firebase-admin-edge 1.1.1 → 3.0.0

package/dist/firebase-edge-server.js

@@ -1,11 +1,16 @@
+import { isLocalRedirectPath, parseProviderSession } from './auth/provider-session.js';
+import { resolveProviderId, providerCredentialFromResponse, FIREBASE_PROVIDER_IDS } from './auth/provider-credential.js';
 import { FirebaseAdminAuth } from './auth/firebase-admin-auth.js';
+import { Identity } from './auth/identity.js';
+import { Firestore } from './db/firestore.js';
+import { AppCheck } from './app-check/app-check.js';
+import { Storage } from './storage/storage.js';
 import { FirebaseAuth } from './auth/firebase-auth.js';
-import { signJWTCustomToken } from './auth/firebase-jwt.js';
-import { exchangeCodeForGitHubIdToken } from './auth/github-oauth.js';
-import { exchangeCodeForGoogleIdToken } from './auth/google-oauth.js';
-import { createGitHubOAuthLoginUrl, createGoogleOAuthLoginUrl } from './auth/oauth.js';
-import { FirebaseEdgeError } from './auth/errors.js';
+import { resolveAuthEmulatorHost } from './auth/auth-emulator.js';
+import { FirebaseEdgeError, ensureError } from './auth/errors.js';
 import { FirebaseEdgeServerErrorInfo } from './firebase-edge-errors.js';
+import { createEmailLinkState, readEmailLinkState, parseEmailActionLink, parseEmailSignInLink } from './auth/email-link.js';
+import { buildEmailActionRequest } from './auth/email-action-request.js';
 const COOKIE_LIFETIME_SECONDS = 60 * 60 * 24 * 5; // 5 days
 const COOKIE_OPTIONS = {
     httpOnly: true,
@@ -14,26 +19,13 @@ const COOKIE_OPTIONS = {
     path: '/',
     maxAge: COOKIE_LIFETIME_SECONDS
 };
-/**
- * Official Firebase OAuth providers
- */
-export const OFFICIAL_FIREBASE_OAUTH_PROVIDERS = [
-    'google',
-    'facebook',
-    'apple',
-    'twitter',
-    'github',
-    'microsoft',
-    'yahoo',
-    'playgames'
-];
+export const OFFICIAL_FIREBASE_OAUTH_PROVIDERS = Object.keys(FIREBASE_PROVIDER_IDS);
 /**
  * Creates a Firebase Edge Server for authentication and session management in edge environments.
  *
  * @param config Configuration object
  * @param config.serviceAccount Firebase service account for admin operations
  * @param config.firebaseConfig Firebase client configuration
- * @param config.providers OAuth provider configurations (Google, GitHub, etc.)
  * @param config.cookies Cookie management functions (getSession, saveSession)
  * @param config.redirectUri OAuth callback redirect URI
  * @param config.cache Optional cache implementation for token caching
@@ -43,9 +35,10 @@ export const OFFICIAL_FIREBASE_OAUTH_PROVIDERS = [
  * @param config.tenantId Optional Firebase Auth tenant ID for multi-tenancy
  * @param config.autoLinkProviders Optional flag to automatically link accounts with same email
  * @param config.fetch Optional custom fetch implementation
- * @returns Object with authentication methods (auth, adminAuth, signOut, getUser, getGoogleLoginURL, getGitHubLoginURL, signInWithCallback, getToken)
+ * @param config.authEmulatorHost Auth emulator host:port; null forces production, undefined reads the environment.
