firebase-admin-edge 1.1.1 → 2.0.0

package/dist/auth/email-link.js

@@ -0,0 +1,103 @@
+import { EncryptJWT, jwtDecrypt } from 'jose';
+import { FirebaseEdgeError } from './errors.js';
+import { isLocalRedirectPath } from './provider-session.js';
+const PURPOSE = 'firebase-admin-edge:email-link';
+/** Derive a purpose-specific encryption key from server-only key material. @internal */
+async function emailLinkKey(secret) {
+    if (!secret)
+        throw new Error('Server key material is required for email links.');
+    const bytes = new TextEncoder().encode(`${PURPOSE}\n${secret}`);
+    const digest = await crypto.subtle.digest('SHA-256', bytes);
+    return new Uint8Array(digest);
+}
+/** Bind optional email and redirect state to this project and tenant for one hour. @internal */
+export async function createEmailLinkState(state, secret, projectId, tenantId) {
+    if (!isLocalRedirectPath(state.next))
+        throw new Error('The next path must be a local absolute path.');
+    const key = await emailLinkKey(secret);
+    return new EncryptJWT({ ...state, tenantId: tenantId ?? null })
+        .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
+        .setIssuer(projectId)
+        .setAudience(PURPOSE)
+        .setIssuedAt()
+        .setExpirationTime('1h')
+        .encrypt(key);
+}
+/** Authenticate and decrypt email-link state before consuming the Firebase code. @internal */
+export async function readEmailLinkState(token, secret, projectId, tenantId) {
+    const key = await emailLinkKey(secret);
+    const { payload } = await jwtDecrypt(token, key, {
+        issuer: projectId,
+        audience: PURPOSE,
+        keyManagementAlgorithms: ['dir'],
+        contentEncryptionAlgorithms: ['A256GCM']
+    });
+    if (payload.tenantId !== (tenantId ?? null) ||
+        !isLocalRedirectPath(payload.next) ||
+        (payload.email !== undefined && typeof payload.email !== 'string'))
+        throw new Error('Invalid email-link state.');
+    return { email: payload.email, next: payload.next };
+}
+/** Inspect an email action without consuming its code. OAuth callbacks return null. @internal */
+export function parseEmailActionLink(input, apiKey, tenantId) {
+    let url = input;
+    for (let depth = 0; depth < 3 && !url.searchParams.has('oobCode'); depth++) {
+        const inner = url.searchParams.get('link');
+        if (!inner)
+            break;
+        url = new URL(inner);
+    }
+    const mode = url.searchParams.get('mode');
+    const code = url.searchParams.get('oobCode');
+    if (!mode &&
+        !['oobCode', 'emailLinkState', 'link'].some((key) => url.searchParams.has(key)))
+        return null;
+    const actionMode = mode ?? 'signIn';
+    const key = url.searchParams.get('apiKey');
+    const tenant = url.searchParams.get('tenantId');
+    if (![
+        'signIn',
+        'resetPassword',
+        'verifyAndChangeEmail',
+        'verifyEmail',
+        'recoverEmail'
+    ].includes(actionMode) ||
+        (key !== null && key !== apiKey) ||
+        (tenant !== null && tenant !== tenantId) ||
+        (url.searchParams.has('link') && !code))
+        throw new FirebaseEdgeError({
+            code: 'auth/invalid-action-code',
+            message: 'Invalid or unsupported email action link.'
+        });
+    return {
+        actionMode: actionMode,
+        hasLink: Boolean(code?.trim()),
+        code,
+        url
+    };
+}
+/** Parse sign-in state using the shared email-action parser. @internal */
+export function parseEmailSignInLink(input, apiKey, tenantId) {
+    const action = parseEmailActionLink(input, apiKey, tenantId);
+    if (!action ||
+        action.actionMode !== 'signIn' ||
+        !action.hasLink ||
+        !action.code)
+        throw new FirebaseEdgeError({
+            code: 'auth/invalid-action-code',
+            message: 'Invalid email sign-in link.'
+        });
+    const { url, code } = action;
+    const continuation = url.searchParams.get('continueUrl');
+    const state = url.searchParams.get('emailLinkState') ??
+        (continuation
+            ? new URL(continuation).searchParams.get('emailLinkState')
+            : null);
+    if (!state)
+        throw new FirebaseEdgeError({
+            code: 'auth/invalid-action-code',
+            message: 'Email-link state is missing.'
