@dereekb/firebase-server 13.36.0 → 13.38.0

package/oidc/index.esm.js

@@ -3,7 +3,7 @@ import { errors } from 'oidc-provider';
 import { SECONDS_IN_MINUTE, SECONDS_IN_DAY, cachedGetter, unixDateTimeSecondsNumberToDate, unixDateTimeSecondsNumberForNow, selectiveFieldEncryptor, filterUndefinedValues, websiteUrlFromPaths, firstValue, hasHttpPrefix } from '@dereekb/util';
 import { generateKeyPairSync, randomBytes } from 'node:crypto';
 import { resolveEncryptionKey, encryptValue, decryptValue, createAesStringEncryptionProvider, isValidAES256GCMEncryptionSecret } from '@dereekb/nestjs';
-import { where, iterateFirestoreDocumentSnapshotPairs, firestoreModelIdentity, snapshotConverterFunctions, optionalFirestoreDate, firestoreDate, firestoreEnum, firestorePassThroughField, AbstractFirestoreDocument, createOidcClientParamsType, deleteOidcClientParamsType, deleteOidcTokenParamsType, rotateOidcClientSecretParamsType, updateOidcClientParamsType, firestoreModelKey, oidcEntryIdentity, PUBLIC_PKCE_TOKEN_ENDPOINT_AUTH_METHOD, OIDC_ENTRY_CLIENT_TYPE, oidcEntriesByUserCodeQuery, oidcEntriesByUidQuery, oidcEntriesByGrantIdQuery, oidcProviderProfilesForClient, requiredScopesForOidcProviderProfiles, scopesForOidcProviderProfiles, oidcScopesFromScopeClaim, adminOnlyScopesForOidcProviderProfiles, oidcEntryFirestoreCollection } from '@dereekb/firebase';
+import { where, iterateFirestoreDocumentSnapshotPairs, firestoreModelIdentity, snapshotConverterFunctions, optionalFirestoreDate, firestoreDate, firestoreEnum, firestorePassThroughField, AbstractFirestoreDocument, createOidcClientParamsType, deleteOidcClientParamsType, deleteOidcTokenParamsType, rotateOidcClientSecretParamsType, updateOidcClientParamsType, firestoreModelKey, oidcEntryIdentity, PUBLIC_PKCE_TOKEN_ENDPOINT_AUTH_METHOD, OIDC_ENTRY_CLIENT_TYPE, oidcEntriesByUserCodeQuery, oidcEntriesByUidQuery, oidcEntriesByGrantIdQuery, assignmentOnlyScopesForOidcProviderProfiles, adminOnlyScopesForOidcProviderProfiles, oidcProviderProfilesForClient, requiredScopesForOidcProviderProfiles, scopesForOidcProviderProfiles, oidcScopesFromScopeClaim, oidcEntryFirestoreCollection } from '@dereekb/firebase';
 import { firestoreEncryptedField, firebaseServerActionsContext, FirebaseServerEnvService, FirebaseServerAnalyticsService, FIREBASE_FIRESTORE_CONTEXT_TOKEN, FirebaseServerFirestoreContextModule } from '@dereekb/firebase-server';
 import { nanoid } from 'nanoid';
 import { safeToJsDate } from '@dereekb/date';
@@ -2817,7 +2817,7 @@ function _define_property$b(obj, key, value) {
     }
     return obj;
 }
-function _instanceof$2(left, right) {
+function _instanceof$3(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -2986,7 +2986,7 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
                                 case 0:
                                     // Set ownership key for Client entries so firestore rules can restrict reads by owner.
                                     // The firestoreOwnerKey is passed through the payload metadata by OidcClientService.
-                                    o = this.name === OIDC_ENTRY_CLIENT_TYPE ? payload.firestoreOwnerKey : undefined;
+                                    o = this.name === OIDC_ENTRY_CLIENT_TYPE ? payload['firestoreOwnerKey'] : undefined;
                                     // oidc-provider uses `accountId` as the user identifier on Grant, AccessToken,
                                     // RefreshToken, etc. — `payload.uid` is only populated on Session/Interaction.
                                     // Fall back to `accountId` so the indexed `uid` column works for all entry types.
@@ -3000,7 +3000,7 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
                                     // inherit `iat` (epoch seconds) from BaseToken; Client entries use
                                     // `created_at` (ISO string).