+ * @returns Object with auth, adminAuth, firestore, and session management methods
  */
-export function createFirebaseEdgeServer({ serviceAccount, firebaseConfig, providers, cookies, cookieName, cookieOptions, cache, cacheName, tenantId, redirectUri, autoLinkProviders, fetch }) {
+export function createFirebaseEdgeServer({ serviceAccount, firebaseConfig, cookies, cookieName, cookieOptions, cache, cacheName, tenantId, redirectUri, autoLinkProviders, fetch, authEmulatorHost }) {
     // Cookies
     const _cookieName = cookieName || '__session';
     const { getSession, saveSession } = cookies;
@@ -54,8 +47,399 @@ export function createFirebaseEdgeServer({ serviceAccount, firebaseConfig, provi
     const fetchImpl = fetch ?? globalThis.fetch;
     const cacheImpl = cache ?? undefined;
     // Auth instances
-    const auth = new FirebaseAuth(firebaseConfig, redirectUri, tenantId, fetchImpl);
-    const adminAuth = new FirebaseAdminAuth(serviceAccount, tenantId, fetchImpl, cacheImpl, cacheName);
+    const authOptions = {
+        emulatorHost: resolveAuthEmulatorHost(authEmulatorHost)
+    };
+    const auth = new FirebaseAuth(firebaseConfig, redirectUri, {
+        tenantId,
+        fetch: fetchImpl,
+        ...authOptions
+    });
+    const adminAuth = new FirebaseAdminAuth(serviceAccount, {
+        tenantId,
+        fetch: fetchImpl,
+        cache: cacheImpl,
+        cacheName,
+        ...authOptions
+    });
+    const firestore = new Firestore(serviceAccount, {
+        fetch: fetchImpl,
+        cache: cacheImpl,
+        cacheName
+    });
+    const identity = new Identity(serviceAccount, {
+        tenantId,
+        fetch: fetchImpl,
+        cache: cacheImpl,
+        cacheName,
+        ...authOptions
+    });
+    const appCheck = new AppCheck(serviceAccount, {
+        fetch: fetchImpl,
+        cache: cacheImpl,
+        cacheName
+    });
+    const storage = new Storage(serviceAccount, {
+        bucketName: firebaseConfig.storageBucket,
+        fetch: fetchImpl,
+        cache: cacheImpl,
+        cacheName
+    });
+    /** Describe the confirmation form to render, without exchanging or consuming any code. */
+    function getCallbackAction(url) {
+        try {
+            const action = parseEmailActionLink(url, firebaseConfig.apiKey, tenantId);
+            if (!action)
+                return { data: null, error: null };
+            return {
+                data: {
+                    hasLink: action.hasLink,
+                    actionMode: action.actionMode
+                },
+                error: null
+            };
+        }
+        catch (cause) {
+            return { data: null, error: ensureError(cause) };
+        }
+    }
+    /** Complete any supported callback after the framework has obtained user confirmation. */
+    async function handleCallback(url, options = {}) {
+        try {
+            const action = parseEmailActionLink(url, firebaseConfig.apiKey, tenantId);
+            if (!action || action.actionMode === 'signIn') {
+                const { error, data } = await signInWithCallback(url, options);
+                if (error)
+                    return { data: null, error };
+                return {
+                    data: { type: 'redirect', url: data },
+                    error: null
+                };
+            }
+            if (!action.hasLink || !action.code)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError({
+                        code: 'auth/invalid-action-code',
+                        message: 'An email action code is required.'
+                    })
+                };
+            if (action.actionMode === 'resetPassword' &&
+                options.confirmPassword !== undefined &&
+                options.newPassword !== options.confirmPassword)
+                return {
+                    data: null,
+                    error: new FirebaseEdgeError({
+                        code: 'auth/password-mismatch',
+                        message: 'Passwords do not match.'
+                    })
+                };
+            const { error } = action.actionMode === 'resetPassword'
+                ? await confirmPasswordReset(action.code, options.newPassword ?? '')
+                : await applyActionCode(action.code);
+            if (error)
+                return { data: null, error };
+            return {
+                data: {
+                    type: 'complete',
+                    message: action.actionMode === 'resetPassword'
+                        ? 'Your password has been reset. You can sign in again.'
+                        : 'Your email has been updated or verified. Please sign in again.'
+                },
+                error: null
+            };
+        }
+        catch (cause) {
+            return { data: null, error: ensureError(cause) };
+        }
+    }
+    /** Send Firebase's password reset email using the configured callback. */
+    async function sendPasswordResetEmail(email, locale) {
+        return auth.sendPasswordResetEmail(email, redirectUri, locale);
+    }
+    /** Reset a password and clear the local session after success. */
+    async function confirmPasswordReset(oobCode, newPassword) {
+        const { error, data } = await auth.confirmPasswordReset(oobCode, newPassword);
+        if (error)
+            return { error, data };
+        signOut();
+        return { error, data };
+    }
+    /** Verify a new email before changing the currently signed-in account. */
+    async function verifyBeforeUpdateEmail(newEmail, locale) {
+        const { error: userError, data: userData } = await getUser(true);
+        if (userError)
+            return { data: null, error: userError };
+        if (!userData)
+            return {
+                data: null,
+                error: new FirebaseEdgeError({
+                    code: 'auth/unauthenticated',
+                    message: 'Sign in before changing your email.'
