@atlasauth/cli 0.25.0 → 0.26.0

package/dist/migrate/export/firebase-config.js

@@ -0,0 +1,215 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchFirebaseConfig = fetchFirebaseConfig;
+exports.translateFirebaseConfig = translateFirebaseConfig;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+async function fetchFirebaseConfig(http, projectId) {
+    const base = `/v2/projects/${encodeURIComponent(projectId)}`;
+    const { body: config } = await http.get(`${base}/config`);
+    const list = async (kind) => {
+        try {
+            const out = [];
+            let token;
+            do {
+                const { body } = await http.get(`${base}/${kind}?pageSize=100${token ? `&nextPageToken=${encodeURIComponent(token)}` : ''}`);
+                out.push(...(0, record_set_1.objs)(body?.[kind]));
+                token = (0, record_set_1.str)(body?.nextPageToken);
+            } while (token);
+            return out;
+        }
+        catch (err) {
+            // Tenants and some provider lists exist only on Identity Platform.
+            if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404].includes(err.status))
+                return [];
+            throw err;
+        }
+    };
+    return {
+        projectId,
+        config: (0, record_set_1.isObj)(config) ? config : {},
+        defaultIdps: await list('defaultSupportedIdpConfigs'),
+        oidcIdps: await list('oauthIdpConfigs'),
+        samlIdps: await list('inboundSamlConfigs'),
+        tenants: await list('tenants'),
+    };
+}
+/** Firebase's built-in providers → Atlas built-in provider keys. */
+const SOCIAL = {
+    'google.com': 'google',
+    'facebook.com': 'facebook',
+    'twitter.com': 'x',
+    'github.com': 'github',
+    'apple.com': 'apple',
+    'microsoft.com': 'microsoft',
+    'linkedin.com': 'linkedin',
+    'yahoo.com': 'yahoo',
+};
+const node = (o, ...path) => {
+    let cur = o;
+    for (const k of path)
+        cur = (0, record_set_1.isObj)(cur) ? cur[k] : undefined;
+    return (0, record_set_1.isObj)(cur) ? cur : {};
+};
+const lastName = (name) => (0, record_set_1.str)(name)?.split('/').pop();
+function translateFirebaseConfig(snap) {
+    const b = new translate_kit_1.ConfigBuilder();
+    const c = snap.config;
+    const signIn = node(c, 'signIn');
+    // ── sign-in methods ──
+    const email = node(signIn, 'email');
+    const emailOn = email.enabled === true;
+    const passwordRequired = email.passwordRequired !== false;
+    b.set('strategies.password', emailOn && passwordRequired);
+    b.add('mapped', 'sign-in method', 'signIn.email.enabled', emailOn ? 'Email / password sign-in on.' : 'Email / password sign-in off.', 'auth_config.strategies.password');
+    if (emailOn) {
+        // passwordRequired=false is "Email link (passwordless sign-in)".
+        b.set('strategies.emailLink', !passwordRequired);
+        b.add('mapped', 'sign-in method', 'signIn.email.passwordRequired', passwordRequired ? 'Passwords are required (no email-link sign-in).' : 'Email-link (passwordless) sign-in on.', 'auth_config.strategies.emailLink');
+    }
+    const phone = node(signIn, 'phoneNumber');
+    b.set('strategies.phoneCode', phone.enabled === true);
+    b.add('mapped', 'sign-in method', 'signIn.phoneNumber.enabled', phone.enabled === true ? 'SMS code sign-in on. Configure your SMS provider in Atlas.' : 'Phone sign-in off.', 'auth_config.strategies.phoneCode');
+    const testNumbers = Object.keys(node(phone, 'testPhoneNumbers'));
+    if (testNumbers.length)
+        b.add('manual', 'sign-in method', 'signIn.phoneNumber.testPhoneNumbers', `${testNumbers.length} fictional test number(s): use Atlas development instances' test numbers instead (codes are not copied).`);
+    const anon = node(signIn, 'anonymous').enabled === true;
+    b.set('strategies.anonymous', anon);
+    b.add('mapped', 'sign-in method', 'signIn.anonymous.enabled', anon ? 'Guest (anonymous) sign-in on.' : 'Anonymous sign-in off.', 'auth_config.strategies.anonymous');
+    if (signIn.allowDuplicateEmails === true) {
