@prmichaelsen/firebase-admin-sdk-v8 2.0.2 → 2.0.4

package/dist/index.js

@@ -173,18 +173,22 @@ async function importPublicKeyFromX509(pem) {
 // src/auth.ts
 var publicKeysCache = null;
 var publicKeysCacheExpiry = 0;
-async function fetchPublicKeys() {
+async function fetchPublicKeys(issuer) {
+  let endpoint = "https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com";
+  if (issuer && issuer.includes("session.firebase.google.com")) {
+    endpoint = "https://www.googleapis.com/identitytoolkit/v3/relyingparty/publicKeys";
+  }
   if (publicKeysCache && Date.now() < publicKeysCacheExpiry) {
     return publicKeysCache;
   }
-  const response = await fetch(
-    "https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com"
-  );
+  console.log(`[fetchPublicKeys] Fetching from: ${endpoint}`);
+  const response = await fetch(endpoint);
   if (!response.ok) {
-    throw new Error("Failed to fetch Firebase public keys");
+    throw new Error(`Failed to fetch Firebase public keys from ${endpoint}`);
   }
   publicKeysCache = await response.json();
   publicKeysCacheExpiry = Date.now() + 36e5;
+  console.log(`[fetchPublicKeys] Fetched ${Object.keys(publicKeysCache || {}).length} keys`);
   return publicKeysCache;
 }
 function base64UrlDecode(str) {
@@ -257,13 +261,20 @@ async function verifyIdToken(idToken) {
     if (payload.sub.length > 128) {
       throw new Error("Subject too long");
     }
-    const publicKeys = await fetchPublicKeys();
-    const publicKeyPem = publicKeys[header.kid];
+    let publicKeys = await fetchPublicKeys(payload.iss);
+    let publicKeyPem = publicKeys[header.kid];
     if (!publicKeyPem) {
-      const availableKids = Object.keys(publicKeys).join(", ");
-      throw new Error(
-        `Public key not found for kid: ${header.kid}. Available kids: ${availableKids}. This might indicate a key rotation issue or the token is from a different Firebase project.`
-      );
+      console.log(`[verifyIdToken] Key ${header.kid} not found in cache, refreshing keys...`);
+      publicKeysCache = null;
+      publicKeysCacheExpiry = 0;
+      publicKeys = await fetchPublicKeys(payload.iss);
+      publicKeyPem = publicKeys[header.kid];
+      if (!publicKeyPem) {
+        const availableKids = Object.keys(publicKeys).join(", ");
+        throw new Error(
+          `Public key not found for kid: ${header.kid}. Available kids: ${availableKids}. This might indicate the token is from a different Firebase project or was signed with a very old key.`
+        );
+      }
     }
     const publicKey = await importPublicKeyFromX509(publicKeyPem);
     const isValid = await verifySignature(idToken, publicKey);

package/dist/index.mjs

@@ -133,18 +133,22 @@ async function importPublicKeyFromX509(pem) {
 // src/auth.ts
 var publicKeysCache = null;
 var publicKeysCacheExpiry = 0;
-async function fetchPublicKeys() {
+async function fetchPublicKeys(issuer) {
+  let endpoint = "https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com";
+  if (issuer && issuer.includes("session.firebase.google.com")) {
+    endpoint = "https://www.googleapis.com/identitytoolkit/v3/relyingparty/publicKeys";
+  }
   if (publicKeysCache && Date.now() < publicKeysCacheExpiry) {
     return publicKeysCache;
   }
-  const response = await fetch(
-    "https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com"
-  );
+  console.log(`[fetchPublicKeys] Fetching from: ${endpoint}`);
+  const response = await fetch(endpoint);
   if (!response.ok) {
-    throw new Error("Failed to fetch Firebase public keys");
+    throw new Error(`Failed to fetch Firebase public keys from ${endpoint}`);
   }
   publicKeysCache = await response.json();
   publicKeysCacheExpiry = Date.now() + 36e5;
+  console.log(`[fetchPublicKeys] Fetched ${Object.keys(publicKeysCache || {}).length} keys`);
   return publicKeysCache;
 }
 function base64UrlDecode(str) {
@@ -217,13 +221,20 @@ async function verifyIdToken(idToken) {
     if (payload.sub.length > 128) {
       throw new Error("Subject too long");
     }
-    const publicKeys = await fetchPublicKeys();
-    const publicKeyPem = publicKeys[header.kid];
+    let publicKeys = await fetchPublicKeys(payload.iss);
+    let publicKeyPem = publicKeys[header.kid];
     if (!publicKeyPem) {
-      const availableKids = Object.keys(publicKeys).join(", ");
-      throw new Error(
-        `Public key not found for kid: ${header.kid}. Available kids: ${availableKids}. This might indicate a key rotation issue or the token is from a different Firebase project.`
-      );
+      console.log(`[verifyIdToken] Key ${header.kid} not found in cache, refreshing keys...`);
+      publicKeysCache = null;
+      publicKeysCacheExpiry = 0;
+      publicKeys = await fetchPublicKeys(payload.iss);
+      publicKeyPem = publicKeys[header.kid];
+      if (!publicKeyPem) {
+        const availableKids = Object.keys(publicKeys).join(", ");
+        throw new Error(
+          `Public key not found for kid: ${header.kid}. Available kids: ${availableKids}. This might indicate the token is from a different Firebase project or was signed with a very old key.`
+        );
+      }
     }
     const publicKey = await importPublicKeyFromX509(publicKeyPem);
     const isValid = await verifySignature(idToken, publicKey);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prmichaelsen/firebase-admin-sdk-v8",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "Firebase Admin SDK for Cloudflare Workers and edge runtimes using REST APIs",
   "main": "dist/index.js",
   "module": "dist/index.mjs",