firebase-admin-edge 1.0.25 → 1.1.1

package/dist/auth/firebase-admin-auth.test.js

@@ -1,10 +1,18 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { FirebaseAdminAuth } from './firebase-admin-auth.js';
-import { getAccountInfo, createSessionCookie as createSessionCookieEndpoint } from './firebase-auth-endpoints.js';
+import { generateEmailActionLink, deleteAccountsAdmin, importAccountsAdmin, getAccountsInfo, createAccountAdmin, updateAccountAdmin, deleteAccountAdmin, downloadAccount, getAccountInfo, createSessionCookie as createSessionCookieEndpoint } from './firebase-auth-endpoints.js';
 import { getToken } from './google-oauth.js';
 import { signJWTCustomToken, verifyJWT, verifySessionJWT } from './firebase-jwt.js';
 import { FirebaseEdgeError, FirebaseAdminAuthErrorInfo, FirebaseEndpointErrorInfo, JWTErrorInfo } from './errors.js';
 vi.mock('./firebase-auth-endpoints.js', () => ({
+    generateEmailActionLink: vi.fn(),
+    deleteAccountsAdmin: vi.fn(),
+    importAccountsAdmin: vi.fn(),
+    getAccountsInfo: vi.fn(),
+    createAccountAdmin: vi.fn(),
+    updateAccountAdmin: vi.fn(),
+    deleteAccountAdmin: vi.fn(),
+    downloadAccount: vi.fn(),
     getAccountInfo: vi.fn(),
     createSessionCookie: vi.fn()
 }));
@@ -76,6 +84,784 @@ describe('FirebaseAdminAuth', () => {
     afterEach(() => {
         vi.resetAllMocks();
     });
+    describe('getUserByProviderUid', () => {
+        it.each([
+            [
+                'google.com',
+                'google-123',
+                {
+                    federatedUserId: [
+                        { providerId: 'google.com', rawId: 'google-123' }
+                    ]
+                }
+            ],
+            ['email', 'test@example.com', { email: ['test@example.com'] }],
+            ['phone', '+15551234567', { phoneNumber: ['+15551234567'] }]
+        ])('looks up %s using the existing batch helper', async (providerId, uid, request) => {
+            const fetchFn = vi.fn();
+            const admin = new FirebaseAdminAuth(serviceAccountKey, 'tenant', fetchFn);
+            mockedGetToken.mockResolvedValue({
+                data: mockGoogleTokenResponse,
+                error: null
+            });
+            vi.mocked(getAccountsInfo).mockResolvedValue({
+                data: {
+                    users: [
+                        {
+                            ...mockUserRecord,
+                            phoneNumber: '+15551234567',
+                            providerUserInfo: [
+                                {
+                                    providerId: 'google.com',
+                                    rawId: 'google-123'
+                                }
+                            ]
+                        }
+                    ]
+                },
+                error: null
+            });
+            const result = await admin.getUserByProviderUid(providerId, uid);
+            expect(result.error).toBeNull();
+            expect(result.data?.uid).toBe('uid-1');
+            expect(result.data?.toJSON()).toMatchObject({ uid: 'uid-1' });
+            expect(getAccountsInfo).toHaveBeenCalledWith(request, 'test-access-token', 'test-project', 'tenant', fetchFn);
+        });
+        it('returns user-not-found for an unmatched provider UID', async () => {
+            vi.spyOn(auth, 'getUsers').mockResolvedValue({
+                data: {
+                    users: [],
+                    notFound: [
+                        { providerId: 'google.com', providerUid: 'missing' }
+                    ]
+                },
+                error: null
+            });
+            expect((await auth.getUserByProviderUid('google.com', 'missing')).error
+                ?.code).toBe(FirebaseAdminAuthErrorInfo.ADMIN_USER_NOT_FOUND.code);
+        });
+        it.each([
+            ['', 'uid'],
+            ['google.com', ''],
+            [null, 'uid'],
+            ['google.com', null],
+            ['email', 'invalid'],
+            ['phone', 'invalid']
+        ])('rejects invalid identifiers %s/%s before authentication', async (providerId, uid) => {
+            expect((await auth.getUserByProviderUid(providerId, uid)).error).toBeInstanceOf(FirebaseEdgeError);
+            expect(mockedGetToken).not.toHaveBeenCalled();
+        });
+        it('preserves lookup failures', async () => {
+            const error = new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_USER_LOOKUP_FAILED);
+            vi.spyOn(auth, 'getUsers').mockResolvedValue({ data: null, error });
+            expect(await auth.getUserByProviderUid('google.com', 'uid')).toEqual({ data: null, error });
+        });
+    });
+    describe('generateVerifyAndChangeEmailLink', () => {
+        it.each([undefined, { url: 'https://example.com/account' }])('generates a link with settings %j', async (settings) => {
+            const fetchFn = vi.fn();
+            const admin = new FirebaseAdminAuth(serviceAccountKey, 'tenant', fetchFn);
+            mockedGetToken.mockResolvedValue({
+                data: mockGoogleTokenResponse,
+                error: null
+            });
+            vi.mocked(generateEmailActionLink).mockResolvedValue({
+                data: 'https://example.com/action',
+                error: null
+            });
+            expect(await admin.generateVerifyAndChangeEmailLink('old@example.com', 'new@example.com', settings)).toEqual({ data: 'https://example.com/action', error: null });
+            expect(generateEmailActionLink).toHaveBeenCalledWith('test-project', {
+                requestType: 'VERIFY_AND_CHANGE_EMAIL',
+                email: 'old@example.com',
+                newEmail: 'new@example.com',
+                returnOobLink: true,
+                ...(settings
+                    ? {
+                        continueUrl: settings.url,
+                        canHandleCodeInApp: false
+                    }
+                    : {})
+            }, 'test-access-token', fetchFn, 'tenant');
+        });
+        it.each([
+            ['invalid', 'new@example.com'],
+            ['old@example.com', 'invalid'],
+            ['old@example.com', undefined]
+        ])('rejects invalid addresses %s/%s', async (email, newEmail) => {
+            const result = await auth.generateVerifyAndChangeEmailLink(email, newEmail);
+            expect(result.error?.code).toBe(FirebaseAdminAuthErrorInfo.ADMIN_API_INVALID_ARGUMENT.code);
+            expect(mockedGetToken).not.toHaveBeenCalled();
+        });
+        it('returns credential errors without requesting a link', async () => {
+            mockedGetToken.mockResolvedValue({
+                data: null,
+                error: new Error('credentials')
+            });
+            expect((await auth.generateVerifyAndChangeEmailLink('old@example.com', 'new@example.com')).error?.code).toBe(FirebaseAdminAuthErrorInfo.ADMIN_SERVICE_ACCOUNT_TOKEN_FAILED
