@react-native-firebase/auth 26.3.3 → 27.0.0

package/CHANGELOG.md

@@ -3,6 +3,33 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [27.0.0](https://github.com/invertase/react-native-firebase/compare/v26.4.0...v27.0.0) (2026-10-19)
+
+### ⚠ BREAKING CHANGES
+
+- **app, sdk:** bump Firebase Android 35, Apple 13, and JS 13
+
+### Features
+
+- **app, sdk:** bump Firebase Android 35, Apple 13, and JS 13 ([0ca03d1](https://github.com/invertase/react-native-firebase/commit/0ca03d11b0c271fb37cfbee8a0c3074a21969f0b))
+
+### Bug Fixes
+
+- **app,database:** resolve platform native module when bundlers apply package exports ([959d91f](https://github.com/invertase/react-native-firebase/commit/959d91fc79d7155d1d9a08e1f836789e6e6d6156))
+- **auth, analytics, remote-config:** unwrap iOS null sentinels on Object args ([53fdb6a](https://github.com/invertase/react-native-firebase/commit/53fdb6a1c273d4125cff69e33b2d0af6bfd7d6dc))
+- **auth, android:** accept null keys in auth cache registry get/take ([211c6cf](https://github.com/invertase/react-native-firebase/commit/211c6cff37c004c06134242cf84e670afd52eff5))
+- **auth:** apply the reCAPTCHA openURL fix on the UIScene life cycle ([327fbe3](https://github.com/invertase/react-native-firebase/commit/327fbe319ba238c4f50aadc85ed687225b0804c8))
+- **auth:** remove sensitive authentication logs ([57c5d1c](https://github.com/invertase/react-native-firebase/commit/57c5d1c993e8497148cd40a706fb40ebe01426ef))
+
+## [26.4.0](https://github.com/invertase/react-native-firebase/compare/v26.3.3...v26.4.0) (2026-09-05)
+
+### Bug Fixes
+
+- **auth, ios:** look up customAuthDomains with JS app name ([9873f61](https://github.com/invertase/react-native-firebase/commit/9873f618a972c3324ec05b9e30f5aaefa7ab163b))
+- **auth:** [LOW] handle malformed action links ([0961ccc](https://github.com/invertase/react-native-firebase/commit/0961ccc1108195c40fbb00ba38280f70f1419fbe))
+- **auth:** use RNFBHandleMap for auth state and id-token listeners ([a708e84](https://github.com/invertase/react-native-firebase/commit/a708e847119995b8cfbde07f11ea84d48aede29b))
+- **auth:** use RNFBHandleMap for credential and MFA caches ([bd891f5](https://github.com/invertase/react-native-firebase/commit/bd891f5f8955c8c08d9d9447f2442beda91c9174))
+
 ## [26.3.3](https://github.com/invertase/react-native-firebase/compare/v26.3.2...v26.3.3) (2026-09-01)
 
 ### Bug Fixes

package/RNFBAuth.podspec

@@ -28,14 +28,20 @@ Pod::Spec.new do |s|
   s.ios.deployment_target = firebase_ios_target
   s.macos.deployment_target = firebase_macos_target
   s.tvos.deployment_target = firebase_tvos_target
-  s.source_files        = 'ios/**/*.{h,m,mm,cpp}'
+  s.swift_version       = '5.10'
+  s.source_files        = 'ios/**/*.{h,m,mm,cpp,swift}'
   s.private_header_files = [
     'ios/RNFBAuth/RNFBAuthModule.h',
+    'ios/RNFBAuth/RNFBAuthNullSentinelDecoder.h',
     'ios/generated/**/*.h',
   ]
-  s.exclude_files       = 'ios/generated/RCTThirdPartyComponentsProvider.*', 'ios/generated/RCTAppDependencyProvider.*', 'ios/generated/RCTModuleProviders.*', 'ios/generated/RCTModulesConformingToProtocolsProvider.*', 'ios/generated/RCTUnstableModulesRequiringMainQueueSetupProvider.*'
+  # CocoaPods FileList uses FNM_PATHNAME: `ios/*UnitTests/**` does not match nested
+  # paths like `ios/RNFBAuthUnitTests/HostStubs/**` (those would compile into the pod).
+  s.exclude_files       = 'ios/generated/RCTThirdPartyComponentsProvider.*', 'ios/generated/RCTAppDependencyProvider.*', 'ios/generated/RCTModuleProviders.*', 'ios/generated/RCTModulesConformingToProtocolsProvider.*', 'ios/generated/RCTUnstableModulesRequiringMainQueueSetupProvider.*', 'ios/*UnitTests/**/*'
 
