@dereekb/firebase-server 13.6.16 → 13.7.0

package/oidc/index.esm.js

@@ -1,5 +1,5 @@
-import { createParamDecorator, Injectable, Inject, Optional, Logger, UnauthorizedException, Module, Get, Param, Req, Res, Post, HttpCode, HttpStatus, Body, Controller, HttpException, All } from '@nestjs/common';
-import { generateKeyPairSync, randomBytes } from 'crypto';
+import { createParamDecorator, Injectable, Inject, Optional, Logger, UnauthorizedException, Get, Param, Req, Res, Post, HttpCode, HttpStatus, Body, Controller, HttpException, All } from '@nestjs/common';
+import { generateKeyPairSync, randomBytes } from 'node:crypto';
 import { resolveEncryptionKey, encryptValue, decryptValue, createAesStringEncryptionProvider, isValidAES256GCMEncryptionSecret } from '@dereekb/nestjs';
 import { where, iterateFirestoreDocumentSnapshotPairs, firestoreModelIdentity, snapshotConverterFunctions, optionalFirestoreDate, firestoreDate, firestoreEnum, firestorePassThroughField, AbstractFirestoreDocument, createOidcClientParamsType, deleteOidcClientParamsType, rotateOidcClientSecretParamsType, updateOidcClientParamsType, firestoreModelKey, oidcEntryIdentity, OIDC_ENTRY_CLIENT_TYPE, oidcEntriesByUserCodeQuery, oidcEntriesByUidQuery, oidcEntriesByGrantIdQuery, oidcEntryFirestoreCollection } from '@dereekb/firebase';
 import { cachedGetter, unixDateTimeSecondsNumberToDate, unixDateTimeSecondsNumberForNow, selectiveFieldEncryptor, filterUndefinedValues, websiteUrlFromPaths, firstValue, hasHttpPrefix } from '@dereekb/util';
@@ -50,7 +50,7 @@ function _class_call_check$g(instance, Constructor) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$e(target, props) {
+function _defineProperties$d(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -59,8 +59,8 @@ function _defineProperties$e(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$e(Constructor, protoProps, staticProps) {
-    if (staticProps) _defineProperties$e(Constructor, staticProps);
+function _create_class$d(Constructor, protoProps, staticProps) {
+    if (staticProps) _defineProperties$d(Constructor, staticProps);
     return Constructor;
 }
 function _define_property$f(obj, key, value) {
@@ -167,7 +167,7 @@ function _define_property$f(obj, key, value) {
      * Defaults to `false`.
      */ _define_property$f(this, "registrationEnabled", void 0);
     }
-    _create_class$e(OidcModuleConfig, null, [
+    _create_class$d(OidcModuleConfig, null, [
         {
             key: "assertValidConfig",
             value: /**
@@ -290,7 +290,7 @@ function _class_call_check$e(instance, Constructor) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$d(target, props) {
+function _defineProperties$c(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -299,8 +299,8 @@ function _defineProperties$d(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$d(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$d(Constructor.prototype, protoProps);
+function _create_class$c(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$c(Constructor.prototype, protoProps);
     return Constructor;
 }
 function _define_property$e(obj, key, value) {
@@ -532,7 +532,7 @@ var JwksService = /*#__PURE__*/ function() {
         this.saveJwksToStorage = (_config_enableSaveJwksToStorage = config.enableSaveJwksToStorage) !== null && _config_enableSaveJwksToStorage !== void 0 ? _config_enableSaveJwksToStorage : hasStorageFile;
         this.serveJwksFromStorage = (_config_serveJwksFromStorage = config.serveJwksFromStorage) !== null && _config_serveJwksFromStorage !== void 0 ? _config_serveJwksFromStorage : this.saveJwksToStorage;
     }
-    _create_class$d(JwksService, [
+    _create_class$c(JwksService, [
         {
             key: "jwksKeyCollection",
             get: function get() {
@@ -996,7 +996,7 @@ function _class_call_check$d(instance, Constructor) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$c(target, props) {
+function _defineProperties$b(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -1005,8 +1005,8 @@ function _defineProperties$c(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$c(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$c(Constructor.prototype, protoProps);
+function _create_class$b(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$b(Constructor.prototype, protoProps);
     return Constructor;
 }
 function _define_property$d(obj, key, value) {
@@ -1181,7 +1181,7 @@ function _ts_generator$9(thisArg, body) {
         this._uid = _uid;
         this.authUserContext = this._service.authService.userContext(this._uid);
     }
-    _create_class$c(OidcAccountServiceUserContext, [
+    _create_class$b(OidcAccountServiceUserContext, [
         {
