Merge branch 'v14' into lm-drop-ns

Author: jonathanedey

etc/firebase-admin.auth.api.md

@@ -232,8 +232,15 @@ export interface CreatePhoneMultiFactorInfoRequest extends BaseCreateMultiFactor
 }
 
 // @public
-export interface CreateRequest extends UpdateRequest {
+export interface CreateRequest {
+    disabled?: boolean;
+    displayName?: string;
+    email?: string;
+    emailVerified?: boolean;
     multiFactor?: MultiFactorCreateSettings;
+    password?: string;
+    phoneNumber?: string;
+    photoURL?: string;
     uid?: string;
 }
 

src/auth/auth-api-request.ts

@@ -127,14 +127,15 @@ class AuthResourceUrlBuilder {
   /**
    * The resource URL builder constructor.
    *
-   * @param projectId - The resource project ID.
+   * @param app - The app for this URL builder.
    * @param version - The endpoint API version.
+   * @param emulatorHost - Optional emulator host captured at init time.
    * @constructor
    */
-  constructor(protected app: App, protected version: string = 'v1') {
-    if (useEmulator()) {
+  constructor(protected app: App, protected version: string = 'v1', emHost?: string) {
+    if (emHost) {
       this.urlFormat = utils.formatString(FIREBASE_AUTH_EMULATOR_BASE_URL_FORMAT, {
-        host: emulatorHost()
+        host: emHost
       });
     } else {
       this.urlFormat = FIREBASE_AUTH_BASE_URL_FORMAT;
@@ -191,16 +192,17 @@ class TenantAwareAuthResourceUrlBuilder extends AuthResourceUrlBuilder {
   /**
    * The tenant aware resource URL builder constructor.
    *
-   * @param projectId - The resource project ID.
+   * @param app - The app for this URL builder.
    * @param version - The endpoint API version.
    * @param tenantId - The tenant ID.
+   * @param emHost - Optional emulator host captured at init time.
    * @constructor
    */
-  constructor(protected app: App, protected version: string, protected tenantId: string) {
-    super(app, version);
-    if (useEmulator()) {
+  constructor(protected app: App, protected version: string, protected tenantId: string, emHost?: string) {
+    super(app, version, emHost);
+    if (emHost) {
       this.urlFormat = utils.formatString(FIREBASE_AUTH_EMULATOR_TENANT_URL_FORMAT, {
-        host: emulatorHost()
+        host: emHost
       });
     } else {
       this.urlFormat = FIREBASE_AUTH_TENANT_URL_FORMAT;
@@ -229,8 +231,15 @@ class TenantAwareAuthResourceUrlBuilder extends AuthResourceUrlBuilder {
  */
 class AuthHttpClient extends AuthorizedHttpClient {
 
+  private readonly isEmulator: boolean;
+
+  constructor(app: FirebaseApp, isEmulator: boolean) {
+    super(app);
+    this.isEmulator = isEmulator;
+  }
+
   protected getToken(): Promise<string> {
-    if (useEmulator()) {
+    if (this.isEmulator) {
       return Promise.resolve('owner');
     }
 
@@ -1048,6 +1057,7 @@ const LIST_INBOUND_SAML_CONFIGS = new ApiSettings('/inboundSamlConfigs', 'GET')
 export abstract class AbstractAuthRequestHandler {
 
   protected readonly httpClient: AuthorizedHttpClient;
+  public readonly emulatorHostValue: string | undefined;
   private authUrlBuilder: AuthResourceUrlBuilder;
   private projectConfigUrlBuilder: AuthResourceUrlBuilder;
 
@@ -1102,17 +1112,21 @@ export abstract class AbstractAuthRequestHandler {
 
   /**
    * @param app - The app used to fetch access tokens to sign API requests.
+   * @param emHost - Optional emulator host override. When provided (including
+   *     null for explicitly no emulator), this value is used instead of reading
+   *     from the FIREBASE_AUTH_EMULATOR_HOST environment variable.
    * @constructor
    */
-  constructor(protected readonly app: App) {
+  constructor(protected readonly app: App, emHost?: string | null) {
     if (typeof app !== 'object' || app === null || !('options' in app)) {
       throw new FirebaseAuthError(
         authClientErrorCode.INVALID_ARGUMENT,
         'First argument passed to admin.auth() must be a valid Firebase app instance.',
       );
     }
 
-    this.httpClient = new AuthHttpClient(app as FirebaseApp);
+    this.emulatorHostValue = emHost !== undefined ? (emHost || undefined) : emulatorHost();
+    this.httpClient = new AuthHttpClient(app as FirebaseApp, !!this.emulatorHostValue);
   }
 