+        b.add('differs', 'user account linking', 'signIn.allowDuplicateEmails', 'Firebase allowed one account per provider for the same email; Atlas keeps one user per email and links providers to it. Duplicate accounts are reported as conflicts at import.', 'auth_config');
+    }
+    if ((0, record_set_1.isObj)(signIn.hashConfig)) {
+        b.add('mapped', 'password hash parameters', 'signIn.hashConfig', 'The export carries these parameters with every password hash; Atlas verifies Firebase scrypt hashes and re-hashes each password on its first sign-in.');
+    }
+    // ── social, OIDC and SAML providers ──
+    for (const idp of snap.defaultIdps) {
+        const id = lastName(idp.name);
+        if (!id)
+            continue;
+        const key = SOCIAL[id];
+        if (!key) {
+            b.add('manual', 'sign-in method', `defaultSupportedIdpConfigs/${id}`, `"${id}" has no Atlas built-in provider: add it as a custom OAuth provider, or let those users sign in with email.`, 'custom_oauth_providers');
+            continue;
+        }
+        b.socialProvider({ atlasKey: key, vendorName: id, area: 'sign-in method', setting: `defaultSupportedIdpConfigs/${id}`, clientId: (0, record_set_1.str)(idp.clientId), enabled: idp.enabled === true });
+        if (id === 'apple.com' && (0, record_set_1.isObj)(idp.appleSignInConfig)) {
+            b.add('manual', 'sign-in method', `defaultSupportedIdpConfigs/apple.com.appleSignInConfig`, 'Sign in with Apple: add your Services ID, team id, key id and private key on the Atlas apple provider (and native bundle ids under auth_config.nativeApps).', 'oauth_providers apple');
+        }
+    }
+    for (const idp of snap.oidcIdps) {
+        const id = lastName(idp.name);
+        if (!id)
+            continue;
+        const providerKey = id.replace(/^oidc\./, '').toLowerCase().replace(/[^a-z0-9]+/g, '_').replace(/^_+|_+$/g, '').slice(0, 48) || 'oidc';
+        const upper = providerKey.toUpperCase();
+        const issuer = (0, record_set_1.str)(idp.issuer);
+        const doc = {
+            provider_key: providerKey,
+            display_name: (0, record_set_1.str)(idp.displayName) ?? id,
+            protocol: 'oidc',
+            client_id: (0, record_set_1.str)(idp.clientId) ?? b.placeholder(`${upper}_CLIENT_ID`, `${id} client id`),
+            client_secret: b.placeholder(`${upper}_CLIENT_SECRET`, `${id} client secret`),
+            enabled: idp.enabled === true,
+            allow_sign_in: true,
+            allow_sign_up: true,
+        };
+        if (issuer) {
+            doc.issuer = issuer;
+            doc.discovery_url = `${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration`;
+        }
+        const rt = node(idp, 'responseType');
+        if (rt.code === true)
+            doc.token_endpoint_auth_method = 'client_secret_post';
+        b.push('custom_oauth_providers', doc);
+        b.providers[id] = providerKey;
+        b.add(rt.idToken === true && rt.code !== true ? 'differs' : 'mapped', 'sign-in method', `oauthIdpConfigs/${id}`, `OIDC provider "${id}" becomes the custom OIDC provider "${providerKey}"${rt.idToken === true && rt.code !== true ? ' (Firebase used the implicit id_token flow; Atlas uses the code flow, so the client needs a secret)' : ''}. Add Atlas's redirect URI to the IdP and set ${upper}_CLIENT_SECRET. Imported identities keep provider "${id}"; map it with provider_map ${id}=${providerKey}.`, `custom_oauth_providers ${providerKey}`);
+    }
+    for (const idp of snap.samlIdps) {
+        const id = lastName(idp.name);
+        if (!id)
+            continue;
+        b.add('mapped', 'sign-in method', `inboundSamlConfigs/${id}`, `SAML provider "${(0, record_set_1.str)(idp.displayName) ?? id}" moves with the data export as an SSO connection. Give the IdP Atlas's ACS URL and entity id before turning it on.`, 'sso_connections');
+    }
+    // ── MFA ──
+    const mfa = node(c, 'mfa');
+    const state = (0, record_set_1.str)(mfa.state);
+    if (state === 'ENABLED' || state === 'MANDATORY') {
+        b.set('mfaPolicy', state === 'MANDATORY' ? 'required' : 'optional');