+                .code);
+            expect(generateEmailActionLink).not.toHaveBeenCalled();
+        });
+        it('wraps endpoint failures with their cause', async () => {
+            const cause = new Error('email already exists');
+            mockedGetToken.mockResolvedValue({
+                data: mockGoogleTokenResponse,
+                error: null
+            });
+            vi.mocked(generateEmailActionLink).mockResolvedValue({
+                data: null,
+                error: cause
+            });
+            const result = await auth.generateVerifyAndChangeEmailLink('old@example.com', 'new@example.com');
+            expect(result.error?.code).toBe(FirebaseAdminAuthErrorInfo.ADMIN_EMAIL_ACTION_LINK_FAILED.code);
+            expect(result.error?.cause).toBe(cause);
+        });
+    });
+    describe('setCustomUserClaims', () => {
+        beforeEach(() => {
+            mockedGetToken.mockResolvedValue({
+                data: mockGoogleTokenResponse,
+                error: null
+            });
+            vi.mocked(updateAccountAdmin).mockResolvedValue({
+                data: { localId: 'uid' },
+                error: null
+            });
+        });
+        it('uses the existing update helper with tenant and custom fetch', async () => {
+            const customFetch = vi.fn();
+            const instance = new FirebaseAdminAuth(serviceAccountKey, 'tenant', customFetch);
+            expect(await instance.setCustomUserClaims('uid', { role: 'editor' })).toEqual({ data: undefined, error: null });
+            expect(updateAccountAdmin).toHaveBeenCalledExactlyOnceWith('test-project', 'uid', { customAttributes: '{"role":"editor"}' }, 'test-access-token', customFetch, 'tenant');
+            expect(getAccountInfo).not.toHaveBeenCalled();
+        });
+        it('clears claims with null', async () => {
+            expect((await auth.setCustomUserClaims('uid', null)).error).toBeNull();
+            expect(updateAccountAdmin).toHaveBeenCalledWith('test-project', 'uid', { customAttributes: '{}' }, 'test-access-token', undefined, undefined);
+        });
+        it('validates UID and claims before authentication', async () => {
+            expect((await auth.setCustomUserClaims('', {})).error).not.toBeNull();
+            expect((await auth.setCustomUserClaims('a'.repeat(129), {})).error).not.toBeNull();
+            expect((await auth.setCustomUserClaims('uid', { sub: 'reserved' }))
+                .error).not.toBeNull();
+            expect(mockedGetToken).not.toHaveBeenCalled();
+            expect(updateAccountAdmin).not.toHaveBeenCalled();
+        });
+        it('uses cached credentials', async () => {
+            const cache = {
+                getCache: vi.fn().mockResolvedValue(mockGoogleTokenResponse),
+                setCache: vi.fn()
+            };
+            const instance = new FirebaseAdminAuth(serviceAccountKey, undefined, undefined, cache);
+            expect((await instance.setCustomUserClaims('uid', {})).error).toBeNull();
+            expect(mockedGetToken).not.toHaveBeenCalled();
+        });
+        it('returns credential failures without updating', async () => {
+            const error = new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SERVICE_ACCOUNT_TOKEN_FAILED);
+            mockedGetToken.mockResolvedValue({ data: null, error });
+            expect(await auth.setCustomUserClaims('uid', {})).toEqual({
+                data: null,
+                error
+            });
+            expect(updateAccountAdmin).not.toHaveBeenCalled();
+        });
+        it('guards against missing access tokens', async () => {
+            mockedGetToken.mockResolvedValue({
+                data: {},
+                error: null
+            });
+            expect((await auth.setCustomUserClaims('uid', {})).error?.code).toBe('auth/admin-no-token-returned');
+            expect(updateAccountAdmin).not.toHaveBeenCalled();
+        });
+        it('preserves endpoint errors including user-not-found', async () => {
+            const cause = new FirebaseEdgeError(FirebaseEndpointErrorInfo.ENDPOINT_USER_NOT_FOUND);
+            vi.mocked(updateAccountAdmin).mockResolvedValue({
+                data: null,
+                error: cause
+            });
+            const result = await auth.setCustomUserClaims('missing', {});
+            expect(result.data).toBeNull();
+            expect(result.error?.code).toBe('auth/admin-set-custom-claims-failed');
+            expect(result.error?.cause).toBe(cause);
+        });
+        it('rejects missing confirmation data', async () => {
+            vi.mocked(updateAccountAdmin).mockResolvedValue({
+                data: { localId: '' },
+                error: null
+            });
+            expect((await auth.setCustomUserClaims('uid', {})).error?.code).toBe('auth/admin-set-custom-claims-failed');
+        });
+        it('returns network and credential exceptions instead of rejecting', async () => {
+            const cause = new Error('offline');
+            vi.mocked(updateAccountAdmin).mockRejectedValue(cause);
+            expect((await auth.setCustomUserClaims('uid', {})).error?.cause).toBe(cause);
+            mockedGetToken.mockRejectedValue('token failure');
+            expect((await auth.setCustomUserClaims('uid', {})).error?.cause).toBeInstanceOf(Error);
+        });
+    });
+    describe('phone lookup and bulk user management', () => {
+        beforeEach(() => {
+            mockedGetToken.mockResolvedValue({
+                data: mockGoogleTokenResponse,
+                error: null
+            });
+            mockedGetAccountInfo.mockResolvedValue({
+                data: mockUserRecord,
+                error: null
+            });
+            vi.mocked(deleteAccountsAdmin).mockResolvedValue({
+                data: {},
+                error: null
+            });
+            vi.mocked(importAccountsAdmin).mockResolvedValue({
+                data: {},
+                error: null
+            });
+        });
+        it('looks up a phone number and returns a converted user record', async () => {
+            const customFetch = vi.fn();
+            const instance = new FirebaseAdminAuth(serviceAccountKey, 'tenant', customFetch);
+            const result = await instance.getUserByPhoneNumber('+15555550100');
+            expect(result.error).toBeNull();
+            expect(result.data?.uid).toBe('uid-1');
+            expect(result.data?.toJSON()).toMatchObject({ uid: 'uid-1' });
+            expect(getAccountInfo).toHaveBeenCalledWith({ phoneNumber: '+15555550100' }, 'test-access-token', 'test-project', 'tenant', customFetch);
+        });
+        it('returns user-not-found when no phone match exists', async () => {
