backend-manager 5.11.6 → 5.11.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend-manager",
-  "version": "5.11.6",
+  "version": "5.11.7",
   "description": "Quick tools for developing Firebase functions",
   "main": "src/manager/index.js",
   "files": [

package/src/cli/commands/serve.js

@@ -207,14 +207,61 @@ class ServeCommand extends BaseCommand {
     const certFile = certFiles.find((f) => !f.includes('-key.pem'));
 
     if (keyFile && certFile) {
-      this.log(chalk.gray('  Using existing mkcert certificates from .temp/certs/'));
-      return { key: keyFile, cert: certFile };
+      const problem = this._checkCertProblem(certFile);
+
+      if (!problem) {
+        this.log(chalk.gray('  Using existing mkcert certificates from .temp/certs/'));
+        return { key: keyFile, cert: certFile };
+      }
+
+      // Stale certs (expired, or issued by a DIFFERENT machine's mkcert CA — e.g.
+      // .temp copied over from another Mac) make browsers reject the proxy outright,
+      // so the only thing that responds is the internal plain-HTTP firebase port.
+      // Wipe and regenerate against THIS machine's trusted CA.
+      this.log(chalk.yellow(`  Existing certificates are not usable (${problem}) — regenerating...`));
+      jetpack.remove(certsDir);
+      jetpack.dir(certsDir);
     }
 
     // Try to generate with mkcert
     return this._generateMkcertCerts(certsDir);
   }
 
+  // Returns a reason string when the existing cert must be regenerated, or null
+  // when it's usable: unexpired AND signed by this machine's trusted mkcert root CA.
+  _checkCertProblem(certFile) {
+    const { X509Certificate } = require('crypto');
+    const { execSync } = require('child_process');
+
+    let cert;
+    try {
+      cert = new X509Certificate(fs.readFileSync(certFile));
+    } catch (e) {
+      return 'unreadable certificate';
+    }
+
+    if (new Date(cert.validTo) <= new Date()) {
+      return `expired ${cert.validTo}`;
+    }
+
+    // Verify the signature chains to the CURRENT mkcert root CA. If mkcert (or its
+    // root) isn't available we can't verify — keep the existing certs rather than
+    // breaking the no-mkcert fallback path.
+    try {
+      const caRoot = execSync('mkcert -CAROOT', { encoding: 'utf8' }).trim();
+      const ca = new X509Certificate(fs.readFileSync(path.join(caRoot, 'rootCA.pem')));
+
+      if (!cert.verify(ca.publicKey)) {
+        const issuerCN = cert.issuer.split('\n').find((line) => line.startsWith('CN=')) || cert.issuer;
+        return `issued by a different CA (${issuerCN})`;
+      }
+    } catch (e) {
+      return null;
+    }
+
+    return null;
+  }
+
   async _generateMkcertCerts(certsDir) {
     try {
       await powertools.execute('which mkcert', { log: false });

package/src/test/fixtures/firebase-project/.temp/test-mode.json

@@ -2,5 +2,5 @@
   "env": {
     "TEST_EXTENDED_MODE": ""
   },
-  "updatedAt": "2026-07-03T23:27:14.219Z"
+  "updatedAt": "2026-07-04T00:56:35.608Z"
 }

package/src/test/fixtures/firebase-project/database-debug.log

@@ -2,17 +2,11 @@ WARNING: A terminally deprecated method in sun.misc.Unsafe has been called
 WARNING: sun.misc.Unsafe::objectFieldOffset has been called by akka.util.Unsafe (file:/Users/ian/.cache/firebase/emulators/firebase-database-emulator-v4.11.2.jar)
 WARNING: Please consider reporting this to the maintainers of class akka.util.Unsafe
 WARNING: sun.misc.Unsafe::objectFieldOffset will be removed in a future release
-16:27:21.224 [NamespaceSystem-akka.actor.default-dispatcher-4] INFO akka.event.slf4j.Slf4jLogger - Slf4jLogger started
-16:27:21.341 [main] INFO com.firebase.server.forge.App$ - Listening at 127.0.0.1:9000
-16:27:31.969 [NamespaceSystem-akka.actor.default-dispatcher-4] INFO com.firebase.core.namespace.NamespaceActor - demo-backend-manager-default-rtdb successfully activated FBKV (SurveyIdle(0)) wait: 74ms, init: 0ms
-16:27:32.006 [NamespaceSystem-blocking-namespace-operation-dispatcher-6] INFO com.firebase.core.namespace.StateManager - Namespace demo-backend-manager-default-rtdb status Active to Active
-16:28:15.226 [FirebaseWorkerPool-1-3] WARN com.firebase.core.persistence.backend.dummy.EmulatorMetadataPersistence - Multiple projectIds are not recommended in single project mode. Requested 
-namespace demo-backend-manager, but the emulator is configured for demo-backend-manager-default-rtdb. To 
-opt-out of single project mode add/set the singleProjectMode: false property in 
-the firebase.json emulators config. 
-16:28:15.229 [NamespaceSystem-akka.actor.default-dispatcher-5] INFO com.firebase.core.namespace.NamespaceActor - demo-backend-manager successfully activated FBKV (SurveyIdle(0)) wait: 1ms, init: 0ms
-16:28:27.505 [Thread-0] INFO com.firebase.server.forge.App$ - Attempting graceful shutdown.
-16:28:27.511 [NamespaceSystem-akka.actor.default-dispatcher-9] INFO com.firebase.core.namespace.Terminator$Terminator - 2 actors left to terminate: demo-backend-manager-default-rtdb, demo-backend-manager
-16:28:27.524 [NamespaceSystem-akka.actor.default-dispatcher-9] INFO com.firebase.core.namespace.NamespaceActor - stopped namespace actor for demo-backend-manager
-16:28:27.524 [NamespaceSystem-akka.actor.default-dispatcher-12] INFO com.firebase.core.namespace.NamespaceActor - stopped namespace actor for demo-backend-manager-default-rtdb
-16:28:27.532 [Thread-0] INFO com.firebase.server.forge.App$ - Graceful shutdown complete.
+17:56:43.904 [NamespaceSystem-akka.actor.default-dispatcher-4] INFO akka.event.slf4j.Slf4jLogger - Slf4jLogger started
+17:56:44.025 [main] INFO com.firebase.server.forge.App$ - Listening at 127.0.0.1:9000
+17:56:55.055 [NamespaceSystem-akka.actor.default-dispatcher-4] INFO com.firebase.core.namespace.NamespaceActor - demo-backend-manager-default-rtdb successfully activated FBKV (SurveyIdle(0)) wait: 84ms, init: 0ms
+17:56:55.099 [NamespaceSystem-blocking-namespace-operation-dispatcher-6] INFO com.firebase.core.namespace.StateManager - Namespace demo-backend-manager-default-rtdb status Active to Active
+17:57:09.904 [Thread-0] INFO com.firebase.server.forge.App$ - Attempting graceful shutdown.
+17:57:09.909 [NamespaceSystem-akka.actor.default-dispatcher-4] INFO com.firebase.core.namespace.Terminator$Terminator - 1 actors left to terminate: demo-backend-manager-default-rtdb
+17:57:09.913 [NamespaceSystem-akka.actor.default-dispatcher-4] INFO com.firebase.core.namespace.NamespaceActor - stopped namespace actor for demo-backend-manager-default-rtdb
+17:57:09.917 [Thread-0] INFO com.firebase.server.forge.App$ - Graceful shutdown complete.