feat: add custom claims support to DecodedIdToken model and update tests (#253)

* feat: add custom claims support to DecodedIdToken model and update tests

* docs: add custom claims support to changelog

* docs: add example for accessing custom claims in README

* fix: exclude standard OIDC and reserved claims from DecodedIdToken custom claims map

* Update packages/firebase_admin_sdk/lib/src/auth/token_verifier.dart

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

* Fix the github suggested change

* Update packages/firebase_admin_sdk/lib/src/auth/token_verifier.dart

Co-authored-by: Nate Bosch <nbosch1@gmail.com>

---------

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Co-authored-by: Nate Bosch <nbosch1@gmail.com>

Author: 3 people

packages/firebase_admin_sdk/CHANGELOG.md

@@ -7,6 +7,7 @@
 - AppOptions.additionalScopes` — append extra OAuth2 scopes to the SDK-managed HTTP client 
   without providing your own `AuthClient`.
 - `FirebaseApp.client` is now part of the public API.
+- Add support for custom claims in ID tokens.
 
 ## 0.5.1
 

packages/firebase_admin_sdk/README.md

@@ -385,6 +385,11 @@ final nextPageToken = result.pageToken;
 final idToken = req.headers['Authorization'].split(' ')[1];
 final decodedToken = await auth.verifyIdToken(idToken, checkRevoked: true);
 print(decodedToken.uid);
+
+// Access custom claims
+if (decodedToken.claims['isAdmin'] == true) {
+  print('User is an admin');
+}
 ```
 
 #### createCustomToken

packages/firebase_admin_sdk/lib/src/auth/token_verifier.dart

@@ -349,6 +349,7 @@ class DecodedIdToken {
   DecodedIdToken({
     required this.aud,
     required this.authTime,
+    required this.claims,
     required this.email,
     required this.emailVerified,
     required this.exp,
@@ -363,11 +364,14 @@ class DecodedIdToken {
 
   @internal
   factory DecodedIdToken.fromMap(Map<String, Object?> map) {
+    final claims = _extractCustomClaims(map);
+
     return DecodedIdToken(
       aud: map['aud']! as String,
       authTime: DateTime.fromMillisecondsSinceEpoch(
         (map['auth_time']! as int) * 1000,
       ),
+      claims: Map.unmodifiable(claims),
       email: map['email'] as String?,
       emailVerified: map['email_verified'] as bool?,
       exp: map['exp']! as int,
@@ -452,11 +456,30 @@ class DecodedIdToken {
   /// convenience, and is set as the value of the [`sub`](#sub) property.
   String uid;
 
-  /**
-   * Other arbitrary claims included in the ID token.
-   */
-  // TODO allow any key
-  // [key: string]: any;
+  /// Other arbitrary claims included in the ID token.
+  final Map<String, Object?> claims;
+}
+
+/// Extracts custom claims from the raw ID token payload map.
+///
+/// Custom claims are all claims that are not standard OpenID Connect claims
+/// or reserved Firebase claims.
+Map<String, Object?> _extractCustomClaims(Map<String, Object?> map) {
+  return {...map}..removeWhere(
+    (key, _) => const {
+      'aud',
+      'auth_time',
+      'email',
+      'email_verified',
+      'exp',
+      'firebase',
+      'iat',
+      'iss',
+      'phone_number',
+      'picture',
+      'sub',
+    }.contains(key),
+  );
 }
 
 /// User facing token information related to the Firebase ID token.

packages/firebase_admin_sdk/test/unit/auth/token_verifier_test.dart

@@ -36,6 +36,9 @@ void main() {
         'phone_number': 'mock-phone-number',
         'picture': 'mock-picture',
         'sub': 'mock-sub',
+        'custom_claim': 'mock-custom-claim',
+        'isAdmin': true,
+        'numberOfTests': 3,
       });
       expect(idToken.aud, 'mock-aud');
       expect(idToken.authTime, DateTime.fromMillisecondsSinceEpoch(1000));
@@ -56,6 +59,11 @@ void main() {
       expect(idToken.picture, 'mock-picture');
       expect(idToken.sub, 'mock-sub');
       expect(idToken.uid, 'mock-sub');
+      expect(idToken.claims['custom_claim'], 'mock-custom-claim');
+      expect(idToken.claims['isAdmin'], true);
+      expect(idToken.claims['numberOfTests'], 3);
+      expect(idToken.claims.containsKey('aud'), false);
+      expect(idToken.claims.containsKey('sub'), false);
     });
   });
 }