firebase-admin-edge 1.1.0 → 2.0.0

package/dist/auth/firebase-admin-auth.js

@@ -1,9 +1,18 @@
-import { createAccountAdmin, updateAccountAdmin, deleteAccountAdmin, createSessionCookie, downloadAccount, getAccountInfo, getAccountsInfo, revokeRefreshTokens } from './firebase-auth-endpoints.js';
-import { signJWTCustomToken, verifyJWT, verifySessionJWT } from './firebase-jwt.js';
+import { createAuthEmulatorFetch, manageAuthConfig, generateEmailActionLink, deleteAccountsAdmin, importAccountsAdmin, createAccountAdmin, updateAccountAdmin, deleteAccountAdmin, createSessionCookie, downloadAccount, getAccountInfo, getAccountsInfo, revokeRefreshTokens } from './firebase-auth-endpoints.js';
+import { resolveAuthEmulatorHost } from './auth-emulator.js';
+import { buildAuthConfigRequest, validateTenantId } from './auth-config.js';
+import { ProjectConfigManager } from './project-config-manager.js';
+import { TenantManager } from './tenant-manager.js';
+export { ProjectConfigManager } from './project-config-manager.js';
+export { TenantManager } from './tenant-manager.js';
+import { verifyAuthBlockingJWT, signJWTCustomToken, verifyJWT, verifySessionJWT } from './firebase-jwt.js';
 import { getToken } from './google-oauth.js';
 import { FirebaseEdgeError, FirebaseAdminAuthErrorInfo, ensureError } from './errors.js';
+import { validateDeleteUsers, createBatchUserResult } from './user-batch.js';
+import { prepareUserImport } from './user-import.js';
 import { createUserRecord, createGetUsersResult } from './user-record.js';
-import { buildUserRequest, buildUsersLookupRequest, validateUserUid } from './user-request.js';
+import { buildUserRequest, buildCustomClaimsRequest, buildUsersLookupRequest, validateUserUid } from './user-request.js';
+import { buildEmailActionRequest } from './email-action-request.js';
 /**
  * Firebase Admin Authentication handler for edge environments.
  * Provides server-side authentication operations using service account credentials.
@@ -14,7 +23,98 @@ export class FirebaseAdminAuth {
     fetch;
     cache;
     cacheName;
+    /** Verify a blocking-event JWT. Audience matching follows the SDK's substring convention. */
+    async _verifyAuthBlockingToken(token, audience) {
+        const result = await verifyAuthBlockingJWT(token, this.serviceAccountKey.project_id, audience, this.fetch, !!this.emulatorHost);
+        if (result.error)
+            return result;
+        if (this.tenantId && result.data.tenant_id !== this.tenantId)
+            return {
+                data: null,
+                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_TENANT_ID_INVALID)
+            };
+        return result;
+    }
+    emulatorHost;
     _cacheName = '__cache';
+    projectManager;
+    tenants;
+    createProviderConfig(config) {
+        return this.executeConfig({
+            resource: 'provider',
+            action: 'create',
+            id: config?.providerId,
+            properties: config
+        });
+    }
+    getProviderConfig(providerId) {
+        return this.executeConfig({
+            resource: 'provider',
+            action: 'get',
+            id: providerId
+        });
+    }
+    updateProviderConfig(providerId, config) {
+        return this.executeConfig({
+            resource: 'provider',
+            action: 'update',
+            id: providerId,
+            properties: config
+        });
+    }
+    deleteProviderConfig(providerId) {
+        return this.executeConfig({
+            resource: 'provider',
+            action: 'delete',
+            id: providerId
+        });
+    }
+    listProviderConfigs(filter) {
+        return this.executeConfig({
+            resource: 'provider',
+            action: 'list',
+            type: filter?.type,
+            maxResults: filter?.maxResults,
+            pageToken: filter?.pageToken
+        });
+    }
+    projectConfigManager() {
+        if (this.projectManager)
+            return this.projectManager;
+        this.projectManager = new ProjectConfigManager(this.executeConfig.bind(this));
+        return this.projectManager;
+    }
+    tenantManager() {
+        if (this.tenants)
+            return this.tenants;
+        this.tenants = new TenantManager(this.executeConfig.bind(this), (tenantId) => new FirebaseAdminAuth(this.serviceAccountKey, tenantId, this.fetch, this.cache, this._cacheName, { emulatorHost: this.emulatorHost }));
+        return this.tenants;
+    }
+    async executeConfig(operation) {
+        try {
+            buildAuthConfigRequest(operation);
+            const { data: token, error } = await this.getCachedToken();
+            if (error)
+                return { data: null, error };
+            if (!token?.access_token)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_NO_TOKEN_RETURNED)
+                };
+            return await manageAuthConfig(this.serviceAccountKey.project_id, operation, token.access_token, this.fetch, this.tenantId);
+        }
+        catch (cause) {
+            if (cause instanceof FirebaseEdgeError)
+                return { data: null, error: cause };
+            return {
+                data: null,
+                error: new FirebaseEdgeError({
+                    code: 'auth/configuration-request-failed',
+                    message: 'Authentication configuration request failed.'
