firebase-admin-edge 1.0.18 → 1.0.20

package/dist/auth/firebase-auth-endpoints.d.ts

@@ -2,100 +2,36 @@ import type { FirebaseCreateAuthUriResponse, FirebaseIdpSignInResponse, Firebase
 import type { JsonWebKey } from 'crypto';
 export declare function refreshFirebaseIdToken(refreshToken: string, key: string, fetchFn?: typeof globalThis.fetch): Promise<{
     data: FirebaseRefreshTokenResponse | null;
-    error: {
-        code: number;
-        message: string;
-        errors?: {
-            message: string;
-            domain: string;
-            reason: string;
-        }[];
-    } | null;
+    error: import("./errors.js").FirebaseEdgeError | null;
 }>;
-export declare function createAuthUri(redirect_uri: string, key: string, fetchFn?: typeof globalThis.fetch): Promise<{
+export declare function createAuthUri(redirect_uri: string, key: string, tenantId?: string, fetchFn?: typeof globalThis.fetch): Promise<{
     data: FirebaseCreateAuthUriResponse | null;
-    error: {
-        code: number;
-        message: string;
-        errors?: {
-            message: string;
-            domain: string;
-            reason: string;
-        }[];
-    } | null;
+    error: import("./errors.js").FirebaseEdgeError | null;
 }>;
-export declare function signInWithIdp(providerIdToken: string, requestUri: string, providerId: string | undefined, key: string, fetchFn?: typeof globalThis.fetch): Promise<{
+export declare function signInWithIdp(providerIdToken: string, requestUri: string, providerId: string | undefined, key: string, tenantId?: string, fetchFn?: typeof globalThis.fetch): Promise<{
     data: FirebaseIdpSignInResponse | null;
-    error: {
-        code: number;
-        message: string;
-        errors?: {
-            message: string;
-            domain: string;
-            reason: string;
-        }[];
-    } | null;
+    error: import("./errors.js").FirebaseEdgeError | null;
 }>;
-export declare function signInWithCustomToken(jwtToken: string, key: string, fetchFn?: typeof globalThis.fetch): Promise<{
+export declare function signInWithCustomToken(jwtToken: string, key: string, tenantId?: string, fetchFn?: typeof globalThis.fetch): Promise<{
     data: FirebaseIdpSignInResponse | null;
-    error: {
-        code: number;
-        message: string;
-        errors?: {
-            message: string;
-            domain: string;
-            reason: string;
-        }[];
-    } | null;
+    error: import("./errors.js").FirebaseEdgeError | null;
 }>;
-export declare function getAccountInfoByUid(uid: string, token: string, project_id: string, fetchFn?: typeof globalThis.fetch): Promise<{
+export declare function getAccountInfoByUid(uid: string, token: string, project_id: string, tenantId?: string, fetchFn?: typeof globalThis.fetch): Promise<{
     data: UserRecord | null | undefined;
-    error: {
-        code: number;
-        message: string;
-        errors?: {
-            message: string;
-            domain: string;
-            reason: string;
-        }[];
-    } | null;
+    error: import("./errors.js").FirebaseEdgeError | null;
 }>;
-export declare function createSessionCookie(idToken: string, token: string, project_id: string, expiresIn?: number, fetchFn?: typeof globalThis.fetch): Promise<{
+export declare function createSessionCookie(idToken: string, token: string, project_id: string, expiresIn?: number, tenantId?: string, fetchFn?: typeof globalThis.fetch): Promise<{
     data: string | null;
-    error: {
-        code: number;
-        message: string;
-        errors?: {
-            message: string;
-            domain: string;
-            reason: string;
-        }[];
-    } | null;
+    error: import("./errors.js").FirebaseEdgeError | null;
 }>;
 export declare function getJWKs(fetchFn?: typeof globalThis.fetch): Promise<{
     data: (JsonWebKey & {
         kid: string;
     })[] | null;
-    error: {
-        code: number;
-        message: string;
-        errors?: {
-            message: string;
-            domain: string;
-            reason: string;
-        }[];
-    } | null;
+    error: import("./errors.js").FirebaseEdgeError | null;
 }>;
 export declare function getPublicKeys(fetchFn?: typeof globalThis.fetch): Promise<{
     data: Record<string, string> | null;
-    error: {
-        code: number;
-        message: string;
-        errors?: {
-            message: string;
-            domain: string;
-            reason: string;
-        }[];
-    } | null;
+    error: import("./errors.js").FirebaseEdgeError | null;
 }>;
 //# sourceMappingURL=firebase-auth-endpoints.d.ts.map

