@dereekb/firebase 13.28.0 → 13.30.0

package/eslint/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase/eslint",
-  "version": "13.28.0",
+  "version": "13.30.0",
   "peerDependencies": {
-    "@dereekb/util": "13.28.0",
+    "@dereekb/util": "13.30.0",
     "@marcbachmann/cel-js": "^7.6.1",
     "@typescript-eslint/parser": "8.59.3",
     "@typescript-eslint/utils": "8.59.3",
     "typescript": "5.9.3"
   },
   "devDependencies": {
-    "@dereekb/firebase": "13.28.0",
+    "@dereekb/firebase": "13.30.0",
     "eslint": "10.4.0",
     "firebase": "^12.12.1"
   },

package/index.cjs.js

@@ -11904,6 +11904,180 @@ function _class_call_check$c(instance, Constructor) {
  * `model.*` scope for a callModel CRUD operation.
  */ var CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE = 'CALL_MODEL_MISSING_OIDC_SCOPE';
 
+/**
+ * The `client_secret_basic` confidential-client auth method (RFC 6749 §2.3.1, the
+ * OAuth 2.0 default): the client sends its `client_id` and `client_secret` in the
+ * `Authorization: Basic` header on token-endpoint requests. Standard pick for
+ * server-side confidential clients.
+ *
+ * @example
+ * ```ts
+ * await oidcClientService.createClient({
+ *   token_endpoint_auth_method: CLIENT_SECRET_BASIC_TOKEN_ENDPOINT_AUTH_METHOD,
+ *   // ...
+ * });
+ * ```
+ */ var CLIENT_SECRET_BASIC_TOKEN_ENDPOINT_AUTH_METHOD = 'client_secret_basic';
+/**
+ * The `client_secret_post` confidential-client auth method (RFC 6749 §2.3.1, the
+ * form-body variant): the client sends `client_id` and `client_secret` as form-encoded
+ * parameters in the token-endpoint request body. Equivalent in security to
+ * {@link CLIENT_SECRET_BASIC_TOKEN_ENDPOINT_AUTH_METHOD}; pick it for clients that
+ * cannot set the `Authorization` header (some older HTTP stacks).
+ *
+ * @example
+ * ```ts
+ * await oidcClientService.createClient({
+ *   token_endpoint_auth_method: CLIENT_SECRET_POST_TOKEN_ENDPOINT_AUTH_METHOD,
+ *   // ...
+ * });
+ * ```
+ */ var CLIENT_SECRET_POST_TOKEN_ENDPOINT_AUTH_METHOD = 'client_secret_post';
+/**
+ * The `client_secret_jwt` confidential-client auth method (OIDC Core §9): the client
+ * signs a JWT client assertion using its `client_secret` as the HMAC key (HS256/HS384/HS512)
+ * and sends it as `client_assertion` on token-endpoint requests. The secret never goes on
+ * the wire — only the signed assertion — which is the upgrade over the plain
+ * `client_secret_*` methods, without requiring asymmetric keys like
+ * {@link PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD}.
+ *
+ * @example
+ * ```ts
+ * await oidcClientService.createClient({
+ *   token_endpoint_auth_method: CLIENT_SECRET_JWT_TOKEN_ENDPOINT_AUTH_METHOD,
+ *   // ...
+ * });
+ * ```
+ */ var CLIENT_SECRET_JWT_TOKEN_ENDPOINT_AUTH_METHOD = 'client_secret_jwt';
+/**
+ * The `private_key_jwt` confidential-client auth method (OIDC Core §9): the client signs
+ * a JWT client assertion with its private key (RS256/ES256/PS256) and sends it as
+ * `client_assertion`; the server verifies via the client's published `jwks` / `jwks_uri`.
+ * Strongest of the confidential-client methods — no shared secret is ever held by the
+ * server — and the canonical pick for high-trust server-to-server integrations.
