry's default profiles). Independent of the admin-only gate above; a scope may be
-                                // subject to both.
-                                _oidcClientProviderProfileScopes = oidcClientProviderProfileScopes(providerProfiles, (_ref2 = clientPayload === null || clientPayload === void 0 ? void 0 : clientPayload.dbx_provider_profiles) !== null && _ref2 !== void 0 ? _ref2 : undefined), clientUnlockedScopes = _oidcClientProviderProfileScopes.unlocked, clientRequiredScopes = _oidcClientProviderProfileScopes.required;
-                                profileGatedScopes = firebase.scopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []);
-                                // Unlock gate: reject any requested gated scope this client's profiles do not unlock.
-                                disallowedGatedScopes = Array.from(requestedOIDCScopeSet).filter(function(scope) {
-                                    return profileGatedScopes.has(scope) && !clientUnlockedScopes.has(scope);
+                            case 11:
+                                // Required gate: a scope a client's profiles force-require (`require: 'required'`) must be present
+                                // in the request. Reject when the client did not request a required scope.
+                                missingRequiredScopes = Array.from(clientRequiredScopes).filter(function(scope) {
+                                    return !requestedOIDCScopeSet.has(scope);
                                 });
-                                if (!(disallowedGatedScopes.length > 0)) return [
+                                if (!(missingRequiredScopes.length > 0)) return [
                                     3,
-                                    16
+                                    13
                                 ];
                                 return [
                                     4,
                                     this.oidcInteractionService.finishInteractionByUid(uid, {
                                         error: 'access_denied',
-                                        error_description: "The following scope(s) are not available to this client: ".concat(disallowedGatedScopes.join(', '), ".")
+                                        error_description: "This client must request the required scope(s): ".concat(missingRequiredScopes.join(', '), ".")
                                     }, {
                                         mergeWithLastSubmission: true
                                     })
                                 ];
-                            case 15:
+                            case 12:
                                 _ref6 = _state.sent(), redirectTo2 = _ref6.returnTo;
                                 emitOidcAnalyticsEvent(this._analytics, {
                                     type: 'consent',
                                     isSuccessful: false,
                                     uid: accountId,
                                     clientId: clientId,
-                                    reason: 'scope_not_unlocked_for_client',
+                                    reason: 'required_scope_missing',
                                     durationMs: Date.now() - startedAt
                                 }, this._logger);
                                 res.json({
@@ -6409,13 +6382,62 @@ var OidcInteractionController_1;
                                 return [
                                     2
                                 ];
-                            case 16:
-                                // Required gate: a scope a client's profiles force-require (`require: 'required'`) must be present
-                                // in the request. Reject when the client did not request a required scope.
-                                missingRequiredScopes = Array.from(clientRequiredScopes).filter(function(scope) {
-                                    return !requestedOIDCScopeSet.has(scope);
+                            case 13:
+                                // The scopes this consent actually puts in force. Resolved once here and re-applied to the grant
+                                // further down, so the admin-only gate below judges exactly the set that will be granted.
+                                //
+                                // Force-grants the client's required profile scopes (in addition to `openid`) so they cannot be
+                                // dropped at consent — the required gate above already guarantees they were requested.
+                                effectiveOIDCScopes = resolveEffectiveSubset({
+                                    missing: missingOIDCScope,
+                                    requestedSubset: body.grantedOIDCScopes,
+                                    alwaysGranted: _to_consumable_array$1(ALWAYS_GRANTED_OIDC_SCOPES).concat(_to_consumable_array$1(clientRequiredScopes)),
+                                    alreadyEncountered: encounteredOIDCScopes
                                 });
-                                if (!(missingRequiredScopes.length > 0)) return [
+                                // Scopes the existing Grant already holds (granted, minus any it rejected). Nothing here revokes
+                                // them, so they stay in force through this consent and the gate below has to count them too.
+                                heldOIDCScopes = existingGrant ? existingGrant.getOIDCScope().split(' ').filter(Boolean) : [];
+                                consentedOIDCScopeSet = new Set(_to_consumable_array$1(heldOIDCScopes).concat(_to_consumable_array$1(effectiveOIDCScopes.granted)));
+                                // Admin-only scope gate. If the consented set intersects the admin-only scopes — the provider's
+                                // `adminOnlyScopes` unioned with the scopes of every profile marked `adminOnly` — and the resolving
+                                // user is not an admin, hard-reject with `access_denied` rather than silently dropping the scope.