                                     iat = payload.iat;
-                                    createdAtIso = payload.created_at;
+                                    createdAtIso = payload['created_at'];
                                     if (typeof iat === 'number') {
                                         createdAt = unixDateTimeSecondsNumberToDate(iat);
                                     } else if (createdAtIso) {
@@ -3228,7 +3228,7 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
                 value: function _toPayload(data) {
                     var expiresDate;
                     if (data.expiresAt) {
-                        expiresDate = _instanceof$2(data.expiresAt, Date) ? data.expiresAt : data.expiresAt.toDate();
+                        expiresDate = _instanceof$3(data.expiresAt, Date) ? data.expiresAt : data.expiresAt.toDate();
                     }
                     var isExpired = expiresDate != null && expiresDate < new Date();
                     return isExpired ? undefined : encryptionService.decryptAdapterPayload(data.payload);
@@ -3240,13 +3240,13 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
     return FirestoreAdapter;
 }
 
-function _array_like_to_array$6(arr, len) {
+function _array_like_to_array$7(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$6(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$6(arr);
+function _array_without_holes$7(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$7(arr);
 }
 function _class_call_check$a(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
@@ -3279,22 +3279,22 @@ function _define_property$a(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$6(iter) {
+function _iterable_to_array$7(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$6() {
+function _non_iterable_spread$7() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$6(arr) {
-    return _array_without_holes$6(arr) || _iterable_to_array$6(arr) || _unsupported_iterable_to_array$6(arr) || _non_iterable_spread$6();
+function _to_consumable_array$7(arr) {
+    return _array_without_holes$7(arr) || _iterable_to_array$7(arr) || _unsupported_iterable_to_array$7(arr) || _non_iterable_spread$7();
 }
-function _unsupported_iterable_to_array$6(o, minLen) {
+function _unsupported_iterable_to_array$7(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$6(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$7(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$6(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$7(o, minLen);
 }
 // MARK: Encrypted Fields
 /**
@@ -3322,7 +3322,7 @@ function _unsupported_iterable_to_array$6(o, minLen) {
         this.provider = createAesStringEncryptionProvider(config.jwksKeyConverterConfig.encryptionSecret);
         this.adapterPayloadEncryptor = selectiveFieldEncryptor({
             provider: this.provider,
-            fields: _to_consumable_array$6(OIDC_ENCRYPTED_PAYLOAD_FIELDS)
+            fields: _to_consumable_array$7(OIDC_ENCRYPTED_PAYLOAD_FIELDS)
         });
     }
     _create_class$8(OidcEncryptionService, [
@@ -3358,13 +3358,13 @@ OidcEncryptionService = __decorate([
     __param(0, Inject(OidcModuleConfig))
 ], OidcEncryptionService);
 
-function _array_like_to_array$5(arr, len) {
+function _array_like_to_array$6(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$5(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$5(arr);
+function _array_without_holes$6(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$6(arr);
 }
 function _class_call_check$9(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
@@ -3397,22 +3397,22 @@ function _define_property$9(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$5(iter) {
+function _iterable_to_array$6(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$5() {
+function _non_iterable_spread$6() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$5(arr) {
-    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$5(arr) || _non_iterable_spread$5();
+function _to_consumable_array$6(arr) {
+    return _array_without_holes$6(arr) || _iterable_to_array$6(arr) || _unsupported_iterable_to_array$6(arr) || _non_iterable_spread$6();
 }
-function _unsupported_iterable_to_array$5(o, minLen) {
+function _unsupported_iterable_to_array$6(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$5(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$6(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$5(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$6(o, minLen);
 }
 // MARK: Routes
 /**
@@ -3461,7 +3461,7 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
  */ var OidcProviderConfigService = /*#__PURE__*/ function() {
     function OidcProviderConfigService(config, accountService, envService) {
         _class_call_check$9(this, OidcProviderConfigService);
-        var _this_config_tokenEndpointAuthMethods;
+        var _this_providerConfig_providerProfiles, _this_config_tokenEndpointAuthMethods;
         _define_property$9(this, "config", void 0);
         _define_property$9(this, "routes", DEFAULT_OIDC_ROUTES);
         /**
@@ -3480,6 +3480,19 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
      * Scopes derived from the claims configuration keys.
      */ _define_property$9(this, "scopesSupported", void 0);
         /**
+     * {@link scopesSupported} minus the scopes only an admin-assigned {@link OidcProviderProfile}
+     * unlocks — what an arbitrary client (a dynamically registered one included) may actually put in
+     * an authorization request.
+     *
+     * The issuer's own discovery document keeps advertising the full {@link scopesSupported}: the
+     * provider does support those scopes, for the clients holding the profile. This narrower list is
+     * for metadata a client treats as a request template — notably an MCP protected-resource
+     * document's `scopes_supported`, which dynamic-registration clients (the Claude Code CLI) copy
+     * verbatim onto `/authorize`. An assignment-only scope advertised there ends the flow in
+     * `access_denied`: the consent unlock gate judges the REQUEST, so unlike an admin-only scope
+     * there is no deselect-at-consent way through.
+     */ _define_property$9(this, "clientRequestableScopesSupported", void 0);
+        /**
      * Flat list of all unique claim names from the claims configuration.
