API reference: pyric/auth

Classes

ActionCodeURL

A parsed out-of-band action link. Mirrors firebase/auth’s ActionCodeURL.

Construct one only via ActionCodeURL.parseLink or parseActionCodeURL — upstream’s constructor is internal, and both entry points return null rather than throwing for a link that does not carry the required mode + oobCode.

Properties

Property	Modifier	Type	Description
`apiKey`	`readonly`	`string`	The project API key carried in the link, or `null`.
`code`	`readonly`	`string`	The out-of-band code — the bearer token the action-code consumers (`applyActionCode`, `confirmPasswordReset`, …) redeem.
`continueUrl`	`readonly`	`string`	Where to send the user after the action completes. URL-decoded. `null` when the link carried no `continueUrl`.
`languageCode`	`readonly`	`string`	BCP-47 language tag from the link’s `lang` param, or `null`.
`operation`	`readonly`	`string`	The normalized operation the code authorizes. One of ActionCodeOperation — NOT the raw `mode` param.
`tenantId`	`readonly`	`string`	Multi-tenant tenant id, or `null`. The sandbox does not model tenants, so this is always `null` on a sandbox-minted link — but a link produced elsewhere and parsed here round-trips it.

Methods

parseLink()

static parseLink(link: string): ActionCodeURL;

Parse an action link. Returns null — never throws — when the input is not a URL, carries no mode, carries an unrecognized mode, or carries no oobCode. Oracle-pinned (see the file docstring).

Parameters

Parameter	Type
`link`	`string`

Returns

ActionCodeURL

AuthCredential

Base auth credential. Mirrors firebase/auth’s abstract AuthCredential: an opaque token identifying a provider and the method used to sign in with it.

Concrete, not abstract, so instanceof AuthCredential narrowing and direct construction both work in consumer code. Upstream marks it abstract, but nothing in the modular surface constructs a bare AuthCredential — the providers’ static factories do.

Constructors

Constructor

new AuthCredential(providerId: string, signInMethod: string): AuthCredential;

Parameters

Parameter	Type
`providerId`	`string`
`signInMethod`	`string`

Returns

AuthCredential

Properties

Property	Modifier	Type	Description
`providerId`	`readonly`	`string`	Provider identifier (e.g. `'google.com'`, `'password'`).
`signInMethod`	`readonly`	`string`	Sign-in method identifier. Distinct from providerId: the `'password'` provider signs in via `'password'` OR `'emailLink'`.

Methods

toJSON()

toJSON(): Record<string, unknown>;

Serialize. Mirrors upstream’s AuthCredential.toJSON().

Returns

Record<string, unknown>

fromJSON()

static fromJSON(json: string | Record<string, unknown>): AuthCredential;

Deserialize a credential previously produced by toJSON. Returns null for input that isn’t a credential payload — matching upstream, which never throws here.

Parameters

Parameter	Type
`json`	`string` \| `Record`<`string`, `unknown`>

Returns

AuthCredential

EmailAuthCredential

Email/password (or email-link) credential. Mirrors firebase/auth’s EmailAuthCredential.

Carries the SECRET — which is the whole reason the linking and reauth families are decidable in the sandbox without a resolver (see the file docstring). The secret is password for the 'password' sign-in method and the email LINK for the 'emailLink' method.

_secret is deliberately non-enumerable: it must not leak into a JSON.stringify(cred) in host/log code. toJSON exposes it only for the round-trip upstream also supports.

Extends

AuthCredential

Constructors

Constructor

new EmailAuthCredential(
   email: string,
   secret: string,
   signInMethod?: string): EmailAuthCredential;

Parameters

Parameter	Type
`email`	`string`
`secret`	`string`
`signInMethod?`	`string`

Returns

EmailAuthCredential

Overrides

AuthCredential.constructor

Properties

Property	Modifier	Type	Description
`email`	`readonly`	`string`	The account this credential is for.
`providerId`	`readonly`	`string`	Provider identifier (e.g. `'google.com'`, `'password'`).
`signInMethod`	`readonly`	`string`	Sign-in method identifier. Distinct from providerId: the `'password'` provider signs in via `'password'` OR `'emailLink'`.

