pyric-admin 0.1.0-alpha.11 → 0.1.0-alpha.12

package/README.md.orig

@@ -21,6 +21,7 @@ loads `firebase-admin` directly.
 | `pyric-admin/auth` | Admin Auth shape |
 | `pyric-admin/database` | Admin Realtime Database shape |
 | `pyric-admin/storage` | Admin Storage shape |
+| `pyric-admin/messaging` | Admin Cloud Messaging send plane |
 
 ## Explicit sandbox setup
 
@@ -46,3 +47,4 @@ without sandbox activation and therefore resolves Firebase Admin directly.
 - [Auth API](https://pyric.dev/docs/pyric-admin-auth-reference-api/)
 - [Realtime Database API](https://pyric.dev/docs/pyric-admin-database-reference-api/)
 - [Storage API](https://pyric.dev/docs/pyric-admin-storage-reference-api/)
+- [Messaging API](https://pyric.dev/docs/pyric-admin-messaging-reference-api/)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pyric-admin",
-  "version": "0.1.0-alpha.11",
+  "version": "0.1.0-alpha.12",
   "license": "Apache-2.0",
   "homepage": "https://pyric.dev",
   "repository": {
@@ -33,10 +33,15 @@
     "./storage": {
       "types": "./dist/storage/index.d.ts",
       "import": "./dist/storage/index.js"
+    },
+    "./messaging": {
+      "types": "./dist/messaging/index.d.ts",
+      "import": "./dist/messaging/index.js"
     }
   },
   "files": [
     "dist",
+    "src",
     "README.md",
     "LICENSE"
   ],
@@ -46,7 +51,7 @@
     "typecheck": "bun x tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "pyric": "^0.1.0-alpha.11"
+    "pyric": "^0.1.0-alpha.12"
   },
   "devDependencies": {
     "@types/bun": "latest",

package/src/app/index.ts

@@ -0,0 +1,235 @@
+/**
+ * `pyric-admin/app` — sandbox-only admin app registry.
+ *
+ * Production selection happens before this module loads: activated Node
+ * processes resolve `firebase-admin/app` here, while inactive applications
+ * continue resolving their own `firebase-admin/app` package unchanged.
+ */
+import {
+  REMOTE_SANDBOX_FACTORY,
+  type RemoteSandboxFactory,
+  type RemoteSandboxFactoryOptions,
+  type Sandbox,
+} from 'pyric/sandbox';
+import { assertAdminAppActive, markAdminAppDeleted } from './lifecycle.js';
+
+/** Brand carried by every sandbox admin app. */
+export const ADMIN_APP_TARGET = Symbol.for('pyric.admin.app.target');
+export type PyricAdminAppTarget = 'sandbox';
+
+/** firebase-admin's default app name. */
+export const DEFAULT_APP_NAME = '[DEFAULT]';
+
+export interface SandboxAdminApp {
+  readonly [ADMIN_APP_TARGET]: 'sandbox';
+  readonly sandbox: Sandbox;
+  readonly name: string;
+}
+
+export type PyricAdminApp = SandboxAdminApp;
+export type InitializeAdminAppConfig = { sandbox: Sandbox };
+
+/**
+ * Firebase Functions' ESM runtime statically imports this credential factory
+ * while linking its database provider. Pyric initializes the sandbox app
+ * before that provider executes, so the factory is not used by supported
+ * Functions flows. Keep the named export link-compatible, but fail clearly if
+ * application code asks the development sandbox for production credentials.
+ */
+export function applicationDefault(): never {
+  throw new Error(
+    'pyric-admin/app: applicationDefault() is unavailable in the sandbox. ' +
+      'Pyric development does not use production credentials.',
+  );
+}
+
+/** Local error with the observable firebase-admin app-error shape. */
+class FirebaseAppError extends Error {
+  readonly code: string;
+
+  constructor(code: string, message: string) {
+    super(message);
+    this.name = 'FirebaseAppError';
+    this.code = `app/${code}`;
+  }
+}
+
+// Node may evaluate this ESM-only mirror through distinct require(esm) and
+// import module records when the register hook rewrites both CJS and ESM
+// Firebase consumers. Firebase Admin's app registry is process-wide, so keep
+// the mirror registry behind Symbol.for as well: both module records must see
+// the same default app and sandbox handle.