             key: "uid",
             get: function get() {
@@ -1265,7 +1265,7 @@ function _ts_generator$9(thisArg, body) {
         this.authService = authService;
         this.delegate = delegate;
     }
-    _create_class$c(OidcAccountService, [
+    _create_class$b(OidcAccountService, [
         {
             key: "providerConfig",
             get: /**
@@ -1307,7 +1307,7 @@ function _class_call_check$c(instance, Constructor) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$b(target, props) {
+function _defineProperties$a(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -1316,8 +1316,8 @@ function _defineProperties$b(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$b(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$b(Constructor.prototype, protoProps);
+function _create_class$a(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$a(Constructor.prototype, protoProps);
     return Constructor;
 }
 function _get_prototype_of(o) {
@@ -1386,7 +1386,7 @@ function _is_native_reflect_construct() {
         _class_call_check$c(this, JwksKeyDocument);
         return _call_super(this, JwksKeyDocument, arguments);
     }
-    _create_class$b(JwksKeyDocument, [
+    _create_class$a(JwksKeyDocument, [
         {
             key: "modelIdentity",
             get: function get() {
@@ -1781,7 +1781,7 @@ function _class_call_check$a(instance, Constructor) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$a(target, props) {
+function _defineProperties$9(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -1790,8 +1790,8 @@ function _defineProperties$a(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$a(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$a(Constructor.prototype, protoProps);
+function _create_class$9(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$9(Constructor.prototype, protoProps);
     return Constructor;
 }
 function _define_property$c(obj, key, value) {
@@ -1952,7 +1952,7 @@ function _ts_generator$7(thisArg, body) {
         _define_property$c(this, "oidcService", void 0);
         this.oidcService = oidcService;
     }
-    _create_class$a(OidcClientService, [
+    _create_class$9(OidcClientService, [
         {
             key: "createClient",
             value: /**
@@ -2346,7 +2346,7 @@ function _class_call_check$9(instance, Constructor) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$9(target, props) {
+function _defineProperties$8(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -2355,8 +2355,8 @@ function _defineProperties$9(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$9(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$9(Constructor.prototype, protoProps);
+function _create_class$8(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$8(Constructor.prototype, protoProps);
     return Constructor;
 }
 function _define_property$a(obj, key, value) {
@@ -2528,7 +2528,7 @@ function _ts_generator$6(thisArg, body) {
             this.name = name;
             this.collection = collections.oidcEntryCollection;
         }
-        _create_class$9(FirestoreAdapter, [
+        _create_class$8(FirestoreAdapter, [
             {
                 key: "upsert",
                 value: function upsert(id, payload, expiresIn) {
@@ -2768,20 +2768,20 @@ function _ts_generator$6(thisArg, body) {
     return FirestoreAdapter;
 }
 
-function _array_like_to_array$5(arr, len) {
+function _array_like_to_array$4(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$4(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$5(arr);
+function _array_without_holes$3(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$4(arr);
 }
 function _class_call_check$8(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$8(target, props) {
+function _defineProperties$7(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -2790,8 +2790,8 @@ function _defineProperties$8(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$8(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$8(Constructor.prototype, protoProps);
+function _create_class$7(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$7(Constructor.prototype, protoProps);
     return Constructor;
 }
 function _define_property$9(obj, key, value) {
@@ -2807,22 +2807,22 @@ function _define_property$9(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$4(iter) {
+function _iterable_to_array$3(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$4() {
+function _non_iterable_spread$3() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$4(arr) {
-    return _array_without_holes$4(arr) || _iterable_to_array$4(arr) || _unsupported_iterable_to_array$5(arr) || _non_iterable_spread$4();