+                }, { cause: ensureError(cause) })
+            };
+        }
+    }
     /**
      * Creates a new Firebase Admin Auth instance.
      *
@@ -23,13 +123,19 @@ export class FirebaseAdminAuth {
      * @param fetch Optional custom fetch implementation
      * @param cache Optional cache implementation for token caching
      * @param cacheName Optional cache key name (defaults to '__cache')
+     * @param options Auth emulator configuration; defaults to FIREBASE_AUTH_EMULATOR_HOST when set.
      */
-    constructor(serviceAccountKey, tenantId, fetch, cache, cacheName) {
+    constructor(serviceAccountKey, tenantId, fetch, cache, cacheName, options = {}) {
         this.serviceAccountKey = serviceAccountKey;
         this.tenantId = tenantId;
         this.fetch = fetch;
         this.cache = cache;
         this.cacheName = cacheName;
+        if (tenantId !== undefined)
+            validateTenantId(tenantId);
+        this.emulatorHost = resolveAuthEmulatorHost(options.emulatorHost);
+        if (this.emulatorHost)
+            this.fetch = createAuthEmulatorFetch(this.emulatorHost, this.fetch);
         this._cacheName = this.cacheName || this._cacheName;
     }
     /**
@@ -39,7 +145,20 @@ export class FirebaseAdminAuth {
      * @returns Promise with token data and error
      */
     async getCachedToken() {
-        const cachedToken = await this.cache?.getCache(this._cacheName);
+        if (this.emulatorHost) {
+            return {
+                data: {
+                    access_token: 'owner',
+                    expires_in: 3600,
+                    token_type: 'Bearer',
+                    scope: '',
+                    id_token: ''
+                },
+                error: null
+            };
+        }
+        const cacheKey = `${this._cacheName}:auth:${this.serviceAccountKey.client_email}`;
+        const cachedToken = await this.cache?.getCache(cacheKey);
         if (cachedToken) {
             return {
                 data: cachedToken,
@@ -48,8 +167,11 @@ export class FirebaseAdminAuth {
         }
         const { data: token, error: getTokenError } = await getToken(this.serviceAccountKey, this.fetch);
         if (token && this.cache) {
-            // Google tokens are valid for 1 hour
-            this.cache?.setCache('token', token, 3600);
+            // Cache adapters accept milliseconds. Expire before the OAuth token does.