package/dist/auth/firebase-auth-endpoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firebase-auth-endpoints.d.ts","sourceRoot":"","sources":["../../src/auth/firebase-auth-endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACR,6BAA6B,EAC7B,yBAAyB,EACzB,4BAA4B,EAE5B,UAAU,EACb,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAgBzC,wBAAsB,sBAAsB,CACxC,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK;;;;;;;;;;;GAuBpC;AAED,wBAAsB,aAAa,CAC/B,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK;;;;;;;;;;;GAsBpC;AAED,wBAAsB,aAAa,CAC/B,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,MAAM,EAClB,UAAU,oBAAe,EACzB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK;;;;;;;;;;;GAgCpC;AAED,wBAAsB,qBAAqB,CACvC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK;;;;;;;;;;;GAsBpC;AAED,wBAAsB,mBAAmB,CACrC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK;;;;;;;;;;;GAmBpC;AAED,wBAAsB,mBAAmB,CACrC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,MAAiC,EAC5C,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK;;;;;;;;;;;GAwBpC;AAED,wBAAsB,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK;;aAK1B,MAAM;;;;;;;;;;;GAW1C;AAED,wBAAsB,aAAa,CAAC,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK;;;;;;;;;;;GAgBpE"}
+{"version":3,"file":"firebase-auth-endpoints.d.ts","sourceRoot":"","sources":["../../src/auth/firebase-auth-endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACR,6BAA6B,EAC7B,yBAAyB,EACzB,4BAA4B,EAE5B,UAAU,EACb,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAuBzC,wBAAsB,sBAAsB,CACxC,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK;;;GAuBpC;AAED,wBAAsB,aAAa,CAC/B,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK;;;GAyBpC;AAED,wBAAsB,aAAa,CAC/B,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,MAAM,EAClB,UAAU,oBAAe,EACzB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK;;;GAmCpC;AAED,wBAAsB,qBAAqB,CACvC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK;;;GAyBpC;AAED,wBAAsB,mBAAmB,CACrC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK;;;GAsBpC;AAED,wBAAsB,mBAAmB,CACrC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,MAAiC,EAC5C,QAAQ,CAAC,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK;;;GA4BpC;AAED,wBAAsB,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK;;aAK1B,MAAM;;;GAW1C;AAED,wBAAsB,aAAa,CAAC,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK;;;GAgBpE"}

package/dist/auth/firebase-auth-endpoints.js

@@ -1,9 +1,15 @@
 import { restFetch } from '../rest-fetch.js';
+import { mapFirebaseError } from './auth-endpoint-errors.js';
 // Functions
-function createAdminIdentityURL(project_id, name, accounts = true) {
+function createAdminIdentityURL(project_id, name, accounts = true, tenantId) {
+    if (tenantId) {
+        // Use Identity Platform API for tenant-specific operations
+        return `https://identitytoolkit.googleapis.com/v1/projects/${project_id}/tenants/${tenantId}${accounts ? '/accounts' : ''}:${name}`;
+    }
     return `https://identitytoolkit.googleapis.com/v1/projects/${project_id}${accounts ? '/accounts' : ''}:${name}`;
 }
 function createIdentityURL(name) {
+    // Standard Firebase Auth REST API - tenant ID goes in request body, not URL
     return `https://identitytoolkit.googleapis.com/v1/accounts:${name}`;
 }
 export async function refreshFirebaseIdToken(refreshToken, key, fetchFn) {
@@ -21,94 +27,104 @@ export async function refreshFirebaseIdToken(refreshToken, key, fetchFn) {
     });
     return {
         data,
-        error: error ? error.error : null
+        error: error ? mapFirebaseError(error.error) : null
     };
 }
-export async function createAuthUri(redirect_uri, key, fetchFn) {
+export async function createAuthUri(redirect_uri, key, tenantId, fetchFn) {
     const url = createIdentityURL('createAuthUri');
+    const body = {
+        continueUri: redirect_uri,
+        providerId: 'google.com',
+        ...(tenantId && { tenantId })
+    };
     const { data, error } = await restFetch(url, {
         global: { fetch: fetchFn },
-        body: {
-            continueUri: redirect_uri,
-            providerId: 'google.com'
-        },
+        body,
         params: {
             key
         }
     });
     return {
         data,
-        error: error ? error.error : null
+        error: error ? mapFirebaseError(error.error) : null
     };
 }
-export async function signInWithIdp(providerIdToken, requestUri, providerId = 'google.com', key, fetchFn) {
+export async function signInWithIdp(providerIdToken, requestUri, providerId = 'google.com', key, tenantId, fetchFn) {
     const url = createIdentityURL('signInWithIdp');
     const tokenField = providerId === 'github.com' ? 'access_token' : 'id_token';
     const postBody = new URLSearchParams({
         [tokenField]: providerIdToken,
         providerId
     }).toString();
+    const body = {
+        postBody,
+        requestUri,
+        returnSecureToken: true,
+        returnIdpCredential: true,
+        ...(tenantId && { tenantId })
+    };
     const { data, error } = await restFetch(url, {
         global: { fetch: fetchFn },
-        body: {
-            postBody,
-            requestUri,
-            returnSecureToken: true,
-            returnIdpCredential: true
-        },
+        body,
         params: {
