@dereekb/firebase-server 13.6.16 → 13.7.0

package/oidc/index.cjs.js

@@ -1,7 +1,7 @@
 'use strict';
 
 var common = require('@nestjs/common');
-var crypto = require('crypto');
+var node_crypto = require('node:crypto');
 var nestjs = require('@dereekb/nestjs');
 var firebase = require('@dereekb/firebase');
 var util = require('@dereekb/util');
@@ -52,7 +52,7 @@ function _class_call_check$g(instance, Constructor) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$e(target, props) {
+function _defineProperties$d(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -61,8 +61,8 @@ function _defineProperties$e(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$e(Constructor, protoProps, staticProps) {
-    if (staticProps) _defineProperties$e(Constructor, staticProps);
+function _create_class$d(Constructor, protoProps, staticProps) {
+    if (staticProps) _defineProperties$d(Constructor, staticProps);
     return Constructor;
 }
 function _define_property$f(obj, key, value) {
@@ -169,7 +169,7 @@ function _define_property$f(obj, key, value) {
      * Defaults to `false`.
      */ _define_property$f(this, "registrationEnabled", void 0);
     }
-    _create_class$e(OidcModuleConfig, null, [
+    _create_class$d(OidcModuleConfig, null, [
         {
             key: "assertValidConfig",
             value: /**
@@ -292,7 +292,7 @@ function _class_call_check$e(instance, Constructor) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$d(target, props) {
+function _defineProperties$c(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -301,8 +301,8 @@ function _defineProperties$d(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$d(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$d(Constructor.prototype, protoProps);
+function _create_class$c(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$c(Constructor.prototype, protoProps);
     return Constructor;
 }
 function _define_property$e(obj, key, value) {
@@ -534,7 +534,7 @@ exports.JwksService = /*#__PURE__*/ function() {
         this.saveJwksToStorage = (_config_enableSaveJwksToStorage = config.enableSaveJwksToStorage) !== null && _config_enableSaveJwksToStorage !== void 0 ? _config_enableSaveJwksToStorage : hasStorageFile;
         this.serveJwksFromStorage = (_config_serveJwksFromStorage = config.serveJwksFromStorage) !== null && _config_serveJwksFromStorage !== void 0 ? _config_serveJwksFromStorage : this.saveJwksToStorage;
     }
-    _create_class$d(JwksService, [
+    _create_class$c(JwksService, [
         {
             key: "jwksKeyCollection",
             get: function get() {
@@ -557,7 +557,7 @@ exports.JwksService = /*#__PURE__*/ function() {
                     return _ts_generator$a(this, function(_state) {
                         switch(_state.label){
                             case 0:
-                                _generateKeyPairSync = crypto.generateKeyPairSync('rsa', {
+                                _generateKeyPairSync = node_crypto.generateKeyPairSync('rsa', {
                                     modulusLength: 2048,
                                     publicKeyEncoding: {
                                         type: 'spki',
@@ -568,7 +568,7 @@ exports.JwksService = /*#__PURE__*/ function() {
                                         format: 'jwk'
                                     }
                                 }), publicKey = _generateKeyPairSync.publicKey, privateKey = _generateKeyPairSync.privateKey;
-                                kid = crypto.randomBytes(16).toString('hex');
+                                kid = node_crypto.randomBytes(16).toString('hex');
                                 publicJwk = _object_spread_props$3(_object_spread$6({}, publicKey), {
                                     kid: kid,
                                     kty: 'RSA',
@@ -998,7 +998,7 @@ function _class_call_check$d(instance, Constructor) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$c(target, props) {
+function _defineProperties$b(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -1007,8 +1007,8 @@ function _defineProperties$c(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$c(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$c(Constructor.prototype, protoProps);
+function _create_class$b(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$b(Constructor.prototype, protoProps);
     return Constructor;
 }
 function _define_property$d(obj, key, value) {
@@ -1183,7 +1183,7 @@ function _ts_generator$9(thisArg, body) {
         this._uid = _uid;
         this.authUserContext = this._service.authService.userContext(this._uid);
     }
-    _create_class$c(OidcAccountServiceUserContext, [
+    _create_class$b(OidcAccountServiceUserContext, [
         {
             key: "uid",
             get: function get() {
@@ -1267,7 +1267,7 @@ function _ts_generator$9(thisArg, body) {
         this.authService = authService;
         this.delegate = delegate;
     }
-    _create_class$c(OidcAccountService, [
+    _create_class$b(OidcAccountService, [
         {
             key: "providerConfig",
             get: /**
