@dereekb/firebase-server 13.32.0 → 13.34.0

package/oidc/index.esm.js

@@ -6217,7 +6217,7 @@ var OidcInteractionController_1;
      * @throws {HttpException} HTTP 400 when the consent interaction cannot be completed.
      */ function postConsent(uid, body, res) {
                 return _async_to_generator$2(function() {
-                    var startedAt, clientId, accountId, _ref, _prompt_details_missingOIDCScope, _this_accountService_providerConfig_adminOnlyScopes, _ref1, _ref2, _ref3, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, _ref4, redirectTo, interaction, prompt, params, session, missingOIDCScope, existingGrant, _tmp, encounteredOIDCScopes, clientPayload, requestedOIDCScopeSet, providerProfiles, configAdminOnlyScopes, adminOnlyScopes, requestedAdminOnlyScopes, requestsServiceToken, isAdmin, _tmp1, _ref5, redirectTo1, _oidcClientProviderProfileScopes, clientUnlockedScopes, clientRequiredScopes, profileGatedScopes, disallowedGatedScopes, _ref6, redirectTo2, missingRequiredScopes, _ref7, redirectTo3, requestedRawTtl, clientMaxSessionTtl, expiresInSeconds, grant, _tmp2, _resolveEffectiveSubset, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset1, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset2, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, _ref8, redirectTo4, err;
+                    var startedAt, clientId, accountId, _ref, _prompt_details_missingOIDCScope, _ref1, _this_accountService_providerConfig_adminOnlyScopes, _ref2, _ref3, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, _ref4, redirectTo, interaction, prompt, params, session, missingOIDCScope, existingGrant, _tmp, encounteredOIDCScopes, clientPayload, requestedOIDCScopeSet, providerProfiles, _oidcClientProviderProfileScopes, clientUnlockedScopes, clientRequiredScopes, profileGatedScopes, disallowedGatedScopes, _ref5, redirectTo1, missingRequiredScopes, _ref6, redirectTo2, effectiveOIDCScopes, heldOIDCScopes, consentedOIDCScopeSet, configAdminOnlyScopes, adminOnlyScopes, consentedAdminOnlyScopes, requestsServiceToken, isAdmin, _tmp1, _ref7, redirectTo3, requestedRawTtl, clientMaxSessionTtl, expiresInSeconds, grant, _tmp2, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _ref8, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset1, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, _ref9, redirectTo4, err;
                     return _ts_generator$2(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -6299,66 +6299,44 @@ var OidcInteractionController_1;
                                 ];
                             case 9:
                                 clientPayload = _state.sent();
-                                // Admin-only scope gate. The requested OIDC scope set is `missingOIDCScope ∪ encounteredOIDCScopes`
-                                // (a fresh consent has everything in `missing`; a re-consent may carry already-granted scopes in
-                                // `encountered`). If that set intersects the admin-only scopes — the provider's `adminOnlyScopes`
-                                // unioned with the scopes of every profile marked `adminOnly` — and the resolving user is not an
-                                // admin, hard-reject with `access_denied` rather than silently dropping the scope.
+                                // The requested OIDC scope set is `missingOIDCScope ∪ encounteredOIDCScopes` (a fresh consent has
+                                // everything in `missing`; a re-consent may carry already-granted scopes in `encountered`). The two
+                                // provider-profile gates below judge the REQUEST — what this client may ask for at all — so they
+                                // read this set. The admin-only gate further down judges what the user actually consented to
+                                // instead, and reads `consentedOIDCScopeSet`.
                                 requestedOIDCScopeSet = new Set(_to_consumable_array$1(missingOIDCScope).concat(_to_consumable_array$1(encounteredOIDCScopes)));
                                 providerProfiles = this.accountService.providerConfig.providerProfiles;
-                                configAdminOnlyScopes = (_this_accountService_providerConfig_adminOnlyScopes = this.accountService.providerConfig.adminOnlyScopes) !== null && _this_accountService_providerConfig_adminOnlyScopes !== void 0 ? _this_accountService_providerConfig_adminOnlyScopes : [];
-                                adminOnlyScopes = new Set(_to_consumable_array$1(configAdminOnlyScopes).concat(_to_consumable_array$1(adminOnlyScopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []))));
-                                requestedAdminOnlyScopes = Array.from(adminOnlyScopes).filter(function(scope) {
-                                    return requestedOIDCScopeSet.has(scope);
-                                });
-                                // Deliberately sourced from the provider config's `adminOnlyScopes` ALONE, unlike the gate above:
-                                // this flag also selects the (highest) service-token TTL tier further down, and a profile marked
-                                // `adminOnly` must gate by admin status WITHOUT widening its grant's lifetime to that tier.
-                                requestsServiceToken = configAdminOnlyScopes.some(function(scope) {
-                                    return requestedOIDCScopeSet.has(scope);
+                                // Provider-profile scope gate. Any scope referenced by a provider profile is "gated" — available
+                                // only to clients whose assigned profiles unlock it (a client with NO assigned profiles resolves
+                                // to the registry's default profiles). Independent of the admin-only gate below; a scope may be
+                                // subject to both.
+                                _oidcClientProviderProfileScopes = oidcClientProviderProfileScopes(providerProfiles, (_ref1 = clientPayload === null || clientPayload === void 0 ? void 0 : clientPayload.dbx_provider_profiles) !== null && _ref1 !== void 0 ? _ref1 : undefined), clientUnlockedScopes = _oidcClientProviderProfileScopes.unlocked, clientRequiredScopes = _oidcClientProviderProfileScopes.required;
+                                profileGatedScopes = scopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []);
+                                // Unlock gate: reject any requested gated scope this client's profiles do not unlock.
+                                disallowedGatedScopes = Array.from(requestedOIDCScopeSet).filter(function(scope) {
+                                    return profileGatedScopes.has(scope) && !clientUnlockedScopes.has(scope);
                                 });
-                                if (!accountId) return [
