@dereekb/firebase-server 14.0.1 → 14.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/firebase-server",
-  "version": "14.0.1",
+  "version": "14.1.0",
   "type": "module",
   "sideEffects": false,
   "exports": {
@@ -58,17 +58,17 @@
   },
   "peerDependencies": {
     "@cantoo/pdf-lib": "^2.6.5",
-    "@dereekb/analytics": "14.0.1",
-    "@dereekb/calcom": "14.0.1",
-    "@dereekb/date": "14.0.1",
-    "@dereekb/dbx-core": "14.0.1",
-    "@dereekb/discord": "14.0.1",
-    "@dereekb/firebase": "14.0.1",
-    "@dereekb/model": "14.0.1",
-    "@dereekb/nestjs": "14.0.1",
-    "@dereekb/rxjs": "14.0.1",
-    "@dereekb/util": "14.0.1",
-    "@dereekb/zoho": "14.0.1",
+    "@dereekb/analytics": "14.1.0",
+    "@dereekb/calcom": "14.1.0",
+    "@dereekb/date": "14.1.0",
+    "@dereekb/dbx-core": "14.1.0",
+    "@dereekb/discord": "14.1.0",
+    "@dereekb/firebase": "14.1.0",
+    "@dereekb/model": "14.1.0",
+    "@dereekb/nestjs": "14.1.0",
+    "@dereekb/rxjs": "14.1.0",
+    "@dereekb/util": "14.1.0",
+    "@dereekb/zoho": "14.1.0",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.22.0",
     "@modelcontextprotocol/node": "2.0.0",

package/src/lib/auth/auth.service.d.ts

@@ -167,6 +167,31 @@ export interface FirebaseServerAuthUserContext extends FirebaseServerAuthUserIde
      * Removes all custom claims from the user.
      */
     clearClaims(): Promise<void>;
+    /**
+     * Mints a short-lived Firebase Auth custom token the client exchanges via `signInWithCustomToken`.
+     *
+     * This is how a sign-in performed OUTSIDE Firebase Auth — a third-party OAuth provider Firebase has
+     * no native provider for — is bridged back into it: the server authenticates the user against the
+     * provider, resolves them to a uid, and mints a token for that uid. The alternative (a generic
+     * OIDC/SAML provider) requires the one-way Identity Platform upgrade, which this workspace avoids.
+     *
+     * ## Two operational notes
+     *
+     * 1. `createCustomToken` NESTS the developer claims under a `claims` key inside the unexchanged JWT
+     *    (see `decodeEncodedCreateCustomTokenResult()` in `@dereekb/firebase-server/test`). This is only
+     *    a property of the token BEFORE it is exchanged — after `signInWithCustomToken`, Firebase spreads
+     *    them to the top level of the ID token, where security rules read them. Do not pre-flatten.
+     * 2. Minting requires `iam.serviceAccounts.signBlob` (the Service Account Token Creator role) when
+     *    the Admin SDK runs on default credentials rather than an explicit key file. The Auth emulator
+     *    does not check this, so the standard failure mode is "works locally, 403s in production".
+     *
+     * The user's STORED custom claims are applied by Firebase on exchange regardless of this argument;
+     * `claims` here adds one-off claims to this sign-in only, and does not persist anything.
+     *
+     * @param claims - Optional additional claims to embed in this token.
+     * @returns The custom token to hand to the client.
+     */
+    mintCustomToken<T extends AuthClaimsObject = AuthClaimsObject>(claims?: Maybe<AuthClaimsUpdate<T>>): Promise<string>;
 }
 /**
  * Base implementation of {@link FirebaseServerAuthUserContext} that manages a single user's
@@ -247,6 +272,7 @@ export declare abstract class AbstractFirebaseServerAuthUserContext<S extends Fi
     updateClaims<T extends AuthClaimsObject = AuthClaimsObject>(claims: AuthClaimsUpdate<T>): Promise<void>;
     clearClaims(): Promise<void>;
     setClaims<T extends AuthClaimsObject = AuthClaimsObject>(claims: Maybe<AuthClaimsUpdate<T>>): Promise<void>;
+    mintCustomToken<T extends AuthClaimsObject = AuthClaimsObject>(claims?: Maybe<AuthClaimsUpdate<T>>): Promise<string>;
 }
 /**
  * Read-only auth context derived from a Firebase callable function request.

package/test/package.json

@@ -1,17 +1,17 @@
 {
   "name": "@dereekb/firebase-server/test",
-  "version": "14.0.1",
+  "version": "14.1.0",
   "type": "module",
   "peerDependencies": {
-    "@dereekb/analytics": "14.0.1",
-    "@dereekb/date": "14.0.1",
-    "@dereekb/firebase": "14.0.1",
-    "@dereekb/firebase-server": "14.0.1",
-    "@dereekb/firebase-server/oidc": "14.0.1",
-    "@dereekb/model": "14.0.1",
-    "@dereekb/nestjs": "14.0.1",
-    "@dereekb/rxjs": "14.0.1",
-    "@dereekb/util": "14.0.1",
+    "@dereekb/analytics": "14.1.0",
+    "@dereekb/date": "14.1.0",
+    "@dereekb/firebase": "14.1.0",
+    "@dereekb/firebase-server": "14.1.0",
+    "@dereekb/firebase-server/oidc": "14.1.0",
+    "@dereekb/model": "14.1.0",
+    "@dereekb/nestjs": "14.1.0",
+    "@dereekb/rxjs": "14.1.0",
+    "@dereekb/util": "14.1.0",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.22.0",
     "@nestjs/common": "^12.0.1",
@@ -24,7 +24,7 @@
     "supertest": "^7.2.2"
   },
   "devDependencies": {
-    "@dereekb/nestjs": "14.0.1"
+    "@dereekb/nestjs": "14.1.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/twilio/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/twilio",
-  "version": "14.0.1",
+  "version": "14.1.0",
   "type": "module",
   "peerDependencies": {
-    "@dereekb/date": "14.0.1",
-    "@dereekb/firebase": "14.0.1",
-    "@dereekb/firebase-server": "14.0.1",
-    "@dereekb/model": "14.0.1",
-    "@dereekb/nestjs": "14.0.1",
-    "@dereekb/rxjs": "14.0.1",
-    "@dereekb/util": "14.0.1"
+    "@dereekb/date": "14.1.0",
+    "@dereekb/firebase": "14.1.0",
+    "@dereekb/firebase-server": "14.1.0",
+    "@dereekb/model": "14.1.0",
+    "@dereekb/nestjs": "14.1.0",
+    "@dereekb/rxjs": "14.1.0",
+    "@dereekb/util": "14.1.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/zoho/index.esm.js

