fix(auth, android): handle null id-tokens from google credential manager

Author: mikehardy

packages/auth/__tests__/auth.test.ts

@@ -413,6 +413,26 @@ describe('Auth', function () {
         expect(credential?.idToken).toBe('id-token');
       });
 
+      it('GoogleAuthProvider.credential maps id-token-only credentials for native bridge', function () {
+        const credential = GoogleAuthProvider.credential('google-id-token', null);
+        expect(credential.providerId).toBe('google.com');
+        expect(credential.signInMethod).toBe('google.com');
+        expect(credential.idToken).toBe('google-id-token');
+        expect(credential.accessToken).toBeUndefined();
+        expect(credential.token).toBe('google-id-token');
+        expect(credential.secret).toBe('');
+      });
+
+      it('GoogleAuthProvider.credential maps access-token-only credentials for native bridge', function () {
+        const credential = GoogleAuthProvider.credential(null, 'google-access-token');
+        expect(credential.providerId).toBe('google.com');
+        expect(credential.signInMethod).toBe('google.com');
+        expect(credential.accessToken).toBe('google-access-token');
+        expect(credential.idToken).toBeUndefined();
+        expect(credential.token).toBe('');
+        expect(credential.secret).toBe('google-access-token');
+      });
+
       it('PhoneAuthCredential.fromJSON deserializes phone credentials', function () {
         const credential = PhoneAuthCredential.fromJSON({
           verificationId: 'vid',

packages/auth/android/src/main/java/io/invertase/firebase/auth/ReactNativeFirebaseAuthModule.java

@@ -2046,7 +2046,12 @@ private AuthCredential getCredentialForProvider(
       case "facebook.com":
         return FacebookAuthProvider.getCredential(authToken);
       case "google.com":
-        return GoogleAuthProvider.getCredential(authToken, authSecret);
+        // Firebase Android rejects empty tokens; id-token-only and access-token-only flows require
+        // null.
+        // https://firebase.google.com/docs/reference/android/com/google/firebase/auth/GoogleAuthProvider#getCredential(java.lang.String,java.lang.String)
+        String googleIdToken = (authToken == null || authToken.isEmpty()) ? null : authToken;
+        String googleAccessToken = (authSecret == null || authSecret.isEmpty()) ? null : authSecret;
+        return GoogleAuthProvider.getCredential(googleIdToken, googleAccessToken);
       case "twitter.com":
         return TwitterAuthProvider.getCredential(authToken, authSecret);
       case "github.com":

packages/auth/e2e/provider.e2e.js

@@ -236,6 +236,70 @@ describe('auth() -> Providers', function () {
             'At least one of ID token and access token must be non-null',
           );
         });
+
+        it('should accept id-token-only credentials (Credential Manager)', function () {
+          const { GoogleAuthProvider } = authModular;
+
+          const token = 'google-id-token-only';
+          const credential = GoogleAuthProvider.credential(token, null);
+          credential.providerId.should.equal('google.com');
+          credential.signInMethod.should.equal('google.com');
+          credential.token.should.equal(token);
+          credential.secret.should.equal('');
+          credential.idToken.should.equal(token);
+          should.equal(credential.accessToken, undefined);
+        });
+
+        it('should accept access-token-only credentials', function () {
+          const { GoogleAuthProvider } = authModular;
+
+          const accessToken = 'google-access-token-only';
+          const credential = GoogleAuthProvider.credential(null, accessToken);
+          credential.providerId.should.equal('google.com');
+          credential.signInMethod.should.equal('google.com');
+          credential.token.should.equal('');
+          credential.secret.should.equal(accessToken);
+          credential.accessToken.should.equal(accessToken);
+          should.equal(credential.idToken, undefined);
+        });
+
+        it('should reach Android native signInWithCredential for id-token-only Google credentials', async function () {
+          if (!Platform.android) {
+            this.skip();
+          }
+          const { getApp } = modular;
+          const { GoogleAuthProvider, signInWithCredential, getAuth } = authModular;
+          const defaultAuth = getAuth(getApp());
+          const credential = GoogleAuthProvider.credential('google-id-token-only-e2e', null);
+
+          try {
+            await signInWithCredential(defaultAuth, credential);
+            throw new Error('Did not error.');
+          } catch (error) {
+            error.code.should.be.a.String();
+            error.code.should.not.equal('auth/unknown');
+            String(error.message).should.not.match(/accessToken cannot be empty/i);
+          }
+        });
+
+        it('should reach Android native signInWithCredential for access-token-only Google credentials', async function () {
+          if (!Platform.android) {
+            this.skip();
+          }
+          const { getApp } = modular;
+          const { GoogleAuthProvider, signInWithCredential, getAuth } = authModular;
+          const defaultAuth = getAuth(getApp());
+          const credential = GoogleAuthProvider.credential(null, 'google-access-token-only-e2e');
+
+          try {
+            await signInWithCredential(defaultAuth, credential);
+            throw new Error('Did not error.');
+          } catch (error) {
+            error.code.should.be.a.String();
+            error.code.should.not.equal('auth/unknown');
+            String(error.message).should.not.match(/idToken cannot be empty/i);
+          }
+        });
       });
 
       describe('GOOGLE_SIGN_IN_METHOD', function () {