pyric-admin 0.1.0-alpha.32 → 0.1.0-alpha.34

package/dist/auth/token-decoders.js

@@ -1,130 +1,110 @@
 /**
- * Token format minted by `createCustomToken` and parsed by
- * `verifyIdToken`. Exported as a constant so tests can lock the shape.
+ * The ID token check behind `pyric-admin/auth` `verifyIdToken`.
  *
- * Layout: `pyric-sandbox-custom:${uid}:${jsonClaims}`
- *
- * - The prefix lets `verifyIdToken` reject foreign tokens with a clear
- *   "not a sandbox token" error rather than NaN'ing out.
- * - `uid` is colon-free per the auto-uid format above.
- * - `jsonClaims` is the JSON-stringified developer claims (or `{}` when
- *   none were provided). Round-trips losslessly through `JSON.parse`.
- *
- * NOT a JWT. NOT signed. Do not use this token format to talk to any
- * real Firebase service — it only round-trips through this same
- * sandbox backend.
+ * The only token that verifies is the JWT pyric's Auth mints
+ * (`pyric/sandbox/internal` `mintIdToken`), checked by the shared
+ * {@link checkIdToken} and then by firebase-admin 13.10.0's rules, in its
+ * order (lib/auth/token-verifier.js `verifyContent` and `verifySignature`,
+ * lib/utils/jwt.js, and jsonwebtoken's `nbf` and `exp`). A plain string, or
+ * the client token shape from before #1836, fails to decode, and a custom
+ * token is refused as one, as in production (#1949, #1952).
  */
-export const SANDBOX_TOKEN_PREFIX = 'pyric-sandbox-custom';
-function resolveStringClaim(claims, key, fallback) {
-    const val = claims[key];
-    const hasStringValue = typeof val === 'string';
-    return hasStringValue ? val : fallback;
+import { checkIdToken, CUSTOM_TOKEN_AUDIENCE } from 'pyric/sandbox/internal';
+const ID_TOKEN_ISSUER = 'https://securetoken.google.com/';
+const MAX_SUBJECT_LENGTH = 128;
+const DOCS = ' See https://firebase.google.com/docs/auth/admin/verify-id-tokens for details on how to retrieve an ID token.';
+const PROJECT_MATCH = ' Make sure the ID token comes from the same Firebase project as the service account used to authenticate this SDK.';
+const MESSAGES = {
+    decode: `Decoding Firebase ID token failed. Make sure you passed the entire string JWT which represents an ID token.${DOCS}`,
+    customToken: `verifyIdToken() expects an ID token, but was given a custom token.${DOCS}`,
+    legacyCustomToken: `verifyIdToken() expects an ID token, but was given a legacy custom token.${DOCS}`,
+    noKid: `Firebase ID token has no "kid" claim.${DOCS}`,
+    algorithm: (alg) => `Firebase ID token has incorrect algorithm. Expected "RS256" but got "${String(alg)}".${DOCS}`,
+    audience: (projectId, aud) => `Firebase ID token has incorrect "aud" (audience) claim. Expected "${projectId}" but got "${String(aud)}".${PROJECT_MATCH}${DOCS}`,
+    issuer: (projectId, iss) => `Firebase ID token has incorrect "iss" (issuer) claim. Expected "${ID_TOKEN_ISSUER}${projectId}" but got "${String(iss)}".${PROJECT_MATCH}${DOCS}`,
+    noSub: `Firebase ID token has no "sub" (subject) claim.${DOCS}`,
+    emptySub: `Firebase ID token has an empty "sub" (subject) claim.${DOCS}`,
+    longSub: `Firebase ID token has a "sub" (subject) claim longer than 128 characters.${DOCS}`,
+    unknownKid: 'Firebase ID token has "kid" claim which does not correspond to a known public key. Most likely the ID token is expired, so get a fresh token from your client app and try again.',
+    signature: `Firebase ID token has invalid signature.${DOCS}`,
+    expired: `Firebase ID token has expired. Get a fresh ID token from your client app and try again (auth/id-token-expired).${DOCS}`,
+};
+function refused(message) {
+    return { ok: false, code: 'argument-error', message };
 }
-function resolveNumberClaim(claims, key, fallback) {
-    const val = claims[key];
-    const hasNumberValue = typeof val === 'number';