+            mockedGetAccountInfo.mockResolvedValue({ data: null, error: null });
+            expect((await auth.getUserByPhoneNumber('+15555550100')).error?.code).toBe('auth/admin-user-not-found');
+        });
+        it.each(['', '555', null, 1])('rejects invalid phone number %s before authentication', async (phone) => {
+            expect((await auth.getUserByPhoneNumber(phone)).error).toBeInstanceOf(FirebaseEdgeError);
+            expect(mockedGetToken).not.toHaveBeenCalled();
+        });
+        it('deletes a batch with tenant, custom fetch, counts, and indexed errors', async () => {
+            const customFetch = vi.fn();
+            const instance = new FirebaseAdminAuth(serviceAccountKey, 'tenant', customFetch);
+            vi.mocked(deleteAccountsAdmin).mockResolvedValue({
+                data: { errors: [{ index: 1, message: 'failure' }] },
+                error: null
+            });
+            const result = await instance.deleteUsers([
+                'one',
+                'two',
+                'missing'
+            ]);
+            expect(result.error).toBeNull();
+            expect(result.data).toMatchObject({
+                successCount: 2,
+                failureCount: 1,
+                errors: [{ index: 1, error: { message: 'failure' } }]
+            });
+            expect(deleteAccountsAdmin).toHaveBeenCalledWith('test-project', ['one', 'two', 'missing'], 'test-access-token', customFetch, 'tenant');
+        });
+        it('returns empty delete and import results without network requests', async () => {
+            const result = {
+                data: { successCount: 0, failureCount: 0, errors: [] },
+                error: null
+            };
+            expect(await auth.deleteUsers([])).toEqual(result);
+            expect(await auth.importUsers([])).toEqual(result);
+            expect(mockedGetToken).not.toHaveBeenCalled();
+        });
+        it('rejects invalid delete batches and oversized imports before authentication', async () => {
+            expect((await auth.deleteUsers(['one', ''])).error).not.toBeNull();
+            expect((await auth.deleteUsers(Array(1001).fill('uid'))).error).not.toBeNull();
+            expect((await auth.importUsers(Array(1001).fill({ uid: 'uid' }))).error).not.toBeNull();
+            expect(mockedGetToken).not.toHaveBeenCalled();
+        });
+        it('merges local and server import failures using original indices', async () => {
+            const customFetch = vi.fn();
+            const instance = new FirebaseAdminAuth(serviceAccountKey, 'tenant', customFetch);
+            vi.mocked(importAccountsAdmin).mockResolvedValue({
+                data: { error: [{ index: 1, message: 'DUPLICATE_LOCAL_ID' }] },
+                error: null
+            });
+            const result = await instance.importUsers([
+                { uid: '' },
+                { uid: 'one' },
+                { uid: 'two' }
+            ]);
+            expect(result.error).toBeNull();
+            expect(result.data).toMatchObject({
+                successCount: 1,
+                failureCount: 2,
+                errors: [{ index: 0 }, { index: 2 }]
+            });
+            expect(importAccountsAdmin).toHaveBeenCalledWith('test-project', { users: [{ localId: 'one' }, { localId: 'two' }] }, 'test-access-token', customFetch, 'tenant');
+        });
+        it('returns all-invalid imports locally and rejects missing password settings', async () => {
+            expect(await auth.importUsers([{ uid: '' }])).toMatchObject({
+                data: { successCount: 0, failureCount: 1 },
+                error: null
+            });
+            expect((await auth.importUsers([
+                { uid: 'uid', passwordHash: new Uint8Array([1]) }
+            ])).error).not.toBeNull();
+            expect(mockedGetToken).not.toHaveBeenCalled();
+            expect(importAccountsAdmin).not.toHaveBeenCalled();
+        });
+        it('sends the selected hashing configuration with password imports', async () => {
+            await auth.importUsers([{ uid: 'uid', passwordHash: new Uint8Array([1]) }], { hash: { algorithm: 'BCRYPT' } });
+            expect(importAccountsAdmin).toHaveBeenCalledWith('test-project', {
+                users: [{ localId: 'uid', passwordHash: 'AQ==' }],
+                hashAlgorithm: 'BCRYPT'
+            }, 'test-access-token', undefined, undefined);
+        });
+        it('uses cached credentials for all three methods', async () => {
+            const cache = {
+                getCache: vi.fn().mockResolvedValue(mockGoogleTokenResponse),
+                setCache: vi.fn()
+            };
+            const instance = new FirebaseAdminAuth(serviceAccountKey, undefined, undefined, cache);
+            expect((await instance.getUserByPhoneNumber('+15555550100')).error).toBeNull();
+            expect((await instance.deleteUsers(['uid'])).error).toBeNull();
+            expect((await instance.importUsers([{ uid: 'uid' }])).error).toBeNull();
+            expect(mockedGetToken).not.toHaveBeenCalled();
+        });
+        const operations = [
+            {
+                name: 'phone',
+                run: () => auth.getUserByPhoneNumber('+15555550100'),
+                endpoint: vi.mocked(getAccountInfo)
+            },
+            {
+                name: 'delete',
+                run: () => auth.deleteUsers(['uid']),
+                endpoint: vi.mocked(deleteAccountsAdmin)
+            },
+            {
+                name: 'import',
+                run: () => auth.importUsers([{ uid: 'uid' }]),
+                endpoint: vi.mocked(importAccountsAdmin)
+            }
+        ];
+        describe.each(operations)('$name failures', ({ run, endpoint }) => {
+            it('propagates token failures without calling the endpoint', async () => {
+                const error = new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SERVICE_ACCOUNT_TOKEN_FAILED);
+                mockedGetToken.mockResolvedValue({ data: null, error });
+                expect(await run()).toEqual({ data: null, error });
+                expect(endpoint).not.toHaveBeenCalled();
+            });
+            it('guards against a missing access token', async () => {
+                mockedGetToken.mockResolvedValue({
+                    data: {},
+                    error: null
+                });
+                expect((await run()).error?.code).toBe('auth/admin-no-token-returned');
+                expect(endpoint).not.toHaveBeenCalled();
+            });
+            it('returns endpoint errors and network exceptions', async () => {
+                const error = new FirebaseEdgeError(FirebaseEndpointErrorInfo.ENDPOINT_PERMISSION_DENIED);
+                endpoint.mockResolvedValue({ data: null, error });
+                expect(await run()).toMatchObject({