Accessors

emailLink

Get Signature

get emailLink(): string;

The email link carried by an 'emailLink'-method credential, else null.

Returns

string

password

Get Signature

get password(): string;

The password carried by a 'password'-method credential, else null.

Returns

string

Methods

toJSON()

toJSON(): Record<string, unknown>;

Serialize. Mirrors upstream’s AuthCredential.toJSON().

Returns

Record<string, unknown>

Overrides

AuthCredential.toJSON

fromJSON()

static fromJSON(json: string | Record<string, unknown>): AuthCredential;

Deserialize a credential previously produced by toJSON. Returns null for input that isn’t a credential payload — matching upstream, which never throws here.

Parameters

Parameter	Type
`json`	`string` \| `Record`<`string`, `unknown`>

Returns

AuthCredential

Inherited from

AuthCredential.fromJSON

EmailAuthProvider

Email + password provider — marker class, used as the providerId on email/password credentials.

Constructors

Constructor

new EmailAuthProvider(): EmailAuthProvider;

Returns

EmailAuthProvider

Properties

Property	Modifier	Type	Default value
`providerId`	`readonly`	`"password"`	`"password"`
`EMAIL_LINK_SIGN_IN_METHOD`	`readonly`	`"emailLink"`	`"emailLink"`
`EMAIL_PASSWORD_SIGN_IN_METHOD`	`readonly`	`"password"`	`"password"`
`PROVIDER_ID`	`readonly`	`"password"`	`"password"`

Methods

credential()

static credential(email: string, password: string): EmailAuthCredential;

Build an email/password credential. The credential CARRIES THE PASSWORD — which is what lets linkWithCredential and reauthenticateWithCredential actually verify it against the sandbox user DB, with no resolver and no mock. See credentials.ts.

Parameters

Parameter	Type
`email`	`string`
`password`	`string`

Returns

EmailAuthCredential

credentialWithLink()

static credentialWithLink(email: string, emailLink: string): EmailAuthCredential;

Build an email-LINK credential from a link the user received. Its secret is the link itself.

Parameters

Parameter	Type
`email`	`string`
`emailLink`	`string`

Returns

EmailAuthCredential

FacebookAuthProvider

Facebook OAuth provider.

Constructors

Constructor

new FacebookAuthProvider(): FacebookAuthProvider;

Returns

FacebookAuthProvider

Properties

Property	Modifier	Type	Default value
`providerId`	`readonly`	`"facebook.com"`	`"facebook.com"`
`FACEBOOK_SIGN_IN_METHOD`	`readonly`	`"facebook.com"`	`"facebook.com"`
`PROVIDER_ID`	`readonly`	`"facebook.com"`	`"facebook.com"`

Methods

addScope()

addScope(_scope: string): FacebookAuthProvider;

Parameters

Parameter	Type
`_scope`	`string`

Returns

FacebookAuthProvider

setCustomParameters()

setCustomParameters(_params: Record<string, unknown>): FacebookAuthProvider;

Parameters

Parameter	Type
`_params`	`Record`<`string`, `unknown`>

Returns

FacebookAuthProvider

credential()

static credential(accessToken: string): AuthCredential;

Parameters

Parameter	Type
`accessToken`	`string`

Returns

AuthCredential

credentialFromError()

static credentialFromError(_err: unknown): AuthCredential;

Parameters

Parameter	Type
`_err`	`unknown`

Returns

AuthCredential

credentialFromResult()

static credentialFromResult(result: UserCredential): AuthCredential;

Parameters

Parameter	Type
`result`	`UserCredential`

Returns

AuthCredential

GithubAuthProvider

GitHub OAuth provider.