+  # DEFINES_MODULE is required for the generated RNFBAuth-Swift.h interface.
   s.pod_target_xcconfig = {
+    "DEFINES_MODULE" => "YES",
     "HEADER_SEARCH_PATHS" => "\"$(PODS_TARGET_SRCROOT)/ios/generated/RNFBAuthTurboModules\" \"$(PODS_TARGET_SRCROOT)/ios/generated\"",
     "CLANG_ALLOW_NON_MODULAR_INCLUDES_IN_FRAMEWORK_MODULES" => "YES",
   }

package/android/build.gradle

@@ -13,6 +13,7 @@ buildscript {
 
     dependencies {
       classpath("com.android.tools.build:gradle:8.4.0")
+      classpath("org.jetbrains.kotlin:kotlin-gradle-plugin:${project.findProperty('kotlinVersion') ?: '2.4.0'}")
     }
   }
 }
@@ -21,6 +22,8 @@ plugins {
   id "io.invertase.gradle.build" version "1.5"
 }
 
+apply plugin: "org.jetbrains.kotlin.android"
+
 def appProject
 if (findProject(':@react-native-firebase_app')) {
   appProject = project(':@react-native-firebase_app')
@@ -91,6 +94,8 @@ dependencies {
   api appProject
   implementation platform("com.google.firebase:firebase-bom:${ReactNative.ext.getVersion("firebase", "bom")}")
   implementation "com.google.firebase:firebase-auth"
+
+  testImplementation "junit:junit:4.13.2"
 }
 
 ReactNative.shared.applyPackageVersion()

package/android/src/main/java/io/invertase/firebase/auth/AuthListenerHandle.java

@@ -0,0 +1,26 @@
+package io.invertase.firebase.auth;
+
+/*
+ * Copyright (c) 2016-present Invertase Limited & Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this library except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+/**
+ * Detach surface stored in {@link RNFBAuthListenerRegistry}. Invoked after {@code get}/{@code
+ * take}/{@code takeAll}, never under the HandleMap lock.
+ */
+interface AuthListenerHandle {
+  void remove();
+}

package/android/src/main/java/io/invertase/firebase/auth/NativeRNFBTurboAuth.java

@@ -84,7 +84,6 @@ import java.text.SimpleDateFormat;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.HashMap;
-import java.util.Iterator;
 import java.util.List;
 import java.util.Locale;
 import java.util.Map;
@@ -104,21 +103,23 @@ public class NativeRNFBTurboAuth extends NativeRNFBTurboAuthSpec {
       new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ssZ");
 
   private static final String TAG = "Auth";
-  private static HashMap<String, FirebaseAuth.AuthStateListener> mAuthListeners = new HashMap<>();
-  private static HashMap<String, FirebaseAuth.IdTokenListener> mIdTokenListeners = new HashMap<>();
+  private static final RNFBAuthListenerRegistry authStateListeners = new RNFBAuthListenerRegistry();
+  private static final RNFBAuthListenerRegistry idTokenListeners = new RNFBAuthListenerRegistry();
   private static HashMap<String, String> emulatorConfigs = new HashMap<>();
   private String mVerificationId;
   private String mLastPhoneNumber;
   private PhoneAuthProvider.ForceResendingToken mForceResendingToken;
   private PhoneAuthCredential mCredential;
 
-  private final HashMap<String, MultiFactorResolver> mCachedResolvers = new HashMap<>();
-  private final HashMap<String, MultiFactorSession> mMultiFactorSessions = new HashMap<>();
-  private final HashMap<String, TotpSecret> mTotpSecrets = new HashMap<>();
+  private final RNFBAuthCacheRegistry<MultiFactorResolver> mCachedResolvers =
+      new RNFBAuthCacheRegistry<>();
+  private final RNFBAuthCacheRegistry<MultiFactorSession> mMultiFactorSessions =
+      new RNFBAuthCacheRegistry<>();
+  private final RNFBAuthCacheRegistry<TotpSecret> mTotpSecrets = new RNFBAuthCacheRegistry<>();
 