             key
         }
     });
     return {
         data,
-        error: error ? error.error : null
+        error: error ? mapFirebaseError(error.error) : null
     };
 }
-export async function signInWithCustomToken(jwtToken, key, fetchFn) {
+export async function signInWithCustomToken(jwtToken, key, tenantId, fetchFn) {
     const url = createIdentityURL('signInWithCustomToken');
+    const body = {
+        token: jwtToken,
+        returnSecureToken: true,
+        ...(tenantId && { tenantId })
+    };
     const { data, error } = await restFetch(url, {
         global: { fetch: fetchFn },
-        body: {
-            token: jwtToken,
-            returnSecureToken: true
-        },
+        body,
         params: {
             key
         }
     });
     return {
         data,
-        error: error ? error.error : null
+        error: error ? mapFirebaseError(error.error) : null
     };
 }
-export async function getAccountInfoByUid(uid, token, project_id, fetchFn) {
-    const url = createAdminIdentityURL(project_id, 'lookup');
+export async function getAccountInfoByUid(uid, token, project_id, tenantId, fetchFn) {
+    const url = createAdminIdentityURL(project_id, 'lookup', true, tenantId);
+    const body = {
+        localId: uid,
+        ...(tenantId && { tenantId })
+    };
     const { data, error } = await restFetch(url, {
         global: { fetch: fetchFn },
-        body: {
-            localId: uid
-        },
+        body,
         bearerToken: token
     });
     return {
         data: data?.users.length ? data.users[0] : null,
-        error: error ? error.error : null
+        error: error ? mapFirebaseError(error.error) : null
     };
 }
-export async function createSessionCookie(idToken, token, project_id, expiresIn = 60 * 60 * 24 * 14 * 1000, fetchFn) {
-    const url = createAdminIdentityURL(project_id, 'createSessionCookie', false);
+export async function createSessionCookie(idToken, token, project_id, expiresIn = 60 * 60 * 24 * 14 * 1000, tenantId, fetchFn) {
+    const url = createAdminIdentityURL(project_id, 'createSessionCookie', false, tenantId);
+    const body = {
+        idToken,
+        validDuration: Math.floor(expiresIn / 1000),
+        ...(tenantId && { tenantId })
+    };
     const { data, error } = await restFetch(url, {
         global: { fetch: fetchFn },
-        body: {
-            idToken,
-            validDuration: Math.floor(expiresIn / 1000)
-        },
+        body,
         bearerToken: token
     });
     return {
         data: data?.sessionCookie || null,
-        error: error ? error.error : null
+        error: error ? mapFirebaseError(error.error) : null
     };
 }
 export async function getJWKs(fetchFn) {
@@ -119,7 +135,7 @@ export async function getJWKs(fetchFn) {
     });
     return {
         data: data?.keys || null,
-        error: error ? error.error : null
+        error: error ? mapFirebaseError(error.error) : null
     };
 }
 export async function getPublicKeys(fetchFn) {
@@ -130,7 +146,7 @@ export async function getPublicKeys(fetchFn) {
     });
     return {
         data,
-        error: error ? error.error : null
+        error: error ? mapFirebaseError(error.error) : null
     };
 }
 //# sourceMappingURL=firebase-auth-endpoints.js.map

package/dist/auth/firebase-auth-endpoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"firebase-auth-endpoints.js","sourceRoot":"","sources":["../../src/auth/firebase-auth-endpoints.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAG7C,YAAY;AAEZ,SAAS,sBAAsB,CAC3B,UAAkB,EAClB,IAAY,EACZ,QAAQ,GAAG,IAAI;IAEf,OAAO,sDAAsD,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;AACpH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACnC,OAAO,sDAAsD,IAAI,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CACxC,YAAoB,EACpB,GAAW,EACX,OAAiC;IAEjC,MAAM,GAAG,GAAG,6CAA6C,CAAC;IAE1D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;QACH,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,IAAI,EAAE;YACF,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;SAC9B;QACD,MAAM,EAAE;YACJ,GAAG;SACN;QACD,IAAI,EAAE,IAAI;KACb,CAAC,CAAC;IAEH,OAAO;QACH,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;KACpC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,YAAoB,EACpB,GAAW,EACX,OAAiC;IAEjC,MAAM,GAAG,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAE/C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;QACH,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,IAAI,EAAE;YACF,WAAW,EAAE,YAAY;YACzB,UAAU,EAAE,YAAY;SAC3B;QACD,MAAM,EAAE;YACJ,GAAG;SACN;KACJ,CAAC,CAAC;IAEH,OAAO;QACH,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;KACpC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,eAAuB,EACvB,UAAkB,EAClB,UAAU,GAAG,YAAY,EACzB,GAAW,EACX,OAAiC;IAEjC,MAAM,GAAG,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAE/C,MAAM,UAAU,GACZ,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC;IAE9D,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC;QACjC,CAAC,UAAU,CAAC,EAAE,eAAe;QAC7B,UAAU;KACb,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEd,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;QACH,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,IAAI,EAAE;YACF,QAAQ;YACR,UAAU;YACV,iBAAiB,EAAE,IAAI;YACvB,mBAAmB,EAAE,IAAI;SAC5B;QACD,MAAM,EAAE;YACJ,GAAG;SACN;KACJ,CAAC,CAAC;IAEH,OAAO;QACH,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;KACpC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACvC,QAAgB,EAChB,GAAW,EACX,OAAiC;IAEjC,MAAM,GAAG,GAAG,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;IAEvD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;QACH,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,IAAI,EAAE;YACF,KAAK,EAAE,QAAQ;YACf,iBAAiB,EAAE,IAAI;SAC1B;QACD,MAAM,EAAE;YACJ,GAAG;SACN;KACJ,CAAC,CAAC;IAEH,OAAO;QACH,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;KACpC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,GAAW,EACX,KAAa,EACb,UAAkB,EAClB,OAAiC;IAEjC,MAAM,GAAG,GAAG,sBAAsB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEzD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;QACH,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,IAAI,EAAE;YACF,OAAO,EAAE,GAAG;SACf;QACD,WAAW,EAAE,KAAK;KACrB,CAAC,CAAC;IAEH,OAAO;QACH,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/C,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;KACpC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,OAAe,EACf,KAAa,EACb,UAAkB,EAClB,YAAoB,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAC5C,OAAiC;IAEjC,MAAM,GAAG,GAAG,sBAAsB,CAC9B,UAAU,EACV,qBAAqB,EACrB,KAAK,CACR,CAAC;IAEF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;QACH,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,IAAI,EAAE;YACF,OAAO;YACP,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;SAC9C;QACD,WAAW,EAAE,KAAK;KACrB,CAAC,CAAC;IAEH,OAAO;QACH,IAAI,EAAE,IAAI,EAAE,aAAa,IAAI,IAAI;QACjC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;KACpC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAiC;IAC3D,MAAM,GAAG,GACL,2FAA2F,CAAC;IAEhG,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;QACH,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,MAAM,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,OAAO;QACH,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI;QACxB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;KACpC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAiC;IACjE,MAAM,GAAG,GACL,uEAAuE,CAAC;IAE5E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;QACH,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,MAAM,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,OAAO;QACH,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;KACpC,CAAC;AACN,CAAC"}
+{"version":3,"file":"firebase-auth-endpoints.js","sourceRoot":"","sources":["../../src/auth/firebase-auth-endpoints.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,YAAY;AAEZ,SAAS,sBAAsB,CAC3B,UAAkB,EAClB,IAAY,EACZ,QAAQ,GAAG,IAAI,EACf,QAAiB;IAEjB,IAAI,QAAQ,EAAE,CAAC;QACX,2DAA2D;QAC3D,OAAO,sDAAsD,UAAU,YAAY,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;IACxI,CAAC;IACD,OAAO,sDAAsD,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;AACpH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACnC,4EAA4E;IAC5E,OAAO,sDAAsD,IAAI,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CACxC,YAAoB,EACpB,GAAW,EACX,OAAiC;IAEjC,MAAM,GAAG,GAAG,6CAA6C,CAAC;IAE1D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;QACH,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,IAAI,EAAE;YACF,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;SAC9B;QACD,MAAM,EAAE;YACJ,GAAG;SACN;QACD,IAAI,EAAE,IAAI;KACb,CAAC,CAAC;IAEH,OAAO;QACH,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;KACtD,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,YAAoB,EACpB,GAAW,EACX,QAAiB,EACjB,OAAiC;IAEjC,MAAM,GAAG,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAE/C,MAAM,IAAI,GAAG;QACT,WAAW,EAAE,YAAY;QACzB,UAAU,EAAE,YAAqB;QACjC,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;KAChC,CAAC;IAEF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;QACH,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,IAAI;QACJ,MAAM,EAAE;YACJ,GAAG;SACN;KACJ,CAAC,CAAC;IAEH,OAAO;QACH,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;KACtD,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,eAAuB,EACvB,UAAkB,EAClB,UAAU,GAAG,YAAY,EACzB,GAAW,EACX,QAAiB,EACjB,OAAiC;IAEjC,MAAM,GAAG,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAE/C,MAAM,UAAU,GACZ,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC;IAE9D,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC;QACjC,CAAC,UAAU,CAAC,EAAE,eAAe;QAC7B,UAAU;KACb,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEd,MAAM,IAAI,GAAG;QACT,QAAQ;QACR,UAAU;QACV,iBAAiB,EAAE,IAAa;QAChC,mBAAmB,EAAE,IAAa;QAClC,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;KAChC,CAAC;IAEF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;QACH,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,IAAI;QACJ,MAAM,EAAE;YACJ,GAAG;SACN;KACJ,CAAC,CAAC;IAEH,OAAO;QACH,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;KACtD,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACvC,QAAgB,EAChB,GAAW,EACX,QAAiB,EACjB,OAAiC;IAEjC,MAAM,GAAG,GAAG,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;IAEvD,MAAM,IAAI,GAAG;QACT,KAAK,EAAE,QAAQ;QACf,iBAAiB,EAAE,IAAa;QAChC,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;KAChC,CAAC;IAEF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;QACH,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,IAAI;QACJ,MAAM,EAAE;YACJ,GAAG;SACN;KACJ,CAAC,CAAC;IAEH,OAAO;QACH,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;KACtD,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,GAAW,EACX,KAAa,EACb,UAAkB,EAClB,QAAiB,EACjB,OAAiC;IAEjC,MAAM,GAAG,GAAG,sBAAsB,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEzE,MAAM,IAAI,GAAG;QACT,OAAO,EAAE,GAAG;QACZ,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;KAChC,CAAC;IAEF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;QACH,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,IAAI;QACJ,WAAW,EAAE,KAAK;KACrB,CAAC,CAAC;IAEH,OAAO;QACH,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/C,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;KACtD,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,OAAe,EACf,KAAa,EACb,UAAkB,EAClB,YAAoB,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAC5C,QAAiB,EACjB,OAAiC;IAEjC,MAAM,GAAG,GAAG,sBAAsB,CAC9B,UAAU,EACV,qBAAqB,EACrB,KAAK,EACL,QAAQ,CACX,CAAC;IAEF,MAAM,IAAI,GAAG;QACT,OAAO;QACP,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QAC3C,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;KAChC,CAAC;IAEF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;QACH,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,IAAI;QACJ,WAAW,EAAE,KAAK;KACrB,CAAC,CAAC;IAEH,OAAO;QACH,IAAI,EAAE,IAAI,EAAE,aAAa,IAAI,IAAI;QACjC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;KACtD,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAiC;IAC3D,MAAM,GAAG,GACL,2FAA2F,CAAC;IAEhG,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;QACH,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,MAAM,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,OAAO;QACH,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI;QACxB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;KACtD,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAiC;IACjE,MAAM,GAAG,GACL,uEAAuE,CAAC;IAE5E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAGrC,GAAG,EAAE;QACH,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,MAAM,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,OAAO;QACH,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;KACtD,CAAC;AACN,CAAC"}

package/dist/auth/firebase-auth-endpoints.test.js

@@ -1,6 +1,7 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { refreshFirebaseIdToken, createAuthUri, signInWithIdp, signInWithCustomToken, getAccountInfoByUid, createSessionCookie, getJWKs, getPublicKeys } from './firebase-auth-endpoints.js';
 import * as restFetch from '../rest-fetch.js';
+import { FirebaseEdgeError, FirebaseEndpointErrorInfo } from './errors.js';
 vi.mock('../rest-fetch.js');
 describe('firebase-auth-endpoints', () => {
     const mockFetch = vi.fn();
@@ -36,14 +37,18 @@ describe('firebase-auth-endpoints', () => {
             }));
         });
         it('should handle error response', async () => {
-            const mockError = { message: 'Invalid refresh token' };
+            const mockError = {
+                code: 400,
+                message: 'INVALID_GRANT: Invalid refresh token'
+            };
             vi.mocked(restFetch.restFetch).mockResolvedValue({
                 data: null,
                 error: { error: mockError }
             });
             const result = await refreshFirebaseIdToken('invalid-token', API_KEY);
             expect(result.data).toBeNull();
-            expect(result.error).toEqual(mockError);
+            expect(result.error).toBeInstanceOf(FirebaseEdgeError);
+            expect(result.error.code).toBe(FirebaseEndpointErrorInfo.ENDPOINT_INVALID_REFRESH_TOKEN.code);
         });
     });
     describe('createAuthUri', () => {
@@ -55,7 +60,7 @@ describe('firebase-auth-endpoints', () => {
                 data: mockResponse,
                 error: null
             });
-            const result = await createAuthUri('https://redirect.com', API_KEY, mockFetch);
+            const result = await createAuthUri('https://redirect.com', API_KEY, undefined, mockFetch);
             expect(result.data).toEqual(mockResponse);
             expect(restFetchSpy).toHaveBeenCalled();
             expect(result.error).toBeNull();
@@ -68,6 +73,28 @@ describe('firebase-auth-endpoints', () => {
                 global: { fetch: mockFetch }
             }));
         });
+        it('should create auth URI with tenant ID', async () => {
+            const mockResponse = { authUri: 'https://auth.example.com' };