+        });
+    return { code, state };
+}
+//# sourceMappingURL=email-link.js.map

package/dist/auth/email-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-link.js","sourceRoot":"","sources":["../../src/auth/email-link.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,OAAO,GAAG,gCAAgC,CAAC;AAEjD,wFAAwF;AACxF,KAAK,UAAU,YAAY,CAAC,MAAc;IACtC,IAAI,CAAC,MAAM;QACP,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5D,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACtC,KAAuC,EACvC,MAAc,EACd,SAAiB,EACjB,QAAiB;IAEjB,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,IAAI,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;SAC1D,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;SAClD,SAAS,CAAC,SAAS,CAAC;SACpB,WAAW,CAAC,OAAO,CAAC;SACpB,WAAW,EAAE;SACb,iBAAiB,CAAC,IAAI,CAAC;SACvB,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,KAAa,EACb,MAAc,EACd,SAAiB,EACjB,QAAiB;IAEjB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE;QAC7C,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,OAAO;QACjB,uBAAuB,EAAE,CAAC,KAAK,CAAC;QAChC,2BAA2B,EAAE,CAAC,SAAS,CAAC;KAC3C,CAAC,CAAC;IACH,IACI,OAAO,CAAC,QAAQ,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC;QACvC,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC;QAElE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACjD,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAA2B,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AAC9E,CAAC;AASD,iGAAiG;AACjG,MAAM,UAAU,oBAAoB,CAChC,KAAU,EACV,MAAc,EACd,QAAiB;IAEjB,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KACI,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,EAC7C,KAAK,EAAE,EACT,CAAC;QACC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,MAAM;QAClB,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7C,IACI,CAAC,IAAI;QACL,CAAC,CAAC,SAAS,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAC5B;QAED,OAAO,IAAI,CAAC;IAChB,MAAM,UAAU,GAAG,IAAI,IAAI,QAAQ,CAAC;IACpC,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChD,IACI,CAAC;QACG,QAAQ;QACR,eAAe;QACf,sBAAsB;QACtB,aAAa;QACb,cAAc;KACjB,CAAC,QAAQ,CAAC,UAAU,CAAC;QACtB,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,CAAC;QAChC,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,QAAQ,CAAC;QACxC,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAEvC,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,2CAA2C;SACvD,CAAC,CAAC;IACP,OAAO;QACH,UAAU,EAAE,UAA6B;QACzC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QAC9B,IAAI;QACJ,GAAG;KACN,CAAC;AACN,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,oBAAoB,CAChC,KAAU,EACV,MAAc,EACd,QAAiB;IAEjB,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7D,IACI,CAAC,MAAM;QACP,MAAM,CAAC,UAAU,KAAK,QAAQ;QAC9B,CAAC,MAAM,CAAC,OAAO;QACf,CAAC,MAAM,CAAC,IAAI;QAEZ,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,6BAA6B;SACzC,CAAC,CAAC;IACP,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAC7B,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACzD,MAAM,KAAK,GACP,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACtC,CAAC,YAAY;YACT,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAC1D,CAAC,CAAC,IAAI,CAAC,CAAC;IAChB,IAAI,CAAC,KAAK;QACN,MAAM,IAAI,iBAAiB,CAAC;YACxB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,8BAA8B;SAC1C,CAAC,CAAC;IACP,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC"}

package/dist/auth/firebase-admin-auth.d.ts

@@ -1,3 +1,13 @@
+import { type AuthEmulatorOptions } from './auth-emulator.js';
+export type { AuthEmulatorOptions } from './auth-emulator.js';
+import { ProjectConfigManager } from './project-config-manager.js';
+import { TenantManager } from './tenant-manager.js';
+import type { AuthProviderConfig, UpdateAuthProviderRequest, AuthProviderConfigFilter, ListProviderConfigResults } from './auth-config-types.js';
+export type * from './auth-config-types.js';
+export { ProjectConfigManager } from './project-config-manager.js';
+export { TenantManager } from './tenant-manager.js';
+import type { DecodedAuthBlockingToken } from './auth-blocking-types.js';
+export type { DecodedAuthBlockingToken, DecodedAuthBlockingUserRecord } from './auth-blocking-types.js';
 import type { ServiceAccount } from './firebase-types.js';
 import { FirebaseEdgeError } from './errors.js';
 import type { CacheConfig } from './cache-types.js';
@@ -29,11 +39,24 @@ export interface SessionCookieOptions {
  */
 export declare class FirebaseAdminAuth {
     private serviceAccountKey;
-    private tenantId?;
+    readonly tenantId?: string | undefined;
     private fetch?;
     private cache?;
     private cacheName?;
+    /** Verify a blocking-event JWT. Audience matching follows the SDK's substring convention. */
+    _verifyAuthBlockingToken(token: string, audience?: string): Promise<AdminResult<DecodedAuthBlockingToken>>;
+    private readonly emulatorHost;
     private _cacheName;
+    private projectManager?;
+    private tenants?;
+    createProviderConfig(config: AuthProviderConfig): Promise<AdminResult<AuthProviderConfig>>;
+    getProviderConfig(providerId: string): Promise<AdminResult<AuthProviderConfig>>;
+    updateProviderConfig(providerId: string, config: UpdateAuthProviderRequest): Promise<AdminResult<AuthProviderConfig>>;
+    deleteProviderConfig(providerId: string): Promise<AdminResult<void>>;
+    listProviderConfigs(filter: AuthProviderConfigFilter): Promise<AdminResult<ListProviderConfigResults>>;
+    projectConfigManager(): ProjectConfigManager;
+    tenantManager(): TenantManager;
+    private executeConfig;
     /**
      * Creates a new Firebase Admin Auth instance.