+                })
+            };
+        // getToken exchanges a custom token, so enforce recency on the original session first.
+        const age = Date.now() / 1000 - userData.auth_time;
+        if (!Number.isFinite(age) || age < 0 || age > 300)
+            return {
+                data: null,
+                error: new FirebaseEdgeError({
+                    code: 'auth/requires-recent-login',
+                    message: 'Sign out and sign in again before changing your email.'
+                })
+            };
+        const { error: tokenError, data: tokenData } = await getToken();
+        if (tokenError)
+            return { data: null, error: tokenError };
+        if (!tokenData?.idToken)
+            return {
+                data: null,
+                error: new FirebaseEdgeError({
+                    code: 'auth/unauthenticated',
+                    message: 'Sign in before changing your email.'
+                })
+            };
+        return auth.verifyBeforeUpdateEmail(tokenData.idToken, newEmail, redirectUri, locale);
+    }
+    /** Apply an email action and discard stale local session claims on success. */
+    async function applyActionCode(oobCode) {
+        const { error, data } = await auth.applyActionCode(oobCode);
+        if (error)
+            return { error, data };
+        signOut();
+        return { error, data };
+    }
+    /** Persist a successful Firebase login as the configured session cookie. */
+    async function saveSignInSession(signInData, next, expiresIn_ms) {
+        const { idToken } = signInData;
+        if (!idToken) {
+            return {
+                error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_ID_TOKEN)
+            };
+        }
+        const { data: sessionCookie, error: sessionError } = await adminAuth.createSessionCookie(idToken, {
+            expiresIn: expiresIn_ms
+        });
+        if (sessionError) {
+            return {
+                error: sessionError
+            };
+        }
+        if (!sessionCookie) {
+            return {
+                error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_SESSION_COOKIE)
+            };
+        }
+        await saveSession(_cookieName, sessionCookie, _cookieOptions);
+        return {
+            data: next,
+            error: null
+        };
+    }
+    /** Send a magic link with an optional email inside encrypted continuation state. */
+    async function sendSignInLinkToEmail(email, next = '/', options = {}) {
+        if (!isLocalRedirectPath(next))
+            return {
+                error: new FirebaseEdgeError({
+                    code: 'auth/invalid-continue-uri',
+                    message: 'The next path must be a local absolute path.'
+                })
+            };
+        const callbackUrl = options.callbackUrl ?? redirectUri;
+        const { error: validatedError } = buildEmailActionRequest('EMAIL_SIGNIN', email, {
+            url: callbackUrl,
+            handleCodeInApp: true
+        });
+        if (validatedError)
+            return { error: validatedError };
+        try {
+            const state = await createEmailLinkState({ next, ...(options.includeEmailInLink && { email }) }, serviceAccount.private_key, firebaseConfig.projectId, tenantId);
+            const continuation = new URL(callbackUrl);
+            continuation.searchParams.set('emailLinkState', state);
+            const { error } = await auth.sendSignInLinkToEmail(email, continuation.toString(), options.locale);
+            if (error)
+                return { error };
+            return { data: { sent: true }, error: null };
+        }
+        catch (cause) {
+            return { error: ensureError(cause) };
+        }
+    }
+    /** Complete a magic link with explicit email or email carried in encrypted state. */
+    async function signInWithEmailLink(url, options = {}) {
+        try {
+            const link = parseEmailSignInLink(url, firebaseConfig.apiKey, tenantId);
+            const state = await readEmailLinkState(link.state, serviceAccount.private_key, firebaseConfig.projectId, tenantId);
+            const email = options.email ?? state.email;
+            if (!email)
+                return {
+                    error: new FirebaseEdgeError({
+                        code: 'auth/missing-email',
+                        message: 'Enter the email address this sign-in link was sent to.'
+                    })
+                };
+            if (state.email && options.email && state.email !== options.email)
+                return {
+                    error: new FirebaseEdgeError({
+                        code: 'auth/invalid-email',
+                        message: 'The email does not match this sign-in link.'