@@ -1309,7 +1309,7 @@ function _class_call_check$c(instance, Constructor) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$b(target, props) {
+function _defineProperties$a(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -1318,8 +1318,8 @@ function _defineProperties$b(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$b(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$b(Constructor.prototype, protoProps);
+function _create_class$a(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$a(Constructor.prototype, protoProps);
     return Constructor;
 }
 function _get_prototype_of(o) {
@@ -1388,7 +1388,7 @@ function _is_native_reflect_construct() {
         _class_call_check$c(this, JwksKeyDocument);
         return _call_super(this, JwksKeyDocument, arguments);
     }
-    _create_class$b(JwksKeyDocument, [
+    _create_class$a(JwksKeyDocument, [
         {
             key: "modelIdentity",
             get: function get() {
@@ -1783,7 +1783,7 @@ function _class_call_check$a(instance, Constructor) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$a(target, props) {
+function _defineProperties$9(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -1792,8 +1792,8 @@ function _defineProperties$a(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$a(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$a(Constructor.prototype, protoProps);
+function _create_class$9(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$9(Constructor.prototype, protoProps);
     return Constructor;
 }
 function _define_property$c(obj, key, value) {
@@ -1954,7 +1954,7 @@ function _ts_generator$7(thisArg, body) {
         _define_property$c(this, "oidcService", void 0);
         this.oidcService = oidcService;
     }
-    _create_class$a(OidcClientService, [
+    _create_class$9(OidcClientService, [
         {
             key: "createClient",
             value: /**
@@ -2012,7 +2012,7 @@ function _ts_generator$7(thisArg, body) {
                                     properties.jwks = validatedMetadata.jwks;
                                 }
                                 if (ProviderClient.needsSecret(properties)) {
-                                    clientSecret = crypto.randomBytes(64).toString('base64url');
+                                    clientSecret = node_crypto.randomBytes(64).toString('base64url');
                                     properties.client_secret = clientSecret;
                                     properties.client_secret_expires_at = 0;
                                 }
@@ -2148,7 +2148,7 @@ function _ts_generator$7(thisArg, body) {
                                 if (!existing) {
                                     throw new Error('Client not found.');
                                 }
-                                newSecret = crypto.randomBytes(64).toString('base64url');
+                                newSecret = node_crypto.randomBytes(64).toString('base64url');
                                 updatedMetadata = _object_spread_props$2(_object_spread$5({}, existing), {
                                     client_secret: newSecret,
                                     client_secret_expires_at: 0
@@ -2348,7 +2348,7 @@ function _class_call_check$9(instance, Constructor) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$9(target, props) {
+function _defineProperties$8(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -2357,8 +2357,8 @@ function _defineProperties$9(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$9(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$9(Constructor.prototype, protoProps);
+function _create_class$8(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$8(Constructor.prototype, protoProps);
     return Constructor;
 }
 function _define_property$a(obj, key, value) {
@@ -2530,7 +2530,7 @@ function _ts_generator$6(thisArg, body) {
             this.name = name;
             this.collection = collections.oidcEntryCollection;
         }
-        _create_class$9(FirestoreAdapter, [
+        _create_class$8(FirestoreAdapter, [
             {
                 key: "upsert",
                 value: function upsert(id, payload, expiresIn) {
@@ -2770,20 +2770,20 @@ function _ts_generator$6(thisArg, body) {
     return FirestoreAdapter;
 }
 
-function _array_like_to_array$5(arr, len) {
+function _array_like_to_array$4(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$4(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$5(arr);
+function _array_without_holes$3(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$4(arr);
 }
 function _class_call_check$8(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$8(target, props) {
+function _defineProperties$7(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -2792,8 +2792,8 @@ function _defineProperties$8(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$8(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$8(Constructor.prototype, protoProps);
+function _create_class$7(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$7(Constructor.prototype, protoProps);
     return Constructor;
 }
 function _define_property$9(obj, key, value) {