      */ _define_property$9(this, "claimsSupported", void 0);
         /**
@@ -3488,8 +3501,12 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
         this.config = config;
         this.providerConfig = accountService.providerConfig;
         this.scopesSupported = Object.keys(this.providerConfig.claims);
+        var assignmentOnlyScopes = assignmentOnlyScopesForOidcProviderProfiles((_this_providerConfig_providerProfiles = this.providerConfig.providerProfiles) !== null && _this_providerConfig_providerProfiles !== void 0 ? _this_providerConfig_providerProfiles : []);
+        this.clientRequestableScopesSupported = this.scopesSupported.filter(function(scope) {
+            return !assignmentOnlyScopes.has(scope);
+        });
         this.claimsSupported = Array.from(new Set(Object.values(this.providerConfig.claims).flat()));
-        this.tokenEndpointAuthMethodsSupported = (_this_config_tokenEndpointAuthMethods = this.config.tokenEndpointAuthMethods) !== null && _this_config_tokenEndpointAuthMethods !== void 0 ? _this_config_tokenEndpointAuthMethods : _to_consumable_array$5(DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS);
+        this.tokenEndpointAuthMethodsSupported = (_this_config_tokenEndpointAuthMethods = this.config.tokenEndpointAuthMethods) !== null && _this_config_tokenEndpointAuthMethods !== void 0 ? _this_config_tokenEndpointAuthMethods : _to_consumable_array$6(DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS);
         var appUrl = envService.appUrl;
         this.appLoginUrl = websiteUrlFromPaths(appUrl, [
             this.config.appOAuthInteractionPath,
@@ -3522,16 +3539,16 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
                     jwks_uri: jwksUri !== null && jwksUri !== void 0 ? jwksUri : "".concat(issuer).concat(routes.jwks),
                     registration_endpoint: this.oidcRegistrationRouteEnabled ? "".concat(issuer).concat(routes.registration) : undefined,
                     scopes_supported: this.scopesSupported,
-                    response_types_supported: _to_consumable_array$5(providerConfig.responseTypes),
+                    response_types_supported: _to_consumable_array$6(providerConfig.responseTypes),
                     response_modes_supported: [
                         'query'
                     ],
-                    grant_types_supported: _to_consumable_array$5(providerConfig.grantTypes),
-                    subject_types_supported: _to_consumable_array$5(DEFAULT_OIDC_SUBJECT_TYPES),
-                    id_token_signing_alg_values_supported: _to_consumable_array$5(DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES),
-                    token_endpoint_auth_methods_supported: _to_consumable_array$5(this.tokenEndpointAuthMethodsSupported),
+                    grant_types_supported: _to_consumable_array$6(providerConfig.grantTypes),
+                    subject_types_supported: _to_consumable_array$6(DEFAULT_OIDC_SUBJECT_TYPES),
+                    id_token_signing_alg_values_supported: _to_consumable_array$6(DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES),
+                    token_endpoint_auth_methods_supported: _to_consumable_array$6(this.tokenEndpointAuthMethodsSupported),
                     claims_supported: this.claimsSupported,
-                    code_challenge_methods_supported: _to_consumable_array$5(DEFAULT_OIDC_CODE_CHALLENGE_METHODS)
+                    code_challenge_methods_supported: _to_consumable_array$6(DEFAULT_OIDC_CODE_CHALLENGE_METHODS)
                 };
             }
         }
@@ -3545,6 +3562,31 @@ OidcProviderConfigService = __decorate([
     __param(2, Inject(FirebaseServerEnvService))
 ], OidcProviderConfigService);
 
+function _array_like_to_array$5(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes$5(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$5(arr);
+}
+function _iterable_to_array$5(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread$5() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _to_consumable_array$5(arr) {
+    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$5(arr) || _non_iterable_spread$5();
+}
+function _unsupported_iterable_to_array$5(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$5(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$5(o, minLen);
+}
 /**
  * Custom oidc-provider client metadata field holding the {@link OidcProviderProfile} keys assigned
  * to a client. Registered via `extraClientMetadata` and persisted on the client's `OidcEntry` payload.
@@ -3570,6 +3612,61 @@ OidcProviderConfigService = __decorate([
         required: requiredScopesForOidcProviderProfiles(clientProfiles)
     };
 }
+/**
+ * Resolves every scope restricted to admin users: the provider config's own `adminOnlyScopes`
+ * unioned with the scopes of each profile marked {@link OidcProviderProfile.adminOnly}.
+ *
+ * The single choke point for that union — the consent admin-only gate (which hard-rejects a
+ * non-admin who consented to one) and the consent URL builder (which withholds them from a
+ * non-admin's consent screen in the first place) both read through it, so the set a user is
+ * offered and the set they are judged against cannot drift apart.
+ *
+ * @param providerConfig - The provider config supplying `adminOnlyScopes` and the profile registry.
+ * @returns The union of config-level and profile-level admin-only scopes.
+ */ function adminOnlyScopesForOidcProviderConfig(providerConfig) {
+    var _providerConfig_adminOnlyScopes, _providerConfig_providerProfiles;
+    return new Set(_to_consumable_array$5((_providerConfig_adminOnlyScopes = providerConfig.adminOnlyScopes) !== null && _providerConfig_adminOnlyScopes !== void 0 ? _providerConfig_adminOnlyScopes : []).concat(_to_consumable_array$5(adminOnlyScopesForOidcProviderProfiles((_providerConfig_providerProfiles = providerConfig.providerProfiles) !== null && _providerConfig_providerProfiles !== void 0 ? _providerConfig_providerProfiles : []))));
+}
+
+/**
+ * Reason string of the check {@link buildOidcInteractionPolicy} adds to the `login` prompt.
+ */ var STALE_SESSION_ACCOUNT_CHECK_REASON = 'stale_session_account';
+/**
+ * Builds the interaction policy: oidc-provider's default prompts, plus a `login` check that
+ * catches a session whose account no longer resolves.
