@dereekb/firebase-server 14.0.1 → 14.1.0

package/calcom/index.esm.js

@@ -462,9 +462,10 @@ function _type_of$1(obj) {
     _create_class(CalcomUserExternalConnectionOAuthService, [
         {
             key: "authorizeUrlForState",
-            value: function authorizeUrlForState(state) {
+            value: function authorizeUrlForState(input) {
+                // Cal.com's authorize URL takes no PKCE challenge, so `input.codeChallenge` is deliberately unused
                 return this.authorizeUrlFactory({
-                    state: state
+                    state: input.state
                 });
             }
         },

package/calcom/package.json

@@ -1,17 +1,17 @@
 {
   "name": "@dereekb/firebase-server/calcom",
-  "version": "14.0.1",
+  "version": "14.1.0",
   "type": "module",
   "peerDependencies": {
-    "@dereekb/analytics": "14.0.1",
-    "@dereekb/calcom": "14.0.1",
-    "@dereekb/date": "14.0.1",
-    "@dereekb/firebase": "14.0.1",
-    "@dereekb/firebase-server": "14.0.1",
-    "@dereekb/model": "14.0.1",
-    "@dereekb/nestjs": "14.0.1",
-    "@dereekb/rxjs": "14.0.1",
-    "@dereekb/util": "14.0.1",
+    "@dereekb/analytics": "14.1.0",
+    "@dereekb/calcom": "14.1.0",
+    "@dereekb/date": "14.1.0",
+    "@dereekb/firebase": "14.1.0",
+    "@dereekb/firebase-server": "14.1.0",
+    "@dereekb/model": "14.1.0",
+    "@dereekb/nestjs": "14.1.0",
+    "@dereekb/rxjs": "14.1.0",
+    "@dereekb/util": "14.1.0",
     "@nestjs/common": "^12.0.1",
     "express": "^5.2.1"
   },

package/calcom/src/lib/calcom.oauth.connection.service.d.ts

@@ -1,6 +1,6 @@
 import { type CalcomAccessToken, type CalcomOAuthAuthorizeUrlFactory } from '@dereekb/calcom';
 import { CalcomOAuthApi } from '@dereekb/calcom/nestjs';
-import { AbstractUserExternalConnectionOAuthService, UserExternalConnectionAccessor, UserExternalConnectionServerActions, UserExternalConnectionStateCoder, type UserExternalConnectionCredentials, type UserExternalConnectionOAuthExchangeInput, type UserExternalConnectionOAuthRefreshCredentialsInput, type UserExternalConnectionOAuthState } from '@dereekb/firebase-server/model';
+import { AbstractUserExternalConnectionOAuthService, UserExternalConnectionAccessor, UserExternalConnectionServerActions, UserExternalConnectionStateCoder, type UserExternalConnectionCredentials, type UserExternalConnectionOAuthExchangeInput, type UserExternalConnectionOAuthRefreshCredentialsInput, type UserExternalConnectionOAuthAuthorizeUrlInput } from '@dereekb/firebase-server/model';
 import { type WebsiteUrl } from '@dereekb/util';
 import { CalcomUserExternalConnectionOAuthServiceConfig } from './calcom.oauth.connection.config';
 /**
@@ -27,7 +27,7 @@ export declare class CalcomUserExternalConnectionOAuthService extends AbstractUs
     readonly oauthApi: CalcomOAuthApi;
     readonly authorizeUrlFactory: CalcomOAuthAuthorizeUrlFactory;
     constructor(config: CalcomUserExternalConnectionOAuthServiceConfig, stateCoder: UserExternalConnectionStateCoder, userExternalConnectionActions: UserExternalConnectionServerActions, userExternalConnectionAccessor: UserExternalConnectionAccessor, oauthApi: CalcomOAuthApi);
-    protected authorizeUrlForState(state: UserExternalConnectionOAuthState): WebsiteUrl;
+    protected authorizeUrlForState(input: UserExternalConnectionOAuthAuthorizeUrlInput): WebsiteUrl;
     protected credentialsForAuthorizationCode(input: UserExternalConnectionOAuthExchangeInput): Promise<UserExternalConnectionCredentials>;
     refreshCredentials(input: UserExternalConnectionOAuthRefreshCredentialsInput): Promise<UserExternalConnectionCredentials>;
 }