Constructors

Constructor

new GithubAuthProvider(): GithubAuthProvider;

Returns

GithubAuthProvider

Properties

Property	Modifier	Type	Default value
`providerId`	`readonly`	`"github.com"`	`"github.com"`
`GITHUB_SIGN_IN_METHOD`	`readonly`	`"github.com"`	`"github.com"`
`PROVIDER_ID`	`readonly`	`"github.com"`	`"github.com"`

Methods

addScope()

addScope(_scope: string): GithubAuthProvider;

Parameters

Parameter	Type
`_scope`	`string`

Returns

GithubAuthProvider

setCustomParameters()

setCustomParameters(_params: Record<string, unknown>): GithubAuthProvider;

Parameters

Parameter	Type
`_params`	`Record`<`string`, `unknown`>

Returns

GithubAuthProvider

credential()

static credential(accessToken: string): AuthCredential;

Parameters

Parameter	Type
`accessToken`	`string`

Returns

AuthCredential

credentialFromError()

static credentialFromError(_err: unknown): AuthCredential;

Parameters

Parameter	Type
`_err`	`unknown`

Returns

AuthCredential

credentialFromResult()

static credentialFromResult(result: UserCredential): AuthCredential;

Parameters

Parameter	Type
`result`	`UserCredential`

Returns

AuthCredential

GoogleAuthProvider

Google OAuth provider. Sandbox marker; no real OAuth flow runs.

Constructors

Constructor

new GoogleAuthProvider(): GoogleAuthProvider;

Returns

GoogleAuthProvider

Properties

Property	Modifier	Type	Default value
`providerId`	`readonly`	`"google.com"`	`"google.com"`
`GOOGLE_SIGN_IN_METHOD`	`readonly`	`"google.com"`	`"google.com"`
`PROVIDER_ID`	`readonly`	`"google.com"`	`"google.com"`

Methods

addScope()

addScope(_scope: string): GoogleAuthProvider;

Parameters

Parameter	Type
`_scope`	`string`

Returns

GoogleAuthProvider

setCustomParameters()

setCustomParameters(_params: Record<string, unknown>): GoogleAuthProvider;

Parameters

Parameter	Type
`_params`	`Record`<`string`, `unknown`>

Returns

GoogleAuthProvider

credential()

static credential(idToken?: string, accessToken?: string): AuthCredential;

Construct a credential directly from an OAuth id_token / access_token. Sandbox accepts any string; opaque marker only.

Parameters

Parameter	Type
`idToken?`	`string`
`accessToken?`	`string`

Returns

AuthCredential

credentialFromError()

static credentialFromError(_err: unknown): AuthCredential;

Parameters

Parameter	Type
`_err`	`unknown`

Returns

AuthCredential

credentialFromResult()

static credentialFromResult(result: UserCredential): AuthCredential;

Parameters

Parameter	Type
`result`	`UserCredential`

Returns

AuthCredential

OAuthCredential

OAuth credential. Mirrors firebase/auth’s OAuthCredential.

Carries the IdP tokens the real flow would have obtained. The sandbox does NOT and cannot verify them — it is not the identity provider — so flows consuming one of these still resolve through the AuthFlowResolver / mockSignInResult seam. Keeping the tokens on the object anyway means a resolver implementation (a playground picker, a test fixture) can read whatever the caller passed.

Extends

AuthCredential

Constructors

Constructor

new OAuthCredential(
   providerId: string,
   signInMethod: string,
   tokens?: {
  accessToken?: string;
  idToken?: string;
  secret?: string;
}): OAuthCredential;

Parameters

Parameter	Type
`providerId`	`string`
`signInMethod`	`string`
`tokens?`	{ `accessToken?`: `string`; `idToken?`: `string`; `secret?`: `string`; }
`tokens.accessToken?`	`string`
`tokens.idToken?`	`string`
`tokens.secret?`	`string`

Returns

OAuthCredential

Overrides

AuthCredential.constructor

Properties

Property	Modifier	Type	Description
`accessToken?`	`readonly`	`string`	-
`idToken?`	`readonly`	`string`	-
`providerId`	`readonly`	`string`	Provider identifier (e.g. `'google.com'`, `'password'`).
`secret?`	`readonly`	`string`	-
`signInMethod`	`readonly`	`string`	Sign-in method identifier. Distinct from providerId: the `'password'` provider signs in via `'password'` OR `'emailLink'`.

