@react-native-firebase/auth 26.3.3 → 26.4.0

package/CHANGELOG.md

@@ -3,6 +3,15 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [26.4.0](https://github.com/invertase/react-native-firebase/compare/v26.3.3...v26.4.0) (2026-09-05)
+
+### Bug Fixes
+
+- **auth, ios:** look up customAuthDomains with JS app name ([9873f61](https://github.com/invertase/react-native-firebase/commit/9873f618a972c3324ec05b9e30f5aaefa7ab163b))
+- **auth:** [LOW] handle malformed action links ([0961ccc](https://github.com/invertase/react-native-firebase/commit/0961ccc1108195c40fbb00ba38280f70f1419fbe))
+- **auth:** use RNFBHandleMap for auth state and id-token listeners ([a708e84](https://github.com/invertase/react-native-firebase/commit/a708e847119995b8cfbde07f11ea84d48aede29b))
+- **auth:** use RNFBHandleMap for credential and MFA caches ([bd891f5](https://github.com/invertase/react-native-firebase/commit/bd891f5f8955c8c08d9d9447f2442beda91c9174))
+
 ## [26.3.3](https://github.com/invertase/react-native-firebase/compare/v26.3.2...v26.3.3) (2026-09-01)
 
 ### Bug Fixes

package/RNFBAuth.podspec

@@ -33,7 +33,7 @@ Pod::Spec.new do |s|
     'ios/RNFBAuth/RNFBAuthModule.h',
     'ios/generated/**/*.h',
   ]
-  s.exclude_files       = 'ios/generated/RCTThirdPartyComponentsProvider.*', 'ios/generated/RCTAppDependencyProvider.*', 'ios/generated/RCTModuleProviders.*', 'ios/generated/RCTModulesConformingToProtocolsProvider.*', 'ios/generated/RCTUnstableModulesRequiringMainQueueSetupProvider.*'
+  s.exclude_files       = 'ios/generated/RCTThirdPartyComponentsProvider.*', 'ios/generated/RCTAppDependencyProvider.*', 'ios/generated/RCTModuleProviders.*', 'ios/generated/RCTModulesConformingToProtocolsProvider.*', 'ios/generated/RCTUnstableModulesRequiringMainQueueSetupProvider.*', 'ios/*UnitTests/**'
 
   s.pod_target_xcconfig = {
     "HEADER_SEARCH_PATHS" => "\"$(PODS_TARGET_SRCROOT)/ios/generated/RNFBAuthTurboModules\" \"$(PODS_TARGET_SRCROOT)/ios/generated\"",

package/android/build.gradle

@@ -91,6 +91,8 @@ dependencies {
   api appProject
   implementation platform("com.google.firebase:firebase-bom:${ReactNative.ext.getVersion("firebase", "bom")}")
   implementation "com.google.firebase:firebase-auth"
+
+  testImplementation "junit:junit:4.13.2"
 }
 
 ReactNative.shared.applyPackageVersion()

package/android/src/main/java/io/invertase/firebase/auth/AuthListenerHandle.java

@@ -0,0 +1,26 @@
+package io.invertase.firebase.auth;
+
+/*
+ * Copyright (c) 2016-present Invertase Limited & Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this library except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+/**
+ * Detach surface stored in {@link RNFBAuthListenerRegistry}. Invoked after {@code get}/{@code
+ * take}/{@code takeAll}, never under the HandleMap lock.
+ */
+interface AuthListenerHandle {
+  void remove();
+}

package/android/src/main/java/io/invertase/firebase/auth/NativeRNFBTurboAuth.java

@@ -84,7 +84,6 @@ import java.text.SimpleDateFormat;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.HashMap;
-import java.util.Iterator;
 import java.util.List;
 import java.util.Locale;
 import java.util.Map;
@@ -104,21 +103,23 @@ public class NativeRNFBTurboAuth extends NativeRNFBTurboAuthSpec {
       new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ssZ");
 
   private static final String TAG = "Auth";
-  private static HashMap<String, FirebaseAuth.AuthStateListener> mAuthListeners = new HashMap<>();
-  private static HashMap<String, FirebaseAuth.IdTokenListener> mIdTokenListeners = new HashMap<>();
+  private static final RNFBAuthListenerRegistry authStateListeners = new RNFBAuthListenerRegistry();
+  private static final RNFBAuthListenerRegistry idTokenListeners = new RNFBAuthListenerRegistry();
   private static HashMap<String, String> emulatorConfigs = new HashMap<>();
   private String mVerificationId;
   private String mLastPhoneNumber;
   private PhoneAuthProvider.ForceResendingToken mForceResendingToken;
   private PhoneAuthCredential mCredential;
 