+                                if (!(disallowedGatedScopes.length > 0)) return [
                                     3,
                                     11
                                 ];
-                                return [
-                                    4,
-                                    (_ref1 = (_this_accountService_delegate_isAdminUser = (_this_accountService_delegate = this.accountService.delegate).isAdminUser) === null || _this_accountService_delegate_isAdminUser === void 0 ? void 0 : _this_accountService_delegate_isAdminUser.call(_this_accountService_delegate, this.accountService.userContext(accountId).authUserContext)) !== null && _ref1 !== void 0 ? _ref1 : false
-                                ];
-                            case 10:
-                                _tmp1 = _state.sent();
-                                return [
-                                    3,
-                                    12
-                                ];
-                            case 11:
-                                _tmp1 = false;
-                                _state.label = 12;
-                            case 12:
-                                isAdmin = _tmp1;
-                                if (!(requestedAdminOnlyScopes.length > 0 && !isAdmin)) return [
-                                    3,
-                                    14
-                                ];
                                 return [
                                     4,
                                     this.oidcInteractionService.finishInteractionByUid(uid, {
                                         error: 'access_denied',
-                                        error_description: "The following scope(s) are restricted to admins: ".concat(requestedAdminOnlyScopes.join(', '), ".")
+                                        error_description: "The following scope(s) are not available to this client: ".concat(disallowedGatedScopes.join(', '), ".")
                                     }, {
                                         mergeWithLastSubmission: true
                                     })
                                 ];
-                            case 13:
+                            case 10:
                                 _ref5 = _state.sent(), redirectTo1 = _ref5.returnTo;
                                 emitOidcAnalyticsEvent(this._analytics, {
                                     type: 'consent',
                                     isSuccessful: false,
                                     uid: accountId,
                                     clientId: clientId,
-                                    serviceToken: requestsServiceToken,
-                                    isAdmin: false,
-                                    reason: 'service_token_non_admin',
+                                    reason: 'scope_not_unlocked_for_client',
                                     durationMs: Date.now() - startedAt
                                 }, this._logger);
                                 res.json({
@@ -6367,38 +6345,33 @@ var OidcInteractionController_1;
                                 return [
                                     2
                                 ];
-                            case 14:
-                                // Provider-profile scope gate. Any scope referenced by a provider profile is "gated" — available
-                                // only to clients whose assigned profiles unlock it (a client with NO assigned profiles resolves
-                                // to the registry's default profiles). Independent of the admin-only gate above; a scope may be
-                                // subject to both.
-                                _oidcClientProviderProfileScopes = oidcClientProviderProfileScopes(providerProfiles, (_ref2 = clientPayload === null || clientPayload === void 0 ? void 0 : clientPayload.dbx_provider_profiles) !== null && _ref2 !== void 0 ? _ref2 : undefined), clientUnlockedScopes = _oidcClientProviderProfileScopes.unlocked, clientRequiredScopes = _oidcClientProviderProfileScopes.required;
-                                profileGatedScopes = scopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []);
-                                // Unlock gate: reject any requested gated scope this client's profiles do not unlock.
-                                disallowedGatedScopes = Array.from(requestedOIDCScopeSet).filter(function(scope) {
-                                    return profileGatedScopes.has(scope) && !clientUnlockedScopes.has(scope);
+                            case 11:
+                                // Required gate: a scope a client's profiles force-require (`require: 'required'`) must be present
+                                // in the request. Reject when the client did not request a required scope.
+                                missingRequiredScopes = Array.from(clientRequiredScopes).filter(function(scope) {
+                                    return !requestedOIDCScopeSet.has(scope);
                                 });
-                                if (!(disallowedGatedScopes.length > 0)) return [
+                                if (!(missingRequiredScopes.length > 0)) return [
                                     3,
-                                    16
+                                    13
                                 ];
                                 return [
                                     4,
                                     this.oidcInteractionService.finishInteractionByUid(uid, {
                                         error: 'access_denied',
-                                        error_description: "The following scope(s) are not available to this client: ".concat(disallowedGatedScopes.join(', '), ".")
+                                        error_description: "This client must request the required scope(s): ".concat(missingRequiredScopes.join(', '), ".")
                                     }, {
                                         mergeWithLastSubmission: true
                                     })
                                 ];
-                            case 15:
+                            case 12:
                                 _ref6 = _state.sent(), redirectTo2 = _ref6.returnTo;
                                 emitOidcAnalyticsEvent(this._analytics, {
                                     type: 'consent',
                                     isSuccessful: false,
                                     uid: accountId,
                                     clientId: clientId,
-                                    reason: 'scope_not_unlocked_for_client',
+                                    reason: 'required_scope_missing',
                                     durationMs: Date.now() - startedAt