@@ -2809,22 +2809,22 @@ function _define_property$9(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$4(iter) {
+function _iterable_to_array$3(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$4() {
+function _non_iterable_spread$3() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$4(arr) {
-    return _array_without_holes$4(arr) || _iterable_to_array$4(arr) || _unsupported_iterable_to_array$5(arr) || _non_iterable_spread$4();
+function _to_consumable_array$3(arr) {
+    return _array_without_holes$3(arr) || _iterable_to_array$3(arr) || _unsupported_iterable_to_array$4(arr) || _non_iterable_spread$3();
 }
-function _unsupported_iterable_to_array$5(o, minLen) {
+function _unsupported_iterable_to_array$4(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$5(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$4(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$5(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$4(o, minLen);
 }
 // MARK: Encrypted Fields
 /**
@@ -2852,10 +2852,10 @@ function _unsupported_iterable_to_array$5(o, minLen) {
         this.provider = nestjs.createAesStringEncryptionProvider(config.jwksKeyConverterConfig.encryptionSecret);
         this.adapterPayloadEncryptor = util.selectiveFieldEncryptor({
             provider: this.provider,
-            fields: _to_consumable_array$4(OIDC_ENCRYPTED_PAYLOAD_FIELDS)
+            fields: _to_consumable_array$3(OIDC_ENCRYPTED_PAYLOAD_FIELDS)
         });
     }
-    _create_class$8(OidcEncryptionService, [
+    _create_class$7(OidcEncryptionService, [
         {
             /**
      * Encrypts sensitive fields in an adapter payload and returns it as a {@link JsonSerializableObject}
@@ -2888,20 +2888,20 @@ exports.OidcEncryptionService = __decorate([
     __param(0, common.Inject(OidcModuleConfig))
 ], exports.OidcEncryptionService);
 
-function _array_like_to_array$4(arr, len) {
+function _array_like_to_array$3(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$3(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$4(arr);
+function _array_without_holes$2(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$3(arr);
 }
 function _class_call_check$7(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$7(target, props) {
+function _defineProperties$6(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -2910,8 +2910,8 @@ function _defineProperties$7(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$7(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$7(Constructor.prototype, protoProps);
+function _create_class$6(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$6(Constructor.prototype, protoProps);
     return Constructor;
 }
 function _define_property$8(obj, key, value) {
@@ -2927,22 +2927,22 @@ function _define_property$8(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$3(iter) {
+function _iterable_to_array$2(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$3() {
+function _non_iterable_spread$2() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$3(arr) {
-    return _array_without_holes$3(arr) || _iterable_to_array$3(arr) || _unsupported_iterable_to_array$4(arr) || _non_iterable_spread$3();
+function _to_consumable_array$2(arr) {
+    return _array_without_holes$2(arr) || _iterable_to_array$2(arr) || _unsupported_iterable_to_array$3(arr) || _non_iterable_spread$2();
 }
-function _unsupported_iterable_to_array$4(o, minLen) {
+function _unsupported_iterable_to_array$3(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$4(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$3(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$4(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$3(o, minLen);
 }
 // MARK: Routes
 /**
@@ -3019,7 +3019,7 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
         this.providerConfig = accountService.providerConfig;
         this.scopesSupported = Object.keys(this.providerConfig.claims);
         this.claimsSupported = Array.from(new Set(Object.values(this.providerConfig.claims).flat()));
-        this.tokenEndpointAuthMethodsSupported = (_this_config_tokenEndpointAuthMethods = this.config.tokenEndpointAuthMethods) !== null && _this_config_tokenEndpointAuthMethods !== void 0 ? _this_config_tokenEndpointAuthMethods : _to_consumable_array$3(DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS);
+        this.tokenEndpointAuthMethodsSupported = (_this_config_tokenEndpointAuthMethods = this.config.tokenEndpointAuthMethods) !== null && _this_config_tokenEndpointAuthMethods !== void 0 ? _this_config_tokenEndpointAuthMethods : _to_consumable_array$2(DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS);
         var appUrl = envService.appUrl;
         this.appLoginUrl = util.websiteUrlFromPaths(appUrl, [
             this.config.appOAuthInteractionPath,
@@ -3031,7 +3031,7 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
         ]);
         this.oidcRegistrationRouteEnabled = config.registrationEnabled === true;
     }
-    _create_class$7(OidcProviderConfigService, [
+    _create_class$6(OidcProviderConfigService, [
         {
             /**
      * Builds the OpenID Connect Discovery metadata document.