+ *
+ * The default policy crashes on that case. `login`'s `no_session` check passes on
+ * `oidc.session.accountId` alone — the value in the `_session` cookie — while `loadAccount` puts
+ * the result of `findAccount` on `oidc.account`, and `loadGrant` establishes `oidc.grant` ONLY when
+ * that account resolved. So a cookie naming a deleted account skips the login prompt, reaches the
+ * `consent` prompt's `op_scopes_missing` check, and dereferences `oidc.grant.getOIDCScopeEncountered()`
+ * on `undefined` — a `TypeError` that oidc-provider renders as an opaque `server_error`, on every
+ * authorization request, until the user clears the cookie by hand.
+ *
+ * Deleted accounts are ordinary: an emulator database reset in development, an account deletion in
+ * production. Re-authenticating is the correct response, so this requests the `login` prompt and the
+ * user recovers by logging in. The check is added to `login` rather than guarding `consent` so the
+ * prompt loop short-circuits before any consent check runs (it breaks on the first prompt that
+ * fires).
+ *
+ * @param policyNamespace - The `interactionPolicy` namespace from the runtime `oidc-provider` import.
+ * @returns The default policy with the stale-session check installed on the `login` prompt.
+ */ function buildOidcInteractionPolicy(policyNamespace) {
+    var base = policyNamespace.base, Check = policyNamespace.Check;
+    var policy = base();
+    var loginPrompt = policy.get('login');
+    if (loginPrompt) {
+        var staleSessionAccountCheck = new Check(STALE_SESSION_ACCOUNT_CHECK_REASON, 'End-User authentication is required', 'login_required', function(ctx) {
+            var _oidc_session;
+            var oidc = ctx.oidc;
+            return ((_oidc_session = oidc.session) === null || _oidc_session === void 0 ? void 0 : _oidc_session.accountId) && !oidc.account ? Check.REQUEST_PROMPT : Check.NO_NEED_TO_PROMPT;
+        });
+        // Placed after `login_prompt`/`no_session` (appended) — order within a prompt only affects which
+        // reason is reported when several fire, and a stale account is the more specific diagnosis.
+        loginPrompt.checks.add(staleSessionAccountCheck);
+    }
+    return policy;
+}
 
 function _array_like_to_array$4(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
@@ -3639,6 +3736,14 @@ function _define_property$8(obj, key, value) {
     }
     return obj;
 }
+function _instanceof$2(left, right) {
+    "@swc/helpers - instanceof";
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
 function _iterable_to_array$4(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
@@ -3825,11 +3930,12 @@ function _ts_generator$5(thisArg, body) {
         };
     }
 }
+var OidcService_1;
 // MARK: Service
 /**
  * Core OIDC service that wraps the oidc-provider instance and exposes
  * typed methods for interaction handling, provider initialization, and JWKS management.
- */ var OidcService = /*#__PURE__*/ function() {
+ */ var OidcService = OidcService_1 = /*#__PURE__*/ function() {
     function OidcService(config, providerConfigService, jwksService, accountService, collections, encryptionService) {
         var _this = this;
         _class_call_check$8(this, OidcService);
@@ -3839,6 +3945,7 @@ function _ts_generator$5(thisArg, body) {
         _define_property$8(this, "accountService", void 0);
         _define_property$8(this, "collections", void 0);
         _define_property$8(this, "encryptionService", void 0);
+        _define_property$8(this, "_logger", new Logger(OidcService_1.name));
         _define_property$8(this, "_getProvider", cachedGetter(function() {
             return _this._buildProvider();
         }));
@@ -4237,11 +4344,11 @@ function _ts_generator$5(thisArg, body) {
                     interactions: {
                         url: function url(_ctx, interaction) {
                             return _async_to_generator$5(function() {
-                                var baseUrl, client_id, paramsToEncode, client, _client_dbx_provider_profiles, scopes, requestedScopeSet, required, requiredScopes, interactionLoginDetails, paramsString;
+                                var baseUrl, client_id, paramsToEncode, client, _client_dbx_provider_profiles, requestedScopes, isAdmin, adminOnlyScopes, offeredScopes, scopes, requestedScopeSet, required, requiredScopes, interactionLoginDetails, paramsString;
                                 return _ts_generator$5(this, function(_state) {
                                     switch(_state.label){
                                         case 0:
-                                            client_id = interaction.params.client_id;
+                                            client_id = interaction.params['client_id'];
                                             paramsToEncode = {
                                                 uid: interaction.uid,
                                                 client_id: client_id
@@ -4253,7 +4360,7 @@ function _ts_generator$5(thisArg, body) {
                                             baseUrl = this.providerConfigService.appLoginUrl;
                                             return [
                                                 3,
-                                                3
+                                                4
                                             ];
                                         case 1:
                                             baseUrl = this.providerConfigService.appConsentUrl;
@@ -4263,29 +4370,42 @@ function _ts_generator$5(thisArg, body) {
                                             ];
                                         case 2:
                                             client = _state.sent();
-                                            if (client) {
-                                                scopes = interaction.params.scope;
-                                                // Surface the scopes the client's provider profiles force-require so the consent UI can
-                                                // render them as required. Intersect with the actually-requested scopes so only visible
-                                                // scope rows are flagged.