-    return hasNumberValue ? val : fallback;
+/** token-verifier.js: a missing `kid` names a custom token, a legacy custom token, or neither. */
+function missingKidMessage(header, claims) {
+    if (claims.aud === CUSTOM_TOKEN_AUDIENCE)
+        return MESSAGES.customToken;
+    const legacyData = claims.d;
+    const isLegacyCustomToken = header.alg === 'HS256' && claims.v === 0 && typeof legacyData === 'object' && legacyData !== null && 'uid' in legacyData;
+    if (isLegacyCustomToken)
+        return MESSAGES.legacyCustomToken;
+    return MESSAGES.noKid;
 }
-function resolveUid(idToken, firstColon, claims) {
-    const rawSub = claims['sub'];
-    const hasExplicitSubjectClaim = typeof rawSub === 'string';
-    if (hasExplicitSubjectClaim) {
-        return rawSub;
-    }
-    const prefixSegment = idToken.slice('sandbox-id-token-'.length, firstColon);
-    const lastHyphen = prefixSegment.lastIndexOf('-');
-    const hasHyphenatedSerialSuffix = lastHyphen > 0;
-    if (hasHyphenatedSerialSuffix) {
-        return prefixSegment.slice(0, lastHyphen);
-    }
-    return prefixSegment;
+/** Auth blocking events with no user record, whose `sub` firebase-admin leaves unchecked. */
+function skipsSubjectCheck(claims) {
+    return claims.event_type === 'beforeSendSms' || claims.event_type === 'beforeSendEmail';
 }
-function resolveFirebaseClaim(claims) {
-    const rawFirebase = claims['firebase'];
-    const isMissingFirebaseClaim = !rawFirebase || typeof rawFirebase !== 'object';
-    if (isMissingFirebaseClaim) {
-        return { identities: {}, sign_in_provider: 'custom' };
-    }
-    const fb = rawFirebase;
-    const signInProvider = resolveStringClaim(fb, 'sign_in_provider', 'custom');
-    const rawIdentities = fb['identities'];
-    const isMissingIdentitiesMap = !rawIdentities || typeof rawIdentities !== 'object';
-    if (isMissingIdentitiesMap) {
-        return { identities: {}, sign_in_provider: signInProvider };
-    }
-    return { identities: rawIdentities, sign_in_provider: signInProvider };
+function subjectMessage(sub) {
+    if (typeof sub !== 'string')
+        return MESSAGES.noSub;
+    if (sub === '')
+        return MESSAGES.emptySub;
+    if (sub.length > MAX_SUBJECT_LENGTH)
+        return MESSAGES.longSub;
+    return undefined;
+}
+/** token-verifier.js `verifyContent`: `kid`, `alg`, `aud`, `iss`, then `sub`; the first failure wins. */
+function contentMessage(header, claims, projectId) {
+    if (header.kid === undefined)
+        return missingKidMessage(header, claims);
+    if (header.alg !== 'RS256')
+        return MESSAGES.algorithm(header.alg);
+    if (claims.aud !== projectId)
+        return MESSAGES.audience(projectId, claims.aud);
+    if (claims.iss !== `${ID_TOKEN_ISSUER}${projectId}`)
+        return MESSAGES.issuer(projectId, claims.iss);
+    if (skipsSubjectCheck(claims))
+        return undefined;
+    return subjectMessage(claims.sub);
+}
+/** jsonwebtoken's `nbf` rule, which runs before `exp`; firebase-admin reports a failure as an invalid signature. */
+function isNotYetValid(nbf, nowSec) {
+    if (nbf === undefined)
+        return false;
+    return typeof nbf !== 'number' || nbf > nowSec;
+}
+/** jsonwebtoken's `exp` rule: an absent `exp` never expires, and a non-number is an invalid signature. */
+function expiryVerdict(exp, nowSec) {
+    if (exp === undefined)
+        return undefined;
+    if (typeof exp !== 'number')
+        return refused(MESSAGES.signature);
+    const hasExpired = nowSec >= exp;
+    if (hasExpired)
+        return { ok: false, code: 'id-token-expired', message: MESSAGES.expired };
+    return undefined;
+}
+/**
+ * Checks an ID token for `projectId` at `nowSec`, in firebase-admin's order:
+ * decoding, the content rules, the key and signature, then `nbf` and `exp`.
