firebase-admin-edge 1.1.1 → 2.0.0

package/dist/app-check/app-check.d.ts

@@ -0,0 +1,43 @@
+import { FirebaseEdgeError } from '../auth/errors.js';
+import type { ServiceAccount } from '../auth/firebase-types.js';
+import type { CacheConfig } from '../auth/cache-types.js';
+import { type DecodedAppCheckToken } from './app-check-jwt.js';
+export type { DecodedAppCheckToken } from './app-check-jwt.js';
+export interface AppCheckToken {
+    token: string;
+    ttlMillis: number;
+}
+export interface AppCheckTokenOptions {
+    ttlMillis?: number;
+    /** Issue a token that supports replay protection. Defaults to false. */
+    limitedUse?: boolean;
+    /** Replay identity; requires limitedUse: true. Empty or omitted lets Firebase generate it. */
+    jti?: string;
+}
+export interface VerifyAppCheckTokenOptions {
+    consume?: boolean;
+}
+export interface AppCheckTokenResult {
+    appId: string;
+    token: DecodedAppCheckToken;
+    alreadyConsumed?: boolean;
+}
+type AppCheckResult<T> = {
+    error: null;
+    data: T;
+} | {
+    error: FirebaseEdgeError;
+    data: null;
+};
+export declare class AppCheck {
+    private readonly serviceAccount;
+    private readonly fetch;
+    private readonly cache?;
+    private readonly cacheName;
+    private readonly keys;
+    constructor(serviceAccount: ServiceAccount, fetch?: typeof globalThis.fetch, cache?: CacheConfig | undefined, cacheName?: string);
+    private getAccessToken;
+    createToken(appId: string, options?: AppCheckTokenOptions): Promise<AppCheckResult<AppCheckToken>>;
+    verifyToken(token: string, options?: VerifyAppCheckTokenOptions): Promise<AppCheckResult<AppCheckTokenResult>>;
+}
+//# sourceMappingURL=app-check.d.ts.map

package/dist/app-check/app-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-check.d.ts","sourceRoot":"","sources":["../../src/app-check/app-check.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAe,MAAM,mBAAmB,CAAC;AACnE,OAAO,KAAK,EACR,cAAc,EAEjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAM1D,OAAO,EAGH,KAAK,oBAAoB,EAC5B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE/D,MAAM,WAAW,aAAa;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACrB;AACD,MAAM,WAAW,oBAAoB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8FAA8F;IAC9F,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,WAAW,0BAA0B;IACvC,OAAO,CAAC,EAAE,OAAO,CAAC;CACrB;AACD,MAAM,WAAW,mBAAmB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,oBAAoB,CAAC;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC7B;AACD,KAAK,cAAc,CAAC,CAAC,IACf;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,GACxB;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC;AAE/C,qBAAa,QAAQ;IAIb,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAN9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+C;gBAG/C,cAAc,EAAE,cAAc,EAC9B,KAAK,GAAE,OAAO,UAAU,CAAC,KAAwB,EACjD,KAAK,CAAC,EAAE,WAAW,YAAA,EACnB,SAAS,SAAY;YAW5B,cAAc;IAiBtB,WAAW,CACb,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,oBAAyB,GACnC,OAAO,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;IA2DnC,WAAW,CACb,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,0BAA+B,GACzC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;CAkDlD"}