+function _to_consumable_array$3(arr) {
+    return _array_without_holes$3(arr) || _iterable_to_array$3(arr) || _unsupported_iterable_to_array$4(arr) || _non_iterable_spread$3();
 }
-function _unsupported_iterable_to_array$5(o, minLen) {
+function _unsupported_iterable_to_array$4(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$5(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$4(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$5(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$4(o, minLen);
 }
 // MARK: Encrypted Fields
 /**
@@ -2850,10 +2850,10 @@ function _unsupported_iterable_to_array$5(o, minLen) {
         this.provider = createAesStringEncryptionProvider(config.jwksKeyConverterConfig.encryptionSecret);
         this.adapterPayloadEncryptor = selectiveFieldEncryptor({
             provider: this.provider,
-            fields: _to_consumable_array$4(OIDC_ENCRYPTED_PAYLOAD_FIELDS)
+            fields: _to_consumable_array$3(OIDC_ENCRYPTED_PAYLOAD_FIELDS)
         });
     }
-    _create_class$8(OidcEncryptionService, [
+    _create_class$7(OidcEncryptionService, [
         {
             /**
      * Encrypts sensitive fields in an adapter payload and returns it as a {@link JsonSerializableObject}
@@ -2886,20 +2886,20 @@ OidcEncryptionService = __decorate([
     __param(0, Inject(OidcModuleConfig))
 ], OidcEncryptionService);
 
-function _array_like_to_array$4(arr, len) {
+function _array_like_to_array$3(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$3(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$4(arr);
+function _array_without_holes$2(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$3(arr);
 }
 function _class_call_check$7(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$7(target, props) {
+function _defineProperties$6(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -2908,8 +2908,8 @@ function _defineProperties$7(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$7(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$7(Constructor.prototype, protoProps);
+function _create_class$6(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$6(Constructor.prototype, protoProps);
     return Constructor;
 }
 function _define_property$8(obj, key, value) {
@@ -2925,22 +2925,22 @@ function _define_property$8(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$3(iter) {
+function _iterable_to_array$2(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$3() {
+function _non_iterable_spread$2() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$3(arr) {
-    return _array_without_holes$3(arr) || _iterable_to_array$3(arr) || _unsupported_iterable_to_array$4(arr) || _non_iterable_spread$3();
+function _to_consumable_array$2(arr) {
+    return _array_without_holes$2(arr) || _iterable_to_array$2(arr) || _unsupported_iterable_to_array$3(arr) || _non_iterable_spread$2();
 }
-function _unsupported_iterable_to_array$4(o, minLen) {
+function _unsupported_iterable_to_array$3(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$4(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$3(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$4(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$3(o, minLen);
 }
 // MARK: Routes
 /**
@@ -3017,7 +3017,7 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
         this.providerConfig = accountService.providerConfig;
         this.scopesSupported = Object.keys(this.providerConfig.claims);
         this.claimsSupported = Array.from(new Set(Object.values(this.providerConfig.claims).flat()));
-        this.tokenEndpointAuthMethodsSupported = (_this_config_tokenEndpointAuthMethods = this.config.tokenEndpointAuthMethods) !== null && _this_config_tokenEndpointAuthMethods !== void 0 ? _this_config_tokenEndpointAuthMethods : _to_consumable_array$3(DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS);
+        this.tokenEndpointAuthMethodsSupported = (_this_config_tokenEndpointAuthMethods = this.config.tokenEndpointAuthMethods) !== null && _this_config_tokenEndpointAuthMethods !== void 0 ? _this_config_tokenEndpointAuthMethods : _to_consumable_array$2(DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS);
         var appUrl = envService.appUrl;
         this.appLoginUrl = websiteUrlFromPaths(appUrl, [
             this.config.appOAuthInteractionPath,
@@ -3029,7 +3029,7 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
         ]);
         this.oidcRegistrationRouteEnabled = config.registrationEnabled === true;
     }
-    _create_class$7(OidcProviderConfigService, [
+    _create_class$6(OidcProviderConfigService, [
         {
             /**
      * Builds the OpenID Connect Discovery metadata document.