Methods

toJSON()

toJSON(): Record<string, unknown>;

Serialize. Mirrors upstream’s AuthCredential.toJSON().

Returns

Record<string, unknown>

Overrides

AuthCredential.toJSON

fromJSON()

static fromJSON(json: string | Record<string, unknown>): AuthCredential;

Deserialize a credential previously produced by toJSON. Returns null for input that isn’t a credential payload — matching upstream, which never throws here.

Parameters

Parameter	Type
`json`	`string` \| `Record`<`string`, `unknown`>

Returns

AuthCredential

Inherited from

AuthCredential.fromJSON

OAuthProvider

Generic OAuth provider — constructed with a providerId so callers can target arbitrary OAuth IdPs (Twitter, Apple, etc.) that don’t have a dedicated class above.

Constructors

Constructor

new OAuthProvider(providerId: string): OAuthProvider;

Parameters

Parameter	Type
`providerId`	`string`

Returns

OAuthProvider

Properties

Property	Modifier	Type
`providerId`	`readonly`	`string`

Methods

addScope()

addScope(_scope: string): OAuthProvider;

Parameters

Parameter	Type
`_scope`	`string`

Returns

OAuthProvider

credential()

credential(args: {
  accessToken?: string;
  idToken?: string;
  rawNonce?: string;
}): AuthCredential;

Parameters

Parameter	Type
`args`	{ `accessToken?`: `string`; `idToken?`: `string`; `rawNonce?`: `string`; }
`args.accessToken?`	`string`
`args.idToken?`	`string`
`args.rawNonce?`	`string`

Returns

AuthCredential

setCustomParameters()

setCustomParameters(_params: Record<string, unknown>): OAuthProvider;

Parameters

Parameter	Type
`_params`	`Record`<`string`, `unknown`>

Returns

OAuthProvider

credentialFromError()

static credentialFromError(_err: unknown): AuthCredential;

Parameters

Parameter	Type
`_err`	`unknown`

Returns

AuthCredential

credentialFromResult()

static credentialFromResult(result: UserCredential): AuthCredential;

Parameters

Parameter	Type
`result`	`UserCredential`

Returns

AuthCredential

SAMLAuthProvider

SAML provider. Constructed with a provider id that MUST start with saml. — upstream enforces that prefix because the id is what routes an assertion to the right configured SAML IdP, and a typo there would silently target nothing.

A SAML sign-in has no client-constructible credential (the assertion comes from the IdP), which is why this class has no credential() factory — only the popup/redirect flows produce one, and in the sandbox those resolve through the AuthFlowResolver seam like every other federated provider.

Constructors

Constructor

new SAMLAuthProvider(providerId: string): SAMLAuthProvider;

Parameters

Parameter	Type
`providerId`	`string`

Returns

SAMLAuthProvider

Properties

Property	Modifier	Type
`providerId`	`readonly`	`string`

Methods

credentialFromError()

static credentialFromError(_err: unknown): AuthCredential;

Parameters

Parameter	Type
`_err`	`unknown`

Returns

AuthCredential

credentialFromResult()

static credentialFromResult(result: UserCredential): AuthCredential;

Parameters

Parameter	Type
`result`	`UserCredential`

Returns

AuthCredential

TwitterAuthProvider

Twitter (X) OAuth provider. A dedicated class rather than a generic OAuthProvider('twitter.com') because upstream ships one and consumer code imports it by name.

Twitter is the one OAuth 1.0a provider in the set, which is why its credential() takes a token AND a secret where the OAuth 2.0 providers take a single access token.