+const APP_REGISTRY = Symbol.for('pyric.admin.app.registry');
+const AMBIENT_APPS = Symbol.for('pyric.admin.app.ambientApps');
+interface GlobalAppRegistry {
+  [APP_REGISTRY]?: Map<string, PyricAdminApp>;
+  [AMBIENT_APPS]?: WeakSet<PyricAdminApp>;
+}
+const globalRegistry = globalThis as GlobalAppRegistry;
+const appRegistry = globalRegistry[APP_REGISTRY] ??= new Map<string, PyricAdminApp>();
+const ambientApps = globalRegistry[AMBIENT_APPS] ??= new WeakSet<PyricAdminApp>();
+
+function validateAppName(name: unknown): asserts name is string {
+  if (typeof name !== 'string' || name === '') {
+    throw new FirebaseAppError(
+      'invalid-app-name',
+      `Invalid Firebase app name "${String(name)}" provided. App name must be a non-empty string.`,
+    );
+  }
+}
+
+function alreadyExists(name: string, code: 'duplicate-app' | 'invalid-app-options'): FirebaseAppError {
+  return new FirebaseAppError(
+    code,
+    `A Firebase app named "${name}" already exists with a different configuration.`,
+  );
+}
+
+/**
+ * Initialize a sandbox admin app.
+ *
+ * An explicit `{ sandbox }` config binds an in-process or remote sandbox.
+ * A bare call resolves the remote sandbox factory installed by
+ * `@pyric/cli/register`. Production callers must import `firebase-admin/app`
+ * without Pyric activation instead of passing production options here.
+ */
+export function initializeApp(
+  config?: InitializeAdminAppConfig,
+  name: string = DEFAULT_APP_NAME,
+): PyricAdminApp {
+  validateAppName(name);
+  const existing = appRegistry.get(name);
+
+  if (config === undefined) {
+    if (existing !== undefined) {
+      if (ambientApps.has(existing)) return existing;
+      throw alreadyExists(name, 'invalid-app-options');
+    }
+    const app = initializeAmbientApp(name);
+    appRegistry.set(name, app);
+    ambientApps.add(app);
+    return app;
+  }
+
+  if (!isSandboxConfig(config)) {
+    throw new TypeError(
+      'pyric-admin/app is a sandbox-only mirror. Production applications must ' +
+        'load firebase-admin/app without Pyric activation.',
+    );
+  }
+
+  if (existing !== undefined) {
+    if (!ambientApps.has(existing) && existing.sandbox === config.sandbox) return existing;
+    throw alreadyExists(
+      name,
+      ambientApps.has(existing) ? 'invalid-app-options' : 'duplicate-app',
+    );
+  }
+
+  const app: SandboxAdminApp = {
+    [ADMIN_APP_TARGET]: 'sandbox',
+    sandbox: config.sandbox,
+    name,
+  };
+  appRegistry.set(name, app);
+  return app;
+}
+
+/** Return the registered app for `name`. */
+export function getApp(name: string = DEFAULT_APP_NAME): PyricAdminApp {
+  validateAppName(name);
+  const app = appRegistry.get(name);
+  if (app === undefined) {
+    const lead = name === DEFAULT_APP_NAME
+      ? 'The default Firebase app does not exist. '
+      : `Firebase app named "${name}" does not exist. `;
+    throw new FirebaseAppError(
+      'no-app',
+      lead + 'Make sure you call initializeApp() before using any of the Firebase services.',
+    );
+  }
+  return app;
+}
+
+/** Return a copy of the app registry. */
+export function getApps(): PyricAdminApp[] {
+  return Array.from(appRegistry.values());
+}
+
+/** Remove a sandbox app from the registry. */
+export function deleteApp(app: PyricAdminApp): Promise<void> {
+  if (typeof app !== 'object' || app === null || !(ADMIN_APP_TARGET in app)) {
+    throw new FirebaseAppError('invalid-argument', 'Invalid app argument.');
+  }
+  assertAdminAppActive(app);
+  const existing = getApp(app.name);
+  appRegistry.delete(existing.name);
+  markAdminAppDeleted(existing);
+  return Promise.resolve();
+}
+
+function initializeAmbientApp(name: string): PyricAdminApp {
+  const env = process.env.PYRIC_SANDBOX;
+  if (env === undefined || env.trim() === '') {
+    throw new Error(