   // storage for anonymous phone auth credentials, used for linkWithCredentials
   // https://github.com/invertase/react-native-firebase/issues/4911
-  private HashMap<String, AuthCredential> credentials = new HashMap<>();
+  private final RNFBAuthCacheRegistry<AuthCredential> credentials = new RNFBAuthCacheRegistry<>();
 
   private final TaskExecutorService executorService;
 
@@ -142,34 +143,13 @@ public class NativeRNFBTurboAuth extends NativeRNFBTurboAuthSpec {
     super.invalidate();
     Log.d(TAG, "instance-destroyed");
 
-    Iterator authListenerIterator = mAuthListeners.entrySet().iterator();
-
-    while (authListenerIterator.hasNext()) {
-      Map.Entry pair = (Map.Entry) authListenerIterator.next();
-      String appName = (String) pair.getKey();
-      FirebaseApp firebaseApp = FirebaseApp.getInstance(appName);
-      FirebaseAuth firebaseAuth = FirebaseAuth.getInstance(firebaseApp);
-      FirebaseAuth.AuthStateListener mAuthListener =
-          (FirebaseAuth.AuthStateListener) pair.getValue();
-      firebaseAuth.removeAuthStateListener(mAuthListener);
-      authListenerIterator.remove();
-    }
-
-    Iterator idTokenListenerIterator = mIdTokenListeners.entrySet().iterator();
-
-    while (idTokenListenerIterator.hasNext()) {
-      Map.Entry pair = (Map.Entry) idTokenListenerIterator.next();
-      String appName = (String) pair.getKey();
-      FirebaseApp firebaseApp = FirebaseApp.getInstance(appName);
-      FirebaseAuth firebaseAuth = FirebaseAuth.getInstance(firebaseApp);
-      FirebaseAuth.IdTokenListener mAuthListener = (FirebaseAuth.IdTokenListener) pair.getValue();
-      firebaseAuth.removeIdTokenListener(mAuthListener);
-      idTokenListenerIterator.remove();
-    }
+    authStateListeners.takeAllAndRemove();
+    idTokenListeners.takeAllAndRemove();
 
     mCachedResolvers.clear();
     mMultiFactorSessions.clear();
     mTotpSecrets.clear();
+    // credentials intentionally not cleared (prior HashMap behavior)
   }
 
   @Override
@@ -199,46 +179,37 @@ public class NativeRNFBTurboAuth extends NativeRNFBTurboAuthSpec {
 
     FirebaseApp firebaseApp = FirebaseApp.getInstance(appName);
     FirebaseAuth firebaseAuth = FirebaseAuth.getInstance(firebaseApp);
-    FirebaseAuth.AuthStateListener mAuthListener = mAuthListeners.get(appName);
-    if (mAuthListener == null) {
-      FirebaseAuth.AuthStateListener newAuthListener =
-          firebaseAuth1 -> {
-            FirebaseUser user = firebaseAuth1.getCurrentUser();
-            WritableMap eventBody = Arguments.createMap();
-            ReactNativeFirebaseEventEmitter emitter =
-                ReactNativeFirebaseEventEmitter.getSharedInstance();
-            if (user != null) {
-              eventBody.putString("appName", appName); // for js side distribution
-              eventBody.putMap("user", firebaseUserToMap(user));
-            } else {
-              eventBody.putString("appName", appName); // for js side distribution
-            }
-            Log.d(TAG, "addAuthStateListener:eventBody " + eventBody.toString());
+    if (authStateListeners.get(appName) != null) {
+      return;
+    }
 