Constructors

Constructor

new TwitterAuthProvider(): TwitterAuthProvider;

Returns

TwitterAuthProvider

Properties

Property	Modifier	Type	Default value
`providerId`	`readonly`	`"twitter.com"`	`"twitter.com"`
`PROVIDER_ID`	`readonly`	`"twitter.com"`	`"twitter.com"`
`TWITTER_SIGN_IN_METHOD`	`readonly`	`"twitter.com"`	`"twitter.com"`

Methods

addScope()

addScope(_scope: string): TwitterAuthProvider;

Parameters

Parameter	Type
`_scope`	`string`

Returns

TwitterAuthProvider

setCustomParameters()

setCustomParameters(_params: Record<string, unknown>): TwitterAuthProvider;

Parameters

Parameter	Type
`_params`	`Record`<`string`, `unknown`>

Returns

TwitterAuthProvider

credential()

static credential(token: string, secret: string): AuthCredential;

Parameters

Parameter	Type
`token`	`string`
`secret`	`string`

Returns

AuthCredential

credentialFromError()

static credentialFromError(_err: unknown): AuthCredential;

Parameters

Parameter	Type
`_err`	`unknown`

Returns

AuthCredential

credentialFromResult()

static credentialFromResult(result: UserCredential): AuthCredential;

Parameters

Parameter	Type
`result`	`UserCredential`

Returns

AuthCredential

Interfaces

ActionCodeInfo

What checkActionCode returns. Mirror of firebase/auth’s ActionCodeInfo.

Properties

Property	Type	Description
`data`	{ `email?`: `string`; `multiFactorInfo?`: `null`; `previousEmail?`: `string`; }	-
`data.email?`	`string`	The account the code acts on.
`data.multiFactorInfo?`	`null`	-
`data.previousEmail?`	`string`	For `VERIFY_AND_CHANGE_EMAIL`: the address being moved AWAY from.
`operation`	`string`	One of ActionCodeOperation.

ActionCodeSettings

ActionCodeSettings — mirror of firebase/auth. The continue-URL contract for a mailed link.

Properties

Property	Type	Description
`android?`	{ `installApp?`: `boolean`; `minimumVersion?`: `string`; `packageName`: `string`; }	-
`android.installApp?`	`boolean`	-
`android.minimumVersion?`	`string`	-
`android.packageName`	`string`	-
`dynamicLinkDomain?`	`string`	Deprecated upstream alias of the Hosting link domain.
`handleCodeInApp?`	`boolean`	Handle the code inside the app rather than on the web widget. REQUIRED (`true`) for `sendSignInLinkToEmail`.
`iOS?`	{ `bundleId`: `string`; }	-
`iOS.bundleId`	`string`	-
`linkDomain?`	`string`	-
`url`	`string`	Where the link sends the user when they click it. REQUIRED.

AdditionalUserInfo

Per-provider extra data attached to a sign-in. Mirrors firebase/auth’s AdditionalUserInfo.

Properties

Property	Modifier	Type	Description
`isNewUser`	`readonly`	`boolean`	Was this credential produced by a sign-UP rather than a sign-IN?
`profile`	`readonly`	`Record`<`string`, `unknown`>	IdP-specific profile blob. Empty object for the sandbox’s own providers — there is no real IdP behind them to return a profile.
`providerId`	`readonly`	`string`	The provider that authenticated this user, or `null` for the anonymous and custom-token paths (neither is a federated provider — see the `ProviderId` docstring in `enums.ts`).
`username?`	`readonly`	`string`	Present only for GitHub / Twitter.

Auth

Hidden brand on every Auth handle. Carries its owning sandbox target. Consumers don’t read it.

Properties

Property	Modifier	Type	Description
`[TARGET_SYMBOL]`	`readonly`	`SandboxTarget`	Internal — identifies the owning sandbox backend.
`app?`	`readonly`	`FirebaseApp`	-
`currentUser`	`readonly`	`User`	Currently signed-in user, or `null`. Snapshot value — read through `onAuthStateChanged` for live updates.

