@dereekb/firebase-server 14.2.0 → 14.4.0

package/test/index.esm.js

@@ -13,7 +13,7 @@ import { HttpsError } from 'firebase-functions/https';
 import { BaseError } from 'make-error';
 import request from 'supertest';
 import { randomBytes, createHash } from 'node:crypto';
-import { OidcClientService, JwksService, OidcAccountService } from '@dereekb/firebase-server/oidc';
+import { OidcProviderConfigService, OidcClientService, JwksService, OidcAccountService } from '@dereekb/firebase-server/oidc';
 
 function _assert_this_initialized$9(self) {
     if (self === void 0) throw new ReferenceError("this hasn't been initialised - super() hasn't been called");
@@ -118,7 +118,7 @@ function _object_spread$6(target) {
     }
     return target;
 }
-function ownKeys$3(object, enumerableOnly) {
+function ownKeys$4(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -126,11 +126,11 @@ function ownKeys$3(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$3(target, source) {
+function _object_spread_props$4(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$3(Object(source)).forEach(function(key) {
+        ownKeys$4(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -482,7 +482,7 @@ function _type_of$9(obj) {
             value: function callAuthBlockingFunction(input) {
                 var fn = input.fn, userRecord = input.userRecord, eventType = input.eventType, eventOverride = input.eventOverride, _input_skipJsonConversion = input.skipJsonConversion, skipJsonConversion = _input_skipJsonConversion === void 0 ? false : _input_skipJsonConversion;
                 var timestamp = new Date().toISOString();
-                var event = _object_spread_props$3(_object_spread$6({
+                var event = _object_spread_props$4(_object_spread$6({
                     ipAddress: '127.0.0.1',
                     userAgent: 'testing',
                     eventId: '0',
@@ -583,7 +583,7 @@ function _type_of$9(obj) {
                                 }
                                 return [
                                     4,
-                                    auth.createUser(_object_spread$6(_object_spread_props$3(_object_spread$6({
+                                    auth.createUser(_object_spread$6(_object_spread_props$4(_object_spread$6({
                                         uid: uid,
                                         displayName: 'Test Person'
                                     }, details), {
@@ -787,7 +787,7 @@ function _type_of$9(obj) {
     var _ref;
     var _decoded_claims;
     var decoded = decode(token);
-    var decodedToken = _object_spread_props$3(_object_spread$6({}, decoded, decoded.claims), {
+    var decodedToken = _object_spread_props$4(_object_spread$6({}, decoded, decoded.claims), {
         auth_time: decoded.iat,
         firebase: (_ref = (_decoded_claims = decoded.claims) === null || _decoded_claims === void 0 ? void 0 : _decoded_claims.firebase) !== null && _ref !== void 0 ? _ref : {}
     });
@@ -2498,7 +2498,7 @@ function _object_spread$4(target) {
     }
     return target;
 }
-function ownKeys$2(object, enumerableOnly) {
+function ownKeys$3(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -2506,11 +2506,11 @@ function ownKeys$2(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$2(target, source) {
+function _object_spread_props$3(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$2(Object(source)).forEach(function(key) {
+        ownKeys$3(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -2640,7 +2640,7 @@ function _ts_generator$5(thisArg, body) {
             return _async_to_generator$5(function() {
                 var _ref, request;
                 return _ts_generator$5(this, function(_state) {
-                    request = _object_spread_props$2(_object_spread$4({}, context), {
+                    request = _object_spread_props$3(_object_spread$4({}, context), {
                         data: data,
                         // NOTE: These will typically not be used/available as they are express.js properties that are not available or useful to the handlers
                         rawRequest: (_ref = context === null || context === void 0 ? void 0 : context.rawRequest) !== null && _ref !== void 0 ? _ref : {},
@@ -2823,7 +2823,7 @@ function _object_spread$3(target) {
     }
     return target;
 }
-function ownKeys$1(object, enumerableOnly) {
+function ownKeys$2(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -2831,11 +2831,11 @@ function ownKeys$1(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$1(target, source) {
+function _object_spread_props$2(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$1(Object(source)).forEach(function(key) {
+        ownKeys$2(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -3129,7 +3129,7 @@ var functionsInitialized = false;
  */ var firebaseAdminFunctionTestBuilder = testContextBuilder({
     buildConfig: function buildConfig(input) {
         var _ref;
-        var config = _object_spread_props$1(_object_spread$3({}, input), {