package/discord/index.esm.js

@@ -1,6 +1,6 @@
 import { DISCORD_USER_EXTERNAL_CONNECTION_PROVIDER_TYPE } from '@dereekb/firebase';
-import { userExternalConnectionOAuthControllerPath, userExternalConnectionOAuthRoutesForGlobalRouteExclude, UserExternalConnectionOAuthServiceConfig, userExternalConnectionOAuthServiceConfigFactory, UserExternalConnectionStateCoder, UserExternalConnectionServerActions, UserExternalConnectionAccessor, AbstractUserExternalConnectionOAuthService, AbstractUserExternalConnectionOAuthController } from '@dereekb/firebase-server/model';
-import { Injectable, Inject, Controller } from '@nestjs/common';
+import { userExternalConnectionOAuthControllerPath, userExternalConnectionOAuthRoutesForGlobalRouteExclude, UserExternalConnectionOAuthServiceConfig, userExternalConnectionOAuthServiceConfigFactory, UserExternalConnectionStateCoder, UserExternalConnectionServerActions, UserExternalConnectionAccessor, UserExternalConnectionSignInService, UserExternalConnectionProviderPolicyRegistry, UserExternalConnectionSignInThrottle, AbstractUserExternalConnectionOAuthService, AbstractUserExternalConnectionOAuthController } from '@dereekb/firebase-server/model';
+import { Injectable, Inject, Optional, Controller } from '@nestjs/common';
 import { DISCORD_OAUTH_SCOPE_DELIMITER } from '@dereekb/discord';
 import { DiscordOAuthApi } from '@dereekb/discord/nestjs';
 import { ConfigModule } from '@nestjs/config';
@@ -126,9 +126,28 @@ function _type_of$3(obj) {
  * — a token granted no scopes can do nothing — and it is what lets the connection be labeled with the
  * account it belongs to. Excludes `email`, which is a real privilege escalation the label does not
  * need, and `guilds` / `connections` / `bot`, which nothing here reads.
+ *
+ * An app using Discord to SIGN IN normally wants `['identify', 'email']`: without `email` the
+ * identity carries none, which both fails the auto-create delegate's default email requirement and
+ * silently skips the sign-in service's existing-account collision check.
  */ var DEFAULT_DISCORD_OAUTH_SCOPES = [
     'identify'
 ];
+/**
+ * The scopes requested for an IDENTITY round trip — a sign-in, or linking Discord as a login method.
+ *
+ * A separate default from {@link DEFAULT_DISCORD_OAUTH_SCOPES} because the two answer different
+ * questions. The data default is least privilege for whatever the integration reads; this one is what
+ * it takes to know WHO signed in, which needs `email` — without it the identity carries none, which
+ * both fails the shipped auto-create delegate's email requirement and silently skips the sign-in
+ * service's existing-account collision check.
+ *
+ * Keeping them separate is what lets an app request a broad data grant without every login also
+ * demanding it, and vice versa.
+ */ var DEFAULT_DISCORD_SIGN_IN_OAUTH_SCOPES = [
+    'identify',
+    'email'
+];
 /**
  * Configuration for the {@link DiscordUserExternalConnectionOAuthService}.
  *
@@ -141,7 +160,11 @@ function _type_of$3(obj) {
     function DiscordUserExternalConnectionOAuthServiceConfig() {
         _class_call_check$2(this, DiscordUserExternalConnectionOAuthServiceConfig);
         var _this;
-        _this = _call_super$2(this, DiscordUserExternalConnectionOAuthServiceConfig, arguments), _define_property$2(_this, "scopes", void 0);
+        _this = _call_super$2(this, DiscordUserExternalConnectionOAuthServiceConfig, arguments), /**
+     * The scopes requested for a DATA connect.
+     */ _define_property$2(_this, "scopes", void 0), /**
+     * The scopes requested for a sign-in or a login-method link.
+     */ _define_property$2(_this, "signInScopes", void 0);
         return _this;
     }
     return DiscordUserExternalConnectionOAuthServiceConfig;
@@ -154,18 +177,22 @@ function _type_of$3(obj) {
  * code-declared paths. The client credentials are read by `discordOAuthServiceConfigFactory` in
  * `@dereekb/discord/nestjs`, so registering Discord adds no deployment configuration here.
  *
- * @param config - The env service, the return paths, and the optional scope override.
+ * @param config - The env service, the return paths, and the optional scope overrides.
  * @returns The validated service configuration.
  */ function discordUserExternalConnectionOAuthServiceConfigFactory(config) {
-    var envService = config.envService, successPath = config.successPath, failurePath = config.failurePath, scopes = config.scopes;
+    var envService = config.envService, successPath = config.successPath, failurePath = config.failurePath, signInSuccessPath = config.signInSuccessPath, signInFailurePath = config.signInFailurePath, allowedReturnPaths = config.allowedReturnPaths, scopes = config.scopes, signInScopes = config.signInScopes;
     var baseConfig = userExternalConnectionOAuthServiceConfigFactory({
         envService: envService,
         providerType: DISCORD_USER_EXTERNAL_CONNECTION_PROVIDER_TYPE,
         successPath: successPath,
-        failurePath: failurePath
+        failurePath: failurePath,
+        signInSuccessPath: signInSuccessPath,
+        signInFailurePath: signInFailurePath,
+        allowedReturnPaths: allowedReturnPaths
     });
     return _object_spread_props(_object_spread({}, baseConfig), {
-        scopes: scopes !== null && scopes !== void 0 ? scopes : DEFAULT_DISCORD_OAUTH_SCOPES
+        scopes: scopes !== null && scopes !== void 0 ? scopes : DEFAULT_DISCORD_OAUTH_SCOPES,
+        signInScopes: signInScopes !== null && signInScopes !== void 0 ? signInScopes : DEFAULT_DISCORD_SIGN_IN_OAUTH_SCOPES
     });
 }
 