+ *
+ * @example
+ * ```ts
+ * await oidcClientService.createClient({
+ *   token_endpoint_auth_method: PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD,
+ *   jwks: { keys: [publicJwk] },
+ *   // ...
+ * });
+ * ```
+ */ var PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD = 'private_key_jwt';
+/**
+ * The public-client auth method (`'none'`): no client secret, PKCE-only. The client
+ * authenticates the `authorization_code` flow with PKCE (RFC 7636) alone — there is no
+ * shared secret and no client assertion. Canonical pick for clients that cannot keep a
+ * secret (native apps, SPAs, CLIs) and what the MCP / Claude connector ecosystem
+ * (claude.ai connector, Claude Code CLI, mcp-inspector via DCR) registers as.
+ *
+ * Mirrors {@link PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD}. `oidc-provider` still
+ * enforces PKCE on the `authorization_code` flow for every client regardless of auth
+ * method, so `'none'` simply unlocks the secret-less variant rather than disabling any
+ * client authentication.
+ *
+ * @example
+ * ```ts
+ * await oidcClientService.createClient({
+ *   token_endpoint_auth_method: PUBLIC_PKCE_TOKEN_ENDPOINT_AUTH_METHOD,
+ *   // no client_secret — public PKCE client
+ *   // ...
+ * });
+ * ```
+ */ var PUBLIC_PKCE_TOKEN_ENDPOINT_AUTH_METHOD = 'none';
+/**
+ * All available token endpoint auth method options with display labels.
+ */ var ALL_OIDC_TOKEN_ENDPOINT_AUTH_METHOD_OPTIONS = [
+    {
+        label: 'Client Secret Basic',
+        value: CLIENT_SECRET_BASIC_TOKEN_ENDPOINT_AUTH_METHOD
+    },
+    {
+        label: 'Client Secret Post',
+        value: CLIENT_SECRET_POST_TOKEN_ENDPOINT_AUTH_METHOD
+    },
+    {
+        label: 'Client Secret JWT',
+        value: CLIENT_SECRET_JWT_TOKEN_ENDPOINT_AUTH_METHOD
+    },
+    {
+        label: 'Private Key JWT',
+        value: PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD
+    },
+    {
+        label: 'None (Public PKCE)',
+        value: PUBLIC_PKCE_TOKEN_ENDPOINT_AUTH_METHOD
+    }
+];
+/**
+ * All available OIDC token endpoint auth methods for the demo app, suitable for use in auth method picker fields.
+ */ var ALL_OIDC_TOKEN_ENDPOINT_AUTH_METHODS = ALL_OIDC_TOKEN_ENDPOINT_AUTH_METHOD_OPTIONS.map(function(x) {
+    return x.value;
+});
+
+// MARK: Utility
+/**
+ * Filters the provider-profile registry to the profiles matching the given assigned keys.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @param keys - The profile keys assigned to a client (e.g. `OidcEntry` `dbx_provider_profiles`).
+ * @returns The registry profiles whose key is in `keys`.
+ */ function oidcProviderProfilesForKeys(profiles, keys) {
+    var keySet = new Set(keys !== null && keys !== void 0 ? keys : []);
+    return profiles.filter(function(profile) {
+        return keySet.has(profile.key);
+    });
+}
+/**
+ * Collects every scope referenced by the given profiles.
+ *
+ * Passed the full registry, this is the set of "profile-gated" scopes — scopes a client may only
+ * obtain via a profile. Passed a client's assigned profiles, this is the set of scopes those
+ * profiles unlock for that client.
+ *
+ * @param profiles - The profiles to collect scopes from.
+ * @returns The union of every profile's scopes.
+ */ function scopesForOidcProviderProfiles(profiles) {
+    var result = new Set();
+    profiles.forEach(function(profile) {
+        return profile.scopes.forEach(function(scopeConfig) {
+            return result.add(scopeConfig.scope);
+        });
+    });
+    return result;
+}
+/**
+ * Collects the scopes marked `require: 'required'` across the given profiles.
+ *
+ * @param profiles - The profiles to collect required scopes from (typically a client's assigned profiles).