                                 }, this._logger);
                                 res.json({
@@ -6407,13 +6380,62 @@ var OidcInteractionController_1;
                                 return [
                                     2
                                 ];
-                            case 16:
-                                // Required gate: a scope a client's profiles force-require (`require: 'required'`) must be present
-                                // in the request. Reject when the client did not request a required scope.
-                                missingRequiredScopes = Array.from(clientRequiredScopes).filter(function(scope) {
-                                    return !requestedOIDCScopeSet.has(scope);
+                            case 13:
+                                // The scopes this consent actually puts in force. Resolved once here and re-applied to the grant
+                                // further down, so the admin-only gate below judges exactly the set that will be granted.
+                                //
+                                // Force-grants the client's required profile scopes (in addition to `openid`) so they cannot be
+                                // dropped at consent — the required gate above already guarantees they were requested.
+                                effectiveOIDCScopes = resolveEffectiveSubset({
+                                    missing: missingOIDCScope,
+                                    requestedSubset: body.grantedOIDCScopes,
+                                    alwaysGranted: _to_consumable_array$1(ALWAYS_GRANTED_OIDC_SCOPES).concat(_to_consumable_array$1(clientRequiredScopes)),
+                                    alreadyEncountered: encounteredOIDCScopes
                                 });
-                                if (!(missingRequiredScopes.length > 0)) return [
+                                // Scopes the existing Grant already holds (granted, minus any it rejected). Nothing here revokes
+                                // them, so they stay in force through this consent and the gate below has to count them too.
+                                heldOIDCScopes = existingGrant ? existingGrant.getOIDCScope().split(' ').filter(Boolean) : [];
+                                consentedOIDCScopeSet = new Set(_to_consumable_array$1(heldOIDCScopes).concat(_to_consumable_array$1(effectiveOIDCScopes.granted)));
+                                // Admin-only scope gate. If the consented set intersects the admin-only scopes — the provider's
+                                // `adminOnlyScopes` unioned with the scopes of every profile marked `adminOnly` — and the resolving
+                                // user is not an admin, hard-reject with `access_denied` rather than silently dropping the scope.
+                                //
+                                // Deliberately gated on what the user CONSENTED to rather than on what the client requested: the
+                                // consent UI renders a deselectable checkbox for every scope in the auth request, and a client
+                                // cannot know the caller's admin status when it builds that request. Gating on the request would
+                                // make an admin-only scope in `scopes_supported` fatal for every non-admin — deselecting it at
+                                // consent has to be a way through.
+                                configAdminOnlyScopes = (_this_accountService_providerConfig_adminOnlyScopes = this.accountService.providerConfig.adminOnlyScopes) !== null && _this_accountService_providerConfig_adminOnlyScopes !== void 0 ? _this_accountService_providerConfig_adminOnlyScopes : [];
+                                adminOnlyScopes = new Set(_to_consumable_array$1(configAdminOnlyScopes).concat(_to_consumable_array$1(adminOnlyScopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []))));
+                                consentedAdminOnlyScopes = Array.from(adminOnlyScopes).filter(function(scope) {
+                                    return consentedOIDCScopeSet.has(scope);
+                                });
+                                // Deliberately sourced from the provider config's `adminOnlyScopes` ALONE, unlike the gate above:
+                                // this flag also selects the (highest) service-token TTL tier further down, and a profile marked
+                                // `adminOnly` must gate by admin status WITHOUT widening its grant's lifetime to that tier.
+                                requestsServiceToken = configAdminOnlyScopes.some(function(scope) {
+                                    return consentedOIDCScopeSet.has(scope);
+                                });
+                                if (!accountId) return [
+                                    3,
+                                    15
+                                ];
+                                return [
+                                    4,
+                                    (_ref2 = (_this_accountService_delegate_isAdminUser = (_this_accountService_delegate = this.accountService.delegate).isAdminUser) === null || _this_accountService_delegate_isAdminUser === void 0 ? void 0 : _this_accountService_delegate_isAdminUser.call(_this_accountService_delegate, this.accountService.userContext(accountId).authUserContext)) !== null && _ref2 !== void 0 ? _ref2 : false
+                                ];
+                            case 14:
+                                _tmp1 = _state.sent();
+                                return [
+                                    3,
+                                    16
+                                ];
+                            case 15:
+                                _tmp1 = false;
+                                _state.label = 16;
+                            case 16:
+                                isAdmin = _tmp1;
+                                if (!(consentedAdminOnlyScopes.length > 0 && !isAdmin)) return [
                                     3,
                                     18
                                 ];
@@ -6421,7 +6443,7 @@ var OidcInteractionController_1;
                                     4,
                                     this.oidcInteractionService.finishInteractionByUid(uid, {
                                         error: 'access_denied',
-                                        error_description: "This client must request the required scope(s): ".concat(missingRequiredScopes.join(', '), ".")
+                                        error_description: "The following scope(s) are restricted to admins: ".concat(consentedAdminOnlyScopes.join(', '), ".")
                                     }, {
                                         mergeWithLastSubmission: true