+        var config = _object_spread_props$2(_object_spread$3({}, input), {
             useFunctionSingletonContext: (_ref = input === null || input === void 0 ? void 0 : input.useFunctionSingletonContext) !== null && _ref !== void 0 ? _ref : DEFAULT_FIREBASE_ADMIN_FUNCTION_TEST_USE_FUNCTION_SINGLETON_CONTEXT
         });
         return config;
@@ -3390,7 +3390,7 @@ function _object_spread$2(target) {
     }
     return target;
 }
-function ownKeys(object, enumerableOnly) {
+function ownKeys$1(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -3398,11 +3398,11 @@ function ownKeys(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props(target, source) {
+function _object_spread_props$1(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys(Object(source)).forEach(function(key) {
+        ownKeys$1(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -3716,7 +3716,7 @@ function _unsupported_iterable_to_array$1(o, minLen) {
                     switch(_state.label){
                         case 0:
                             additionalProviders = (_makeProviders = makeProviders(f.instance)) !== null && _makeProviders !== void 0 ? _makeProviders : [];
-                            rootModule = buildNestServerRootModule(_object_spread_props(_object_spread$2({}, serverInstanceConfig), {
+                            rootModule = buildNestServerRootModule(_object_spread_props$1(_object_spread$2({}, serverInstanceConfig), {
                                 modules: _to_consumable_array$1(asArray(nestModules)).concat(_to_consumable_array$1(asArray(serverInstanceConfig === null || serverInstanceConfig === void 0 ? void 0 : serverInstanceConfig.modules))),
                                 firebaseAppGetter: config.injectFirebaseServerAppTokenProvider ? asGetter(f.instance.app) : undefined,
                                 providers: additionalProviders,
@@ -4602,6 +4602,24 @@ function _object_spread(target) {
     }
     return target;
 }
+function ownKeys(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    else {
+        ownKeys(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
 function _sliced_to_array(arr, i) {
     return _array_with_holes(arr) || _iterable_to_array_limit(arr, i) || _unsupported_iterable_to_array(arr, i) || _non_iterable_rest();
 }
@@ -4767,6 +4785,16 @@ function _unsupported_iterable_to_array(o, minLen) {
     var url = location.startsWith('/') ? new URL(location, 'http://localhost') : new URL(location);
     return url.searchParams.get('uid');
 }
+/**
+ * Whether a redirect response points at the given interaction frontend URL (the login or consent screen).
+ *
+ * @param res - Supertest response to inspect.
+ * @param frontendUrl - The frontend URL to match, without its query string.
+ * @returns True when the response's `Location` header starts with `frontendUrl`.
+ */ function isRedirectTo(res, frontendUrl) {
+    var location = res.headers['location'];
+    return location != null && location.startsWith(frontendUrl);
+}
 /**
  * Cookie jar helpers for the OAuth flow.
  *
@@ -4859,29 +4887,39 @@ function _unsupported_iterable_to_array(o, minLen) {
     })();
 }
 /**
- * Performs the full OAuth authorization code flow with PKCE and returns tokens.
+ * Performs the OAuth authorization code flow with PKCE, up to the configured
+ * {@link OAuthTestFlowConfig.stopAtStage}.
  *
  * Steps: create client → PKCE → auth redirect → login → consent → code exchange → token
  *
- * @param input - Bag of services and overrides needed to drive the flow end-to-end.
+ * Stopping early is how a test asserts on an intermediate the completed flow discards — the raw
+ * `/oidc/auth` response, the consent screen's offered `scopes`, or a callback that came back carrying
+ * an `error` instead of a `code`. A stage before `'token'` never exchanges the code, so it never
+ * throws on such a callback; the caller asserts on {@link OAuthTestFlowResult.callbackUrl} instead,
+ * and can run its own `/oidc/token` request with {@link OAuthTestFlowResult.codeVerifier} and the
+ * session's cookie header.
+ *
+ * @param input - Bag of services and overrides needed to drive the flow.
  * @param input.server - HTTP server returned by `nestApp.getHttpServer()` against which all supertest requests are issued.
  * @param input.oidcClientService - Service used to create the OAuth client whose credentials drive the flow.
  * @param input.nestApp - Initialized NestJS application; used to resolve {@link OidcAccountService} for project-id-derived ID tokens and default scopes.
- * @param input.uid - Firebase user ID for whom the test ID token is minted and the OAuth flow is authorized.
- * @param input.config - Optional flow overrides (scopes, redirect URI, client name, token endpoint auth method, provider profiles).
- * @returns The exchanged access token and ID token from the OIDC `/token` endpoint.
- * @throws {Error} When the token exchange step fails (the response body and status are included in the message).