@@ -3052,16 +3052,16 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
                     jwks_uri: jwksUri !== null && jwksUri !== void 0 ? jwksUri : "".concat(issuer).concat(routes.jwks),
                     registration_endpoint: this.oidcRegistrationRouteEnabled ? "".concat(issuer).concat(routes.registration) : undefined,
                     scopes_supported: this.scopesSupported,
-                    response_types_supported: _to_consumable_array$3(providerConfig.responseTypes),
+                    response_types_supported: _to_consumable_array$2(providerConfig.responseTypes),
                     response_modes_supported: [
                         'query'
                     ],
-                    grant_types_supported: _to_consumable_array$3(providerConfig.grantTypes),
-                    subject_types_supported: _to_consumable_array$3(DEFAULT_OIDC_SUBJECT_TYPES),
-                    id_token_signing_alg_values_supported: _to_consumable_array$3(DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES),
-                    token_endpoint_auth_methods_supported: _to_consumable_array$3(this.tokenEndpointAuthMethodsSupported),
+                    grant_types_supported: _to_consumable_array$2(providerConfig.grantTypes),
+                    subject_types_supported: _to_consumable_array$2(DEFAULT_OIDC_SUBJECT_TYPES),
+                    id_token_signing_alg_values_supported: _to_consumable_array$2(DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES),
+                    token_endpoint_auth_methods_supported: _to_consumable_array$2(this.tokenEndpointAuthMethodsSupported),
                     claims_supported: this.claimsSupported,
-                    code_challenge_methods_supported: _to_consumable_array$3(DEFAULT_OIDC_CODE_CHALLENGE_METHODS)
+                    code_challenge_methods_supported: _to_consumable_array$2(DEFAULT_OIDC_CODE_CHALLENGE_METHODS)
                 };
             }
         }
@@ -3075,13 +3075,13 @@ exports.OidcProviderConfigService = __decorate([
     __param(2, common.Inject(firebaseServer.FirebaseServerEnvService))
 ], exports.OidcProviderConfigService);
 
-function _array_like_to_array$3(arr, len) {
+function _array_like_to_array$2(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$2(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$3(arr);
+function _array_without_holes$1(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$2(arr);
 }
 function asyncGeneratorStep$5(gen, resolve, reject, _next, _throw, key, arg) {
     try {
@@ -3117,7 +3117,7 @@ function _class_call_check$6(instance, Constructor) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$6(target, props) {
+function _defineProperties$5(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -3126,8 +3126,8 @@ function _defineProperties$6(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$6(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$6(Constructor.prototype, protoProps);
+function _create_class$5(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$5(Constructor.prototype, protoProps);
     return Constructor;
 }
 function _define_property$7(obj, key, value) {
@@ -3143,10 +3143,10 @@ function _define_property$7(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$2(iter) {
+function _iterable_to_array$1(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$2() {
+function _non_iterable_spread$1() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _object_spread$2(target) {
@@ -3183,16 +3183,52 @@ function _object_spread_props(target, source) {
     }
     return target;
 }
-function _to_consumable_array$2(arr) {
-    return _array_without_holes$2(arr) || _iterable_to_array$2(arr) || _unsupported_iterable_to_array$3(arr) || _non_iterable_spread$2();
+function _object_without_properties(source, excluded) {
+    if (source == null) return {};
+    var target = {}, sourceKeys, key, i;
+    if (typeof Reflect !== "undefined" && Reflect.ownKeys) {
+        sourceKeys = Reflect.ownKeys(Object(source));
+        for(i = 0; i < sourceKeys.length; i++){
+            key = sourceKeys[i];
+            if (excluded.indexOf(key) >= 0) continue;
+            if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
+            target[key] = source[key];
+        }
+        return target;
+    }
+    target = _object_without_properties_loose(source, excluded);
+    if (Object.getOwnPropertySymbols) {
+        sourceKeys = Object.getOwnPropertySymbols(source);
+        for(i = 0; i < sourceKeys.length; i++){
+            key = sourceKeys[i];
+            if (excluded.indexOf(key) >= 0) continue;
+            if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
+            target[key] = source[key];
+        }
+    }
+    return target;
 }
-function _unsupported_iterable_to_array$3(o, minLen) {
+function _object_without_properties_loose(source, excluded) {
+    if (source == null) return {};
+    var target = {}, sourceKeys = Object.getOwnPropertyNames(source), key, i;
+    for(i = 0; i < sourceKeys.length; i++){
+        key = sourceKeys[i];
+        if (excluded.indexOf(key) >= 0) continue;
