@atlasauth/cli 0.23.0 → 0.25.0

package/dist/migrate/export/firebase-config.js

@@ -1,215 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.fetchFirebaseConfig = fetchFirebaseConfig;
-exports.translateFirebaseConfig = translateFirebaseConfig;
-const record_set_1 = require("./record-set");
-const translate_kit_1 = require("./translate-kit");
-const vendor_http_1 = require("./vendor-http");
-async function fetchFirebaseConfig(http, projectId) {
-    const base = `/v2/projects/${encodeURIComponent(projectId)}`;
-    const { body: config } = await http.get(`${base}/config`);
-    const list = async (kind) => {
-        try {
-            const out = [];
-            let token;
-            do {
-                const { body } = await http.get(`${base}/${kind}?pageSize=100${token ? `&nextPageToken=${encodeURIComponent(token)}` : ''}`);
-                out.push(...(0, record_set_1.objs)(body?.[kind]));
-                token = (0, record_set_1.str)(body?.nextPageToken);
-            } while (token);
-            return out;
-        }
-        catch (err) {
-            // Tenants and some provider lists exist only on Identity Platform.
-            if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404].includes(err.status))
-                return [];
-            throw err;
-        }
-    };
-    return {
-        projectId,
-        config: (0, record_set_1.isObj)(config) ? config : {},
-        defaultIdps: await list('defaultSupportedIdpConfigs'),
-        oidcIdps: await list('oauthIdpConfigs'),
-        samlIdps: await list('inboundSamlConfigs'),
-        tenants: await list('tenants'),
-    };
-}
-/** Firebase's built-in providers → Atlas built-in provider keys. */
-const SOCIAL = {
-    'google.com': 'google',
-    'facebook.com': 'facebook',
-    'twitter.com': 'x',
-    'github.com': 'github',
-    'apple.com': 'apple',
-    'microsoft.com': 'microsoft',
-    'linkedin.com': 'linkedin',
-    'yahoo.com': 'yahoo',
-};
-const node = (o, ...path) => {
-    let cur = o;
-    for (const k of path)
-        cur = (0, record_set_1.isObj)(cur) ? cur[k] : undefined;
-    return (0, record_set_1.isObj)(cur) ? cur : {};
-};
-const lastName = (name) => (0, record_set_1.str)(name)?.split('/').pop();
-function translateFirebaseConfig(snap) {
-    const b = new translate_kit_1.ConfigBuilder();
-    const c = snap.config;
-    const signIn = node(c, 'signIn');
-    // ── sign-in methods ──
-    const email = node(signIn, 'email');
-    const emailOn = email.enabled === true;
-    const passwordRequired = email.passwordRequired !== false;
-    b.set('strategies.password', emailOn && passwordRequired);
-    b.add('mapped', 'sign-in method', 'signIn.email.enabled', emailOn ? 'Email / password sign-in on.' : 'Email / password sign-in off.', 'auth_config.strategies.password');
-    if (emailOn) {
-        // passwordRequired=false is "Email link (passwordless sign-in)".
-        b.set('strategies.emailLink', !passwordRequired);
-        b.add('mapped', 'sign-in method', 'signIn.email.passwordRequired', passwordRequired ? 'Passwords are required (no email-link sign-in).' : 'Email-link (passwordless) sign-in on.', 'auth_config.strategies.emailLink');
-    }
-    const phone = node(signIn, 'phoneNumber');
-    b.set('strategies.phoneCode', phone.enabled === true);
-    b.add('mapped', 'sign-in method', 'signIn.phoneNumber.enabled', phone.enabled === true ? 'SMS code sign-in on. Configure your SMS provider in Atlas.' : 'Phone sign-in off.', 'auth_config.strategies.phoneCode');
-    const testNumbers = Object.keys(node(phone, 'testPhoneNumbers'));
-    if (testNumbers.length)
-        b.add('manual', 'sign-in method', 'signIn.phoneNumber.testPhoneNumbers', `${testNumbers.length} fictional test number(s): use Atlas development instances' test numbers instead (codes are not copied).`);
-    const anon = node(signIn, 'anonymous').enabled === true;
-    b.set('strategies.anonymous', anon);
-    b.add('mapped', 'sign-in method', 'signIn.anonymous.enabled', anon ? 'Guest (anonymous) sign-in on.' : 'Anonymous sign-in off.', 'auth_config.strategies.anonymous');
