firebase-admin-edge 1.1.1 → 3.0.0

package/dist/auth/firebase-auth.d.ts

@@ -1,5 +1,11 @@
+import { type ProviderCredential, type ProviderAuthorizationOptions, type ProviderCallback } from './provider-credential.js';
+import { type AuthEmulatorOptions } from './auth-emulator.js';
 import type { FirebaseConfig } from './firebase-types.js';
 import { FirebaseEdgeError } from './errors.js';
+export interface FirebaseAuthOptions extends AuthEmulatorOptions {
+    tenantId?: string;
+    fetch?: typeof globalThis.fetch;
+}
 /**
  * Firebase Client Authentication handler for edge environments.
  * Provides client-side authentication operations using Firebase API.
@@ -9,15 +15,85 @@ export declare class FirebaseAuth {
     private requestUri;
     private tenantId?;
     private fetch?;
+    sendPasswordResetEmail(email: string, continueUrl?: string, locale?: string): Promise<{
+        data: {
+            email: string;
+        } | null;
+        error: FirebaseEdgeError | null;
+    } | {
+        data: null;
+        error: Error;
+    }>;
+    verifyBeforeUpdateEmail(idToken: string, newEmail: string, continueUrl?: string, locale?: string): Promise<{
+        data: {
+            email: string;
+        } | null;
+        error: FirebaseEdgeError | null;
+    } | {
+        data: null;
+        error: Error;
+    }>;
+    confirmPasswordReset(oobCode: string, newPassword: string): Promise<{
+        data: {
+            email: string;
+        } | null;
+        error: FirebaseEdgeError | null;
+    } | {
+        data: null;
+        error: Error;
+    }>;
+    applyActionCode(oobCode: string): Promise<{
+        data: {
+            email?: string;
+            localId?: string;
+        } | null;
+        error: FirebaseEdgeError | null;
+    } | {
+        data: null;
+        error: Error;
+    }>;
+    /** Ask Firebase to deliver a sign-in email. */
+    sendSignInLinkToEmail(email: string, continueUrl: string, locale?: string): Promise<{
+        data: {
+            email: string;
+        } | null;
+        error: FirebaseEdgeError | null;
+    } | {
+        data: null;
+        error: Error;
+    }>;
+    /** Exchange the email and one-time action code for Firebase tokens. */
+    signInWithEmailLink(email: string, oobCode: string): Promise<{
+        data: import("./firebase-types.js").FirebaseIdpSignInResponse | null;
+        error: FirebaseEdgeError | null;
+    } | {
+        data: null;
+        error: Error;
+    }>;
+    /** Begin a Firebase-managed provider flow. Persist sessionId securely for the callback. */
+    createProviderAuthorization(providerId: string, options?: ProviderAuthorizationOptions): Promise<{
+        data: import("./firebase-types.js").FirebaseCreateAuthUriResponse | null;
+        error: FirebaseEdgeError | null;
+    } | {
+        data: null;
+        error: Error;
+    }>;
+    /** Complete a provider callback; idToken links to an existing Firebase account. */
+    signInWithProviderCallback(callback: ProviderCallback, idToken?: string): Promise<{
+        data: import("./firebase-types.js").FirebaseIdpSignInResponse | null;
+        error: FirebaseEdgeError | null;
+    } | {
+        data: null;
+        error: Error;
+    }>;
     /**
      * Creates a new Firebase Auth instance.
      *
      * @param firebase_config Firebase client configuration
      * @param requestUri OAuth callback URI
-     * @param tenantId Optional tenant ID for multi-tenancy
-     * @param fetch Optional custom fetch implementation
+     * @param options Optional constructor settings, including Auth emulator configuration.
      */
-    constructor(firebase_config: FirebaseConfig, requestUri: string, tenantId?: string | undefined, fetch?: typeof globalThis.fetch | undefined);
+    constructor(firebase_config: FirebaseConfig, requestUri: string, options?: FirebaseAuthOptions);
     /**
      * Signs in a user with an OAuth provider token.
      *
@@ -25,7 +101,7 @@ export declare class FirebaseAuth {
      * @param providerId OAuth provider ID (defaults to 'google.com')
      * @returns Promise with object containing sign-in data or null, and error if any
      */
-    signInWithProvider(oauthToken: string, providerId?: string): Promise<{
+    signInWithProvider(oauthToken: string | ProviderCredential, providerId?: string): Promise<{
         data: null;
         error: FirebaseEdgeError;
     } | {
@@ -39,8 +115,8 @@ export declare class FirebaseAuth {
      * @returns Promise with object containing sign-in data (idToken, refreshToken, expiresIn) or null, and error if any
      */
     signInWithCustomToken(customToken: string): Promise<{
-        data: null;
         error: FirebaseEdgeError;
+        data: null;
     } | {
         data: import("./firebase-types.js").FirebaseIdpSignInResponse;
         error: null;
@@ -53,7 +129,7 @@ export declare class FirebaseAuth {
      * @param providerId OAuth provider ID (defaults to 'google.com')
      * @returns Promise with object containing linked account data or null, and error if any
      */
-    linkWithCredential(idToken: string, providerToken: string, providerId?: string): Promise<{
+    linkWithCredential(idToken: string, providerToken: string | ProviderCredential, providerId?: string): Promise<{
         data: null;
         error: FirebaseEdgeError;
     } | {