+                    data: null,
+                    error: expect.any(FirebaseEdgeError)
+                });
+                endpoint.mockRejectedValue(new Error('offline'));
+                expect(await run()).toMatchObject({
+                    data: null,
+                    error: expect.any(FirebaseEdgeError)
+                });
+            });
+        });
+        it('returns errors for corrupt bulk responses instead of misleading counts', async () => {
+            vi.mocked(deleteAccountsAdmin).mockResolvedValue({
+                data: { errors: [{ index: 5 }] },
+                error: null
+            });
+            vi.mocked(importAccountsAdmin).mockResolvedValue({
+                data: { error: [{ index: 5 }] },
+                error: null
+            });
+            expect((await auth.deleteUsers(['uid'])).error).not.toBeNull();
+            expect((await auth.importUsers([{ uid: 'uid' }])).error).not.toBeNull();
+        });
+    });
+    describe('getUsers', () => {
+        beforeEach(() => {
+            mockedGetToken.mockResolvedValue({
+                data: mockGoogleTokenResponse,
+                error: null
+            });
+            vi.mocked(getAccountsInfo).mockResolvedValue({
+                data: {},
+                error: null
+            });
+        });
+        it('returns records and unmatched identifiers using one batch request', async () => {
+            const customFetch = vi.fn();
+            const instance = new FirebaseAdminAuth(serviceAccountKey, 'tenant', customFetch);
+            const ids = [{ uid: 'uid' }, { email: 'missing@example.com' }];
+            vi.mocked(getAccountsInfo).mockResolvedValue({
+                data: { users: [{ localId: 'uid' }] },
+                error: null
+            });
+            const { data, error } = await instance.getUsers(ids);
+            expect(error).toBeNull();
+            expect(data?.users[0]?.uid).toBe('uid');
+            expect(data?.notFound).toEqual([ids[1]]);
+            expect(getAccountsInfo).toHaveBeenCalledExactlyOnceWith({ localId: ['uid'], email: ['missing@example.com'] }, 'test-access-token', 'test-project', 'tenant', customFetch);
+        });
+        it('returns an empty batch without authentication or requests', async () => {
+            expect(await auth.getUsers([])).toEqual({
+                data: { users: [], notFound: [] },
+                error: null
+            });
+            expect(mockedGetToken).not.toHaveBeenCalled();
+            expect(getAccountsInfo).not.toHaveBeenCalled();
+        });
+        it('rejects invalid inputs before authentication', async () => {
+            expect((await auth.getUsers([{ uid: '' }])).error).toBeInstanceOf(FirebaseEdgeError);
+            expect((await auth.getUsers(Array(101).fill({ uid: 'uid' }))).error).toBeInstanceOf(FirebaseEdgeError);
+            expect(mockedGetToken).not.toHaveBeenCalled();
+            expect(getAccountsInfo).not.toHaveBeenCalled();
+        });
+        it('returns all identifiers in notFound when there are no matches', async () => {
+            expect(await auth.getUsers([{ uid: 'missing' }])).toEqual({
+                data: { users: [], notFound: [{ uid: 'missing' }] },
+                error: null
+            });
+        });
+        it('uses cached credentials', async () => {
+            const cache = {
+                getCache: vi.fn().mockResolvedValue(mockGoogleTokenResponse),
+                setCache: vi.fn()
+            };
+            const instance = new FirebaseAdminAuth(serviceAccountKey, undefined, undefined, cache);
+            expect((await instance.getUsers([{ uid: 'uid' }])).error).toBeNull();
+            expect(mockedGetToken).not.toHaveBeenCalled();
+            expect(getAccountsInfo).toHaveBeenCalledTimes(1);
+        });
+        it('returns credential failures without a lookup', async () => {
+            const error = new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SERVICE_ACCOUNT_TOKEN_FAILED);
+            mockedGetToken.mockResolvedValue({ data: null, error });
+            expect(await auth.getUsers([{ uid: 'uid' }])).toEqual({
+                data: null,
+                error
+            });
+            expect(getAccountsInfo).not.toHaveBeenCalled();
+        });
+        it('guards against missing access tokens', async () => {
+            mockedGetToken.mockResolvedValue({
+                data: {},
+                error: null
+            });
+            expect((await auth.getUsers([{ uid: 'uid' }])).error?.code).toBe('auth/admin-no-token-returned');
+            expect(getAccountsInfo).not.toHaveBeenCalled();
+        });
+        it('retains mapped endpoint failures as the cause', async () => {
+            const cause = new FirebaseEdgeError(FirebaseEndpointErrorInfo.ENDPOINT_PERMISSION_DENIED);
+            vi.mocked(getAccountsInfo).mockResolvedValue({
+                data: null,
+                error: cause
+            });
+            const result = await auth.getUsers([{ uid: 'uid' }]);
+            expect(result.data).toBeNull();
+            expect(result.error?.cause).toBe(cause);
+        });
+        it.each([null, 'not JSON', { users: [{}] }, { users: 'invalid' }])('returns structured errors for malformed responses %j', async (data) => {
+            vi.mocked(getAccountsInfo).mockResolvedValue({
+                data,
+                error: null
+            });
+            const result = await auth.getUsers([{ uid: 'uid' }]);
+            expect(result.data).toBeNull();
+            expect(result.error?.code).toBe('auth/admin-user-lookup-failed');
+        });
+        it('returns network and token exceptions rather than rejecting', async () => {
+            vi.mocked(getAccountsInfo).mockRejectedValue(new Error('offline'));
+            expect((await auth.getUsers([{ uid: 'uid' }])).error?.cause).toBeInstanceOf(Error);
+            mockedGetToken.mockRejectedValue('token failure');
+            expect((await auth.getUsers([{ uid: 'uid' }])).error?.cause).toBeInstanceOf(Error);
+        });
+    });
+    describe('user management', () => {
+        beforeEach(() => {
+            mockedGetToken.mockResolvedValue({
+                data: mockGoogleTokenResponse,
+                error: null
+            });
+            mockedGetAccountInfo.mockResolvedValue({
+                data: mockUserRecord,
+                error: null
+            });
+            vi.mocked(createAccountAdmin).mockResolvedValue({
+                data: { localId: 'uid-1' },
+                error: null
+            });
+            vi.mocked(updateAccountAdmin).mockResolvedValue({
+                data: { localId: 'uid-1' },
+                error: null
+            });
+            vi.mocked(deleteAccountAdmin).mockResolvedValue({ error: null });
+        });