+            const ttlMs = Math.max(0, (token.expires_in - 60) * 1000);
+            if (Number.isFinite(ttlMs) && ttlMs > 0) {
+                await this.cache.setCache(cacheKey, token, ttlMs);
+            }
         }
         if (getTokenError) {
             return {
@@ -133,6 +255,43 @@ export class FirebaseAdminAuth {
             };
         }
     }
+    /** Replace stored custom claims; pass null to clear all claims. */
+    async setCustomUserClaims(uid, claims) {
+        const uidError = validateUserUid(uid);
+        if (uidError)
+            return { data: null, error: uidError };
+        const request = buildCustomClaimsRequest(claims);
+        if (request.error)
+            return { data: null, error: request.error };
+        try {
+            const { data: token, error } = await this.getCachedToken();
+            if (error)
+                return { data: null, error };
+            if (!token?.access_token)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_NO_TOKEN_RETURNED)
+                };
+            const result = await updateAccountAdmin(this.serviceAccountKey.project_id, uid, request.data, token.access_token, this.fetch, this.tenantId);
+            if (result.error)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SET_CUSTOM_CLAIMS_FAILED, { cause: result.error })
+                };
+            if (!result.data?.localId)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SET_CUSTOM_CLAIMS_FAILED)
+                };
+            return { data: undefined, error: null };
+        }
+        catch (cause) {
+            return {
+                data: null,
+                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SET_CUSTOM_CLAIMS_FAILED, { cause: ensureError(cause) })
+            };
+        }
+    }
     /** Delete one user. A successful deletion returns undefined data. */
     async deleteUser(uid) {
         const uidError = validateUserUid(uid);
@@ -162,6 +321,88 @@ export class FirebaseAdminAuth {
             };
         }
     }
+    /** Delete up to 1000 users, reporting failures by original input index. */
+    async deleteUsers(uids) {
+        const validationError = validateDeleteUsers(uids);
+        if (validationError)
+            return { data: null, error: validationError };
+        if (uids.length === 0)
+            return { data: createBatchUserResult([]), error: null };
+        try {
+            const { data: token, error } = await this.getCachedToken();
+            if (error)
+                return { data: null, error };
+            if (!token?.access_token)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_NO_TOKEN_RETURNED)
+                };
+            const result = await deleteAccountsAdmin(this.serviceAccountKey.project_id, uids, token.access_token, this.fetch, this.tenantId);
+            if (result.error)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_DELETE_USER_FAILED, { cause: result.error })
+                };
+            if (!result.data || typeof result.data !== 'object')
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_DELETE_USER_FAILED)
+                };
+            return {
+                data: createBatchUserResult(uids.map((_, index) => index), result.data.errors),
+                error: null
+            };
+        }
+        catch (cause) {
+            return {
+                data: null,
+                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_DELETE_USER_FAILED, { cause: ensureError(cause) })
+            };
+        }
+    }
+    /** Import up to 1000 users, with local and API failures indexed to the original input. */
+    async importUsers(users, options) {
+        const prepared = prepareUserImport(users, options, this.tenantId);
+        if (prepared.error)
+            return { data: null, error: prepared.error };
+        const { body, indices, errors } = prepared.data;
+        if (indices.length === 0)
+            return {
+                data: createBatchUserResult([], [], errors, 'import'),
+                error: null
+            };
+        try {
+            const { data: token, error } = await this.getCachedToken();
+            if (error)
+                return { data: null, error };
+            if (!token?.access_token)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_NO_TOKEN_RETURNED)
+                };
+            const result = await importAccountsAdmin(this.serviceAccountKey.project_id, body, token.access_token, this.fetch, this.tenantId);
+            if (result.error)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_IMPORT_USERS_FAILED, { cause: result.error })
+                };
+            if (!result.data || typeof result.data !== 'object')
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_IMPORT_USERS_FAILED)
+                };
+            return {
+                data: createBatchUserResult(indices, result.data.error, errors, 'import'),
+                error: null
+            };
+        }
+        catch (cause) {
+            return {
+                data: null,
+                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_IMPORT_USERS_FAILED, { cause: ensureError(cause) })
+            };
+        }
+    }
     /** Read back a complete record after a successful create or update. */
     async getManagedUser(uid, token) {
         const { data, error } = await getAccountInfo({ uid }, token, this.serviceAccountKey.project_id, this.tenantId, this.fetch);
@@ -220,24 +461,37 @@ export class FirebaseAdminAuth {
      * @returns Promise with object containing user data or null, and error if any
      */
     async getUser(uid) {
-        const { data: token, error: tokenError } = await this.getCachedToken();
-        if (tokenError) {
-            return {
-                data: null,
-                error: tokenError
-            };
+        return this.lookupUser({ uid });
+    }
+    async lookupUser(identifier) {
+        const validation = buildUsersLookupRequest([identifier]);
+        if (validation.error)
+            return { data: null, error: validation.error };
+        try {
+            const { data: token, error: tokenError } = await this.getCachedToken();
+            if (tokenError)
+                return { data: null, error: tokenError };
+            if (!token?.access_token)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_NO_TOKEN_RETURNED)
+                };
+            const result = await getAccountInfo(identifier, token.access_token, this.serviceAccountKey.project_id, this.tenantId, this.fetch);
+            if (result.error)
+                return { data: null, error: result.error };
+            if (!result.data)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_USER_NOT_FOUND)
+                };
+            return { data: result.data, error: null };
         }
-        const { data, error } = await getAccountInfo({ uid }, token.access_token, this.serviceAccountKey.project_id, this.tenantId, this.fetch);
-        if (error) {
+        catch (cause) {
             return {
                 data: null,
-                error
+                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_USER_LOOKUP_FAILED, { cause: ensureError(cause) })
             };
         }
-        return {
-            data,
-            error: null
-        };
     }
     /**
      * Lists one page of users, using Firebase Admin's page size and token contract.