package/dist/auth/firebase-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firebase-auth.d.ts","sourceRoot":"","sources":["../../src/auth/firebase-auth.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAe,MAAM,aAAa,CAAC;AAG7D;;;GAGG;AACH,qBAAa,YAAY;IAUjB,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,QAAQ,CAAC;IACjB,OAAO,CAAC,KAAK,CAAC;IAZlB;;;;;;;OAOG;gBAES,eAAe,EAAE,cAAc,EAC/B,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,YAAA,EACjB,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,YAAA;IAG3C;;;;;;OAMG;IACG,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,SAAe;;;;;;;IAuDtE;;;;;OAKG;IACG,qBAAqB,CAAC,WAAW,EAAE,MAAM;;;;;;;IA0D/C;;;;;;;OAOG;IACG,kBAAkB,CACpB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,EACrB,UAAU,SAAe;;;;;;;IAiEvB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;;;;;;;CA4DnD"}
+{"version":3,"file":"firebase-auth.d.ts","sourceRoot":"","sources":["../../src/auth/firebase-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EACjC,KAAK,gBAAgB,EACxB,MAAM,0BAA0B,CAAC;AAclC,OAAO,EAEH,KAAK,mBAAmB,EAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAe,MAAM,aAAa,CAAC;AAI7D,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACnC;AAED;;;GAGG;AACH,qBAAa,YAAY;IAsKjB,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,UAAU;IAtKtB,OAAO,CAAC,QAAQ,CAAC,CAAS;IAC1B,OAAO,CAAC,KAAK,CAAC,CAA0B;IAElC,sBAAsB,CACxB,KAAK,EAAE,MAAM,EACb,WAAW,SAAkB,EAC7B,MAAM,CAAC,EAAE,MAAM;;;;;;;;;IAeb,uBAAuB,CACzB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAkB,EAC7B,MAAM,CAAC,EAAE,MAAM;;;;;;;;;IAeb,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;;;;;;;;;IAczD,eAAe,CAAC,OAAO,EAAE,MAAM;;;;;;;;;;IAarC,+CAA+C;IACzC,qBAAqB,CACvB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM;;;;;;;;;IAenB,uEAAuE;IACjE,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;;;;;;;IAkCxD,2FAA2F;IACrF,2BAA2B,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,4BAA4B;;;;;;;IAgB1C,mFAAmF;IAC7E,0BAA0B,CAC5B,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,CAAC,EAAE,MAAM;;;;;;;IAcpB;;;;;;OAMG;gBAES,eAAe,EAAE,cAAc,EAC/B,UAAU,EAAE,MAAM,EAC1B,OAAO,GAAE,mBAAwB;IAYrC;;;;;;OAMG;IACG,kBAAkB,CACpB,UAAU,EAAE,MAAM,GAAG,kBAAkB,EACvC,UAAU,SAAe;;;;;;;IAwD7B;;;;;OAKG;IACG,qBAAqB,CAAC,WAAW,EAAE,MAAM;;;;;;;IA6D/C;;;;;;;OAOG;IACG,kBAAkB,CACpB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GAAG,kBAAkB,EAC1C,UAAU,SAAe;;;;;;;IAiEvB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;;;;;;;CA4DnD"}

package/dist/auth/firebase-auth.js

@@ -1,6 +1,9 @@
-import { signInWithCustomToken, signInWithIdp, linkWithOAuthCredential, unlinkProvider } from './firebase-auth-endpoints.js';
+import {} from './provider-credential.js';
+import { createAuthEmulatorFetch, createAuthUri, signInWithCustomToken, signInWithIdp, executeProviderSignIn, linkWithOAuthCredential, unlinkProvider, sendOobCode, confirmPasswordReset as resetPassword, applyActionCode as applyEmailCode, signInWithEmailLink as completeEmailLink } from './firebase-auth-endpoints.js';
+import { resolveAuthEmulatorHost } from './auth-emulator.js';
 import { FirebaseEdgeError, ensureError } from './errors.js';
 import { FirebaseAuthErrorInfo } from './auth-error-codes.js';
+import { buildEmailActionRequest } from './email-action-request.js';
 /**
  * Firebase Client Authentication handler for edge environments.
  * Provides client-side authentication operations using Firebase API.
@@ -10,19 +13,107 @@ export class FirebaseAuth {
     requestUri;
     tenantId;
     fetch;
+    async sendPasswordResetEmail(email, continueUrl = this.requestUri, locale) {
+        try {
+            return await sendOobCode('PASSWORD_RESET', this.firebase_config.apiKey, { email, continueUrl, locale }, this.tenantId, this.fetch);
+        }
+        catch (cause) {
+            return { data: null, error: ensureError(cause) };
+        }
+    }
+    async verifyBeforeUpdateEmail(idToken, newEmail, continueUrl = this.requestUri, locale) {
+        try {
+            return await sendOobCode('VERIFY_AND_CHANGE_EMAIL', this.firebase_config.apiKey, { idToken, newEmail, continueUrl, locale }, this.tenantId, this.fetch);
+        }
+        catch (cause) {
+            return { data: null, error: ensureError(cause) };
+        }
+    }
+    async confirmPasswordReset(oobCode, newPassword) {
+        try {
+            return await resetPassword(oobCode, newPassword, this.firebase_config.apiKey, this.tenantId, this.fetch);
+        }
+        catch (cause) {
+            return { data: null, error: ensureError(cause) };
+        }
+    }
+    async applyActionCode(oobCode) {
+        try {
+            return await applyEmailCode(oobCode, this.firebase_config.apiKey, this.tenantId, this.fetch);
+        }
+        catch (cause) {
+            return { data: null, error: ensureError(cause) };
+        }
+    }
+    /** Ask Firebase to deliver a sign-in email. */
+    async sendSignInLinkToEmail(email, continueUrl, locale) {
+        try {
+            return await sendOobCode('EMAIL_SIGNIN', this.firebase_config.apiKey, { email, continueUrl, locale }, this.tenantId, this.fetch);
+        }
+        catch (cause) {
+            return { data: null, error: ensureError(cause) };
+        }
+    }
+    /** Exchange the email and one-time action code for Firebase tokens. */
+    async signInWithEmailLink(email, oobCode) {
+        const { error: validationError } = buildEmailActionRequest('EMAIL_SIGNIN', email, {
+            url: this.requestUri,
+            handleCodeInApp: true
+        });
+        if (validationError) {
+            return { data: null, error: validationError };
+        }
+        if (typeof oobCode !== 'string' || !oobCode.trim()) {
+            return {
+                data: null,
+                error: new FirebaseEdgeError({
+                    code: 'auth/invalid-action-code',
+                    message: 'An email sign-in code is required.'