+        it('creates a user and reads the full record with the same credentials', async () => {
+            const customFetch = vi.fn();
+            const instance = new FirebaseAdminAuth(serviceAccountKey, 'tenant', customFetch);
+            const result = await instance.createUser({
+                email: 'test@example.com',
+                photoURL: 'https://example.com/photo',
+                disabled: false
+            });
+            expect(result.error).toBeNull();
+            expect(result.data?.uid).toBe('uid-1');
+            expect(result.data?.toJSON()).toMatchObject({
+                uid: 'uid-1',
+                email: 'test@example.com'
+            });
+            expect(createAccountAdmin).toHaveBeenCalledWith('test-project', {
+                email: 'test@example.com',
+                photoUrl: 'https://example.com/photo',
+                disabled: false
+            }, 'test-access-token', customFetch, 'tenant');
+            expect(mockedGetAccountInfo).toHaveBeenCalledWith({ uid: 'uid-1' }, 'test-access-token', 'test-project', 'tenant', customFetch);
+            expect(mockedGetToken).toHaveBeenCalledTimes(1);
+        });
+        it('updates through the existing endpoint with translated fields and tenant', async () => {
+            const result = await authWithTenant.updateUser('uid-1', {
+                displayName: null,
+                photoURL: null,
+                phoneNumber: null,
+                disabled: true
+            });
+            expect(result.error).toBeNull();
+            expect(result.data?.uid).toBe('uid-1');
+            expect(updateAccountAdmin).toHaveBeenCalledWith('test-project', 'uid-1', {
+                deleteAttribute: ['DISPLAY_NAME', 'PHOTO_URL'],
+                deleteProvider: ['phone'],
+                disableUser: true
+            }, 'test-access-token', undefined, 'test-tenant-id');
+            expect(mockedGetAccountInfo).toHaveBeenCalledWith({ uid: 'uid-1' }, 'test-access-token', 'test-project', 'test-tenant-id', undefined);
+        });
+        it('deletes without a follow-up lookup and returns void data', async () => {
+            expect(await authWithTenant.deleteUser('uid-1')).toEqual({
+                data: undefined,
+                error: null
+            });
+            expect(deleteAccountAdmin).toHaveBeenCalledWith('test-project', 'uid-1', 'test-access-token', undefined, 'test-tenant-id');
+            expect(mockedGetAccountInfo).not.toHaveBeenCalled();
+        });
+        it.each(['', 'a'.repeat(129), null])('rejects invalid UID %s before authentication', async (uid) => {
+            expect((await auth.updateUser(uid, {})).error).toBeInstanceOf(FirebaseEdgeError);
+            expect((await auth.deleteUser(uid)).error).toBeInstanceOf(FirebaseEdgeError);
+            expect(mockedGetToken).not.toHaveBeenCalled();
+        });
+        it('rejects invalid create and update properties before authentication', async () => {
+            expect((await auth.createUser({ email: 'invalid' })).error).toBeInstanceOf(FirebaseEdgeError);
+            expect((await auth.updateUser('uid', { password: 'short' })).error).toBeInstanceOf(FirebaseEdgeError);
+            expect(mockedGetToken).not.toHaveBeenCalled();
+        });
+        const operations = [
+            {
+                name: 'create',
+                run: () => auth.createUser({}),
+                endpoint: vi.mocked(createAccountAdmin)
+            },
+            {
+                name: 'update',
+                run: () => auth.updateUser('uid-1', {}),
+                endpoint: vi.mocked(updateAccountAdmin)
+            },
+            {
+                name: 'delete',
+                run: () => auth.deleteUser('uid-1'),
+                endpoint: vi.mocked(deleteAccountAdmin)
+            }
+        ];
+        describe.each(operations)('$name errors', ({ name, run, endpoint }) => {
+            it('returns credential errors without a write', async () => {
+                const error = new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SERVICE_ACCOUNT_TOKEN_FAILED);
+                mockedGetToken.mockResolvedValue({ data: null, error });
+                expect(await run()).toEqual({ data: null, error });
+                expect(endpoint).not.toHaveBeenCalled();
+            });
+            it('guards against missing credentials', async () => {
+                mockedGetToken.mockResolvedValue({
+                    data: {},
+                    error: null
+                });
+                expect((await run()).error?.code).toBe('auth/admin-no-token-returned');
+                expect(endpoint).not.toHaveBeenCalled();
+            });
+            it('preserves API errors as the cause without a readback', async () => {
+                const cause = new FirebaseEdgeError(FirebaseEndpointErrorInfo.ENDPOINT_USER_NOT_FOUND);
+                endpoint.mockResolvedValue({ data: null, error: cause });
+                const result = await run();
+                expect(result.data).toBeNull();
+                expect(result.error?.code).toBe(`auth/admin-${name}-user-failed`);
+                expect(result.error?.cause).toBe(cause);
+                expect(mockedGetAccountInfo).not.toHaveBeenCalled();
+            });
+            it('returns transport exceptions instead of rejecting', async () => {
+                const cause = new Error('offline');
+                endpoint.mockRejectedValue(cause);
+                const result = await run();
+                expect(result.data).toBeNull();
+                expect(result.error?.cause).toBe(cause);
+            });
+            it('returns unexpected token exceptions', async () => {
+                mockedGetToken.mockRejectedValue('token failure');
+                const result = await run();
+                expect(result.data).toBeNull();
+                expect(result.error?.code).toBe(`auth/admin-${name}-user-failed`);
+            });
+        });
+        describe.each(operations.slice(0, 2))('$name readback', ({ run, endpoint }) => {
+            it('requires a UID in the write response', async () => {
+                endpoint.mockResolvedValue({
+                    data: { localId: '' },
+                    error: null
+                });
+                expect((await run()).error).toBeInstanceOf(FirebaseEdgeError);
+                expect(mockedGetAccountInfo).not.toHaveBeenCalled();
+            });
+            it('returns lookup errors', async () => {
+                const error = new FirebaseEdgeError(FirebaseEndpointErrorInfo.ENDPOINT_USER_NOT_FOUND);
+                mockedGetAccountInfo.mockResolvedValue({
+                    data: null,
+                    error
+                });
+                expect(await run()).toEqual({ data: null, error });
+            });