+                    })
+                };
+            const { error, data } = await auth.signInWithEmailLink(email, link.code);
+            if (error)
+                return { error };
+            return await saveSignInSession(data ?? {}, state.next, options.expiresInMs ?? COOKIE_LIFETIME_SECONDS * 1000);
+        }
+        catch (cause) {
+            return { error: ensureError(cause) };
+        }
+    }
+    /** Begin a provider flow using the provider configuration in Firebase Console. */
+    async function startProviderAuthorization(provider, next, intent, options) {
+        const providerId = resolveProviderId(provider);
+        if (providerId === 'playgames.google.com')
+            throw new FirebaseEdgeError({
+                code: 'auth/operation-not-supported-in-this-environment',
+                message: 'Use a native Play Games server authorization code with signInWithProviderToken.'
+            });
+        if (!isLocalRedirectPath(next))
+            throw new FirebaseEdgeError({
+                code: 'auth/invalid-continue-uri',
+                message: 'The next path must be a local absolute path.'
+            });
+        if (intent === 'link') {
+            const { error: userError, data: userData } = await getUser();
+            if (userError)
+                throw userError;
+            if (!userData)
+                throw new FirebaseEdgeError({
+                    code: 'auth/user-not-found',
+                    message: 'Sign in before linking a provider.'
+                });
+        }
+        const { error, data } = await auth.createProviderAuthorization(providerId, options);
+        if (error)
+            throw error;
+        if (!data?.authUri || !data.sessionId)
+            throw new FirebaseEdgeError({
+                code: 'auth/internal-error',
+                message: 'Firebase returned an incomplete authorization response.'
+            });
+        await saveSession(_cookieName + '_oauth', JSON.stringify({ sessionId: data.sessionId, next, intent }), {
+            ..._cookieOptions,
+            httpOnly: true,
+            secure: true,
+            sameSite: 'none',
+            maxAge: 600
+        });
+        if (intent === 'signin')
+            deleteSession();
+        return data.authUri;
+    }
+    async function getProviderLoginURL(provider, next, options) {
+        return startProviderAuthorization(provider, next, 'signin', options);
+    }
+    async function getProviderLinkURL(provider, next, options) {
+        return startProviderAuthorization(provider, next, 'link', options);
+    }
+    /** Complete GET or form POST callbacks from Firebase-managed provider authorization. */
+    async function signInWithProviderCallback(url, postBody, expiresIn_ms = COOKIE_LIFETIME_SECONDS * 1000) {
+        const stored = await getSession(_cookieName + '_oauth');
+        if (!stored)
+            return {
+                error: new FirebaseEdgeError({
+                    code: 'auth/invalid-credential',
+                    message: 'The provider authorization session is missing or expired.'
+                })
+            };
+        await saveSession(_cookieName + '_oauth', '', {
+            ..._cookieOptions,
+            maxAge: 0
+        });
+        const flow = parseProviderSession(stored);
+        if (!flow)
+            return {
+                error: new FirebaseEdgeError({
+                    code: 'auth/invalid-credential',
+                    message: 'Invalid provider authorization session.'
+                })
+            };
+        let idToken;
+        if (flow.intent === 'link') {
+            const { error: tokenError, data: tokenData } = await getToken();
+            if (tokenError)
+                return { error: tokenError };
+            if (!tokenData?.idToken)
+                return {
+                    error: new FirebaseEdgeError({
+                        code: 'auth/user-not-found',
+                        message: 'Sign in before linking a provider.'