@@ -3050,16 +3050,16 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
                     jwks_uri: jwksUri !== null && jwksUri !== void 0 ? jwksUri : "".concat(issuer).concat(routes.jwks),
                     registration_endpoint: this.oidcRegistrationRouteEnabled ? "".concat(issuer).concat(routes.registration) : undefined,
                     scopes_supported: this.scopesSupported,
-                    response_types_supported: _to_consumable_array$3(providerConfig.responseTypes),
+                    response_types_supported: _to_consumable_array$2(providerConfig.responseTypes),
                     response_modes_supported: [
                         'query'
                     ],
-                    grant_types_supported: _to_consumable_array$3(providerConfig.grantTypes),
-                    subject_types_supported: _to_consumable_array$3(DEFAULT_OIDC_SUBJECT_TYPES),
-                    id_token_signing_alg_values_supported: _to_consumable_array$3(DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES),
-                    token_endpoint_auth_methods_supported: _to_consumable_array$3(this.tokenEndpointAuthMethodsSupported),
+                    grant_types_supported: _to_consumable_array$2(providerConfig.grantTypes),
+                    subject_types_supported: _to_consumable_array$2(DEFAULT_OIDC_SUBJECT_TYPES),
+                    id_token_signing_alg_values_supported: _to_consumable_array$2(DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES),
+                    token_endpoint_auth_methods_supported: _to_consumable_array$2(this.tokenEndpointAuthMethodsSupported),
                     claims_supported: this.claimsSupported,
-                    code_challenge_methods_supported: _to_consumable_array$3(DEFAULT_OIDC_CODE_CHALLENGE_METHODS)
+                    code_challenge_methods_supported: _to_consumable_array$2(DEFAULT_OIDC_CODE_CHALLENGE_METHODS)
                 };
             }
         }
@@ -3073,13 +3073,13 @@ OidcProviderConfigService = __decorate([
     __param(2, Inject(FirebaseServerEnvService))
 ], OidcProviderConfigService);
 
-function _array_like_to_array$3(arr, len) {
+function _array_like_to_array$2(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$2(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$3(arr);
+function _array_without_holes$1(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$2(arr);
 }
 function asyncGeneratorStep$5(gen, resolve, reject, _next, _throw, key, arg) {
     try {
@@ -3115,7 +3115,7 @@ function _class_call_check$6(instance, Constructor) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$6(target, props) {
+function _defineProperties$5(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -3124,8 +3124,8 @@ function _defineProperties$6(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$6(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$6(Constructor.prototype, protoProps);
+function _create_class$5(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$5(Constructor.prototype, protoProps);
     return Constructor;
 }
 function _define_property$7(obj, key, value) {
@@ -3141,10 +3141,10 @@ function _define_property$7(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$2(iter) {
+function _iterable_to_array$1(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$2() {
+function _non_iterable_spread$1() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _object_spread$2(target) {
@@ -3181,16 +3181,52 @@ function _object_spread_props(target, source) {
     }
     return target;
 }
-function _to_consumable_array$2(arr) {
-    return _array_without_holes$2(arr) || _iterable_to_array$2(arr) || _unsupported_iterable_to_array$3(arr) || _non_iterable_spread$2();
+function _object_without_properties(source, excluded) {
+    if (source == null) return {};
+    var target = {}, sourceKeys, key, i;
+    if (typeof Reflect !== "undefined" && Reflect.ownKeys) {
+        sourceKeys = Reflect.ownKeys(Object(source));
+        for(i = 0; i < sourceKeys.length; i++){
+            key = sourceKeys[i];
+            if (excluded.indexOf(key) >= 0) continue;
+            if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
+            target[key] = source[key];
+        }
+        return target;
+    }
+    target = _object_without_properties_loose(source, excluded);
+    if (Object.getOwnPropertySymbols) {
+        sourceKeys = Object.getOwnPropertySymbols(source);
+        for(i = 0; i < sourceKeys.length; i++){
+            key = sourceKeys[i];
+            if (excluded.indexOf(key) >= 0) continue;
+            if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
+            target[key] = source[key];
+        }
+    }
+    return target;
 }
-function _unsupported_iterable_to_array$3(o, minLen) {
+function _object_without_properties_loose(source, excluded) {
+    if (source == null) return {};
+    var target = {}, sourceKeys = Object.getOwnPropertyNames(source), key, i;
+    for(i = 0; i < sourceKeys.length; i++){
+        key = sourceKeys[i];
+        if (excluded.indexOf(key) >= 0) continue;
+        if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
+        target[key] = source[key];
+    }
+    return target;
+}
+function _to_consumable_array$1(arr) {
+    return _array_without_holes$1(arr) || _iterable_to_array$1(arr) || _unsupported_iterable_to_array$2(arr) || _non_iterable_spread$1();
+}
+function _unsupported_iterable_to_array$2(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$3(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$2(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$3(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$2(o, minLen);
 }
 function _ts_generator$5(thisArg, body) {
     var f, y, t, _ = {
@@ -3315,7 +3351,7 @@ function _ts_generator$5(thisArg, body) {
         this.collections = collections;
         this.encryptionService = encryptionService;
     }
-    _create_class$6(OidcService, [
+    _create_class$5(OidcService, [
         {
             /**
      * Returns the oidc-provider instance, initializing it on first access.