package/dist/app-check/app-check.js

@@ -0,0 +1,141 @@
+import { errors } from 'jose';
+import { getToken } from '../auth/google-oauth.js';
+import { FirebaseEdgeError, ensureError } from '../auth/errors.js';
+import { appCheckRequest, createAppCheckKeyResolver, parseAppCheckToken } from './app-check-endpoints.js';
+import { signAppCheckToken, verifyAppCheckToken } from './app-check-jwt.js';
+export class AppCheck {
+    serviceAccount;
+    fetch;
+    cache;
+    cacheName;
+    keys;
+    constructor(serviceAccount, fetch = globalThis.fetch, cache, cacheName = '__cache') {
+        this.serviceAccount = serviceAccount;
+        this.fetch = fetch;
+        this.cache = cache;
+        this.cacheName = cacheName;
+        if (!serviceAccount?.project_id?.trim()) {
+            throw new FirebaseEdgeError({
+                code: 'app-check/invalid-argument',
+                message: 'A service account project ID is required.'
+            });
+        }
+        this.keys = createAppCheckKeyResolver(fetch);
+    }
+    async getAccessToken() {
+        const key = `${this.cacheName}:app-check:${this.serviceAccount.client_email}`;
+        const cached = await this.cache?.getCache(key);
+        if (cached?.access_token) {
+            return { error: null, data: cached };
+        }
+        const { error, data } = await getToken(this.serviceAccount, this.fetch);
+        if (error) {
+            return { error, data: null };
+        }
+        const ttlMs = (data.expires_in - 60) * 1000;
+        if (Number.isFinite(ttlMs) && ttlMs > 0) {
+            await this.cache?.setCache(key, data, ttlMs);
+        }
+        return { error: null, data };
+    }
+    async createToken(appId, options = {}) {
+        try {
+            if (!options ||
+                typeof options !== 'object' ||
+                Array.isArray(options)) {
+                throw new FirebaseEdgeError({
+                    code: 'app-check/invalid-argument',
+                    message: 'Token options must be an object.'
+                });
+            }
+            const { limitedUse, jti } = options;
+            if (limitedUse !== undefined && typeof limitedUse !== 'boolean') {
+                throw new FirebaseEdgeError({
+                    code: 'app-check/invalid-argument',
+                    message: 'limitedUse must be a boolean.'
+                });
+            }
+            if (jti !== undefined && typeof jti !== 'string') {
+                throw new FirebaseEdgeError({
+                    code: 'app-check/invalid-argument',
+                    message: 'jti must be a string.'
+                });
+            }
+            if (jti !== undefined && limitedUse !== true) {
+                throw new FirebaseEdgeError({
+                    code: 'app-check/invalid-argument',
+                    message: 'jti requires limitedUse to be true.'
+                });
+            }
+            const customToken = await signAppCheckToken(this.serviceAccount, appId, options.ttlMillis);
+            const { error, data } = await this.getAccessToken();
+            if (error) {
+                return { error, data: null };
+            }
+            const response = await appCheckRequest(this.serviceAccount.project_id, data.access_token, {
+                appId,
+                customToken,
+                ...(limitedUse !== undefined && { limitedUse }),
+                ...(jti !== undefined && { jti })
+            }, this.fetch);
+            return { error: null, data: parseAppCheckToken(response) };
+        }
+        catch (cause) {
+            return { error: appCheckError(cause), data: null };
+        }
+    }
+    async verifyToken(token, options = {}) {
+        try {
+            if (!options ||
+                typeof options !== 'object' ||
+                Array.isArray(options) ||
+                (options.consume !== undefined &&
+                    typeof options.consume !== 'boolean')) {
+                throw new FirebaseEdgeError({
+                    code: 'app-check/invalid-argument',
+                    message: 'consume must be a boolean.'
+                });
+            }
+            const decoded = await verifyAppCheckToken(token, this.serviceAccount.project_id, this.keys);
+            if (!options.consume) {
+                return {
+                    error: null,
+                    data: { appId: decoded.app_id, token: decoded }
+                };
+            }
+            const { error, data } = await this.getAccessToken();
+            if (error) {
+                return { error, data: null };
+            }
+            const { alreadyConsumed = false } = await appCheckRequest(this.serviceAccount.project_id, data.access_token, { token }, this.fetch);
+            if (typeof alreadyConsumed !== 'boolean') {
+                throw new FirebaseEdgeError({
+                    code: 'app-check/internal-error',
+                    message: 'Invalid replay protection response.'
+                });
+            }
+            return {
+                error: null,
+                data: { appId: decoded.app_id, token: decoded, alreadyConsumed }
+            };
+        }
+        catch (cause) {
+            return { error: appCheckError(cause), data: null };
+        }
+    }
+}
+/** @internal Normalize thrown failures to the package result convention. */
+function appCheckError(cause) {
+    if (cause instanceof FirebaseEdgeError) {
+        return cause;
+    }
+    return new FirebaseEdgeError({
+        code: cause instanceof errors.JWTExpired
+            ? 'app-check/app-check-token-expired'
+            : cause instanceof errors.JOSEError
+                ? 'app-check/invalid-argument'
+                : 'app-check/internal-error',
+        message: 'App Check operation failed.'
+    }, { cause: ensureError(cause) });
+}
+//# sourceMappingURL=app-check.js.map