+                    })
+                };
+            idToken = tokenData.idToken;
+        }
+        const { error, data } = await auth.signInWithProviderCallback({ requestUri: url.toString(), sessionId: flow.sessionId, postBody }, idToken);
+        if (error)
+            return { error };
+        if (!data)
+            return {
+                error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_SIGN_IN_DATA)
+            };
+        const signInData = data;
+        const { error: completedError, data: completedData } = flow.intent === 'link'
+            ? { error, data }
+            : await completeProviderSignIn(signInData, async (existingIdToken) => {
+                if (signInData.pendingToken)
+                    return auth.signInWithProviderCallback({
+                        requestUri: url.toString(),
+                        pendingToken: signInData.pendingToken
+                    }, existingIdToken);
+                try {
+                    const { providerId, credential } = providerCredentialFromResponse(signInData);
+                    return await auth.linkWithCredential(existingIdToken, credential, providerId);
+                }
+                catch (cause) {
+                    return { error: ensureError(cause) };
+                }
+            });
+        if (completedError)
+            return { error: completedError };
+        if (!completedData?.idToken)
+            return {
+                error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_ID_TOKEN)
+            };
+        return saveSignInSession(completedData, flow.next, expiresIn_ms);
+    }
+    async function getFacebookLoginURL(next, options) {
+        return getProviderLoginURL('facebook', next, options);
+    }
+    async function getFacebookLinkURL(next, options) {
+        return getProviderLinkURL('facebook', next, options);
+    }
+    async function getAppleLoginURL(next, options) {
+        return getProviderLoginURL('apple', next, options);
+    }
+    async function getAppleLinkURL(next, options) {
+        return getProviderLinkURL('apple', next, options);
+    }
+    async function getTwitterLoginURL(next, options) {
+        return getProviderLoginURL('twitter', next, options);
+    }
+    async function getTwitterLinkURL(next, options) {
+        return getProviderLinkURL('twitter', next, options);
+    }
+    async function getMicrosoftLoginURL(next, options) {
+        return getProviderLoginURL('microsoft', next, options);
+    }
+    async function getMicrosoftLinkURL(next, options) {
+        return getProviderLinkURL('microsoft', next, options);
+    }
+    async function getYahooLoginURL(next, options) {
+        return getProviderLoginURL('yahoo', next, options);
+    }
+    async function getYahooLinkURL(next, options) {
+        return getProviderLinkURL('yahoo', next, options);
+    }
     /**
      * Clears the session cookie by setting its maxAge to 0.
      */
@@ -109,53 +493,29 @@ export function createFirebaseEdgeServer({ serviceAccount, firebaseConfig, provi
             error: null
         };
     }
-    /**
-     * Generates a Google OAuth login URL and clears any existing session.
-     *
-     * @param next State parameter for the OAuth flow (typically the redirect path after login)
-     * @param options Optional configuration object
-     * @param options.languageCode ISO 639-1 language code (e.g., 'en', 'es', 'fr')
-     * @param options.customParameters Custom OAuth parameters (e.g., { login_hint: 'user@example.com', hd: 'example.com' })
-     * @param options.addScopes Additional OAuth scopes (e.g., ['https://www.googleapis.com/auth/calendar.readonly'])
-     * @returns Promise resolving to Google OAuth login URL string
-     * @throws {FirebaseEdgeError} If Google provider is not configured
-     */
+    /** Begin Google sign-in using the provider configured in Firebase Console. */
     async function getGoogleLoginURL(next, options) {
-        deleteSession();
-        if (!providers.google) {
-            throw new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_GOOGLE_PROVIDER_NOT_CONFIGURED);
-        }
-        const { client_id } = providers.google;
-        return createGoogleOAuthLoginUrl(redirectUri, next, client_id, 'signin', options?.languageCode, options?.customParameters, options?.addScopes);
+        return getProviderLoginURL('google', next, options);
     }
-    /**
-     * Generates a GitHub OAuth login URL and clears any existing session.
-     * Note: GitHub doesn't support language parameters - language is determined by user's browser/account settings.
-     *
-     * @param next State parameter for the OAuth flow (typically the redirect path after login)
-     * @param options Optional configuration object
-     * @param options.customParameters Custom OAuth parameters (e.g., { login: 'username', allow_signup: 'false' })
-     * @param options.addScopes Additional OAuth scopes (e.g., ['repo', 'gist'])
-     * @returns Promise resolving to GitHub OAuth login URL string
-     * @throws {FirebaseEdgeError} If GitHub provider is not configured
-     */
+    /** Begin GitHub sign-in using the provider configured in Firebase Console. */
     async function getGitHubLoginURL(next, options) {
-        deleteSession();
-        if (!providers.github) {
-            throw new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_GITHUB_PROVIDER_NOT_CONFIGURED);
-        }
-        const { client_id } = providers.github;
-        return createGitHubOAuthLoginUrl(redirectUri, next, client_id, 'link', options?.customParameters, options?.addScopes);
+        return getProviderLoginURL('github', next, options);
     }
     /**
      * Signs a user in using an already-obtained provider token.