@@ -3339,7 +3375,7 @@ function _ts_generator$5(thisArg, body) {
      * @returns The auth context, or `undefined` if the token is invalid or expired.
      */ function verifyAccessToken(rawToken) {
                 return _async_to_generator$5(function() {
-                    var _accessToken_exp, provider, accessToken, token;
+                    var _accessToken_extra, _accessToken_exp, provider, accessToken, accountClaims, token;
                     return _ts_generator$5(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -3361,7 +3397,12 @@ function _ts_generator$5(thisArg, body) {
                                         undefined
                                     ];
                                 }
-                                token = {
+                                // Extract account claims baked into the access token at issuance time.
+                                // These are the claims built by OidcAccountServiceDelegate.buildClaimsForUser()
+                                // (e.g., `a` for admin, `o` for onboarded) based on the granted scopes.
+                                // Read the account claims baked into the token at issuance time via extraAccessTokenClaims.
+                                accountClaims = (_accessToken_extra = accessToken.extra) !== null && _accessToken_extra !== void 0 ? _accessToken_extra : {};
+                                token = _object_spread_props(_object_spread$2({}, accountClaims), {
                                     // Standard JWT claims — sourced from the access token
                                     aud: firstValue(accessToken.aud),
                                     iss: this.config.issuer,
@@ -3379,18 +3420,18 @@ function _ts_generator$5(thisArg, body) {
                                         identities: {},
                                         sign_in_provider: 'dbx_oidc'
                                     }
-                                };
+                                });
                                 return [
                                     2,
                                     {
                                         uid: accessToken.accountId,
                                         token: token,
                                         rawToken: rawToken,
-                                        oidcValidatedToken: {
+                                        oidcValidatedToken: _object_spread$2({
                                             sub: accessToken.accountId,
                                             scope: accessToken.scope,
                                             client_id: accessToken.clientId
-                                        }
+                                        }, accountClaims)
                                     }
                                 ];
                         }
@@ -3461,10 +3502,10 @@ function _ts_generator$5(thisArg, body) {
                 var _this = this;
                 var config = this.config;
                 var providerConfig = this.providerConfigService.providerConfig;
-                return _object_spread$2({
+                return _object_spread_props(_object_spread$2({
                     routes: _object_spread$2({}, this.providerConfigService.routes),
                     claims: _object_spread$2({}, providerConfig.claims),
-                    responseTypes: _to_consumable_array$2(providerConfig.responseTypes),
+                    responseTypes: _to_consumable_array$1(providerConfig.responseTypes),
                     pkce: {
                         required: function required() {
                             return true;
@@ -3550,7 +3591,55 @@ function _ts_generator$5(thisArg, body) {
                     }
                 }, config.renderError ? {
                     renderError: config.renderError
-                } : {});
+                } : {}), {
+                    // Bake account claims into the access token at issuance time so they're
+                    // available via `accessToken.extra` during verification without an extra DB call.
+                    extraTokenClaims: function extraTokenClaims(_ctx, token) {
+                        return _async_to_generator$5(function() {
+                            var accountId, scope, account, claims, extraClaims;
+                            return _ts_generator$5(this, function(_state) {
+                                switch(_state.label){
+                                    case 0:
+                                        accountId = token.accountId;
+                                        scope = token.scope;
+                                        if (!(accountId && scope)) return [
+                                            3,
+                                            3
+                                        ];
+                                        return [
+                                            4,
+                                            this.accountService.userContext(accountId).findAccount()
+                                        ];
+                                    case 1:
+                                        account = _state.sent();
+                                        if (!account) return [
+                                            3,
+                                            3
+                                        ];
+                                        return [
+                                            4,
+                                            account.claims('access_token', scope)
+                                        ];
+                                    case 2:
+                                        claims = _state.sent();
+                                        claims.sub, extraClaims = _object_without_properties(claims, [
+                                            "sub"
+                                        ]);
+                                        // Filter out undefined values — the Firestore adapter cannot serialize them.