                                     })
@@ -6433,7 +6455,9 @@ var OidcInteractionController_1;
                                     isSuccessful: false,
                                     uid: accountId,
                                     clientId: clientId,
-                                    reason: 'required_scope_missing',
+                                    serviceToken: requestsServiceToken,
+                                    isAdmin: false,
+                                    reason: 'service_token_non_admin',
                                     durationMs: Date.now() - startedAt
                                 }, this._logger);
                                 res.json({
@@ -6476,14 +6500,7 @@ var OidcInteractionController_1;
                             case 21:
                                 grant = _tmp2;
                                 if (missingOIDCScope.length > 0) {
-                                    // Force-grant the client's required profile scopes (in addition to `openid`) so they cannot be
-                                    // dropped at consent — the required gate above already guarantees they were requested.
-                                    _resolveEffectiveSubset = resolveEffectiveSubset({
-                                        missing: missingOIDCScope,
-                                        requestedSubset: body.grantedOIDCScopes,
-                                        alwaysGranted: _to_consumable_array$1(ALWAYS_GRANTED_OIDC_SCOPES).concat(_to_consumable_array$1(clientRequiredScopes)),
-                                        alreadyEncountered: encounteredOIDCScopes
-                                    }), granted = _resolveEffectiveSubset.granted, rejected = _resolveEffectiveSubset.rejected;
+                                    granted = effectiveOIDCScopes.granted, rejected = effectiveOIDCScopes.rejected;
                                     if (granted.length > 0) {
                                         grant.addOIDCScope(granted.join(' '));
                                     }
@@ -6511,11 +6528,11 @@ var OidcInteractionController_1;
                                 encounteredOIDCClaims = grant.getOIDCClaimsEncountered();
                                 missingOIDCClaims = (_prompt_details_missingOIDCClaims = prompt.details.missingOIDCClaims) !== null && _prompt_details_missingOIDCClaims !== void 0 ? _prompt_details_missingOIDCClaims : [];
                                 if (missingOIDCClaims.length > 0) {
-                                    _resolveEffectiveSubset1 = resolveEffectiveSubset({
+                                    _resolveEffectiveSubset = resolveEffectiveSubset({
                                         missing: missingOIDCClaims,
                                         requestedSubset: body.grantedOIDCClaims,
                                         alreadyEncountered: encounteredOIDCClaims
-                                    }), granted1 = _resolveEffectiveSubset1.granted, rejected1 = _resolveEffectiveSubset1.rejected;
+                                    }), granted1 = _resolveEffectiveSubset.granted, rejected1 = _resolveEffectiveSubset.rejected;
                                     if (granted1.length > 0) {
                                         grant.addOIDCClaims(granted1);
                                     }
@@ -6529,13 +6546,22 @@ var OidcInteractionController_1;
                                     for(_iterator1 = Object.entries(missingResourceScopes)[Symbol.iterator](); !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
                                         _step_value = _sliced_to_array(_step1.value, 2), indicator = _step_value[0], scopes = _step_value[1];
                                         ;
-                                        requestedSubset = (_body_grantedResourceScopes = body.grantedResourceScopes) === null || _body_grantedResourceScopes === void 0 ? void 0 : _body_grantedResourceScopes[indicator];
+                                        ;
+                                        // A submission with no explicit per-resource selection falls back to the OIDC scope selection
+                                        // rather than granting everything the resource server declares. A resource server's scope list
+                                        // is drawn from the same provider scopes the consent UI renders as one checkbox list, so a scope
+                                        // deselected there must not reappear on the resource-bound access token — otherwise deselecting
+                                        // an admin-only scope would clear the gate above while the token still carried it.
+                                        // `grantedOIDCScopes` being absent still means "grant everything requested".
+                                        requestedSubset = (_ref8 = (_body_grantedResourceScopes = body.grantedResourceScopes) === null || _body_grantedResourceScopes === void 0 ? void 0 : _body_grantedResourceScopes[indicator]) !== null && _ref8 !== void 0 ? _ref8 : body.grantedOIDCScopes ? scopes.filter(function(scope) {
+                                            return consentedOIDCScopeSet.has(scope);
+                                        }) : undefined;
                                         encounteredResourceScopes = grant.getResourceScopeEncountered(indicator).split(' ').filter(Boolean);
-                                        _resolveEffectiveSubset2 = resolveEffectiveSubset({
+                                        _resolveEffectiveSubset1 = resolveEffectiveSubset({
                                             missing: scopes,
                                             requestedSubset: requestedSubset,
                                             alreadyEncountered: encounteredResourceScopes
-                                        }), granted2 = _resolveEffectiveSubset2.granted, rejected2 = _resolveEffectiveSubset2.rejected;
+                                        }), granted2 = _resolveEffectiveSubset1.granted, rejected2 = _resolveEffectiveSubset1.rejected;
                                         if (granted2.length > 0) {
                                             grant.addResourceScope(indicator, granted2.join(' '));
                                         }
@@ -6591,7 +6617,7 @@ var OidcInteractionController_1;
                                     })
                                 ];
                             case 23:
-                                _ref8 = _state.sent(), redirectTo4 = _ref8.returnTo;
+                                _ref9 = _state.sent(), redirectTo4 = _ref9.returnTo;
                                 emitOidcAnalyticsEvent(this._analytics, {
                                     type: 'consent',
                                     isSuccessful: true,