@@ -428,30 +455,50 @@ function _type_of$1(obj) {
  * choosing the redirect — is the framework's.
  */ var DiscordUserExternalConnectionOAuthService = /*#__PURE__*/ function(AbstractUserExternalConnectionOAuthService) {
     _inherits$1(DiscordUserExternalConnectionOAuthService, AbstractUserExternalConnectionOAuthService);
-    function DiscordUserExternalConnectionOAuthService(config, stateCoder, userExternalConnectionActions, userExternalConnectionAccessor, oauthApi) {
+    function DiscordUserExternalConnectionOAuthService(config, stateCoder, userExternalConnectionActions, userExternalConnectionAccessor, oauthApi, userExternalConnectionSignInService, userExternalConnectionProviderPolicyRegistry, userExternalConnectionSignInThrottle) {
         _class_call_check$1(this, DiscordUserExternalConnectionOAuthService);
         var _this;
-        _this = _call_super$1(this, DiscordUserExternalConnectionOAuthService), _define_property$1(_this, "config", void 0), _define_property$1(_this, "stateCoder", void 0), _define_property$1(_this, "userExternalConnectionActions", void 0), _define_property$1(_this, "userExternalConnectionAccessor", void 0), _define_property$1(_this, "oauthApi", void 0), _define_property$1(_this, "authorizeUrlFactory", void 0);
+        _this = _call_super$1(this, DiscordUserExternalConnectionOAuthService), _define_property$1(_this, "config", void 0), _define_property$1(_this, "stateCoder", void 0), _define_property$1(_this, "userExternalConnectionActions", void 0), _define_property$1(_this, "userExternalConnectionAccessor", void 0), _define_property$1(_this, "oauthApi", void 0), _define_property$1(_this, "userExternalConnectionSignInService", void 0), _define_property$1(_this, "userExternalConnectionProviderPolicyRegistry", void 0), _define_property$1(_this, "userExternalConnectionSignInThrottle", void 0), _define_property$1(_this, "authorizeUrlFactory", void 0), _define_property$1(_this, "signInAuthorizeUrlFactory", void 0);
         _this.config = config;
         _this.stateCoder = stateCoder;
         _this.userExternalConnectionActions = userExternalConnectionActions;
         _this.userExternalConnectionAccessor = userExternalConnectionAccessor;
         _this.oauthApi = oauthApi;
-        var scopes = config.scopes, userExternalConnectionOAuth = config.userExternalConnectionOAuth;
+        _this.userExternalConnectionSignInService = userExternalConnectionSignInService;
+        _this.userExternalConnectionProviderPolicyRegistry = userExternalConnectionProviderPolicyRegistry;
+        _this.userExternalConnectionSignInThrottle = userExternalConnectionSignInThrottle;
+        var scopes = config.scopes, signInScopes = config.signInScopes, userExternalConnectionOAuth = config.userExternalConnectionOAuth;
         // no clientId guard here, unlike the Cal.com equivalent: DiscordOAuthConfig requires both
         // credentials, so DiscordOAuthApi cannot construct without a client id to authorize as
         _this.authorizeUrlFactory = oauthApi.authorizeUrlFactory({
             redirectUri: userExternalConnectionOAuth.redirectUri,
             scopes: scopes
         });
+        // a second factory rather than a scope argument on the first: the url factory closes over its
+        // scopes, and the two sets are genuinely different grants rather than one set with a variation
+        _this.signInAuthorizeUrlFactory = oauthApi.authorizeUrlFactory({
+            redirectUri: userExternalConnectionOAuth.redirectUri,
+            scopes: signInScopes
+        });
         return _this;
     }
     _create_class(DiscordUserExternalConnectionOAuthService, [
         {
-            key: "authorizeUrlForState",
-            value: function authorizeUrlForState(state) {
-                return this.authorizeUrlFactory({
-                    state: state
+            /**
+     * Picks the scope set from the handoff's direction.
+     *
+     * A `connect` is a DATA grant and gets `scopes`; a `signin` or a `link` is an IDENTITY grant and gets
+     * `signInScopes`. The service cannot read the mode off the state — it is an encrypted envelope only
+     * the state coder can open — so the framework decodes it and passes it in.
+     *
+     * @param input - The state, the optional PKCE challenge, and the mode.
+     * @returns Discord's authorize URL.
+     */ key: "authorizeUrlForState",
+            value: function authorizeUrlForState(input) {
+                var factory = input.mode === 'signin' || input.mode === 'link' ? this.signInAuthorizeUrlFactory : this.authorizeUrlFactory;
+                return factory({
+                    state: input.state,
+                    codeChallenge: input.codeChallenge
                 });
             }
         },
@@ -467,7 +514,8 @@ function _type_of$1(obj) {
                                     4,
                                     this.oauthApi.exchangeAuthorizationCodeToAccessToken({
                                         code: input.code,
-                                        redirectUri: input.redirectUri
+                                        redirectUri: input.redirectUri,
+                                        codeVerifier: input.codeVerifier
                                     })
                                 ];
                             case 1:
@@ -512,6 +560,47 @@ function _type_of$1(obj) {
                 }).call(this);
             }
         },
+        {
+            key: "signInIdentityForCredentials",
+            value: /**
+     * Reads the Discord account a sign-in is attributed to.
+     *
+     * MANDATORY, unlike the best-effort read in the exchange above: a sign-in with no snowflake has
+     * nothing to key the account on. `email`/`verified` come from the same call and are only populated
+     * when the `email` scope was granted — an app whose sign-in delegate provisions users by email must
+     * request it.
+     *
+     * @param input - The credentials the exchange produced.
+     * @returns The Discord identity to sign in as.
+     */ function signInIdentityForCredentials(input) {
+                return _async_to_generator(function() {
+                    var _currentUser_verified, _currentUser_global_name, currentUser;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                return [
+                                    4,
+                                    this.oauthApi.readCurrentUser({
+                                        accessToken: input.credentials.accessToken
+                                    })
+                                ];
+                            case 1:
+                                currentUser = _state.sent();
+                                return [
+                                    2,
+                                    {
+                                        // the snowflake, never the username — Discord usernames became mutable in 2023
+                                        externalAccountId: currentUser.id,
+                                        email: currentUser.email,
+                                        emailVerified: (_currentUser_verified = currentUser.verified) !== null && _currentUser_verified !== void 0 ? _currentUser_verified : false,
+                                        label: (_currentUser_global_name = currentUser.global_name) !== null && _currentUser_global_name !== void 0 ? _currentUser_global_name : currentUser.username
+                                    }
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
         {
             key: "refreshCredentials",
             value: function refreshCredentials(input) {
@@ -545,6 +634,62 @@ function _type_of$1(obj) {
                     });
                 }).call(this);
             }
+        },
+        {
+            key: "revokeCredentials",
+            value: /**
+     * Revokes the Discord grant so a captured token cannot outlive the disconnect.
+     *
+     * The refresh token is revoked when there is one: Discord invalidates the whole grant, so revoking
+     * the longer-lived credential covers the access token issued from it. A failure is logged rather
+     * than thrown — the disconnect has already decided to forget these credentials, and failing it
+     * would leave the user connected to an account they asked to leave.
+     *
+     * @param input - The acting user and the credentials being discarded.
+     */ function revokeCredentials(input) {
+                return _async_to_generator(function() {
+                    var _input_credentials, refreshToken, accessToken, token, e;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                _input_credentials = input.credentials, refreshToken = _input_credentials.refreshToken, accessToken = _input_credentials.accessToken;
+                                token = refreshToken !== null && refreshToken !== void 0 ? refreshToken : accessToken;
+                                _state.label = 1;
+                            case 1:
+                                _state.trys.push([
+                                    1,
+                                    3,
+                                    ,
+                                    4
+                                ]);
+                                return [
+                                    4,
+                                    this.oauthApi.revokeToken({
+                                        token: token,
+                                        tokenTypeHint: refreshToken ? 'refresh_token' : 'access_token'
+                                    })
+                                ];
+                            case 2:
+                                _state.sent();
+                                return [
+                                    3,
+                                    4
+                                ];
+                            case 3:
+                                e = _state.sent();
+                                this.logger.warn('Disconnected Discord but could not revoke the token at Discord: ', e);
+                                return [
+                                    3,
+                                    4
+                                ];
+                            case 4:
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
         }
     ]);
     return DiscordUserExternalConnectionOAuthService;
@@ -555,7 +700,13 @@ DiscordUserExternalConnectionOAuthService = __decorate([
     __param(1, Inject(UserExternalConnectionStateCoder)),
     __param(2, Inject(UserExternalConnectionServerActions)),
     __param(3, Inject(UserExternalConnectionAccessor)),
-    __param(4, Inject(DiscordOAuthApi))
+    __param(4, Inject(DiscordOAuthApi)),
+    __param(5, Optional()),
+    __param(5, Inject(UserExternalConnectionSignInService)),
+    __param(6, Optional()),
+    __param(6, Inject(UserExternalConnectionProviderPolicyRegistry)),
+    __param(7, Optional()),
+    __param(7, Inject(UserExternalConnectionSignInThrottle))
 ], DiscordUserExternalConnectionOAuthService);
 