package/dist/app-check/app-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-check.js","sourceRoot":"","sources":["../../src/app-check/app-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAMnE,OAAO,EACH,eAAe,EACf,yBAAyB,EACzB,kBAAkB,EACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACH,iBAAiB,EACjB,mBAAmB,EAEtB,MAAM,oBAAoB,CAAC;AA0B5B,MAAM,OAAO,QAAQ;IAII;IACA;IACA;IACA;IANJ,IAAI,CAA+C;IAEpE,YACqB,cAA8B,EAC9B,QAAiC,UAAU,CAAC,KAAK,EACjD,KAAmB,EACnB,YAAY,SAAS;QAHrB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,UAAK,GAAL,KAAK,CAA4C;QACjD,UAAK,GAAL,KAAK,CAAc;QACnB,cAAS,GAAT,SAAS,CAAY;QAEtC,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,iBAAiB,CAAC;gBACxB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,2CAA2C;aACvD,CAAC,CAAC;QACP,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,cAAc;QACxB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,cAAc,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,CAAC;QAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAsB,GAAG,CAAC,CAAC;QACpE,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACzC,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,WAAW,CACb,KAAa,EACb,UAAgC,EAAE;QAElC,IAAI,CAAC;YACD,IACI,CAAC,OAAO;gBACR,OAAO,OAAO,KAAK,QAAQ;gBAC3B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EACxB,CAAC;gBACC,MAAM,IAAI,iBAAiB,CAAC;oBACxB,IAAI,EAAE,4BAA4B;oBAClC,OAAO,EAAE,kCAAkC;iBAC9C,CAAC,CAAC;YACP,CAAC;YAED,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;YACpC,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC9D,MAAM,IAAI,iBAAiB,CAAC;oBACxB,IAAI,EAAE,4BAA4B;oBAClC,OAAO,EAAE,+BAA+B;iBAC3C,CAAC,CAAC;YACP,CAAC;YACD,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC/C,MAAM,IAAI,iBAAiB,CAAC;oBACxB,IAAI,EAAE,4BAA4B;oBAClC,OAAO,EAAE,uBAAuB;iBACnC,CAAC,CAAC;YACP,CAAC;YACD,IAAI,GAAG,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC3C,MAAM,IAAI,iBAAiB,CAAC;oBACxB,IAAI,EAAE,4BAA4B;oBAClC,OAAO,EAAE,qCAAqC;iBACjD,CAAC,CAAC;YACP,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,iBAAiB,CACvC,IAAI,CAAC,cAAc,EACnB,KAAK,EACL,OAAO,CAAC,SAAS,CACpB,CAAC;YACF,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAClC,IAAI,CAAC,cAAc,CAAC,UAAU,EAC9B,IAAI,CAAC,YAAY,EACjB;gBACI,KAAK;gBACL,WAAW;gBACX,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;gBAC/C,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,CAAC;aACpC,EACD,IAAI,CAAC,KAAK,CACb,CAAC;YACF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACvD,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CACb,KAAa,EACb,UAAsC,EAAE;QAExC,IAAI,CAAC;YACD,IACI,CAAC,OAAO;gBACR,OAAO,OAAO,KAAK,QAAQ;gBAC3B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBACtB,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS;oBAC1B,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,EAC3C,CAAC;gBACC,MAAM,IAAI,iBAAiB,CAAC;oBACxB,IAAI,EAAE,4BAA4B;oBAClC,OAAO,EAAE,4BAA4B;iBACxC,CAAC,CAAC;YACP,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CACrC,KAAK,EACL,IAAI,CAAC,cAAc,CAAC,UAAU,EAC9B,IAAI,CAAC,IAAI,CACZ,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO;oBACH,KAAK,EAAE,IAAI;oBACX,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;iBAClD,CAAC;YACN,CAAC;YAED,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;YACD,MAAM,EAAE,eAAe,GAAG,KAAK,EAAE,GAAG,MAAM,eAAe,CACrD,IAAI,CAAC,cAAc,CAAC,UAAU,EAC9B,IAAI,CAAC,YAAY,EACjB,EAAE,KAAK,EAAE,EACT,IAAI,CAAC,KAAK,CACb,CAAC;YACF,IAAI,OAAO,eAAe,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,iBAAiB,CAAC;oBACxB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,qCAAqC;iBACjD,CAAC,CAAC;YACP,CAAC;YACD,OAAO;gBACH,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE;aACnE,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACvD,CAAC;IACL,CAAC;CACJ;AAED,4EAA4E;AAC5E,SAAS,aAAa,CAAC,KAAc;IACjC,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,iBAAiB,CACxB;QACI,IAAI,EACA,KAAK,YAAY,MAAM,CAAC,UAAU;YAC9B,CAAC,CAAC,mCAAmC;YACrC,CAAC,CAAC,KAAK,YAAY,MAAM,CAAC,SAAS;gBACjC,CAAC,CAAC,4BAA4B;gBAC9B,CAAC,CAAC,0BAA0B;QACtC,OAAO,EAAE,6BAA6B;KACzC,EACD,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAChC,CAAC;AACN,CAAC"}