package/oidc/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/oidc",
-  "version": "13.32.0",
+  "version": "13.34.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.32.0",
-    "@dereekb/date": "13.32.0",
-    "@dereekb/firebase": "13.32.0",
-    "@dereekb/firebase-server": "13.32.0",
-    "@dereekb/model": "13.32.0",
-    "@dereekb/nestjs": "13.32.0",
-    "@dereekb/rxjs": "13.32.0",
-    "@dereekb/util": "13.32.0",
-    "@dereekb/zoho": "13.32.0",
+    "@dereekb/analytics": "13.34.0",
+    "@dereekb/date": "13.34.0",
+    "@dereekb/firebase": "13.34.0",
+    "@dereekb/firebase-server": "13.34.0",
+    "@dereekb/model": "13.34.0",
+    "@dereekb/nestjs": "13.34.0",
+    "@dereekb/rxjs": "13.34.0",
+    "@dereekb/util": "13.34.0",
+    "@dereekb/zoho": "13.34.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "express": "^5.2.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/firebase-server",
-  "version": "13.32.0",
+  "version": "13.34.0",
   "sideEffects": false,
   "exports": {
     "./test": {
@@ -9,6 +9,18 @@
       "import": "./test/index.cjs.mjs",
       "default": "./test/index.cjs.js"
     },
+    "./calcom": {
+      "module": "./calcom/index.esm.js",
+      "types": "./calcom/index.d.ts",
+      "import": "./calcom/index.cjs.mjs",
+      "default": "./calcom/index.cjs.js"
+    },
+    "./discord": {
+      "module": "./discord/index.esm.js",
+      "types": "./discord/index.d.ts",
+      "import": "./discord/index.cjs.mjs",
+      "default": "./discord/index.cjs.js"
+    },
     "./mailgun": {
       "module": "./mailgun/index.esm.js",
       "types": "./mailgun/index.d.ts",
@@ -57,15 +69,17 @@
   "types": "./src/index.d.ts",
   "peerDependencies": {
     "@cantoo/pdf-lib": "^2.6.5",
-    "@dereekb/analytics": "13.32.0",
-    "@dereekb/date": "13.32.0",
-    "@dereekb/dbx-core": "13.32.0",
-    "@dereekb/firebase": "13.32.0",
-    "@dereekb/model": "13.32.0",
-    "@dereekb/nestjs": "13.32.0",
-    "@dereekb/rxjs": "13.32.0",
-    "@dereekb/util": "13.32.0",
-    "@dereekb/zoho": "13.32.0",
+    "@dereekb/analytics": "13.34.0",
+    "@dereekb/calcom": "13.34.0",
+    "@dereekb/date": "13.34.0",
+    "@dereekb/dbx-core": "13.34.0",
+    "@dereekb/discord": "13.34.0",
+    "@dereekb/firebase": "13.34.0",
+    "@dereekb/model": "13.34.0",
+    "@dereekb/nestjs": "13.34.0",
+    "@dereekb/rxjs": "13.34.0",
+    "@dereekb/util": "13.34.0",
+    "@dereekb/zoho": "13.34.0",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@modelcontextprotocol/sdk": "1.29.0",