+ * @returns The union of every profile's `required` scopes.
+ */ function requiredScopesForOidcProviderProfiles(profiles) {
+    var result = new Set();
+    profiles.forEach(function(profile) {
+        return profile.scopes.forEach(function(scopeConfig) {
+            if (scopeConfig.require === 'required') {
+                result.add(scopeConfig.scope);
+            }
+        });
+    });
+    return result;
+}
+/**
+ * Builds picker entries for the given provider profiles, suitable for an admin profile-selection field.
+ *
+ * @param profiles - The provider-profile registry.
+ * @returns One {@link OidcProviderProfileDetails} per profile.
+ */ function oidcProviderProfileDetails(profiles) {
+    return profiles.map(function(profile) {
+        return {
+            value: profile.key,
+            label: profile.label,
+            description: profile.description
+        };
+    });
+}
+
 /**
  * Prefix shared by every callModel OIDC scope (e.g., `model.create`).
  *
@@ -12074,6 +12248,100 @@ var OFFLINE_ACCESS_OIDC_SCOPE_DETAILS = {
     value: SERVICE_TOKEN_OIDC_SCOPE,
     description: 'Admin-only: issue a long-lived, non-rotating token for server/API use'
 };
+/**
+ * Parses a raw OIDC `scope` claim (a space-delimited string) into the granted scope set consumed by
+ * {@link oidcScopeTermSatisfied} / {@link oidcScopeTermsSatisfied}.
+ *
+ * The single source of truth for scope-string parsing, shared by the server-side `getOidcScopesFromRequest`
+ * (which reads `request.auth.token.scope`) and the model-api-layer enforcement (which reads the OIDC-validated
+ * token off the request auth). Returns `undefined` when the claim is not a string — i.e. the caller is not
+ * OIDC-authenticated (a regular Firebase ID token carries no `scope` claim) — so callers can distinguish
+ * "no OIDC scopes to enforce against" (bypass) from "OIDC caller that was granted zero scopes" (empty set).
+ *
+ * @param scope - The raw `scope` claim value, typically a space-delimited string.
+ * @returns A `Set` of the granted scopes, or `undefined` when `scope` is not a string.
+ */ function oidcScopesFromScopeClaim(scope) {
+    var result = typeof scope === 'string' ? new Set(scope.split(' ').filter(function(value) {
+        return value.length > 0;
+    })) : undefined;
+    return result;
+}
+/**
+ * Returns whether a single {@link OidcScopeTerm} is satisfied by the granted scope set.
+ *
+ * A string term requires that exact scope; an array term is an OR-group satisfied by ANY member (an
+ * empty group is vacuously satisfied — no requirement).
+ *
+ * @param term - The scope term to test.
+ * @param grantedScopes - The scopes the caller holds.
+ * @returns `true` when the caller satisfies the term.
+ */ function oidcScopeTermSatisfied(term, grantedScopes) {
+    return typeof term === 'string' ? grantedScopes.has(term) : term.length === 0 || term.some(function(scope) {
+        return grantedScopes.has(scope);
+    });
+}
+/**
+ * Returns whether EVERY {@link OidcScopeTerm} is satisfied by the granted scope set (AND-of-ORs).
+ *
+ * The single source of truth shared by the server-side callModel scope enforcement
+ * (`assertModelApiOidcScope`) and the MCP tool-visibility filter, so enforcement and tool-list
+ * visibility never drift. An empty term list is vacuously satisfied.
+ *
+ * @param terms - The AND-ed scope terms; each is a single scope or an OR-group.
+ * @param grantedScopes - The scopes the caller holds.
+ * @returns `true` when the caller satisfies every term.
+ */ function oidcScopeTermsSatisfied(terms, grantedScopes) {
+    return terms.every(function(term) {
+        return oidcScopeTermSatisfied(term, grantedScopes);
+    });
+}
+/**
+ * Resolves the effective {@link OidcScopeTerm} an {@link OidcModelScopeRequirement} imposes for a
+ * given call verb.