+            it('handles a missing user in the lookup response', async () => {
+                mockedGetAccountInfo.mockResolvedValue({
+                    data: null,
+                    error: null
+                });
+                expect((await run()).error?.code).toBe('auth/admin-user-record-not-found');
+            });
+            it('returns conversion errors rather than rejecting', async () => {
+                mockedGetAccountInfo.mockResolvedValue({
+                    data: { localId: 'uid', customAttributes: '{' },
+                    error: null
+                });
+                expect((await run()).error).toBeInstanceOf(FirebaseEdgeError);
+            });
+        });
+    });
+    describe('listUsers', () => {
+        const download = vi.mocked(downloadAccount);
+        beforeEach(() => {
+            mockedGetToken.mockResolvedValue({
+                data: mockGoogleTokenResponse,
+                error: null
+            });
+            download.mockResolvedValue({ data: {}, error: null });
+        });
+        it('requests the default page and converts the result', async () => {
+            download.mockResolvedValue({
+                data: { users: [{ localId: 'uid' }], nextPageToken: 'next' },
+                error: null
+            });
+            const { data, error } = await auth.listUsers();
+            expect(error).toBeNull();
+            expect(data?.pageToken).toBe('next');
+            expect(data?.users[0]).toMatchObject({
+                uid: 'uid',
+                emailVerified: false,
+                disabled: false
+            });
+            expect(download).toHaveBeenCalledExactlyOnceWith('test-access-token', 'test-project', 1000, undefined, undefined, undefined);
+        });
+        it('forwards pagination, tenant, and custom fetch to the endpoint', async () => {
+            const customFetch = vi.fn();
+            const instance = new FirebaseAdminAuth(serviceAccountKey, 'tenant', customFetch);
+            expect(await instance.listUsers(25, 'opaque+/=')).toEqual({
+                data: { users: [] },
+                error: null
+            });
+            expect(download).toHaveBeenCalledExactlyOnceWith('test-access-token', 'test-project', 25, 'opaque+/=', 'tenant', customFetch);
+            expect(mockedGetToken).toHaveBeenCalledWith(serviceAccountKey, customFetch);
+        });
+        it('defaults an undefined page size and omits an absent page token', async () => {
+            expect(await auth.listUsers(undefined)).toEqual({
+                data: { users: [] },
+                error: null
+            });
+        });
+        it('preserves an explicitly returned empty page token', async () => {
+            download.mockResolvedValue({
+                data: { nextPageToken: '' },
+                error: null
+            });
+            expect(await auth.listUsers()).toEqual({
+                data: { users: [], pageToken: '' },
+                error: null
+            });
+        });
+        it.each([0, -1, 1001, 1.5, NaN, Infinity, null, '10'])('rejects invalid page size %s before authentication', async (size) => {
+            const result = await auth.listUsers(size);
+            expect(result.data).toBeNull();
+            expect(result.error?.code).toBe('auth/admin-api-invalid-argument');
+            expect(mockedGetToken).not.toHaveBeenCalled();
+            expect(download).not.toHaveBeenCalled();
+        });
+        it.each(['', null, 123, {}])('rejects invalid page token %s before authentication', async (pageToken) => {
+            const result = await auth.listUsers(25, pageToken);
+            expect(result.data).toBeNull();
+            expect(result.error?.code).toBe('auth/admin-invalid-page-token');
+            expect(mockedGetToken).not.toHaveBeenCalled();
+            expect(download).not.toHaveBeenCalled();
+        });
+        it('returns authentication errors without calling the endpoint', async () => {
+            const error = new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SERVICE_ACCOUNT_TOKEN_FAILED);
+            mockedGetToken.mockResolvedValue({ data: null, error });
+            expect(await auth.listUsers()).toEqual({ data: null, error });
+            expect(download).not.toHaveBeenCalled();
+        });
+        it('uses cached credentials', async () => {
+            const cache = {
+                getCache: vi.fn().mockResolvedValue(mockGoogleTokenResponse),
+                setCache: vi.fn()
+            };
+            const instance = new FirebaseAdminAuth(serviceAccountKey, undefined, undefined, cache);
+            expect((await instance.listUsers()).error).toBeNull();
+            expect(mockedGetToken).not.toHaveBeenCalled();
+            expect(cache.getCache).toHaveBeenCalledWith('__cache');
+            expect(download).toHaveBeenCalledWith('test-access-token', 'test-project', 1000, undefined, undefined, undefined);
+        });
+        it('guards against a missing access token', async () => {
+            mockedGetToken.mockResolvedValue({
+                data: {},
+                error: null
+            });
+            expect((await auth.listUsers()).error?.code).toBe('auth/admin-no-token-returned');
+            expect(download).not.toHaveBeenCalled();
+        });
+        it('retains a mapped endpoint error as its cause', async () => {
+            const cause = new FirebaseEdgeError(FirebaseEndpointErrorInfo.ENDPOINT_PERMISSION_DENIED);
+            download.mockResolvedValue({ data: null, error: cause });
+            const result = await auth.listUsers();
+            expect(result.data).toBeNull();
+            expect(result.error?.code).toBe('auth/admin-list-users-failed');
+            expect(result.error?.cause).toBe(cause);
+        });
+        it.each([
+            null,
+            'not JSON',
+            { users: [{ localId: 'uid', customAttributes: '{' }] },
+            { users: [{}] },
+            { users: 'invalid' }
+        ])('returns an error for invalid endpoint data %j', async (data) => {
+            download.mockResolvedValue({ data, error: null });
+            const result = await auth.listUsers();
+            expect(result.data).toBeNull();
+            expect(result.error?.code).toBe('auth/admin-list-users-failed');
+        });
+        it('returns unexpected endpoint failures rather than rejecting', async () => {
+            const cause = new Error('offline');
+            download.mockRejectedValue(cause);
+            const result = await auth.listUsers();
+            expect(result.data).toBeNull();
+            expect(result.error?.cause).toBe(cause);
+        });
+        it('normalizes unexpected authentication failures', async () => {
+            mockedGetToken.mockRejectedValue('token failure');
+            const result = await auth.listUsers();