+                })
+            };
+        }
+        try {
+            return await completeEmailLink(oobCode, email, this.firebase_config.apiKey, undefined, this.tenantId, this.fetch);
+        }
+        catch (cause) {
+            return { data: null, error: ensureError(cause) };
+        }
+    }
+    /** Begin a Firebase-managed provider flow. Persist sessionId securely for the callback. */
+    async createProviderAuthorization(providerId, options) {
+        try {
+            return await createAuthUri(this.requestUri, this.firebase_config.apiKey, this.tenantId, this.fetch, providerId, options);
+        }
+        catch (cause) {
+            return { data: null, error: ensureError(cause) };
+        }
+    }
+    /** Complete a provider callback; idToken links to an existing Firebase account. */
+    async signInWithProviderCallback(callback, idToken) {
+        try {
+            return await executeProviderSignIn({ callback, idToken }, this.firebase_config.apiKey, this.tenantId, this.fetch);
+        }
+        catch (cause) {
+            return { data: null, error: ensureError(cause) };
+        }
+    }
     /**
      * Creates a new Firebase Auth instance.
      *
      * @param firebase_config Firebase client configuration
      * @param requestUri OAuth callback URI
-     * @param tenantId Optional tenant ID for multi-tenancy
-     * @param fetch Optional custom fetch implementation
+     * @param options Optional constructor settings, including Auth emulator configuration.
      */
-    constructor(firebase_config, requestUri, tenantId, fetch) {
+    constructor(firebase_config, requestUri, options = {}) {
         this.firebase_config = firebase_config;
         this.requestUri = requestUri;
+        const { tenantId, fetch } = options;
         this.tenantId = tenantId;
         this.fetch = fetch;
+        const emulatorHost = resolveAuthEmulatorHost(options.emulatorHost);
+        if (emulatorHost) {
+            this.fetch = createAuthEmulatorFetch(emulatorHost, this.fetch);
+        }
     }
     /**
      * Signs in a user with an OAuth provider token.
@@ -73,6 +164,12 @@ export class FirebaseAuth {
      * @returns Promise with object containing sign-in data (idToken, refreshToken, expiresIn) or null, and error if any
      */
     async signInWithCustomToken(customToken) {
+        if (typeof customToken !== 'string' || !customToken.trim()) {
+            return {
+                error: new FirebaseEdgeError(FirebaseAuthErrorInfo.AUTH_INVALID_CUSTOM_TOKEN),
+                data: null
+            };
+        }
         try {
             const { data: signInData, error: signInError } = await signInWithCustomToken(customToken, this.firebase_config.apiKey, this.tenantId, this.fetch);
             if (signInError) {
@@ -80,9 +177,7 @@ export class FirebaseAuth {
                     data: null,
                     error: new FirebaseEdgeError(FirebaseAuthErrorInfo.AUTH_INVALID_CUSTOM_TOKEN, {
                         cause: ensureError(signInError),
-                        context: {
-                            customToken: customToken.substring(0, 20) + '...'
-                        }
+                        context: { operation: 'signInWithCustomToken' }
                     })
                 };
             }
@@ -104,9 +199,7 @@ export class FirebaseAuth {
                 data: null,
                 error: new FirebaseEdgeError(FirebaseAuthErrorInfo.AUTH_CUSTOM_TOKEN_SIGN_FAILED, {
                     cause: ensureError(err),
-                    context: {
-                        customToken: customToken.substring(0, 20) + '...'
-                    }
+                    context: { operation: 'signInWithCustomToken' }
                 })
             };
         }

package/dist/auth/firebase-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"firebase-auth.js","sourceRoot":"","sources":["../../src/auth/firebase-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACvB,cAAc,EACjB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D;;;GAGG;AACH,MAAM,OAAO,YAAY;IAUT;IACA;IACA;IACA;IAZZ;;;;;;;OAOG;IACH,YACY,eAA+B,EAC/B,UAAkB,EAClB,QAAiB,EACjB,KAA+B;QAH/B,oBAAe,GAAf,eAAe,CAAgB;QAC/B,eAAU,GAAV,UAAU,CAAQ;QAClB,aAAQ,GAAR,QAAQ,CAAS;QACjB,UAAK,GAAL,KAAK,CAA0B;IACxC,CAAC;IAEJ;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CAAC,UAAkB,EAAE,UAAU,GAAG,YAAY;QAClE,IAAI,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,GAC1C,MAAM,aAAa,CACf,UAAU,EACV,IAAI,CAAC,UAAU,EACf,UAAU,EACV,IAAI,CAAC,eAAe,CAAC,MAAM,EAC3B,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CACb,CAAC;YAEN,IAAI,WAAW,EAAE,CAAC;gBACd,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,4BAA4B,EAClD;wBACI,KAAK,EAAE,WAAW,CAAC,WAAW,CAAC;wBAC/B,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;qBACvD,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,IAAI,CAAC,UAAU,EAAE,CAAC;gBACd,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,0BAA0B,EAChD;wBACI,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;qBACvD,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,OAAO;gBACH,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,IAAI;aACd,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,4BAA4B,EAClD;oBACI,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC;oBACvB,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;iBACvD,CACJ;aACJ,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,qBAAqB,CAAC,WAAmB;QAC3C,IAAI,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,GAC1C,MAAM,qBAAqB,CACvB,WAAW,EACX,IAAI,CAAC,eAAe,CAAC,MAAM,EAC3B,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CACb,CAAC;YAEN,IAAI,WAAW,EAAE,CAAC;gBACd,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,yBAAyB,EAC/C;wBACI,KAAK,EAAE,WAAW,CAAC,WAAW,CAAC;wBAC/B,OAAO,EAAE;4