@dereekb/firebase 13.29.0 → 13.31.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/firebase",
-  "version": "13.29.0",
+  "version": "13.31.0",
   "sideEffects": false,
   "exports": {
     "./test": {
@@ -24,10 +24,10 @@
     }
   },
   "peerDependencies": {
-    "@dereekb/date": "13.29.0",
-    "@dereekb/model": "13.29.0",
-    "@dereekb/rxjs": "13.29.0",
-    "@dereekb/util": "13.29.0",
+    "@dereekb/date": "13.31.0",
+    "@dereekb/model": "13.31.0",
+    "@dereekb/rxjs": "13.31.0",
+    "@dereekb/util": "13.31.0",
     "@firebase/rules-unit-testing": "5.0.0",
     "@marcbachmann/cel-js": "^7.6.1",
     "@typescript-eslint/parser": "8.59.3",

package/src/lib/common/auth/oidc/index.d.ts

@@ -1,2 +1,5 @@
 export * from './oidc.error';
+export * from './oidc.base';
+export * from './oidc.interaction';
+export * from './oidc.profile';
 export * from './oidc';

package/src/lib/{model/oidcmodel/oidcmodel.interaction.d.ts → common/auth/oidc/oidc.base.d.ts}

@@ -43,6 +43,15 @@ export type OidcScopeDetails<T extends OidcScope = OidcScope> = LabeledValueWith
  * @semanticTopic dereekb-firebase:oidc
  */
 export type OidcRedirectUri = string;
+/**
+ * Unique client identifier for an OIDC client registration.
+ *
+ * @semanticType
+ * @semanticTopic identifier
+ * @semanticTopic string
+ * @semanticTopic dereekb-firebase:oidc
+ */
+export type OidcEntryClientId = string;
 /**
  * The `client_secret_basic` confidential-client auth method (RFC 6749 §2.3.1, the
  * OAuth 2.0 default): the client sends its `client_id` and `client_secret` in the