+ *
+ * A single-term requirement applies to every verb; a verb-keyed requirement returns the matching
+ * verb entry, falling back to its `default`. Returns `undefined` when the requirement imposes no
+ * term for the verb.
+ *
+ * @param requirement - The per-model requirement.
+ * @param call - The call verb being resolved.
+ * @returns The effective term for the verb, or `undefined`.
+ */ function resolveOidcModelScopeRequirement(requirement, call) {
+    var _verbMap_call;
+    var isTerm = typeof requirement === 'string' || Array.isArray(requirement);
+    var verbMap = requirement;
+    return isTerm ? requirement : (_verbMap_call = verbMap[call]) !== null && _verbMap_call !== void 0 ? _verbMap_call : verbMap.default;
+}
+/**
+ * Resolves the full AND-ed list of {@link OidcScopeTerm}s enforced for one callModel op — the single
+ * composition rule shared by the server model-api scope gate and the MCP visibility filter (no drift).
+ *
+ * The list is the per-verb scope AND the effective GROUP term, where the group term is resolved by
+ * precedence: per-function `requiredScope` (finest) > model-level requirement (verb-resolved; covers
+ * plain reads) > configured default. Nullish and empty-OR-group terms are dropped, so an op with no
+ * requirement yields an empty list (no scope gate — the caller can skip reading scopes). With no
+ * config supplied and no per-function scope, the list is exactly `[perVerbScope]` (or empty), matching
+ * the pre-grouping behavior.
+ *
+ * @param input - The per-verb scope, per-function scope, model requirement, verb, and default.
+ * @returns The AND-ed scope terms to enforce (possibly empty).
+ */ function resolveEffectiveOidcScopeTerms(input) {
+    var _ref;
+    var perVerbScope = input.perVerbScope, requiredScope = input.requiredScope, modelRequirement = input.modelRequirement, call = input.call, defaultRequiredScope = input.defaultRequiredScope;
+    var modelTerm = modelRequirement == null ? undefined : resolveOidcModelScopeRequirement(modelRequirement, call);
+    var effectiveGroupTerm = (_ref = requiredScope !== null && requiredScope !== void 0 ? requiredScope : modelTerm) !== null && _ref !== void 0 ? _ref : defaultRequiredScope;
+    var result = [];
+    for(var _i = 0, _iter = [
+        perVerbScope,
+        effectiveGroupTerm
+    ]; _i < _iter.length; _i++){
+        var term = _iter[_i];
+        if (term != null && !(Array.isArray(term) && term.length === 0)) {
+            result.push(term);
+        }
+    }
+    return result;
+}
 
 function _array_like_to_array$6(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
@@ -18822,7 +19090,8 @@ var updateOidcClientFieldParamsType = /* @__PURE__ */ arktype.type({
     redirect_uris: 'string[]',
     'logo_uri?': model.clearable('string'),
     'client_uri?': model.clearable('string'),
-    'dbx_max_session_ttl?': model.clearable('number')
+    'dbx_max_session_ttl?': model.clearable('number'),
+    'dbx_provider_profiles?': model.clearable('string[]')
 });
 var createOidcClientFieldParamsType = updateOidcClientFieldParamsType.merge(arktype.type({
     token_endpoint_auth_method: "'client_secret_basic' | 'client_secret_post' | 'client_secret_jwt' | 'private_key_jwt' | 'none'"
@@ -18857,118 +19126,6 @@ var OIDC_MODEL_CRUD_FUNCTIONS_CONFIG = {
  * ```
  */ var oidcModelFunctionMap = callModelFirebaseFunctionMapFactory(OIDC_FUNCTION_TYPE_CONFIG_MAP, OIDC_MODEL_CRUD_FUNCTIONS_CONFIG);
 
-/**
- * The `client_secret_basic` confidential-client auth method (RFC 6749 §2.3.1, the
- * OAuth 2.0 default): the client sends its `client_id` and `client_secret` in the
- * `Authorization: Basic` header on token-endpoint requests. Standard pick for
- * server-side confidential clients.