-            ReactNativeFirebaseEvent event =
-                new ReactNativeFirebaseEvent("auth_state_changed", eventBody, appName);
-            emitter.sendEvent(event);
-          };
+    FirebaseAuth.AuthStateListener newAuthListener =
+        firebaseAuth1 -> {
+          FirebaseUser user = firebaseAuth1.getCurrentUser();
+          WritableMap eventBody = Arguments.createMap();
+          ReactNativeFirebaseEventEmitter emitter =
+              ReactNativeFirebaseEventEmitter.getSharedInstance();
+          if (user != null) {
+            eventBody.putString("appName", appName); // for js side distribution
+            eventBody.putMap("user", firebaseUserToMap(user));
+          } else {
+            eventBody.putString("appName", appName); // for js side distribution
+          }
+          ReactNativeFirebaseEvent event =
+              new ReactNativeFirebaseEvent("auth_state_changed", eventBody, appName);
+          emitter.sendEvent(event);
+        };
 
-      firebaseAuth.addAuthStateListener(newAuthListener);
-      mAuthListeners.put(appName, newAuthListener);
-    }
+    firebaseAuth.addAuthStateListener(newAuthListener);
+    authStateListeners.putOrDiscard(
+        appName, () -> firebaseAuth.removeAuthStateListener(newAuthListener));
   }
 
   /** Removes the current auth state listener */
   @Override
   public void removeAuthStateListener(String appName) {
     Log.d(TAG, "removeAuthStateListener");
-
-    FirebaseApp firebaseApp = FirebaseApp.getInstance(appName);
-    FirebaseAuth firebaseAuth = FirebaseAuth.getInstance(firebaseApp);
-
-    FirebaseAuth.AuthStateListener mAuthListener = mAuthListeners.get(appName);
-
-    if (mAuthListener != null) {
-      firebaseAuth.removeAuthStateListener(mAuthListener);
-      mAuthListeners.remove(appName);
-    }
+    authStateListeners.takeAndRemove(appName);
   }
 
   /** Add a new id token listener - if one doesn't exist already */
@@ -249,46 +220,40 @@ public class NativeRNFBTurboAuth extends NativeRNFBTurboAuthSpec {
     FirebaseApp firebaseApp = FirebaseApp.getInstance(appName);
     FirebaseAuth firebaseAuth = FirebaseAuth.getInstance(firebaseApp);
 
-    if (!mIdTokenListeners.containsKey(appName)) {
-      FirebaseAuth.IdTokenListener newIdTokenListener =
-          firebaseAuth1 -> {
-            FirebaseUser user = firebaseAuth1.getCurrentUser();
-            ReactNativeFirebaseEventEmitter emitter =
-                ReactNativeFirebaseEventEmitter.getSharedInstance();
-            WritableMap eventBody = Arguments.createMap();
-            if (user != null) {
-              eventBody.putBoolean("authenticated", true);
-              eventBody.putString("appName", appName);
-              eventBody.putMap("user", firebaseUserToMap(user));
-            } else {
-              eventBody.putString("appName", appName);
-              eventBody.putBoolean("authenticated", false);
-            }
+    if (idTokenListeners.get(appName) != null) {
+      return;
+    }
 
-            ReactNativeFirebaseEvent event =
-                new ReactNativeFirebaseEvent("auth_id_token_changed", eventBody, appName);
-            emitter.sendEvent(event);
-          };
+    FirebaseAuth.IdTokenListener newIdTokenListener =
+        firebaseAuth1 -> {
+          FirebaseUser user = firebaseAuth1.getCurrentUser();
+          ReactNativeFirebaseEventEmitter emitter =
+              ReactNativeFirebaseEventEmitter.getSharedInstance();
+          WritableMap eventBody = Arguments.createMap();
+          if (user != null) {
+            eventBody.putBoolean("authenticated", true);
+            eventBody.putString("appName", appName);
+            eventBody.putMap("user", firebaseUserToMap(user));
+          } else {
+            eventBody.putString("appName", appName);
+            eventBody.putBoolean("authenticated", false);
+          }
 
-      firebaseAuth.addIdTokenListener(newIdTokenListener);
-      mIdTokenListeners.put(appName, newIdTokenListener);
-    }
+          ReactNativeFirebaseEvent event =
+              new ReactNativeFirebaseEvent("auth_id_token_changed", eventBody, appName);
+          emitter.sendEvent(event);
+        };
+
+    firebaseAuth.addIdTokenListener(newIdTokenListener);
+    idTokenListeners.putOrDiscard(
+        appName, () -> firebaseAuth.removeIdTokenListener(newIdTokenListener));
   }
 