@@ -313,24 +567,56 @@ export class FirebaseAdminAuth {
      * @returns Promise with object containing user data or null, and error if any
      */
     async getUserByEmail(email) {
-        const { data: token, error: tokenError } = await this.getCachedToken();
-        if (tokenError) {
+        return this.lookupUser({ email });
+    }
+    /** Look up a linked provider UID, or a primary email/phone identifier. */
+    async getUserByProviderUid(providerId, uid) {
+        const identifier = providerId === 'email'
+            ? { email: uid }
+            : providerId === 'phone'
+                ? { phoneNumber: uid }
+                : { providerId, providerUid: uid };
+        const result = await this.getUsers([identifier]);
+        if (result.error)
+            return { data: null, error: result.error };
+        const user = result.data.users[0];
+        if (!user)
             return {
                 data: null,
-                error: tokenError
+                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_USER_NOT_FOUND)
             };
+        return { data: user, error: null };
+    }
+    /** Look up a user by their primary international phone number. */
+    async getUserByPhoneNumber(phoneNumber) {
+        const validation = buildUsersLookupRequest([{ phoneNumber }]);
+        if (validation.error)
+            return { data: null, error: validation.error };
+        try {
+            const { data: token, error } = await this.getCachedToken();
+            if (error)
+                return { data: null, error };
+            if (!token?.access_token)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_NO_TOKEN_RETURNED)
+                };
+            const result = await getAccountInfo({ phoneNumber }, token.access_token, this.serviceAccountKey.project_id, this.tenantId, this.fetch);
+            if (result.error)
+                return { data: null, error: result.error };
+            if (!result.data)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_USER_NOT_FOUND)
+                };
+            return { data: createUserRecord(result.data), error: null };
         }
-        const { data, error } = await getAccountInfo({ email }, token.access_token, this.serviceAccountKey.project_id, this.tenantId, this.fetch);
-        if (error) {
+        catch (cause) {
             return {
                 data: null,
-                error
+                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_USER_LOOKUP_FAILED, { cause: ensureError(cause) })
             };
         }
-        return {
-            data,
-            error: null
-        };
     }
     /**
      * Verifies a Firebase ID token and returns the decoded payload.
@@ -341,7 +627,7 @@ export class FirebaseAdminAuth {
      * @returns Promise with object containing decoded token payload or null, and error if any
      */
     async verifyIdToken(idToken, checkRevoked = false) {
-        const { data: decodedIdToken, error: verifyError } = await verifyJWT(idToken, this.serviceAccountKey.project_id, this.fetch);
+        const { data: decodedIdToken, error: verifyError } = await verifyJWT(idToken, this.serviceAccountKey.project_id, this.fetch, !!this.emulatorHost);
         if (verifyError) {
             return {
                 data: null,
@@ -369,7 +655,7 @@ export class FirebaseAdminAuth {
                 };
             }
         }
-        if (!checkRevoked) {
+        if (!checkRevoked && !this.emulatorHost) {
             return {
                 data: decodedIdToken,
                 error: null
@@ -379,7 +665,10 @@ export class FirebaseAdminAuth {
         if (userError) {
             return {
                 data: null,
-                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_USER_LOOKUP_FAILED, { cause: ensureError(userError) })
+                error: new FirebaseEdgeError(userError.code ===
+                    FirebaseAdminAuthErrorInfo.ADMIN_USER_NOT_FOUND.code
+                    ? FirebaseAdminAuthErrorInfo.ADMIN_USER_RECORD_NOT_FOUND
+                    : FirebaseAdminAuthErrorInfo.ADMIN_USER_LOOKUP_FAILED, { cause: ensureError(userError) })
             };
         }
         if (!user) {
@@ -413,28 +702,105 @@ export class FirebaseAdminAuth {
      * Creates a session cookie from a Firebase ID token.