+ */
+export async function checkClientIdToken(idToken, projectId, nowSec) {
+    const check = await checkIdToken(idToken);
+    if (!check.ok && check.reason === 'malformed')
+        return refused(MESSAGES.decode);
+    const contentFailure = contentMessage(check.header, check.claims, projectId);
+    if (contentFailure !== undefined)
+        return refused(contentFailure);
+    if (!check.ok)
+        return refused(check.reason === 'kid' ? MESSAGES.unknownKid : MESSAGES.signature);
+    if (isNotYetValid(check.claims.nbf, nowSec))
+        return refused(MESSAGES.signature);
+    const expired = expiryVerdict(check.claims.exp, nowSec);
+    if (expired !== undefined)
+        return expired;
+    const token = { ...check.claims, uid: check.claims.sub };
+    return { ok: true, token };
 }
-const customTokenDecoder = {
-    name: 'custom-token',
-    prefix: `${SANDBOX_TOKEN_PREFIX}:`,
-    decode(idToken, nowSec) {
-        const firstColon = idToken.indexOf(':');
-        const secondColon = idToken.indexOf(':', firstColon + 1);
-        const isMissingClaimsSegment = secondColon < 0;
-        if (isMissingClaimsSegment) {
-            throw new Error(`pyric-admin/auth: verifyIdToken received a malformed sandbox token (missing claims segment): ${idToken}`);
-        }
-        const uid = idToken.slice(firstColon + 1, secondColon);
-        const jsonClaims = idToken.slice(secondColon + 1);
-        let claims;
-        try {
-            claims = JSON.parse(jsonClaims);
-        }
-        catch (e) {
-            throw new Error(`pyric-admin/auth: verifyIdToken failed to parse sandbox token claims as JSON: ${e.message}`);
-        }
-        return {
-            aud: 'pyric-sandbox',
-            auth_time: nowSec,
-            exp: nowSec + 3600,
-            firebase: {
-                identities: {},
-                sign_in_provider: 'custom',
-            },
-            iat: nowSec,
-            iss: 'pyric-sandbox',
-            sub: uid,
-            uid,
-            ...claims,
-        };
-    },
-};
-const clientIdTokenDecoder = {
-    name: 'client-id-token',
-    prefix: 'sandbox-id-token-',
-    decode(idToken, nowSec) {
-        const firstColon = idToken.indexOf(':');
-        const isMissingClaimsSegment = firstColon < 0;
-        if (isMissingClaimsSegment) {
-            throw new Error(`pyric-admin/auth: verifyIdToken received a malformed client ID token (missing claims segment after colon): ${idToken}`);
-        }
-        const jsonClaims = idToken.slice(firstColon + 1);
-        let claims;
-        try {
-            claims = JSON.parse(jsonClaims);
-        }
-        catch (e) {
-            throw new Error(`pyric-admin/auth: verifyIdToken failed to parse client ID token claims as JSON: ${e.message}`);
-        }
-        const uid = resolveUid(idToken, firstColon, claims);
-        const aud = resolveStringClaim(claims, 'aud', 'pyric-sandbox');
-        const iss = resolveStringClaim(claims, 'iss', 'https://sandbox.pyric.dev');
-        const exp = resolveNumberClaim(claims, 'exp', nowSec + 3600);
-        const iat = resolveNumberClaim(claims, 'iat', nowSec);
-        const authTime = resolveNumberClaim(claims, 'auth_time', nowSec);
-        const firebase = resolveFirebaseClaim(claims);
-        return {