+            const tenantId = 'tenant-123';
+            const restFetchSpy = vi
+                .mocked(restFetch.restFetch)
+                .mockResolvedValue({
+                data: mockResponse,
+                error: null
+            });
+            const result = await createAuthUri('https://redirect.com', API_KEY, tenantId, mockFetch);
+            expect(result.data).toEqual(mockResponse);
+            expect(result.error).toBeNull();
+            expect(restFetchSpy).toHaveBeenCalledWith('https://identitytoolkit.googleapis.com/v1/accounts:createAuthUri', expect.objectContaining({
+                body: {
+                    continueUri: 'https://redirect.com',
+                    providerId: 'google.com',
+                    tenantId: tenantId
+                },
+                params: { key: API_KEY },
+                global: { fetch: mockFetch }
+            }));
+        });
     });
     describe('signInWithIdp', () => {
         it('should sign in with IDP successfully', async () => {
@@ -79,7 +106,7 @@ describe('firebase-auth-endpoints', () => {
                 data: mockResponse,
                 error: null
             });
-            const result = await signInWithIdp('provider-token', 'https://request.com', 'google.com', API_KEY, mockFetch);
+            const result = await signInWithIdp('provider-token', 'https://request.com', 'google.com', API_KEY, undefined, mockFetch);
             expect(result.data).toEqual(mockResponse);
             expect(result.error).toBeNull();
             expect(restFetch.restFetch).toHaveBeenCalledWith('https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp', expect.objectContaining({
@@ -91,6 +118,50 @@ describe('firebase-auth-endpoints', () => {
                 }
             }));
         });
+        it('should sign in with IDP and tenant ID', async () => {
+            const mockResponse = {
+                idToken: 'firebase-token',
+                refreshToken: 'refresh'
+            };
+            const tenantId = 'tenant-456';
+            const restFetchSpy = vi
+                .mocked(restFetch.restFetch)
+                .mockResolvedValue({
+                data: mockResponse,
+                error: null
+            });
+            const result = await signInWithIdp('provider-token', 'https://request.com', 'google.com', API_KEY, tenantId, mockFetch);
+            expect(result.data).toEqual(mockResponse);
+            expect(result.error).toBeNull();
+            expect(restFetchSpy).toHaveBeenCalledWith('https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp', expect.objectContaining({
+                body: {
+                    postBody: 'id_token=provider-token&providerId=google.com',
+                    requestUri: 'https://request.com',
+                    returnSecureToken: true,
+                    returnIdpCredential: true,
+                    tenantId: tenantId
+                }
+            }));
+        });
+        it('should use access_token for GitHub provider', async () => {
+            const mockResponse = {
+                idToken: 'firebase-token',
+                refreshToken: 'refresh'
+            };
+            const restFetchSpy = vi
+                .mocked(restFetch.restFetch)
+                .mockResolvedValue({
+                data: mockResponse,
+                error: null
+            });
+            const result = await signInWithIdp('github-token', 'https://request.com', 'github.com', API_KEY, undefined, mockFetch);
+            expect(result.data).toEqual(mockResponse);
+            expect(restFetchSpy).toHaveBeenCalledWith('https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp', expect.objectContaining({
+                body: expect.objectContaining({
+                    postBody: 'access_token=github-token&providerId=github.com'
+                })
+            }));
+        });
     });
     describe('signInWithCustomToken', () => {
         it('should sign in with custom token successfully', async () => {
@@ -99,10 +170,30 @@ describe('firebase-auth-endpoints', () => {
                 data: mockResponse,
                 error: null
             });
-            const result = await signInWithCustomToken('jwt-token', API_KEY, mockFetch);
+            const result = await signInWithCustomToken('jwt-token', API_KEY, undefined, mockFetch);
             expect(result.data).toEqual(mockResponse);
             expect(result.error).toBeNull();
         });
+        it('should sign in with custom token and tenant ID', async () => {
+            const mockResponse = { idToken: 'firebase-token' };
+            const tenantId = 'tenant-789';
+            const restFetchSpy = vi
+                .mocked(restFetch.restFetch)
+                .mockResolvedValue({
+                data: mockResponse,
+                error: null
+            });
+            const result = await signInWithCustomToken('jwt-token', API_KEY, tenantId, mockFetch);