+                                //
+                                // Deliberately gated on what the user CONSENTED to rather than on what the client requested: the
+                                // consent UI renders a deselectable checkbox for every scope in the auth request, and a client
+                                // cannot know the caller's admin status when it builds that request. Gating on the request would
+                                // make an admin-only scope in `scopes_supported` fatal for every non-admin — deselecting it at
+                                // consent has to be a way through.
+                                configAdminOnlyScopes = (_this_accountService_providerConfig_adminOnlyScopes = this.accountService.providerConfig.adminOnlyScopes) !== null && _this_accountService_providerConfig_adminOnlyScopes !== void 0 ? _this_accountService_providerConfig_adminOnlyScopes : [];
+                                adminOnlyScopes = new Set(_to_consumable_array$1(configAdminOnlyScopes).concat(_to_consumable_array$1(firebase.adminOnlyScopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []))));
+                                consentedAdminOnlyScopes = Array.from(adminOnlyScopes).filter(function(scope) {
+                                    return consentedOIDCScopeSet.has(scope);
+                                });
+                                // Deliberately sourced from the provider config's `adminOnlyScopes` ALONE, unlike the gate above:
+                                // this flag also selects the (highest) service-token TTL tier further down, and a profile marked
+                                // `adminOnly` must gate by admin status WITHOUT widening its grant's lifetime to that tier.
+                                requestsServiceToken = configAdminOnlyScopes.some(function(scope) {
+                                    return consentedOIDCScopeSet.has(scope);
+                                });
+                                if (!accountId) return [
+                                    3,
+                                    15
+                                ];
+                                return [
+                                    4,
+                                    (_ref2 = (_this_accountService_delegate_isAdminUser = (_this_accountService_delegate = this.accountService.delegate).isAdminUser) === null || _this_accountService_delegate_isAdminUser === void 0 ? void 0 : _this_accountService_delegate_isAdminUser.call(_this_accountService_delegate, this.accountService.userContext(accountId).authUserContext)) !== null && _ref2 !== void 0 ? _ref2 : false
+                                ];
+                            case 14:
+                                _tmp1 = _state.sent();
+                                return [
+                                    3,
+                                    16
+                                ];
+                            case 15:
+                                _tmp1 = false;
+                                _state.label = 16;
+                            case 16:
+                                isAdmin = _tmp1;
+                                if (!(consentedAdminOnlyScopes.length > 0 && !isAdmin)) return [
                                     3,
                                     18
                                 ];
@@ -6423,7 +6445,7 @@ var OidcInteractionController_1;
                                     4,
                                     this.oidcInteractionService.finishInteractionByUid(uid, {
                                         error: 'access_denied',
-                                        error_description: "This client must request the required scope(s): ".concat(missingRequiredScopes.join(', '), ".")
+                                        error_description: "The following scope(s) are restricted to admins: ".concat(consentedAdminOnlyScopes.join(', '), ".")
                                     }, {
                                         mergeWithLastSubmission: true
                                     })
@@ -6435,7 +6457,9 @@ var OidcInteractionController_1;
                                     isSuccessful: false,
                                     uid: accountId,
                                     clientId: clientId,
-                                    reason: 'required_scope_missing',
+                                    serviceToken: requestsServiceToken,
+                                    isAdmin: false,
+                                    reason: 'service_token_non_admin',
                                     durationMs: Date.now() - startedAt
                                 }, this._logger);
                                 res.json({
@@ -6478,14 +6502,7 @@ var OidcInteractionController_1;
                             case 21:
                                 grant = _tmp2;
                                 if (missingOIDCScope.length > 0) {
-                                    // Force-grant the client's required profile scopes (in addition to `openid`) so they cannot be
-                                    // dropped at consent — the required gate above already guarantees they were requested.
