@dereekb/firebase-server 13.35.0 → 13.37.0

package/oidc/src/lib/profile.d.ts

@@ -34,3 +34,24 @@ export interface OidcClientProviderProfileScopes<S extends OidcScope = OidcScope
  * @returns The unlocked and required scope sets for the client.
  */
 export declare function oidcClientProviderProfileScopes<S extends OidcScope = OidcScope>(providerProfiles: readonly OidcProviderProfile<S>[] | undefined, clientProfileKeys: readonly OidcProviderProfileKey[] | undefined): OidcClientProviderProfileScopes<S>;
+/**
+ * The subset of an {@link OidcProviderConfig} needed to resolve its admin-only scopes. Declared
+ * structurally so this module stays free of a dependency on the config type.
+ */
+export interface OidcAdminOnlyScopesInput<S extends OidcScope = OidcScope> {
+    readonly adminOnlyScopes?: readonly string[];
+    readonly providerProfiles?: readonly OidcProviderProfile<S>[];
+}
+/**
+ * Resolves every scope restricted to admin users: the provider config's own `adminOnlyScopes`
+ * unioned with the scopes of each profile marked {@link OidcProviderProfile.adminOnly}.
+ *
+ * The single choke point for that union — the consent admin-only gate (which hard-rejects a
+ * non-admin who consented to one) and the consent URL builder (which withholds them from a
+ * non-admin's consent screen in the first place) both read through it, so the set a user is
+ * offered and the set they are judged against cannot drift apart.
+ *
+ * @param providerConfig - The provider config supplying `adminOnlyScopes` and the profile registry.
+ * @returns The union of config-level and profile-level admin-only scopes.
+ */
+export declare function adminOnlyScopesForOidcProviderConfig<S extends OidcScope = OidcScope>(providerConfig: OidcAdminOnlyScopesInput<S>): Set<string>;

package/oidc/src/lib/service/index.d.ts

@@ -9,3 +9,4 @@ export * from './oidc.jwks.service';
 export * from './oidc.config.service';
 export * from './oidc.client.service';
 export * from './oidc.interaction.service';
+export * from './oidc.interaction-policy';

package/oidc/src/lib/service/oidc.config.service.d.ts

@@ -81,6 +81,20 @@ export declare class OidcProviderConfigService {
      * Scopes derived from the claims configuration keys.
      */
     readonly scopesSupported: string[];
+    /**
+     * {@link scopesSupported} minus the scopes only an admin-assigned {@link OidcProviderProfile}
+     * unlocks — what an arbitrary client (a dynamically registered one included) may actually put in
+     * an authorization request.
+     *
+     * The issuer's own discovery document keeps advertising the full {@link scopesSupported}: the
+     * provider does support those scopes, for the clients holding the profile. This narrower list is
+     * for metadata a client treats as a request template — notably an MCP protected-resource
+     * document's `scopes_supported`, which dynamic-registration clients (the Claude Code CLI) copy
+     * verbatim onto `/authorize`. An assignment-only scope advertised there ends the flow in
+     * `access_denied`: the consent unlock gate judges the REQUEST, so unlike an admin-only scope
+     * there is no deselect-at-consent way through.
+     */
+    readonly clientRequestableScopesSupported: string[];
     /**
      * Flat list of all unique claim names from the claims configuration.
      */

package/oidc/src/lib/service/oidc.interaction-policy.d.ts

@@ -0,0 +1,35 @@
+import { type interactionPolicy } from 'oidc-provider';
+/**
+ * Reason string of the check {@link buildOidcInteractionPolicy} adds to the `login` prompt.
+ */
+export declare const STALE_SESSION_ACCOUNT_CHECK_REASON = "stale_session_account";
+/**
+ * The `interactionPolicy` namespace as imported at runtime.
+ *
+ * Passed in rather than imported here because `oidc-provider` is ESM-only and the service reaches
+ * it through a dynamic `import()`; taking it as an argument keeps this module synchronously
+ * testable.
+ */
+export type OidcInteractionPolicyNamespace = typeof interactionPolicy;
+/**
+ * Builds the interaction policy: oidc-provider's default prompts, plus a `login` check that
+ * catches a session whose account no longer resolves.
+ *
+ * The default policy crashes on that case. `login`'s `no_session` check passes on
+ * `oidc.session.accountId` alone — the value in the `_session` cookie — while `loadAccount` puts
+ * the result of `findAccount` on `oidc.account`, and `loadGrant` establishes `oidc.grant` ONLY when
+ * that account resolved. So a cookie naming a deleted account skips the login prompt, reaches the
+ * `consent` prompt's `op_scopes_missing` check, and dereferences `oidc.grant.getOIDCScopeEncountered()`
+ * on `undefined` — a `TypeError` that oidc-provider renders as an opaque `server_error`, on every
+ * authorization request, until the user clears the cookie by hand.
+ *
+ * Deleted accounts are ordinary: an emulator database reset in development, an account deletion in
+ * production. Re-authenticating is the correct response, so this requests the `login` prompt and the
+ * user recovers by logging in. The check is added to `login` rather than guarding `consent` so the
+ * prompt loop short-circuits before any consent check runs (it breaks on the first prompt that
+ * fires).
+ *
+ * @param policyNamespace - The `interactionPolicy` namespace from the runtime `oidc-provider` import.
+ * @returns The default policy with the stale-session check installed on the `login` prompt.
+ */
+export declare function buildOidcInteractionPolicy(policyNamespace: OidcInteractionPolicyNamespace): interactionPolicy.DefaultPolicy;