   /**
@@ -2021,6 +2035,11 @@ export abstract class AbstractAuthRequestHandler {
 /** Instantiates the getConfig endpoint settings. */
 const GET_PROJECT_CONFIG = new ApiSettings('/config', 'GET')
   .setResponseValidator((response: RequestResponse) => {
+    // The Auth emulator does not populate the resource `name` field on the
+    // project config response, so skip the assertion when running against it.
+    if (useEmulator()) {
+      return;
+    }
     const data = response.data;
     // Response should always contain at least the config name.
     if (!validator.isNonEmptyString(data?.name)) {
@@ -2035,6 +2054,11 @@ const GET_PROJECT_CONFIG = new ApiSettings('/config', 'GET')
 /** Instantiates the updateConfig endpoint settings. */
 const UPDATE_PROJECT_CONFIG = new ApiSettings('/config?updateMask={updateMask}', 'PATCH')
   .setResponseValidator((response: RequestResponse) => {
+    // The Auth emulator does not populate the resource `name` field on the
+    // project config response, so skip the assertion when running against it.
+    if (useEmulator()) {
+      return;
+    }
     const data = response.data;
     // Response should always contain at least the config name.
     if (!validator.isNonEmptyString(data?.name)) {
@@ -2135,21 +2159,21 @@ export class AuthRequestHandler extends AbstractAuthRequestHandler {
    */
   constructor(app: App) {
     super(app);
-    this.authResourceUrlBuilder = new AuthResourceUrlBuilder(app, 'v2');
+    this.authResourceUrlBuilder = new AuthResourceUrlBuilder(app, 'v2', this.emulatorHostValue);
   }
 
   /**
    * @returns A new Auth user management resource URL builder instance.
    */
   protected newAuthUrlBuilder(): AuthResourceUrlBuilder {
-    return new AuthResourceUrlBuilder(this.app, 'v1');
+    return new AuthResourceUrlBuilder(this.app, 'v1', this.emulatorHostValue);
   }
 
   /**
    * @returns A new project config resource URL builder instance.
    */
   protected newProjectConfigUrlBuilder(): AuthResourceUrlBuilder {
-    return new AuthResourceUrlBuilder(this.app, 'v2');
+    return new AuthResourceUrlBuilder(this.app, 'v2', this.emulatorHostValue);
   }
 
   /**
@@ -2306,24 +2330,25 @@ export class TenantAwareAuthRequestHandler extends AbstractAuthRequestHandler {
    *
    * @param app - The app used to fetch access tokens to sign API requests.
    * @param tenantId - The request handler's tenant ID.
+   * @param emHost - Optional emulator host override captured at init time.
    * @constructor
    */
-  constructor(app: App, private readonly tenantId: string) {
-    super(app);
+  constructor(app: App, private readonly tenantId: string, emHost?: string | null) {
+    super(app, emHost);
   }
 
   /**
    * @returns A new Auth user management resource URL builder instance.
    */
   protected newAuthUrlBuilder(): AuthResourceUrlBuilder {
-    return new TenantAwareAuthResourceUrlBuilder(this.app, 'v1', this.tenantId);
+    return new TenantAwareAuthResourceUrlBuilder(this.app, 'v1', this.tenantId, this.emulatorHostValue);
   }
 
   /**
    * @returns A new project config resource URL builder instance.
    */
   protected newProjectConfigUrlBuilder(): AuthResourceUrlBuilder {
-    return new TenantAwareAuthResourceUrlBuilder(this.app, 'v2', this.tenantId);
+    return new TenantAwareAuthResourceUrlBuilder(this.app, 'v2', this.tenantId, this.emulatorHostValue);
   }
 
   /**

src/auth/auth-config.ts

@@ -231,7 +231,43 @@ export interface UserProvider {
  * Interface representing the properties to set on a new user record to be
  * created.
  */
-export interface CreateRequest extends UpdateRequest {
+export interface CreateRequest {
+
+  /**
+   * Whether or not the user is disabled: `true` for disabled;
+   * `false` for enabled.
+   */
+  disabled?: boolean;
+
+  /**
+   * The user's display name.
+   */
+  displayName?: string;
+
+  /**
+   * The user's primary email.
+   */
+  email?: string;
+
+  /**
+   * Whether or not the user's primary email is verified.
+   */
+  emailVerified?: boolean;
+
+  /**
+   * The user's unhashed password.
+   */
+  password?: string;
+
+  /**
+   * The user's primary phone number.
+   */
+  phoneNumber?: string;
+
+  /**
+   * The user's photo URL.
+   */
+  photoURL?: string;
 
   /**
    * The user's `uid`.