-            ...claims,
-            aud,
-            auth_time: authTime,
-            exp,
-            firebase,
-            iat,
-            iss,
-            sub: uid,
-            uid,
-        };
-    },
-};
-export const TOKEN_DECODERS = [customTokenDecoder, clientIdTokenDecoder];
 //# sourceMappingURL=token-decoders.js.map

package/dist/auth/token-decoders.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-decoders.js","sourceRoot":"","sources":["../../src/auth/token-decoders.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAQ3D,SAAS,kBAAkB,CAAC,MAA+B,EAAE,GAAW,EAAE,QAAgB;IACxF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,cAAc,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC;IAC/C,OAAO,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;AACzC,CAAC;AAED,SAAS,kBAAkB,CAAC,MAA+B,EAAE,GAAW,EAAE,QAAgB;IACxF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,cAAc,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC;IAC/C,OAAO,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,UAAkB,EAAE,MAA+B;IACtF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,uBAAuB,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC;IAC3D,IAAI,uBAAuB,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,yBAAyB,GAAG,UAAU,GAAG,CAAC,CAAC;IACjD,IAAI,yBAAyB,EAAE,CAAC;QAC9B,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAA+B;IAE/B,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,sBAAsB,GAAG,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,CAAC;IAC/E,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,EAAE,GAAG,WAAsC,CAAC;IAClD,MAAM,cAAc,GAAG,kBAAkB,CAAC,EAAE,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;IAC5E,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,sBAAsB,GAAG,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ,CAAC;IACnF,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,aAAwC,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC;AACpG,CAAC;AAED,MAAM,kBAAkB,GAAiB;IACvC,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE,GAAG,oBAAoB,GAAG;IAClC,MAAM,CAAC,OAAe,EAAE,MAAc;QACpC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;QACzD,MAAM,sBAAsB,GAAG,WAAW,GAAG,CAAC,CAAC;QAC/C,IAAI,sBAAsB,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,gGAAgG,OAAO,EAAE,CAC1G,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAA4B,CAAC;QAC7D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,iFAAkF,CAAW,CAAC,OAAO,EAAE,CACxG,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,EAAE,eAAe;YACpB,SAAS,EAAE,MAAM;YACjB,GAAG,EAAE,MAAM,GAAG,IAAI;YAClB,QAAQ,EAAE;gBACR,UAAU,EAAE,EAAE;gBACd,gBAAgB,EAAE,QAAQ;aAC3B;YACD,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,eAAe;YACpB,GAAG,EAAE,GAAG;YACR,GAAG;YACH,GAAG,MAAM;SACV,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,oBAAoB,GAAiB;IACzC,IAAI,EAAE,iBAAiB;IACvB,MAAM,EAAE,mBAAmB;IAC3B,MAAM,CAAC,OAAe,EAAE,MAAc;QACpC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,sBAAsB,GAAG,UAAU,GAAG,CAAC,CAAC;QAC9C,IAAI,sBAAsB,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,8GAA8G,OAAO,EAAE,CACxH,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QACjD,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAA4B,CAAC;QAC7D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mFAAoF,CAAW,CAAC,OAAO,EAAE,CAC1G,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,