-  private final HashMap<String, MultiFactorResolver> mCachedResolvers = new HashMap<>();
-  private final HashMap<String, MultiFactorSession> mMultiFactorSessions = new HashMap<>();
-  private final HashMap<String, TotpSecret> mTotpSecrets = new HashMap<>();
+  private final RNFBAuthCacheRegistry<MultiFactorResolver> mCachedResolvers =
+      new RNFBAuthCacheRegistry<>();
+  private final RNFBAuthCacheRegistry<MultiFactorSession> mMultiFactorSessions =
+      new RNFBAuthCacheRegistry<>();
+  private final RNFBAuthCacheRegistry<TotpSecret> mTotpSecrets = new RNFBAuthCacheRegistry<>();
 
   // storage for anonymous phone auth credentials, used for linkWithCredentials
   // https://github.com/invertase/react-native-firebase/issues/4911
-  private HashMap<String, AuthCredential> credentials = new HashMap<>();
+  private final RNFBAuthCacheRegistry<AuthCredential> credentials = new RNFBAuthCacheRegistry<>();
 
   private final TaskExecutorService executorService;
 
@@ -142,34 +143,13 @@ public class NativeRNFBTurboAuth extends NativeRNFBTurboAuthSpec {
     super.invalidate();
     Log.d(TAG, "instance-destroyed");
 
-    Iterator authListenerIterator = mAuthListeners.entrySet().iterator();
-
-    while (authListenerIterator.hasNext()) {
-      Map.Entry pair = (Map.Entry) authListenerIterator.next();
-      String appName = (String) pair.getKey();
-      FirebaseApp firebaseApp = FirebaseApp.getInstance(appName);
-      FirebaseAuth firebaseAuth = FirebaseAuth.getInstance(firebaseApp);
-      FirebaseAuth.AuthStateListener mAuthListener =
-          (FirebaseAuth.AuthStateListener) pair.getValue();
-      firebaseAuth.removeAuthStateListener(mAuthListener);
-      authListenerIterator.remove();
-    }
-
-    Iterator idTokenListenerIterator = mIdTokenListeners.entrySet().iterator();
-
-    while (idTokenListenerIterator.hasNext()) {
-      Map.Entry pair = (Map.Entry) idTokenListenerIterator.next();
-      String appName = (String) pair.getKey();
-      FirebaseApp firebaseApp = FirebaseApp.getInstance(appName);
-      FirebaseAuth firebaseAuth = FirebaseAuth.getInstance(firebaseApp);
-      FirebaseAuth.IdTokenListener mAuthListener = (FirebaseAuth.IdTokenListener) pair.getValue();
-      firebaseAuth.removeIdTokenListener(mAuthListener);
-      idTokenListenerIterator.remove();
-    }
+    authStateListeners.takeAllAndRemove();
+    idTokenListeners.takeAllAndRemove();
 
     mCachedResolvers.clear();
     mMultiFactorSessions.clear();
     mTotpSecrets.clear();
+    // credentials intentionally not cleared (prior HashMap behavior)
   }
 
   @Override
@@ -199,46 +179,39 @@ public class NativeRNFBTurboAuth extends NativeRNFBTurboAuthSpec {
 
     FirebaseApp firebaseApp = FirebaseApp.getInstance(appName);
     FirebaseAuth firebaseAuth = FirebaseAuth.getInstance(firebaseApp);
-    FirebaseAuth.AuthStateListener mAuthListener = mAuthListeners.get(appName);
-    if (mAuthListener == null) {
-      FirebaseAuth.AuthStateListener newAuthListener =
-          firebaseAuth1 -> {
-            FirebaseUser user = firebaseAuth1.getCurrentUser();
-            WritableMap eventBody = Arguments.createMap();
-            ReactNativeFirebaseEventEmitter emitter =
-                ReactNativeFirebaseEventEmitter.getSharedInstance();
-            if (user != null) {
-              eventBody.putString("appName", appName); // for js side distribution
-              eventBody.putMap("user", firebaseUserToMap(user));
-            } else {
-              eventBody.putString("appName", appName); // for js side distribution
-            }
-            Log.d(TAG, "addAuthStateListener:eventBody " + eventBody.toString());
+    if (authStateListeners.get(appName) != null) {
+      return;
+    }
 