- */ function performFullOAuthFlow(input) {
+ * @param input.uid - Firebase user ID for whom the test ID token is minted; required for any stage past `'auth'`.
+ * @param input.config - Optional flow overrides (scopes, redirect URI, client name, token endpoint auth method, provider profiles, stop stage).
+ * @returns The intermediates the flow produced, plus the tokens when it ran to the `'token'` stage.
+ * @throws {Error} When a stage past `'auth'` is requested without a `uid`, or when the token exchange step fails (the response body and status are included in the message).
+ */ function performOAuthFlow(input) {
     return _async_to_generator$1(function() {
-        var _ref, _ref1, _ref2, server, oidcClientService, nestApp, uid, config, _createCookieJar, collectCookies, cookieHeader, redirectUri, clientName, tokenEndpointAuthMethod, providerProfiles, scopes, _ref3, client_id, client_secret, codeVerifier, codeChallenge, authRes, loginUid, idToken, loginRes, resumeAfterLoginPath, consentRedirectRes, consentUid, consentRes, resumeAfterConsentPath, callbackRedirectRes, callbackUrl, authorizationCode, tokenRes;
+        var _ref, _ref1, _ref2, _ref3, _ref4, _ref5, _config_session, _config_session1, server, oidcClientService, nestApp, uid, config, cookieJar, collectCookies, cookieHeader, stage, redirectUri, clientName, tokenEndpointAuthMethod, providerProfiles, scopes, client, _ref6, client_id, client_secret, client_id1, client_secret1, codeVerifier, codeChallenge, authRes, consentRedirectUrl, callbackUrl, tokenBody, idToken, providerConfigService, interactionRes, loginUid, loginRes, resumeAfterLoginPath, callbackRedirectRes, consentUid, consentRes, resumeAfterConsentPath, authorizationCode, tokenRes;
         return _ts_generator$1(this, function(_state) {
             switch(_state.label){
                 case 0:
                     server = input.server, oidcClientService = input.oidcClientService, nestApp = input.nestApp, uid = input.uid, config = input.config;
-                    _createCookieJar = createCookieJar(), collectCookies = _createCookieJar.collectCookies, cookieHeader = _createCookieJar.cookieHeader;
-                    redirectUri = (_ref = config === null || config === void 0 ? void 0 : config.redirectUri) !== null && _ref !== void 0 ? _ref : 'https://example.com/callback';
-                    clientName = (_ref1 = config === null || config === void 0 ? void 0 : config.clientName) !== null && _ref1 !== void 0 ? _ref1 : 'test-oauth-context';
-                    tokenEndpointAuthMethod = (_ref2 = config === null || config === void 0 ? void 0 : config.tokenEndpointAuthMethod) !== null && _ref2 !== void 0 ? _ref2 : 'client_secret_post';
+                    cookieJar = (_ref = config === null || config === void 0 ? void 0 : (_config_session = config.session) === null || _config_session === void 0 ? void 0 : _config_session.cookieJar) !== null && _ref !== void 0 ? _ref : createCookieJar();
+                    collectCookies = cookieJar.collectCookies, cookieHeader = cookieJar.cookieHeader;
+                    stage = (_ref1 = config === null || config === void 0 ? void 0 : config.stopAtStage) !== null && _ref1 !== void 0 ? _ref1 : 'token';
+                    redirectUri = (_ref2 = (_ref3 = config === null || config === void 0 ? void 0 : (_config_session1 = config.session) === null || _config_session1 === void 0 ? void 0 : _config_session1.client.redirectUri) !== null && _ref3 !== void 0 ? _ref3 : config === null || config === void 0 ? void 0 : config.redirectUri) !== null && _ref2 !== void 0 ? _ref2 : 'https://example.com/callback';
+                    clientName = (_ref4 = config === null || config === void 0 ? void 0 : config.clientName) !== null && _ref4 !== void 0 ? _ref4 : 'test-oauth-context';
+                    tokenEndpointAuthMethod = (_ref5 = config === null || config === void 0 ? void 0 : config.tokenEndpointAuthMethod) !== null && _ref5 !== void 0 ? _ref5 : 'client_secret_post';
                     providerProfiles = config === null || config === void 0 ? void 0 : config.providerProfiles;
                     return [
                         4,
@@ -4889,6 +4927,16 @@ function _unsupported_iterable_to_array(o, minLen) {
                     ];
                 case 1:
                     scopes = _state.sent();
+                    if (!(config === null || config === void 0 ? void 0 : config.session)) return [
+                        3,
+                        2
+                    ];
+                    client = config.session.client;
+                    return [
+                        3,
+                        4
+                    ];
+                case 2:
                     return [
                         4,
                         oidcClientService.createClient(_object_spread({
@@ -4901,15 +4949,23 @@ function _unsupported_iterable_to_array(o, minLen) {
                             dbx_provider_profiles: _to_consumable_array(providerProfiles)
                         }))
                     ];
-                case 2:
-                    _ref3 = _state.sent(), client_id = _ref3.client_id, client_secret = _ref3.client_secret;
+                case 3:
+                    _ref6 = _state.sent(), client_id = _ref6.client_id, client_secret = _ref6.client_secret;