+      'pyric-admin/app is a sandbox-only mirror and no sandbox is active. ' +
+        'Run under `pyric dev`, set PYRIC_SANDBOX with @pyric/cli/register, ' +
+        'or load firebase-admin/app without Pyric activation for production.',
+    );
+  }
+
+  const opts = parsePyricSandboxEnv(env);
+  if (process.env.NODE_ENV === 'production' && process.env.PYRIC_SANDBOX_FORCE !== '1') {
+    throw new Error(
+      'pyric-admin: PYRIC_SANDBOX is set but NODE_ENV is "production" — ' +
+        'refusing to route firebase-admin to a development sandbox. ' +
+        'Unset PYRIC_SANDBOX in production, or set PYRIC_SANDBOX_FORCE=1 ' +
+        'if this routing is intentional.',
+    );
+  }
+
+  const factory = (globalThis as { [REMOTE_SANDBOX_FACTORY]?: RemoteSandboxFactory })[
+    REMOTE_SANDBOX_FACTORY
+  ];
+  if (typeof factory !== 'function') {
+    throw new Error(
+      `pyric-admin: PYRIC_SANDBOX=${env} is set but no remote sandbox ` +
+        "factory is installed (globalThis[Symbol.for('pyric.remote.sandboxFactory')] is absent). " +
+        'Run your server under `pyric dev`, or add `--import @pyric/cli/register` to NODE_OPTIONS.',
+    );
+  }
+
+  const sandbox = factory(opts);
+  process.stderr.write(
+    `pyric: firebase-admin routed to sandbox${opts.url !== undefined ? ` at ${opts.url}` : ''}\n`,
+  );
+  return { [ADMIN_APP_TARGET]: 'sandbox', sandbox, name };
+}
+
+function parsePyricSandboxEnv(env: string): RemoteSandboxFactoryOptions {
+  const value = env.trim();
+  if (value === 'remote') return {};
+  if (value.startsWith('remote:')) {
+    const url = value.slice('remote:'.length).trim();
+    if (url === '') {
+      throw new Error(
+        'pyric-admin: PYRIC_SANDBOX=remote: has an empty url. Use ' +
+          'PYRIC_SANDBOX=remote to auto-discover the running `pyric dev`, ' +
+          'or PYRIC_SANDBOX=remote:<url> with the host url.',
+      );
+    }
+    return { url };
+  }
+  throw new Error(
+    `pyric-admin: unrecognized PYRIC_SANDBOX value "${env}". Supported ` +
+      'values: "remote" (auto-discover the running `pyric dev`) or "remote:<url>".',
+  );
+}
+
+function isSandboxConfig(config: InitializeAdminAppConfig): config is { sandbox: Sandbox } {
+  return typeof config === 'object' && config !== null && 'sandbox' in config;
+}
+
+export function isSandboxAdminApp(app: PyricAdminApp): app is SandboxAdminApp {
+  return app[ADMIN_APP_TARGET] === 'sandbox';
+}

package/src/app/lifecycle.ts

@@ -0,0 +1,17 @@
+const deletedApps = new WeakSet<object>();
+
+/** Internal lifecycle guard shared by every pyric-admin service factory. */
+export function assertAdminAppActive(app: object & { readonly name: string }): void {
+  if (!deletedApps.has(app)) return;
+  const error = new Error(
+    `Firebase app named "${app.name}" has already been deleted.`,
+  ) as Error & { code: string };
+  error.name = 'FirebaseAppError';
+  error.code = 'app/app-deleted';
+  throw error;
+}
+
+/** Tombstone a wrapper while leaving the caller-owned Sandbox alive. */
+export function markAdminAppDeleted(app: object): void {
+  deletedApps.add(app);
+}

package/src/auth/auth.test.ts

@@ -0,0 +1,322 @@
+/**
+ * Tests for `pyric-admin/auth`.
+ *
+ * Covers:
+ *   - Phase 3 dispatch: branded `PyricAdminApp` from `pyric-admin/app`
+ *     routes to the right backend (`prod` → firebase-admin/auth;
+ *     `sandbox` → in-memory backend). Inputs that aren't a
+ *     `PyricAdminApp` throw a clear `TypeError`.
+ *   - Phase 4b sandbox backend: roundtrips for createCustomToken /
+ *     verifyIdToken, createUser / getUser / getUserByEmail / deleteUser,
+ *     setCustomUserClaims persistence, and that `sandbox.reset()` clears
+ *     the in-memory user store.
+ *   - Documented "not implemented" surface throws the canonical
+ *     `not implemented in pyric-admin/auth sandbox backend` message.