BACL,WAAW,EACP,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;yBAC3C;qBACJ,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,IAAI,CAAC,UAAU,EAAE,CAAC;gBACd,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,0BAA0B,EAChD;wBACI,OAAO,EAAE,EAAE,SAAS,EAAE,uBAAuB,EAAE;qBAClD,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,OAAO;gBACH,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,IAAI;aACd,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,6BAA6B,EACnD;oBACI,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC;oBACvB,OAAO,EAAE;wBACL,WAAW,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;qBACpD;iBACJ,CACJ;aACJ,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CACpB,OAAe,EACf,aAAqB,EACrB,UAAU,GAAG,YAAY;QAEzB,IAAI,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,GACtC,MAAM,uBAAuB,CACzB,OAAO,EACP,aAAa,EACb,IAAI,CAAC,UAAU,EACf,UAAU,EACV,IAAI,CAAC,eAAe,CAAC,MAAM,EAC3B,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CACb,CAAC;YAEN,IAAI,SAAS,EAAE,CAAC;gBACZ,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,yBAAyB,EAC/C;wBACI,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC;wBAC7B,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;qBACvD,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,0BAA0B,EAChD;wBACI,OAAO,EAAE;4BACL,UAAU;4BACV,UAAU,EAAE,IAAI,CAAC,UAAU;4BAC3B,SAAS,EAAE,oBAAoB;yBAClC;qBACJ,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,OAAO;gBACH,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,IAAI;aACd,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,yBAAyB,EAC/C;oBACI,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC;oBACvB,OAAO,EAAE;wBACL,UAAU;wBACV,UAAU,EAAE,IAAI,CAAC,UAAU;wBAC3B,SAAS,EAAE,oBAAoB;qBAClC;iBACJ,CACJ;aACJ,CAAC;QACN,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,UAAkB;QAC5C,IAAI,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,GAC1C,MAAM,cAAc,CAChB,OAAO,EACP,UAAU,EACV,IAAI,CAAC,eAAe,CAAC,MAAM,EAC3B,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CACb,CAAC;YAEN,IAAI,WAAW,EAAE,CAAC;gBACd,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,2BAA2B,EACjD;wBACI,KAAK,EAAE,WAAW,CAAC,WAAW,CAAC;wBAC/B,OAAO,EAAE,EAAE,UAAU,EAAE;qBAC1B,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,IAAI,CAAC,UAAU,EAAE,CAAC;gBACd,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,0BAA0B,EAChD;wBACI,OAAO,EAAE;4BACL,UAAU;4BACV,SAAS,EAAE,QAAQ;yBACtB;qBACJ,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,OAAO;gBACH,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,IAAI;aACd,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,2BAA2B,EACjD;oBACI,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC;oBACvB,OAAO,EAAE;wBACL,UAAU;wBACV,UAAU,EAAE,IAAI,CAAC,UAAU;wBAC3B,SAAS,EAAE,QAAQ;qBACtB;iBACJ,CACJ;aACJ,CAAC;QACN,CAAC;IACL,CAAC;CACJ"}
+{"version":3,"file":"firebase-auth.js","sourceRoot":"","sources":["../../src/auth/firebase-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACH,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,aAAa,EACb,qBAAqB,EACrB,uBAAuB,EACvB,cAAc,EACd,WAAW,EACX,oBAAoB,IAAI,aAAa,EACrC,eAAe,IAAI,cAAc,EACjC,mBAAmB,IAAI,iBAAiB,EAC3C,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,uBAAuB,EAE1B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAOpE;;;GAGG;AACH,MAAM,OAAO,YAAY;IAsKT;IACA;IAtKJ,QAAQ,CAAU;IAClB,KAAK,CAA2B;IAExC,KAAK,CAAC,sBAAsB,CACxB,KAAa,EACb,WAAW,GAAG,IAAI,CAAC,UAAU,EAC7B,MAAe;QAEf,IAAI,CAAC;YACD,OAAO,MAAM,WAAW,CACpB,gBAAgB,EAChB,IAAI,CAAC,eAAe,CAAC,MAAM,EAC3B,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAC9B,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CACb,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,CAAC;IACL,CAAC;IAED,KAAK,CAAC,uBAAuB,CACzB,OAAe,EACf,QAAgB,EAChB,WAAW,GAAG,IAAI,CAAC,UAAU,EAC7B,MAAe;QAEf,IAAI,CAAC;YACD,OAAO,MAAM,WAAW,CACpB,yBAAyB,EACzB,IAAI,CAAC,eAAe,CAAC,MAAM,EAC3B,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,EAC1C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CACb,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,CAAC;IACL,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,OAAe,EAAE,WAAmB;QAC3D,IAAI,CAAC;YACD,OAAO,MAAM,aAAa,CACtB,OAAO,EACP,WAAW,EACX,IAAI,CAAC,eAAe,CAAC,MAAM,EAC3B,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CACb,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAe;QACjC,IAAI,CAAC;YACD,OAAO,MAAM,cAAc,CACvB,OAAO,EACP,IAAI,CAAC,eAAe,CAAC,MAAM,EAC3B,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CACb,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,CAAC;IACL,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,qBAAqB,CACvB,KAAa,EACb,WAAmB,EACnB,MAAe;QAEf,IAAI,CAAC;YACD,OAAO,MAAM,WAAW,CACpB,cAAc,EACd,IAAI,CAAC,eAAe,CAAC,MAAM,EAC3B,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAC9B,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CACb,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,mBAAmB,CAAC,KAAa,EAAE,OAAe;QACpD,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,uBAAuB,CACtD,cAAc,EACd,KAAK,EACL;YACI,GAAG,EAAE,IAAI,CAAC,UAAU;YACpB,eAAe,EAAE,IAAI;SACxB,CACJ,CAAC;QACF,IAAI,eAAe,EAAE,CAAC;YAClB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QAClD,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YACjD,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CAAC;oBACzB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,oCAAoC;iBAChD,CAAC;aACL,CAAC;QACN,CAAC;QACD,IAAI,CAAC;YACD,OAAO,MAAM,iBAAiB,CAC1B,OAAO,EACP,KAAK,EACL,IAAI,CAAC,eAAe,CAAC,MAAM,EAC3B,SAAS,EACT,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CACb,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,CAAC;IACL,CAAC;IACD,2FAA2F;IAC3F,KAAK,CAAC,2BAA2B,CAC7B,UAAkB,EAClB,OAAsC;QAEtC,IAAI,CAAC;YACD,OAAO,MAAM,aAAa,CACtB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,eAAe,CAAC,MAAM,EAC3B,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