-                                                requestedScopeSet = new Set(scopes.split(' ').filter(Boolean));
-                                                required = oidcClientProviderProfileScopes(providerConfig.providerProfiles, (_client_dbx_provider_profiles = client.dbx_provider_profiles) !== null && _client_dbx_provider_profiles !== void 0 ? _client_dbx_provider_profiles : undefined).required;
-                                                requiredScopes = Array.from(required).filter(function(scope) {
-                                                    return requestedScopeSet.has(scope);
-                                                });
-                                                interactionLoginDetails = _object_spread$3({
-                                                    client_id: client_id,
-                                                    client_name: client.client_name,
-                                                    client_uri: client.client_uri,
-                                                    logo_uri: client.logo_uri,
-                                                    scopes: scopes
-                                                }, requiredScopes.length > 0 ? {
-                                                    requiredScopes: requiredScopes.join(' ')
-                                                } : {});
-                                                paramsToEncode = _object_spread$3({}, paramsToEncode, interactionLoginDetails);
-                                            }
-                                            _state.label = 3;
+                                            if (!client) return [
+                                                3,
+                                                4
+                                            ];
+                                            requestedScopes = interaction.params['scope'].split(' ').filter(Boolean);
+                                            return [
+                                                4,
+                                                this._isAdminInteractionUser(interaction)
+                                            ];
                                         case 3:
+                                            isAdmin = _state.sent();
+                                            adminOnlyScopes = isAdmin ? undefined : adminOnlyScopesForOidcProviderConfig(providerConfig);
+                                            offeredScopes = adminOnlyScopes ? requestedScopes.filter(function(scope) {
+                                                return !adminOnlyScopes.has(scope);
+                                            }) : requestedScopes;
+                                            scopes = offeredScopes.join(' ');
+                                            // Surface the scopes the client's provider profiles force-require so the consent UI can
+                                            // render them as required. Intersect with the actually-offered scopes so only visible
+                                            // scope rows are flagged.
+                                            requestedScopeSet = new Set(offeredScopes);
+                                            required = oidcClientProviderProfileScopes(providerConfig.providerProfiles, (_client_dbx_provider_profiles = client.dbx_provider_profiles) !== null && _client_dbx_provider_profiles !== void 0 ? _client_dbx_provider_profiles : undefined).required;
+                                            requiredScopes = Array.from(required).filter(function(scope) {
+                                                return requestedScopeSet.has(scope);
+                                            });
+                                            interactionLoginDetails = _object_spread$3({
+                                                client_id: client_id,
+                                                client_name: client.client_name,
+                                                client_uri: client.client_uri,
+                                                logo_uri: client.logo_uri,
+                                                scopes: scopes
+                                            }, requiredScopes.length > 0 ? {
+                                                requiredScopes: requiredScopes.join(' ')
+                                            } : {});
+                                            paramsToEncode = _object_spread$3({}, paramsToEncode, interactionLoginDetails);
+                                            _state.label = 4;
+                                        case 4:
                                             paramsString = makeUrlSearchParamsString(paramsToEncode, {
                                                 useUrlSearchSpaceHandling: true
                                             });
@@ -4420,7 +4540,7 @@ function _ts_generator$5(thisArg, body) {
             value: // MARK: Internal
             function _buildProvider() {
                 return _async_to_generator$5(function() {
-                    var _this, _config_trustProxy, config, findAccount, signingKey, result, getEncryptionKey, cookieKey, adapterFactory, providerConfiguration, _ref, ProviderClass, provider;
+                    var _this, _config_trustProxy, config, findAccount, signingKey, result, getEncryptionKey, cookieKey, adapterFactory, providerConfiguration, _ref, ProviderClass, interactionPolicy, provider;
                     return _ts_generator$5(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -4461,8 +4581,14 @@ function _ts_generator$5(thisArg, body) {
                                     import('oidc-provider')
                                 ];
                             case 4:
-                                _ref = _state.sent(), ProviderClass = _ref.default;
+                                _ref = _state.sent(), ProviderClass = _ref.default, interactionPolicy = _ref.interactionPolicy;
                                 provider = new ProviderClass(config.issuer, _object_spread_props(_object_spread$3({}, providerConfiguration), {
+                                    // The policy is applied here rather than in buildProviderConfiguration() because it needs the
+                                    // `interactionPolicy` namespace off the dynamic (ESM-only) import, which that sync method has no
+                                    // access to. Spread the configured `interactions` so its `url` builder survives.
+                                    interactions: _object_spread_props(_object_spread$3({}, providerConfiguration.interactions), {
+                                        policy: buildOidcInteractionPolicy(interactionPolicy)
+                                    }),
                                     adapter: adapterFactory,
                                     findAccount: findAccount,
                                     jwks: {
@@ -4477,6 +4603,7 @@ function _ts_generator$5(thisArg, body) {
                                 // issuer's canonical host, so cookies set on the issuer host are not sent
                                 // on resume → "authorization request has expired".