      *
@@ -42,8 +65,9 @@ export declare class FirebaseAdminAuth {
      * @param fetch Optional custom fetch implementation
      * @param cache Optional cache implementation for token caching
      * @param cacheName Optional cache key name (defaults to '__cache')
+     * @param options Auth emulator configuration; defaults to FIREBASE_AUTH_EMULATOR_HOST when set.
      */
-    constructor(serviceAccountKey: ServiceAccount, tenantId?: string | undefined, fetch?: typeof globalThis.fetch | undefined, cache?: CacheConfig | undefined, cacheName?: string | undefined);
+    constructor(serviceAccountKey: ServiceAccount, tenantId?: string | undefined, fetch?: typeof globalThis.fetch | undefined, cache?: CacheConfig | undefined, cacheName?: string | undefined, options?: AuthEmulatorOptions);
     /**
      * Retrieves a cached service account token or fetches a new one.
      * Tokens are cached for 1 hour.
@@ -77,9 +101,10 @@ export declare class FirebaseAdminAuth {
         data: null;
         error: FirebaseEdgeError;
     } | {
-        data: import("./firebase-types.js").UserInfo | null | undefined;
+        data: import("./firebase-types.js").UserInfo;
         error: null;
     }>;
+    private lookupUser;
     /**
      * Lists one page of users, using Firebase Admin's page size and token contract.
      * @param maxResults Page size (1–1000), defaults to 1000.
@@ -103,7 +128,7 @@ export declare class FirebaseAdminAuth {
         data: null;
         error: FirebaseEdgeError;
     } | {
-        data: import("./firebase-types.js").UserInfo | null | undefined;
+        data: import("./firebase-types.js").UserInfo;
         error: null;
     }>;
     /** Look up a linked provider UID, or a primary email/phone identifier. */

package/dist/auth/firebase-admin-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firebase-admin-auth.d.ts","sourceRoot":"","sources":["../../src/auth/firebase-admin-auth.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAuB,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE/E,OAAO,EACH,iBAAiB,EAGpB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAGH,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEH,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACzB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACR,iBAAiB,EACjB,gBAAgB,EAChB,uBAAuB,EAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACR,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAGH,KAAK,cAAc,EACnB,KAAK,eAAe,EACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAIH,KAAK,cAAc,EAEnB,KAAK,aAAa,EAClB,KAAK,aAAa,EACrB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACR,cAAc,EACd,aAAa,EACb,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,YAAY,EACZ,iCAAiC,EACjC,iCAAiC,EACpC,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACR,cAAc,EACd,eAAe,EACf,UAAU,EACb,MAAM,kBAAkB,CAAC;AAE1B,KAAK,WAAW,CAAC,CAAC,IACZ;IAAE,IAAI,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,IAAI,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAE/C,OAAO,EAEH,KAAK,kBAAkB,EAE1B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,MAAM,WAAW,oBAAoB;IACjC,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,qBAAa,iBAAiB;IAatB,OAAO,CAAC,iBAAiB;IACzB,OAAO,CAAC,QAAQ,CAAC;IACjB,OAAO,CAAC,KAAK,CAAC;IACd,OAAO,CAAC,KAAK,CAAC;IACd,OAAO,CAAC,SAAS,CAAC;IAhBtB,OAAO,CAAC,UAAU,CAAa;IAE/B;;;;;;;;OAQG;gBAES,iBAAiB,EAAE,cAAc,EACjC,QAAQ,CAAC,EAAE,MAAM,YAAA,EACjB,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,YAAA,EAC/B,KAAK,CAAC,EAAE,WAAW,YAAA,EACnB,SAAS,CAAC,EAAE,MAAM,YAAA;IAK9B;;;;;OAKG;YACW,cAAc;IAoC5B,yDAAyD;IACnD,UAAU,CACZ,UAAU,EAAE,aAAa,GAC1B,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAkDnC,wEAAwE;IAClE,UAAU,CACZ,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,aAAa,GAC1B,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAqDnC,mEAAmE;IAC7D,mBAAmB,CACrB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GAAG,IAAI,GACtB,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAkD7B,qEAAqE;IAC/D,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAwCzD,2EAA2E;IACrE,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAuD1E,0FAA0F;IACpF,WAAW,CACb,KAAK,EAAE,gBAAgB,EAAE,EACzB,OAAO,CAAC,EAAE,iBAAiB,GAC5B,