,EACV,UAAU,EACV,OAAO,CACV,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,CAAC;IACL,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,0BAA0B,CAC5B,QAA0B,EAC1B,OAAgB;QAEhB,IAAI,CAAC;YACD,OAAO,MAAM,qBAAqB,CAC9B,EAAE,QAAQ,EAAE,OAAO,EAAE,EACrB,IAAI,CAAC,eAAe,CAAC,MAAM,EAC3B,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CACb,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,YACY,eAA+B,EAC/B,UAAkB,EAC1B,UAA+B,EAAE;QAFzB,oBAAe,GAAf,eAAe,CAAgB;QAC/B,eAAU,GAAV,UAAU,CAAQ;QAG1B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAEnB,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,YAAY,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,GAAG,uBAAuB,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CACpB,UAAuC,EACvC,UAAU,GAAG,YAAY;QAEzB,IAAI,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,GAC1C,MAAM,aAAa,CACf,UAAU,EACV,IAAI,CAAC,UAAU,EACf,UAAU,EACV,IAAI,CAAC,eAAe,CAAC,MAAM,EAC3B,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CACb,CAAC;YAEN,IAAI,WAAW,EAAE,CAAC;gBACd,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,4BAA4B,EAClD;wBACI,KAAK,EAAE,WAAW,CAAC,WAAW,CAAC;wBAC/B,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;qBACvD,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,IAAI,CAAC,UAAU,EAAE,CAAC;gBACd,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,0BAA0B,EAChD;wBACI,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;qBACvD,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,OAAO;gBACH,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,IAAI;aACd,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,4BAA4B,EAClD;oBACI,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC;oBACvB,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;iBACvD,CACJ;aACJ,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,qBAAqB,CAAC,WAAmB;QAC3C,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;YACzD,OAAO;gBACH,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,yBAAyB,CAClD;gBACD,IAAI,EAAE,IAAI;aACb,CAAC;QACN,CAAC;QACD,IAAI,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,GAC1C,MAAM,qBAAqB,CACvB,WAAW,EACX,IAAI,CAAC,eAAe,CAAC,MAAM,EAC3B,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CACb,CAAC;YAEN,IAAI,WAAW,EAAE,CAAC;gBACd,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,yBAAyB,EAC/C;wBACI,KAAK,EAAE,WAAW,CAAC,WAAW,CAAC;wBAC/B,OAAO,EAAE,EAAE,SAAS,EAAE,uBAAuB,EAAE;qBAClD,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,IAAI,CAAC,UAAU,EAAE,CAAC;gBACd,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,0BAA0B,EAChD;wBACI,OAAO,EAAE,EAAE,SAAS,EAAE,uBAAuB,EAAE;qBAClD,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,OAAO;gBACH,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,IAAI;aACd,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,6BAA6B,EACnD;oBACI,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC;oBACvB,OAAO,EAAE,EAAE,SAAS,EAAE,uBAAuB,EAAE;iBAClD,CACJ;aACJ,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CACpB,OAAe,EACf,aAA0C,EAC1C,UAAU,GAAG,YAAY;QAEzB,IAAI,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,GACtC,MAAM,uBAAuB,CACzB,OAAO,EACP,aAAa,EACb,IAAI,CAAC,UAAU,EACf,UAAU,EACV,IAAI,CAAC,eAAe,CAAC,MAAM,EAC3B,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CACb,CAAC;YAEN,IAAI,SAAS,EAAE,CAAC;gBACZ,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,yBAAyB,EAC/C;wBACI,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC;wBAC7B,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;qBACvD,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,0BAA0B,EAChD;wBACI,OAAO,EAAE;4BACL,UAAU;4BACV,UAAU,EAAE,IAAI,CAAC,UAAU;4BAC3B,SAAS,EAAE,oBAAoB;yBAClC;qBACJ,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,OAAO;gBACH,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,IAAI;aACd,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,yBAAyB,EAC/C;oBACI,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC;oBACvB,OAAO,EAAE;wBACL,UAAU;wBACV,UAAU,EAAE,IAAI,CAAC,UAAU;wBAC3B,SAAS,EAAE,oBAAoB;qBAClC;iBACJ,CACJ;aACJ,CAAC;QACN,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,UAAkB;QAC5C,IAAI,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,GAC1C,MAAM,cAAc,CAChB,OAAO,EACP,UAAU,EACV,IAAI,CAAC,eAAe,CAAC,MAAM,EAC3B,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CACb,CAAC;YAEN,IAAI,WAAW,EAAE,CAAC;gBACd,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,2BAA2B,EACjD;wBACI,KAAK,EAAE,WAAW,CAAC,WAAW,CAAC;wBAC/B,OAAO,EAAE,EAAE,UAAU,EAAE;qBAC1B,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,IAAI,CAAC,UAAU,EAAE,CAAC;gBACd,OAAO;oBACH,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,0BAA0B,EAChD;wBACI,OAAO,EAAE;4BACL,UAAU;4BACV,SAAS,EAAE,QAAQ;yBACtB;qBACJ,CACJ;iBACJ,CAAC;YACN,CAAC;YAED,OAAO;gBACH,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,IAAI;aACd,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI,iBAAiB,CACxB,qBAAqB,CAAC,2BAA2B,EACjD;oBACI,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC;oBACvB,OAAO,EAAE;wBACL,UAAU;wBACV,UAAU,EAAE,IAAI,CAAC,UAAU;wBAC3B,SAAS,EAAE,QAAQ;qBACtB;iBACJ,CACJ;aACJ,CAAC;QACN,CAAC;IACL,CAAC;CACJ"}

package/dist/auth/firebase-jwt.d.ts

@@ -1,5 +1,14 @@
 import type { FirebaseIdTokenPayload, ServiceAccount } from './firebase-types.js';
 import { FirebaseEdgeError } from './errors.js';
+import type { DecodedAuthBlockingToken } from './auth-blocking-types.js';
+/** @internal Verify the JWT supplied in a blocking function request's data.jwt field. */
+export declare function verifyAuthBlockingJWT(token: string, projectId: string, audience?: string, fetchFn?: typeof globalThis.fetch, emulator?: boolean): Promise<{
+    data: DecodedAuthBlockingToken;
+    error: null;
+} | {
+    data: null;
+    error: FirebaseEdgeError;
+}>;
 type SignJwtResult = {
     data: string;
     error: null;
@@ -7,22 +16,22 @@ type SignJwtResult = {