Methods

signOut()

signOut(): Promise<void>;

Sign the current user out. Method form of the free signOut(auth) function — firebase/auth’s Auth exposes both, so consumer code written as auth.signOut() works unchanged (AUTH-GAP).

Returns

Promise<void>

AuthFlowRequest

What a popup/redirect sign-in flow needs to know about the request. Mirrors the params firebase/auth hands its emulator widget (providerId, authType, scopes, customParameters — see upstream core/util/handler.ts), so a resolver implementation has the same inputs the real flow does.

Properties

Property	Type	Description
`authType`	`"signIn"` \| `"reauth"` \| `"link"`	Why the popup/redirect opened. v0 only drives `'signIn'`; the others exist for parity with reauth/link flows.
`customParameters?`	`Record`<`string`, `unknown`>	Provider custom parameters (`setCustomParameters`). Sandbox-opaque.
`providerId`	`string`	e.g. `'google.com'`, `'github.com'`, or a generic `OAuthProvider` id.
`scopes?`	`string`[]	OAuth scopes the provider requested (`addScope`). Sandbox-opaque.

AuthFlowResolver

Pluggable popup/redirect resolver — pyric’s analog of firebase/auth’s PopupRedirectResolver. The SDK stays UI-free and delegates the experience to whatever implements this: a playground modal, a headless test fixture, a CLI prompt. One resolver serves all three flows.

Configured the same three ways the upstream resolver is: passed per-call to signInWithPopup / signInWithRedirect, injected once via sandbox.setAuthFlowResolver (the analog of browser getAuth wiring browserPopupRedirectResolver), or installed implicitly as a one-shot by sandbox.mockSignInResult.

Implementations reject with auth/popup-closed-by-user when the user dismisses the experience — matches firebase/auth.

Methods

openPopup()

openPopup(req: AuthFlowRequest): Promise<UserCredential>;

Resolve a signInWithPopup flow to a credential.

Parameters

Parameter	Type
`req`	`AuthFlowRequest`

Returns

Promise<UserCredential>

openRedirect()

openRedirect(req: AuthFlowRequest): Promise<UserCredential>;

Resolve a signInWithRedirect flow. In a real browser the redirect navigates away and the credential surfaces on return; the sandbox has no navigation, so this resolves inline to the credential and the SDK stashes it for the next getRedirectResult.

Parameters

Parameter	Type
`req`	`AuthFlowRequest`

Returns

Promise<UserCredential>

AuthMailResolver

Notified for every message the sandbox’s auth mail server emits — the analog of AuthFlowResolver for the email family. A host (the playground) installs one to surface the link in its UI; a headless test reads AuthFlowRegistry.takeMail instead.

Advisory, not a gate: the message is written to the outbox whether or not a resolver is installed, because in this model the sandbox IS the mail server — the mail exists regardless of who is watching.

Methods

deliver()

deliver(mail: OutboundAuthMail): void;

Parameters

Parameter	Type
`mail`	`OutboundAuthMail`

Returns

void

AuthUserRecord

Public per-user record for the user-admin surface (sandbox.listUsers & co.) — emulator-REST-shaped (Identity Toolkit accounts:lookup field names, ISO timestamps).

Properties

Property	Type	Description
`createdAt`	`string`	ISO timestamp.
`customClaims`	`Record`<`string`, `unknown`>	-
`disabled`	`boolean`	-
`displayName`	`string`	-
`email`	`string`	-
`emailVerified`	`boolean`	-
`isAnonymous`	`boolean`	-
`lastLoginAt`	`string`	ISO timestamp, or null if the identity never signed in.
`phoneNumber`	`string`	-
`photoUrl`	`string`	-
`providerUserInfo`	`ProviderUserInfo`[]	-
`uid`	`string`	-

CreateUserRequest

sandbox.createUser request. Everything optional except that a password requires an email to be useful for sign-in.