+        if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
+        target[key] = source[key];
+    }
+    return target;
+}
+function _to_consumable_array$1(arr) {
+    return _array_without_holes$1(arr) || _iterable_to_array$1(arr) || _unsupported_iterable_to_array$2(arr) || _non_iterable_spread$1();
+}
+function _unsupported_iterable_to_array$2(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$3(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$2(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$3(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$2(o, minLen);
 }
 function _ts_generator$5(thisArg, body) {
     var f, y, t, _ = {
@@ -3317,7 +3353,7 @@ function _ts_generator$5(thisArg, body) {
         this.collections = collections;
         this.encryptionService = encryptionService;
     }
-    _create_class$6(OidcService, [
+    _create_class$5(OidcService, [
         {
             /**
      * Returns the oidc-provider instance, initializing it on first access.
@@ -3341,7 +3377,7 @@ function _ts_generator$5(thisArg, body) {
      * @returns The auth context, or `undefined` if the token is invalid or expired.
      */ function verifyAccessToken(rawToken) {
                 return _async_to_generator$5(function() {
-                    var _accessToken_exp, provider, accessToken, token;
+                    var _accessToken_extra, _accessToken_exp, provider, accessToken, accountClaims, token;
                     return _ts_generator$5(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -3363,7 +3399,12 @@ function _ts_generator$5(thisArg, body) {
                                         undefined
                                     ];
                                 }
-                                token = {
+                                // Extract account claims baked into the access token at issuance time.
+                                // These are the claims built by OidcAccountServiceDelegate.buildClaimsForUser()
+                                // (e.g., `a` for admin, `o` for onboarded) based on the granted scopes.
+                                // Read the account claims baked into the token at issuance time via extraAccessTokenClaims.
+                                accountClaims = (_accessToken_extra = accessToken.extra) !== null && _accessToken_extra !== void 0 ? _accessToken_extra : {};
+                                token = _object_spread_props(_object_spread$2({}, accountClaims), {
                                     // Standard JWT claims — sourced from the access token
                                     aud: util.firstValue(accessToken.aud),
                                     iss: this.config.issuer,
@@ -3381,18 +3422,18 @@ function _ts_generator$5(thisArg, body) {
                                         identities: {},
                                         sign_in_provider: 'dbx_oidc'
                                     }
-                                };
+                                });
                                 return [
                                     2,
                                     {
                                         uid: accessToken.accountId,
                                         token: token,
                                         rawToken: rawToken,
-                                        oidcValidatedToken: {
+                                        oidcValidatedToken: _object_spread$2({
                                             sub: accessToken.accountId,
                                             scope: accessToken.scope,
                                             client_id: accessToken.clientId
-                                        }
+                                        }, accountClaims)
                                     }
                                 ];
                         }
@@ -3463,10 +3504,10 @@ function _ts_generator$5(thisArg, body) {
                 var _this = this;
                 var config = this.config;
                 var providerConfig = this.providerConfigService.providerConfig;
-                return _object_spread$2({
+                return _object_spread_props(_object_spread$2({
                     routes: _object_spread$2({}, this.providerConfigService.routes),
                     claims: _object_spread$2({}, providerConfig.claims),
-                    responseTypes: _to_consumable_array$2(providerConfig.responseTypes),
+                    responseTypes: _to_consumable_array$1(providerConfig.responseTypes),
                     pkce: {
                         required: function required() {
                             return true;
@@ -3552,7 +3593,55 @@ function _ts_generator$5(thisArg, body) {
                     }
                 }, config.renderError ? {
                     renderError: config.renderError
-                } : {});
+                } : {}), {
+                    // Bake account claims into the access token at issuance time so they're
+                    // available via `accessToken.extra` during verification without an extra DB call.