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;IA6DzC,uEAAuE;YACzD,cAAc;IAsB5B,kFAAkF;IAC5E,QAAQ,CACV,WAAW,EAAE,cAAc,EAAE,GAC9B,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IAoDvC;;;;;OAKG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM;;;;;;;IA+BzB;;;;;OAKG;IACG,SAAS,CACX,UAAU,SAAO,EACjB,SAAS,CAAC,EAAE,MAAM,GACnB,OAAO,CACJ;QAAE,IAAI,EAAE,eAAe,CAAC;QAAC,KAAK,EAAE,IAAI,CAAA;KAAE,GACtC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,iBAAiB,CAAA;KAAE,CAC7C;IAuFD;;;;;OAKG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM;;;;;;;IA+BlC,0EAA0E;IACpE,oBAAoB,CACtB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACZ,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAoBnC,kEAAkE;IAC5D,oBAAoB,CACtB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAwCnC;;;;;;;OAOG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,GAAE,OAAe;;;;;;;IAwGlE;;;;;;OAMG;IACG,mBAAmB,CACrB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,oBAAoB,GAC9B,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAmF/B,6EAA6E;IACvE,yBAAyB,CAC3B,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,kBAAkB,GAC9B,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAI/B,oEAAoE;IAC9D,6BAA6B,CAC/B,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,kBAAkB,GAC9B,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAI/B,mFAAmF;IAC7E,gCAAgC,CAClC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,kBAAkB,GAC9B,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAS/B,yEAAyE;IACnE,2BAA2B,CAC7B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,kBAAkB,GAC7B,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAIjB,kBAAkB;IA0DhC;;;;;;;OAOG;IACG,mBAAmB,CACrB,aAAa,EAAE,MAAM,EACrB,YAAY,GAAE,OAAe;;;;;;;IA+FjC;;;;;OAKG;IACG,mBAAmB,CAAC,GAAG,EAAE,MAAM;;;;;;;IAwCrC;;;;;;OAMG;IACG,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,GAAE,MAAW;;;;;;;CAmCpE"}
+{"version":3,"file":"firebase-admin-auth.d.ts","sourceRoot":"","sources":["../../src/auth/firebase-admin-auth.ts"],"names":[],"mappings":"AAeA,OAAO,EAEH,KAAK,mBAAmB,EAC3B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAER,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EAC5B,MAAM,wBAAwB,CAAC;AAChC,mBAAmB,wBAAwB,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOpD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,YAAY,EACR,wBAAwB,EACxB,6BAA6B,EAChC,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAuB,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE/E,OAAO,EACH,iBAAiB,EAGpB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAGH,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEH,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACzB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACR,iBAAiB,EACjB,gBAAgB,EAChB,uBAAuB,EAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACR,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAGH,KAAK,cAAc,EACnB,KAAK,eAAe,EACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAIH,KAAK,cAAc,EAEnB,KAAK,aAAa,EAClB,KAAK,aAAa,EACrB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACR,cAAc,EACd,aAAa,EACb,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,YAAY,EACZ,iCAAiC,EACjC,iCAAiC,EACpC,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACR,cAAc,EACd,eAAe,EACf,UAAU,EACb,MAAM,kBAAkB,CAAC;AAE1B,KAAK,WAAW,CAAC,CAAC,IACZ;IAAE,IAAI,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,IAAI,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAE/C,OAAO,EAEH,KAAK,kBAAkB,EAE1B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,MAAM,WAAW,oBAAoB;IACjC,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,qBAAa,iBAAiB;IA0JtB,OAAO,CAAC,iBAAiB;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM;IAC1B,OAAO,CAAC,KAAK,CAAC;IACd,OAAO,CAAC,KAAK,CAAC;IACd,OAAO,CAAC,SAAS,CAAC;IA7JtB,6FAA6F;IACvF,wBAAwB,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAAC;IAkBjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgB;IAC7C,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,cAAc,CAAC,CAAuB;IAC9C,OAAO,CAAC,OAAO,CAAC,CAAgB;IAEhC,oBAAoB,CAChB,MAAM,EAAE,kBAAkB,GAC3B,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAS3C,iBAAiB,CACb,UAAU,EAAE,MAAM,GACnB,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAQ3C,oBAAoB,CAChB