+            expect(result.data).toEqual(mockResponse);
+            expect(result.error).toBeNull();
+            expect(restFetchSpy).toHaveBeenCalledWith('https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken', expect.objectContaining({
+                body: {
+                    token: 'jwt-token',
+                    returnSecureToken: true,
+                    tenantId: tenantId
+                }
+            }));
+        });
     });
     describe('getAccountInfoByUid', () => {
         it('should get account info successfully', async () => {
@@ -111,9 +202,29 @@ describe('firebase-auth-endpoints', () => {
                 data: { users: [mockUser] },
                 error: null
             });
-            const result = await getAccountInfoByUid('user-123', ACCESS_TOKEN, PROJECT_ID, mockFetch);
+            const result = await getAccountInfoByUid('user-123', ACCESS_TOKEN, PROJECT_ID, undefined, mockFetch);
+            expect(result.data).toEqual(mockUser);
+            expect(result.error).toBeNull();
+        });
+        it('should get account info with tenant ID', async () => {
+            const mockUser = { localId: 'user-123', email: 'test@example.com' };
+            const tenantId = 'tenant-abc';
+            const restFetchSpy = vi
+                .mocked(restFetch.restFetch)
+                .mockResolvedValue({
+                data: { users: [mockUser] },
+                error: null
+            });
+            const result = await getAccountInfoByUid('user-123', ACCESS_TOKEN, PROJECT_ID, tenantId, mockFetch);
             expect(result.data).toEqual(mockUser);
             expect(result.error).toBeNull();
+            expect(restFetchSpy).toHaveBeenCalledWith(`https://identitytoolkit.googleapis.com/v1/projects/${PROJECT_ID}/tenants/${tenantId}/accounts:lookup`, expect.objectContaining({
+                body: {
+                    localId: 'user-123',
+                    tenantId: tenantId
+                },
+                bearerToken: ACCESS_TOKEN
+            }));
         });
         it('should return null when no users found', async () => {
             vi.mocked(restFetch.restFetch).mockResolvedValue({
@@ -133,7 +244,7 @@ describe('firebase-auth-endpoints', () => {
                 data: mockResponse,
                 error: null
             });
-            const result = await createSessionCookie('id-token', ACCESS_TOKEN, PROJECT_ID, undefined, mockFetch);
+            const result = await createSessionCookie('id-token', ACCESS_TOKEN, PROJECT_ID, undefined, undefined, mockFetch);
             expect(result.data).toBe('cookie-value');
             expect(restFetchSpy).toHaveBeenCalledWith(`https://identitytoolkit.googleapis.com/v1/projects/${PROJECT_ID}:createSessionCookie`, expect.objectContaining({
                 body: expect.objectContaining({
@@ -142,6 +253,27 @@ describe('firebase-auth-endpoints', () => {
                 })
             }));
         });
+        it('should create session cookie with tenant ID', async () => {
+            const mockResponse = { sessionCookie: 'cookie-value' };
+            const tenantId = 'tenant-def';
+            const restFetchSpy = vi
+                .mocked(restFetch.restFetch)
+                .mockResolvedValue({
+                data: mockResponse,
+                error: null
+            });
+            const result = await createSessionCookie('id-token', ACCESS_TOKEN, PROJECT_ID, 3600000, // 1 hour in ms
+            tenantId, mockFetch);
+            expect(result.data).toBe('cookie-value');
+            expect(restFetchSpy).toHaveBeenCalledWith(`https://identitytoolkit.googleapis.com/v1/projects/${PROJECT_ID}/tenants/${tenantId}:createSessionCookie`, expect.objectContaining({
+                body: {
+                    idToken: 'id-token',
+                    validDuration: 3600, // converted to seconds
+                    tenantId: tenantId
+                },
+                bearerToken: ACCESS_TOKEN
+            }));
+        });
         it('should create session cookie with custom expiry (using seconds)', async () => {
             const mockResponse = { sessionCookie: 'cookie-value' };
             vi.mocked(restFetch.restFetch).mockResolvedValue({
@@ -149,7 +281,7 @@ describe('firebase-auth-endpoints', () => {
                 error: null
             });
             const result = await createSessionCookie('id-token', ACCESS_TOKEN, PROJECT_ID, 3600, // 1 hour in seconds
-            mockFetch);
+            undefined, mockFetch);
             expect(result.data).toBe('cookie-value');
         });
     });
@@ -185,17 +317,21 @@ describe('firebase-auth-endpoints', () => {
             expect(result.error).toBeNull();
         });
         it('should handle error response', async () => {
-            const mockError = { message: 'Failed to fetch keys' };
+            const mockError = {
+                code: 403,