package/dist/auth/auth-blocking-types.d.ts

@@ -0,0 +1,44 @@
+/** Raw user information carried by an Auth blocking-event JWT. */
+export interface DecodedAuthBlockingUserRecord {
+    uid: string;
+    display_name?: string;
+    email?: string;
+    email_verified?: boolean;
+    photo_url?: string;
+    phone_number?: string;
+    disabled?: boolean;
+    tenant_id?: string;
+    custom_claims?: Record<string, unknown>;
+    metadata?: {
+        creation_time?: number;
+        last_sign_in_time?: number;
+    };
+    [key: string]: unknown;
+}
+/** Verified blocking-event payload, not an ID token or a parsed Cloud Functions event. */
+export interface DecodedAuthBlockingToken {
+    aud: string;
+    iss: string;
+    iat: number;
+    exp: number;
+    /** Email/SMS events may have no user subject. */
+    sub?: string;
+    uid?: string;
+    event_id: string;
+    event_type: string;
+    tenant_id?: string;
+    user_record?: DecodedAuthBlockingUserRecord;
+    ip_address?: string;
+    user_agent?: string;
+    locale?: string;
+    sign_in_method?: string;
+    raw_user_info?: string;
+    sign_in_attributes?: Record<string, unknown>;
+    oauth_id_token?: string;
+    oauth_access_token?: string;
+    oauth_refresh_token?: string;
+    oauth_token_secret?: string;
+    oauth_expires_in?: number;
+    [key: string]: unknown;
+}
+//# sourceMappingURL=auth-blocking-types.d.ts.map

package/dist/auth/auth-blocking-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-blocking-types.d.ts","sourceRoot":"","sources":["../../src/auth/auth-blocking-types.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,MAAM,WAAW,6BAA6B;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,0FAA0F;AAC1F,MAAM,WAAW,wBAAwB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,6BAA6B,CAAC;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B"}

package/dist/auth/auth-blocking-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth-blocking-types.js.map

package/dist/auth/auth-blocking-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-blocking-types.js","sourceRoot":"","sources":["../../src/auth/auth-blocking-types.ts"],"names":[],"mappings":""}