-    if (signIn.allowDuplicateEmails === true) {
-        b.add('differs', 'user account linking', 'signIn.allowDuplicateEmails', 'Firebase allowed one account per provider for the same email; Atlas keeps one user per email and links providers to it. Duplicate accounts are reported as conflicts at import.', 'auth_config');
-    }
-    if ((0, record_set_1.isObj)(signIn.hashConfig)) {
-        b.add('mapped', 'password hash parameters', 'signIn.hashConfig', 'The export carries these parameters with every password hash; Atlas verifies Firebase scrypt hashes and re-hashes each password on its first sign-in.');
-    }
-    // ── social, OIDC and SAML providers ──
-    for (const idp of snap.defaultIdps) {
-        const id = lastName(idp.name);
-        if (!id)
-            continue;
-        const key = SOCIAL[id];
-        if (!key) {
-            b.add('manual', 'sign-in method', `defaultSupportedIdpConfigs/${id}`, `"${id}" has no Atlas built-in provider: add it as a custom OAuth provider, or let those users sign in with email.`, 'custom_oauth_providers');
-            continue;
-        }
-        b.socialProvider({ atlasKey: key, vendorName: id, area: 'sign-in method', setting: `defaultSupportedIdpConfigs/${id}`, clientId: (0, record_set_1.str)(idp.clientId), enabled: idp.enabled === true });
-        if (id === 'apple.com' && (0, record_set_1.isObj)(idp.appleSignInConfig)) {
-            b.add('manual', 'sign-in method', `defaultSupportedIdpConfigs/apple.com.appleSignInConfig`, 'Sign in with Apple: add your Services ID, team id, key id and private key on the Atlas apple provider (and native bundle ids under auth_config.nativeApps).', 'oauth_providers apple');
-        }
-    }
-    for (const idp of snap.oidcIdps) {
-        const id = lastName(idp.name);
-        if (!id)
-            continue;
-        const providerKey = id.replace(/^oidc\./, '').toLowerCase().replace(/[^a-z0-9]+/g, '_').replace(/^_+|_+$/g, '').slice(0, 48) || 'oidc';
-        const upper = providerKey.toUpperCase();
-        const issuer = (0, record_set_1.str)(idp.issuer);
-        const doc = {
-            provider_key: providerKey,
-            display_name: (0, record_set_1.str)(idp.displayName) ?? id,
-            protocol: 'oidc',
-            client_id: (0, record_set_1.str)(idp.clientId) ?? b.placeholder(`${upper}_CLIENT_ID`, `${id} client id`),
-            client_secret: b.placeholder(`${upper}_CLIENT_SECRET`, `${id} client secret`),
-            enabled: idp.enabled === true,
-            allow_sign_in: true,
-            allow_sign_up: true,
-        };
-        if (issuer) {
-            doc.issuer = issuer;
-            doc.discovery_url = `${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration`;
-        }
-        const rt = node(idp, 'responseType');
-        if (rt.code === true)
-            doc.token_endpoint_auth_method = 'client_secret_post';
-        b.push('custom_oauth_providers', doc);
-        b.providers[id] = providerKey;
-        b.add(rt.idToken === true && rt.code !== true ? 'differs' : 'mapped', 'sign-in method', `oauthIdpConfigs/${id}`, `OIDC provider "${id}" becomes the custom OIDC provider "${providerKey}"${rt.idToken === true && rt.code !== true ? ' (Firebase used the implicit id_token flow; Atlas uses the code flow, so the client needs a secret)' : ''}. Add Atlas's redirect URI to the IdP and set ${upper}_CLIENT_SECRET. Imported identities keep provider "${id}"; map it with provider_map ${id}=${providerKey}.`, `custom_oauth_providers ${providerKey}`);
-    }
-    for (const idp of snap.samlIdps) {
-        const id = lastName(idp.name);
-        if (!id)
-            continue;
-        b.add('mapped', 'sign-in method', `inboundSamlConfigs/${id}`, `SAML provider "${(0, record_set_1.str)(idp.displayName) ?? id}" moves with the data export as an SSO connection. Give the IdP Atlas's ACS URL and entity id before turning it on.`, 'sso_connections');
-    }
-    // ── MFA ──
-    const mfa = node(c, 'mfa');
-    const state = (0, record_set_1.str)(mfa.state);
-    if (state === 'ENABLED' || state === 'MANDATORY') {
-        b.set('mfaPolicy', state === 'MANDATORY' ? 'required' : 'optional');