 function _assert_this_initialized(self) {
@@ -690,7 +841,7 @@ function _unsupported_iterable_to_array(o, minLen) {
  * @param config - The module metadata configuration.
  * @returns NestJS ModuleMetadata mounting the Discord connect endpoints.
  */ function appDiscordUserExternalConnectionOAuthModuleMetadata(config) {
-    var dependencyModule = config.dependencyModule, successPath = config.successPath, failurePath = config.failurePath, scopes = config.scopes, imports = config.imports, exports = config.exports, providers = config.providers;
+    var dependencyModule = config.dependencyModule, successPath = config.successPath, failurePath = config.failurePath, signInSuccessPath = config.signInSuccessPath, signInFailurePath = config.signInFailurePath, allowedReturnPaths = config.allowedReturnPaths, scopes = config.scopes, signInScopes = config.signInScopes, imports = config.imports, exports = config.exports, providers = config.providers;
     var dependencyModuleImport = dependencyModule ? [
         dependencyModule
     ] : [];
@@ -715,7 +866,11 @@ function _unsupported_iterable_to_array(o, minLen) {
                         envService: envService,
                         successPath: successPath,
                         failurePath: failurePath,
-                        scopes: scopes
+                        signInSuccessPath: signInSuccessPath,
+                        signInFailurePath: signInFailurePath,
+                        allowedReturnPaths: allowedReturnPaths,
+                        scopes: scopes,
+                        signInScopes: signInScopes
                     });
                 }
             },
@@ -724,4 +879,4 @@ function _unsupported_iterable_to_array(o, minLen) {
     };
 }
 