package/src/lib/common/auth/oidc/oidc.d.ts

@@ -1,5 +1,6 @@
 import { type LabeledValueWithDescription, type Maybe } from '@dereekb/util';
 import { type KnownOnCallFunctionType, type OnCallFunctionType } from '../../model/function';
+import { type OidcScope } from './oidc.base';
 /**
  * Prefix shared by every callModel OIDC scope (e.g., `model.create`).
  *
@@ -125,3 +126,138 @@ export type ServiceTokenOidcScope = typeof SERVICE_TOKEN_OIDC_SCOPE;
  * restricted to privileged users.
  */
 export declare const SERVICE_TOKEN_OIDC_SCOPE_DETAILS: LabeledValueWithDescription<ServiceTokenOidcScope>;
+/**
+ * A single requirement TERM in the callModel OIDC scope model.
+ *
+ * A term is satisfied when the caller holds the required scope(s):
+ * - a single {@link OidcScope} — the caller must hold exactly that scope; or
+ * - a `readonly` array of {@link OidcScope}s — an OR-group the caller satisfies by holding ANY one
+ *   (an empty group imposes no requirement).
+ *
+ * Multiple terms combine with AND — see {@link oidcScopeTermsSatisfied}. The callModel gate ANDs the
+ * per-verb `model.<call>` scope with the effective GROUP term resolved for the model/handler.
+ */
+export type OidcScopeTerm = OidcScope | readonly OidcScope[];
+/**
+ * Parses a raw OIDC `scope` claim (a space-delimited string) into the granted scope set consumed by
+ * {@link oidcScopeTermSatisfied} / {@link oidcScopeTermsSatisfied}.
+ *
+ * The single source of truth for scope-string parsing, shared by the server-side `getOidcScopesFromRequest`
+ * (which reads `request.auth.token.scope`) and the model-api-layer enforcement (which reads the OIDC-validated
+ * token off the request auth). Returns `undefined` when the claim is not a string — i.e. the caller is not
+ * OIDC-authenticated (a regular Firebase ID token carries no `scope` claim) — so callers can distinguish
+ * "no OIDC scopes to enforce against" (bypass) from "OIDC caller that was granted zero scopes" (empty set).
+ *
+ * @param scope - The raw `scope` claim value, typically a space-delimited string.
+ * @returns A `Set` of the granted scopes, or `undefined` when `scope` is not a string.
+ */
+export declare function oidcScopesFromScopeClaim(scope: unknown): Maybe<Set<OidcScope>>;
+/**
+ * Verb-keyed form of {@link OidcModelScopeRequirement}: a term per {@link OnCallFunctionType}, with an
+ * optional `default` term applied to verbs without an explicit entry.
+ */
+export interface OidcModelScopeRequirementVerbMap {
+    /**
+     * Fallback term applied to any verb without an explicit entry below.
+     */
+    readonly default?: OidcScopeTerm;
+    /**
+     * Per-verb term keyed by call type (e.g. `read`, `create`, `query`). A `read` entry is the only
+     * way to require a scope on a PLAIN READ, which has no per-function handler.
+     */
+    readonly [verb: string]: OidcScopeTerm | undefined;
+}
+/**
+ * Per-model callModel scope requirement, consulted by the model-api scope gate and the MCP visibility filter.
+ *
+ * Either a single {@link OidcScopeTerm} applied to EVERY verb, or an {@link OidcModelScopeRequirementVerbMap}
+ * (verb-keyed with an optional `default`). The verb-keyed form is the only way to require a scope on
+ * a plain read — a plain read has no per-function handler to hang a `requiredScope` on, but the
+ * scope gate still resolves its verb + model type, so a `read` entry here reaches it.
+ *
+ * @example
+ * ```typescript
+ * // WorkerAcademyProgress is wholly LMS — same term for every verb:
+ * const wap: OidcModelScopeRequirement = ['hellosubs', 'lms'];
+ * // allow lms reads, require hellosubs for everything else:
+ * const worker: OidcModelScopeRequirement = { read: ['hellosubs', 'lms'], default: 'hellosubs' };
+ * ```
+ */
+export type OidcModelScopeRequirement = OidcScopeTerm | OidcModelScopeRequirementVerbMap;
+/**