                                 provider.proxy = (_config_trustProxy = config.trustProxy) !== null && _config_trustProxy !== void 0 ? _config_trustProxy : true;
+                                this._attachProviderErrorLogging(provider);
                                 if (config.suppressBodyParserWarning) ;
                                 return [
                                     2,
@@ -4486,11 +4613,66 @@ function _ts_generator$5(thisArg, body) {
                     });
                 }).call(this);
             }
+        },
+        {
+            key: "_isAdminInteractionUser",
+            value: /**
+     * Whether the user an interaction resolved to is an admin.
+     *
+     * Reads the same `isAdminUser` delegate the consent admin-only gate uses. Fails closed — an
+     * interaction with no resolved account (the login prompt, before authentication) or a delegate
+     * that does not implement the hook is treated as non-admin, so admin-only scopes are withheld
+     * unless admin status is positively established.
+     *
+     * @param interaction - The interaction whose session account should be checked.
+     * @returns True when the interaction's account resolves to an admin user.
+     */ function _isAdminInteractionUser(interaction) {
+                return _async_to_generator$5(function() {
+                    var _ref, _interaction_session, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, accountId;
+                    return _ts_generator$5(this, function(_state) {
+                        accountId = (_interaction_session = interaction.session) === null || _interaction_session === void 0 ? void 0 : _interaction_session.accountId;
+                        return [
+                            2,
+                            accountId ? (_ref = (_this_accountService_delegate_isAdminUser = (_this_accountService_delegate = this.accountService.delegate).isAdminUser) === null || _this_accountService_delegate_isAdminUser === void 0 ? void 0 : _this_accountService_delegate_isAdminUser.call(_this_accountService_delegate, this.accountService.userContext(accountId).authUserContext)) !== null && _ref !== void 0 ? _ref : false : false
+                        ];
+                    });
+                }).call(this);
+            }
+        },
+        {
+            /**
+     * Wires oidc-provider's error events to the Nest logger.
+     *
+     * oidc-provider catches everything thrown inside its koa stack and renders the generic
+     * `{"error":"server_error","error_description":"oops! something went wrong"}` body. The real
+     * cause is only ever handed to the `server_error` event — with no listener it is dropped, and a
+     * failing authorization request is undiagnosable from either the response or the function logs.
+     *
+     * `grant.error` / `introspection.error` / `revocation.error` cover the token-endpoint equivalents.
+     * These are all genuine server-side faults; expected protocol rejections (`invalid_client`,
+     * `access_denied`, …) travel as normal responses and are NOT emitted here, so this stays quiet in
+     * healthy operation.
+     *
+     * @param provider - The constructed oidc-provider instance to attach listeners to.
+     */ key: "_attachProviderErrorLogging",
+            value: function _attachProviderErrorLogging(provider) {
+                var _this = this;
+                var logError = function logError(event) {
+                    return function(ctx, err) {
+                        var route = ctx ? "".concat(ctx.method, " ").concat(ctx.path) : 'unknown route';
+                        _this._logger.error("oidc-provider ".concat(event, " on ").concat(route, ": ").concat(_instanceof$2(err, Error) ? err.stack : String(err)));
+                    };
+                };
+                provider.on('server_error', logError('server_error'));
+                provider.on('grant.error', logError('grant.error'));
+                provider.on('introspection.error', logError('introspection.error'));
+                provider.on('revocation.error', logError('revocation.error'));
+            }
         }
     ]);
     return OidcService;
 }();
-OidcService = __decorate([
+OidcService = OidcService_1 = __decorate([
     Injectable(),
     __param(0, Inject(OidcModuleConfig)),
     __param(1, Inject(OidcProviderConfigService)),
@@ -6265,9 +6447,9 @@ var OidcInteractionController_1;
                             case 5:
                                 interaction = _state.sent();
                                 prompt = interaction.prompt, params = interaction.params, session = interaction.session;
-                                clientId = params.client_id;
+                                clientId = params['client_id'];
                                 accountId = (_ref = session === null || session === void 0 ? void 0 : session.accountId) !== null && _ref !== void 0 ? _ref : '';
-                                missingOIDCScope = (_prompt_details_missingOIDCScope = prompt.details.missingOIDCScope) !== null && _prompt_details_missingOIDCScope !== void 0 ? _prompt_details_missingOIDCScope : [];
+                                missingOIDCScope = (_prompt_details_missingOIDCScope = prompt.details['missingOIDCScope']) !== null && _prompt_details_missingOIDCScope !== void 0 ? _prompt_details_missingOIDCScope : [];
                                 if (!interaction.grantId) return [
                                     3,
                                     7
@@ -6405,8 +6587,13 @@ var OidcInteractionController_1;
                                 // cannot know the caller's admin status when it builds that request. Gating on the request would
                                 // make an admin-only scope in `scopes_supported` fatal for every non-admin — deselecting it at
                                 // consent has to be a way through.
+                                //
+                                // A non-admin should not normally reach this gate at all: the consent URL builder withholds
+                                // admin-only scopes from their consent screen, so the scope never enters the consented set (see
+                                // `adminOnlyScopesForOidcProviderConfig`, which both sides read). This remains as defense in
+                                // depth for a consent submit that names the scope anyway.