-export { DEFAULT_DISCORD_OAUTH_SCOPES, DISCORD_USER_EXTERNAL_CONNECTION_OAUTH_CONTROLLER_PATH, DISCORD_USER_EXTERNAL_CONNECTION_OAUTH_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, DiscordUserExternalConnectionOAuthController, DiscordUserExternalConnectionOAuthService, DiscordUserExternalConnectionOAuthServiceConfig, appDiscordUserExternalConnectionOAuthModuleMetadata, discordUserExternalConnectionCredentials, discordUserExternalConnectionOAuthServiceConfigFactory };
+export { DEFAULT_DISCORD_OAUTH_SCOPES, DEFAULT_DISCORD_SIGN_IN_OAUTH_SCOPES, DISCORD_USER_EXTERNAL_CONNECTION_OAUTH_CONTROLLER_PATH, DISCORD_USER_EXTERNAL_CONNECTION_OAUTH_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, DiscordUserExternalConnectionOAuthController, DiscordUserExternalConnectionOAuthService, DiscordUserExternalConnectionOAuthServiceConfig, appDiscordUserExternalConnectionOAuthModuleMetadata, discordUserExternalConnectionCredentials, discordUserExternalConnectionOAuthServiceConfigFactory };

package/discord/package.json

@@ -1,17 +1,17 @@
 {
   "name": "@dereekb/firebase-server/discord",
-  "version": "14.0.1",
+  "version": "14.1.0",
   "type": "module",
   "peerDependencies": {
-    "@dereekb/analytics": "14.0.1",
-    "@dereekb/date": "14.0.1",
-    "@dereekb/discord": "14.0.1",
-    "@dereekb/firebase": "14.0.1",
-    "@dereekb/firebase-server": "14.0.1",
-    "@dereekb/model": "14.0.1",
-    "@dereekb/nestjs": "14.0.1",
-    "@dereekb/rxjs": "14.0.1",
-    "@dereekb/util": "14.0.1",
+    "@dereekb/analytics": "14.1.0",
+    "@dereekb/date": "14.1.0",
+    "@dereekb/discord": "14.1.0",
+    "@dereekb/firebase": "14.1.0",
+    "@dereekb/firebase-server": "14.1.0",
+    "@dereekb/model": "14.1.0",
+    "@dereekb/nestjs": "14.1.0",
+    "@dereekb/rxjs": "14.1.0",
+    "@dereekb/util": "14.1.0",
     "@nestjs/common": "^12.0.1",
     "express": "^5.2.1"
   },

package/discord/src/lib/discord.oauth.connection.config.d.ts

@@ -27,8 +27,25 @@ export declare const DISCORD_USER_EXTERNAL_CONNECTION_OAUTH_ROUTES_FOR_GLOBAL_RO
  * — a token granted no scopes can do nothing — and it is what lets the connection be labeled with the
  * account it belongs to. Excludes `email`, which is a real privilege escalation the label does not
  * need, and `guilds` / `connections` / `bot`, which nothing here reads.
+ *
+ * An app using Discord to SIGN IN normally wants `['identify', 'email']`: without `email` the
+ * identity carries none, which both fails the auto-create delegate's default email requirement and
+ * silently skips the sign-in service's existing-account collision check.
  */
 export declare const DEFAULT_DISCORD_OAUTH_SCOPES: readonly DiscordOAuthScope[];
+/**
+ * The scopes requested for an IDENTITY round trip — a sign-in, or linking Discord as a login method.
+ *
+ * A separate default from {@link DEFAULT_DISCORD_OAUTH_SCOPES} because the two answer different
+ * questions. The data default is least privilege for whatever the integration reads; this one is what
+ * it takes to know WHO signed in, which needs `email` — without it the identity carries none, which
+ * both fails the shipped auto-create delegate's email requirement and silently skips the sign-in
+ * service's existing-account collision check.
+ *
+ * Keeping them separate is what lets an app request a broad data grant without every login also
+ * demanding it, and vice versa.
+ */
+export declare const DEFAULT_DISCORD_SIGN_IN_OAUTH_SCOPES: readonly DiscordOAuthScope[];
 /**
  * Configuration for the {@link DiscordUserExternalConnectionOAuthService}.
  *
@@ -38,7 +55,14 @@ export declare const DEFAULT_DISCORD_OAUTH_SCOPES: readonly DiscordOAuthScope[];
  * `@dereekb/discord/nestjs`, and the service reads them through the injected `DiscordOAuthApi`.
  */
 export declare abstract class DiscordUserExternalConnectionOAuthServiceConfig extends UserExternalConnectionOAuthServiceConfig {
+    /**
+     * The scopes requested for a DATA connect.
+     */
     readonly scopes: readonly DiscordOAuthScope[];
+    /**
+     * The scopes requested for a sign-in or a login-method link.
+     */
+    readonly signInScopes: readonly DiscordOAuthScope[];
 }
 export interface DiscordUserExternalConnectionOAuthServiceConfigFactoryConfig {
     readonly envService: FirebaseServerEnvService;
@@ -51,9 +75,26 @@ export interface DiscordUserExternalConnectionOAuthServiceConfigFactoryConfig {
      */
     readonly failurePath?: Maybe<string>;
     /**
-     * The scopes to request. Defaults to {@link DEFAULT_DISCORD_OAUTH_SCOPES}.
+     * Path on the app URL a successful SIGN-IN returns to. Defaults to `successPath`.
+     */
+    readonly signInSuccessPath?: Maybe<string>;
+    /**
+     * Path on the app URL a FAILED sign-in returns to, e.g. `/auth/login`. Defaults to `failurePath`.
+     */
+    readonly signInFailurePath?: Maybe<string>;
+    /**
+     * App paths a sign-in request may ask to return to instead of `signInSuccessPath`.
+     */
+    readonly allowedReturnPaths?: Maybe<readonly string[]>;
+    /**
+     * The scopes to request for a DATA connect. Defaults to {@link DEFAULT_DISCORD_OAUTH_SCOPES}.
      */
     readonly scopes?: Maybe<readonly DiscordOAuthScope[]>;
+    /**
+     * The scopes to request for a SIGN-IN or a login-method link. Defaults to
+     * {@link DEFAULT_DISCORD_SIGN_IN_OAUTH_SCOPES}.
+     */
+    readonly signInScopes?: Maybe<readonly DiscordOAuthScope[]>;
 }
 /**
  * Builds the Discord connect flow's configuration from the app's configured origins.
@@ -63,7 +104,7 @@ export interface DiscordUserExternalConnectionOAuthServiceConfigFactoryConfig {
  * code-declared paths. The client credentials are read by `discordOAuthServiceConfigFactory` in
  * `@dereekb/discord/nestjs`, so registering Discord adds no deployment configuration here.
  *
- * @param config - The env service, the return paths, and the optional scope override.
+ * @param config - The env service, the return paths, and the optional scope overrides.
  * @returns The validated service configuration.
  */
 export declare function discordUserExternalConnectionOAuthServiceConfigFactory(config: DiscordUserExternalConnectionOAuthServiceConfigFactoryConfig): DiscordUserExternalConnectionOAuthServiceConfig;