+        b.add('mapped', 'multi-factor', 'mfa.state', state === 'MANDATORY' ? 'MFA required.' : 'MFA optional.', 'auth_config.mfaPolicy');
+        const sms = (0, record_set_1.strs)(mfa.enabledProviders).includes('PHONE_SMS');
+        b.set('mfa.factors.sms', sms);
+        b.add('mapped', 'multi-factor', 'mfa.enabledProviders', sms ? 'SMS second factor on; enrolled phone numbers are imported.' : 'No SMS second factor.', 'auth_config.mfa.factors.sms');
+        const totp = (0, record_set_1.objs)(mfa.providerConfigs).find((p) => (0, record_set_1.isObj)(p.totpProviderConfig));
+        if (totp) {
+            b.set('mfa.factors.totp', (0, record_set_1.str)(totp.state) === 'ENABLED');
+            b.add('differs', 'multi-factor', 'mfa.providerConfigs.totpProviderConfig', 'Authenticator-app second factor on. Firebase never exports TOTP secrets: enrolled users enrol again in Atlas.', 'auth_config.mfa.factors.totp');
+            const adjacent = node(totp, 'totpProviderConfig').adjacentIntervals;
+            if (typeof adjacent === 'number')
+                b.add('differs', 'multi-factor', 'mfa.providerConfigs.totpProviderConfig.adjacentIntervals', `Firebase accepted ±${adjacent} adjacent interval(s); Atlas accepts ±1.`);
+        }
+    }
+    else {
+        b.add('mapped', 'multi-factor', 'mfa.state', 'MFA off.', 'auth_config.mfaPolicy');
+    }
+    // ── password policy ──
+    const pp = node(c, 'passwordPolicyConfig');
+    const enforce = (0, record_set_1.str)(pp.passwordPolicyEnforcementState);
+    const version = (0, record_set_1.objs)(pp.passwordPolicyVersions)[0];
+    const strength = version ? node(version, 'customStrengthOptions') : {};
+    if (enforce === 'ENFORCE' || enforce === 'NOT_ENFORCE') {
+        if (typeof strength.minPasswordLength === 'number')
+            b.set('passwordPolicy.minLength', Math.max(strength.minPasswordLength, 6));
+        if (typeof strength.maxPasswordLength === 'number')
+            b.set('passwordPolicy.maxLength', Math.min(strength.maxPasswordLength, 4096));
+        for (const [fb, atlas] of [
+            ['containsUppercaseCharacter', 'requireUppercase'],
+            ['containsLowercaseCharacter', 'requireLowercase'],
+            ['containsNumericCharacter', 'requireNumber'],
+            ['containsNonAlphanumericCharacter', 'requireSymbol'],
+        ]) {
+            if (typeof strength[fb] === 'boolean')
+                b.set(`passwordPolicy.${atlas}`, strength[fb]);
+        }
+        b.add(enforce === 'ENFORCE' ? 'mapped' : 'differs', 'password policy', 'passwordPolicyConfig', enforce === 'ENFORCE' ? 'Password requirements enforced at sign-up and password change.' : 'Firebase only reported (NOT_ENFORCE) violations; Atlas enforces its policy.', 'auth_config.passwordPolicy');
+        if (pp.forceUpgradeOnSignin === true)
+            b.add('differs', 'password policy', 'passwordPolicyConfig.forceUpgradeOnSignin', 'Atlas does not force a password change at sign-in for an old password that misses the policy; it applies on the next change.');
+    }
+    else {
+        b.add('differs', 'password policy', 'passwordPolicyConfig', 'No Firebase policy (6 characters minimum). Atlas defaults to 8 and checks breached passwords; imported passwords keep working.', 'auth_config.passwordPolicy');
+    }
+    // ── domains, blocking functions and the rest ──
+    const domains = (0, record_set_1.strs)(c.authorizedDomains);
+    const origins = domains.filter((d) => !/\.(firebaseapp\.com|web\.app)$/.test(d)).map((d) => (d === 'localhost' || d.startsWith('127.') ? `http://${d}` : `https://${d}`));
+    if (origins.length) {
+        b.instance.allowed_origins = origins;
+        b.add('differs', 'authorized domains', 'authorizedDomains', `Firebase authorized domains become allowed origins (${origins.length}); the *.firebaseapp.com / *.web.app hosting domains are dropped — add them if you keep hosting there.`, 'instance.allowed_origins');
+    }
+    const triggers = Object.keys(node(c, 'blockingFunctions', 'triggers'));
+    for (const t of triggers) {