                                 configAdminOnlyScopes = (_this_accountService_providerConfig_adminOnlyScopes = this.accountService.providerConfig.adminOnlyScopes) !== null && _this_accountService_providerConfig_adminOnlyScopes !== void 0 ? _this_accountService_providerConfig_adminOnlyScopes : [];
-                                adminOnlyScopes = new Set(_to_consumable_array$1(configAdminOnlyScopes).concat(_to_consumable_array$1(adminOnlyScopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []))));
+                                adminOnlyScopes = adminOnlyScopesForOidcProviderConfig(this.accountService.providerConfig);
                                 consentedAdminOnlyScopes = Array.from(adminOnlyScopes).filter(function(scope) {
                                     return consentedOIDCScopeSet.has(scope);
                                 });
@@ -6526,7 +6713,7 @@ var OidcInteractionController_1;
                                     }
                                 }
                                 encounteredOIDCClaims = grant.getOIDCClaimsEncountered();
-                                missingOIDCClaims = (_prompt_details_missingOIDCClaims = prompt.details.missingOIDCClaims) !== null && _prompt_details_missingOIDCClaims !== void 0 ? _prompt_details_missingOIDCClaims : [];
+                                missingOIDCClaims = (_prompt_details_missingOIDCClaims = prompt.details['missingOIDCClaims']) !== null && _prompt_details_missingOIDCClaims !== void 0 ? _prompt_details_missingOIDCClaims : [];
                                 if (missingOIDCClaims.length > 0) {
                                     _resolveEffectiveSubset = resolveEffectiveSubset({
                                         missing: missingOIDCClaims,
@@ -6540,7 +6727,7 @@ var OidcInteractionController_1;
                                         grant.rejectOIDCClaims(rejected1);
                                     }
                                 }
-                                missingResourceScopes = (_prompt_details_missingResourceScopes = prompt.details.missingResourceScopes) !== null && _prompt_details_missingResourceScopes !== void 0 ? _prompt_details_missingResourceScopes : {};
+                                missingResourceScopes = (_prompt_details_missingResourceScopes = prompt.details['missingResourceScopes']) !== null && _prompt_details_missingResourceScopes !== void 0 ? _prompt_details_missingResourceScopes : {};
                                 _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
                                 try {
                                     for(_iterator1 = Object.entries(missingResourceScopes)[Symbol.iterator](); !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
@@ -7818,4 +8005,4 @@ function _unsupported_iterable_to_array(o, minLen) {
     };
 }
 
-export { DBX_FIREBASE_SERVER_OIDC_PROVIDER_PROFILES_CLIENT_METADATA, DEFAULT_APP_OAUTH_CONSENT_PATH_PART, DEFAULT_APP_OAUTH_INTERACTION_PATH, DEFAULT_APP_OAUTH_LOGIN_PATH_PART, DEFAULT_MAX_ADMIN_LOGIN_DURATION_SECONDS, DEFAULT_MAX_NONADMIN_LOGIN_DURATION_SECONDS, DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_MAX_SERVICE_TOKEN_LOGIN_DURATION_SECONDS, DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_OIDC_ANALYTICS_EVENT_NAMES, DEFAULT_OIDC_ANALYTICS_EVENT_NAME_PREFIX, DEFAULT_OIDC_CODE_CHALLENGE_METHODS, DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES, DEFAULT_OIDC_ISSUER_PATH, DEFAULT_OIDC_ROUTES, DEFAULT_OIDC_SUBJECT_TYPES, DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, DEFAULT_OIDC_TOKEN_LIFETIMES, DEFAULT_ROTATED_KEY_MAX_AGE, FIREBASE_SERVER_OIDC_ANALYTICS_CONFIG, FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, FirebaseServerOidcAnalyticsService, GRANTABLE_MODEL_NAMES, JwksFirestoreCollections, JwksKeyDocument, JwksService, JwksServiceConfig, JwksServiceStorageConfig, OIDC_ANALYTICS_SERVICE, OIDC_ENCRYPTED_PAYLOAD_FIELDS, OIDC_JSON_RENDER_ERROR_FUNCTION, OIDC_JWKS_ENCRYPTION_SECRET_ENV_KEY, OidcAccountService, OidcAccountServiceDelegate, OidcAccountServiceUserContext, OidcAnalyticsService, OidcAuth, OidcAuthBearerTokenMiddleware, OidcAuthMiddlewareConfig, OidcClientService, OidcEncryptionService, OidcInteractionController, OidcInteractionService, OidcModelServerActions, OidcModuleConfig, OidcProviderConfigService, OidcProviderController, OidcServerFirestoreCollections, OidcService, OidcWellKnownController, activeJwksKeysQuery, allOidcScopesStringForProviderConfig, appOidcAnalyticsModuleMetadata, appOidcModelModuleMetadata, applyOidcAuthMiddleware, applyOidcCorsMiddleware, buildBearerChallenge, buildFirebaseServerMcpResourceServer, createAdapterFactory, createOidcClientFactory, deleteOidcClientFactory, deleteOidcTokenFactory, deriveResourceMetadataUrlFromEnv, emitOidcAnalyticsEvent, getOidcScopesFromRequest, jwksKeyCollectionReference, jwksKeyConverter, jwksKeyFirestoreCollection, jwksKeyIdentity, jwksKeysWithStatusQuery, nonRetiredJwksKeysQuery, noopOidcAnalyticsService, oidcClientProviderProfileScopes, oidcCorsOriginDelegate, oidcFirestoreCollectionsFactory, oidcModelServerActions, oidcModelServerActionsFactory, oidcModuleConfigFactory, oidcModuleMetadata, resolveEffectiveSubset, rotateOidcClientSecretFactory, rotatedJwksKeysQuery, updateOidcClientFactory };
+export { DBX_FIREBASE_SERVER_OIDC_PROVIDER_PROFILES_CLIENT_METADATA, DEFAULT_APP_OAUTH_CONSENT_PATH_PART, DEFAULT_APP_OAUTH_INTERACTION_PATH, DEFAULT_APP_OAUTH_LOGIN_PATH_PART, DEFAULT_MAX_ADMIN_LOGIN_DURATION_SECONDS, DEFAULT_MAX_NONADMIN_LOGIN_DURATION_SECONDS, DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_MAX_SERVICE_TOKEN_LOGIN_DURATION_SECONDS, DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_OIDC_ANALYTICS_EVENT_NAMES, DEFAULT_OIDC_ANALYTICS_EVENT_NAME_PREFIX, DEFAULT_OIDC_CODE_CHALLENGE_METHODS, DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES, DEFAULT_OIDC_ISSUER_PATH, DEFAULT_OIDC_ROUTES, DEFAULT_OIDC_SUBJECT_TYPES, DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, DEFAULT_OIDC_TOKEN_LIFETIMES, DEFAULT_ROTATED_KEY_MAX_AGE, FIREBASE_SERVER_OIDC_ANALYTICS_CONFIG, FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, FirebaseServerOidcAnalyticsService, GRANTABLE_MODEL_NAMES, JwksFirestoreCollections, JwksKeyDocument, JwksService, JwksServiceConfig, JwksServiceStorageConfig, OIDC_ANALYTICS_SERVICE, OIDC_ENCRYPTED_PAYLOAD_FIELDS, OIDC_JSON_RENDER_ERROR_FUNCTION, OIDC_JWKS_ENCRYPTION_SECRET_ENV_KEY, OidcAccountService, OidcAccountServiceDelegate, OidcAccountServiceUserContext, OidcAnalyticsService, OidcAuth, OidcAuthBearerTokenMiddleware, OidcAuthMiddlewareConfig, OidcClientService, OidcEncryptionService, OidcInteractionController, OidcInteractionService, OidcModelServerActions, OidcModuleConfig, OidcProviderConfigService, OidcProviderController, OidcServerFirestoreCollections, OidcService, OidcWellKnownController, STALE_SESSION_ACCOUNT_CHECK_REASON, activeJwksKeysQuery, adminOnlyScopesForOidcProviderConfig, allOidcScopesStringForProviderConfig, appOidcAnalyticsModuleMetadata, appOidcModelModuleMetadata, applyOidcAuthMiddleware, applyOidcCorsMiddleware, buildBearerChallenge, buildFirebaseServerMcpResourceServer, buildOidcInteractionPolicy, createAdapterFactory, createOidcClientFactory, deleteOidcClientFactory, deleteOidcTokenFactory, deriveResourceMetadataUrlFromEnv, emitOidcAnalyticsEvent, getOidcScopesFromRequest, jwksKeyCollectionReference, jwksKeyConverter, jwksKeyFirestoreCollection, jwksKeyIdentity, jwksKeysWithStatusQuery, nonRetiredJwksKeysQuery, noopOidcAnalyticsService, oidcClientProviderProfileScopes, oidcCorsOriginDelegate, oidcFirestoreCollectionsFactory, oidcModelServerActions, oidcModelServerActionsFactory, oidcModuleConfigFactory, oidcModuleMetadata, resolveEffectiveSubset, rotateOidcClientSecretFactory, rotatedJwksKeysQuery, updateOidcClientFactory };

package/oidc/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/oidc",
-  "version": "13.36.0",
+  "version": "13.38.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.36.0",
-    "@dereekb/date": "13.36.0",
-    "@dereekb/firebase": "13.36.0",
-    "@dereekb/firebase-server": "13.36.0",
-    "@dereekb/model": "13.36.0",
-    "@dereekb/nestjs": "13.36.0",
-    "@dereekb/rxjs": "13.36.0",
-    "@dereekb/util": "13.36.0",
-    "@dereekb/zoho": "13.36.0",
+    "@dereekb/analytics": "13.38.0",
+    "@dereekb/date": "13.38.0",
+    "@dereekb/firebase": "13.38.0",
+    "@dereekb/firebase-server": "13.38.0",
+    "@dereekb/model": "13.38.0",
+    "@dereekb/nestjs": "13.38.0",
+    "@dereekb/rxjs": "13.38.0",
+    "@dereekb/util": "13.38.0",
+    "@dereekb/zoho": "13.38.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "express": "^5.2.1",