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,yBAAyB,GAClC,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAS3C,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAQpE,mBAAmB,CACf,MAAM,EAAE,wBAAwB,GACjC,OAAO,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;IAUlD,oBAAoB,IAAI,oBAAoB;IAQ5C,aAAa,IAAI,aAAa;YAiBhB,aAAa;IAqC3B;;;;;;;;;OASG;gBAES,iBAAiB,EAAE,cAAc,EAChC,QAAQ,CAAC,EAAE,MAAM,YAAA,EAClB,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,YAAA,EAC/B,KAAK,CAAC,EAAE,WAAW,YAAA,EACnB,SAAS,CAAC,EAAE,MAAM,YAAA,EAC1B,OAAO,GAAE,mBAAwB;IASrC;;;;;OAKG;YACW,cAAc;IAkD5B,yDAAyD;IACnD,UAAU,CACZ,UAAU,EAAE,aAAa,GAC1B,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAkDnC,wEAAwE;IAClE,UAAU,CACZ,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,aAAa,GAC1B,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAqDnC,mEAAmE;IAC7D,mBAAmB,CACrB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GAAG,IAAI,GACtB,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAkD7B,qEAAqE;IAC/D,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAwCzD,2EAA2E;IACrE,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAuD1E,0FAA0F;IACpF,WAAW,CACb,KAAK,EAAE,gBAAgB,EAAE,EACzB,OAAO,CAAC,EAAE,iBAAiB,GAC5B,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;IA6DzC,uEAAuE;YACzD,cAAc;IAsB5B,kFAAkF;IAC5E,QAAQ,CACV,WAAW,EAAE,cAAc,EAAE,GAC9B,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IAoDvC;;;;;OAKG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM;;;;;;;YAIX,UAAU;IAyCxB;;;;;OAKG;IACG,SAAS,CACX,UAAU,SAAO,EACjB,SAAS,CAAC,EAAE,MAAM,GACnB,OAAO,CACJ;QAAE,IAAI,EAAE,eAAe,CAAC;QAAC,KAAK,EAAE,IAAI,CAAA;KAAE,GACtC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,iBAAiB,CAAA;KAAE,CAC7C;IAuFD;;;;;OAKG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM;;;;;;;IAIlC,0EAA0E;IACpE,oBAAoB,CACtB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACZ,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAoBnC,kEAAkE;IAC5D,oBAAoB,CACtB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAwCnC;;;;;;;OAOG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,GAAE,OAAe;;;;;;;IA4GlE;;;;;;OAMG;IACG,mBAAmB,CACrB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,oBAAoB,GAC9B,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAmF/B,6EAA6E;IACvE,yBAAyB,CAC3B,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,kBAAkB,GAC9B,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAI/B,oEAAoE;IAC9D,6BAA6B,CAC/B,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,kBAAkB,GAC9B,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAI/B,mFAAmF;IAC7E,gCAAgC,CAClC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,kBAAkB,GAC9B,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAS/B,yEAAyE;IACnE,2BAA2B,CAC7B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,kBAAkB,GAC7B,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAIjB,kBAAkB;IA0DhC;;;;;;;OAOG;IACG,mBAAmB,CACrB,aAAa,EAAE,MAAM,EACrB,YAAY,GAAE,OAAe;;;;;;;IAmGjC;;;;;OAKG;IACG,mBAAmB,CAAC,GAAG,EAAE,MAAM;;;;;;;IA0DrC;;;;;;OAMG;IACG,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,GAAE,MAAW;;;;;;;CAiCpE"}

package/dist/auth/firebase-admin-auth.js

@@ -1,5 +1,11 @@
-import { generateEmailActionLink, deleteAccountsAdmin, importAccountsAdmin, createAccountAdmin, updateAccountAdmin, deleteAccountAdmin, createSessionCookie, downloadAccount, getAccountInfo, getAccountsInfo, revokeRefreshTokens } from './firebase-auth-endpoints.js';
-import { signJWTCustomToken, verifyJWT, verifySessionJWT } from './firebase-jwt.js';
+import { createAuthEmulatorFetch, manageAuthConfig, generateEmailActionLink, deleteAccountsAdmin, importAccountsAdmin, createAccountAdmin, updateAccountAdmin, deleteAccountAdmin, createSessionCookie, downloadAccount, getAccountInfo, getAccountsInfo, revokeRefreshTokens } from './firebase-auth-endpoints.js';
+import { resolveAuthEmulatorHost } from './auth-emulator.js';
+import { buildAuthConfigRequest, validateTenantId } from './auth-config.js';
+import { ProjectConfigManager } from './project-config-manager.js';
+import { TenantManager } from './tenant-manager.js';
+export { ProjectConfigManager } from './project-config-manager.js';
+export { TenantManager } from './tenant-manager.js';