package/dist/auth/auth-config-types.d.ts

@@ -0,0 +1,146 @@
+import type { FirebaseEdgeError } from './errors.js';
+export type AuthConfigResult<T> = {
+    data: T;
+    error: null;
+} | {
+    data: null;
+    error: FirebaseEdgeError;
+};
+export interface BaseAuthProviderConfig {
+    providerId: string;
+    displayName?: string;
+    enabled: boolean;
+}
+export interface OAuthResponseType {
+    code?: boolean;
+    idToken?: boolean;
+}
+export interface OIDCAuthProviderConfig extends BaseAuthProviderConfig {
+    clientId: string;
+    issuer: string;
+    clientSecret?: string;
+    responseType?: OAuthResponseType;
+}
+export interface SAMLAuthProviderConfig extends BaseAuthProviderConfig {
+    idpEntityId: string;
+    ssoURL: string;
+    x509Certificates: string[];
+    rpEntityId: string;
+    callbackURL?: string;
+    enableRequestSigning?: boolean;
+}
+export type AuthProviderConfig = OIDCAuthProviderConfig | SAMLAuthProviderConfig;
+export type OIDCUpdateAuthProviderRequest = Partial<Omit<OIDCAuthProviderConfig, 'providerId'>>;
+export type SAMLUpdateAuthProviderRequest = Partial<Omit<SAMLAuthProviderConfig, 'providerId'>>;
+export type UpdateAuthProviderRequest = OIDCUpdateAuthProviderRequest | SAMLUpdateAuthProviderRequest;
+export interface AuthProviderConfigFilter {
+    type: 'oidc' | 'saml';
+    maxResults?: number;
+    pageToken?: string;
+}
+export interface ListProviderConfigResults {
+    providerConfigs: AuthProviderConfig[];
+    pageToken?: string;
+}
+export interface EmailSignInProviderConfig {
+    enabled?: boolean;
+    passwordRequired?: boolean;
+}
+export type MultiFactorConfigState = 'ENABLED' | 'DISABLED';
+export interface TotpMultiFactorProviderConfig {
+    adjacentIntervals?: number;
+}
+export interface MultiFactorProviderConfig {
+    state: MultiFactorConfigState;
+    totpProviderConfig?: TotpMultiFactorProviderConfig;
+}
+export interface MultiFactorConfig {
+    state?: MultiFactorConfigState;
+    factorIds?: 'phone'[];
+    providerConfigs?: MultiFactorProviderConfig[];
+}
+export type SmsRegionConfig = {
+    allowByDefault: {
+        disallowedRegions: string[];
+    };
+} | {
+    allowlistOnly: {
+        allowedRegions: string[];
+    };
+};
+export type RecaptchaProviderEnforcementState = 'OFF' | 'AUDIT' | 'ENFORCE';
+export interface RecaptchaConfig {
+    emailPasswordEnforcementState?: RecaptchaProviderEnforcementState;
+    phoneEnforcementState?: RecaptchaProviderEnforcementState;
+    managedRules?: {
+        endScore: number;
+        action: 'BLOCK';
+    }[];
+    recaptchaKeys?: {
+        key: string;
+        type: 'WEB' | 'ANDROID' | 'IOS';
+    }[];
+    useAccountDefender?: boolean;
+    useSmsBotScore?: boolean;
+    useSmsTollFraudProtection?: boolean;
+    smsTollFraudManagedRules?: {
+        startScore: number;
+        action: 'BLOCK';
+    }[];
+}
+export interface CustomStrengthOptionsConfig {
+    requireUppercase?: boolean;
+    requireLowercase?: boolean;
+    requireNonAlphanumeric?: boolean;
+    requireNumeric?: boolean;
+    minLength?: number;
+    maxLength?: number;
+}
+export interface PasswordPolicyConfig {
+    enforcementState?: 'OFF' | 'ENFORCE';
+    forceUpgradeOnSignin?: boolean;
+    constraints?: CustomStrengthOptionsConfig;
+}
+export interface EmailPrivacyConfig {
+    enableImprovedEmailPrivacy?: boolean;
+}
+export interface MobileLinksConfig {
+    domain?: 'HOSTING_DOMAIN' | 'FIREBASE_DYNAMIC_LINK_DOMAIN';
+}
+export interface UpdateProjectConfigRequest {
+    smsRegionConfig?: SmsRegionConfig;
+    multiFactorConfig?: MultiFactorConfig;
+    recaptchaConfig?: RecaptchaConfig;
+    passwordPolicyConfig?: PasswordPolicyConfig;
+    emailPrivacyConfig?: EmailPrivacyConfig;
+    mobileLinksConfig?: MobileLinksConfig;
+}
+/** Configuration results are plain JSON objects, like user records in this package. */
+export interface ProjectConfig extends UpdateProjectConfigRequest {
+}
+export interface UpdateTenantRequest extends Omit<UpdateProjectConfigRequest, 'mobileLinksConfig'> {
+    displayName?: string;
+    emailSignInConfig?: EmailSignInProviderConfig;
+    anonymousSignInEnabled?: boolean;
+    testPhoneNumbers?: Record<string, string> | null;
+}
+export type CreateTenantRequest = UpdateTenantRequest;
+export interface Tenant extends UpdateTenantRequest {
+    tenantId: string;
+}
+export interface ListTenantsResult {
+    tenants: Tenant[];
+    pageToken?: string;
+}
+/** Internal operation description; transport details belong to the endpoint layer. */
+export interface AuthConfigOperation {
+    resource: 'provider' | 'project' | 'tenant';
+    action: 'create' | 'get' | 'update' | 'delete' | 'list';
+    id?: string;
+    type?: 'oidc' | 'saml';
+    properties?: object;
+    maxResults?: number;
+    pageToken?: string;
+}
+export type AuthConfigExecutor = <T>(operation: AuthConfigOperation) => Promise<AuthConfigResult<T>>;
+//# sourceMappingURL=auth-config-types.d.ts.map