     data: null;
     error: FirebaseEdgeError;
 };
-export declare function verifySessionJWT(sessionCookie: string, projectId: string, fetchFn?: typeof globalThis.fetch): Promise<{
+export declare function verifySessionJWT(sessionCookie: string, projectId: string, fetchFn?: typeof globalThis.fetch, emulator?: boolean): Promise<{
+    data: FirebaseIdTokenPayload;
+    error: null;
+} | {
     data: null;
     error: FirebaseEdgeError;
-} | {
-    error: null;
-    data: FirebaseIdTokenPayload;
 }>;
-export declare function verifyJWT(idToken: string, projectId: string, fetchFn?: typeof globalThis.fetch): Promise<{
-    error: FirebaseEdgeError;
-    data: null;
-} | {
-    error: null;
+export declare function verifyJWT(idToken: string, projectId: string, fetchFn?: typeof globalThis.fetch, emulator?: boolean): Promise<{
     data: FirebaseIdTokenPayload;
+    error: null;
+} | {
+    data: null;
+    error: FirebaseEdgeError;
 }>;
 export declare function signJWT(serviceAccount: ServiceAccount): Promise<SignJwtResult>;
-export declare function signJWTCustomToken(uid: string, serviceAccount: ServiceAccount, additionalClaims?: object): Promise<{
+export declare function signJWTCustomToken(uid: string, serviceAccount: ServiceAccount, additionalClaims?: object, tenantId?: string, emulator?: boolean): Promise<{
     data: null;
     error: FirebaseEdgeError;
 } | {

package/dist/auth/firebase-jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firebase-jwt.d.ts","sourceRoot":"","sources":["../../src/auth/firebase-jwt.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EACR,sBAAsB,EACtB,cAAc,EACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAe,MAAM,aAAa,CAAC;AAoC7D,KAAK,aAAa,GACZ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,IAAI,CAAA;CAAE,GAC7B;IACI,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,iBAAiB,CAAC;CAC5B,CAAC;AAER,wBAAsB,gBAAgB,CAClC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,OAAO,UAAU,CAAC,KAAwB;;;;;UAwD1B,sBAAsB;GAsDlD;AAED,wBAAsB,SAAS,CAC3B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK;;;;;UAiDR,sBAAsB;GAsDlD;AAED,wBAAsB,OAAO,CACzB,cAAc,EAAE,cAAc,GAC/B,OAAO,CAAC,aAAa,CAAC,CAqExB;AAsBD,wBAAsB,kBAAkB,CACpC,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,cAAc,EAC9B,gBAAgB,GAAE,MAAW;;;;;;GAqEhC"}
+{"version":3,"file":"firebase-jwt.d.ts","sourceRoot":"","sources":["../../src/auth/firebase-jwt.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACR,sBAAsB,EACtB,cAAc,EACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAe,MAAM,aAAa,CAAC;AAG7D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AA6BzE,yFAAyF;AACzF,wBAAsB,qBAAqB,CACvC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,EACjC,QAAQ,UAAQ,GACjB,OAAO,CACJ;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,KAAK,EAAE,IAAI,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,CAC7C,CAkFA;AAmCD,KAAK,aAAa,GACZ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,IAAI,CAAA;CAAE,GAC7B;IACI,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,iBAAiB,CAAC;CAC5B,CAAC;AAkFR,wBAAsB,gBAAgB,CAClC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,OAAO,UAAU,CAAC,KAAwB,EACnD,QAAQ,UAAQ;;;;;;GAoHnB;AAED,wBAAsB,SAAS,CAC3B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,EACjC,QAAQ,UAAQ;;;;;;GA2EnB;AAED,wBAAsB,OAAO,CACzB,cAAc,EAAE,cAAc,GAC/B,OAAO,CAAC,aAAa,CAAC,CAqExB;AAsBD,wBAAsB,kBAAkB,CACpC,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,cAAc,EAC9B,gBAAgB,GAAE,MAAW,EAC7B,QAAQ,CAAC,EAAE,MAAM,EACjB,QAAQ,UAAQ;;;;;;GAmGnB"}

package/dist/auth/firebase-jwt.js

@@ -1,14 +1,103 @@
-import { decodeProtectedHeader, errors, jwtVerify, importPKCS8, SignJWT, importX509, importSPKI } from 'jose';
+import { decodeProtectedHeader, errors, jwtVerify, importPKCS8, SignJWT, UnsecuredJWT, importX509, importSPKI } from 'jose';
 import { JOSEError, JWSInvalid, JWSSignatureVerificationFailed, JWTClaimValidationFailed, JWTExpired, JWTInvalid } from 'jose/errors';
 import { getJWKs, getPublicKeys } from './firebase-auth-endpoints.js';
 import { FirebaseEdgeError, ensureError } from './errors.js';
 import { JWTErrorInfo } from './auth-error-codes.js';
+import { validateUserUid } from './user-request.js';
+/** Shared Secure Token signature verification for ID and blocking-event JWTs. */
+async function verifySecureTokenJWT(token, options, fetchFn) {
+    const { kid, alg } = decodeProtectedHeader(token);
+    if (typeof kid !== 'string' || !kid)
+        throw new FirebaseEdgeError(JWTErrorInfo.JWT_NO_KID_FOUND);
+    if (alg !== 'RS256')
+        throw new FirebaseEdgeError(JWTErrorInfo.JWT_INVALID_ALGORITHM);
+    const { data, error } = await getJWKs(fetchFn);
+    if (error)
+        throw error;
+    if (!data?.length)
+        throw new FirebaseEdgeError(JWTErrorInfo.JWT_NO_JWKS_RETRIEVED);
+    const jwk = data.find((key) => key.kid === kid);
+    if (!jwk)
+        throw new FirebaseEdgeError(JWTErrorInfo.JWT_NO_MATCHING_KEY, {
+            context: { kid }
+        });
+    const { payload } = await jwtVerify(token, jwk, {
+        ...options,
+        algorithms: ['RS256']
+    });
+    return payload;
+}
+/** @internal Verify the JWT supplied in a blocking function request's data.jwt field. */
+export async function verifyAuthBlockingJWT(token, projectId, audience, fetchFn, emulator = false) {
+    try {
+        if (typeof token !== 'string' ||
+            !token.length ||
+            typeof projectId !== 'string' ||
+            !projectId.length ||
+            (audience !== undefined &&
+                (typeof audience !== 'string' || !audience.trim().length)))
+            throw new FirebaseEdgeError({
+                code: 'auth/invalid-argument',
+                message: 'A token, project ID, and non-empty audience (when supplied) are required.'