+import { verifyAuthBlockingJWT, signJWTCustomToken, verifyJWT, verifySessionJWT } from './firebase-jwt.js';
 import { getToken } from './google-oauth.js';
 import { FirebaseEdgeError, FirebaseAdminAuthErrorInfo, ensureError } from './errors.js';
 import { validateDeleteUsers, createBatchUserResult } from './user-batch.js';
@@ -17,7 +23,98 @@ export class FirebaseAdminAuth {
     fetch;
     cache;
     cacheName;
+    /** Verify a blocking-event JWT. Audience matching follows the SDK's substring convention. */
+    async _verifyAuthBlockingToken(token, audience) {
+        const result = await verifyAuthBlockingJWT(token, this.serviceAccountKey.project_id, audience, this.fetch, !!this.emulatorHost);
+        if (result.error)
+            return result;
+        if (this.tenantId && result.data.tenant_id !== this.tenantId)
+            return {
+                data: null,
+                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_TENANT_ID_INVALID)
+            };
+        return result;
+    }
+    emulatorHost;
     _cacheName = '__cache';
+    projectManager;
+    tenants;
+    createProviderConfig(config) {
+        return this.executeConfig({
+            resource: 'provider',
+            action: 'create',
+            id: config?.providerId,
+            properties: config
+        });
+    }
+    getProviderConfig(providerId) {
+        return this.executeConfig({
+            resource: 'provider',
+            action: 'get',
+            id: providerId
+        });
+    }
+    updateProviderConfig(providerId, config) {
+        return this.executeConfig({
+            resource: 'provider',
+            action: 'update',
+            id: providerId,
+            properties: config
+        });
+    }
+    deleteProviderConfig(providerId) {
+        return this.executeConfig({
+            resource: 'provider',
+            action: 'delete',
+            id: providerId
+        });
+    }
+    listProviderConfigs(filter) {
+        return this.executeConfig({
+            resource: 'provider',
+            action: 'list',
+            type: filter?.type,
+            maxResults: filter?.maxResults,
+            pageToken: filter?.pageToken
+        });
+    }
+    projectConfigManager() {
+        if (this.projectManager)
+            return this.projectManager;
+        this.projectManager = new ProjectConfigManager(this.executeConfig.bind(this));
+        return this.projectManager;
+    }
+    tenantManager() {
+        if (this.tenants)
+            return this.tenants;
+        this.tenants = new TenantManager(this.executeConfig.bind(this), (tenantId) => new FirebaseAdminAuth(this.serviceAccountKey, tenantId, this.fetch, this.cache, this._cacheName, { emulatorHost: this.emulatorHost }));
+        return this.tenants;
+    }
+    async executeConfig(operation) {
+        try {
+            buildAuthConfigRequest(operation);
+            const { data: token, error } = await this.getCachedToken();
+            if (error)
+                return { data: null, error };
+            if (!token?.access_token)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_NO_TOKEN_RETURNED)
+                };
+            return await manageAuthConfig(this.serviceAccountKey.project_id, operation, token.access_token, this.fetch, this.tenantId);
+        }
+        catch (cause) {
+            if (cause instanceof FirebaseEdgeError)
+                return { data: null, error: cause };
+            return {
+                data: null,
+                error: new FirebaseEdgeError({
+                    code: 'auth/configuration-request-failed',
+                    message: 'Authentication configuration request failed.'
+                }, { cause: ensureError(cause) })
+            };
+        }
+    }
     /**
      * Creates a new Firebase Admin Auth instance.
      *
@@ -26,13 +123,19 @@ export class FirebaseAdminAuth {
      * @param fetch Optional custom fetch implementation
      * @param cache Optional cache implementation for token caching
      * @param cacheName Optional cache key name (defaults to '__cache')
+     * @param options Auth emulator configuration; defaults to FIREBASE_AUTH_EMULATOR_HOST when set.