+ * Returns whether a single {@link OidcScopeTerm} is satisfied by the granted scope set.
+ *
+ * A string term requires that exact scope; an array term is an OR-group satisfied by ANY member (an
+ * empty group is vacuously satisfied — no requirement).
+ *
+ * @param term - The scope term to test.
+ * @param grantedScopes - The scopes the caller holds.
+ * @returns `true` when the caller satisfies the term.
+ */
+export declare function oidcScopeTermSatisfied(term: OidcScopeTerm, grantedScopes: ReadonlySet<OidcScope>): boolean;
+/**
+ * Returns whether EVERY {@link OidcScopeTerm} is satisfied by the granted scope set (AND-of-ORs).
+ *
+ * The single source of truth shared by the server-side callModel scope enforcement
+ * (`assertModelApiOidcScope`) and the MCP tool-visibility filter, so enforcement and tool-list
+ * visibility never drift. An empty term list is vacuously satisfied.
+ *
+ * @param terms - The AND-ed scope terms; each is a single scope or an OR-group.
+ * @param grantedScopes - The scopes the caller holds.
+ * @returns `true` when the caller satisfies every term.
+ */
+export declare function oidcScopeTermsSatisfied(terms: readonly OidcScopeTerm[], grantedScopes: ReadonlySet<OidcScope>): boolean;
+/**
+ * Resolves the effective {@link OidcScopeTerm} an {@link OidcModelScopeRequirement} imposes for a
+ * given call verb.
+ *
+ * A single-term requirement applies to every verb; a verb-keyed requirement returns the matching
+ * verb entry, falling back to its `default`. Returns `undefined` when the requirement imposes no
+ * term for the verb.
+ *
+ * @param requirement - The per-model requirement.
+ * @param call - The call verb being resolved.
+ * @returns The effective term for the verb, or `undefined`.
+ */
+export declare function resolveOidcModelScopeRequirement(requirement: OidcModelScopeRequirement, call: OnCallFunctionType): Maybe<OidcScopeTerm>;
+/**
+ * Inputs to {@link resolveEffectiveOidcScopeTerms}.
+ */
+export interface ResolveEffectiveOidcScopeTermsInput {
+    /**
+     * The per-verb `model.<call>` scope, if any — kept as its own AND term.
+     */
+    readonly perVerbScope?: Maybe<OidcScopeTerm>;
+    /**
+     * The per-function `requiredScope` from `withApiDetails`, if any — the finest (highest-precedence)
+     * group term.
+     */
+    readonly requiredScope?: Maybe<OidcScopeTerm>;
+    /**
+     * The model-level requirement for the targeted model type, if configured.
+     */
+    readonly modelRequirement?: Maybe<OidcModelScopeRequirement>;
+    /**
+     * The call verb, used to resolve a verb-keyed {@link modelRequirement}.
+     */
+    readonly call: OnCallFunctionType;
+    /**
+     * The configured default group term applied when no finer term overrides it.
+     */
+    readonly defaultRequiredScope?: Maybe<OidcScopeTerm>;
+}
+/**
+ * Resolves the full AND-ed list of {@link OidcScopeTerm}s enforced for one callModel op — the single
+ * composition rule shared by the server model-api scope gate and the MCP visibility filter (no drift).
+ *
+ * The list is the per-verb scope AND the effective GROUP term, where the group term is resolved by
+ * precedence: per-function `requiredScope` (finest) > model-level requirement (verb-resolved; covers
+ * plain reads) > configured default. Nullish and empty-OR-group terms are dropped, so an op with no
+ * requirement yields an empty list (no scope gate — the caller can skip reading scopes). With no
+ * config supplied and no per-function scope, the list is exactly `[perVerbScope]` (or empty), matching
+ * the pre-grouping behavior.
+ *
+ * @param input - The per-verb scope, per-function scope, model requirement, verb, and default.
+ * @returns The AND-ed scope terms to enforce (possibly empty).
+ */
+export declare function resolveEffectiveOidcScopeTerms(input: ResolveEffectiveOidcScopeTermsInput): OidcScopeTerm[];