+            expect(result.data).toBeNull();
+            expect(result.error?.cause).toBeInstanceOf(Error);
+        });
+    });
     describe('getUser', () => {
         it('returns error when getToken returns an error', async () => {
             mockedGetToken.mockResolvedValueOnce({
@@ -298,13 +1084,186 @@ describe('FirebaseAdminAuth', () => {
             expect(result.error).toBeNull();
         });
     });
+    describe.each([
+        ['generatePasswordResetLink', 'PASSWORD_RESET'],
+        ['generateEmailVerificationLink', 'VERIFY_EMAIL'],
+        ['generateSignInWithEmailLink', 'EMAIL_SIGNIN']
+    ])('%s', (method, requestType) => {
+        const settings = {
+            url: 'https://example.com/finish',
+            handleCodeInApp: true
+        };
+        it('returns the generated link and forwards credentials, settings, tenant and fetch', async () => {
+            const fetchFn = vi.fn();
+            const admin = new FirebaseAdminAuth(serviceAccountKey, 'tenant', fetchFn);
+            mockedGetToken.mockResolvedValue({
+                data: mockGoogleTokenResponse,
+                error: null
+            });
+            vi.mocked(generateEmailActionLink).mockResolvedValue({
+                data: 'https://example.com/action',
+                error: null
+            });
+            expect(await admin[method]('person@example.com', settings)).toEqual({ data: 'https://example.com/action', error: null });
+            expect(generateEmailActionLink).toHaveBeenCalledWith('test-project', {
+                requestType,
+                email: 'person@example.com',
+                returnOobLink: true,
+                continueUrl: settings.url,
+                canHandleCodeInApp: true
+            }, 'test-access-token', fetchFn, 'tenant');
+        });
+        it('rejects invalid input before obtaining credentials', async () => {
+            expect((await auth[method]('invalid', settings)).error?.code).toBe(FirebaseAdminAuthErrorInfo.ADMIN_API_INVALID_ARGUMENT.code);
+            expect(mockedGetToken).not.toHaveBeenCalled();
+            expect(generateEmailActionLink).not.toHaveBeenCalled();
+        });
+        it('returns authentication errors without calling the endpoint', async () => {
+            mockedGetToken.mockResolvedValue({
+                data: null,
+                error: new Error('credentials')
+            });
+            expect((await auth[method]('person@example.com', settings)).error?.code).toBe(FirebaseAdminAuthErrorInfo.ADMIN_SERVICE_ACCOUNT_TOKEN_FAILED
+                .code);
+            expect(generateEmailActionLink).not.toHaveBeenCalled();
+        });
+        it('wraps endpoint errors and preserves the cause', async () => {
+            const cause = new Error('email not found');
+            mockedGetToken.mockResolvedValue({
+                data: mockGoogleTokenResponse,
+                error: null
+            });
+            vi.mocked(generateEmailActionLink).mockResolvedValue({
+                data: null,
+                error: cause
+            });
+            const result = await auth[method]('person@example.com', settings);
+            expect(result.error?.code).toBe(FirebaseAdminAuthErrorInfo.ADMIN_EMAIL_ACTION_LINK_FAILED.code);
+            expect(result.error?.cause).toBe(cause);
+        });
+        it('returns unexpected failures using the package error convention', async () => {
+            mockedGetToken.mockResolvedValue({
+                data: mockGoogleTokenResponse,
+                error: null
+            });
+            vi.mocked(generateEmailActionLink).mockRejectedValue(new Error('network'));
+            expect((await auth[method]('person@example.com', settings)).error?.code).toBe(FirebaseAdminAuthErrorInfo.ADMIN_EMAIL_ACTION_LINK_FAILED.code);
+        });
+    });
+    it.each([
+        'generatePasswordResetLink',
+        'generateEmailVerificationLink'
+    ])('%s allows omitted settings', async (method) => {
+        mockedGetToken.mockResolvedValue({
+            data: mockGoogleTokenResponse,
+            error: null
+        });
+        vi.mocked(generateEmailActionLink).mockResolvedValue({
+            data: 'https://example.com/action',
+            error: null
+        });
+        expect((await auth[method]('person@example.com')).error).toBeNull();
+        expect(generateEmailActionLink).toHaveBeenCalledWith('test-project', expect.not.objectContaining({ continueUrl: expect.anything() }), 'test-access-token', undefined, undefined);
+    });
+    it('requires settings when generating an email sign-in link', async () => {
+        const result = 
+        // @ts-expect-error Settings are required for email sign-in.
+        await auth.generateSignInWithEmailLink('person@example.com');
+        expect(result.error?.code).toBe(FirebaseAdminAuthErrorInfo.ADMIN_API_INVALID_ARGUMENT.code);
+        expect(mockedGetToken).not.toHaveBeenCalled();
+    });
+    it.each([
+        'generatePasswordResetLink',
+        'generateEmailVerificationLink',
+        'generateSignInWithEmailLink',
+        'createSessionCookie'
+    ])('%s rejects missing access tokens', async (method) => {
+        mockedGetToken.mockResolvedValue({
+            data: { ...mockGoogleTokenResponse, access_token: '' },
+            error: null
+        });
+        const result = method === 'createSessionCookie'
+            ? await auth.createSessionCookie('id-token', {
+                expiresIn: 300000
+            })
+            : await auth[method]('person@example.com', {
+                url: 'https://example.com'
+            });
+        expect(result.error?.code).toBe(FirebaseAdminAuthErrorInfo.ADMIN_NO_TOKEN_RETURNED.code);
+        expect(generateEmailActionLink).not.toHaveBeenCalled();
+        expect(mockedCreateSessionCookieEndpoint).not.toHaveBeenCalled();
+    });
     describe('createSessionCookie', () => {
+        it.each([
+            undefined,
+            null,
+            3600000,
+            {},
+            { expiresIn: '3600000' },
+            { expiresIn: NaN },
+            { expiresIn: Infinity },
+            { expiresIn: 299999 },
+            { expiresIn: 1209600001 }
+        ])('rejects invalid options %j before authentication', async (options) => {
+            const result = await auth.createSessionCookie('id-token', options);
+            expect(result.error?.code).toBe(FirebaseAdminAuthErrorInfo
+                .ADMIN_SESSION_COOKIE_DURATION_INVALID.code);
+            expect(mockedGetToken).not.toHaveBeenCalled();
+        });
+        it.each(['', null, 1])('rejects invalid ID token %s', async (idToken) => {
+            const result = await auth.createSessionCookie(idToken, { expiresIn: 300000 });
+            expect(result.error?.code).toBe(FirebaseAdminAuthErrorInfo.ADMIN_ID_TOKEN_INVALID.code);