+            });
+        const options = {
+            issuer: `https://securetoken.google.com/${projectId}`,
+            requiredClaims: ['iat', 'exp']
+        };
+        const payload = emulator
+            ? UnsecuredJWT.decode(token, options).payload
+            : await verifySecureTokenJWT(token, options, fetchFn);
+        const expectedAudience = audience ?? `${projectId}.cloudfunctions.net/`;
+        if (typeof payload.aud !== 'string' ||
+            !payload.aud.includes(expectedAudience))
+            throw new JWTClaimValidationFailed('Invalid blocking token audience.', payload);
+        if (typeof payload.iat !== 'number' ||
+            !Number.isFinite(payload.iat) ||
+            payload.iat > Math.floor(Date.now() / 1000) ||
+            typeof payload.event_type !== 'string' ||
+            !payload.event_type.length ||
+            typeof payload.event_id !== 'string' ||
+            !payload.event_id.length)
+            throw new JWTClaimValidationFailed('Invalid blocking event claims.', payload);
+        const noUserEvent = payload.event_type === 'beforeSendEmail' ||
+            payload.event_type === 'beforeSendSms';
+        if (!noUserEvent &&
+            (typeof payload.sub !== 'string' ||
+                !payload.sub.length ||
+                payload.sub.length > 128))
+            throw new JWTClaimValidationFailed('Invalid blocking token subject.', payload);
+        return {
+            data: { ...payload, uid: payload.sub },
+            error: null
+        };
+    }
+    catch (cause) {
+        if (cause instanceof FirebaseEdgeError)
+            return { data: null, error: cause };
+        const info = cause instanceof JWTExpired
+            ? {
+                code: 'auth/auth-blocking-token-expired',
+                message: 'The Auth blocking token has expired.'
+            }
+            : cause instanceof JWTClaimValidationFailed
+                ? JWTErrorInfo.JWT_CLAIM_VALIDATION_FAILED
+                : cause instanceof JWTInvalid ||
+                    cause instanceof JWSInvalid ||
+                    cause instanceof JWSSignatureVerificationFailed
+                    ? JWTErrorInfo.JWT_INVALID_TOKEN
+                    : JWTErrorInfo.JWT_UNKNOWN_VERIFICATION_ERROR;
+        return {
+            data: null,
+            error: new FirebaseEdgeError(info, { cause: ensureError(cause) })
+        };
+    }
+}
 const ALGORITHM_RS256 = 'RS256';
 const OAUTH_TOKEN_URL = 'https://oauth2.googleapis.com/token';
 const SCOPES = [
+    'https://www.googleapis.com/auth/cloud-platform',
     'https://www.googleapis.com/auth/datastore',
     'https://www.googleapis.com/auth/identitytoolkit',
-    'https://www.googleapis.com/auth/devstorage.read_write',
     'https://www.googleapis.com/auth/devstorage.read_write'
 ];
 const keyMap = new Map();
@@ -27,8 +116,51 @@ async function getPublicCryptoKey(publicKey) {
     keyMap.set(publicKey, key);
     return key;
 }
-export async function verifySessionJWT(sessionCookie, projectId, fetchFn = globalThis.fetch) {
+/** Decode only emulator-format JWTs, retaining claim checks while skipping signature verification. */
+function verifyEmulatorJWT(token, projectId, kind) {
+    const issuer = kind === 'id'
+        ? `https://securetoken.google.com/${projectId}`
+        : `https://session.firebase.google.com/${projectId}`;
+    const { payload } = UnsecuredJWT.decode(token, {
+        issuer,
+        audience: projectId,
+        requiredClaims: ['sub', 'iat', 'exp', 'auth_time']
+    });
+    return validateFirebaseTokenPayload(payload, projectId);
+}
+// Allow a small difference between Firebase's clock and the verifying server.