+                    extraTokenClaims: function extraTokenClaims(_ctx, token) {
+                        return _async_to_generator$5(function() {
+                            var accountId, scope, account, claims, extraClaims;
+                            return _ts_generator$5(this, function(_state) {
+                                switch(_state.label){
+                                    case 0:
+                                        accountId = token.accountId;
+                                        scope = token.scope;
+                                        if (!(accountId && scope)) return [
+                                            3,
+                                            3
+                                        ];
+                                        return [
+                                            4,
+                                            this.accountService.userContext(accountId).findAccount()
+                                        ];
+                                    case 1:
+                                        account = _state.sent();
+                                        if (!account) return [
+                                            3,
+                                            3
+                                        ];
+                                        return [
+                                            4,
+                                            account.claims('access_token', scope)
+                                        ];
+                                    case 2:
+                                        claims = _state.sent();
+                                        claims.sub, extraClaims = _object_without_properties(claims, [
+                                            "sub"
+                                        ]);
+                                        // Filter out undefined values — the Firestore adapter cannot serialize them.
+                                        return [
+                                            2,
+                                            util.filterUndefinedValues(extraClaims)
+                                        ];
+                                    case 3:
+                                        return [
+                                            2,
+                                            {}
+                                        ];
+                                }
+                            });
+                        }).call(_this);
+                    }
+                });
             }
         },
         {
@@ -3668,7 +3757,7 @@ function _class_call_check$5(instance, Constructor) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$5(target, props) {
+function _defineProperties$4(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -3677,8 +3766,8 @@ function _defineProperties$5(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$5(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$5(Constructor.prototype, protoProps);
+function _create_class$4(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$4(Constructor.prototype, protoProps);
     return Constructor;
 }
 function _define_property$6(obj, key, value) {
@@ -3818,7 +3907,7 @@ function _ts_generator$4(thisArg, body) {
         _define_property$6(this, "logger", new common.Logger('OidcAuthBearerTokenMiddleware'));
         this.oidcService = oidcService;
     }
-    _create_class$5(OidcAuthBearerTokenMiddleware, [
+    _create_class$4(OidcAuthBearerTokenMiddleware, [
         {
             key: "use",
             value: function use(req, _res, next) {
@@ -3879,32 +3968,11 @@ exports.OidcAuthBearerTokenMiddleware = __decorate([
     __param(0, common.Inject(exports.OidcService))
 ], exports.OidcAuthBearerTokenMiddleware);
 
-function _array_like_to_array$2(arr, len) {
-    if (len == null || len > arr.length) len = arr.length;
-    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
-    return arr2;
-}
-function _array_without_holes$1(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$2(arr);
-}
 function _class_call_check$4(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$4(target, props) {
-    for(var i = 0; i < props.length; i++){
-        var descriptor = props[i];
-        descriptor.enumerable = descriptor.enumerable || false;
-        descriptor.configurable = true;
-        if ("value" in descriptor) descriptor.writable = true;
-        Object.defineProperty(target, descriptor.key, descriptor);
-    }
-}
-function _create_class$4(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$4(Constructor.prototype, protoProps);
-    return Constructor;
-}
 function _define_property$5(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
@@ -3918,23 +3986,6 @@ function _define_property$5(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$1(iter) {
-    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
-}
-function _non_iterable_spread$1() {
-    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
-}
-function _to_consumable_array$1(arr) {
-    return _array_without_holes$1(arr) || _iterable_to_array$1(arr) || _unsupported_iterable_to_array$2(arr) || _non_iterable_spread$1();
-}
-function _unsupported_iterable_to_array$2(o, minLen) {
-    if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$2(o, minLen);
-    var n = Object.prototype.toString.call(o).slice(8, -1);
-    if (n === "Object" && o.constructor) n = o.constructor.name;
-    if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$2(o, minLen);
-}
 // MARK: Config
 /**
  * Configuration for `OidcAuthBearerTokenMiddleware` route protection.