2BAA2B,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAE9C,OAAO;YACL,GAAG,MAAM;YACT,GAAG;YACH,SAAS,EAAE,QAAQ;YACnB,GAAG;YACH,QAAQ;YACR,GAAG;YACH,GAAG;YACH,GAAG,EAAE,GAAG;YACR,GAAG;SACJ,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAmB,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"token-decoders.js","sourceRoot":"","sources":["../../src/auth/token-decoders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAG7E,MAAM,eAAe,GAAG,iCAAiC,CAAC;AAC1D,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B,MAAM,IAAI,GAAG,+GAA+G,CAAC;AAC7H,MAAM,aAAa,GAAG,oHAAoH,CAAC;AAE3I,MAAM,QAAQ,GAAG;IACf,MAAM,EAAE,8GAA8G,IAAI,EAAE;IAC5H,WAAW,EAAE,qEAAqE,IAAI,EAAE;IACxF,iBAAiB,EAAE,4EAA4E,IAAI,EAAE;IACrG,KAAK,EAAE,wCAAwC,IAAI,EAAE;IACrD,SAAS,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,wEAAwE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;IAC3H,QAAQ,EAAE,CAAC,SAAiB,EAAE,GAAY,EAAE,EAAE,CAC5C,qEAAqE,SAAS,cAAc,MAAM,CAAC,GAAG,CAAC,KAAK,aAAa,GAAG,IAAI,EAAE;IACpI,MAAM,EAAE,CAAC,SAAiB,EAAE,GAAY,EAAE,EAAE,CAC1C,mEAAmE,eAAe,GAAG,SAAS,cAAc,MAAM,CAAC,GAAG,CAAC,KAAK,aAAa,GAAG,IAAI,EAAE;IACpJ,KAAK,EAAE,kDAAkD,IAAI,EAAE;IAC/D,QAAQ,EAAE,wDAAwD,IAAI,EAAE;IACxE,OAAO,EAAE,4EAA4E,IAAI,EAAE;IAC3F,UAAU,EACR,kLAAkL;IACpL,SAAS,EAAE,2CAA2C,IAAI,EAAE;IAC5D,OAAO,EAAE,kHAAkH,IAAI,EAAE;CAClI,CAAC;AAWF,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;AACxD,CAAC;AAED,kGAAkG;AAClG,SAAS,iBAAiB,CAAC,MAAc,EAAE,MAAc;IACvD,IAAI,MAAM,CAAC,GAAG,KAAK,qBAAqB;QAAE,OAAO,QAAQ,CAAC,WAAW,CAAC;IACtE,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC;IAC5B,MAAM,mBAAmB,GACvB,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,IAAI,KAAK,IAAI,UAAU,CAAC;IAC3H,IAAI,mBAAmB;QAAE,OAAO,QAAQ,CAAC,iBAAiB,CAAC;IAC3D,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,6FAA6F;AAC7F,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,MAAM,CAAC,UAAU,KAAK,eAAe,IAAI,MAAM,CAAC,UAAU,KAAK,iBAAiB,CAAC;AAC1F,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;IACnD,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC;IACzC,IAAI,GAAG,CAAC,MAAM,GAAG,kBAAkB;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;IAC7D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,yGAAyG;AACzG,SAAS,cAAc,CAAC,MAAc,EAAE,MAAc,EAAE,SAAiB;IACvE,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,eAAe,GAAG,SAAS,EAAE;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACnG,IAAI,iBAAiB,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,oHAAoH;AACpH,SAAS,aAAa,CAAC,GAAY,EAAE,MAAc;IACjD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,MAAM,CAAC;AACjD,CAAC;AAED,0GAA0G;AAC1G,SAAS,aAAa,CAAC,GAAY,EAAE,MAAc;IACjD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,MAAM,IAAI,GAAG,CAAC;IACjC,IAAI,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC1F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAe,EAAE,SAAiB,EAAE,MAAc;IACzF,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/E,MAAM,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7E,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACjG,IAAI,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC1C,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAoB,CAAC;IAC3E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC"}

package/dist/auth/verify-token.d.ts

@@ -1,16 +1,52 @@
 /**
- * Stateless ID token verification for `pyric-admin/auth`.