      *
-     * @param provider Provider slug ('google' or 'github')
+     * @param provider Firebase provider slug or ID
      * @param oauthToken Provider token (Google `id_token` or GitHub `access_token`)
      * @returns Promise resolving to an object containing sign-in data and/or an error
      */
     async function signInWithProviderToken(provider, oauthToken) {
-        const providerId = provider === 'google' ? 'google.com' : 'github.com';
+        let providerId;
+        try {
+            providerId = resolveProviderId(provider);
+        }
+        catch (error) {
+            return { data: null, error: error };
+        }
         const { data: signInData, error: signInError } = await auth.signInWithProvider(oauthToken, providerId);
         if (signInError) {
             return {
@@ -167,197 +527,77 @@ export function createFirebaseEdgeServer({ serviceAccount, firebaseConfig, provi
                 error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_SIGN_IN_DATA)
             };
         }
-        // Account exists with that email but different sign-in method
-        if (signInData.needConfirmation) {
-            if (!autoLinkProviders) {
-                return {
-                    error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_ACCOUNT_EXISTS_DIFFERENT_METHOD)
-                };
-            }
-            if (!signInData.email) {
-                return {
-                    error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_EMAIL_FOR_AUTO_LINKING)
-                };
-            }
-            const { data, error: getEmailError } = await adminAuth.getUserByEmail(signInData.email);
-            if (getEmailError) {
-                return {
-                    error: getEmailError
-                };
-            }
-            if (!data?.localId) {
-                return {
-                    error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_USER_RECORD)
-                };
-            }
-            const { data: customTokenData, error: tokenError } = await adminAuth.createCustomToken(data.localId);
-            if (tokenError) {
-                return {
-                    data: null,
-                    error: tokenError
-                };
-            }
-            const { data: customSignInData, error: customSignInError } = await auth.signInWithCustomToken(customTokenData);
-            if (customSignInError) {
-                return {
-                    data: null,
-                    error: customSignInError
-                };
-            }
-            if (!customSignInData?.idToken) {
-                return {
-                    data: null,
-                    error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_ID_TOKEN)
-                };
-            }
-            const { data: linkData, error: linkError } = await auth.linkWithCredential(customSignInData.idToken, oauthToken, providerId);
-            if (linkError) {
-                return {
-                    data: null,
-                    error: linkError
-                };
-            }
+        return completeProviderSignIn(signInData, (idToken) => auth.linkWithCredential(idToken, oauthToken, providerId));
+    }
+    /** Resolve same-email collisions consistently for credential and managed flows. */
+    async function completeProviderSignIn(signInData, linkCredential) {
+        if (!signInData.needConfirmation)
+            return { data: signInData, error: null };
+        if (!autoLinkProviders) {
             return {
-                data: linkData,
-                error: null
+                error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_ACCOUNT_EXISTS_DIFFERENT_METHOD)
             };
         }
-        return {
-            data: signInData,
-            error: signInError
-        };
-    }
-    /**
-     * Completes OAuth flow by exchanging authorization code for a session.