package/src/lib/env/env.config.d.ts

@@ -29,6 +29,21 @@ export interface FirebaseServerEnvironmentConfig extends ServerEnvironmentConfig
      * `appApiUrl` (or `appUrl`).
      */
     readonly appMcpUrl?: Maybe<WebsiteUrlWithPrefix>;
+    /**
+     * The origin external-connection OAuth endpoints are reachable at (e.g. 'https://example.com').
+     *
+     * The `/oauth/<providerType>/{authorize,callback}` routes are excluded from the global API route
+     * prefix, so they are served from the site origin rather than from `appApiUrl`. The redirect URI
+     * registered with each provider is derived from this value, and providers require a byte-identical
+     * match.
+     *
+     * Set explicitly when those routes are not reachable at `appUrl` — in local development `appUrl`
+     * is typically the Angular dev server while the `/oauth/**` hosting rewrite is served by the
+     * hosting emulator on another port. In production the two normally coincide, so it can be omitted.
+     *
+     * When omitted, modules fall back to `appUrl`.
+     */
+    readonly appOAuthUrl?: Maybe<WebsiteUrlWithPrefix>;
     /**
      * The webhook URL. When not set explicitly, `buildNestServerRootModule()` computes
      * it from `appUrl + /webhook`.

package/src/lib/env/env.service.d.ts

@@ -54,6 +54,13 @@ export declare abstract class FirebaseServerEnvService {
      * URL from `appApiUrl` / `appUrl`.
      */
     abstract readonly appMcpUrl: Maybe<WebsiteUrl>;
+    /**
+     * The origin external-connection OAuth endpoints are reachable at (e.g., 'https://app.example.com').
+     *
+     * Used to derive each provider's registered redirect URI. When omitted, modules fall back to
+     * `appUrl`.
+     */
+    abstract readonly appOAuthUrl: Maybe<WebsiteUrl>;
     /**
      * The full webhook URL (e.g., 'https://app.example.com/webhook').
      */