+                    client = {
+                        client_id: client_id,
+                        client_secret: client_secret,
+                        redirectUri: redirectUri
+                    };
+                    _state.label = 4;
+                case 4:
+                    client_id1 = client.client_id, client_secret1 = client.client_secret;
                     // 2. Generate PKCE code_verifier and code_challenge
                     codeVerifier = randomBytes(32).toString('base64url');
                     codeChallenge = createHash('sha256').update(codeVerifier).digest('base64url');
                     return [
                         4,
-                        request(server).get('/oidc/auth').query({
-                            client_id: client_id,
+                        request(server).get('/oidc/auth').query(_object_spread({
+                            client_id: client_id1,
                             redirect_uri: redirectUri,
                             response_type: 'code',
                             scope: scopes,
@@ -4917,25 +4973,42 @@ function _unsupported_iterable_to_array(o, minLen) {
                             code_challenge_method: 'S256',
                             state: 'test-state',
                             nonce: 'test-nonce'
-                        }).redirects(0)
+                        }, (config === null || config === void 0 ? void 0 : config.prompt) == null ? {} : {
+                            prompt: config.prompt
+                        }, (config === null || config === void 0 ? void 0 : config.resource) == null ? {} : {
+                            resource: config.resource
+                        }, config === null || config === void 0 ? void 0 : config.extraAuthParams)).redirects(0)
                     ];
-                case 3:
+                case 5:
                     authRes = _state.sent();
                     collectCookies(authRes);
-                    loginUid = extractInteractionUid(authRes);
+                    if (!(stage !== 'auth')) return [
+                        3,
+                        14
+                    ];
+                    if (uid == null) {
+                        throw new Error('performOAuthFlow requires a uid to reach the "'.concat(stage, '" stage (only the "auth" stage skips the login interaction).'));
+                    }
                     return [
                         4,
                         createTestIdToken(nestApp, uid)
                     ];
-                case 4:
+                case 6:
                     idToken = _state.sent();
+                    providerConfigService = nestApp.get(OidcProviderConfigService);
+                    interactionRes = authRes;
+                    if (!isRedirectTo(authRes, providerConfigService.appLoginUrl)) return [
+                        3,
+                        9
+                    ];
+                    loginUid = extractInteractionUid(authRes);
                     return [
                         4,
                         request(server).post("/interaction/".concat(loginUid, "/login")).set('Cookie', cookieHeader()).send({
                             idToken: idToken
                         })
                     ];
-                case 5:
+                case 7:
                     loginRes = _state.sent();
                     // 5. Resume after login → consent redirect
                     resumeAfterLoginPath = new URL(loginRes.body.redirectTo).pathname + new URL(loginRes.body.redirectTo).search;
@@ -4943,18 +5016,29 @@ function _unsupported_iterable_to_array(o, minLen) {
                         4,
                         request(server).get(resumeAfterLoginPath).set('Cookie', cookieHeader()).redirects(0)
                     ];
-                case 6:
-                    consentRedirectRes = _state.sent();
-                    collectCookies(consentRedirectRes);
-                    consentUid = extractInteractionUid(consentRedirectRes);
+                case 8:
+                    interactionRes = _state.sent();
+                    collectCookies(interactionRes);
+                    _state.label = 9;
+                case 9:
+                    // 6. Approve consent — unless nothing needed consenting and the provider went straight to the callback
+                    callbackRedirectRes = interactionRes;
+                    if (!isRedirectTo(interactionRes, providerConfigService.appConsentUrl)) return [
+                        3,
+                        12
+                    ];
+                    consentRedirectUrl = new URL(interactionRes.headers['location'], 'http://localhost');
+                    consentUid = extractInteractionUid(interactionRes);
                     return [
                         4,
-                        request(server).post("/interaction/".concat(consentUid, "/consent")).set('Cookie', cookieHeader()).send({
+                        request(server).post("/interaction/".concat(consentUid, "/consent")).set('Cookie', cookieHeader()).send(_object_spread({
                             idToken: idToken,
                             approved: true
-                        })
+                        }, (config === null || config === void 0 ? void 0 : config.grantedOIDCScopes) == null ? {} : {