-            ReactNativeFirebaseEvent event =
-                new ReactNativeFirebaseEvent("auth_state_changed", eventBody, appName);
-            emitter.sendEvent(event);
-          };
+    FirebaseAuth.AuthStateListener newAuthListener =
+        firebaseAuth1 -> {
+          FirebaseUser user = firebaseAuth1.getCurrentUser();
+          WritableMap eventBody = Arguments.createMap();
+          ReactNativeFirebaseEventEmitter emitter =
+              ReactNativeFirebaseEventEmitter.getSharedInstance();
+          if (user != null) {
+            eventBody.putString("appName", appName); // for js side distribution
+            eventBody.putMap("user", firebaseUserToMap(user));
+          } else {
+            eventBody.putString("appName", appName); // for js side distribution
+          }
+          Log.d(TAG, "addAuthStateListener:eventBody " + eventBody.toString());
 
-      firebaseAuth.addAuthStateListener(newAuthListener);
-      mAuthListeners.put(appName, newAuthListener);
-    }
+          ReactNativeFirebaseEvent event =
+              new ReactNativeFirebaseEvent("auth_state_changed", eventBody, appName);
+          emitter.sendEvent(event);
+        };
+
+    firebaseAuth.addAuthStateListener(newAuthListener);
+    authStateListeners.putOrDiscard(
+        appName, () -> firebaseAuth.removeAuthStateListener(newAuthListener));
   }
 
   /** Removes the current auth state listener */
   @Override
   public void removeAuthStateListener(String appName) {
     Log.d(TAG, "removeAuthStateListener");
-
-    FirebaseApp firebaseApp = FirebaseApp.getInstance(appName);
-    FirebaseAuth firebaseAuth = FirebaseAuth.getInstance(firebaseApp);
-
-    FirebaseAuth.AuthStateListener mAuthListener = mAuthListeners.get(appName);
-
-    if (mAuthListener != null) {
-      firebaseAuth.removeAuthStateListener(mAuthListener);
-      mAuthListeners.remove(appName);
-    }
+    authStateListeners.takeAndRemove(appName);
   }
 
   /** Add a new id token listener - if one doesn't exist already */
@@ -249,46 +222,40 @@ public class NativeRNFBTurboAuth extends NativeRNFBTurboAuthSpec {
     FirebaseApp firebaseApp = FirebaseApp.getInstance(appName);
     FirebaseAuth firebaseAuth = FirebaseAuth.getInstance(firebaseApp);
 
-    if (!mIdTokenListeners.containsKey(appName)) {
-      FirebaseAuth.IdTokenListener newIdTokenListener =
-          firebaseAuth1 -> {
-            FirebaseUser user = firebaseAuth1.getCurrentUser();
-            ReactNativeFirebaseEventEmitter emitter =
-                ReactNativeFirebaseEventEmitter.getSharedInstance();
-            WritableMap eventBody = Arguments.createMap();
-            if (user != null) {
-              eventBody.putBoolean("authenticated", true);
-              eventBody.putString("appName", appName);
-              eventBody.putMap("user", firebaseUserToMap(user));
-            } else {
-              eventBody.putString("appName", appName);
-              eventBody.putBoolean("authenticated", false);
-            }
+    if (idTokenListeners.get(appName) != null) {
+      return;
+    }
 
-            ReactNativeFirebaseEvent event =
-                new ReactNativeFirebaseEvent("auth_id_token_changed", eventBody, appName);
-            emitter.sendEvent(event);
-          };
+    FirebaseAuth.IdTokenListener newIdTokenListener =
+        firebaseAuth1 -> {
+          FirebaseUser user = firebaseAuth1.getCurrentUser();
+          ReactNativeFirebaseEventEmitter emitter =
+              ReactNativeFirebaseEventEmitter.getSharedInstance();
+          WritableMap eventBody = Arguments.createMap();
+          if (user != null) {
+            eventBody.putBoolean("authenticated", true);
+            eventBody.putString("appName", appName);
+            eventBody.putMap("user", firebaseUserToMap(user));
+          } else {
+            eventBody.putString("appName", appName);
+            eventBody.putBoolean("authenticated", false);
+          }
 
