@dereekb/firebase-server 13.12.3 → 13.12.5

package/index.cjs.js

@@ -265,6 +265,12 @@ function _type_of$7(obj) {
  *
  * @param input - The value to check.
  * @returns `true` if the input is a Firebase {@link HttpsError}.
+ *
+ * @dbxUtil
+ * @dbxUtilCategory firebase-error
+ * @dbxUtilKind function
+ * @dbxUtilTags firebase, https, error, type-guard, server, callable
+ * @dbxUtilRelated is-firebase-error, firebase-server-error-info
  */ function isFirebaseHttpsError(input) {
     return (typeof input === "undefined" ? "undefined" : _type_of$7(input)) === 'object' && input != null && 'code' in input && 'httpErrorCode' in input && 'toJSON' in input;
 }
@@ -273,6 +279,12 @@ function _type_of$7(obj) {
  *
  * @param input - The value to check.
  * @returns `true` if the input is a Firebase Admin {@link admin.FirebaseError}.
+ *
+ * @dbxUtil
+ * @dbxUtilCategory firebase-error
+ * @dbxUtilKind function
+ * @dbxUtilTags firebase, admin, error, type-guard, server
+ * @dbxUtilRelated is-firebase-https-error, firebase-server-error-info
  */ function isFirebaseError(input) {
     return (typeof input === "undefined" ? "undefined" : _type_of$7(input)) === 'object' && input != null && 'code' in input && 'message' in input && 'toJSON' in input;
 }
@@ -285,6 +297,12 @@ function _type_of$7(obj) {
  * @param e - The caught error to analyze.
  * @returns Structured {@link FirebaseServerErrorInfo} with classified error details.
  *
+ * @dbxUtil
+ * @dbxUtilCategory firebase-error
+ * @dbxUtilKind function
+ * @dbxUtilTags firebase, error, decode, analyze, https, admin, server, classify, server-error
+ * @dbxUtilRelated firebase-server-error-info-code-pair, firebase-server-error-info-server-error-pair, firebase-server-error-info-server-error-code-pair, is-firebase-https-error, is-firebase-error
+ *
  * @example
  * ```typescript
  * try {
@@ -331,6 +349,12 @@ function _type_of$7(obj) {
  *
  * @param e - The caught error to analyze.
  * @returns A tuple of the Firebase error code (if present) and the full error info.
+ *
+ * @dbxUtil
+ * @dbxUtilCategory firebase-error
+ * @dbxUtilKind function
+ * @dbxUtilTags firebase, error, code, pair, tuple, pattern-match, decode
+ * @dbxUtilRelated firebase-server-error-info, firebase-server-error-info-server-error-pair, firebase-server-error-info-server-error-code-pair
  */ function firebaseServerErrorInfoCodePair(e) {
     var info = firebaseServerErrorInfo(e);
     return [
@@ -343,6 +367,12 @@ function _type_of$7(obj) {
  *
  * @param e - The caught error to analyze.
  * @returns A tuple of the server error (if present) and the full error info.
+ *
+ * @dbxUtil
+ * @dbxUtilCategory firebase-error
+ * @dbxUtilKind function
+ * @dbxUtilTags firebase, error, server-error, pair, tuple, pattern-match, decode, details
+ * @dbxUtilRelated firebase-server-error-info, firebase-server-error-info-code-pair, firebase-server-error-info-server-error-code-pair
  */ function firebaseServerErrorInfoServerErrorPair(e) {
     var info = firebaseServerErrorInfo(e);
     return [
@@ -355,6 +385,12 @@ function _type_of$7(obj) {
  *
  * @param e - The caught error to analyze.
  * @returns A tuple of the server error code (if present) and the full error info.
+ *
+ * @dbxUtil
+ * @dbxUtilCategory firebase-error
+ * @dbxUtilKind function
+ * @dbxUtilTags firebase, error, server-error, code, string-code, pair, tuple, pattern-match, decode
+ * @dbxUtilRelated firebase-server-error-info, firebase-server-error-info-code-pair, firebase-server-error-info-server-error-pair
  */ function firebaseServerErrorInfoServerErrorCodePair(e) {
     var info = firebaseServerErrorInfo(e);
     return [
@@ -369,6 +405,12 @@ function _type_of$7(obj) {
  *
  * @param e - The caught error.
  * @param handleFirebaseErrorFn - Handler that receives the typed {@link admin.FirebaseError}.