package/src/lib/{model/oidcmodel/oidcmodel.interaction.oauth.d.ts → common/auth/oidc/oidc.interaction.d.ts}

@@ -1,7 +1,6 @@
 import { type Maybe, type SpaceSeparatedString, type WebsiteUrlWithPrefix } from '@dereekb/util';
-import { type FirebaseAuthIdToken } from '../../common/auth/auth';
-import { type OidcEntryClientId } from './oidcmodel.id';
-import { type OidcScope } from './oidcmodel.interaction';
+import { type FirebaseAuthIdToken } from '../auth';
+import { type OidcEntryClientId, type OidcScope } from './oidc.base';
 /**
  * Request body sent by the frontend to complete a login interaction.
  *

package/src/lib/common/auth/oidc/oidc.profile.d.ts

@@ -0,0 +1,213 @@
+import { type LabeledValueWithDescription } from '@dereekb/util';
+import { type OidcScope } from './oidc.base';
+/**
+ * Arbitrary key identifying an {@link OidcProviderProfile} (e.g. `'lms'`).
+ *
+ * @semanticType
+ * @semanticTopic string
+ * @semanticTopic dereekb-firebase:oidc
+ */
+export type OidcProviderProfileKey = string;
+/**
+ * How a scope unlocked by an {@link OidcProviderProfile} is enforced for a client
+ * carrying that profile.
+ *
+ * - `none`: the scope is merely unlocked/allowed — the client may request it, but it stays optional.
+ * - `required`: the scope is force-required — it is surfaced as a required (non-deselectable) scope
+ *   at consent and the interaction is rejected if it is not granted.
+ */
+export type OidcProviderProfileScopeRequireMode = 'none' | 'required';
+/**
+ * A single scope entry within an {@link OidcProviderProfile}.
+ */
+export interface OidcProviderProfileScopeConfig<S extends OidcScope = OidcScope> {
+    /**
+     * The scope this profile unlocks. It should be a scope that is otherwise restricted (not offered
+     * in the general scope picker) so that only clients carrying this profile can request it.
+     */
+    readonly scope: S;
+    /**
+     * How the scope is enforced. Defaults to `none` (unlock only, optional) when omitted.
+     */
+    readonly require?: OidcProviderProfileScopeRequireMode;
+}
+/**
+ * A named, admin-assignable preset that unlocks (and optionally force-requires) scopes for the OIDC
+ * clients it is assigned to.
+ *
+ * Provider profiles are declared statically in code (an exported registry) and supplied to the
+ * provider via {@link OidcProviderConfig.providerProfiles}. An admin assigns one or more profile keys
+ * to an OIDC client (persisted as `dbx_provider_profiles` client metadata). At consent, a scope
+ * referenced by any profile is treated as restricted: a client may only obtain it when one of its
+ * assigned profiles unlocks it.
+ *
+ * @example
+ * ```ts
+ * const LMS_PROVIDER_PROFILE: OidcProviderProfile = {
+ *   key: 'lms',
+ *   label: 'LMS',
+ *   scopes: [{ scope: 'lms', require: 'required' }]
+ * };
+ * ```
+ */
+export interface OidcProviderProfile<S extends OidcScope = OidcScope> {
+    /**
+     * Unique key for the profile (e.g. `'lms'`).
+     */
+    readonly key: OidcProviderProfileKey;
+    /**
+     * Human-readable label, used in the admin profile picker.
+     */
+    readonly label: string;
+    /**
+     * Optional human-readable description, used in the admin profile picker.
+     */
+    readonly description?: string;
+    /**
+     * Whether this profile applies to a client that has NO profiles assigned (an empty or absent
+     * `dbx_provider_profiles`). Defaults to `false`.
+     *
+     * Lets an app make a coarse, broadly-available scope profile-gated — so the profile picker becomes
+     * the single control surface for scope grouping — without breaking every already-registered client.
+     * Multiple default profiles union.
+     *
+     * The fallback is exclusive: a client assigned ANY profile resolves to exactly its assigned
+     * profiles, so assigning a non-default profile does NOT additionally confer the default's scopes.
+     *
+     * Note a `require: 'required'` scope on a default profile is force-required for EVERY unassigned