package/oidc/src/lib/service/oidc.service.d.ts

@@ -34,6 +34,7 @@ export declare class OidcService {
     private readonly accountService;
     private readonly collections;
     private readonly encryptionService;
+    private readonly _logger;
     private readonly _getProvider;
     constructor(config: OidcModuleConfig, providerConfigService: OidcProviderConfigService, jwksService: JwksService, accountService: OidcAccountService, collections: OidcServerFirestoreCollections, encryptionService: OidcEncryptionService);
     /**
@@ -108,4 +109,32 @@ export declare class OidcService {
      */
     buildProviderConfiguration(cookieKeys: string[]): Configuration;
     private _buildProvider;
+    /**
+     * Whether the user an interaction resolved to is an admin.
+     *
+     * Reads the same `isAdminUser` delegate the consent admin-only gate uses. Fails closed — an
+     * interaction with no resolved account (the login prompt, before authentication) or a delegate
+     * that does not implement the hook is treated as non-admin, so admin-only scopes are withheld
+     * unless admin status is positively established.
+     *
+     * @param interaction - The interaction whose session account should be checked.
+     * @returns True when the interaction's account resolves to an admin user.
+     */
+    private _isAdminInteractionUser;
+    /**
+     * Wires oidc-provider's error events to the Nest logger.
+     *
+     * oidc-provider catches everything thrown inside its koa stack and renders the generic
+     * `{"error":"server_error","error_description":"oops! something went wrong"}` body. The real
+     * cause is only ever handed to the `server_error` event — with no listener it is dropped, and a
+     * failing authorization request is undiagnosable from either the response or the function logs.
+     *
+     * `grant.error` / `introspection.error` / `revocation.error` cover the token-endpoint equivalents.
+     * These are all genuine server-side faults; expected protocol rejections (`invalid_client`,
+     * `access_denied`, …) travel as normal responses and are NOT emitted here, so this stays quiet in
+     * healthy operation.
+     *
+     * @param provider - The constructed oidc-provider instance to attach listeners to.
+     */
+    private _attachProviderErrorLogging;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/firebase-server",
-  "version": "13.35.0",
+  "version": "13.37.0",
   "sideEffects": false,
   "exports": {
     "./test": {
@@ -69,20 +69,21 @@
   "types": "./src/index.d.ts",
   "peerDependencies": {
     "@cantoo/pdf-lib": "^2.6.5",
-    "@dereekb/analytics": "13.35.0",
-    "@dereekb/calcom": "13.35.0",
-    "@dereekb/date": "13.35.0",
-    "@dereekb/dbx-core": "13.35.0",
-    "@dereekb/discord": "13.35.0",
-    "@dereekb/firebase": "13.35.0",
-    "@dereekb/model": "13.35.0",
-    "@dereekb/nestjs": "13.35.0",
-    "@dereekb/rxjs": "13.35.0",
-    "@dereekb/util": "13.35.0",
-    "@dereekb/zoho": "13.35.0",
+    "@dereekb/analytics": "13.37.0",
+    "@dereekb/calcom": "13.37.0",
+    "@dereekb/date": "13.37.0",
+    "@dereekb/dbx-core": "13.37.0",
+    "@dereekb/discord": "13.37.0",
+    "@dereekb/firebase": "13.37.0",
+    "@dereekb/model": "13.37.0",
+    "@dereekb/nestjs": "13.37.0",
+    "@dereekb/rxjs": "13.37.0",
+    "@dereekb/util": "13.37.0",
+    "@dereekb/zoho": "13.37.0",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
-    "@modelcontextprotocol/sdk": "1.29.0",
+    "@modelcontextprotocol/node": "2.0.0",
+    "@modelcontextprotocol/server": "2.0.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "@nestjs/core": "^11.1.19",