@@ -3942,12 +3993,6 @@ function _unsupported_iterable_to_array$2(o, minLen) {
  * Works in reverse of `FirebaseAppCheckMiddlewareConfig`: instead of protecting
  * all routes and ignoring some, this only protects explicitly specified paths.
  * Routes under the global API prefix (protected by AppCheck) are excluded.
- *
- * @example
- * ```ts
- * // Provide in your module:
- * { provide: OidcAuthMiddlewareConfig, useValue: { protectedPaths: ['/mcp'] } }
- * ```
  */ var OidcAuthMiddlewareConfig = function OidcAuthMiddlewareConfig() {
     _class_call_check$4(this, OidcAuthMiddlewareConfig);
     /**
@@ -3959,56 +4004,75 @@ function _unsupported_iterable_to_array$2(o, minLen) {
      */ _define_property$5(this, "protectedPaths", void 0);
 };
 // MARK: Module
+var _logger = new common.Logger('applyOidcAuthMiddleware');
+// MARK: Express-Level Helper
 /**
- * Middleware module that applies OAuth bearer token verification
- * to paths specified in `OidcAuthMiddlewareConfig`.
+ * Applies OAuth bearer token verification as global Express middleware on
+ * the given NestJS application.
  *
- * Only protects explicitly listed paths — all other routes pass through.
- * This is the inverse of `ConfigureFirebaseAppCheckMiddlewareModule`, which
- * protects everything and ignores specific paths.
+ * Resolves `OidcService` and `OidcAuthMiddlewareConfig` from the app's DI container,
+ * then registers an Express middleware that verifies bearer tokens for the configured
+ * protected paths and attaches auth data to `req.auth`.
+ *
+ * This is an alternative to {@link ConfigureOidcAuthMiddlewareModule} for cases where
+ * NestJS module scoping makes the module approach impractical.
+ *
+ * @param nestApp - The NestJS application instance used to resolve dependencies and register the middleware.
  *
  * @example
  * ```ts
- * @Module({
- *   imports: [ConfigureOidcAuthMiddlewareModule],
- *   providers: [
- *     { provide: OidcAuthMiddlewareConfig, useValue: { protectedPaths: ['/mcp'] } }
- *   ]
- * })
- * export class AppModule {}
+ * export const APP_NEST_SERVER_CONFIG: NestServerInstanceConfig<AppModule> = {
+ *   moduleClass: AppModule,
+ *   configureNestServerInstance: (nestApp) => {
+ *     applyOidcAuthMiddleware(nestApp);
+ *   }
+ * };
  * ```
- */ exports.ConfigureOidcAuthMiddlewareModule = /*#__PURE__*/ function() {
-    function ConfigureOidcAuthMiddlewareModule(config) {
-        _class_call_check$4(this, ConfigureOidcAuthMiddlewareModule);
-        _define_property$5(this, "config", void 0);
-        _define_property$5(this, "logger", new common.Logger('ConfigureOidcAuthMiddlewareModule'));
-        this.config = config;
+ */ function applyOidcAuthMiddleware(nestApp) {
+    var _ref;
+    var oidcService = nestApp.get(exports.OidcService);
+    var config = nestApp.get(OidcAuthMiddlewareConfig);
+    var protectedPaths = (_ref = config === null || config === void 0 ? void 0 : config.protectedPaths) !== null && _ref !== void 0 ? _ref : [];
+    if (protectedPaths.length === 0) {
+        return;
     }
-    _create_class$4(ConfigureOidcAuthMiddlewareModule, [
-        {
-            key: "configure",
-            value: function configure(consumer) {
-                var _ref;
-                var _this_config;
-                var protectedPaths = (_ref = (_this_config = this.config) === null || _this_config === void 0 ? void 0 : _this_config.protectedPaths) !== null && _ref !== void 0 ? _ref : [];
-                if (protectedPaths.length > 0) {
-                    var _consumer_apply;
-                    var routes = protectedPaths.map(function(path) {