+                            grantedOIDCScopes: _to_consumable_array(config.grantedOIDCScopes)
+                        }))
                     ];
-                case 7:
+                case 10:
                     consentRes = _state.sent();
                     // 7. Follow resume redirect → callback with authorization code
                     resumeAfterConsentPath = new URL(consentRes.body.redirectTo).pathname + new URL(consentRes.body.redirectTo).search;
@@ -4962,49 +5046,112 @@ function _unsupported_iterable_to_array(o, minLen) {
                         4,
                         request(server).get(resumeAfterConsentPath).set('Cookie', cookieHeader()).redirects(0)
                     ];
-                case 8:
+                case 11:
                     callbackRedirectRes = _state.sent();
                     collectCookies(callbackRedirectRes);
+                    _state.label = 12;
+                case 12:
                     callbackUrl = new URL(callbackRedirectRes.headers['location']);
+                    if (!(stage !== 'callback')) return [
+                        3,
+                        14
+                    ];
+                    // 8. Exchange authorization code for tokens
                     authorizationCode = callbackUrl.searchParams.get('code');
                     return [
                         4,
-                        request(server).post('/oidc/token').set('Cookie', cookieHeader()).type('form').send({
+                        request(server).post('/oidc/token').set('Cookie', cookieHeader()).type('form').send(_object_spread({
                             grant_type: 'authorization_code',
                             code: authorizationCode,
                             redirect_uri: redirectUri,
-                            client_id: client_id,
-                            client_secret: client_secret,
+                            client_id: client_id1,
+                            client_secret: client_secret1,
                             code_verifier: codeVerifier
-                        })
+                        }, (config === null || config === void 0 ? void 0 : config.resource) == null ? {} : {
+                            resource: config.resource
+                        }))
                     ];
-                case 9:
+                case 13:
                     tokenRes = _state.sent();
                     if (!tokenRes.body.access_token) {
                         throw new Error("OAuth token exchange failed (status ".concat(tokenRes.status, "): ").concat(JSON.stringify(tokenRes.body)));
                     }
+                    tokenBody = tokenRes.body;
+                    _state.label = 14;
+                case 14:
                     return [
                         2,
                         {
-                            accessToken: tokenRes.body.access_token,
-                            idToken: tokenRes.body.id_token
+                            stage: stage,
+                            authResponse: authRes,
+                            codeVerifier: codeVerifier,
+                            consentRedirectUrl: consentRedirectUrl,
+                            callbackUrl: callbackUrl,
+                            accessToken: tokenBody === null || tokenBody === void 0 ? void 0 : tokenBody.access_token,
+                            idToken: tokenBody === null || tokenBody === void 0 ? void 0 : tokenBody.id_token,
+                            tokenType: tokenBody === null || tokenBody === void 0 ? void 0 : tokenBody.token_type,
+                            scope: tokenBody === null || tokenBody === void 0 ? void 0 : tokenBody.scope,
+                            session: {
+                                client: client,
+                                cookieJar: cookieJar
+                            }
                         }
                     ];
             }
         });
     })();
 }
+/**
+ * Performs the full OAuth authorization code flow with PKCE and returns tokens.
+ *
+ * Steps: create client → PKCE → auth redirect → login → consent → code exchange → token
+ *
+ * Always runs to the `'token'` stage — {@link OAuthTestFlowConfig.stopAtStage} is ignored here, since
+ * this function's result guarantees tokens. Use {@link performOAuthFlow} to stop earlier.
+ *
+ * @param input - Bag of services and overrides needed to drive the flow end-to-end.
+ * @param input.server - HTTP server returned by `nestApp.getHttpServer()` against which all supertest requests are issued.
+ * @param input.oidcClientService - Service used to create the OAuth client whose credentials drive the flow.
+ * @param input.nestApp - Initialized NestJS application; used to resolve {@link OidcAccountService} for project-id-derived ID tokens and default scopes.
+ * @param input.uid - Firebase user ID for whom the test ID token is minted and the OAuth flow is authorized.
+ * @param input.config - Optional flow overrides (scopes, redirect URI, client name, token endpoint auth method, provider profiles).
+ * @returns The exchanged access token and ID token from the OIDC `/token` endpoint, plus the flow's intermediates.
+ * @throws {Error} When the token exchange step fails (the response body and status are included in the message).