package/src/lib/firestore/snapshot/snapshot.field.encrypt.d.ts

@@ -14,6 +14,18 @@ export interface FirestoreEncryptedFieldConfig<T> {
      * Default value when the field is missing from Firestore.
      */
     readonly default: GetterOrValue<T>;
+    /**
+     * Called when a stored value is present but cannot be decrypted — a wrong or rotated key, a
+     * corrupt value, or data written before the field was encrypted. Its return value is used in
+     * place of the decrypted value.
+     *
+     * When omitted the decode throws, which is the correct behavior for a field of record: a
+     * credential that silently becomes `undefined` is far worse than a loud failure.
+     *
+     * Only supply this for data that can be regenerated — a cache. See the Zoho access token cache,
+     * where an undecryptable entry is a cache miss and the next call re-mints the token.
+     */
+    readonly onDecodeFailure?: Maybe<(error: unknown, data: string) => T>;
 }
 /**
  * Configuration for an optional encrypted Firestore field.
@@ -25,13 +37,20 @@ export interface OptionalFirestoreEncryptedFieldConfig<T> {
      * Secret source for the encryption key.
      */
     readonly secret: GetterOrValue<string>;
+    /**
+     * Called when a stored value is present but cannot be decrypted. See
+     * {@link FirestoreEncryptedFieldConfig.onDecodeFailure}. When omitted the decode throws.
+     */
+    readonly onDecodeFailure?: Maybe<(error: unknown, data: string) => Maybe<T>>;
 }
 /**
  * Creates a Firestore field mapping that encrypts/decrypts a JSON-serializable value
  * using AES-256-GCM. The value is stored in Firestore as a base64-encoded string.
  *
- * The encryption key is resolved from the configured secret source on each read/write,
- * allowing for key rotation via environment variable changes.
+ * IMPORTANT: there is NO key rotation. `resolveEncryptionKey()` reads and validates the secret once,
+ * here at construction, and closes over the resulting key — changing the secret afterwards orphans
+ * every value already written with the old one. Rotation is only survivable for fields that supply
+ * {@link FirestoreEncryptedFieldConfig.onDecodeFailure} and hold regenerable data.
  *
  * @param config - Encryption field configuration.
  * @returns A field mapping configuration for encrypted values.

package/src/lib/nest/env/env.service.d.ts

@@ -17,6 +17,7 @@ export declare class DefaultFirebaseServerEnvService extends ServerEnvironmentSe
     get developmentSchedulerEnabled(): boolean;
     get appUrlDetails(): Maybe<WebsiteUrlDetails>;
     get appMcpUrl(): Maybe<WebsiteUrl>;
+    get appOAuthUrl(): Maybe<WebsiteUrl>;
     get appWebhookUrl(): Maybe<WebsiteUrl>;
     get isApiEnabled(): boolean;
     get isWebhooksEnabled(): boolean;

package/test/index.cjs.js

@@ -707,12 +707,24 @@ function _ts_generator$a(thisArg, body) {
         });
     };
 }
+/**
+ * Random component of a generated test uid.
+ *
+ * The counter and the timestamp alone are not enough to keep uids unique: the counter is per-module, so
+ * every spec FILE starts it at 1, and two files whose first user is created in the same millisecond
+ * would otherwise be handed the identical uid — which fails as "the user with the provided uid already
+ * exists" in whichever file loses. Kept numeric so a uid stays digits-only.
+ */ var testUidRandomFactory = util.randomNumberFactory({
+    min: 100000,
+    max: 1000000,
+    round: 'floor'
+});
 /**
  * Incrementing number factory for generating test UID values.
  *
- * Has the format 'test-uid-<number>'
+ * Has the format '<timestamp>0<counter><random>'
  */ var testUidFactory = util.mapGetter(util.incrementingNumberFactory(), function(i) {
-    return "".concat(Date.now(), "0").concat(i);
+    return "".concat(Date.now(), "0").concat(i).concat(testUidRandomFactory());
 });
 /**
  * Creates a CallableContextOptions with auth attached corresponding to the input UserRecord.