-                        return "".concat(path, "/*path");
-                    });
-                    (_consumer_apply = consumer.apply(exports.OidcAuthBearerTokenMiddleware)).forRoutes.apply(_consumer_apply, _to_consumable_array$1(routes));
-                    this.logger.debug("Configured OAuth bearer token middleware for routes: ".concat(protectedPaths.join(', ')));
-                }
-            }
+    var logger = new common.Logger('OidcAuthMiddleware');
+    nestApp.use(function(req, res, next) {
+        var isProtected = protectedPaths.some(function(prefix) {
+            return req.path.startsWith(prefix);
+        });
+        if (!isProtected) {
+            return next();
         }
-    ]);
-    return ConfigureOidcAuthMiddlewareModule;
-}();
-exports.ConfigureOidcAuthMiddlewareModule = __decorate([
-    common.Module({}),
-    __param(0, common.Optional()),
-    __param(0, common.Inject(OidcAuthMiddlewareConfig))
-], exports.ConfigureOidcAuthMiddlewareModule);
+        var authHeader = req.headers.authorization;
+        if (!(authHeader === null || authHeader === void 0 ? void 0 : authHeader.startsWith('Bearer '))) {
+            res.status(401).json({
+                statusCode: 401,
+                message: 'Missing or invalid Authorization header'
+            });
+            return;
+        }
+        var token = authHeader.slice(7);
+        oidcService.verifyAccessToken(token).then(function(oauthAuth) {
+            if (!oauthAuth) {
+                res.status(401).json({
+                    statusCode: 401,
+                    message: 'Invalid or expired access token'
+                });
+                return;
+            }
+            req.auth = oauthAuth;
+            next();
+        }).catch(function(err) {
+            logger.error('Bearer token verification failed', err);
+            res.status(401).json({
+                statusCode: 401,
+                message: 'Token verification failed'
+            });
+        });
+    });
+    _logger.debug("Applied OAuth bearer token middleware for paths: ".concat(protectedPaths.join(', ')));
+}
 
 function asyncGeneratorStep$3(gen, resolve, reject, _next, _throw, key, arg) {
     try {
@@ -5593,8 +5657,7 @@ function _unsupported_iterable_to_array(o, minLen) {
     return {
         imports: [
             config.ConfigModule,
-            firebaseServer.FirebaseServerFirestoreContextModule,
-            exports.ConfigureOidcAuthMiddlewareModule
+            firebaseServer.FirebaseServerFirestoreContextModule
         ].concat(_to_consumable_array(dependencyModuleImport), _to_consumable_array(imports !== null && imports !== void 0 ? imports : [])),
         controllers: [
             exports.OidcWellKnownController,
@@ -5604,6 +5667,7 @@ function _unsupported_iterable_to_array(o, minLen) {
         exports: [
             OidcClientService,
             OidcModuleConfig,
+            OidcAuthMiddlewareConfig,
             OidcServerFirestoreCollections
         ].concat(_to_consumable_array(exports$1 !== null && exports$1 !== void 0 ? exports$1 : [])),
         providers: [
@@ -5698,6 +5762,7 @@ exports.OidcModuleConfig = OidcModuleConfig;
 exports.OidcServerFirestoreCollections = OidcServerFirestoreCollections;
 exports.activeJwksKeysQuery = activeJwksKeysQuery;
 exports.appOidcModelModuleMetadata = appOidcModelModuleMetadata;
+exports.applyOidcAuthMiddleware = applyOidcAuthMiddleware;
 exports.createAdapterFactory = createAdapterFactory;
 exports.createOidcClientFactory = createOidcClientFactory;
 exports.deleteOidcClientFactory = deleteOidcClientFactory;