+ */ function performFullOAuthFlow(input) {
+    return _async_to_generator$1(function() {
+        var result;
+        return _ts_generator$1(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        performOAuthFlow(_object_spread_props(_object_spread({}, input), {
+                            config: _object_spread_props(_object_spread({}, input.config), {
+                                stopAtStage: 'token'
+                            })
+                        }))
+                    ];
+                case 1:
+                    result = _state.sent();
+                    return [
+                        2,
+                        result
+                    ];
+            }
+        });
+    })();
+}
 /**
  * Higher-level helper that resolves OIDC services from the NestJS DI container,
- * rotates JWKS keys, and then performs the full OAuth flow.
+ * rotates JWKS keys, and then performs the OAuth flow up to {@link OAuthTestFlowConfig.stopAtStage}.
  *
  * This avoids callers needing to import from `@dereekb/firebase-server/oidc` directly.
  *
  * @param nestApp - Initialized NestJS application from which {@link JwksService} and {@link OidcClientService} are resolved.
- * @param uid - Firebase user ID for whom the OAuth flow is authorized.
- * @param config - Optional flow overrides (scopes, redirect URI, client name, token endpoint auth method, provider profiles).
- * @returns The exchanged access token and ID token from {@link performFullOAuthFlow}.
- */ function setupAndPerformFullOAuthFlow(nestApp, uid, config) {
+ * @param uid - Firebase user ID for whom the OAuth flow is authorized; only omittable for the `'auth'` stage.
+ * @param config - Optional flow overrides (scopes, redirect URI, client name, token endpoint auth method, provider profiles, stop stage).
+ * @returns The result of {@link performOAuthFlow}.
+ */ function setupAndPerformOAuthFlow(nestApp, uid, config) {
     return _async_to_generator$1(function() {
         var jwksService, oidcClientService, server;
         return _ts_generator$1(this, function(_state) {
@@ -5023,7 +5170,7 @@ function _unsupported_iterable_to_array(o, minLen) {
                     server = nestApp.getHttpServer();
                     return [
                         2,
-                        performFullOAuthFlow({
+                        performOAuthFlow({
                             server: server,
                             oidcClientService: oidcClientService,
                             nestApp: nestApp,
@@ -5035,6 +5182,38 @@ function _unsupported_iterable_to_array(o, minLen) {
         });
     })();
 }
+/**
+ * Higher-level helper that resolves OIDC services from the NestJS DI container,
+ * rotates JWKS keys, and then performs the full OAuth flow.
+ *
+ * This avoids callers needing to import from `@dereekb/firebase-server/oidc` directly.
+ *
+ * @param nestApp - Initialized NestJS application from which {@link JwksService} and {@link OidcClientService} are resolved.
+ * @param uid - Firebase user ID for whom the OAuth flow is authorized.
+ * @param config - Optional flow overrides (scopes, redirect URI, client name, token endpoint auth method, provider profiles).
+ * @returns The exchanged access token and ID token from {@link performFullOAuthFlow}.
+ */ function setupAndPerformFullOAuthFlow(nestApp, uid, config) {
+    return _async_to_generator$1(function() {
+        var result;
+        return _ts_generator$1(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        setupAndPerformOAuthFlow(nestApp, uid, _object_spread_props(_object_spread({}, config), {
+                            stopAtStage: 'token'
+                        }))
+                    ];
+                case 1:
+                    result = _state.sent();
+                    return [
+                        2,
+                        result
+                    ];
+            }
+        });
+    })();
+}
 
 function _assert_this_initialized(self) {