package/discord/src/lib/discord.oauth.connection.module.d.ts

@@ -18,9 +18,26 @@ export interface ProvideAppDiscordUserExternalConnectionOAuthMetadataConfig exte
      */
     readonly failurePath?: Maybe<string>;
     /**
-     * The scopes to request. Defaults to `DEFAULT_DISCORD_OAUTH_SCOPES`.
+     * Path on the app URL a successful SIGN-IN returns to. Defaults to `successPath`.
+     */
+    readonly signInSuccessPath?: Maybe<string>;
+    /**
+     * Path on the app URL a FAILED sign-in returns to, e.g. `/auth/login`. Defaults to `failurePath`.
+     */
+    readonly signInFailurePath?: Maybe<string>;
+    /**
+     * App paths a sign-in request may ask to return to instead of `signInSuccessPath`.
+     */
+    readonly allowedReturnPaths?: Maybe<readonly string[]>;
+    /**
+     * The scopes to request for a DATA connect. Defaults to `DEFAULT_DISCORD_OAUTH_SCOPES`.
      */
     readonly scopes?: Maybe<readonly DiscordOAuthScope[]>;
+    /**
+     * The scopes to request for a SIGN-IN or a login-method link. Defaults to
+     * `DEFAULT_DISCORD_SIGN_IN_OAUTH_SCOPES`.
+     */
+    readonly signInScopes?: Maybe<readonly DiscordOAuthScope[]>;
 }
 /**
  * Convenience function used to generate ModuleMetadata for an app's Discord external-connection