+     * client — a default profile usually wants `require: 'none'`.
+     *
+     * @see oidcProviderProfilesForClient
+     */
+    readonly isDefault?: boolean;
+    /**
+     * Whether the scopes this profile unlocks may only be granted to admin users. Defaults to `false`.
+     *
+     * Equivalent to listing this profile's scopes in `OidcProviderConfig.adminOnlyScopes` — the two are
+     * unioned — but declared alongside the profile so the fact lives in one place rather than drifting
+     * between the shared registry and the server provider config.
+     *
+     * Combined with `require: 'required'`, this makes the whole client admin-only: the client always
+     * requests the scope, so a non-admin resolving its consent is always rejected with `access_denied`.
+     *
+     * Independent of {@link isDefault} and of the profile unlock gate — a scope may be subject to both
+     * gates.
+     *
+     * @see adminOnlyScopesForOidcProviderProfiles
+     */
+    readonly adminOnly?: boolean;
+    /**
+     * The scopes this profile unlocks, each with an optional require mode.
+     */
+    readonly scopes: readonly OidcProviderProfileScopeConfig<S>[];
+}
+/**
+ * Suffix appended to a default profile's description in {@link oidcProviderProfileDetails}, so an
+ * admin viewing the picker sees that leaving the field empty still grants that profile's scopes.
+ */
+export declare const OIDC_PROVIDER_PROFILE_DEFAULT_DESCRIPTION_SUFFIX = "Applied by default when no profiles are assigned.";
+/**
+ * Profile picker entry (label + key + description), mirroring {@link OidcScopeDetails}.
+ */
+export type OidcProviderProfileDetails = LabeledValueWithDescription<OidcProviderProfileKey>;
+/**
+ * Filters the provider-profile registry to the profiles matching the given assigned keys.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @param keys - The profile keys assigned to a client (e.g. `OidcEntry` `dbx_provider_profiles`).
+ * @returns The registry profiles whose key is in `keys`.
+ */
+export declare function oidcProviderProfilesForKeys<S extends OidcScope = OidcScope>(profiles: readonly OidcProviderProfile<S>[], keys: readonly OidcProviderProfileKey[] | undefined): OidcProviderProfile<S>[];
+/**
+ * Filters the provider-profile registry to the profiles marked {@link OidcProviderProfile.isDefault}.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @returns The registry profiles that apply to a client with no assigned profiles.
+ */
+export declare function defaultOidcProviderProfiles<S extends OidcScope = OidcScope>(profiles: readonly OidcProviderProfile<S>[]): OidcProviderProfile<S>[];
+/**
+ * Resolves the profiles that apply to a client: its assigned profiles, or — when it has NO profiles
+ * assigned — the registry's default profiles.
+ *
+ * The fallback is exclusive: a client with any assigned key resolves to exactly
+ * {@link oidcProviderProfilesForKeys}, so a non-default assignment never additionally confers the
+ * default profiles' scopes. A registry declaring no default behaves identically to
+ * {@link oidcProviderProfilesForKeys}.
+ *
+ * The fallback keys off the assigned key list being empty/absent rather than off the resolved set
+ * being empty, so a client whose assigned profile was later removed from the registry resolves to no
+ * profiles (fail-closed) rather than silently picking up the default.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @param keys - The profile keys assigned to the client (its `dbx_provider_profiles`).
+ * @returns The client's assigned profiles, or the default profiles when none are assigned.
+ */
+export declare function oidcProviderProfilesForClient<S extends OidcScope = OidcScope>(profiles: readonly OidcProviderProfile<S>[], keys: readonly OidcProviderProfileKey[] | undefined): OidcProviderProfile<S>[];
+/**
+ * Collects every scope referenced by the given profiles.
+ *