+const FUTURE_CLAIM_TOLERANCE_SECONDS = 5;
+/** Validate user-token claims in both production and emulator modes. */
+function validateFirebaseTokenPayload(payload, projectId) {
+    const now = Math.floor(Date.now() / 1000);
+    if (typeof payload.exp !== 'number' ||
+        !Number.isFinite(payload.exp) ||
+        payload.exp <= now)
+        throw new JWTClaimValidationFailed('Firebase token expiration must be in the future.', payload, 'exp', 'check_failed');
+    if (payload.aud !== projectId)
+        throw new JWTClaimValidationFailed('Firebase token audience must match the project ID.', payload, 'aud', 'check_failed');
+    if (typeof payload.sub !== 'string' ||
+        !payload.sub.length ||
+        payload.sub.length > 128)
+        throw new JWTClaimValidationFailed('Firebase token subject must contain between 1 and 128 characters.', payload, 'sub', 'check_failed');
+    for (const claim of ['iat', 'auth_time']) {
+        const value = payload[claim];
+        if (typeof value !== 'number' ||
+            !Number.isFinite(value) ||
+            (claim === 'auth_time' && value < 0))
+            throw new JWTClaimValidationFailed(`Invalid Firebase token ${claim} timestamp.`, payload, claim, 'check_failed');
+        if (value > now + FUTURE_CLAIM_TOLERANCE_SECONDS)
+            throw new JWTClaimValidationFailed(`Firebase token ${claim} is ${value - now} seconds ahead of the server clock (maximum ${FUTURE_CLAIM_TOLERANCE_SECONDS}). Check the server clock synchronization.`, payload, claim, 'check_failed');
+    }
+    return { ...payload, uid: payload.sub };
+}
+export async function verifySessionJWT(sessionCookie, projectId, fetchFn = globalThis.fetch, emulator = false) {
     try {
+        if (emulator)
+            return {
+                data: verifyEmulatorJWT(sessionCookie, projectId, 'session'),
+                error: null
+            };
         const { data: keyData, error } = await getPublicKeys(fetchFn);
         if (error) {
             return {
@@ -66,11 +198,12 @@ export async function verifySessionJWT(sessionCookie, projectId, fetchFn = globa
         const { payload } = await jwtVerify(sessionCookie, publicKey, {
             issuer: expectedIssuer,
             audience: expectedAudience,
-            algorithms: [ALGORITHM_RS256]
+            algorithms: [ALGORITHM_RS256],
+            requiredClaims: ['sub', 'iat', 'exp', 'auth_time']
         });
         return {
             error: null,
-            data: payload
+            data: validateFirebaseTokenPayload(payload, projectId)
         };
     }
     catch (err) {
@@ -111,48 +244,26 @@ export async function verifySessionJWT(sessionCookie, projectId, fetchFn = globa
         };
     }
 }
-export async function verifyJWT(idToken, projectId, fetchFn) {
+export async function verifyJWT(idToken, projectId, fetchFn, emulator = false) {
     try {
-        const { kid } = decodeProtectedHeader(idToken);
-        if (!kid) {
-            return {
-                error: new FirebaseEdgeError(JWTErrorInfo.JWT_NO_KID_FOUND),
-                data: null
-            };
-        }
-        const { data, error } = await getJWKs(fetchFn);
-        if (error) {
+        if (emulator)
             return {
-                error,
-                data: null
+                data: verifyEmulatorJWT(idToken, projectId, 'id'),
+                error: null
             };
-        }
-        if (!data || !data.length) {
-            return {
-                error: new FirebaseEdgeError(JWTErrorInfo.JWT_NO_JWKS_RETRIEVED),
-                data: null
-            };
-        }
-        const jwk = data.find((key) => key.kid === kid);
-        if (!jwk) {
-            return {
-                error: new FirebaseEdgeError(JWTErrorInfo.JWT_NO_MATCHING_KEY, {
-                    context: { kid }
-                }),
-                data: null
-            };
-        }
-        const { payload } = await jwtVerify(idToken, jwk, {
+        const payload = await verifySecureTokenJWT(idToken, {
             issuer: `https://securetoken.google.com/${projectId}`,
             audience: projectId,
-            algorithms: ['RS256']
-        });
+            requiredClaims: ['sub', 'iat', 'exp', 'auth_time']
+        }, fetchFn);
         return {
             error: null,
-            data: payload
+            data: validateFirebaseTokenPayload(payload, projectId)
         };
     }
     catch (err) {
+        if (err instanceof FirebaseEdgeError)
+            return { data: null, error: err };
         if (err instanceof JWTExpired) {
             return {
                 error: new FirebaseEdgeError(JWTErrorInfo.JWT_EXPIRED, {
@@ -266,7 +377,20 @@ const RESERVED_CLAIMS = [
     'firebase',
     'user_id'
 ];
-export async function signJWTCustomToken(uid, serviceAccount, additionalClaims = {}) {
+export async function signJWTCustomToken(uid, serviceAccount, additionalClaims = {}, tenantId, emulator = false) {
+    const uidError = validateUserUid(uid);
+    if (uidError)
+        return { data: null, error: uidError };
+    if (!additionalClaims ||
+        typeof additionalClaims !== 'object' ||
+        Array.isArray(additionalClaims))
+        return {
+            data: null,
+            error: new FirebaseEdgeError({
+                code: 'auth/invalid-argument',
+                message: 'Developer claims must be a non-null object.'
+            })
+        };
     const { private_key, client_email } = serviceAccount;
     if (Object.keys(additionalClaims).some((k) => RESERVED_CLAIMS.includes(k) || k.startsWith('firebase'))) {
         return {
@@ -280,12 +404,25 @@ export async function signJWTCustomToken(uid, serviceAccount, additionalClaims =
         };
     }
     const payload = { uid };
+    if (tenantId)
+        payload.tenant_id = tenantId;
     if (Object.keys(additionalClaims).length) {
         payload.claims = additionalClaims;
     }
     const url = 'https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit';
     try {
-        const key = await importPKCS8(private_key, 'RS256');
+        if (emulator) {
+            const issuer = client_email || 'firebase-auth-emulator@example.com';
+            const token = new UnsecuredJWT(payload)
+                .setIssuer(issuer)
+                .setSubject(issuer)
+                .setAudience(url)
+                .setIssuedAt()
+                .setExpirationTime('1h')
+                .encode();
+            return { data: token, error: null };
+        }
+        const key = await importPKCS8(private_key.replace(/\\n/g, '\n'), 'RS256');
         const token = await new SignJWT(payload)
             .setProtectedHeader({ alg: 'RS256', typ: 'JWT' })
             .setIssuer(client_email)