package/dist/auth/auth-config-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-config-types.d.ts","sourceRoot":"","sources":["../../src/auth/auth-config-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,MAAM,gBAAgB,CAAC,CAAC,IACxB;IAAE,IAAI,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,IAAI,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAC/C,MAAM,WAAW,sBAAsB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;CACpB;AACD,MAAM,WAAW,iBAAiB;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;CACrB;AACD,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,iBAAiB,CAAC;CACpC;AACD,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAClC;AACD,MAAM,MAAM,kBAAkB,GACxB,sBAAsB,GACtB,sBAAsB,CAAC;AAC7B,MAAM,MAAM,6BAA6B,GAAG,OAAO,CAC/C,IAAI,CAAC,sBAAsB,EAAE,YAAY,CAAC,CAC7C,CAAC;AACF,MAAM,MAAM,6BAA6B,GAAG,OAAO,CAC/C,IAAI,CAAC,sBAAsB,EAAE,YAAY,CAAC,CAC7C,CAAC;AACF,MAAM,MAAM,yBAAyB,GAC/B,6BAA6B,GAC7B,6BAA6B,CAAC;AACpC,MAAM,WAAW,wBAAwB;IACrC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AACD,MAAM,WAAW,yBAAyB;IACtC,eAAe,EAAE,kBAAkB,EAAE,CAAC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AACD,MAAM,WAAW,yBAAyB;IACtC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B;AACD,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,UAAU,CAAC;AAC5D,MAAM,WAAW,6BAA6B;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B;AACD,MAAM,WAAW,yBAAyB;IACtC,KAAK,EAAE,sBAAsB,CAAC;IAC9B,kBAAkB,CAAC,EAAE,6BAA6B,CAAC;CACtD;AACD,MAAM,WAAW,iBAAiB;IAC9B,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;IACtB,eAAe,CAAC,EAAE,yBAAyB,EAAE,CAAC;CACjD;AACD,MAAM,MAAM,eAAe,GACrB;IAAE,cAAc,EAAE;QAAE,iBAAiB,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;CAAE,GACnD;IAAE,aAAa,EAAE;QAAE,cAAc,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;CAAE,CAAC;AACtD,MAAM,MAAM,iCAAiC,GAAG,KAAK,GAAG,OAAO,GAAG,SAAS,CAAC;AAC5E,MAAM,WAAW,eAAe;IAC5B,6BAA6B,CAAC,EAAE,iCAAiC,CAAC;IAClE,qBAAqB,CAAC,EAAE,iCAAiC,CAAC;IAC1D,YAAY,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IACvD,aAAa,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,KAAK,GAAG,SAAS,GAAG,KAAK,CAAA;KAAE,EAAE,CAAC;IACnE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,wBAAwB,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;CACxE;AACD,MAAM,WAAW,2BAA2B;IACxC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AACD,MAAM,WAAW,oBAAoB;IACjC,gBAAgB,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;IACrC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,WAAW,CAAC,EAAE,2BAA2B,CAAC;CAC7C;AACD,MAAM,WAAW,kBAAkB;IAC/B,0BAA0B,CAAC,EAAE,OAAO,CAAC;CACxC;AACD,MAAM,WAAW,iBAAiB;IAC9B,MAAM,CAAC,EAAE,gBAAgB,GAAG,8BAA8B,CAAC;CAC9D;AACD,MAAM,WAAW,0BAA0B;IACvC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACzC;AACD,uFAAuF;AACvF,MAAM,WAAW,aAAc,SAAQ,0BAA0B;CAAG;AACpE,MAAM,WAAW,mBACb,SAAQ,IAAI,CAAC,0BAA0B,EAAE,mBAAmB,CAAC;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CACpD;AACD,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AACtD,MAAM,WAAW,MAAO,SAAQ,mBAAmB;IAC/C,QAAQ,EAAE,MAAM,CAAC;CACpB;AACD,MAAM,WAAW,iBAAiB;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,sFAAsF;AACtF,MAAM,WAAW,mBAAmB;IAChC,QAAQ,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC5C,MAAM,EAAE,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACxD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AACD,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,EAC/B,SAAS,EAAE,mBAAmB,KAC7B,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/auth/auth-config-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth-config-types.js.map