+ *
+ * @dbxUtil
+ * @dbxUtilCategory firebase-error
+ * @dbxUtilKind function
+ * @dbxUtilTags firebase, admin, error, handler, catch, conditional, rethrow
+ * @dbxUtilRelated is-firebase-error, firebase-server-error-info
  */ function handleFirebaseError(e, handleFirebaseErrorFn) {
     var firebaseError = e.code ? e : undefined;
     if (firebaseError) {
@@ -1256,15 +1298,6 @@ function _ts_generator$g(thisArg, body) {
                                     this.updateClaims(passwordClaimsData)
                                 ];
                             case 1:
-                                _state.sent();
-                                // update the user
-                                return [
-                                    4,
-                                    this.updateUser({
-                                        password: password
-                                    })
-                                ];
-                            case 2:
                                 _state.sent();
                                 return [
                                     2,
@@ -1346,11 +1379,43 @@ function _ts_generator$g(thisArg, body) {
             key: "updateUser",
             value: function updateUser(template) {
                 return _async_to_generator$g(function() {
+                    var e, firebaseError, errorCode, email, phoneNumber;
                     return _ts_generator$g(this, function(_state) {
-                        return [
-                            2,
-                            this.service.auth.updateUser(this.uid, template)
-                        ];
+                        switch(_state.label){
+                            case 0:
+                                _state.trys.push([
+                                    0,
+                                    2,
+                                    ,
+                                    3
+                                ]);
+                                return [
+                                    4,
+                                    this.service.auth.updateUser(this.uid, template)
+                                ];
+                            case 1:
+                                return [
+                                    2,
+                                    _state.sent()
+                                ];
+                            case 2:
+                                e = _state.sent();
+                                firebaseError = e;
+                                errorCode = firebaseError.code;
+                                email = template.email, phoneNumber = template.phoneNumber;
+                                if (errorCode === firebase.FIREBASE_AUTH_PHONE_NUMBER_ALREADY_EXISTS_ERROR && phoneNumber) {
+                                    throw new FirebaseServerAuthUserExistsError(errorCode, 'phone', phoneNumber);
+                                } else if (errorCode === firebase.FIREBASE_AUTH_EMAIL_ALREADY_EXISTS_ERROR && email) {
+                                    throw new FirebaseServerAuthUserExistsError(errorCode, 'email', email);
+                                } else if (errorCode === firebase.FIREBASE_AUTH_INVALID_PHONE_NUMBER_ERROR && phoneNumber) {
+                                    throw new FirebaseServerAuthUserBadInputError(errorCode, phoneNumber);
+                                }
+                                throw e;
+                            case 3:
+                                return [
+                                    2
+                                ];
+                        }
                     });
                 }).call(this);
             }
@@ -2123,6 +2188,50 @@ function _ts_generator$g(thisArg, body) {
     ]);
     return NoSetupContentFirebaseServerNewUserService;
 }(AbstractFirebaseServerNewUserService);
+/**
+ * Builds the composite oob code from a raw reset code (the numeric value stored in
+ * {@link FirebaseServerAuthResetUserPasswordClaims.resetPassword}) and the target user's uid.
+ *
+ * @param uid - The target user's UID.
+ * @param code - The raw reset code from the user's claims.
+ *
+ * @example
+ * ```typescript
+ * const oobCode = encodeFirebaseServerUserPasswordResetOobCode(user.uid, claims.resetPassword);
+ * // e.g. '482910-abcDEF123'
+ * ```
+ */ function encodeFirebaseServerUserPasswordResetOobCode(uid, code) {
+    return "".concat(code, "-").concat(uid);
+}
+/**
+ * Decodes a composite oob code back into its `{ uid, code }` parts. Returns `undefined`
+ * when the token is malformed (missing separator, non-numeric code, empty uid).
+ *
+ * @param token - The composite oob token, typically received from the password-reset email.
+ *
+ * @example
+ * ```typescript
+ * const decoded = decodeFirebaseServerUserPasswordResetOobCode('482910-abcDEF123');
+ * // decoded = { uid: 'abcDEF123', code: '482910' }
+ * ```
+ */ function decodeFirebaseServerUserPasswordResetOobCode(token) {
+    var result;
+    if (typeof token === 'string') {
+        var dashIndex = token.indexOf('-');
+        if (dashIndex > 0 && dashIndex < token.length - 1) {
+            var code = token.slice(0, dashIndex);
+            var uid = token.slice(dashIndex + 1);
+            // Code must be purely digits (matches DEFAULT_FIREBASE_PASSWORD_NUMBER_GENERATOR output).
+            if (/^\d+$/.test(code)) {
+                result = {
+                    uid: uid,
+                    code: code
+                };
+            }
+        }
+    }
+    return result;
+}
 /**
  * Default throttle duration (60 seconds) between reset content re-sends to prevent spam while
  * remaining responsive for legitimate users who didn't receive the first email.