-      firebaseAuth.addIdTokenListener(newIdTokenListener);
-      mIdTokenListeners.put(appName, newIdTokenListener);
-    }
+          ReactNativeFirebaseEvent event =
+              new ReactNativeFirebaseEvent("auth_id_token_changed", eventBody, appName);
+          emitter.sendEvent(event);
+        };
+
+    firebaseAuth.addIdTokenListener(newIdTokenListener);
+    idTokenListeners.putOrDiscard(
+        appName, () -> firebaseAuth.removeIdTokenListener(newIdTokenListener));
   }
 
   /** Removes the current id token listener */
   @Override
   public void removeIdTokenListener(String appName) {
     Log.d(TAG, "removeIdTokenListener");
-
-    FirebaseApp firebaseApp = FirebaseApp.getInstance(appName);
-    FirebaseAuth firebaseAuth = FirebaseAuth.getInstance(firebaseApp);
-
-    FirebaseAuth.IdTokenListener mIdTokenListener = mIdTokenListeners.get(appName);
-
-    if (mIdTokenListener != null) {
-      firebaseAuth.removeIdTokenListener(mIdTokenListener);
-      mIdTokenListeners.remove(appName);
-    }
+    idTokenListeners.takeAndRemove(appName);
   }
 
   /**
@@ -1152,7 +1119,7 @@ public class NativeRNFBTurboAuth extends NativeRNFBTurboAuthSpec {
 
               final MultiFactorSession session = task.getResult();
               final String sessionId = Integer.toString(session.hashCode());
-              mMultiFactorSessions.put(sessionId, session);
+              mMultiFactorSessions.putReplacing(sessionId, session);
 
               promise.resolve(sessionId);
             });
@@ -1493,7 +1460,7 @@ public class NativeRNFBTurboAuth extends NativeRNFBTurboAuthSpec {
               if (task.isSuccessful()) {
                 TotpSecret totpSecret = task.getResult();
                 String totpSecretKey = totpSecret.getSharedSecretKey();
-                mTotpSecrets.put(totpSecretKey, totpSecret);
+                mTotpSecrets.putReplacing(totpSecretKey, totpSecret);
                 WritableMap result = Arguments.createMap();
                 result.putString("secretKey", totpSecretKey);
                 promise.resolve(result);
@@ -2061,8 +2028,9 @@ public class NativeRNFBTurboAuth extends NativeRNFBTurboAuthSpec {
     if (provider.startsWith("oidc.")) {
       return OAuthProvider.newCredentialBuilder(provider).setIdToken(authToken).build();
     }
-    if (credentials.containsKey(authToken) && credentials.get(authToken) != null) {
-      return credentials.get(authToken);
+    AuthCredential cachedCredential = credentials.get(authToken);
+    if (cachedCredential != null) {
+      return cachedCredential;
     }
 
     switch (provider) {
@@ -2463,7 +2431,7 @@ public class NativeRNFBTurboAuth extends NativeRNFBTurboAuthSpec {
     authCredentialsMap.putString("secret", null);
 
     // Temporarily store the non-serializable credential for later
-    credentials.put(authHashCode, authCredential);
+    credentials.putReplacing(authHashCode, authCredential);
 
     WritableMap userInfoMap = Arguments.createMap();
     userInfoMap.putString("code", error.getString("code"));
@@ -2565,7 +2533,7 @@ public class NativeRNFBTurboAuth extends NativeRNFBTurboAuthSpec {
       code = "MULTI_FACTOR_AUTH_REQUIRED";
       final MultiFactorResolver resolver = multiFactorException.getResolver();
       final String sessionId = Integer.toString(resolver.getSession().hashCode());
-      mCachedResolvers.put(sessionId, resolver);
+      mCachedResolvers.putReplacing(sessionId, resolver);
       // Passing around a resolver ReadableMap leads to issues when trying to send the data back by
       // calling Promise#reject. Building the map just before sending solves that issue.
       error.putString("sessionId", sessionId);

package/android/src/main/java/io/invertase/firebase/auth/RNFBAuthCacheRegistry.java