+ * Passed the full registry, this is the set of "profile-gated" scopes — scopes a client may only
+ * obtain via a profile. Passed a client's assigned profiles, this is the set of scopes those
+ * profiles unlock for that client.
+ *
+ * Note a gated scope is not necessarily unavailable to an unassigned client: a scope unlocked by a
+ * default profile is gated yet reachable by every client. Use
+ * {@link assignmentOnlyScopesForOidcProviderProfiles} for the "requires an explicit assignment"
+ * subset (e.g. to exclude scopes from a general picker or from advertised scope metadata).
+ *
+ * @param profiles - The profiles to collect scopes from.
+ * @returns The union of every profile's scopes.
+ */
+export declare function scopesForOidcProviderProfiles<S extends OidcScope = OidcScope>(profiles: readonly OidcProviderProfile<S>[]): Set<S>;
+/**
+ * Collects the scopes marked `require: 'required'` across the given profiles.
+ *
+ * @param profiles - The profiles to collect required scopes from (typically a client's assigned profiles).
+ * @returns The union of every profile's `required` scopes.
+ */
+export declare function requiredScopesForOidcProviderProfiles<S extends OidcScope = OidcScope>(profiles: readonly OidcProviderProfile<S>[]): Set<S>;
+/**
+ * Collects the scopes unlocked by the registry's default profiles — the scopes every client can
+ * obtain, including one with no profiles assigned.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @returns The union of every default profile's scopes. Empty when no profile is marked default.
+ */
+export declare function defaultUnlockedScopesForOidcProviderProfiles<S extends OidcScope = OidcScope>(profiles: readonly OidcProviderProfile<S>[]): Set<S>;
+/**
+ * Collects the gated scopes that are NOT unlocked by default — the scopes a client can only obtain
+ * via an explicit profile assignment.
+ *
+ * This is the set to exclude from a general scope picker or from advertised scope metadata (e.g. an
+ * MCP protected-resource document's `scopes_supported`). Prefer it over
+ * {@link scopesForOidcProviderProfiles} for that job: the full gated set would wrongly drop a
+ * default-unlocked scope that every client can in fact obtain. With no default declared the two are
+ * identical.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @returns Every profile-gated scope minus the default-unlocked ones.
+ */
+export declare function assignmentOnlyScopesForOidcProviderProfiles<S extends OidcScope = OidcScope>(profiles: readonly OidcProviderProfile<S>[]): Set<S>;
+/**
+ * Collects the scopes of every profile marked {@link OidcProviderProfile.adminOnly}.
+ *
+ * Unioned with `OidcProviderConfig.adminOnlyScopes` by the consent admin-only gate: a consent
+ * requesting one of these scopes is hard-rejected with `access_denied` when the resolving user is
+ * not an admin.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @returns The union of every admin-only profile's scopes. Empty when no profile is marked admin-only.
+ */
+export declare function adminOnlyScopesForOidcProviderProfiles<S extends OidcScope = OidcScope>(profiles: readonly OidcProviderProfile<S>[]): Set<S>;
+/**
+ * Builds picker entries for the given provider profiles, suitable for an admin profile-selection field.
+ *
+ * A default profile's description carries {@link OIDC_PROVIDER_PROFILE_DEFAULT_DESCRIPTION_SUFFIX} so
+ * an admin isn't surprised that an empty selection still grants scopes. Default profiles are
+ * deliberately not pre-selected — persisting the default as an explicit assignment would opt the
+ * client out of the fallback, so it would stop tracking the registry if the default later changed.
+ *
+ * @param profiles - The provider-profile registry.
+ * @returns One {@link OidcProviderProfileDetails} per profile.
+ */
+export declare function oidcProviderProfileDetails<S extends OidcScope = OidcScope>(profiles: readonly OidcProviderProfile<S>[]): OidcProviderProfileDetails[];