+                message: 'PERMISSION_DENIED: Failed to fetch keys'
+            };
             vi.mocked(restFetch.restFetch).mockResolvedValue({
                 data: null,
                 error: { error: mockError }
             });
             const result = await getPublicKeys();
             expect(result.data).toBeNull();
-            expect(result.error).toEqual(mockError);
+            expect(result.error).toBeInstanceOf(FirebaseEdgeError);
+            expect(result.error.code).toBe(FirebaseEndpointErrorInfo.ENDPOINT_PERMISSION_DENIED.code);
         });
     });
-    describe('createAdminIdentityURL (indirectly via createSessionCookie)', () => {
+    describe('createAdminIdentityURL (indirectly via functions)', () => {
         it('should call createSessionCookie URL without /accounts segment', async () => {
             const mockResponse = { sessionCookie: 'cookie-value' };
             const restFetchSpy = vi
@@ -207,7 +343,7 @@ describe('firebase-auth-endpoints', () => {
             const idToken = 'id-token';
             const token = 'access-token';
             const projectId = 'test-project';
-            const result = await createSessionCookie(idToken, token, projectId, 3600_000, vi.fn());
+            const result = await createSessionCookie(idToken, token, projectId, 3600_000, undefined, vi.fn());
             expect(result.data).toBe('cookie-value');
             expect(restFetchSpy).toHaveBeenCalledTimes(1);
             const [calledUrl, options] = restFetchSpy.mock
@@ -216,6 +352,20 @@ describe('firebase-auth-endpoints', () => {
             expect(options.bearerToken).toBe(token);
             expect(options.body.idToken).toBe(idToken);
         });
+        it('should call createSessionCookie tenant URL when tenant ID provided', async () => {
+            const mockResponse = { sessionCookie: 'cookie-value' };
+            const tenantId = 'tenant-test';
+            const restFetchSpy = vi
+                .mocked(restFetch.restFetch)
+                .mockResolvedValue({
+                data: mockResponse,
+                error: null
+            });
+            const result = await createSessionCookie('id-token', 'access-token', 'test-project', 3600_000, tenantId, vi.fn());
+            expect(result.data).toBe('cookie-value');
+            const [calledUrl] = restFetchSpy.mock.calls[0];
+            expect(calledUrl).toBe(`https://identitytoolkit.googleapis.com/v1/projects/test-project/tenants/${tenantId}:createSessionCookie`);
+        });
         it('should call accounts lookup URL with /accounts segment via getAccountInfoByUid', async () => {
             const mockUser = { localId: 'user-123', email: 'test@example.com' };
             const restFetchSpy = vi
@@ -227,7 +377,7 @@ describe('firebase-auth-endpoints', () => {
             const uid = 'user-123';
             const token = 'access-token';
             const projectId = 'test-project';
-            const result = await getAccountInfoByUid(uid, token, projectId, vi.fn());
+            const result = await getAccountInfoByUid(uid, token, projectId, undefined, vi.fn());
             expect(result.data).toEqual(mockUser);
             expect(restFetchSpy).toHaveBeenCalledTimes(1);
             const [calledUrl, options] = restFetchSpy.mock
@@ -236,6 +386,20 @@ describe('firebase-auth-endpoints', () => {
             expect(options.bearerToken).toBe(token);
             expect(options.body.localId).toBe(uid);
         });
+        it('should call accounts lookup tenant URL when tenant ID provided', async () => {
+            const mockUser = { localId: 'user-123', email: 'test@example.com' };
+            const tenantId = 'tenant-lookup';
+            const restFetchSpy = vi
+                .mocked(restFetch.restFetch)
+                .mockResolvedValue({
+                data: { users: [mockUser] },
+                error: null
+            });
+            const result = await getAccountInfoByUid('user-123', 'access-token', 'test-project', tenantId, vi.fn());
+            expect(result.data).toEqual(mockUser);
+            const [calledUrl] = restFetchSpy.mock.calls[0];
+            expect(calledUrl).toBe(`https://identitytoolkit.googleapis.com/v1/projects/test-project/tenants/${tenantId}/accounts:lookup`);
+        });
     });
     describe('createSessionCookie with ms input', () => {
         it('should convert ms to seconds when creating session cookie', async () => {
@@ -247,6 +411,7 @@ describe('firebase-auth-endpoints', () => {
                 error: null
             });
             const result = await createSessionCookie('id-token', ACCESS_TOKEN, PROJECT_ID, 1209600000, // 14 days in ms
+            undefined, // tenantId
             mockFetch);
             expect(result.data).toBe('cookie-value');
             expect(restFetchSpy).toHaveBeenCalledWith(expect.stringContaining('createSessionCookie'), expect.objectContaining({