@@ -0,0 +1,66 @@
+package io.invertase.firebase.auth;
+
+/*
+ * Copyright (c) 2016-present Invertase Limited & Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this library except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+import io.invertase.firebase.common.RNFBHandleCollisionException;
+import io.invertase.firebase.common.RNFBHandleMap;
+
+/**
+ * Credential / MFA cache map (data only — no SDK cancel). Unique {@link #put}; callers that
+ * previously HashMap-upserted use {@link #putReplacing} (atomic last wins). Peek with {@link #get};
+ * remove with {@link #take}; invalidate with {@link #clear}.
+ *
+ * <p><strong>Collision vs prior HashMap.put upsert:</strong> unique {@link #put} throws; replace at
+ * call sites is {@link #putReplacing} (last wins). {@link #putOrDiscard} keeps the first mapping.
+ */
+final class RNFBAuthCacheRegistry<V> {
+  private final RNFBHandleMap<String, V> map = new RNFBHandleMap<>();
+
+  void put(String key, V value) throws RNFBHandleCollisionException {
+    map.put(key, value);
+  }
+
+  /**
+   * Unique put. On collision, leave the existing mapping and discard the incoming value (data
+   * only).
+   *
+   * @return true if stored
+   */
+  boolean putOrDiscard(String key, V value) {
+    return map.putIfAbsent(key, value);
+  }
+
+  /**
+   * Atomic replace (last wins). Preserves prior HashMap {@code put} upsert. Taken value discarded.
+   */
+  void putReplacing(String key, V value) {
+    map.putReplacing(key, value);
+  }
+
+  V get(String key) {
+    return map.get(key);
+  }
+
+  V take(String key) {
+    return map.take(key);
+  }
+
+  void clear() {
+    map.takeAll();
+  }
+}

package/android/src/main/java/io/invertase/firebase/auth/RNFBAuthListenerRegistry.java

@@ -0,0 +1,76 @@
+package io.invertase.firebase.auth;
+
+/*
+ * Copyright (c) 2016-present Invertase Limited & Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this library except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+import io.invertase.firebase.common.RNFBHandleCollisionException;
+import io.invertase.firebase.common.RNFBHandleMap;
+import java.util.List;
+
+/**
+ * Auth-state / id-token listener map. Unique {@link #put} / {@link #putOrDiscard}; callers {@link
+ * #take} or {@link #takeAllAndRemove} then {@code remove()} outside the HandleMap lock.
+ * Skip-if-registered is {@code get(appName) != null}.
+ */
+final class RNFBAuthListenerRegistry {
+  private final RNFBHandleMap<String, AuthListenerHandle> map = new RNFBHandleMap<>();
+
+  void put(String appName, AuthListenerHandle handle) throws RNFBHandleCollisionException {
+    map.put(appName, handle);
+  }
+
+  /**
+   * Unique put. On collision, {@code remove()} the incoming handle and leave the existing mapping.
+   *
+   * @return true if stored
+   */
+  boolean putOrDiscard(String appName, AuthListenerHandle handle) {
+    try {
+      map.put(appName, handle);
+      return true;
+    } catch (RNFBHandleCollisionException collision) {
+      if (handle != null) {
+        handle.remove();
+      }
+      return false;
+    }
+  }
+
+  AuthListenerHandle get(String appName) {
+    return map.get(appName);
+  }
+
+  AuthListenerHandle take(String appName) {
+    return map.take(appName);
+  }
+
+  void takeAndRemove(String appName) {
+    AuthListenerHandle handle = map.take(appName);
+    if (handle != null) {
+      handle.remove();
+    }
+  }
+
+  void takeAllAndRemove() {
+    List<AuthListenerHandle> remaining = map.takeAll();
+    for (AuthListenerHandle handle : remaining) {
+      if (handle != null) {
+        handle.remove();
+      }
+    }
+  }
+}

package/android/src/test/java/io/invertase/firebase/auth/RNFBAuthCacheRegistryTest.java