package/test/index.cjs.js

@@ -824,7 +824,7 @@ function _ts_generator$a(thisArg, body) {
         auth_time: decoded.iat,
         firebase: (_ref = (_decoded_claims = decoded.claims) === null || _decoded_claims === void 0 ? void 0 : _decoded_claims.firebase) !== null && _ref !== void 0 ? _ref : {}
     });
-    delete decodedToken.claims; // remove the "claims" item if it exists.
+    delete decodedToken['claims']; // remove the "claims" item if it exists.
     return decodedToken;
 }
 /**
@@ -1318,8 +1318,8 @@ var adminEnvironmentInitialized = false;
  * @returns The newly generated project ID.
  */ function rollNewGCloudProjectEnvironmentVariable() {
     var projectId = generateNewProjectId();
-    process.env.GCLOUD_TEST_PROJECT = projectId;
-    process.env.GCLOUD_PROJECT = projectId;
+    process.env['GCLOUD_TEST_PROJECT'] = projectId;
+    process.env['GCLOUD_PROJECT'] = projectId;
     applyFirebaseGCloudTestProjectIdToFirebaseConfigEnv();
     return projectId;
 }
@@ -1330,7 +1330,7 @@ var adminEnvironmentInitialized = false;
  *
  * @returns The current value of `process.env.GCLOUD_PROJECT`, or `undefined` when unset.
  */ function getGCloudProjectId() {
-    return process.env.GCLOUD_PROJECT;
+    return process.env['GCLOUD_PROJECT'];
 }
 /**
  * Reads the current `GCLOUD_TEST_PROJECT` environment variable.
@@ -1341,7 +1341,7 @@ var adminEnvironmentInitialized = false;
  *
  * @returns The current value of `process.env.GCLOUD_TEST_PROJECT`, or `undefined` when unset.
  */ function getGCloudTestProjectId() {
-    return process.env.GCLOUD_TEST_PROJECT;
+    return process.env['GCLOUD_TEST_PROJECT'];
 }
 /**
  * Applies the current GCLOUD_PROJECT to FIREBASE_CONFIG.
@@ -1360,10 +1360,10 @@ var adminEnvironmentInitialized = false;
     if (!testProjectId) {
         throw new Error('No test project id was available in the environment. Did you call initFirebaseAdminTestEnvironment() first?');
     }
-    var config = JSON.parse((_process_env_FIREBASE_CONFIG = process.env.FIREBASE_CONFIG) !== null && _process_env_FIREBASE_CONFIG !== void 0 ? _process_env_FIREBASE_CONFIG : '{}');
+    var config = JSON.parse((_process_env_FIREBASE_CONFIG = process.env['FIREBASE_CONFIG']) !== null && _process_env_FIREBASE_CONFIG !== void 0 ? _process_env_FIREBASE_CONFIG : '{}');
     config.projectId = testProjectId;
-    process.env.FIREBASE_CONFIG = JSON.stringify(config);
-    process.env.GCLOUD_PROJECT = testProjectId; // re-apply to GCLOUD_PROJECT too
+    process.env['FIREBASE_CONFIG'] = JSON.stringify(config);
+    process.env['GCLOUD_PROJECT'] = testProjectId; // re-apply to GCLOUD_PROJECT too
     return testProjectId;
 }
 /**

package/test/index.esm.js

@@ -823,7 +823,7 @@ function _ts_generator$a(thisArg, body) {
         auth_time: decoded.iat,
         firebase: (_ref = (_decoded_claims = decoded.claims) === null || _decoded_claims === void 0 ? void 0 : _decoded_claims.firebase) !== null && _ref !== void 0 ? _ref : {}
     });
-    delete decodedToken.claims; // remove the "claims" item if it exists.
+    delete decodedToken['claims']; // remove the "claims" item if it exists.
     return decodedToken;
 }
 /**
@@ -1317,8 +1317,8 @@ var adminEnvironmentInitialized = false;
  * @returns The newly generated project ID.
  */ function rollNewGCloudProjectEnvironmentVariable() {
     var projectId = generateNewProjectId();
-    process.env.GCLOUD_TEST_PROJECT = projectId;
-    process.env.GCLOUD_PROJECT = projectId;
+    process.env['GCLOUD_TEST_PROJECT'] = projectId;
+    process.env['GCLOUD_PROJECT'] = projectId;
     applyFirebaseGCloudTestProjectIdToFirebaseConfigEnv();
     return projectId;
 }
@@ -1329,7 +1329,7 @@ var adminEnvironmentInitialized = false;
  *
  * @returns The current value of `process.env.GCLOUD_PROJECT`, or `undefined` when unset.
  */ function getGCloudProjectId() {
-    return process.env.GCLOUD_PROJECT;
+    return process.env['GCLOUD_PROJECT'];
 }
 /**
  * Reads the current `GCLOUD_TEST_PROJECT` environment variable.
@@ -1340,7 +1340,7 @@ var adminEnvironmentInitialized = false;
  *
  * @returns The current value of `process.env.GCLOUD_TEST_PROJECT`, or `undefined` when unset.
  */ function getGCloudTestProjectId() {
-    return process.env.GCLOUD_TEST_PROJECT;
+    return process.env['GCLOUD_TEST_PROJECT'];
 }
 /**
  * Applies the current GCLOUD_PROJECT to FIREBASE_CONFIG.
@@ -1359,10 +1359,10 @@ var adminEnvironmentInitialized = false;
     if (!testProjectId) {
         throw new Error('No test project id was available in the environment. Did you call initFirebaseAdminTestEnvironment() first?');
     }
-    var config = JSON.parse((_process_env_FIREBASE_CONFIG = process.env.FIREBASE_CONFIG) !== null && _process_env_FIREBASE_CONFIG !== void 0 ? _process_env_FIREBASE_CONFIG : '{}');
+    var config = JSON.parse((_process_env_FIREBASE_CONFIG = process.env['FIREBASE_CONFIG']) !== null && _process_env_FIREBASE_CONFIG !== void 0 ? _process_env_FIREBASE_CONFIG : '{}');
     config.projectId = testProjectId;
-    process.env.FIREBASE_CONFIG = JSON.stringify(config);
-    process.env.GCLOUD_PROJECT = testProjectId; // re-apply to GCLOUD_PROJECT too
+    process.env['FIREBASE_CONFIG'] = JSON.stringify(config);
+    process.env['GCLOUD_PROJECT'] = testProjectId; // re-apply to GCLOUD_PROJECT too
     return testProjectId;
 }
 /**