-                                    _resolveEffectiveSubset = resolveEffectiveSubset({
-                                        missing: missingOIDCScope,
-                                        requestedSubset: body.grantedOIDCScopes,
-                                        alwaysGranted: _to_consumable_array$1(ALWAYS_GRANTED_OIDC_SCOPES).concat(_to_consumable_array$1(clientRequiredScopes)),
-                                        alreadyEncountered: encounteredOIDCScopes
-                                    }), granted = _resolveEffectiveSubset.granted, rejected = _resolveEffectiveSubset.rejected;
+                                    granted = effectiveOIDCScopes.granted, rejected = effectiveOIDCScopes.rejected;
                                     if (granted.length > 0) {
                                         grant.addOIDCScope(granted.join(' '));
                                     }
@@ -6513,11 +6530,11 @@ var OidcInteractionController_1;
                                 encounteredOIDCClaims = grant.getOIDCClaimsEncountered();
                                 missingOIDCClaims = (_prompt_details_missingOIDCClaims = prompt.details.missingOIDCClaims) !== null && _prompt_details_missingOIDCClaims !== void 0 ? _prompt_details_missingOIDCClaims : [];
                                 if (missingOIDCClaims.length > 0) {
-                                    _resolveEffectiveSubset1 = resolveEffectiveSubset({
+                                    _resolveEffectiveSubset = resolveEffectiveSubset({
                                         missing: missingOIDCClaims,
                                         requestedSubset: body.grantedOIDCClaims,
                                         alreadyEncountered: encounteredOIDCClaims
-                                    }), granted1 = _resolveEffectiveSubset1.granted, rejected1 = _resolveEffectiveSubset1.rejected;
+                                    }), granted1 = _resolveEffectiveSubset.granted, rejected1 = _resolveEffectiveSubset.rejected;
                                     if (granted1.length > 0) {
                                         grant.addOIDCClaims(granted1);
                                     }
@@ -6531,13 +6548,22 @@ var OidcInteractionController_1;
                                     for(_iterator1 = Object.entries(missingResourceScopes)[Symbol.iterator](); !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
                                         _step_value = _sliced_to_array(_step1.value, 2), indicator = _step_value[0], scopes = _step_value[1];
                                         ;
-                                        requestedSubset = (_body_grantedResourceScopes = body.grantedResourceScopes) === null || _body_grantedResourceScopes === void 0 ? void 0 : _body_grantedResourceScopes[indicator];
+                                        ;
+                                        // A submission with no explicit per-resource selection falls back to the OIDC scope selection
+                                        // rather than granting everything the resource server declares. A resource server's scope list
+                                        // is drawn from the same provider scopes the consent UI renders as one checkbox list, so a scope
+                                        // deselected there must not reappear on the resource-bound access token — otherwise deselecting
+                                        // an admin-only scope would clear the gate above while the token still carried it.
+                                        // `grantedOIDCScopes` being absent still means "grant everything requested".
+                                        requestedSubset = (_ref8 = (_body_grantedResourceScopes = body.grantedResourceScopes) === null || _body_grantedResourceScopes === void 0 ? void 0 : _body_grantedResourceScopes[indicator]) !== null && _ref8 !== void 0 ? _ref8 : body.grantedOIDCScopes ? scopes.filter(function(scope) {
+                                            return consentedOIDCScopeSet.has(scope);
+                                        }) : undefined;
                                         encounteredResourceScopes = grant.getResourceScopeEncountered(indicator).split(' ').filter(Boolean);
-                                        _resolveEffectiveSubset2 = resolveEffectiveSubset({
+                                        _resolveEffectiveSubset1 = resolveEffectiveSubset({
                                             missing: scopes,
                                             requestedSubset: requestedSubset,
                                             alreadyEncountered: encounteredResourceScopes
-                                        }), granted2 = _resolveEffectiveSubset2.granted, rejected2 = _resolveEffectiveSubset2.rejected;
+                                        }), granted2 = _resolveEffectiveSubset1.granted, rejected2 = _resolveEffectiveSubset1.rejected;
                                         if (granted2.length > 0) {
                                             grant.addResourceScope(indicator, granted2.join(' '));
                                         }
@@ -6593,7 +6619,7 @@ var OidcInteractionController_1;
                                     })
                                 ];
                             case 23:
-                                _ref8 = _state.sent(), redirectTo4 = _ref8.returnTo;
+                                _ref9 = _state.sent(), redirectTo4 = _ref9.returnTo;
                                 emitOidcAnalyticsEvent(this._analytics, {
                                     type: 'consent',
                                     isSuccessful: true,