@@ -2171,7 +2280,7 @@ function _ts_generator$g(thisArg, body) {
             key: "beginPasswordReset",
             value: function beginPasswordReset(input) {
                 return _async_to_generator$g(function() {
-                    var uid, email, sendResetContent, sendResetDetailsOnce, sendResetIgnoreThrottle, sendResetThrowErrors, data, sendDetailsInTestEnvironment, resolvedUid, userRecord, userContext, claims;
+                    var uid, email, sendResetContent, sendResetDetailsOnce, sendResetIgnoreThrottle, sendResetThrowErrors, data, sendDetailsInTestEnvironment, resolvedUid, userRecord, userContext, claims, oobCode;
                     return _ts_generator$g(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -2232,9 +2341,13 @@ function _ts_generator$g(thisArg, body) {
                                 _state.sent();
                                 _state.label = 7;
                             case 7:
+                                oobCode = encodeFirebaseServerUserPasswordResetOobCode(resolvedUid, claims.resetPassword);
                                 return [
                                     2,
-                                    claims
+                                    {
+                                        claims: claims,
+                                        oobCode: oobCode
+                                    }
                                 ];
                         }
                     });
@@ -2380,6 +2493,7 @@ function _ts_generator$g(thisArg, body) {
                                             resetCommunicationAt: claims.resetCommunicationAt,
                                             resetExpiresAt: claims.resetExpiresAt
                                         },
+                                        oobCode: encodeFirebaseServerUserPasswordResetOobCode(userContext.uid, claims.resetPassword),
                                         data: config === null || config === void 0 ? void 0 : config.data,
                                         sendDetailsInTestEnvironment: config === null || config === void 0 ? void 0 : config.sendDetailsInTestEnvironment
                                     };
@@ -2422,30 +2536,56 @@ function _ts_generator$g(thisArg, body) {
         },
         {
             key: "completePasswordReset",
-            value: function completePasswordReset(uid, input) {
+            value: function completePasswordReset(input) {
                 return _async_to_generator$g(function() {
-                    var userContext, claims, storedCode, expiresAt, storedBuf, inputBuf;
+                    var decoded, userContext, claims, storedCode, expiresAt, storedBuf, inputBuf;
                     return _ts_generator$g(this, function(_state) {
                         switch(_state.label){
                             case 0:
-                                userContext = this.authService.userContext(uid);
+                                // Decode the composite token. A malformed token is treated identically to every other
+                                // failure mode below — the caller cannot distinguish between "bad encoding", "unknown uid",
+                                // "no active reset", "expired", or "wrong code".
+                                decoded = decodeFirebaseServerUserPasswordResetOobCode(input.oobCode);
+                                if (!decoded) {
+                                    throw new FirebaseServerAuthPasswordResetInvalidCodeError();
+                                }
+                                userContext = this.authService.userContext(decoded.uid);
+                                _state.label = 1;
+                            case 1:
+                                _state.trys.push([
+                                    1,
+                                    3,
+                                    ,
+                                    4
+                                ]);
                                 return [
                                     4,
                                     userContext.loadResetPasswordClaims()
                                 ];
-                            case 1:
+                            case 2:
                                 claims = _state.sent();
+                                return [
+                                    3,
+                                    4
+                                ];
+                            case 3:
+                                _state.sent();
+                                claims = undefined;
+                                return [
+                                    3,
+                                    4
+                                ];
+                            case 4:
                                 storedCode = claims === null || claims === void 0 ? void 0 : claims.resetPassword;
                                 expiresAt = claims === null || claims === void 0 ? void 0 : claims.resetExpiresAt;
                                 // Reject if no active reset OR the stored code is missing/wrong length OR the code is expired.
-                                // All failure cases throw the same opaque error so callers cannot distinguish them.
-                                if (!storedCode || !expiresAt || storedCode.length !== input.resetPassword.length || new Date(expiresAt).getTime() <= Date.now()) {
+                                if (!storedCode || !expiresAt || storedCode.length !== decoded.code.length || new Date(expiresAt).getTime() <= Date.now()) {
                                     throw new FirebaseServerAuthPasswordResetInvalidCodeError();
                                 }
                                 // Constant-time comparison to avoid leaking timing information about how many leading
                                 // characters of the provided code matched. Lengths are equal per the guard above.
                                 storedBuf = Buffer.from(storedCode);
-                                inputBuf = Buffer.from(input.resetPassword);
+                                inputBuf = Buffer.from(decoded.code);
                                 if (!node_crypto.timingSafeEqual(storedBuf, inputBuf)) {
                                     throw new FirebaseServerAuthPasswordResetInvalidCodeError();
                                 }
@@ -12998,12 +13138,14 @@ exports.catchAndThrowPasswordResetServerErrors = catchAndThrowPasswordResetServe
 exports.cloudEventHandlerWithNestContextFactory = cloudEventHandlerWithNestContextFactory;
 exports.collectionRefForPath = collectionRefForPath;
 exports.createModelUnknownModelTypeError = createModelUnknownModelTypeError;
+exports.decodeFirebaseServerUserPasswordResetOobCode = decodeFirebaseServerUserPasswordResetOobCode;
 exports.defaultFirebaseServerActionsTransformFactoryLogErrorFunction = defaultFirebaseServerActionsTransformFactoryLogErrorFunction;
 exports.defaultProvideFirebaseServerStorageServiceSimple = defaultProvideFirebaseServerStorageServiceSimple;
 exports.deleteModelUnknownModelTypeError = deleteModelUnknownModelTypeError;
 exports.developmentUnknownSpecifierError = developmentUnknownSpecifierError;
 exports.docRefForPath = docRefForPath;
 exports.documentModelNotAvailableError = documentModelNotAvailableError;
+exports.encodeFirebaseServerUserPasswordResetOobCode = encodeFirebaseServerUserPasswordResetOobCode;
 exports.executeOnCallQuery = executeOnCallQuery;
 exports.firebaseAuthTokenFromDecodedIdToken = firebaseAuthTokenFromDecodedIdToken;
 exports.firebaseServerActionsContext = firebaseServerActionsContext;