package/test/index.esm.js

@@ -1,4 +1,4 @@
-import { randomEmailFactory, randomPhoneNumberFactory, mapGetter, incrementingNumberFactory, asGetter, getValueFromGetter, cachedGetter, asArray, mapObjectMap, unixDateTimeSecondsNumberForNow } from '@dereekb/util';
+import { randomEmailFactory, randomPhoneNumberFactory, randomNumberFactory, mapGetter, incrementingNumberFactory, asGetter, getValueFromGetter, cachedGetter, asArray, mapObjectMap, unixDateTimeSecondsNumberForNow } from '@dereekb/util';
 import { useTestContextFixture, AbstractChildTestContextFixture, testContextBuilder, AbstractTestContextFixture, useTestFunctionFixture, useTestFunctionMapFixture, ExpectedErrorOfSpecificTypeError } from '@dereekb/util/test';
 import { decode } from 'jsonwebtoken';
 import { flatFirestoreModelKey, twoWayFlatFirestoreModelKey, firestoreContextFactory, firebaseStorageContextFactory, adminOnlyScopesForOidcProviderProfiles, assignmentOnlyScopesForOidcProviderProfiles } from '@dereekb/firebase';
@@ -706,12 +706,24 @@ function _ts_generator$a(thisArg, body) {
         });
     };
 }
+/**
+ * Random component of a generated test uid.
+ *
+ * The counter and the timestamp alone are not enough to keep uids unique: the counter is per-module, so
+ * every spec FILE starts it at 1, and two files whose first user is created in the same millisecond
+ * would otherwise be handed the identical uid — which fails as "the user with the provided uid already
+ * exists" in whichever file loses. Kept numeric so a uid stays digits-only.
+ */ var testUidRandomFactory = randomNumberFactory({
+    min: 100000,
+    max: 1000000,
+    round: 'floor'
+});
 /**
  * Incrementing number factory for generating test UID values.
  *
- * Has the format 'test-uid-<number>'
+ * Has the format '<timestamp>0<counter><random>'
  */ var testUidFactory = mapGetter(incrementingNumberFactory(), function(i) {
-    return "".concat(Date.now(), "0").concat(i);
+    return "".concat(Date.now(), "0").concat(i).concat(testUidRandomFactory());
 });
 /**
  * Creates a CallableContextOptions with auth attached corresponding to the input UserRecord.

package/test/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/test",
-  "version": "13.32.0",
+  "version": "13.34.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.32.0",
-    "@dereekb/date": "13.32.0",
-    "@dereekb/firebase": "13.32.0",
-    "@dereekb/firebase-server": "13.32.0",
-    "@dereekb/firebase-server/oidc": "13.32.0",
-    "@dereekb/model": "13.32.0",
-    "@dereekb/nestjs": "13.32.0",
-    "@dereekb/rxjs": "13.32.0",
-    "@dereekb/util": "13.32.0",
+    "@dereekb/analytics": "13.34.0",
+    "@dereekb/date": "13.34.0",
+    "@dereekb/firebase": "13.34.0",
+    "@dereekb/firebase-server": "13.34.0",
+    "@dereekb/firebase-server/oidc": "13.34.0",
+    "@dereekb/model": "13.34.0",
+    "@dereekb/nestjs": "13.34.0",
+    "@dereekb/rxjs": "13.34.0",
+    "@dereekb/util": "13.34.0",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@nestjs/common": "^11.1.19",
@@ -23,7 +23,7 @@
     "supertest": "^7.2.2"
   },
   "devDependencies": {
-    "@dereekb/nestjs": "13.32.0"
+    "@dereekb/nestjs": "13.34.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/test/src/lib/firebase/firebase.admin.auth.d.ts

@@ -283,7 +283,7 @@ export declare function authorizedUserContextFactory<PI extends FirebaseAdminTes
 /**
  * Incrementing number factory for generating test UID values.
  *
- * Has the format 'test-uid-<number>'
+ * Has the format '<timestamp>0<counter><random>'
  */
 export declare const testUidFactory: Factory<FirebaseAuthUserId>;
 /**

package/twilio/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@dereekb/firebase-server/twilio",
-  "version": "13.32.0",
+  "version": "13.34.0",
   "peerDependencies": {
-    "@dereekb/date": "13.32.0",
-    "@dereekb/firebase": "13.32.0",
-    "@dereekb/firebase-server": "13.32.0",
-    "@dereekb/model": "13.32.0",
-    "@dereekb/nestjs": "13.32.0",
-    "@dereekb/rxjs": "13.32.0",
-    "@dereekb/util": "13.32.0"
+    "@dereekb/date": "13.34.0",
+    "@dereekb/firebase": "13.34.0",
+    "@dereekb/firebase-server": "13.34.0",
+    "@dereekb/model": "13.34.0",
+    "@dereekb/nestjs": "13.34.0",
+    "@dereekb/rxjs": "13.34.0",
+    "@dereekb/util": "13.34.0"
   },
   "exports": {
     "./package.json": "./package.json",