     if (self === void 0) throw new ReferenceError("this hasn't been initialised - super() hasn't been called");
@@ -5425,7 +5604,9 @@ function _type_of(obj) {
         "makeFixture",
         "makeInstance"
     ]);
-    var flowConfig = flowConfigOverrides.scopes || flowConfigOverrides.redirectUri || flowConfigOverrides.clientName || flowConfigOverrides.providerProfiles ? flowConfigOverrides : undefined;
+    var flowConfig = Object.values(flowConfigOverrides).some(function(value) {
+        return value != null;
+    }) ? flowConfigOverrides : undefined;
     return function(params, buildTests) {
         var f = params.f, u = params.u;
         describe('(oauth)', function() {
@@ -5484,4 +5665,4 @@ function _type_of(obj) {
  * Uses @google-cloud/storage
  */ var dbxComponentsAdminTestWithMockItemStorage = testWithMockItemStorageFixture()(adminFirebaseStorageFactory);
 
-export { AUTHORIZED_USER_RANDOM_EMAIL_FACTORY, AUTHORIZED_USER_RANDOM_PHONE_NUMBER_FACTORY, AbstractFirebaseAdminTestContextInstanceChild, AuthorizedUserTestContextFixture, AuthorizedUserTestContextInstance, CallableRequestTestMultipleFixtureSuffix, DEFAULT_FIREBASE_ADMIN_FUNCTION_TEST_USE_FUNCTION_SINGLETON_CONTEXT, ExpectedHttpErrorWithSpecificServerErrorCode, FIREBASE_ADMIN_NEST_TEST_SERVER_INSTANCE_CONFIG_TOKEN, FirebaseAdminFunctionNestRootModule, FirebaseAdminFunctionNestTestContextFixture, FirebaseAdminFunctionNestTestContextInstance, FirebaseAdminFunctionTestContextFixture, FirebaseAdminFunctionTestContextInstance, FirebaseAdminNestTestContextFixture, FirebaseAdminNestTestContextInstance, FirebaseAdminTestContextFixture, FirebaseAdminTestContextInstance, GoogleCloudTestFirebaseStorageContextFixture, GoogleCloudTestFirebaseStorageInstance, GoogleCloudTestFirestoreContextFixture, GoogleCloudTestFirestoreInstance, ModelTestContextFixture, ModelTestContextInstance, OAuthAuthorizedSuperTestFixture, OAuthAuthorizedSuperTestInstance, adminFirebaseStorageFactory, adminFirestoreFactory, applyFirebaseGCloudTestProjectIdToFirebaseConfigEnv, authorizedUserContext, authorizedUserContextFactory, callableRequestTest, cloudFunctionTest, createEncodedTestFirestoreTokenForUserRecord, createTestFirestoreTokenForUserRecord, createTestFunctionContextAuthData, createTestFunctionContextOptions, dbxComponentsAdminTestWithMockItemCollection, dbxComponentsAdminTestWithMockItemStorage, decodeEncodedCreateCustomTokenResult, describeCallableRequestTest, describeCloudFunctionTest, describeFirestoreTest, expectFailAssertHttpErrorServerErrorCode, firebaseAdminFirestoreContextFixture, firebaseAdminFirestoreContextWithFixture, firebaseAdminFunctionNestContextFactory, firebaseAdminFunctionNestContextFixture, firebaseAdminFunctionNestContextWithFixture, firebaseAdminFunctionTestBuilder, firebaseAdminFunctionTestContextFactory, firebaseAdminNestContextFactory, firebaseAdminNestContextFixture, firebaseAdminNestContextWithFixture, firebaseAdminTestBuilder, firebaseAdminTestContextFactory, generateNewProjectId, getGCloudProjectId, getGCloudTestProjectId, googleCloudTestFirebaseStorageBuilder, googleCloudTestFirestoreBuilder, initFirebaseAdminTestEnvironment, initFirebaseServerAdminTestEnvironment, isAdminEnvironmentInitialized, isCallableRequestTestSingleConfig, isCloudFunctionTestSingleConfig, makeGoogleFirebaseStorageContext, makeGoogleFirestoreContext, modelTestContextFactory, oAuthAuthorizedSuperTestContextFactory, performFullOAuthFlow, rerollFirebaseAdminFunctionTestSingleton, rollNewGCloudProjectEnvironmentVariable, setDefaultFirebaseAdminFunctionTestUseFunctionSingleton, setupAndPerformFullOAuthFlow, setupFirebaseAdminFunctionTestSingleton, testFirestoreClaimsFromUserRecord, testUidFactory, wrapCallableRequestForNestTestsGetter, wrapCloudFunctionForNestTestsGetter };