- *
- * @example
- * ```ts
- * await oidcClientService.createClient({
- *   token_endpoint_auth_method: CLIENT_SECRET_BASIC_TOKEN_ENDPOINT_AUTH_METHOD,
- *   // ...
- * });
- * ```
- */ var CLIENT_SECRET_BASIC_TOKEN_ENDPOINT_AUTH_METHOD = 'client_secret_basic';
-/**
- * The `client_secret_post` confidential-client auth method (RFC 6749 §2.3.1, the
- * form-body variant): the client sends `client_id` and `client_secret` as form-encoded
- * parameters in the token-endpoint request body. Equivalent in security to
- * {@link CLIENT_SECRET_BASIC_TOKEN_ENDPOINT_AUTH_METHOD}; pick it for clients that
- * cannot set the `Authorization` header (some older HTTP stacks).
- *
- * @example
- * ```ts
- * await oidcClientService.createClient({
- *   token_endpoint_auth_method: CLIENT_SECRET_POST_TOKEN_ENDPOINT_AUTH_METHOD,
- *   // ...
- * });
- * ```
- */ var CLIENT_SECRET_POST_TOKEN_ENDPOINT_AUTH_METHOD = 'client_secret_post';
-/**
- * The `client_secret_jwt` confidential-client auth method (OIDC Core §9): the client
- * signs a JWT client assertion using its `client_secret` as the HMAC key (HS256/HS384/HS512)
- * and sends it as `client_assertion` on token-endpoint requests. The secret never goes on
- * the wire — only the signed assertion — which is the upgrade over the plain
- * `client_secret_*` methods, without requiring asymmetric keys like
- * {@link PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD}.
- *
- * @example
- * ```ts
- * await oidcClientService.createClient({
- *   token_endpoint_auth_method: CLIENT_SECRET_JWT_TOKEN_ENDPOINT_AUTH_METHOD,
- *   // ...
- * });
- * ```
- */ var CLIENT_SECRET_JWT_TOKEN_ENDPOINT_AUTH_METHOD = 'client_secret_jwt';
-/**
- * The `private_key_jwt` confidential-client auth method (OIDC Core §9): the client signs
- * a JWT client assertion with its private key (RS256/ES256/PS256) and sends it as
- * `client_assertion`; the server verifies via the client's published `jwks` / `jwks_uri`.
- * Strongest of the confidential-client methods — no shared secret is ever held by the
- * server — and the canonical pick for high-trust server-to-server integrations.
- *
- * @example
- * ```ts
- * await oidcClientService.createClient({
- *   token_endpoint_auth_method: PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD,
- *   jwks: { keys: [publicJwk] },
- *   // ...
- * });
- * ```
- */ var PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD = 'private_key_jwt';
-/**
- * The public-client auth method (`'none'`): no client secret, PKCE-only. The client
- * authenticates the `authorization_code` flow with PKCE (RFC 7636) alone — there is no
- * shared secret and no client assertion. Canonical pick for clients that cannot keep a
- * secret (native apps, SPAs, CLIs) and what the MCP / Claude connector ecosystem
- * (claude.ai connector, Claude Code CLI, mcp-inspector via DCR) registers as.
- *
- * Mirrors {@link PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD}. `oidc-provider` still
- * enforces PKCE on the `authorization_code` flow for every client regardless of auth
- * method, so `'none'` simply unlocks the secret-less variant rather than disabling any
- * client authentication.
- *
- * @example
- * ```ts
- * await oidcClientService.createClient({
- *   token_endpoint_auth_method: PUBLIC_PKCE_TOKEN_ENDPOINT_AUTH_METHOD,
- *   // no client_secret — public PKCE client
- *   // ...
- * });
- * ```
- */ var PUBLIC_PKCE_TOKEN_ENDPOINT_AUTH_METHOD = 'none';
-/**
- * All available token endpoint auth method options with display labels.