package/src/lib/model/oidcmodel/index.d.ts

@@ -4,6 +4,3 @@ export * from './oidcmodel.query';
 export * from './oidcmodel.api';
 export * from './oidcmodel.action';
 export * from './oidcmodel.data';
-export * from './oidcmodel.interaction';
-export * from './oidcmodel.interaction.oauth';
-export * from './oidc.profile';

package/src/lib/model/oidcmodel/oidcmodel.api.d.ts

@@ -1,11 +1,9 @@
 import { type Type } from 'arktype';
-import { type TargetModelParams, type OnCallCreateModelResult } from '../../common';
+import { type TargetModelParams, type OnCallCreateModelResult, type OidcEntryClientId, type OidcRedirectUri, type OidcTokenEndpointAuthMethod } from '../../common';
 import { type InferredTargetModelParams } from '../../common/model/model/model.param';
 import { type ModelFirebaseCrudFunction, type FirebaseFunctionTypeConfigMap, type ModelFirebaseCrudFunctionConfigMap, type ModelFirebaseFunctionMap, type ModelFirebaseCreateFunction, type ModelFirebaseDeleteFunction, type ModelFirebaseUpdateFunction } from '../../client';
 import { type WebsiteUrlWithPrefix, type Maybe } from '@dereekb/util';
-import { type OidcEntryClientId } from './oidcmodel.id';
 import { type OidcModelTypes } from './oidcmodel';
-import { type OidcRedirectUri, type OidcTokenEndpointAuthMethod } from './oidcmodel.interaction';
 /**
  * Fields that can be changed on an existing OIDC client.
  *
@@ -41,7 +39,7 @@ export declare const createOidcClientFieldParamsType: import("arktype/internal/v
     readonly client_uri?: Maybe<string>;
     readonly dbx_max_session_ttl?: Maybe<number>;
     readonly dbx_provider_profiles?: Maybe<string[]>;
-    token_endpoint_auth_method: "none" | "client_secret_basic" | "client_secret_post" | "client_secret_jwt" | "private_key_jwt";
+    token_endpoint_auth_method: "client_secret_basic" | "client_secret_post" | "client_secret_jwt" | "private_key_jwt" | "none";
 }, {}>;
 /**
  * Parameters for registering a new OAuth client for the target entity.

package/src/lib/model/oidcmodel/oidcmodel.data.d.ts

@@ -1,6 +1,5 @@
 import { type Maybe } from '@dereekb/util';
-import { type OidcEntryClientId } from './oidcmodel.id';
-import { type OidcRedirectUri } from './oidcmodel.interaction';
+import { type OidcEntryClientId, type OidcRedirectUri } from '../../common';
 /**
  * Corresponds with readable content from a OidcEntry's payload.
  */

package/src/lib/model/oidcmodel/oidcmodel.id.d.ts

@@ -12,12 +12,3 @@ export type OidcEntryId = FirestoreModelId;
  * Full Firestore model key path for an OidcEntry document.
  */
 export type OidcEntryKey = FirestoreModelKey;
-/**
- * Unique client identifier for an OIDC client registration.
- *
- * @semanticType
- * @semanticTopic identifier
- * @semanticTopic string
- * @semanticTopic dereekb-firebase:oidc
- */
-export type OidcEntryClientId = string;

package/test/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@dereekb/firebase/test",
-  "version": "13.29.0",
+  "version": "13.31.0",
   "peerDependencies": {
-    "@dereekb/date": "13.29.0",
-    "@dereekb/firebase": "13.29.0",
-    "@dereekb/model": "13.29.0",
-    "@dereekb/rxjs": "13.29.0",
-    "@dereekb/util": "13.29.0",
+    "@dereekb/date": "13.31.0",
+    "@dereekb/firebase": "13.31.0",
+    "@dereekb/model": "13.31.0",
+    "@dereekb/rxjs": "13.31.0",
+    "@dereekb/util": "13.31.0",
     "@firebase/rules-unit-testing": "5.0.0",
     "date-fns": "^4.1.0",
     "firebase": "^12.12.1",