package/test/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/test",
-  "version": "13.35.0",
+  "version": "13.37.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.35.0",
-    "@dereekb/date": "13.35.0",
-    "@dereekb/firebase": "13.35.0",
-    "@dereekb/firebase-server": "13.35.0",
-    "@dereekb/firebase-server/oidc": "13.35.0",
-    "@dereekb/model": "13.35.0",
-    "@dereekb/nestjs": "13.35.0",
-    "@dereekb/rxjs": "13.35.0",
-    "@dereekb/util": "13.35.0",
+    "@dereekb/analytics": "13.37.0",
+    "@dereekb/date": "13.37.0",
+    "@dereekb/firebase": "13.37.0",
+    "@dereekb/firebase-server": "13.37.0",
+    "@dereekb/firebase-server/oidc": "13.37.0",
+    "@dereekb/model": "13.37.0",
+    "@dereekb/nestjs": "13.37.0",
+    "@dereekb/rxjs": "13.37.0",
+    "@dereekb/util": "13.37.0",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@nestjs/common": "^11.1.19",
@@ -23,7 +23,7 @@
     "supertest": "^7.2.2"
   },
   "devDependencies": {
-    "@dereekb/nestjs": "13.35.0"
+    "@dereekb/nestjs": "13.37.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/twilio/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@dereekb/firebase-server/twilio",
-  "version": "13.35.0",
+  "version": "13.37.0",
   "peerDependencies": {
-    "@dereekb/date": "13.35.0",
-    "@dereekb/firebase": "13.35.0",
-    "@dereekb/firebase-server": "13.35.0",
-    "@dereekb/model": "13.35.0",
-    "@dereekb/nestjs": "13.35.0",
-    "@dereekb/rxjs": "13.35.0",
-    "@dereekb/util": "13.35.0"
+    "@dereekb/date": "13.37.0",
+    "@dereekb/firebase": "13.37.0",
+    "@dereekb/firebase-server": "13.37.0",
+    "@dereekb/model": "13.37.0",
+    "@dereekb/nestjs": "13.37.0",
+    "@dereekb/rxjs": "13.37.0",
+    "@dereekb/util": "13.37.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/zoho/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/zoho",
-  "version": "13.35.0",
+  "version": "13.37.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.35.0",
-    "@dereekb/date": "13.35.0",
-    "@dereekb/model": "13.35.0",
-    "@dereekb/nestjs": "13.35.0",
-    "@dereekb/rxjs": "13.35.0",
-    "@dereekb/firebase": "13.35.0",
-    "@dereekb/firebase-server": "13.35.0",
-    "@dereekb/util": "13.35.0",
-    "@dereekb/zoho": "13.35.0",
+    "@dereekb/analytics": "13.37.0",
+    "@dereekb/date": "13.37.0",
+    "@dereekb/model": "13.37.0",
+    "@dereekb/nestjs": "13.37.0",
+    "@dereekb/rxjs": "13.37.0",
+    "@dereekb/firebase": "13.37.0",
+    "@dereekb/firebase-server": "13.37.0",
+    "@dereekb/util": "13.37.0",
+    "@dereekb/zoho": "13.37.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "express": "^5.2.1"