+ */
+
+import { afterEach, describe, it, expect } from 'bun:test';
+
+import { initializeSandbox } from 'pyric/sandbox';
+
+import { initializeApp, deleteApp, getApps, ADMIN_APP_TARGET } from '../app/index.js';
+import { getAuth, SANDBOX_TOKEN_PREFIX } from './index.js';
+
+// The app registry is module-global (mirror of firebase-admin's
+// defaultAppStore) — deregister every app after each test so unnamed
+// `initializeApp({ sandbox })` calls don't collide across tests.
+afterEach(async () => {
+  await Promise.all(getApps().map((app) => deleteApp(app)));
+});
+
+describe('getAuth — Phase 3 dispatch', () => {
+  it('rejects values that are not PyricAdminApp with a clear TypeError', () => {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    expect(() => getAuth(null as any)).toThrow(TypeError);
+    // `undefined` is the no-arg mirror: it resolves the default app from
+    // the registry and (with none initialized) throws firebase-admin's
+    // app/no-app error, not the entry-guard TypeError.
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    expect(() => getAuth(undefined as any)).toThrow(
+      /The default Firebase app does not exist/,
+    );
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    expect(() => getAuth({} as any)).toThrow(/ADMIN_APP_TARGET brand/);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    expect(() => getAuth('not an app' as any)).toThrow(TypeError);
+  });
+
+  it('rejects PyricAdminApp-shaped values with an unknown target string', () => {
+    // Manually-constructed handle with an unrecognized target value —
+    // simulates a future `pyric-admin/app` adding a new arm that this
+    // adapter hasn't been updated for. The error names the offending
+    // target so the remediation is obvious.
+    const futureApp = {
+      [ADMIN_APP_TARGET]: 'replay' as const,
+      // Carry a stub `sandbox` so it doesn't fail the prod-arm cast.
+      sandbox: {},
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    } as any;
+    expect(() => getAuth(futureApp)).toThrow(/expected a sandbox admin app/);
+  });
+
+  it('returns a sandbox Auth handle for a sandbox-target PyricAdminApp', () => {
+    const sandbox = initializeSandbox();
+    const app = initializeApp({ sandbox });
+    const auth = getAuth(app);
+    // The sandbox handle exposes the documented method subset as
+    // callable functions. Cast through unknown — the Auth type is the
+    // upstream class; the sandbox returns a structurally-compatible
+    // duck.
+    const a = auth as unknown as Record<string, unknown>;
+    expect(typeof a.createCustomToken).toBe('function');
+    expect(typeof a.verifyIdToken).toBe('function');
+    expect(typeof a.createUser).toBe('function');
+    expect(typeof a.getUser).toBe('function');
+    expect(typeof a.getUserByEmail).toBe('function');
+    expect(typeof a.deleteUser).toBe('function');
+    expect(typeof a.setCustomUserClaims).toBe('function');
+  });
+});
+
+describe('sandbox backend — createCustomToken / verifyIdToken roundtrip', () => {
+  it('mints a deterministic token with the documented prefix', async () => {
+    const sandbox = initializeSandbox();
+    const auth = getAuth(initializeApp({ sandbox }));
+    const token = await auth.createCustomToken('alice');
+    expect(token.startsWith(`${SANDBOX_TOKEN_PREFIX}:`)).toBe(true);
+    expect(token).toBe(`${SANDBOX_TOKEN_PREFIX}:alice:{}`);
+  });
+
+  it('round-trips uid + claims through verifyIdToken', async () => {
+    const sandbox = initializeSandbox();
+    const auth = getAuth(initializeApp({ sandbox }));
+    const token = await auth.createCustomToken('alice', { role: 'admin', tier: 2 });
+    const decoded = await auth.verifyIdToken(token);
+    expect(decoded.uid).toBe('alice');
+    expect(decoded.sub).toBe('alice');
+    expect(decoded.role).toBe('admin');
+    expect(decoded.tier).toBe(2);
+    // Required DecodedIdToken fields are populated with sandbox placeholders.
+    expect(decoded.iss).toBe('pyric-sandbox');
+    expect(decoded.aud).toBe('pyric-sandbox');
+    expect(decoded.firebase.sign_in_provider).toBe('custom');
+  });
+
+  it('rejects tokens that do not carry the sandbox prefix', async () => {
+    const sandbox = initializeSandbox();
+    const auth = getAuth(initializeApp({ sandbox }));
+    // A real-looking JWT — three base64 segments joined by '.'. The
+    // sandbox backend doesn't try to parse JWTs; it only accepts its
+    // own minted tokens.