package/discord/src/lib/discord.oauth.connection.service.d.ts

@@ -1,6 +1,6 @@
 import { type DiscordAccessToken, type DiscordOAuthAuthorizeUrlFactory, type DiscordOAuthCurrentUser } from '@dereekb/discord';
 import { DiscordOAuthApi } from '@dereekb/discord/nestjs';
-import { AbstractUserExternalConnectionOAuthService, UserExternalConnectionAccessor, UserExternalConnectionServerActions, UserExternalConnectionStateCoder, type UserExternalConnectionCredentials, type UserExternalConnectionOAuthExchangeInput, type UserExternalConnectionOAuthRefreshCredentialsInput, type UserExternalConnectionOAuthState } from '@dereekb/firebase-server/model';
+import { AbstractUserExternalConnectionOAuthService, UserExternalConnectionAccessor, UserExternalConnectionProviderPolicyRegistry, UserExternalConnectionServerActions, UserExternalConnectionSignInService, UserExternalConnectionSignInThrottle, UserExternalConnectionStateCoder, type UserExternalConnectionCredentials, type UserExternalConnectionOAuthAuthorizeUrlInput, type UserExternalConnectionOAuthExchangeInput, type UserExternalConnectionOAuthRefreshCredentialsInput, type UserExternalConnectionOAuthRevokeCredentialsInput, type UserExternalConnectionOAuthSignInIdentityInput, type UserExternalConnectionSignInIdentity } from '@dereekb/firebase-server/model';
 import { type Maybe, type WebsiteUrl } from '@dereekb/util';
 import { DiscordUserExternalConnectionOAuthServiceConfig } from './discord.oauth.connection.config';
 export interface DiscordUserExternalConnectionCredentialsInput {
@@ -35,9 +35,46 @@ export declare class DiscordUserExternalConnectionOAuthService extends AbstractU
     readonly userExternalConnectionActions: UserExternalConnectionServerActions;
     readonly userExternalConnectionAccessor: UserExternalConnectionAccessor;
     readonly oauthApi: DiscordOAuthApi;
+    readonly userExternalConnectionSignInService?: Maybe<UserExternalConnectionSignInService>;
+    readonly userExternalConnectionProviderPolicyRegistry?: Maybe<UserExternalConnectionProviderPolicyRegistry>;
+    readonly userExternalConnectionSignInThrottle?: Maybe<UserExternalConnectionSignInThrottle>;
     readonly authorizeUrlFactory: DiscordOAuthAuthorizeUrlFactory;
-    constructor(config: DiscordUserExternalConnectionOAuthServiceConfig, stateCoder: UserExternalConnectionStateCoder, userExternalConnectionActions: UserExternalConnectionServerActions, userExternalConnectionAccessor: UserExternalConnectionAccessor, oauthApi: DiscordOAuthApi);
-    protected authorizeUrlForState(state: UserExternalConnectionOAuthState): WebsiteUrl;
+    readonly signInAuthorizeUrlFactory: DiscordOAuthAuthorizeUrlFactory;
+    constructor(config: DiscordUserExternalConnectionOAuthServiceConfig, stateCoder: UserExternalConnectionStateCoder, userExternalConnectionActions: UserExternalConnectionServerActions, userExternalConnectionAccessor: UserExternalConnectionAccessor, oauthApi: DiscordOAuthApi, userExternalConnectionSignInService?: Maybe<UserExternalConnectionSignInService>, userExternalConnectionProviderPolicyRegistry?: Maybe<UserExternalConnectionProviderPolicyRegistry>, userExternalConnectionSignInThrottle?: Maybe<UserExternalConnectionSignInThrottle>);
+    /**
+     * Picks the scope set from the handoff's direction.
+     *
+     * A `connect` is a DATA grant and gets `scopes`; a `signin` or a `link` is an IDENTITY grant and gets
+     * `signInScopes`. The service cannot read the mode off the state — it is an encrypted envelope only
+     * the state coder can open — so the framework decodes it and passes it in.
+     *
+     * @param input - The state, the optional PKCE challenge, and the mode.
+     * @returns Discord's authorize URL.
+     */
+    protected authorizeUrlForState(input: UserExternalConnectionOAuthAuthorizeUrlInput): WebsiteUrl;
     protected credentialsForAuthorizationCode(input: UserExternalConnectionOAuthExchangeInput): Promise<UserExternalConnectionCredentials>;
+    /**
+     * Reads the Discord account a sign-in is attributed to.
+     *
+     * MANDATORY, unlike the best-effort read in the exchange above: a sign-in with no snowflake has
+     * nothing to key the account on. `email`/`verified` come from the same call and are only populated
+     * when the `email` scope was granted — an app whose sign-in delegate provisions users by email must
+     * request it.
+     *
+     * @param input - The credentials the exchange produced.
+     * @returns The Discord identity to sign in as.
+     */
+    protected signInIdentityForCredentials(input: UserExternalConnectionOAuthSignInIdentityInput): Promise<UserExternalConnectionSignInIdentity>;
     refreshCredentials(input: UserExternalConnectionOAuthRefreshCredentialsInput): Promise<UserExternalConnectionCredentials>;
+    /**
+     * Revokes the Discord grant so a captured token cannot outlive the disconnect.
+     *
+     * The refresh token is revoked when there is one: Discord invalidates the whole grant, so revoking
+     * the longer-lived credential covers the access token issued from it. A failure is logged rather
+     * than thrown — the disconnect has already decided to forget these credentials, and failing it
+     * would leave the user connected to an account they asked to leave.
+     *
+     * @param input - The acting user and the credentials being discarded.
+     */
+    revokeCredentials(input: UserExternalConnectionOAuthRevokeCredentialsInput): Promise<void>;
 }