   /** Removes the current id token listener */
   @Override
   public void removeIdTokenListener(String appName) {
     Log.d(TAG, "removeIdTokenListener");
-
-    FirebaseApp firebaseApp = FirebaseApp.getInstance(appName);
-    FirebaseAuth firebaseAuth = FirebaseAuth.getInstance(firebaseApp);
-
-    FirebaseAuth.IdTokenListener mIdTokenListener = mIdTokenListeners.get(appName);
-
-    if (mIdTokenListener != null) {
-      firebaseAuth.removeIdTokenListener(mIdTokenListener);
-      mIdTokenListeners.remove(appName);
-    }
+    idTokenListeners.takeAndRemove(appName);
   }
 
   /**
@@ -1152,7 +1117,7 @@ public class NativeRNFBTurboAuth extends NativeRNFBTurboAuthSpec {
 
               final MultiFactorSession session = task.getResult();
               final String sessionId = Integer.toString(session.hashCode());
-              mMultiFactorSessions.put(sessionId, session);
+              mMultiFactorSessions.putReplacing(sessionId, session);
 
               promise.resolve(sessionId);
             });
@@ -1493,7 +1458,7 @@ public class NativeRNFBTurboAuth extends NativeRNFBTurboAuthSpec {
               if (task.isSuccessful()) {
                 TotpSecret totpSecret = task.getResult();
                 String totpSecretKey = totpSecret.getSharedSecretKey();
-                mTotpSecrets.put(totpSecretKey, totpSecret);
+                mTotpSecrets.putReplacing(totpSecretKey, totpSecret);
                 WritableMap result = Arguments.createMap();
                 result.putString("secretKey", totpSecretKey);
                 promise.resolve(result);
@@ -1551,7 +1516,7 @@ public class NativeRNFBTurboAuth extends NativeRNFBTurboAuthSpec {
       final String requestKey,
       final double timeout,
       final boolean forceResend) {
-    Log.d(TAG, "verifyPhoneNumber:" + phoneNumber);
+    Log.d(TAG, "verifyPhoneNumber");
 
     FirebaseApp firebaseApp = FirebaseApp.getInstance(appName);
     final FirebaseAuth firebaseAuth = FirebaseAuth.getInstance(firebaseApp);
@@ -2061,8 +2026,9 @@ public class NativeRNFBTurboAuth extends NativeRNFBTurboAuthSpec {
     if (provider.startsWith("oidc.")) {
       return OAuthProvider.newCredentialBuilder(provider).setIdToken(authToken).build();
     }
-    if (credentials.containsKey(authToken) && credentials.get(authToken) != null) {
-      return credentials.get(authToken);
+    AuthCredential cachedCredential = credentials.get(authToken);
+    if (cachedCredential != null) {
+      return cachedCredential;
     }
 
     switch (provider) {
@@ -2463,7 +2429,7 @@ public class NativeRNFBTurboAuth extends NativeRNFBTurboAuthSpec {
     authCredentialsMap.putString("secret", null);
 
     // Temporarily store the non-serializable credential for later
-    credentials.put(authHashCode, authCredential);
+    credentials.putReplacing(authHashCode, authCredential);
 
     WritableMap userInfoMap = Arguments.createMap();
     userInfoMap.putString("code", error.getString("code"));
@@ -2565,7 +2531,7 @@ public class NativeRNFBTurboAuth extends NativeRNFBTurboAuthSpec {
       code = "MULTI_FACTOR_AUTH_REQUIRED";
       final MultiFactorResolver resolver = multiFactorException.getResolver();
       final String sessionId = Integer.toString(resolver.getSession().hashCode());
-      mCachedResolvers.put(sessionId, resolver);
+      mCachedResolvers.putReplacing(sessionId, resolver);
       // Passing around a resolver ReadableMap leads to issues when trying to send the data back by
       // calling Promise#reject. Building the map just before sending solves that issue.
       error.putString("sessionId", sessionId);

package/android/src/main/java/io/invertase/firebase/auth/RNFBAuthCacheRegistry.kt