- * Routes token parsing across recognized decoder strategies.
+ * `verifyIdToken` for `pyric-admin/auth`, shared by the in-process and remote
+ * arms. Each arm passes the project the token must be scoped to and the
+ * current time on its own clock.
  */
+import type { AuthAccountStanding } from 'pyric/sandbox/internal';
+import { PrefixedFirebaseError } from '../app/firebase-error.js';
 import type { DecodedIdToken } from './types.js';
+import { type IdTokenFailureCode } from './token-decoders.js';
+/** The codes `checkRevoked` and `revokeRefreshTokens` add to a token check's. */
+type AccountFailureCode = 'user-not-found' | 'user-disabled' | 'id-token-revoked' | 'invalid-uid';
+/** firebase-admin's FirebaseAuthError: a PrefixedFirebaseError with prefix `auth`. */
+export declare class FirebaseAuthError extends PrefixedFirebaseError {
+    constructor(code: IdTokenFailureCode | AccountFailureCode, message: string);
+}
+/** What one verification checks against. */
+export interface IdTokenExpectation {
+    /** The project the token's `aud` and `iss` must name. */
+    projectId: string;
+    /** The current time, in epoch milliseconds, that `nbf` and `exp` are read against. */
+    nowMs: number;
+}
 /**
- * Parse a token minted by `createCustomToken` or a client ID token
- * minted by `pyric/auth`'s `getIdToken()`. Routes to the appropriate
- * modular token decoder based on token prefix.
+ * Throws `auth/argument-error` synchronously for a token that is not a string,
+ * as firebase-admin's `verifyJWT` does, so an arm that reads its clock before
+ * verifying can check the argument first.
+ */
+export declare function assertIdTokenArgument(idToken: unknown): void;
+/**
+ * Verifies an ID token minted by pyric's Auth for `expected.projectId`.
  *
- * Throws on any token that doesn't match a recognized sandbox prefix —
- * including real JWTs that another verifier would parse. The sandbox
- * backends are intentionally not drop-ins for production verification.
+ * A token that is not a string throws `auth/argument-error` synchronously, as
+ * firebase-admin's `verifyJWT` does. Every other failure rejects with
+ * `auth/argument-error`, or `auth/id-token-expired` for an expired token.
+ */
+export declare function verifySandboxIdToken(idToken: string, expected: IdTokenExpectation): Promise<DecodedIdToken>;
+/**
+ * firebase-admin's answer for a uid that is not a non-empty string of at most
+ * 128 characters (13.10.0 `validator.isUid`), checked before any request.
+ */
+export declare function invalidUid(uid: unknown): FirebaseAuthError | null;
+/** firebase-admin's `getUser` answer for a uid with no record. */
+export declare function userNotFound(): FirebaseAuthError;
+/**
+ * firebase-admin's `verifyDecodedJWTNotRevokedOrDisabled` (13.10.0
+ * `lib/auth/base-auth.js`), the `checkRevoked` step: the account must exist,
+ * be enabled, and have no revocation after the token's `auth_time`, compared
+ * in whole seconds as production stores it.