+            expect(mockedGetToken).not.toHaveBeenCalled();
+        });
+        it.each([300000, 1209600000])('accepts boundary lifetime %s and forwards tenant and fetch', async (expiresIn) => {
+            const fetchFn = vi.fn();
+            const admin = new FirebaseAdminAuth(serviceAccountKey, 'tenant', fetchFn);
+            mockedGetToken.mockResolvedValue({
+                data: mockGoogleTokenResponse,
+                error: null
+            });
+            mockedCreateSessionCookieEndpoint.mockResolvedValue({
+                data: 'cookie',
+                error: null
+            });
+            expect(await admin.createSessionCookie('id-token', { expiresIn })).toEqual({ data: 'cookie', error: null });
+            expect(mockedCreateSessionCookieEndpoint).toHaveBeenCalledWith('id-token', 'test-access-token', 'test-project', expiresIn, 'tenant', fetchFn);
+        });
+        it('returns an error for an empty cookie response', async () => {
+            mockedGetToken.mockResolvedValue({
+                data: mockGoogleTokenResponse,
+                error: null
+            });
+            mockedCreateSessionCookieEndpoint.mockResolvedValue({
+                data: null,
+                error: null
+            });
+            const result = await auth.createSessionCookie('id-token', {
+                expiresIn: 300000
+            });
+            expect(result.error?.code).toBe(FirebaseAdminAuthErrorInfo.ADMIN_SESSION_COOKIE_CREATE_FAILED
+                .code);
+        });
+        it('wraps unexpected endpoint failures', async () => {
+            mockedGetToken.mockResolvedValue({
+                data: mockGoogleTokenResponse,
+                error: null
+            });
+            mockedCreateSessionCookieEndpoint.mockRejectedValue(new Error('network'));
+            const result = await auth.createSessionCookie('id-token', {
+                expiresIn: 300000
+            });
+            expect(result.error?.code).toBe(FirebaseAdminAuthErrorInfo.ADMIN_SESSION_COOKIE_CREATE_FAILED
+                .code);
+        });
         it('returns error when getToken fails', async () => {
             mockedGetToken.mockResolvedValueOnce({
                 data: null,
                 error: new Error('unauthorized')
             });
-            const result = await auth.createSessionCookie('id-token', 3600);
+            const result = await auth.createSessionCookie('id-token', {
+                expiresIn: 3600000
+            });
             expect(result.data).toBeNull();
             expect(result.error).toBeInstanceOf(FirebaseEdgeError);
             expect(result.error.code).toBe(FirebaseAdminAuthErrorInfo.ADMIN_SERVICE_ACCOUNT_TOKEN_FAILED
@@ -315,7 +1274,9 @@ describe('FirebaseAdminAuth', () => {
                 data: null,
                 error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SERVICE_ACCOUNT_TOKEN_FAILED)
             });
-            const result = await auth.createSessionCookie('id-token', 3600);
+            const result = await auth.createSessionCookie('id-token', {
+                expiresIn: 3600000
+            });
             expect(result.data).toBeNull();
             expect(result.error).toBeInstanceOf(FirebaseEdgeError);
             expect(result.error.code).toBe(FirebaseAdminAuthErrorInfo.ADMIN_SERVICE_ACCOUNT_TOKEN_FAILED
@@ -331,8 +1292,10 @@ describe('FirebaseAdminAuth', () => {
                 data: null,
                 error: endpointError
             });
-            const result = await auth.createSessionCookie('id-token', 3600);
-            expect(mockedCreateSessionCookieEndpoint).toHaveBeenCalledWith('id-token', 'test-access-token', 'test-project', 3600, undefined, undefined);
+            const result = await auth.createSessionCookie('id-token', {
+                expiresIn: 3600000
+            });
+            expect(mockedCreateSessionCookieEndpoint).toHaveBeenCalledWith('id-token', 'test-access-token', 'test-project', 3600000, undefined, undefined);
             expect(result.data).toBeNull();
             expect(result.error).toBeInstanceOf(FirebaseEdgeError);
             expect(result.error.code).toBe(FirebaseAdminAuthErrorInfo.ADMIN_SESSION_COOKIE_CREATE_FAILED
@@ -348,12 +1311,58 @@ describe('FirebaseAdminAuth', () => {
                 data: cookieData,
                 error: null
             });
-            const result = await auth.createSessionCookie('id-token', 3600);
+            const result = await auth.createSessionCookie('id-token', {
+                expiresIn: 3600000
+            });
             expect(result.data).toEqual(cookieData);
             expect(result.error).toBeNull();
         });
     });
     describe('verifySessionCookie', () => {
+        it('rejects disabled users when revocation checking is enabled', async () => {
+            mockedVerifySessionJWT.mockResolvedValue({
+                data: mockFirebasePayload,
+                error: null
+            });
+            vi.spyOn(auth, 'getUser').mockResolvedValue({
+                data: { ...mockUserRecord, disabled: true },
+                error: null
+            });
+            expect((await auth.verifySessionCookie('cookie', true)).error?.code).toBe(FirebaseAdminAuthErrorInfo.ADMIN_USER_DISABLED.code);
+        });
+        it.each([
+            [
+                '1001',
+                FirebaseAdminAuthErrorInfo.ADMIN_SESSION_COOKIE_REVOKED.code
+            ],
+            ['1000', undefined],
+            ['999', undefined],
+            [undefined, undefined]
+        ])('checks auth_time against validSince %s, not issuance time', async (validSince, expectedCode) => {
+            mockedVerifySessionJWT.mockResolvedValue({
+                data: { ...mockFirebasePayload, iat: 1500 },
+                error: null
+            });
+            vi.spyOn(auth, 'getUser').mockResolvedValue({
+                data: { ...mockUserRecord, validSince },
+                error: null
+            });
+            const result = await auth.verifySessionCookie('cookie', true);
+            expect(result.error?.code).toBe(expectedCode);
+            expect(result.data === null).toBe(Boolean(expectedCode));
+        });
+        it('skips the user lookup by default', async () => {
+            mockedVerifySessionJWT.mockResolvedValue({
+                data: mockFirebasePayload,
+                error: null
+            });
+            const lookup = vi.spyOn(auth, 'getUser');
+            expect(await auth.verifySessionCookie('cookie')).toEqual({
+                data: mockFirebasePayload,
+                error: null
+            });
+            expect(lookup).not.toHaveBeenCalled();
+        });
         it('returns error when verifySessionJWT fails', async () => {
             mockedVerifySessionJWT.mockResolvedValueOnce({
                 data: null,