+                                        return [
+                                            2,
+                                            filterUndefinedValues(extraClaims)
+                                        ];
+                                    case 3:
+                                        return [
+                                            2,
+                                            {}
+                                        ];
+                                }
+                            });
+                        }).call(_this);
+                    }
+                });
             }
         },
         {
@@ -3666,7 +3755,7 @@ function _class_call_check$5(instance, Constructor) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$5(target, props) {
+function _defineProperties$4(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -3675,8 +3764,8 @@ function _defineProperties$5(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$5(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$5(Constructor.prototype, protoProps);
+function _create_class$4(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$4(Constructor.prototype, protoProps);
     return Constructor;
 }
 function _define_property$6(obj, key, value) {
@@ -3816,7 +3905,7 @@ function _ts_generator$4(thisArg, body) {
         _define_property$6(this, "logger", new Logger('OidcAuthBearerTokenMiddleware'));
         this.oidcService = oidcService;
     }
-    _create_class$5(OidcAuthBearerTokenMiddleware, [
+    _create_class$4(OidcAuthBearerTokenMiddleware, [
         {
             key: "use",
             value: function use(req, _res, next) {
@@ -3877,32 +3966,11 @@ OidcAuthBearerTokenMiddleware = __decorate([
     __param(0, Inject(OidcService))
 ], OidcAuthBearerTokenMiddleware);
 
-function _array_like_to_array$2(arr, len) {
-    if (len == null || len > arr.length) len = arr.length;
-    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
-    return arr2;
-}
-function _array_without_holes$1(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$2(arr);
-}
 function _class_call_check$4(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$4(target, props) {
-    for(var i = 0; i < props.length; i++){
-        var descriptor = props[i];
-        descriptor.enumerable = descriptor.enumerable || false;
-        descriptor.configurable = true;
-        if ("value" in descriptor) descriptor.writable = true;
-        Object.defineProperty(target, descriptor.key, descriptor);
-    }
-}
-function _create_class$4(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$4(Constructor.prototype, protoProps);
-    return Constructor;
-}
 function _define_property$5(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
@@ -3916,23 +3984,6 @@ function _define_property$5(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$1(iter) {
-    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
-}
-function _non_iterable_spread$1() {
-    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
-}
-function _to_consumable_array$1(arr) {
-    return _array_without_holes$1(arr) || _iterable_to_array$1(arr) || _unsupported_iterable_to_array$2(arr) || _non_iterable_spread$1();
-}
-function _unsupported_iterable_to_array$2(o, minLen) {
-    if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$2(o, minLen);
-    var n = Object.prototype.toString.call(o).slice(8, -1);
-    if (n === "Object" && o.constructor) n = o.constructor.name;
-    if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$2(o, minLen);
-}
 // MARK: Config
 /**
  * Configuration for `OidcAuthBearerTokenMiddleware` route protection.
@@ -3940,12 +3991,6 @@ function _unsupported_iterable_to_array$2(o, minLen) {
  * Works in reverse of `FirebaseAppCheckMiddlewareConfig`: instead of protecting
  * all routes and ignoring some, this only protects explicitly specified paths.
  * Routes under the global API prefix (protected by AppCheck) are excluded.
- *
- * @example
- * ```ts
- * // Provide in your module:
- * { provide: OidcAuthMiddlewareConfig, useValue: { protectedPaths: ['/mcp'] } }
- * ```
  */ var OidcAuthMiddlewareConfig = function OidcAuthMiddlewareConfig() {
     _class_call_check$4(this, OidcAuthMiddlewareConfig);
     /**
@@ -3957,56 +4002,75 @@ function _unsupported_iterable_to_array$2(o, minLen) {
      */ _define_property$5(this, "protectedPaths", void 0);
 };
 // MARK: Module
+var _logger = new Logger('applyOidcAuthMiddleware');
+// MARK: Express-Level Helper
 /**
- * Middleware module that applies OAuth bearer token verification
- * to paths specified in `OidcAuthMiddlewareConfig`.
+ * Applies OAuth bearer token verification as global Express middleware on
+ * the given NestJS application.
  *
- * Only protects explicitly listed paths — all other routes pass through.
- * This is the inverse of `ConfigureFirebaseAppCheckMiddlewareModule`, which
- * protects everything and ignores specific paths.
+ * Resolves `OidcService` and `OidcAuthMiddlewareConfig` from the app's DI container,
+ * then registers an Express middleware that verifies bearer tokens for the configured
+ * protected paths and attaches auth data to `req.auth`.
+ *
+ * This is an alternative to {@link ConfigureOidcAuthMiddlewareModule} for cases where
+ * NestJS module scoping makes the module approach impractical.
+ *
+ * @param nestApp - The NestJS application instance used to resolve dependencies and register the middleware.