-     *
-     * @param url URL containing authorization code and state from OAuth callback
-     * @param expiresIn_ms Session cookie expiration time in milliseconds (defaults to 5 days)
-     * @returns Promise resolving to object with next redirect path and error if any
-     */
-    async function signInWithCallback(url, expiresIn_ms = COOKIE_LIFETIME_SECONDS * 1000) {
-        const code = url.searchParams.get('code');
-        const state = url.searchParams.get('state');
-        if (!code) {
+        if (!signInData.email) {
             return {
-                error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_AUTHORIZATION_CODE)
+                error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_EMAIL_FOR_AUTO_LINKING)
             };
         }
-        let next = '/';
-        let provider = null;
-        let intent = null;
-        try {
-            const parsed = state && JSON.parse(state);
-            next = parsed?.next ?? '/';
-            provider = parsed?.provider ?? null;
-            intent = parsed?.intent ?? null;
-        }
-        catch { }
-        if (!provider) {
+        const { data, error: getEmailError } = await adminAuth.getUserByEmail(signInData.email);
+        if (getEmailError) {
             return {
-                error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_PROVIDER_IN_STATE)
+                error: getEmailError
             };
         }
-        let oauthToken = null;
-        if (providers.google && provider === 'google') {
-            const { client_id, client_secret } = providers.google;
-            const { data: googleData, error: exchangeError } = await exchangeCodeForGoogleIdToken(code, redirectUri, client_id, client_secret, fetchImpl);
-            if (exchangeError) {
-                return {
-                    error: exchangeError
-                };
-            }
-            if (!googleData) {
-                return {
-                    error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_EXCHANGE_DATA)
-                };
-            }
-            oauthToken = googleData.id_token;
-        }
-        else if (providers.github && provider === 'github') {
-            const { client_id, client_secret } = providers.github;
-            const { data: githubData, error: exchangeError } = await exchangeCodeForGitHubIdToken(code, redirectUri, client_id, client_secret, fetchImpl);
-            if (exchangeError) {
-                return {
-                    error: exchangeError
-                };
-            }
-            if (!githubData) {
-                return {
-                    error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_EXCHANGE_DATA)
-                };
-            }
-            oauthToken = githubData.access_token;
-        }
-        if (!oauthToken) {
+        if (!data?.localId) {
             return {
-                error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_OAUTH_TOKEN)
+                error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_USER_RECORD)
             };
         }
-        if (intent === 'link') {
-            const providerId = provider === 'google' ? 'google.com' : 'github.com';
-            const { error: linkError } = await linkProvider(oauthToken, providerId);
-            if (linkError) {
-                return {
-                    error: linkError
-                };
-            }
-            const { data: userData, error: userError } = await getUser();
-            if (userError) {
-                return {
-                    error: userError
-                };
-            }
-            if (!userData?.user_id) {
-                return {
-                    error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_USER_FOR_LINKING)
-                };
-            }
-            const { error: revokeError } = await adminAuth.revokeRefreshTokens(userData.user_id);
-            if (revokeError) {
-                return {
-                    error: revokeError
-                };
-            }
+        const { data: customTokenData, error: tokenError } = await adminAuth.createCustomToken(data.localId);
+        if (tokenError) {
             return {
-                data: next,
-                error: null
+                data: null,
+                error: tokenError
             };
         }
-        const { data: signInData, error: signInError } = await signInWithProviderToken(provider, oauthToken);
-        if (signInError) {
+        if (!customTokenData)
             return {
-                error: signInError
+                error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_CUSTOM_TOKEN_SIGNED)
             };
-        }
-        if (!signInData) {
+        const { data: customSignInData, error: customSignInError } = await auth.signInWithCustomToken(customTokenData);
+        if (customSignInError) {
             return {
-                error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_SIGN_IN_DATA)
+                data: null,
+                error: customSignInError
             };
         }
-        const { idToken } = signInData;
-        if (!idToken) {
+        if (!customSignInData?.idToken) {
             return {
+                data: null,
                 error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_ID_TOKEN)
             };
         }
-        const { data: sessionCookie, error: sessionError } = await adminAuth.createSessionCookie(idToken, {
-            expiresIn: expiresIn_ms
-        });
-        if (sessionError) {
-            return {
-                error: sessionError
-            };
+        return linkCredential(customSignInData.idToken);
+    }
+    /**
+     * Completes provider or magic-link sign-in and saves a session.
+     *
+     * @param url Full provider callback or email action URL
+     * @param options Callback options, or a legacy numeric session duration in milliseconds
+     * @returns Promise resolving to object with next redirect path and error if any
+     */
+    async function signInWithCallback(url, options = {}) {
+        const settings = typeof options === 'number' ? { expiresInMs: options } : options;
+        try {
+            const action = parseEmailActionLink(url, firebaseConfig.apiKey, tenantId);
+            if (action)
+                return signInWithEmailLink(url, settings);
         }
-        if (!sessionCookie) {
-            return {
-                error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_SESSION_COOKIE)
-            };
+        catch (cause) {
+            return { error: ensureError(cause) };
         }
-        saveSession(_cookieName, sessionCookie, _cookieOptions);
-        return {
-            data: next,
-            error: null
-        };
+        return signInWithProviderCallback(url, settings.postBody, settings.expiresInMs);
     }
     /**
      * Generates fresh Firebase client tokens for the authenticated user.