@@ -0,0 +1,77 @@
+package io.invertase.firebase.auth
+
+/*
+ * Copyright (c) 2016-present Invertase Limited & Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this library except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+import io.invertase.firebase.common.RNFBHandleCollisionException
+import io.invertase.firebase.common.RNFBHandleMap
+
+/**
+ * Credential / MFA cache map (data only — no SDK cancel). Unique [put]; callers that previously
+ * HashMap-upserted use [putReplacing] (atomic last wins). Peek with [get]; remove with [take];
+ * invalidate with [clear].
+ *
+ * Collision vs prior HashMap.put upsert: unique [put] throws; replace at call sites is
+ * [putReplacing] (last wins). [putOrDiscard] keeps the first mapping.
+ */
+internal class RNFBAuthCacheRegistry<V> {
+  private val map = RNFBHandleMap<String, V>()
+
+  @Throws(RNFBHandleCollisionException::class)
+  fun put(
+    key: String,
+    value: V,
+  ) {
+    map.put(key, value)
+  }
+
+  /**
+   * Unique put. On collision, leave the existing mapping and discard the incoming value (data
+   * only).
+   *
+   * @return true if stored
+   */
+  fun putOrDiscard(
+    key: String,
+    value: V,
+  ): Boolean = map.putIfAbsent(key, value)
+
+  /**
+   * Atomic replace (last wins). Preserves prior HashMap `put` upsert. Taken value discarded.
+   */
+  fun putReplacing(
+    key: String,
+    value: V,
+  ) {
+    map.putReplacing(key, value)
+  }
+
+  /**
+   * Peek. Nullable [key] matches prior Java `HashMap.get(null)` → null (no NPE). Java callers such
+   * as `promiseRejectAuthException` may pass a null sessionId when the error map has none.
+   */
+  fun get(key: String?): V? = if (key == null) null else map.get(key)
+
+  /**
+   * Remove. Nullable [key] matches prior Java `HashMap.remove(null)` → null (no NPE).
+   */
+  fun take(key: String?): V? = if (key == null) null else map.take(key)
+
+  fun clear() {
+    map.takeAll()
+  }
+}

package/android/src/main/java/io/invertase/firebase/auth/RNFBAuthListenerRegistry.kt

@@ -0,0 +1,76 @@
+package io.invertase.firebase.auth
+
+/*
+ * Copyright (c) 2016-present Invertase Limited & Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this library except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+import io.invertase.firebase.common.RNFBHandleCollisionException
+import io.invertase.firebase.common.RNFBHandleMap
+
+/**
+ * Auth-state / id-token listener map. Unique [put] / [putOrDiscard]; callers [take] or
+ * [takeAllAndRemove] then `remove()` outside the HandleMap lock. Skip-if-registered is
+ * `get(appName) != null`.
+ *
+ * Null-key note: [get]/[take]/[takeAndRemove] keep non-null [String] keys. Call sites always
+ * pass TurboModule `appName` (never null). Unlike [RNFBAuthCacheRegistry], no Java path passes a
+ * null lookup key.
+ */
+internal class RNFBAuthListenerRegistry {
+  private val map = RNFBHandleMap<String, AuthListenerHandle?>()
+
+  @Throws(RNFBHandleCollisionException::class)
+  fun put(
+    appName: String,
+    handle: AuthListenerHandle?,
+  ) {
+    map.put(appName, handle)
+  }
+
+  /**
+   * Unique put. On collision, `remove()` the incoming handle and leave the existing mapping.
+   *
+   * @return true if stored
+   */
+  fun putOrDiscard(
+    appName: String,
+    handle: AuthListenerHandle?,
+  ): Boolean {
+    try {
+      map.put(appName, handle)
+      return true
+    } catch (_: RNFBHandleCollisionException) {
+      handle?.remove()
+      return false
+    }
+  }
+
+  fun get(appName: String): AuthListenerHandle? = map.get(appName)
+
+  fun take(appName: String): AuthListenerHandle? = map.take(appName)
+
+  fun takeAndRemove(appName: String) {
+    val handle = map.take(appName)
+    handle?.remove()
+  }
+
+  fun takeAllAndRemove() {
+    val remaining = map.takeAll()
+    for (handle in remaining) {
+      handle?.remove()
+    }
+  }
+}