+        const what = t === 'beforeCreate' ? 'a before-sign-up action (or a user.created webhook)' : t === 'beforeSignIn' ? 'a before-sign-in action (custom claims become a JWT template)' : 'Atlas email / SMS templates and your own delivery provider';
+        b.add('manual', 'blocking functions', `blockingFunctions.triggers.${t}`, `Move this Cloud Function to ${what}.`);
+    }
+    if (node(c, 'emailPrivacyConfig').enableImprovedEmailPrivacy === true)
+        b.add('mapped', 'user actions', 'emailPrivacyConfig.enableImprovedEmailPrivacy', 'Atlas never reveals whether an email has an account.');
+    if ((0, record_set_1.isObj)(c.autodeleteAnonymousUsers) || c.autodeleteAnonymousUsers === true)
+        b.add('manual', 'user actions', 'autodeleteAnonymousUsers', 'Clean up stale guest users with a scheduled call to the Atlas Backend API.');
+    if ((0, record_set_1.isObj)(c.recaptchaConfig) && Object.keys(c.recaptchaConfig).length)
+        b.add('differs', 'fraud prevention', 'recaptchaConfig', 'Atlas has its own bot protection (turn it on under Attack protection); reCAPTCHA keys are not used.', 'auth_config');
+    if ((0, record_set_1.isObj)(c.smsRegionConfig) && Object.keys(c.smsRegionConfig).length)
+        b.add('manual', 'fraud prevention', 'smsRegionConfig', 'Restrict SMS countries in Atlas under SMS settings.');
+    if ((0, record_set_1.isObj)(c.quota) && Object.keys(c.quota).length)
+        b.add('differs', 'quota', 'quota.signUpQuotaConfig', 'Atlas applies its own sign-up rate limits per IP.');
+    const sendEmail = node(c, 'notification', 'sendEmail');
+    if (Object.keys(sendEmail).length)
+        b.add('manual', 'templates', 'notification.sendEmail', 'Recreate customised email templates (and the action URL / custom SMTP) in Atlas; template bodies are not copied.');
+    if (node(c, 'multiTenant').allowTenants === true || snap.tenants.length) {
+        b.add('manual', 'multi-tenancy', 'multiTenant.allowTenants', `${snap.tenants.length} Identity Platform tenant(s). Export each into its own Atlas instance (tenant=<id>), or all of them as organizations of one instance (tenant=all). Each tenant's own providers and MFA settings are not translated here.`);
+    }
+    b.add('mapped', 'sessions', 'ID token / refresh token', 'Firebase ID tokens live one hour with long-lived refresh tokens; Atlas keeps its own session lifetime (auth_config.session). The firebase bridge preset exchanges a Firebase ID token for an Atlas session.', 'auth_config.session');
+    return b.result(`firebase project ${snap.projectId}`, {
+        bridge: { preset: 'firebase', vars: { project_id: snap.projectId } },
+    });
+}
+//# sourceMappingURL=firebase-config.js.map

package/dist/migrate/export/firebase-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firebase-config.js","sourceRoot":"","sources":["../../../src/migrate/export/firebase-config.ts"],"names":[],"mappings":";;AA0BA,kDA2BC;AAqBD,0DAwJC;AAhOD,6CAAgE;AAChE,mDAAgD;AAChD,+CAAgE;AAsBzD,KAAK,UAAU,mBAAmB,CAAC,IAAgB,EAAE,SAAiB;IAC3E,MAAM,IAAI,GAAG,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;IAC7D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,GAAG,IAAI,SAAS,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAkB,EAAE;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,GAAU,EAAE,CAAC;YACtB,IAAI,KAAyB,CAAC;YAC9B,GAAG,CAAC;gBACF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,GAAG,IAAI,IAAI,IAAI,gBAAgB,KAAK,CAAC,CAAC,CAAC,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClI,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChC,KAAK,GAAG,IAAA,gBAAG,EAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YACnC,CAAC,QAAQ,KAAK,EAAE;YAChB,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,CAAC;YACrF,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,SAAS;QACT,MAAM,EAAE,IAAA,kBAAK,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACnC,WAAW,EAAE,MAAM,IAAI,CAAC,4BAA4B,CAAC;QACrD,QAAQ,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC;QACvC,QAAQ,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC;QAC1C,OAAO,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,MAAM,GAA2B;IACrC,YAAY,EAAE,QAAQ;IACtB,cAAc,EAAE,UAAU;IAC1B,aAAa,EAAE,GAAG;IAClB,YAAY,EAAE,QAAQ;IACtB,WAAW,EAAE,OAAO;IACpB,eAAe,EAAE,WAAW;IAC5B,cAAc,EAAE,UAAU;IAC1B,WAAW,EAAE,OAAO;CACrB,CAAC;AAEF,MAAM,IAAI,GAAG,CAAC,CAAM,EAAE,GAAG,IAAc,EAAO,EAAE;IAC9C,IAAI,GAAG,GAAY,CAAC,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,GAAG,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,OAAO,IAAA,kBAAK,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/B,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,IAAI,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;AAEhE,SAAgB,uBAAuB,CAAC,IAA4B;IAClE,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAEjC,wBAAwB;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;IACvC,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC;IAC1D,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,OAAO,IAAI,gBAAgB,CAAC,CAAC;IAC1D,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,+BAA+B,EAAE,iCAAiC,CAAC,CAAC;IACzK,IAAI,OAAO,EAAE,CAAC;QACZ,iEAAiE;QACjE,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC,gBAAgB,CAAC,CAAC;QACjD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,+BAA+B,EAAE,gBAAgB,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,uCAAuC,EAAE,kCAAkC,CAAC,CAAC;IACzN,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC1C,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,4DAA4D,CAAC,CAAC,CAAC,oBAAoB,EAAE,kCAAkC,CAAC,CAAC;IAClN,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACjE,IAAI,WAAW,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,qCAAqC,EAAE,GAAG,WAAW,CAAC,MAAM,0GAA0G,CAAC,CAAC;IAClO,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC;IACxD,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,IAAI,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;IACrK,IAAI,MAAM,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QACzC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,iLAAiL,EAAE,aAAa,CAAC,CAAC;IAC5Q,CAAC;IACD,IAAI,IAAA,kBAAK,EAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,uJAAuJ,CAAC,CAAC;IAC5N,CAAC;IAED,wCAAwC;IACxC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,EAAE,EAAE,IAAI,EAAE,6GAA6G,EAAE,wBAAwB,CAAC,CAAC;YACrN,SAAS;QACX,CAAC;QACD,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC;QACrL,IAAI,EAAE,KAAK,WAAW,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACvD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,wDAAwD,EAAE,6JAA6J,EAAE,uBAAuB,CAAC,CAAC;QACtR,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;QACvI,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAyB;YAChC,YAAY,EAAE,WAAW;YACzB,YAAY,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;YACxC,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,KAAK,YAAY,EAAE,GAAG,EAAE,YAAY,CAAC;YACtF,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,KAAK,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,CAAC;YAC7E,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,IAAI;YAC7B,aAAa,EAAE,IAAI;YACnB,aAAa,EAAE,IAAI;SACpB,CAAC;QACF,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;YACpB,GAAG,CAAC,aAAa,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mCAAmC,CAAC;QACvF,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACrC,IAAI,EAAE,CAAC,IAAI,KAAK,IAAI;YAAE,GAAG,CAAC,0BAA0B,GAAG,oBAAoB,CAAC;QAC5E,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC;QAC9B,CAAC,CAAC,GAAG,CACH,EAAE,CAAC,OAAO,KAAK,IAAI,IAAI,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAC9D,gBAAgB,EAChB,mBAAmB,EAAE,EAAE,EACvB,kBAAkB,EAAE,uCAAuC,WAAW,IAAI,EAAE,CAAC,OAAO,KAAK,IAAI,IAAI,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,qGAAqG,CAAC,CAAC,CAAC,EAAE,iDAAiD,KAAK,sDAAsD,EAAE,+BAA+B,EAAE,IAAI,WAAW,GAAG,EAC/X,0BAA0B,WAAW,EAAE,CACxC,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,EAAE,EAAE,kBAAkB,IAAA,gBAAG,EAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,qHAAqH,EAAE,iBAAiB,CAAC,CAAC;IACtP,CAAC;IAED,YAAY;IACZ,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QACjD,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACpE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;QACjI,MAAM,GAAG,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC7D,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAC,CAAC,4DAA4D,CAAC,CAAC,CAAC,uBAAuB,EAAE,6BAA6B,CAAC,CAAC;QACrL,MAAM,IAAI,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAChF,IAAI,IAAI,EAAE,CAAC;YACT,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAA,gBAAG,EAAC,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC;YACzD,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,wCAAwC,EAAE,+GAA+G,EAAE,8BAA8B,CAAC,CAAC;YAC5N,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,iBAAiB,CAAC;YACpE,IAAI,OAAO,QAAQ,KAAK,QAAQ;gBAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,0DAA0D,EAAE,sBAAsB,QAAQ,0CAA0C,CAAC,CAAC;QAC3M,CAAC;IACH,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,uBAAuB,CAAC,CAAC;IACpF,CAAC;IAED,wBAAwB;IACxB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAA,gBAAG,EAAC,EAAE,CAAC,8BAA8B,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAA,iBAAI,EAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QACvD,IAAI,OAAO,QAAQ,CAAC,iBAAiB,KAAK,QAAQ;YAAE,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/H,IAAI,OAAO,QAAQ,CAAC,iBAAiB,KAAK,QAAQ;YAAE,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC;QAClI,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI;YACxB,CAAC,4BAA4B,EAAE,kBAAkB,CAAC;YAClD,CAAC,4BAA4B,EAAE,kBAAkB,CAAC;YAClD,CAAC,0BAA0B,EAAE,eAAe,CAAC;YAC7C,CAAC,kCAAkC,EAAE,eAAe,CAAC;SAC7C,EAAE,CAAC;YACX,IAAI,OAAO,QAAQ,CAAC,EAAE,CAAC,KAAK,SAAS;gBAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,KAAK,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAY,CAAC,CAAC;QACnG,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC,CAAC,6EAA6E,EAAE,4BAA4B,CAAC,CAAC;QACvS,IAAI,EAAE,CAAC,oBAAoB,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAiB,EAAE,2CAA2C,EAAE,8HAA8H,CAAC,CAAC;IACzP,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,gIAAgI,EAAE,4BAA4B,CAAC,CAAC;IAC9N,CAAC;IAED,iDAAiD;IACjD,MAAM,OAAO,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1K,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,CAAC,CAAC,QAAQ,CAAC,eAAe,GAAG,OAAO,CAAC;QACrC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,uDAAuD,OAAO,CAAC,MAAM,wGAAwG,EAAE,0BAA0B,CAAC,CAAC;IACzQ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAC,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,4DAA4D,CAAC;QAClP,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,8BAA8B,CAAC,EAAE,EAAE,+BAA+B,IAAI,GAAG,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,0BAA0B,KAAK,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,+CAA+C,EAAE,sDAAsD,CAAC,CAAC;IAChN,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,wBAAwB,KAAK,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,0BAA0B,EAAE,4EAA4E,CAAC,CAAC;IACxN,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,qGAAqG,EAAE,aAAa,CAAC,CAAC;IACrP,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,qDAAqD,CAAC,CAAC;IACrL,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,yBAAyB,EAAE,mDAAmD,CAAC,CAAC;IAC7J,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,wBAAwB,EAAE,kHAAkH,CAAC,CAAC;IAC9M,IAAI,IAAI,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACxE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,0BAA0B,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,0NAA0N,CAAC,CAAC;IACjT,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,0BAA0B,EAAE,6MAA6M,EAAE,qBAAqB,CAAC,CAAC;IAE9R,OAAO,CAAC,CAAC,MAAM,CAAC,oBAAoB,IAAI,CAAC,SAAS,EAAE,EAAE;QACpD,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;KACrE,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/firebase.d.ts

@@ -0,0 +1,102 @@
+import type { IdentityRecord, MfaFactorRecord, UserRecord } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate export firebase` — Firebase Authentication and Google Cloud
+ * Identity Platform (including multi-tenant projects) onto the canonical
+ * bundle models.
+ *
+ * Two inputs, both on the owner's machine:
+ *   - the Identity Toolkit Admin REST API (`accounts:batchGet`, the same call
+ *     the Admin SDK's `listUsers` makes) with a service-account key file or
+ *     an OAuth access token. The key signs a JWT assertion locally; it is
+ *     exchanged for an access token at Google and never goes anywhere else.