-        b.add('mapped', 'multi-factor', 'mfa.state', state === 'MANDATORY' ? 'MFA required.' : 'MFA optional.', 'auth_config.mfaPolicy');
-        const sms = (0, record_set_1.strs)(mfa.enabledProviders).includes('PHONE_SMS');
-        b.set('mfa.factors.sms', sms);
-        b.add('mapped', 'multi-factor', 'mfa.enabledProviders', sms ? 'SMS second factor on; enrolled phone numbers are imported.' : 'No SMS second factor.', 'auth_config.mfa.factors.sms');
-        const totp = (0, record_set_1.objs)(mfa.providerConfigs).find((p) => (0, record_set_1.isObj)(p.totpProviderConfig));
-        if (totp) {
-            b.set('mfa.factors.totp', (0, record_set_1.str)(totp.state) === 'ENABLED');
-            b.add('differs', 'multi-factor', 'mfa.providerConfigs.totpProviderConfig', 'Authenticator-app second factor on. Firebase never exports TOTP secrets: enrolled users enrol again in Atlas.', 'auth_config.mfa.factors.totp');
-            const adjacent = node(totp, 'totpProviderConfig').adjacentIntervals;
-            if (typeof adjacent === 'number')
-                b.add('differs', 'multi-factor', 'mfa.providerConfigs.totpProviderConfig.adjacentIntervals', `Firebase accepted ±${adjacent} adjacent interval(s); Atlas accepts ±1.`);
-        }
-    }
-    else {
-        b.add('mapped', 'multi-factor', 'mfa.state', 'MFA off.', 'auth_config.mfaPolicy');
-    }
-    // ── password policy ──
-    const pp = node(c, 'passwordPolicyConfig');
-    const enforce = (0, record_set_1.str)(pp.passwordPolicyEnforcementState);
-    const version = (0, record_set_1.objs)(pp.passwordPolicyVersions)[0];
-    const strength = version ? node(version, 'customStrengthOptions') : {};
-    if (enforce === 'ENFORCE' || enforce === 'NOT_ENFORCE') {
-        if (typeof strength.minPasswordLength === 'number')
-            b.set('passwordPolicy.minLength', Math.max(strength.minPasswordLength, 6));
-        if (typeof strength.maxPasswordLength === 'number')
-            b.set('passwordPolicy.maxLength', Math.min(strength.maxPasswordLength, 4096));
-        for (const [fb, atlas] of [
-            ['containsUppercaseCharacter', 'requireUppercase'],
-            ['containsLowercaseCharacter', 'requireLowercase'],
-            ['containsNumericCharacter', 'requireNumber'],
-            ['containsNonAlphanumericCharacter', 'requireSymbol'],
-        ]) {
-            if (typeof strength[fb] === 'boolean')
-                b.set(`passwordPolicy.${atlas}`, strength[fb]);
-        }
-        b.add(enforce === 'ENFORCE' ? 'mapped' : 'differs', 'password policy', 'passwordPolicyConfig', enforce === 'ENFORCE' ? 'Password requirements enforced at sign-up and password change.' : 'Firebase only reported (NOT_ENFORCE) violations; Atlas enforces its policy.', 'auth_config.passwordPolicy');
-        if (pp.forceUpgradeOnSignin === true)
-            b.add('differs', 'password policy', 'passwordPolicyConfig.forceUpgradeOnSignin', 'Atlas does not force a password change at sign-in for an old password that misses the policy; it applies on the next change.');
-    }
-    else {
-        b.add('differs', 'password policy', 'passwordPolicyConfig', 'No Firebase policy (6 characters minimum). Atlas defaults to 8 and checks breached passwords; imported passwords keep working.', 'auth_config.passwordPolicy');
-    }
-    // ── domains, blocking functions and the rest ──
-    const domains = (0, record_set_1.strs)(c.authorizedDomains);
-    const origins = domains.filter((d) => !/\.(firebaseapp\.com|web\.app)$/.test(d)).map((d) => (d === 'localhost' || d.startsWith('127.') ? `http://${d}` : `https://${d}`));
-    if (origins.length) {
-        b.instance.allowed_origins = origins;
-        b.add('differs', 'authorized domains', 'authorizedDomains', `Firebase authorized domains become allowed origins (${origins.length}); the *.firebaseapp.com / *.web.app hosting domains are dropped — add them if you keep hosting there.`, 'instance.allowed_origins');
-    }
-    const triggers = Object.keys(node(c, 'blockingFunctions', 'triggers'));
-    for (const t of triggers) {