src/auth/base-auth.ts

@@ -117,9 +117,10 @@ export interface SessionCookieOptions {
  * @internal
  */
 export function createFirebaseTokenGenerator(app: App,
-  tenantId?: string): FirebaseTokenGenerator {
+  tenantId?: string, isEmulator?: boolean): FirebaseTokenGenerator {
   try {
-    const signer = useEmulator() ? new EmulatedSigner() : cryptoSignerFromApp(app);
+    const shouldEmulate = isEmulator !== undefined ? isEmulator : useEmulator();
+    const signer = shouldEmulate ? new EmulatedSigner() : cryptoSignerFromApp(app);
     return new FirebaseTokenGenerator(signer, tenantId);
   } catch (err) {
     throw handleCryptoSignerError(err);
@@ -139,6 +140,7 @@ export abstract class BaseAuth {
   protected readonly authBlockingTokenVerifier: FirebaseTokenVerifier;
   /** @internal */
   protected readonly sessionCookieVerifier: FirebaseTokenVerifier;
+  private readonly emulatorMode: boolean;
 
   /**
    * The BaseAuth class constructor.
@@ -155,6 +157,8 @@ export abstract class BaseAuth {
     app: App,
     /** @internal */ protected readonly authRequestHandler: AbstractAuthRequestHandler,
     tokenGenerator?: FirebaseTokenGenerator) {
+    this.emulatorMode = !!this.authRequestHandler.emulatorHostValue;
+
     if (tokenGenerator) {
       this.tokenGenerator = tokenGenerator;
     } else {
@@ -211,7 +215,7 @@ export abstract class BaseAuth {
    *   promise.
    */
   public verifyIdToken(idToken: string, checkRevoked = false): Promise<DecodedIdToken> {
-    const isEmulator = useEmulator();
+    const isEmulator = this.emulatorMode;
     return this.idTokenVerifier.verifyJWT(idToken, isEmulator)
       .then((decodedIdToken: DecodedIdToken) => {
         // Whether to check if the token was revoked.
@@ -717,7 +721,7 @@ export abstract class BaseAuth {
    */
   public verifySessionCookie(
     sessionCookie: string, checkRevoked = false): Promise<DecodedIdToken> {
-    const isEmulator = useEmulator();
+    const isEmulator = this.emulatorMode;
     return this.sessionCookieVerifier.verifyJWT(sessionCookie, isEmulator)
       .then((decodedIdToken: DecodedIdToken) => {
         // Whether to check if the token was revoked.
@@ -1095,10 +1099,10 @@ export abstract class BaseAuth {
   /** @alpha */
   // eslint-disable-next-line @typescript-eslint/naming-convention
   public _verifyAuthBlockingToken(
-    token: string,  
+    token: string,
     audience?: string
   ): Promise<DecodedAuthBlockingToken> {
-    const isEmulator = useEmulator();
+    const isEmulator = this.emulatorMode;
     return this.authBlockingTokenVerifier._verifyAuthBlockingToken(token, isEmulator, audience)
       .then((decodedAuthBlockingToken: DecodedAuthBlockingToken) => {
         return decodedAuthBlockingToken;

src/auth/tenant-manager.ts

@@ -76,12 +76,15 @@ export class TenantAwareAuth extends BaseAuth {
    *
    * @param app - The app that created this tenant.
    * @param tenantId - The corresponding tenant ID.
+   * @param emHost - Optional emulator host captured at init time.
    * @constructor
    * @internal
    */
-  constructor(app: App, tenantId: string) {
+  constructor(app: App, tenantId: string, emHost?: string | null) {
+    const emIsSet = emHost !== undefined;
     super(app, new TenantAwareAuthRequestHandler(
-      app, tenantId), createFirebaseTokenGenerator(app, tenantId));
+      app, tenantId, emHost), createFirebaseTokenGenerator(
+      app, tenantId, emIsSet ? !!emHost : undefined));
     utils.addReadonlyGetter(this, 'tenantId', tenantId);
   }
 
@@ -148,6 +151,7 @@ export class TenantAwareAuth extends BaseAuth {
 export class TenantManager {
   private readonly authRequestHandler: AuthRequestHandler;
   private readonly tenantsMap: {[key: string]: TenantAwareAuth};
+  private readonly emulatorHost: string | undefined;
 
   /**
    * Initializes a TenantManager instance for a specified FirebaseApp.
@@ -159,6 +163,7 @@ export class TenantManager {
    */
   constructor(private readonly app: App) {
     this.authRequestHandler = new AuthRequestHandler(app);
+    this.emulatorHost = this.authRequestHandler.emulatorHostValue;
     this.tenantsMap = {};
   }
 
@@ -174,7 +179,7 @@ export class TenantManager {
       throw new FirebaseAuthError(authClientErrorCode.INVALID_TENANT_ID);
     }
     if (typeof this.tenantsMap[tenantId] === 'undefined') {
-      this.tenantsMap[tenantId] = new TenantAwareAuth(this.app, tenantId);
+      this.tenantsMap[tenantId] = new TenantAwareAuth(this.app, tenantId, this.emulatorHost ?? null);
     }
     return this.tenantsMap[tenantId];
   }