@@ -1060,9 +1060,10 @@ function _type_of$1(obj) {
     _create_class(ZohoUserExternalConnectionOAuthService, [
         {
             key: "authorizeUrlForState",
-            value: function authorizeUrlForState(state) {
+            value: function authorizeUrlForState(input) {
+                // Zoho's authorize URL takes no PKCE challenge, so `input.codeChallenge` is deliberately unused
                 return this.authorizeUrlFactory({
-                    state: state
+                    state: input.state
                 });
             }
         },

package/zoho/package.json

@@ -1,17 +1,17 @@
 {
   "name": "@dereekb/firebase-server/zoho",
-  "version": "14.0.1",
+  "version": "14.1.0",
   "type": "module",
   "peerDependencies": {
-    "@dereekb/analytics": "14.0.1",
-    "@dereekb/date": "14.0.1",
-    "@dereekb/model": "14.0.1",
-    "@dereekb/nestjs": "14.0.1",
-    "@dereekb/rxjs": "14.0.1",
-    "@dereekb/firebase": "14.0.1",
-    "@dereekb/firebase-server": "14.0.1",
-    "@dereekb/util": "14.0.1",
-    "@dereekb/zoho": "14.0.1",
+    "@dereekb/analytics": "14.1.0",
+    "@dereekb/date": "14.1.0",
+    "@dereekb/model": "14.1.0",
+    "@dereekb/nestjs": "14.1.0",
+    "@dereekb/rxjs": "14.1.0",
+    "@dereekb/firebase": "14.1.0",
+    "@dereekb/firebase-server": "14.1.0",
+    "@dereekb/util": "14.1.0",
+    "@dereekb/zoho": "14.1.0",
     "@nestjs/common": "^12.0.1",
     "@nestjs/config": "^12.0.0",
     "express": "^5.2.1"

package/zoho/src/lib/zoho.oauth.connection.service.d.ts

@@ -1,6 +1,6 @@
 import { type ZohoAccountsApiUrl, type ZohoAccountsAuthorizeUrlFactory, type ZohoAccountsRefreshTokenFromAuthorizationCodeResponse, type ZohoAccountsUserInfoResponse } from '@dereekb/zoho';
 import { ZohoAccountsOAuthApi } from '@dereekb/zoho/nestjs';
-import { AbstractUserExternalConnectionOAuthService, UserExternalConnectionAccessor, UserExternalConnectionServerActions, UserExternalConnectionStateCoder, type UserExternalConnectionCredentials, type UserExternalConnectionOAuthCallbackQueryValues, type UserExternalConnectionOAuthExchangeInput, type UserExternalConnectionOAuthRefreshCredentialsInput, type UserExternalConnectionOAuthState } from '@dereekb/firebase-server/model';
+import { AbstractUserExternalConnectionOAuthService, UserExternalConnectionAccessor, UserExternalConnectionServerActions, UserExternalConnectionStateCoder, type UserExternalConnectionCredentials, type UserExternalConnectionOAuthCallbackQueryValues, type UserExternalConnectionOAuthExchangeInput, type UserExternalConnectionOAuthRefreshCredentialsInput, type UserExternalConnectionOAuthAuthorizeUrlInput } from '@dereekb/firebase-server/model';
 import { type Maybe, type WebsiteUrl } from '@dereekb/util';
 import { ZohoUserExternalConnectionOAuthServiceConfig } from './zoho.oauth.connection.config';
 /**
@@ -80,7 +80,7 @@ export declare class ZohoUserExternalConnectionOAuthService extends AbstractUser
      */
     readonly accountsApiUrl: ZohoAccountsApiUrl;
     constructor(config: ZohoUserExternalConnectionOAuthServiceConfig, stateCoder: UserExternalConnectionStateCoder, userExternalConnectionActions: UserExternalConnectionServerActions, userExternalConnectionAccessor: UserExternalConnectionAccessor, oauthApi: ZohoAccountsOAuthApi);
-    protected authorizeUrlForState(state: UserExternalConnectionOAuthState): WebsiteUrl;
+    protected authorizeUrlForState(input: UserExternalConnectionOAuthAuthorizeUrlInput): WebsiteUrl;
     protected credentialsForAuthorizationCode(input: UserExternalConnectionOAuthExchangeInput): Promise<UserExternalConnectionCredentials>;
     refreshCredentials(input: UserExternalConnectionOAuthRefreshCredentialsInput): Promise<UserExternalConnectionCredentials>;
     /**