package/index.esm.js

@@ -1,6 +1,6 @@
 import { timingSafeEqual } from 'node:crypto';
 import { DBX_FIREBASE_SERVER_NO_AUTH_ERROR_CODE, UNAUTHENTICATED_ERROR_CODE, FORBIDDEN_ERROR_CODE, PERMISSION_DENIED_ERROR_CODE, NOT_FOUND_ERROR_CODE, MODEL_NOT_AVAILABLE_ERROR_CODE, BAD_REQUEST_ERROR_CODE, CONFLICT_ERROR_CODE, ALREADY_EXISTS_ERROR_CODE, UNAVAILABLE_ERROR_CODE, UNAVAILABLE_OR_DEACTIVATED_FUNCTION_ERROR_CODE, INTERNAL_SERVER_ERROR_CODE, FIREBASE_AUTH_USER_NOT_FOUND_ERROR, FIREBASE_SERVER_AUTH_CLAIMS_RESET_PASSWORD_KEY, FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, FIREBASE_SERVER_AUTH_CLAIMS_RESET_EXPIRES_AT_KEY, FIREBASE_AUTH_PHONE_NUMBER_ALREADY_EXISTS_ERROR, FIREBASE_AUTH_EMAIL_ALREADY_EXISTS_ERROR, FIREBASE_AUTH_INVALID_PHONE_NUMBER_ERROR, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_LAST_COM_DATE_KEY, setIdAndKeyFromKeyIdRefOnDocumentData, DBX_FIREBASE_SERVER_PASSWORD_RESET_INVALID_CODE_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_NO_CONFIG_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_SEND_ONCE_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_THROTTLE_ERROR_CODE, FirestoreDocumentContextType, streamFromOnSnapshot, FIRESTORE_LIMIT_QUERY_CONSTRAINT_TYPE, FIRESTORE_LIMIT_TO_LAST_QUERY_CONSTRAINT_TYPE, FIRESTORE_ORDER_BY_QUERY_CONSTRAINT_TYPE, FIRESTORE_ORDER_BY_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, FIRESTORE_WHERE_QUERY_CONSTRAINT_TYPE, FIRESTORE_WHERE_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, FIRESTORE_OFFSET_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AT_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AT_VALUE_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AFTER_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_AT_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_AT_VALUE_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_BEFORE_QUERY_CONSTRAINT_TYPE, makeFirestoreQueryConstraintFunctionsDriver, firestoreContextFactory, firestoreField, optionalFirestoreField, DEFAULT_MODEL_FUNCTION_FIREBASE_CRUD_FUNCTION_SPECIFIER, UNKNOWN_MODEL_TYPE_ERROR_CODE, BAD_DOCUMENT_QUERY_CURSOR_ERROR_CODE, limit, startAfter, DEFAULT_ON_CALL_QUERY_MODEL_LIMIT, MAX_ON_CALL_QUERY_MODEL_LIMIT, oidcScopeTermSatisfied, oidcScopesFromScopeClaim, resolveEffectiveOidcScopeTerms, callModelOidcScopeForCallType, oidcScopeTermsSatisfied, CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE, FIRESTORE_SESSION_OIDC_SCOPE, ScheduledFunctionDevelopmentFunctionTypeEnum, SCHEDULED_FUNCTION_DEV_FUNCTION_SPECIFIER, storageListFilesResultFactory, assertStorageUploadOptionsStringFormat, firebaseStorageContextFactory, inContextFirebaseModelsServiceFactory, useFirebaseModelsService } from '@dereekb/firebase';
-import { partialServerError, isServerError, randomNumberFactory, cachedGetter, filterNullAndUndefinedValues, asSet, AUTH_ADMIN_ROLE, AUTH_TOS_SIGNED_ROLE, forEachKeyValue, KeyValueTypleValueFilter, filterUndefinedValues, isThrottled, mapObjectMap, batch, objectToMap, serverError, asArray, containsAllValues, websiteUrlDetails, mergeObjects, cronExpressionRepeatingEveryNMinutes, mapIdentityFunction, slashPathName, toRelativeSlashPathStartType, fixMultiSlashesInSlashPath, SLASH_PATH_SEPARATOR, objectHasNoKeys, websiteUrlFromPaths, pushItemOrArrayItemsIntoArray, makeGetter, asGetter, build, performAsyncTasks } from '@dereekb/util';
+import { partialServerError, isServerError, randomNumberFactory, cachedGetter, filterNullAndUndefinedValues, asSet, filterUndefinedValues, AUTH_ADMIN_ROLE, AUTH_TOS_SIGNED_ROLE, forEachKeyValue, KeyValueTypleValueFilter, isThrottled, mapObjectMap, batch, objectToMap, serverError, asArray, containsAllValues, websiteUrlDetails, mergeObjects, cronExpressionRepeatingEveryNMinutes, mapIdentityFunction, slashPathName, toRelativeSlashPathStartType, fixMultiSlashesInSlashPath, SLASH_PATH_SEPARATOR, objectHasNoKeys, websiteUrlFromPaths, pushItemOrArrayItemsIntoArray, makeGetter, asGetter, build, performAsyncTasks } from '@dereekb/util';
 import { HttpsError } from 'firebase-functions/https';
 import { hoursToMs, minutesToMs, toISODateString } from '@dereekb/date';
 import { BaseError } from 'make-error';
@@ -1534,6 +1534,14 @@ function _unsupported_iterable_to_array$h(o, minLen) {
                     _this._loadRecord.reset(); // reset the cache
                 });
             }
+        },
+        {
+            key: "mintCustomToken",
+            value: function mintCustomToken(claims) {
+                // `createCustomToken` rejects an explicit undefined for the claims argument on some Admin SDK
+                // versions, so the no-claims call is made without the second argument at all
+                return claims == null ? this.service.auth.createCustomToken(this.uid) : this.service.auth.createCustomToken(this.uid, filterUndefinedValues(claims));
+            }
         }
     ]);
     return AbstractFirebaseServerAuthUserContext;

package/mailgun/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/mailgun",
-  "version": "14.0.1",
+  "version": "14.1.0",
   "type": "module",
   "peerDependencies": {
-    "@dereekb/analytics": "14.0.1",
-    "@dereekb/firebase": "14.0.1",
-    "@dereekb/firebase-server": "14.0.1",
-    "@dereekb/date": "14.0.1",
-    "@dereekb/nestjs": "14.0.1",
-    "@dereekb/model": "14.0.1",
-    "@dereekb/rxjs": "14.0.1",
-    "@dereekb/util": "14.0.1"
+    "@dereekb/analytics": "14.1.0",
+    "@dereekb/firebase": "14.1.0",
+    "@dereekb/firebase-server": "14.1.0",
+    "@dereekb/date": "14.1.0",
+    "@dereekb/nestjs": "14.1.0",
+    "@dereekb/model": "14.1.0",
+    "@dereekb/rxjs": "14.1.0",
+    "@dereekb/util": "14.1.0"
   },
   "exports": {
     "./package.json": "./package.json",