@@ -0,0 +1,172 @@
+package io.invertase.firebase.auth;
+
+/*
+ * Copyright (c) 2016-present Invertase Limited & Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this library except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertSame;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+
+import io.invertase.firebase.common.RNFBHandleCollisionException;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicReference;
+import org.junit.Test;
+
+/**
+ * JVM coverage for {@link RNFBAuthCacheRegistry}. Does not instantiate {@code NativeRNFBTurboAuth}
+ * (React Native / Firebase) — D12.
+ */
+public class RNFBAuthCacheRegistryTest {
+
+  @Test
+  public void putGetTake_happyPath() throws Exception {
+    RNFBAuthCacheRegistry<String> registry = new RNFBAuthCacheRegistry<>();
+    registry.put("k1", "payload");
+    assertSame("payload", registry.get("k1"));
+    assertSame("payload", registry.take("k1"));
+    assertNull(registry.get("k1"));
+  }
+
+  @Test
+  public void put_occupiedId_throwsCollision() throws Exception {
+    RNFBAuthCacheRegistry<String> registry = new RNFBAuthCacheRegistry<>();
+    registry.put("k1", "first");
+    try {
+      registry.put("k1", "second");
+      fail("expected RNFBHandleCollisionException");
+    } catch (RNFBHandleCollisionException e) {
+      assertTrue(e.getMessage().contains("k1"));
+      assertSame("first", registry.get("k1"));
+    }
+  }
+
+  @Test
+  public void get_whenFree_isNull() {
+    RNFBAuthCacheRegistry<String> registry = new RNFBAuthCacheRegistry<>();
+    assertNull(registry.get("missing"));
+  }
+
+  @Test
+  public void take_whenFree_isNull() {
+    RNFBAuthCacheRegistry<String> registry = new RNFBAuthCacheRegistry<>();
+    assertNull(registry.take("missing"));
+  }
+
+  @Test
+  public void putOrDiscard_storesWhenFree() {
+    RNFBAuthCacheRegistry<String> registry = new RNFBAuthCacheRegistry<>();
+    assertTrue(registry.putOrDiscard("k1", "payload"));
+    assertSame("payload", registry.get("k1"));
+  }
+
+  @Test
+  public void putOrDiscard_collision_keepsExisting() throws Exception {
+    RNFBAuthCacheRegistry<String> registry = new RNFBAuthCacheRegistry<>();
+    registry.put("k1", "first");
+    assertFalse(registry.putOrDiscard("k1", "second"));
+    assertSame("first", registry.get("k1"));
+  }
+
+  @Test
+  public void putReplacing_whenFree_stores() {
+    RNFBAuthCacheRegistry<String> registry = new RNFBAuthCacheRegistry<>();
+    registry.putReplacing("k1", "payload");
+    assertSame("payload", registry.get("k1"));
+  }
+
+  @Test
+  public void putReplacing_whenOccupied_replacesLastWins() throws Exception {
+    RNFBAuthCacheRegistry<String> registry = new RNFBAuthCacheRegistry<>();
+    registry.put("k1", "first");
+    registry.putReplacing("k1", "second");
+    assertSame("second", registry.get("k1"));
+  }
+
+  @Test
+  public void putReplacing_sameIdFromTwoThreads_lastWins() throws Exception {
+    RNFBAuthCacheRegistry<String> registry = new RNFBAuthCacheRegistry<>();
+    registry.put("k1", "first");
+
+    CountDownLatch start = new CountDownLatch(1);
+    CountDownLatch done = new CountDownLatch(2);
+    AtomicReference<String> winner = new AtomicReference<>();
+
+    Thread t1 =
+        new Thread(
+            () -> {
+              try {
+                start.await();
+                registry.putReplacing("k1", "second");
+                winner.compareAndSet(null, registry.get("k1"));
+              } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
+              } finally {
+                done.countDown();
+              }
+            });
+    Thread t2 =
+        new Thread(
+            () -> {
+              try {
+                start.await();
+                registry.putReplacing("k1", "third");
+                winner.compareAndSet(null, registry.get("k1"));
+              } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
+              } finally {
+                done.countDown();
+              }
+            });
+
+    t1.start();
+    t2.start();
+    start.countDown();
+    assertTrue(done.await(5, TimeUnit.SECONDS));
+
+    String stored = registry.get("k1");
+    assertTrue(stored == "second" || stored == "third");
+  }
+
+  @Test
+  public void put_afterTake_allowsReuse() throws Exception {
+    RNFBAuthCacheRegistry<String> registry = new RNFBAuthCacheRegistry<>();
+    registry.put("k1", "first");
+    assertSame("first", registry.take("k1"));
+    registry.put("k1", "second");
+    assertSame("second", registry.get("k1"));
+  }
+
+  @Test
+  public void clear_removesAll() throws Exception {
+    RNFBAuthCacheRegistry<String> registry = new RNFBAuthCacheRegistry<>();
+    registry.put("a", "1");
+    registry.put("b", "2");
+    registry.clear();
+    assertNull(registry.get("a"));
+    assertNull(registry.get("b"));
+  }
+
+  @Test
+  public void clear_empty_isNoOp() {
+    RNFBAuthCacheRegistry<String> registry = new RNFBAuthCacheRegistry<>();
+    registry.clear();
+    assertNull(registry.get("k1"));
+  }
+}