@@ -379,8 +619,7 @@ export function createFirebaseEdgeServer({ serviceAccount, firebaseConfig, provi
                 error: null
             };
         }
-        const claims = tenantId ? { tenant_id: tenantId } : {};
-        const { data: signJWTData, error: signJWTError } = await signJWTCustomToken(verifiedToken.sub, serviceAccount, claims);
+        const { data: signJWTData, error: signJWTError } = await adminAuth.createCustomToken(verifiedToken.sub);
         if (signJWTError) {
             return {
                 data: null,
@@ -463,46 +702,19 @@ export function createFirebaseEdgeServer({ serviceAccount, firebaseConfig, provi
                 error: new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_NO_SESSION_COOKIE)
             };
         }
-        saveSession(_cookieName, sessionCookie, _cookieOptions);
+        await saveSession(_cookieName, sessionCookie, _cookieOptions);
         return {
             data: unlinkData,
             error: null
         };
     }
-    /**
-     * Generates a Google OAuth URL for linking an additional provider to the current user.
-     *
-     * @param next State parameter for the OAuth flow (typically the redirect path after linking)
-     * @param options Optional configuration object
-     * @param options.languageCode ISO 639-1 language code (e.g., 'en', 'es', 'fr')
-     * @param options.customParameters Custom OAuth parameters (e.g., { login_hint: 'user@example.com' })
-     * @param options.addScopes Additional OAuth scopes (e.g., ['https://www.googleapis.com/auth/calendar.readonly'])
-     * @returns Promise resolving to Google OAuth link URL string
-     * @throws {FirebaseEdgeError} If Google provider is not configured
-     */
+    /** Begin Google linking for the currently authenticated user. */
     async function getGoogleLinkURL(next, options) {
-        if (!providers.google) {
-            throw new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_GOOGLE_PROVIDER_NOT_CONFIGURED);
-        }
-        const { client_id } = providers.google;
-        return createGoogleOAuthLoginUrl(redirectUri, next, client_id, 'link', options?.languageCode, options?.customParameters, options?.addScopes);
+        return getProviderLinkURL('google', next, options);
     }
-    /**
-     * Generates a GitHub OAuth URL for linking an additional provider to the current user.
-     *
-     * @param next State parameter for the OAuth flow (typically the redirect path after linking)
-     * @param options Optional configuration object
-     * @param options.customParameters Custom OAuth parameters (e.g., { login: 'username', allow_signup: 'false' })
-     * @param options.addScopes Additional OAuth scopes (e.g., ['repo', 'gist'])
-     * @returns Promise resolving to GitHub OAuth link URL string
-     * @throws {FirebaseEdgeError} If GitHub provider is not configured
-     */
+    /** Begin GitHub linking for the currently authenticated user. */
     async function getGitHubLinkURL(next, options) {
-        if (!providers.github) {
-            throw new FirebaseEdgeError(FirebaseEdgeServerErrorInfo.EDGE_GITHUB_PROVIDER_NOT_CONFIGURED);
-        }
-        const { client_id } = providers.github;
-        return createGitHubOAuthLoginUrl(redirectUri, next, client_id, 'signin', options?.customParameters, options?.addScopes);
+        return getProviderLinkURL('github', next, options);
     }
     /**
      * Links an OAuth provider to the currently authenticated user.
@@ -540,8 +752,33 @@ export function createFirebaseEdgeServer({ serviceAccount, firebaseConfig, provi
     return {
         auth,
         adminAuth,
+        firestore,
+        identity,
+        appCheck,
+        storage,
+        sendSignInLinkToEmail,
+        getCallbackAction,
+        handleCallback,
+        sendPasswordResetEmail,
+        confirmPasswordReset,
+        verifyBeforeUpdateEmail,
+        applyActionCode,
         signOut,
         getUser,
+        getProviderLoginURL,
+        getProviderLinkURL,
+        signInWithProviderCallback,
+        signInWithProviderToken,
+        getFacebookLoginURL,
+        getFacebookLinkURL,
+        getAppleLoginURL,
+        getAppleLinkURL,
+        getTwitterLoginURL,
+        getTwitterLinkURL,
+        getMicrosoftLoginURL,
+        getMicrosoftLinkURL,
+        getYahooLoginURL,
+        getYahooLinkURL,
         getGoogleLoginURL,
         getGitHubLoginURL,
         getGoogleLinkURL,