+ *     This is the complete export: every provider link (OIDC and SAML too),
+ *     the second factors and the tenants.
+ *   - a `firebase auth:export` file (JSON or CSV). It is smaller: the CLI keeps
+ *     ten social providers only, drops OIDC / SAML / phone links, cannot
+ *     export a tenant, and its CSV has no second factors.
+ *
+ * Password hashes are Firebase's modified scrypt; they verify in Atlas with
+ * the project's hash parameters (signer key, salt separator, rounds, memory
+ * cost), read from the project config with the same credentials or passed as
+ * flags (Console → Authentication → Users → ⋮ → Password hash parameters).
+ * Every tenant has its own parameters.
+ *
+ * Firebase never exports TOTP secrets (the enrollment has no fields): those
+ * users enrol again. SMS second factors move by phone number. Sessions are
+ * not exported: the `firebase` bridge preset exchanges a Firebase ID token.
+ */
+export interface FirebaseHashParams {
+    signer_key: string;
+    salt_separator: string;
+    rounds: number;
+    mem_cost: number;
+}
+export interface FirebaseServiceAccount {
+    client_email: string;
+    private_key: string;
+    private_key_id?: string;
+    project_id?: string;
+    token_uri?: string;
+}
+export interface FirebaseExportOptions {
+    /** The Firebase / Google Cloud project id. */
+    projectId: string;
+    /** A service-account key file's JSON (Firebase Authentication Admin or Identity Platform Viewer + hash access). */
+    serviceAccountJson?: string;
+    /** An OAuth 2.0 access token instead (`gcloud auth print-access-token`). */
+    accessToken?: string;
+    /** A `firebase auth:export` file (JSON or CSV), instead of the API. */
+    usersText?: string;
+    usersFileName?: string;
+    /** Project-level users (default), one tenant id, or `all` (every tenant, each as an organization). */
+    tenant?: string;
+    /** Hash parameters from flags; win over what the API reports. */
+    hashParams?: Partial<FirebaseHashParams>;
+    /** Export anonymous users too (default: left out). */
+    includeAnonymous?: boolean;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+    onProgress?: (message: string) => void;
+}
+/** Firebase's `-_` alphabet → standard base64 (the CLI does the same; the Admin SDK does not). */
+export declare const stdBase64: (v: string) => string;
+export declare function parseServiceAccount(text: string): FirebaseServiceAccount;
+/** The RS256 JWT assertion of the OAuth 2.0 JWT-bearer grant, signed locally with the service account's key. */
+export declare function serviceAccountAssertion(sa: FirebaseServiceAccount, nowSeconds: number): string;
+/** Exchange the assertion for an access token — at Google, the only place the key's signature goes. */
+export declare function serviceAccountToken(sa: FirebaseServiceAccount, fetchImpl?: typeof fetch, now?: () => number): Promise<string>;
+export declare function firebaseHttp(o: {
+    accessToken?: string;
+    serviceAccount?: FirebaseServiceAccount;
+    projectId: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+}): VendorHttp;
+/** A project's (or tenant's) password hash parameters, from the admin v2 config. Null when the caller cannot read them. */
+export declare function fetchHashConfig(http: VendorHttp, projectId: string, tenant?: string): Promise<{
+    params: Partial<FirebaseHashParams>;
+    algorithm?: string;
+} | null>;
+/** `signIn.hashConfig` (or the console's names) → the registry's scrypt_firebase params. */
+export declare function hashParamsOf(hc: Obj): Partial<FirebaseHashParams>;
+export declare function exportFirebase(opts: FirebaseExportOptions): Promise<RecordSet>;
+export interface MappedFirebaseUser {
+    user: UserRecord | null;
+    identities: IdentityRecord[];
+    factors: MfaFactorRecord[];
+    totp: number;
+    anonymous: boolean;
+    redacted: boolean;
+    otherVersion: boolean;
+}
+export declare function mapFirebaseUser(u: Obj, ctx: {
+    params: FirebaseHashParams | null;
+    includeAnonymous?: boolean;
+    tenant?: string;
+}): MappedFirebaseUser;
+/** `firebase auth:export` JSON (`{"users": [...]}`) or its header-less 52-column CSV → UserInfo-shaped objects. */
+export declare function parseFirebaseExport(text: string, fileName?: string): Obj[];