- */ var ALL_OIDC_TOKEN_ENDPOINT_AUTH_METHOD_OPTIONS = [
-    {
-        label: 'Client Secret Basic',
-        value: CLIENT_SECRET_BASIC_TOKEN_ENDPOINT_AUTH_METHOD
-    },
-    {
-        label: 'Client Secret Post',
-        value: CLIENT_SECRET_POST_TOKEN_ENDPOINT_AUTH_METHOD
-    },
-    {
-        label: 'Client Secret JWT',
-        value: CLIENT_SECRET_JWT_TOKEN_ENDPOINT_AUTH_METHOD
-    },
-    {
-        label: 'Private Key JWT',
-        value: PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD
-    },
-    {
-        label: 'None (Public PKCE)',
-        value: PUBLIC_PKCE_TOKEN_ENDPOINT_AUTH_METHOD
-    }
-];
-/**
- * All available OIDC token endpoint auth methods for the demo app, suitable for use in auth method picker fields.
- */ var ALL_OIDC_TOKEN_ENDPOINT_AUTH_METHODS = ALL_OIDC_TOKEN_ENDPOINT_AUTH_METHOD_OPTIONS.map(function(x) {
-    return x.value;
-});
-
 /**
  * Thrown if the target uploaded file does not exist.
  */ var UPLOADED_FILE_DOES_NOT_EXIST_ERROR_CODE = 'UPLOADED_FILE_DOES_NOT_EXIST';
@@ -22158,6 +22315,11 @@ exports.oidcEntryFirestoreCollection = oidcEntryFirestoreCollection;
 exports.oidcEntryIdentity = oidcEntryIdentity;
 exports.oidcGrantEntriesByUidQuery = oidcGrantEntriesByUidQuery;
 exports.oidcModelFunctionMap = oidcModelFunctionMap;
+exports.oidcProviderProfileDetails = oidcProviderProfileDetails;
+exports.oidcProviderProfilesForKeys = oidcProviderProfilesForKeys;
+exports.oidcScopeTermSatisfied = oidcScopeTermSatisfied;
+exports.oidcScopeTermsSatisfied = oidcScopeTermsSatisfied;
+exports.oidcScopesFromScopeClaim = oidcScopesFromScopeClaim;
 exports.onCallCreateModelParams = onCallCreateModelParams;
 exports.onCallCreateModelResult = onCallCreateModelResult;
 exports.onCallCreateModelResultWithDocs = onCallCreateModelResultWithDocs;
@@ -22194,10 +22356,14 @@ exports.readStorageFileMetadataParamsType = readStorageFileMetadataParamsType;
 exports.regenerateAllFlaggedStorageFileGroupsContentParamsType = regenerateAllFlaggedStorageFileGroupsContentParamsType;
 exports.regenerateStorageFileGroupContentParamsType = regenerateStorageFileGroupContentParamsType;
 exports.replaceConstraints = replaceConstraints;
+exports.requiredScopesForOidcProviderProfiles = requiredScopesForOidcProviderProfiles;
+exports.resolveEffectiveOidcScopeTerms = resolveEffectiveOidcScopeTerms;
+exports.resolveOidcModelScopeRequirement = resolveOidcModelScopeRequirement;
 exports.resyncAllNotificationUserParamsType = resyncAllNotificationUserParamsType;
 exports.resyncNotificationUserParamsType = targetModelParamsType;
 exports.rotateOidcClientSecretParamsType = targetModelParamsType;
 exports.scheduledFunctionDevelopmentFirebaseFunctionParamsType = scheduledFunctionDevelopmentFirebaseFunctionParamsType;
+exports.scopesForOidcProviderProfiles = scopesForOidcProviderProfiles;
 exports.selectFromFirebaseModelsService = selectFromFirebaseModelsService;
 exports.sendNotificationParamsType = sendNotificationParamsType;
 exports.sendQueuedNotificationsParamsType = sendQueuedNotificationsParamsType;