  */
-export declare function verifySandboxIdToken(idToken: string): Promise<DecodedIdToken>;
+export declare function assertNotRevokedOrDisabled(decoded: DecodedIdToken, standing: AuthAccountStanding): DecodedIdToken;
+export {};
 //# sourceMappingURL=verify-token.d.ts.map

package/dist/auth/verify-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-token.d.ts","sourceRoot":"","sources":["../../src/auth/verify-token.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAGjD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAyB7E"}
+{"version":3,"file":"verify-token.d.ts","sourceRoot":"","sources":["../../src/auth/verify-token.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAElF,iFAAiF;AACjF,KAAK,kBAAkB,GAAG,gBAAgB,GAAG,eAAe,GAAG,kBAAkB,GAAG,aAAa,CAAC;AAElG,sFAAsF;AACtF,qBAAa,iBAAkB,SAAQ,qBAAqB;gBAC9C,IAAI,EAAE,kBAAkB,GAAG,kBAAkB,EAAE,OAAO,EAAE,MAAM;CAG3E;AAED,4CAA4C;AAC5C,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,KAAK,EAAE,MAAM,CAAC;CACf;AAID;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAG5D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC,CAO3G;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,iBAAiB,GAAG,IAAI,CAIjE;AAED,kEAAkE;AAClE,wBAAgB,YAAY,IAAI,iBAAiB,CAEhD;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,mBAAmB,GAAG,cAAc,CAQjH"}

package/dist/auth/verify-token.js

@@ -1,32 +1,68 @@
-import { SANDBOX_TOKEN_PREFIX, TOKEN_DECODERS } from './token-decoders.js';
+import { PrefixedFirebaseError } from '../app/firebase-error.js';
+import { checkClientIdToken } from './token-decoders.js';
+/** firebase-admin's FirebaseAuthError: a PrefixedFirebaseError with prefix `auth`. */
+export class FirebaseAuthError extends PrefixedFirebaseError {
+    constructor(code, message) {
+        super('auth', code, message);
+    }
+}
+const NOT_A_STRING = 'First argument to verifyIdToken() must be a Firebase ID token string.';
 /**
- * Parse a token minted by `createCustomToken` or a client ID token
- * minted by `pyric/auth`'s `getIdToken()`. Routes to the appropriate
- * modular token decoder based on token prefix.
- *
- * Throws on any token that doesn't match a recognized sandbox prefix —
- * including real JWTs that another verifier would parse. The sandbox
- * backends are intentionally not drop-ins for production verification.
+ * Throws `auth/argument-error` synchronously for a token that is not a string,
+ * as firebase-admin's `verifyJWT` does, so an arm that reads its clock before
+ * verifying can check the argument first.
  */
-export function verifySandboxIdToken(idToken) {
+export function assertIdTokenArgument(idToken) {
     const isInvalidTokenArgument = typeof idToken !== 'string';
-    if (isInvalidTokenArgument) {
-        return Promise.reject(new Error('pyric-admin/auth: verifyIdToken expects a string argument.'));
-    }
-    const nowSec = Math.floor(Date.now() / 1000);
-    for (const decoder of TOKEN_DECODERS) {
-        const matchesDecoderPrefix = idToken.startsWith(decoder.prefix);
-        if (matchesDecoderPrefix) {
-            try {
-                return Promise.resolve(decoder.decode(idToken, nowSec));
-            }
-            catch (error) {
-                return Promise.reject(error);
-            }
-        }
-    }
-    return Promise.reject(new Error('pyric-admin/auth: verifyIdToken on the sandbox backend only ' +
-        'accepts tokens minted by this sandbox\'s createCustomToken or client getIdToken(). ' +
-        `Token must begin with "${SANDBOX_TOKEN_PREFIX}:" or "sandbox-id-token-".`));
+    if (isInvalidTokenArgument)
+        throw new FirebaseAuthError('argument-error', NOT_A_STRING);
+}
+/**
+ * Verifies an ID token minted by pyric's Auth for `expected.projectId`.
+ *
+ * A token that is not a string throws `auth/argument-error` synchronously, as
+ * firebase-admin's `verifyJWT` does. Every other failure rejects with
+ * `auth/argument-error`, or `auth/id-token-expired` for an expired token.
+ */
+export function verifySandboxIdToken(idToken, expected) {
+    assertIdTokenArgument(idToken);
+    const nowSec = Math.floor(expected.nowMs / 1000);
+    return checkClientIdToken(idToken, expected.projectId, nowSec).then((verdict) => {
+        if (!verdict.ok)
+            throw new FirebaseAuthError(verdict.code, verdict.message);
+        return verdict.token;
+    });
+}
+/**
+ * firebase-admin's answer for a uid that is not a non-empty string of at most
+ * 128 characters (13.10.0 `validator.isUid`), checked before any request.