+    const realJwt = 'eyJhbGciOi.eyJzdWIiOi.signature';
+    await expect(auth.verifyIdToken(realJwt)).rejects.toThrow(
+      /sandbox.*createCustomToken/,
+    );
+  });
+
+  it('rejects tokens with malformed claim JSON', async () => {
+    const sandbox = initializeSandbox();
+    const auth = getAuth(initializeApp({ sandbox }));
+    const badToken = `${SANDBOX_TOKEN_PREFIX}:alice:not-json`;
+    await expect(auth.verifyIdToken(badToken)).rejects.toThrow(/JSON/);
+  });
+});
+
+describe('sandbox backend — user CRUD', () => {
+  it('createUser stores by uid; getUser retrieves it', async () => {
+    const sandbox = initializeSandbox();
+    const auth = getAuth(initializeApp({ sandbox }));
+    const created = await auth.createUser({
+      uid: 'alice',
+      email: 'alice@example.com',
+      displayName: 'Alice',
+    });
+    expect(created.uid).toBe('alice');
+    expect(created.email).toBe('alice@example.com');
+    expect(created.displayName).toBe('Alice');
+    expect(created.disabled).toBe(false);
+    expect(created.emailVerified).toBe(false);
+
+    const fetched = await auth.getUser('alice');
+    expect(fetched.uid).toBe('alice');
+    expect(fetched.email).toBe('alice@example.com');
+  });
+
+  it('createUser auto-generates a uid when omitted', async () => {
+    const sandbox = initializeSandbox();
+    const auth = getAuth(initializeApp({ sandbox }));
+    const created = await auth.createUser({ email: 'noid@example.com' });
+    expect(created.uid).toMatch(/^pyric-sandbox-/);
+    // Round-trips: the auto-uid is retrievable.
+    const fetched = await auth.getUser(created.uid);
+    expect(fetched.email).toBe('noid@example.com');
+  });
+
+  it('createUser rejects on uid collision', async () => {
+    const sandbox = initializeSandbox();
+    const auth = getAuth(initializeApp({ sandbox }));
+    await auth.createUser({ uid: 'alice' });
+    await expect(auth.createUser({ uid: 'alice' })).rejects.toThrow(/already exists/);
+  });
+
+  it('getUserByEmail finds users by email via linear scan', async () => {
+    const sandbox = initializeSandbox();
+    const auth = getAuth(initializeApp({ sandbox }));
+    await auth.createUser({ uid: 'alice', email: 'a@e.com' });
+    await auth.createUser({ uid: 'bob', email: 'b@e.com' });
+    const fetched = await auth.getUserByEmail('b@e.com');
+    expect(fetched.uid).toBe('bob');
+  });
+
+  it('getUserByEmail rejects on miss', async () => {
+    const sandbox = initializeSandbox();
+    const auth = getAuth(initializeApp({ sandbox }));
+    await expect(auth.getUserByEmail('nobody@e.com')).rejects.toThrow(
+      /no user with email/,
+    );
+  });
+
+  it('getUser rejects on miss', async () => {
+    const sandbox = initializeSandbox();
+    const auth = getAuth(initializeApp({ sandbox }));
+    await expect(auth.getUser('ghost')).rejects.toThrow(/no user with uid/);
+  });
+
+  it('deleteUser removes the record', async () => {
+    const sandbox = initializeSandbox();
+    const auth = getAuth(initializeApp({ sandbox }));
+    await auth.createUser({ uid: 'alice' });
+    await auth.deleteUser('alice');
+    await expect(auth.getUser('alice')).rejects.toThrow(/no user/);
+  });
+
+  it('deleteUser rejects on miss', async () => {
+    const sandbox = initializeSandbox();
+    const auth = getAuth(initializeApp({ sandbox }));
+    await expect(auth.deleteUser('ghost')).rejects.toThrow(/no user with uid/);
+  });
+});
+
+describe('sandbox backend — setCustomUserClaims persistence', () => {
+  it('persists claims and getUser reads them back', async () => {
+    const sandbox = initializeSandbox();
+    const auth = getAuth(initializeApp({ sandbox }));
+    await auth.createUser({ uid: 'alice' });
+    await auth.setCustomUserClaims('alice', { role: 'admin', org: 'acme' });
+    const fetched = await auth.getUser('alice');
+    expect(fetched.customClaims).toEqual({ role: 'admin', org: 'acme' });
+  });
+
+  it('passing null clears claims', async () => {
+    const sandbox = initializeSandbox();
+    const auth = getAuth(initializeApp({ sandbox }));
+    await auth.createUser({ uid: 'alice' });
+    await auth.setCustomUserClaims('alice', { role: 'admin' });
+    await auth.setCustomUserClaims('alice', null);
+    const fetched = await auth.getUser('alice');
+    expect(fetched.customClaims).toBeUndefined();
+  });
+
+  it('claims minted via setCustomUserClaims surface through createCustomToken + verifyIdToken', async () => {
+    // The token format is stateless (claims are baked in at mint time
+    // by the caller, not pulled from the store), so this test is
+    // really asserting the caller's pattern: read claims off the
+    // UserRecord, pass them through to createCustomToken.