      */
-    constructor(serviceAccountKey, tenantId, fetch, cache, cacheName) {
+    constructor(serviceAccountKey, tenantId, fetch, cache, cacheName, options = {}) {
         this.serviceAccountKey = serviceAccountKey;
         this.tenantId = tenantId;
         this.fetch = fetch;
         this.cache = cache;
         this.cacheName = cacheName;
+        if (tenantId !== undefined)
+            validateTenantId(tenantId);
+        this.emulatorHost = resolveAuthEmulatorHost(options.emulatorHost);
+        if (this.emulatorHost)
+            this.fetch = createAuthEmulatorFetch(this.emulatorHost, this.fetch);
         this._cacheName = this.cacheName || this._cacheName;
     }
     /**
@@ -42,7 +145,20 @@ export class FirebaseAdminAuth {
      * @returns Promise with token data and error
      */
     async getCachedToken() {
-        const cachedToken = await this.cache?.getCache(this._cacheName);
+        if (this.emulatorHost) {
+            return {
+                data: {
+                    access_token: 'owner',
+                    expires_in: 3600,
+                    token_type: 'Bearer',
+                    scope: '',
+                    id_token: ''
+                },
+                error: null
+            };
+        }
+        const cacheKey = `${this._cacheName}:auth:${this.serviceAccountKey.client_email}`;
+        const cachedToken = await this.cache?.getCache(cacheKey);
         if (cachedToken) {
             return {
                 data: cachedToken,
@@ -51,8 +167,11 @@ export class FirebaseAdminAuth {
         }
         const { data: token, error: getTokenError } = await getToken(this.serviceAccountKey, this.fetch);
         if (token && this.cache) {
-            // Google tokens are valid for 1 hour
-            this.cache?.setCache('token', token, 3600);
+            // Cache adapters accept milliseconds. Expire before the OAuth token does.
+            const ttlMs = Math.max(0, (token.expires_in - 60) * 1000);
+            if (Number.isFinite(ttlMs) && ttlMs > 0) {
+                await this.cache.setCache(cacheKey, token, ttlMs);
+            }
         }
         if (getTokenError) {
             return {
@@ -342,24 +461,37 @@ export class FirebaseAdminAuth {
      * @returns Promise with object containing user data or null, and error if any
      */
     async getUser(uid) {
-        const { data: token, error: tokenError } = await this.getCachedToken();
-        if (tokenError) {
-            return {
-                data: null,
-                error: tokenError
-            };
+        return this.lookupUser({ uid });
+    }
+    async lookupUser(identifier) {
+        const validation = buildUsersLookupRequest([identifier]);
+        if (validation.error)
+            return { data: null, error: validation.error };
+        try {
+            const { data: token, error: tokenError } = await this.getCachedToken();
+            if (tokenError)
+                return { data: null, error: tokenError };
+            if (!token?.access_token)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_NO_TOKEN_RETURNED)
+                };
+            const result = await getAccountInfo(identifier, token.access_token, this.serviceAccountKey.project_id, this.tenantId, this.fetch);
+            if (result.error)
+                return { data: null, error: result.error };
+            if (!result.data)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_USER_NOT_FOUND)
+                };
+            return { data: result.data, error: null };
         }
-        const { data, error } = await getAccountInfo({ uid }, token.access_token, this.serviceAccountKey.project_id, this.tenantId, this.fetch);
-        if (error) {
+        catch (cause) {
             return {
                 data: null,
-                error
+                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_USER_LOOKUP_FAILED, { cause: ensureError(cause) })
             };
         }
-        return {
-            data,
-            error: null
-        };
     }
     /**
      * Lists one page of users, using Firebase Admin's page size and token contract.
@@ -435,24 +567,7 @@ export class FirebaseAdminAuth {
      * @returns Promise with object containing user data or null, and error if any
      */
     async getUserByEmail(email) {
-        const { data: token, error: tokenError } = await this.getCachedToken();
-        if (tokenError) {
-            return {
-                data: null,
-                error: tokenError
-            };
-        }
-        const { data, error } = await getAccountInfo({ email }, token.access_token, this.serviceAccountKey.project_id, this.tenantId, this.fetch);
-        if (error) {
-            return {
-                data: null,
-                error
-            };
-        }
-        return {
-            data,
-            error: null
-        };
+        return this.lookupUser({ email });
     }
     /** Look up a linked provider UID, or a primary email/phone identifier. */
     async getUserByProviderUid(providerId, uid) {
@@ -512,7 +627,7 @@ export class FirebaseAdminAuth {
      * @returns Promise with object containing decoded token payload or null, and error if any
      */
     async verifyIdToken(idToken, checkRevoked = false) {
-        const { data: decodedIdToken, error: verifyError } = await verifyJWT(idToken, this.serviceAccountKey.project_id, this.fetch);