  *
  * @example
  * ```ts
- * @Module({
- *   imports: [ConfigureOidcAuthMiddlewareModule],
- *   providers: [
- *     { provide: OidcAuthMiddlewareConfig, useValue: { protectedPaths: ['/mcp'] } }
- *   ]
- * })
- * export class AppModule {}
+ * export const APP_NEST_SERVER_CONFIG: NestServerInstanceConfig<AppModule> = {
+ *   moduleClass: AppModule,
+ *   configureNestServerInstance: (nestApp) => {
+ *     applyOidcAuthMiddleware(nestApp);
+ *   }
+ * };
  * ```
- */ var ConfigureOidcAuthMiddlewareModule = /*#__PURE__*/ function() {
-    function ConfigureOidcAuthMiddlewareModule(config) {
-        _class_call_check$4(this, ConfigureOidcAuthMiddlewareModule);
-        _define_property$5(this, "config", void 0);
-        _define_property$5(this, "logger", new Logger('ConfigureOidcAuthMiddlewareModule'));
-        this.config = config;
+ */ function applyOidcAuthMiddleware(nestApp) {
+    var _ref;
+    var oidcService = nestApp.get(OidcService);
+    var config = nestApp.get(OidcAuthMiddlewareConfig);
+    var protectedPaths = (_ref = config === null || config === void 0 ? void 0 : config.protectedPaths) !== null && _ref !== void 0 ? _ref : [];
+    if (protectedPaths.length === 0) {
+        return;
     }
-    _create_class$4(ConfigureOidcAuthMiddlewareModule, [
-        {
-            key: "configure",
-            value: function configure(consumer) {
-                var _ref;
-                var _this_config;
-                var protectedPaths = (_ref = (_this_config = this.config) === null || _this_config === void 0 ? void 0 : _this_config.protectedPaths) !== null && _ref !== void 0 ? _ref : [];
-                if (protectedPaths.length > 0) {
-                    var _consumer_apply;
-                    var routes = protectedPaths.map(function(path) {
-                        return "".concat(path, "/*path");
-                    });
-                    (_consumer_apply = consumer.apply(OidcAuthBearerTokenMiddleware)).forRoutes.apply(_consumer_apply, _to_consumable_array$1(routes));
-                    this.logger.debug("Configured OAuth bearer token middleware for routes: ".concat(protectedPaths.join(', ')));
-                }
-            }
+    var logger = new Logger('OidcAuthMiddleware');
+    nestApp.use(function(req, res, next) {
+        var isProtected = protectedPaths.some(function(prefix) {
+            return req.path.startsWith(prefix);
+        });
+        if (!isProtected) {
+            return next();
         }
-    ]);
-    return ConfigureOidcAuthMiddlewareModule;
-}();
-ConfigureOidcAuthMiddlewareModule = __decorate([
-    Module({}),
-    __param(0, Optional()),
-    __param(0, Inject(OidcAuthMiddlewareConfig))
-], ConfigureOidcAuthMiddlewareModule);
+        var authHeader = req.headers.authorization;
+        if (!(authHeader === null || authHeader === void 0 ? void 0 : authHeader.startsWith('Bearer '))) {
+            res.status(401).json({
+                statusCode: 401,
+                message: 'Missing or invalid Authorization header'
+            });
+            return;
+        }
+        var token = authHeader.slice(7);
+        oidcService.verifyAccessToken(token).then(function(oauthAuth) {
+            if (!oauthAuth) {
+                res.status(401).json({
+                    statusCode: 401,
+                    message: 'Invalid or expired access token'
+                });
+                return;
+            }
+            req.auth = oauthAuth;
+            next();
+        }).catch(function(err) {
+            logger.error('Bearer token verification failed', err);
+            res.status(401).json({
+                statusCode: 401,
+                message: 'Token verification failed'
+            });
+        });
+    });
+    _logger.debug("Applied OAuth bearer token middleware for paths: ".concat(protectedPaths.join(', ')));
+}
 
 function asyncGeneratorStep$3(gen, resolve, reject, _next, _throw, key, arg) {
     try {