-        const what = t === 'beforeCreate' ? 'a before-sign-up action (or a user.created webhook)' : t === 'beforeSignIn' ? 'a before-sign-in action (custom claims become a JWT template)' : 'Atlas email / SMS templates and your own delivery provider';
-        b.add('manual', 'blocking functions', `blockingFunctions.triggers.${t}`, `Move this Cloud Function to ${what}.`);
-    }
-    if (node(c, 'emailPrivacyConfig').enableImprovedEmailPrivacy === true)
-        b.add('mapped', 'user actions', 'emailPrivacyConfig.enableImprovedEmailPrivacy', 'Atlas never reveals whether an email has an account.');
-    if ((0, record_set_1.isObj)(c.autodeleteAnonymousUsers) || c.autodeleteAnonymousUsers === true)
-        b.add('manual', 'user actions', 'autodeleteAnonymousUsers', 'Clean up stale guest users with a scheduled call to the Atlas Backend API.');
-    if ((0, record_set_1.isObj)(c.recaptchaConfig) && Object.keys(c.recaptchaConfig).length)
-        b.add('differs', 'fraud prevention', 'recaptchaConfig', 'Atlas has its own bot protection (turn it on under Attack protection); reCAPTCHA keys are not used.', 'auth_config');
-    if ((0, record_set_1.isObj)(c.smsRegionConfig) && Object.keys(c.smsRegionConfig).length)
-        b.add('manual', 'fraud prevention', 'smsRegionConfig', 'Restrict SMS countries in Atlas under SMS settings.');
-    if ((0, record_set_1.isObj)(c.quota) && Object.keys(c.quota).length)
-        b.add('differs', 'quota', 'quota.signUpQuotaConfig', 'Atlas applies its own sign-up rate limits per IP.');
-    const sendEmail = node(c, 'notification', 'sendEmail');
-    if (Object.keys(sendEmail).length)
-        b.add('manual', 'templates', 'notification.sendEmail', 'Recreate customised email templates (and the action URL / custom SMTP) in Atlas; template bodies are not copied.');
-    if (node(c, 'multiTenant').allowTenants === true || snap.tenants.length) {
-        b.add('manual', 'multi-tenancy', 'multiTenant.allowTenants', `${snap.tenants.length} Identity Platform tenant(s). Export each into its own Atlas instance (tenant=<id>), or all of them as organizations of one instance (tenant=all). Each tenant's own providers and MFA settings are not translated here.`);
-    }
-    b.add('mapped', 'sessions', 'ID token / refresh token', 'Firebase ID tokens live one hour with long-lived refresh tokens; Atlas keeps its own session lifetime (auth_config.session). The firebase bridge preset exchanges a Firebase ID token for an Atlas session.', 'auth_config.session');
-    return b.result(`firebase project ${snap.projectId}`, {
-        bridge: { preset: 'firebase', vars: { project_id: snap.projectId } },
-    });
-}
-//# sourceMappingURL=firebase-config.js.map

package/dist/migrate/export/firebase-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"firebase-config.js","sourceRoot":"","sources":["../../../src/migrate/export/firebase-config.ts"],"names":[],"mappings":";;AA0BA,kDA2BC;AAqBD,0DAwJC;AAhOD,6CAAgE;AAChE,mDAAgD;AAChD,+CAAgE;AAsBzD,KAAK,UAAU,mBAAmB,CAAC,IAAgB,EAAE,SAAiB;IAC3E,MAAM,IAAI,GAAG,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;IAC7D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,GAAG,IAAI,SAAS,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAkB,EAAE;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,GAAU,EAAE,CAAC;YACtB,IAAI,KAAyB,CAAC;YAC9B,GAAG,CAAC;gBACF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,GAAG,IAAI,IAAI,IAAI,gBAAgB,KAAK,CAAC,CAAC,CAAC,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClI,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChC,KAAK,GAAG,IAAA,gBAAG,EAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YACnC,CAAC,QAAQ,KAAK,EAAE;YAChB,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,CAAC;YACrF,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,SAAS;QACT,MAAM,EAAE,IAAA,kBAAK,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACnC,WAAW,EAAE,MAAM,IAAI,CAAC,4BAA4B,CAAC;QACrD,QAAQ,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC;QACvC,QAAQ,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC;QAC1C,OAAO,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,MAAM,GAA2B;IACrC,YAAY,EAAE,QAAQ;IACtB,cAAc,EAAE,UAAU;IAC1B,aAAa,EAAE,GAAG