+ */
+export function invalidUid(uid) {
+    const isUid = typeof uid === 'string' && uid.length > 0 && uid.length <= 128;
+    if (isUid)
+        return null;
+    return new FirebaseAuthError('invalid-uid', 'The uid must be a non-empty string with at most 128 characters.');
+}
+/** firebase-admin's `getUser` answer for a uid with no record. */
+export function userNotFound() {
+    return new FirebaseAuthError('user-not-found', 'There is no user record corresponding to the provided identifier.');
+}
+/**
+ * firebase-admin's `verifyDecodedJWTNotRevokedOrDisabled` (13.10.0
+ * `lib/auth/base-auth.js`), the `checkRevoked` step: the account must exist,
+ * be enabled, and have no revocation after the token's `auth_time`, compared
+ * in whole seconds as production stores it.
+ */
+export function assertNotRevokedOrDisabled(decoded, standing) {
+    const hasNoRecord = standing.kind === 'deleted' || standing.kind === 'unrecorded';
+    if (hasNoRecord)
+        throw userNotFound();
+    if (standing.kind === 'disabled')
+        throw new FirebaseAuthError('user-disabled', 'The user record is disabled.');
+    const validAfterMs = standing.tokensValidAfterMs;
+    const revoked = validAfterMs !== null && decoded.auth_time * 1000 < validAfterMs;
+    if (revoked)
+        throw new FirebaseAuthError('id-token-revoked', 'The Firebase ID token has been revoked.');
+    return decoded;
 }
 //# sourceMappingURL=verify-token.js.map

package/dist/auth/verify-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify-token.js","sourceRoot":"","sources":["../../src/auth/verify-token.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE3E;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,sBAAsB,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC;IAC3D,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,4DAA4D,CAAC,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,MAAM,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,oBAAoB,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,8DAA8D;QAC5D,qFAAqF;QACrF,0BAA0B,oBAAoB,4BAA4B,CAC7E,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"verify-token.js","sourceRoot":"","sources":["../../src/auth/verify-token.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAA2B,MAAM,qBAAqB,CAAC;AAKlF,sFAAsF;AACtF,MAAM,OAAO,iBAAkB,SAAQ,qBAAqB;IAC1D,YAAY,IAA6C,EAAE,OAAe;QACxE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;CACF;AAUD,MAAM,YAAY,GAAG,uEAAuE,CAAC;AAE7F;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,sBAAsB,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC;IAC3D,IAAI,sBAAsB;QAAE,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,QAA4B;IAChF,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACjD,OAAO,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9E,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5E,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC;IAC7E,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,IAAI,iBAAiB,CAAC,aAAa,EAAE,iEAAiE,CAAC,CAAC;AACjH,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,mEAAmE,CAAC,CAAC;AACtH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAuB,EAAE,QAA6B;IAC/F,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,CAAC;IAClF,IAAI,WAAW;QAAE,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU;QAAE,MAAM,IAAI,iBAAiB,CAAC,eAAe,EAAE,8BAA8B,CAAC,CAAC;IAC/G,MAAM,YAAY,GAAG,QAAQ,CAAC,kBAAkB,CAAC;IACjD,MAAM,OAAO,GAAG,YAAY,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,GAAG,YAAY,CAAC;IACjF,IAAI,OAAO;QAAE,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,yCAAyC,CAAC,CAAC;IACxG,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pyric-admin",
-  "version": "0.1.0-alpha.32",
+  "version": "0.1.0-alpha.34",
   "license": "Apache-2.0",
   "homepage": "https://pyric.dev",
   "repository": {
@@ -106,7 +106,7 @@
     "typecheck": "bun x tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "pyric": "^0.1.0-alpha.32"
+    "pyric": "^0.1.0-alpha.34"
   },
   "devDependencies": {
     "@types/bun": "1.3.14",