+export { AUTHORIZED_USER_RANDOM_EMAIL_FACTORY, AUTHORIZED_USER_RANDOM_PHONE_NUMBER_FACTORY, AbstractFirebaseAdminTestContextInstanceChild, AuthorizedUserTestContextFixture, AuthorizedUserTestContextInstance, CallableRequestTestMultipleFixtureSuffix, DEFAULT_FIREBASE_ADMIN_FUNCTION_TEST_USE_FUNCTION_SINGLETON_CONTEXT, ExpectedHttpErrorWithSpecificServerErrorCode, FIREBASE_ADMIN_NEST_TEST_SERVER_INSTANCE_CONFIG_TOKEN, FirebaseAdminFunctionNestRootModule, FirebaseAdminFunctionNestTestContextFixture, FirebaseAdminFunctionNestTestContextInstance, FirebaseAdminFunctionTestContextFixture, FirebaseAdminFunctionTestContextInstance, FirebaseAdminNestTestContextFixture, FirebaseAdminNestTestContextInstance, FirebaseAdminTestContextFixture, FirebaseAdminTestContextInstance, GoogleCloudTestFirebaseStorageContextFixture, GoogleCloudTestFirebaseStorageInstance, GoogleCloudTestFirestoreContextFixture, GoogleCloudTestFirestoreInstance, ModelTestContextFixture, ModelTestContextInstance, OAuthAuthorizedSuperTestFixture, OAuthAuthorizedSuperTestInstance, adminFirebaseStorageFactory, adminFirestoreFactory, applyFirebaseGCloudTestProjectIdToFirebaseConfigEnv, authorizedUserContext, authorizedUserContextFactory, callableRequestTest, cloudFunctionTest, createEncodedTestFirestoreTokenForUserRecord, createTestFirestoreTokenForUserRecord, createTestFunctionContextAuthData, createTestFunctionContextOptions, dbxComponentsAdminTestWithMockItemCollection, dbxComponentsAdminTestWithMockItemStorage, decodeEncodedCreateCustomTokenResult, describeCallableRequestTest, describeCloudFunctionTest, describeFirestoreTest, expectFailAssertHttpErrorServerErrorCode, firebaseAdminFirestoreContextFixture, firebaseAdminFirestoreContextWithFixture, firebaseAdminFunctionNestContextFactory, firebaseAdminFunctionNestContextFixture, firebaseAdminFunctionNestContextWithFixture, firebaseAdminFunctionTestBuilder, firebaseAdminFunctionTestContextFactory, firebaseAdminNestContextFactory, firebaseAdminNestContextFixture, firebaseAdminNestContextWithFixture, firebaseAdminTestBuilder, firebaseAdminTestContextFactory, generateNewProjectId, getGCloudProjectId, getGCloudTestProjectId, googleCloudTestFirebaseStorageBuilder, googleCloudTestFirestoreBuilder, initFirebaseAdminTestEnvironment, initFirebaseServerAdminTestEnvironment, isAdminEnvironmentInitialized, isCallableRequestTestSingleConfig, isCloudFunctionTestSingleConfig, makeGoogleFirebaseStorageContext, makeGoogleFirestoreContext, modelTestContextFactory, oAuthAuthorizedSuperTestContextFactory, performFullOAuthFlow, performOAuthFlow, rerollFirebaseAdminFunctionTestSingleton, rollNewGCloudProjectEnvironmentVariable, setDefaultFirebaseAdminFunctionTestUseFunctionSingleton, setupAndPerformFullOAuthFlow, setupAndPerformOAuthFlow, setupFirebaseAdminFunctionTestSingleton, testFirestoreClaimsFromUserRecord, testUidFactory, wrapCallableRequestForNestTestsGetter, wrapCloudFunctionForNestTestsGetter };

package/test/package.json

@@ -1,18 +1,19 @@
 {
   "name": "@dereekb/firebase-server/test",
-  "version": "14.2.0",
+  "version": "14.4.0",
   "sideEffects": false,
   "type": "module",
   "peerDependencies": {
-    "@dereekb/analytics": "14.2.0",
-    "@dereekb/date": "14.2.0",
-    "@dereekb/firebase": "14.2.0",
-    "@dereekb/firebase-server": "14.2.0",
-    "@dereekb/firebase-server/oidc": "14.2.0",
-    "@dereekb/model": "14.2.0",
-    "@dereekb/nestjs": "14.2.0",
-    "@dereekb/rxjs": "14.2.0",
-    "@dereekb/util": "14.2.0",
+    "@dereekb/analytics": "14.4.0",
+    "@dereekb/date": "14.4.0",
+    "@dereekb/firebase": "14.4.0",
+    "@dereekb/firebase-server": "14.4.0",
+    "@dereekb/firebase-server/oidc": "14.4.0",
+    "@dereekb/model": "14.4.0",
+    "@dereekb/nestjs": "14.4.0",
+    "@dereekb/oauth-resource": "14.4.0",
+    "@dereekb/rxjs": "14.4.0",
+    "@dereekb/util": "14.4.0",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.22.0",
     "@nestjs/common": "^12.0.1",
@@ -25,7 +26,7 @@
     "supertest": "^7.2.2"
   },
   "devDependencies": {
-    "@dereekb/nestjs": "14.2.0"
+    "@dereekb/nestjs": "14.4.0"
   },
   "exports": {
     "./package.json": "./package.json",