;IAClB,YAAY,EAAE,QAAQ;IACtB,WAAW,EAAE,OAAO;IACpB,eAAe,EAAE,WAAW;IAC5B,cAAc,EAAE,UAAU;IAC1B,WAAW,EAAE,OAAO;CACrB,CAAC;AAEF,MAAM,IAAI,GAAG,CAAC,CAAM,EAAE,GAAG,IAAc,EAAO,EAAE;IAC9C,IAAI,GAAG,GAAY,CAAC,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,GAAG,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,OAAO,IAAA,kBAAK,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/B,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;AAEhE,SAAgB,uBAAuB,CAAC,IAA4B;IAClE,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAEjC,wBAAwB;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;IACvC,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC;IAC1D,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,OAAO,IAAI,gBAAgB,CAAC,CAAC;IAC1D,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,+BAA+B,EAAE,iCAAiC,CAAC,CAAC;IACzK,IAAI,OAAO,EAAE,CAAC;QACZ,iEAAiE;QACjE,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC,gBAAgB,CAAC,CAAC;QACjD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,+BAA+B,EAAE,gBAAgB,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,uCAAuC,EAAE,kCAAkC,CAAC,CAAC;IACzN,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC1C,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,4DAA4D,CAAC,CAAC,CAAC,oBAAoB,EAAE,kCAAkC,CAAC,CAAC;IAClN,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACjE,IAAI,WAAW,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,qCAAqC,EAAE,GAAG,WAAW,CAAC,MAAM,0GAA0G,CAAC,CAAC;IAClO,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC;IACxD,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,IAAI,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;IACrK,IAAI,MAAM,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QACzC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,iLAAiL,EAAE,aAAa,CAAC,CAAC;IAC5Q,CAAC;IACD,IAAI,IAAA,kBAAK,EAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,uJAAuJ,CAAC,CAAC;IAC5N,CAAC;IAED,wCAAwC;IACxC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,EAAE,EAAE,IAAI,EAAE,6GAA6G,EAAE,wBAAwB,CAAC,CAAC;YACrN,SAAS;QACX,CAAC;QACD,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC;QACrL,IAAI,EAAE,KAAK,WAAW,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACvD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,wDAAwD,EAAE,6JAA6J,EAAE,uBAAuB,CAAC,CAAC;QACtR,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;QACvI,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAyB;YAChC,YAAY,EAAE,WAAW;YACzB,YAAY,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;YACxC,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,KAAK,YAAY,EAAE,GAAG,EAAE,YAAY,CAAC;YACtF,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,KAAK,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,CAAC;YAC7E,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,IAAI;YAC7B,aAAa,EAAE,IAAI;YACnB,aAAa,EAAE,IAAI;SACpB,CAAC;QACF,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;YACpB,GAAG,CAAC,aAAa,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mCAAmC,CAAC;QACvF,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACrC,IAAI,EAAE,CAAC,IAAI,KAAK,IAAI;YAAE,GAAG,CAAC,0BAA0B,GAAG,oBAAoB,CAAC;QAC5E,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC;QAC9B,CAAC,CAAC,GAAG,CACH,EAAE,CAAC,OAAO,KAAK,IAAI,IAAI,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAC9D,gBAAgB,EAChB,mBAAmB,EAAE,EAAE,EACvB,kBAAkB,EAAE,uCAAuC,WAAW,IAAI,EAAE,CAAC,OAAO,KAAK,IAAI,IAAI,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,qGAAqG,CAAC,CAAC,CAAC,EAAE,iDAAiD,KAAK,sDAAsD,EAAE,+BAA+B,EAAE,IAAI,WAAW,GAAG,EAC/X,0BAA0B,WAAW,EAAE,CACxC,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,EAAE,EAAE,kBAAkB,IAAA,gBAAG,EAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,qHAAqH,EAAE,iBAAiB,CAAC,CAAC;IACtP,CAAC;IAED,YAAY;IACZ,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QACjD,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACpE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;QACjI,MAAM,GAAG,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC7D,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAC,CAAC,4DAA4D,CAAC,CAAC,CAAC,uBAAuB,EAAE,6BAA6B,CAAC,CAAC;QACrL,MAAM,IAAI,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAChF,IAAI,IAAI,EAAE,CAAC;YACT,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC;YACzD,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,wCAAwC,EAAE,+GAA+G,EAAE,8BAA8B,CAAC,CAAC;YAC5N,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,iBAAiB,CAAC;YACpE,IAAI,OAAO,QAAQ,KAAK,QAAQ;gBAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,0DAA0D,EAAE,sBAAsB,QAAQ,0CAA0C,CAAC,CAAC;QAC3M,CAAC;IACH,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,uBAAuB,CAAC,CAAC;IACpF,CAAC;IAED,wBAAwB;IACxB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAA,gBAAG,EAAC,EAAE,CAAC,8BAA8B,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAA,iBAAI,EAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QACvD,IAAI,OAAO,QAAQ,CAAC,iBAAiB,KAAK,QAAQ;YAAE,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/H,IAAI,OAAO,QAAQ,CAAC,iBAAiB,KAAK,QAAQ;YAAE,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC;QAClI,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI;YACxB,CAAC,4BAA4B,EAAE,kBAAkB,CAAC;YAClD,CAAC,4BAA4B,EAAE,kBAAkB,CAAC;YAClD,CAAC,0BAA0B,EAAE,eAAe,CAAC;YAC7C,CAAC,kCAAkC,EAAE,eAAe,CAAC;SAC7C,EAAE,CAAC;YACX,IAAI,OAAO,QAAQ,CAAC,EAAE,CAAC,KAAK,SAAS;gBAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,KAAK,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAY,CAAC,CAAC;QACnG,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC,CAAC,6EAA6E,EAAE,4BAA4B,CAAC,CAAC;QACvS,IAAI,EAAE,CAAC,oBAAoB,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAiB,EAAE,2CAA2C,EAAE,8HAA8H,CAAC,CAAC;IACzP,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,gIAAgI,EAAE,4BAA4B,CAAC,CAAC;IAC9N,CAAC;IAED,iDAAiD;IACjD,MAAM,OAAO,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1K,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,CAAC,CAAC,QAAQ,CAAC,eAAe,GAAG,OAAO,CAAC;QACrC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,uDAAuD,OAAO,CAAC,MAAM,wGAAwG,EAAE,0BAA0B,CAAC,CAAC;IACzQ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAC,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,4DAA4D,CAAC;QAClP,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,8BAA8B,CAAC,EAAE,EAAE,+BAA+B,IAAI,GAAG,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,0BAA0B,KAAK,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,+CAA+C,EAAE,sDAAsD,CAAC,CAAC;IAChN,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,wBAAwB,KAAK,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,0BAA0B,EAAE,4EAA4E,CAAC,CAAC;IACxN,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,qGAAqG,EAAE,aAAa,CAAC,CAAC;IACrP,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,qDAAqD,CAAC,CAAC;IACrL,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,yBAAyB,EAAE,mDAAmD,CAAC,CAAC;IAC7J,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,wBAAwB,EAAE,kHAAkH,CAAC,CAAC;IAC9M,IAAI,IAAI,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACxE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,0BAA0B,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,0NAA0N,CAAC,CAAC;IACjT,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,0BAA0B,EAAE,6MAA6M,EAAE,qBAAqB,CAAC,CAAC;IAE9R,OAAO,CAAC,CAAC,MAAM,CAAC,oBAAoB,IAAI,CAAC,SAAS,EAAE,EAAE;QACpD,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;KACrE,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/firebase.d.ts

@@ -1,102 +0,0 @@
-import type { IdentityRecord, MfaFactorRecord, UserRecord } from '@atlasauth/migrate';
-import { RecordSet, type Obj } from './record-set';
-import { VendorHttp } from './vendor-http';
-/**
- * `atlas migrate export firebase` — Firebase Authentication and Google Cloud
- * Identity Platform (including multi-tenant projects) onto the canonical
- * bundle models.
- *
- * Two inputs, both on the owner's machine:
- *   - the Identity Toolkit Admin REST API (`accounts:batchGet`, the same call
- *     the Admin SDK's `listUsers` makes) with a service-account key file or
- *     an OAuth access token. The key signs a JWT assertion locally; it is
- *     exchanged for an access token at Google and never goes anywhere else.
- *     This is the complete export: every provider link (OIDC and SAML too),
- *     the second factors and the tenants.