@@ -5591,8 +5655,7 @@ function _unsupported_iterable_to_array(o, minLen) {
     return {
         imports: [
             ConfigModule,
-            FirebaseServerFirestoreContextModule,
-            ConfigureOidcAuthMiddlewareModule
+            FirebaseServerFirestoreContextModule
         ].concat(_to_consumable_array(dependencyModuleImport), _to_consumable_array(imports !== null && imports !== void 0 ? imports : [])),
         controllers: [
             OidcWellKnownController,
@@ -5602,6 +5665,7 @@ function _unsupported_iterable_to_array(o, minLen) {
         exports: [
             OidcClientService,
             OidcModuleConfig,
+            OidcAuthMiddlewareConfig,
             OidcServerFirestoreCollections
         ].concat(_to_consumable_array(exports$1 !== null && exports$1 !== void 0 ? exports$1 : [])),
         providers: [
@@ -5667,4 +5731,4 @@ function _unsupported_iterable_to_array(o, minLen) {
     };
 }
 
-export { ConfigureOidcAuthMiddlewareModule, DEFAULT_APP_OAUTH_CONSENT_PATH_PART, DEFAULT_APP_OAUTH_INTERACTION_PATH, DEFAULT_APP_OAUTH_LOGIN_PATH_PART, DEFAULT_OIDC_CODE_CHALLENGE_METHODS, DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES, DEFAULT_OIDC_ISSUER_PATH, DEFAULT_OIDC_ROUTES, DEFAULT_OIDC_SUBJECT_TYPES, DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, DEFAULT_OIDC_TOKEN_LIFETIMES, DEFAULT_ROTATED_KEY_MAX_AGE, FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, JwksFirestoreCollections, JwksKeyDocument, JwksService, JwksServiceConfig, JwksServiceStorageConfig, OIDC_ENCRYPTED_PAYLOAD_FIELDS, OIDC_JWKS_ENCRYPTION_SECRET_ENV_KEY, OidcAccountService, OidcAccountServiceDelegate, OidcAccountServiceUserContext, OidcAuth, OidcAuthBearerTokenMiddleware, OidcAuthMiddlewareConfig, OidcClientService, OidcEncryptionService, OidcInteractionController, OidcInteractionService, OidcModelServerActions, OidcModuleConfig, OidcProviderConfigService, OidcProviderController, OidcServerFirestoreCollections, OidcService, OidcWellKnownController, activeJwksKeysQuery, appOidcModelModuleMetadata, createAdapterFactory, createOidcClientFactory, deleteOidcClientFactory, jwksKeyCollectionReference, jwksKeyConverter, jwksKeyFirestoreCollection, jwksKeyIdentity, jwksKeysWithStatusQuery, nonRetiredJwksKeysQuery, oidcFirestoreCollectionsFactory, oidcModelServerActions, oidcModelServerActionsFactory, oidcModuleConfigFactory, oidcModuleMetadata, rotateOidcClientSecretFactory, rotatedJwksKeysQuery, updateOidcClientFactory };
+export { DEFAULT_APP_OAUTH_CONSENT_PATH_PART, DEFAULT_APP_OAUTH_INTERACTION_PATH, DEFAULT_APP_OAUTH_LOGIN_PATH_PART, DEFAULT_OIDC_CODE_CHALLENGE_METHODS, DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES, DEFAULT_OIDC_ISSUER_PATH, DEFAULT_OIDC_ROUTES, DEFAULT_OIDC_SUBJECT_TYPES, DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, DEFAULT_OIDC_TOKEN_LIFETIMES, DEFAULT_ROTATED_KEY_MAX_AGE, FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, JwksFirestoreCollections, JwksKeyDocument, JwksService, JwksServiceConfig, JwksServiceStorageConfig, OIDC_ENCRYPTED_PAYLOAD_FIELDS, OIDC_JWKS_ENCRYPTION_SECRET_ENV_KEY, OidcAccountService, OidcAccountServiceDelegate, OidcAccountServiceUserContext, OidcAuth, OidcAuthBearerTokenMiddleware, OidcAuthMiddlewareConfig, OidcClientService, OidcEncryptionService, OidcInteractionController, OidcInteractionService, OidcModelServerActions, OidcModuleConfig, OidcProviderConfigService, OidcProviderController, OidcServerFirestoreCollections, OidcService, OidcWellKnownController, activeJwksKeysQuery, appOidcModelModuleMetadata, applyOidcAuthMiddleware, createAdapterFactory, createOidcClientFactory, deleteOidcClientFactory, jwksKeyCollectionReference, jwksKeyConverter, jwksKeyFirestoreCollection, jwksKeyIdentity, jwksKeysWithStatusQuery, nonRetiredJwksKeysQuery, oidcFirestoreCollectionsFactory, oidcModelServerActions, oidcModelServerActionsFactory, oidcModuleConfigFactory, oidcModuleMetadata, rotateOidcClientSecretFactory, rotatedJwksKeysQuery, updateOidcClientFactory };