+        const { data: decodedIdToken, error: verifyError } = await verifyJWT(idToken, this.serviceAccountKey.project_id, this.fetch, !!this.emulatorHost);
         if (verifyError) {
             return {
                 data: null,
@@ -540,7 +655,7 @@ export class FirebaseAdminAuth {
                 };
             }
         }
-        if (!checkRevoked) {
+        if (!checkRevoked && !this.emulatorHost) {
             return {
                 data: decodedIdToken,
                 error: null
@@ -550,7 +665,10 @@ export class FirebaseAdminAuth {
         if (userError) {
             return {
                 data: null,
-                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_USER_LOOKUP_FAILED, { cause: ensureError(userError) })
+                error: new FirebaseEdgeError(userError.code ===
+                    FirebaseAdminAuthErrorInfo.ADMIN_USER_NOT_FOUND.code
+                    ? FirebaseAdminAuthErrorInfo.ADMIN_USER_RECORD_NOT_FOUND
+                    : FirebaseAdminAuthErrorInfo.ADMIN_USER_LOOKUP_FAILED, { cause: ensureError(userError) })
             };
         }
         if (!user) {
@@ -693,7 +811,7 @@ export class FirebaseAdminAuth {
      * @returns Promise with object containing decoded session payload or null, and error if any
      */
     async verifySessionCookie(sessionCookie, checkRevoked = false) {
-        const { data, error } = await verifySessionJWT(sessionCookie, this.serviceAccountKey.project_id, this.fetch);
+        const { data, error } = await verifySessionJWT(sessionCookie, this.serviceAccountKey.project_id, this.fetch, !!this.emulatorHost);
         if (error) {
             return {
                 data: null,
@@ -721,7 +839,7 @@ export class FirebaseAdminAuth {
                 };
             }
         }
-        if (!checkRevoked) {
+        if (!checkRevoked && !this.emulatorHost) {
             return {
                 data,
                 error: null
@@ -731,7 +849,10 @@ export class FirebaseAdminAuth {
         if (userError) {
             return {
                 data: null,
-                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_USER_LOOKUP_FAILED, { cause: ensureError(userError) })
+                error: new FirebaseEdgeError(userError.code ===
+                    FirebaseAdminAuthErrorInfo.ADMIN_USER_NOT_FOUND.code
+                    ? FirebaseAdminAuthErrorInfo.ADMIN_USER_RECORD_NOT_FOUND
+                    : FirebaseAdminAuthErrorInfo.ADMIN_USER_LOOKUP_FAILED, { cause: ensureError(userError) })
             };
         }
         if (!user) {
@@ -762,25 +883,40 @@ export class FirebaseAdminAuth {
      * @returns Promise with object containing revoke response data or null, and error if any
      */
     async revokeRefreshTokens(uid) {
-        const { data: token, error: getTokenError } = await this.getCachedToken();
-        if (getTokenError) {
+        const uidError = validateUserUid(uid);
+        if (uidError)
+            return { data: null, error: uidError };
+        try {
+            const { data: token, error: getTokenError } = await this.getCachedToken();
+            if (getTokenError) {
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SERVICE_ACCOUNT_TOKEN_FAILED, { cause: getTokenError })
+                };
+            }
+            if (!token?.access_token)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_NO_TOKEN_RETURNED)
+                };
+            const { data: revokeData, error: revokeError } = await revokeRefreshTokens(this.serviceAccountKey.project_id, uid, token.access_token, this.fetch, this.tenantId);
+            if (revokeError || !revokeData) {
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_REVOKE_TOKENS_FAILED, { cause: ensureError(revokeError) })
+                };
+            }
             return {
-                data: null,
-                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_SERVICE_ACCOUNT_TOKEN_FAILED, { cause: getTokenError })
+                data: revokeData,
+                error: null
             };
         }
-        const { data: revokeData, error: revokeError } = await revokeRefreshTokens(this.serviceAccountKey.project_id, uid, token.access_token, this.fetch, this.tenantId);
-        if (revokeError) {
-            console.error('Error revoking tokens:', revokeError);
+        catch (cause) {
             return {
                 data: null,
-                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_REVOKE_TOKENS_FAILED, { cause: ensureError(revokeError) })
+                error: new FirebaseEdgeError(FirebaseAdminAuthErrorInfo.ADMIN_REVOKE_TOKENS_FAILED, { cause: ensureError(cause) })
             };
         }
-        return {
-            data: revokeData,
-            error: null
-        };
     }
     /**
      * Creates a custom Firebase authentication token for a given user.
@@ -790,10 +926,7 @@ export class FirebaseAdminAuth {
      * @returns Promise with object containing custom token string or null, and error if any
      */
     async createCustomToken(uid, developerClaims = {}) {
-        const claims = this.tenantId
-            ? { ...developerClaims, tenant_id: this.tenantId }
-            : developerClaims;
-        const { data, error } = await signJWTCustomToken(uid, this.serviceAccountKey, claims);
+        const { data, error } = await signJWTCustomToken(uid, this.serviceAccountKey, developerClaims, this.tenantId, !!this.emulatorHost);
         if (error) {
             return {
                 data: null,