      *
      * @param idToken Firebase ID token to convert to session cookie
-     * @param expiresIn_ms Session cookie expiration time in milliseconds
+     * @param options Session cookie lifetime in milliseconds
      * @returns Promise with object containing session cookie string or null, and error if any
      */
-    async createSessionCookie(idToken, expiresIn_ms) {
-        const { data: token, error: getTokenError } = await this.getCachedToken();
-        if (getTokenError) {
+    async createSessionCookie(idToken, options) {
+        if (typeof idToken !== 'string' || !idToken.length)
+            return {
+                data: null,
+                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_ID_TOKEN_INVALID)
+            };
+        if (!options ||
+            typeof options !== 'object' ||
+            !Number.isFinite(options.expiresIn) ||
+            options.expiresIn < 300000 ||
+            options.expiresIn > 1209600000)
+            return {
+                data: null,
+                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SESSION_COOKIE_DURATION_INVALID)
+            };
+        try {
+            const { data: token, error: getTokenError } = await this.getCachedToken();
+            if (getTokenError) {
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SERVICE_ACCOUNT_TOKEN_FAILED, { cause: getTokenError })
+                };
+            }
+            if (!token?.access_token)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_NO_TOKEN_RETURNED)
+                };
+            const { data, error } = await createSessionCookie(idToken, token.access_token, this.serviceAccountKey.project_id, options.expiresIn, this.tenantId, this.fetch);
+            if (error || !data) {
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SESSION_COOKIE_CREATE_FAILED, {
+                        cause: ensureError(error ??
+                            new Error('Firebase returned no session cookie.'))
+                    })
+                };
+            }
+            return {
+                data,
+                error: null
+            };
+        }
+        catch (cause) {
             return {
                 data: null,
-                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SERVICE_ACCOUNT_TOKEN_FAILED, { cause: getTokenError })
+                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SESSION_COOKIE_CREATE_FAILED, { cause: ensureError(cause) })
             };
         }
-        const { data, error } = await createSessionCookie(idToken, token.access_token, this.serviceAccountKey.project_id, expiresIn_ms, this.tenantId, this.fetch);
-        if (error) {
+    }
+    /** Generate a password reset link to send through your own email service. */
+    async generatePasswordResetLink(email, settings) {
+        return this.generateActionLink('PASSWORD_RESET', email, settings);
+    }
+    /** Generate an email verification link without sending an email. */
+    async generateEmailVerificationLink(email, settings) {
+        return this.generateActionLink('VERIFY_EMAIL', email, settings);
+    }
+    /** Generate a link that verifies a new email before changing the account email. */
+    async generateVerifyAndChangeEmailLink(email, newEmail, settings) {
+        return this.generateActionLink('VERIFY_AND_CHANGE_EMAIL', email, settings, newEmail);
+    }
+    /** Generate an email sign-in link; action code settings are required. */
+    async generateSignInWithEmailLink(email, settings) {
+        return this.generateActionLink('EMAIL_SIGNIN', email, settings);
+    }
+    async generateActionLink(requestType, email, settings, newEmail) {
+        const request = buildEmailActionRequest(requestType, email, settings, newEmail);
+        if (request.error)
+            return request;
+        try {
+            const { data: token, error: tokenError } = await this.getCachedToken();
+            if (tokenError)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SERVICE_ACCOUNT_TOKEN_FAILED, { cause: ensureError(tokenError) })
+                };
+            if (!token?.access_token)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_NO_TOKEN_RETURNED)
+                };
+            const { data, error } = await generateEmailActionLink(this.serviceAccountKey.project_id, request.data, token.access_token, this.fetch, this.tenantId);
+            if (error)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_EMAIL_ACTION_LINK_FAILED, { cause: ensureError(error) })
+                };
+            return { data, error: null };
+        }
+        catch (cause) {
             return {
                 data: null,
-                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SESSION_COOKIE_CREATE_FAILED, { cause: ensureError(error) })
+                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_EMAIL_ACTION_LINK_FAILED, { cause: ensureError(cause) })
             };
         }
-        return {
-            data,
-            error: null
-        };
     }
     /**
      * Verifies a Firebase session cookie and returns the decoded payload.