package/dist/auth/auth-config-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-config-types.js","sourceRoot":"","sources":["../../src/auth/auth-config-types.ts"],"names":[],"mappings":""}

package/dist/auth/auth-config.d.ts

@@ -0,0 +1,15 @@
+import { FirebaseEdgeError } from './errors.js';
+import type { AuthConfigOperation } from './auth-config-types.js';
+type Fields = Record<string, unknown>;
+/** @internal */
+export declare function invalidConfig(message: string): FirebaseEdgeError;
+/** @internal */
+export declare function validateTenantId(id: string): void;
+/** Validate before obtaining credentials, and convert public properties to API fields. @internal */
+export declare function buildAuthConfigRequest(operation: AuthConfigOperation): Fields | undefined;
+/** Build a leaf mask so partial nested updates do not erase sibling settings. @internal */
+export declare function configUpdateMask(body: Fields, prefix?: string): string[];
+/** Parse resource and pagination envelopes into public configuration objects. @internal */
+export declare function parseAuthConfigResponse(operation: AuthConfigOperation, input: unknown): unknown;
+export {};
+//# sourceMappingURL=auth-config.d.ts.map

package/dist/auth/auth-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-config.d.ts","sourceRoot":"","sources":["../../src/auth/auth-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAElE,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAsKtC,gBAAgB;AAChB,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,CAEhE;AAED,gBAAgB;AAChB,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAWjD;AAwID,oGAAoG;AACpG,wBAAgB,sBAAsB,CAClC,SAAS,EAAE,mBAAmB,GAC/B,MAAM,GAAG,SAAS,CA2EpB;AAED,2FAA2F;AAC3F,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,SAAK,GAAG,MAAM,EAAE,CAapE;AAED,2FAA2F;AAC3F,wBAAgB,uBAAuB,CACnC,SAAS,EAAE,mBAAmB,EAC9B,KAAK,EAAE,OAAO,GACf,OAAO,CAuET"}