+    const sandbox = initializeSandbox();
+    const auth = getAuth(initializeApp({ sandbox }));
+    await auth.createUser({ uid: 'alice' });
+    await auth.setCustomUserClaims('alice', { role: 'admin' });
+    const stored = await auth.getUser('alice');
+    const token = await auth.createCustomToken(
+      stored.uid,
+      stored.customClaims ?? {},
+    );
+    const decoded = await auth.verifyIdToken(token);
+    expect(decoded.role).toBe('admin');
+  });
+
+  it('setCustomUserClaims rejects on missing user', async () => {
+    const sandbox = initializeSandbox();
+    const auth = getAuth(initializeApp({ sandbox }));
+    await expect(auth.setCustomUserClaims('ghost', { x: 1 })).rejects.toThrow(
+      /no user with uid/,
+    );
+  });
+});
+
+describe('sandbox backend — reset clears state', () => {
+  it('sandbox.reset() wipes the auth user store', async () => {
+    const sandbox = initializeSandbox();
+    const auth = getAuth(initializeApp({ sandbox }));
+    await auth.createUser({ uid: 'alice', email: 'a@e.com' });
+    // Confirm pre-reset state.
+    const before = await auth.getUser('alice');
+    expect(before.uid).toBe('alice');
+
+    sandbox.reset();
+
+    // After reset, the same auth handle should see no users.
+    await expect(auth.getUser('alice')).rejects.toThrow(/no user with uid/);
+  });
+
+  it('repeat getAuth(app) calls share the same in-memory store', async () => {
+    // Mirrors firebase-admin's `getAuth(app)` idempotency — writes
+    // through one handle are visible through another for the same
+    // sandbox.
+    const sandbox = initializeSandbox();
+    const app = initializeApp({ sandbox });
+    const auth1 = getAuth(app);
+    const auth2 = getAuth(app);
+    await auth1.createUser({ uid: 'alice' });
+    const fetched = await auth2.getUser('alice');
+    expect(fetched.uid).toBe('alice');
+  });
+});
+
+describe('sandbox backend — explicitly-not-implemented surface', () => {
+  it('updateUser throws the canonical not-implemented message', async () => {
+    const sandbox = initializeSandbox();
+    const auth = getAuth(initializeApp({ sandbox }));
+    await expect(
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      (auth as any).updateUser('alice', { displayName: 'A' }),
+    ).rejects.toThrow(/not implemented in pyric-admin\/auth sandbox backend/);
+  });
+
+  it.each([
+    'getUserByPhoneNumber',
+    'getUserByProviderUid',
+    'getUsers',
+    'deleteUsers',
+    'listUsers',
+    'importUsers',
+    'revokeRefreshTokens',
+    'createSessionCookie',
+    'verifySessionCookie',
+    'generatePasswordResetLink',
+    'generateEmailVerificationLink',
+    'generateSignInWithEmailLink',
+    'generateVerifyAndChangeEmailLink',
+    'createProviderConfig',
+    'getProviderConfig',
+    'listProviderConfigs',
+    'updateProviderConfig',
+    'deleteProviderConfig',
+  ])('%s rejects with the not-implemented message', async (method) => {
+    const sandbox = initializeSandbox();
+    const auth = getAuth(initializeApp({ sandbox }));
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const fn = (auth as any)[method] as (...args: unknown[]) => Promise<unknown>;
+    await expect(fn.call(auth)).rejects.toThrow(
+      /not implemented in pyric-admin\/auth sandbox backend/,
+    );
+  });
+
+  it('tenantManager getter throws the not-implemented message', () => {
+    const sandbox = initializeSandbox();
+    const auth = getAuth(initializeApp({ sandbox }));
+    expect(() => auth.tenantManager()).toThrow(
+      /not implemented in pyric-admin\/auth sandbox backend/,
+    );
+  });
+});