package/src/lib/model/oidcmodel/oidc.profile.d.ts

@@ -1,107 +0,0 @@
-import { type LabeledValueWithDescription } from '@dereekb/util';
-import { type OidcScope } from './oidcmodel.interaction';
-/**
- * Arbitrary key identifying an {@link OidcProviderProfile} (e.g. `'lms'`).
- *
- * @semanticType
- * @semanticTopic string
- * @semanticTopic dereekb-firebase:oidc
- */
-export type OidcProviderProfileKey = string;
-/**
- * How a scope unlocked by an {@link OidcProviderProfile} is enforced for a client
- * carrying that profile.
- *
- * - `none`: the scope is merely unlocked/allowed — the client may request it, but it stays optional.
- * - `required`: the scope is force-required — it is surfaced as a required (non-deselectable) scope
- *   at consent and the interaction is rejected if it is not granted.
- */
-export type OidcProviderProfileScopeRequireMode = 'none' | 'required';
-/**
- * A single scope entry within an {@link OidcProviderProfile}.
- */
-export interface OidcProviderProfileScopeConfig<S extends OidcScope = OidcScope> {
-    /**
-     * The scope this profile unlocks. It should be a scope that is otherwise restricted (not offered
-     * in the general scope picker) so that only clients carrying this profile can request it.
-     */
-    readonly scope: S;
-    /**
-     * How the scope is enforced. Defaults to `none` (unlock only, optional) when omitted.
-     */
-    readonly require?: OidcProviderProfileScopeRequireMode;
-}
-/**
- * A named, admin-assignable preset that unlocks (and optionally force-requires) scopes for the OIDC
- * clients it is assigned to.
- *
- * Provider profiles are declared statically in code (an exported registry) and supplied to the
- * provider via {@link OidcProviderConfig.providerProfiles}. An admin assigns one or more profile keys
- * to an OIDC client (persisted as `dbx_provider_profiles` client metadata). At consent, a scope
- * referenced by any profile is treated as restricted: a client may only obtain it when one of its
- * assigned profiles unlocks it.
- *
- * @example
- * ```ts
- * const LMS_PROVIDER_PROFILE: OidcProviderProfile = {
- *   key: 'lms',
- *   label: 'LMS',
- *   scopes: [{ scope: 'lms', require: 'required' }]
- * };
- * ```
- */
-export interface OidcProviderProfile<S extends OidcScope = OidcScope> {
-    /**
-     * Unique key for the profile (e.g. `'lms'`).
-     */
-    readonly key: OidcProviderProfileKey;
-    /**
-     * Human-readable label, used in the admin profile picker.
-     */
-    readonly label: string;
-    /**
-     * Optional human-readable description, used in the admin profile picker.
-     */
-    readonly description?: string;
-    /**
-     * The scopes this profile unlocks, each with an optional require mode.
-     */
-    readonly scopes: readonly OidcProviderProfileScopeConfig<S>[];
-}
-/**
- * Profile picker entry (label + key + description), mirroring {@link OidcScopeDetails}.
- */
-export type OidcProviderProfileDetails = LabeledValueWithDescription<OidcProviderProfileKey>;
-/**
- * Filters the provider-profile registry to the profiles matching the given assigned keys.
- *
- * @param profiles - The full provider-profile registry.
- * @param keys - The profile keys assigned to a client (e.g. `OidcEntry` `dbx_provider_profiles`).
- * @returns The registry profiles whose key is in `keys`.
- */
-export declare function oidcProviderProfilesForKeys<S extends OidcScope = OidcScope>(profiles: readonly OidcProviderProfile<S>[], keys: readonly OidcProviderProfileKey[] | undefined): OidcProviderProfile<S>[];
-/**
- * Collects every scope referenced by the given profiles.
- *
- * Passed the full registry, this is the set of "profile-gated" scopes — scopes a client may only
- * obtain via a profile. Passed a client's assigned profiles, this is the set of scopes those
- * profiles unlock for that client.
- *
- * @param profiles - The profiles to collect scopes from.
- * @returns The union of every profile's scopes.
- */
-export declare function scopesForOidcProviderProfiles<S extends OidcScope = OidcScope>(profiles: readonly OidcProviderProfile<S>[]): Set<S>;
-/**
- * Collects the scopes marked `require: 'required'` across the given profiles.
- *
- * @param profiles - The profiles to collect required scopes from (typically a client's assigned profiles).
- * @returns The union of every profile's `required` scopes.
- */
-export declare function requiredScopesForOidcProviderProfiles<S extends OidcScope = OidcScope>(profiles: readonly OidcProviderProfile<S>[]): Set<S>;
-/**
- * Builds picker entries for the given provider profiles, suitable for an admin profile-selection field.
- *
- * @param profiles - The provider-profile registry.
- * @returns One {@link OidcProviderProfileDetails} per profile.
- */
-export declare function oidcProviderProfileDetails<S extends OidcScope = OidcScope>(profiles: readonly OidcProviderProfile<S>[]): OidcProviderProfileDetails[];