@@ -445,7 +811,7 @@ export class FirebaseAdminAuth {
      * @returns Promise with object containing decoded session payload or null, and error if any
      */
     async verifySessionCookie(sessionCookie, checkRevoked = false) {
-        const { data, error } = await verifySessionJWT(sessionCookie, this.serviceAccountKey.project_id, this.fetch);
+        const { data, error } = await verifySessionJWT(sessionCookie, this.serviceAccountKey.project_id, this.fetch, !!this.emulatorHost);
         if (error) {
             return {
                 data: null,
@@ -473,7 +839,7 @@ export class FirebaseAdminAuth {
                 };
             }
         }
-        if (!checkRevoked) {
+        if (!checkRevoked && !this.emulatorHost) {
             return {
                 data,
                 error: null
@@ -483,7 +849,10 @@ export class FirebaseAdminAuth {
         if (userError) {
             return {
                 data: null,
-                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_USER_LOOKUP_FAILED, { cause: ensureError(userError) })
+                error: new FirebaseEdgeError(userError.code ===
+                    FirebaseAdminAuthErrorInfo.ADMIN_USER_NOT_FOUND.code
+                    ? FirebaseAdminAuthErrorInfo.ADMIN_USER_RECORD_NOT_FOUND
+                    : FirebaseAdminAuthErrorInfo.ADMIN_USER_LOOKUP_FAILED, { cause: ensureError(userError) })
             };
         }
         if (!user) {
@@ -492,6 +861,16 @@ export class FirebaseAdminAuth {
                 error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_USER_RECORD_NOT_FOUND)
             };
         }
+        if (user.disabled)
+            return {
+                data: null,
+                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_USER_DISABLED)
+            };
+        if (user.validSince && data.auth_time < Number(user.validSince))
+            return {
+                data: null,
+                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SESSION_COOKIE_REVOKED)
+            };
         return {
             data,
             error: null
@@ -504,25 +883,40 @@ export class FirebaseAdminAuth {
      * @returns Promise with object containing revoke response data or null, and error if any
      */
     async revokeRefreshTokens(uid) {
-        const { data: token, error: getTokenError } = await this.getCachedToken();
-        if (getTokenError) {
+        const uidError = validateUserUid(uid);
+        if (uidError)
+            return { data: null, error: uidError };
+        try {
+            const { data: token, error: getTokenError } = await this.getCachedToken();
+            if (getTokenError) {
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SERVICE_ACCOUNT_TOKEN_FAILED, { cause: getTokenError })
+                };
+            }
+            if (!token?.access_token)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_NO_TOKEN_RETURNED)
+                };
+            const { data: revokeData, error: revokeError } = await revokeRefreshTokens(this.serviceAccountKey.project_id, uid, token.access_token, this.fetch, this.tenantId);
+            if (revokeError || !revokeData) {
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_REVOKE_TOKENS_FAILED, { cause: ensureError(revokeError) })
+                };
+            }
             return {
-                data: null,
-                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SERVICE_ACCOUNT_TOKEN_FAILED, { cause: getTokenError })
+                data: revokeData,
+                error: null
             };
         }
-        const { data: revokeData, error: revokeError } = await revokeRefreshTokens(this.serviceAccountKey.project_id, uid, token.access_token, this.fetch, this.tenantId);
-        if (revokeError) {
-            console.error('Error revoking tokens:', revokeError);
+        catch (cause) {
             return {
                 data: null,
-                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_REVOKE_TOKENS_FAILED, { cause: ensureError(revokeError) })
+                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_REVOKE_TOKENS_FAILED, { cause: ensureError(cause) })
             };
         }
-        return {
-            data: revokeData,
-            error: null
-        };
     }
     /**
      * Creates a custom Firebase authentication token for a given user.
@@ -532,10 +926,7 @@ export class FirebaseAdminAuth {
      * @returns Promise with object containing custom token string or null, and error if any
      */
     async createCustomToken(uid, developerClaims = {}) {
-        const claims = this.tenantId
-            ? { ...developerClaims, tenant_id: this.tenantId }
-            : developerClaims;
-        const { data, error } = await signJWTCustomToken(uid, this.serviceAccountKey, claims);
+        const { data, error } = await signJWTCustomToken(uid, this.serviceAccountKey, developerClaims, this.tenantId, !!this.emulatorHost);
         if (error) {
             return {
                 data: null,