- *   - a `firebase auth:export` file (JSON or CSV). It is smaller: the CLI keeps
- *     ten social providers only, drops OIDC / SAML / phone links, cannot
- *     export a tenant, and its CSV has no second factors.
- *
- * Password hashes are Firebase's modified scrypt; they verify in Atlas with
- * the project's hash parameters (signer key, salt separator, rounds, memory
- * cost), read from the project config with the same credentials or passed as
- * flags (Console → Authentication → Users → ⋮ → Password hash parameters).
- * Every tenant has its own parameters.
- *
- * Firebase never exports TOTP secrets (the enrollment has no fields): those
- * users enrol again. SMS second factors move by phone number. Sessions are
- * not exported: the `firebase` bridge preset exchanges a Firebase ID token.
- */
-export interface FirebaseHashParams {
-    signer_key: string;
-    salt_separator: string;
-    rounds: number;
-    mem_cost: number;
-}
-export interface FirebaseServiceAccount {
-    client_email: string;
-    private_key: string;
-    private_key_id?: string;
-    project_id?: string;
-    token_uri?: string;
-}
-export interface FirebaseExportOptions {
-    /** The Firebase / Google Cloud project id. */
-    projectId: string;
-    /** A service-account key file's JSON (Firebase Authentication Admin or Identity Platform Viewer + hash access). */
-    serviceAccountJson?: string;
-    /** An OAuth 2.0 access token instead (`gcloud auth print-access-token`). */
-    accessToken?: string;
-    /** A `firebase auth:export` file (JSON or CSV), instead of the API. */
-    usersText?: string;
-    usersFileName?: string;
-    /** Project-level users (default), one tenant id, or `all` (every tenant, each as an organization). */
-    tenant?: string;
-    /** Hash parameters from flags; win over what the API reports. */
-    hashParams?: Partial<FirebaseHashParams>;
-    /** Export anonymous users too (default: left out). */
-    includeAnonymous?: boolean;
-    fetchImpl?: typeof fetch;
-    sleep?: (ms: number) => Promise<void>;
-    now?: () => number;
-    onProgress?: (message: string) => void;
-}
-/** Firebase's `-_` alphabet → standard base64 (the CLI does the same; the Admin SDK does not). */
-export declare const stdBase64: (v: string) => string;
-export declare function parseServiceAccount(text: string): FirebaseServiceAccount;
-/** The RS256 JWT assertion of the OAuth 2.0 JWT-bearer grant, signed locally with the service account's key. */
-export declare function serviceAccountAssertion(sa: FirebaseServiceAccount, nowSeconds: number): string;
-/** Exchange the assertion for an access token — at Google, the only place the key's signature goes. */
-export declare function serviceAccountToken(sa: FirebaseServiceAccount, fetchImpl?: typeof fetch, now?: () => number): Promise<string>;
-export declare function firebaseHttp(o: {
-    accessToken?: string;
-    serviceAccount?: FirebaseServiceAccount;
-    projectId: string;
-    fetchImpl?: typeof fetch;
-    sleep?: (ms: number) => Promise<void>;
-    now?: () => number;
-}): VendorHttp;
-/** A project's (or tenant's) password hash parameters, from the admin v2 config. Null when the caller cannot read them. */
-export declare function fetchHashConfig(http: VendorHttp, projectId: string, tenant?: string): Promise<{
-    params: Partial<FirebaseHashParams>;
-    algorithm?: string;
-} | null>;
-/** `signIn.hashConfig` (or the console's names) → the registry's scrypt_firebase params. */
-export declare function hashParamsOf(hc: Obj): Partial<FirebaseHashParams>;
-export declare function exportFirebase(opts: FirebaseExportOptions): Promise<RecordSet>;
-export interface MappedFirebaseUser {
-    user: UserRecord | null;
-    identities: IdentityRecord[];
-    factors: MfaFactorRecord[];
-    totp: number;
-    anonymous: boolean;
-    redacted: boolean;
-    otherVersion: boolean;
-}
-export declare function mapFirebaseUser(u: Obj, ctx: {
-    params: FirebaseHashParams | null;
-    includeAnonymous?: boolean;
-    tenant?: string;
-}): MappedFirebaseUser;
-/** `firebase auth:export` JSON (`{"users": [...]}`) or its header-less 52-column CSV → UserInfo-shaped objects. */
-export declare function parseFirebaseExport(text: string, fileName?: string): Obj[];