Properties

Property	Type	Description
`customClaims?`	`Record`<`string`, `unknown`>	-
`disabled?`	`boolean`	-
`displayName?`	`string`	-
`email?`	`string`	-
`emailVerified?`	`boolean`	-
`password?`	`string`	-
`phoneNumber?`	`string`	-
`photoUrl?`	`string`	-
`providerUserInfo?`	`ProviderUserInfo`[]	Linked OAuth providers to create the user with (dedup by providerId; multiple providers per user are supported). Same rules as UpdateUserRequest.providerUserInfo: `password` is credential-derived (send `password` to link it) and `anonymous` is token-level — neither can be forged here.
`uid?`	`string`	Defaults to a generated `user-<N>` uid.

IdTokenResult

Result of getIdTokenResult(). Mirrors the firebase/auth shape.

On the sandbox backend token is an opaque sandbox-issued string with a recognizable prefix (sandbox-id-token-) — NOT a JWT and NOT cryptographically signed. claims echoes the user’s customClaims (from sandbox.seedUsers) plus a small set of synthesized standard claims (sub, aud, iss). Expiration is set far in the future since the sandbox has no refresh story.

Properties

Property	Type	Description
`authTime`	`string`	ISO string — when the user last signed in (not when the token was last refreshed).
`claims`	`Record`<`string`, `unknown`>	Custom + standard claims. Same map seen by the rules engine as `request.auth.token.*`.
`expirationTime`	`string`	ISO string. Sandbox: far-future.
`issuedAtTime`	`string`	ISO string.
`signInProvider?`	`string`	Provider of the current sign-in session — `'password'`, `'anonymous'`, `'google.com'`, etc., or `null` when unknown. Mirrors `firebase/auth`’s `IdTokenResult.signInProvider`; the sandbox synthesizes the same `firebase.sign_in_provider` claim. Optional (`?`) for now: external `User` implementations built before this field existed (the playground’s helper-minted users, until Track B’s lockstep swap lands) omit it. The sandbox backend always populates it. Tighten to required once all `User` minting is backend-owned.
`token`	`string`	Opaque sandbox token string: `sandbox-id-token-<uid>-<hash>`.

MintedSession

A minted per-connection session: the User plus the AuthState its data contexts should carry (sandbox.withAuth(state)).

Properties

Property	Type
`state`	{ `token?`: `Record`<`string`, `unknown`>; `uid`: `string`; }
`state.token?`	`Record`<`string`, `unknown`>
`state.uid`	`string`
`user`	`User`

OutboundAuthMail

One message the sandbox’s auth “mail server” emitted. Produced by every send-an-email API (sendSignInLinkToEmail, sendPasswordResetEmail, sendEmailVerification, verifyBeforeUpdateEmail).

─── Why a mailbox and not a stub ────────────────────────────────── The email family’s one genuinely unobservable step is the human opening an inbox and clicking a link. Production cannot be probed across that gap and neither can a test. What the sandbox does is make the gap CROSSABLE instead of pretending it isn’t there: the message, with its real out-of-band code and its real link, lands in an outbox the caller can read. sandbox.takeAuthMail(auth) is the program’s substitute for a human reading their mail — and the code in that message is the same code applyActionCode / signInWithEmailLink will accept, so the round trip really does close.

That is the same move mockSignInResult makes for OAuth: the sandbox does not fake the outcome of the external step, it hands you the seam where the external step’s result enters the system.

Properties

Property	Type	Description
`code`	`string`	The out-of-band code the recipient would redeem.
`email`	`string`	Recipient.
`link`	`string`	The full action link the message would contain — the exact string `signInWithEmailLink` / `parseActionCodeURL` accept.
`newEmail?`	`string`	For `VERIFY_AND_CHANGE_EMAIL`: the address being moved TO.
`operation`	`string`	The ActionCodeOperation this message authorizes.

PasswordPolicy

Mirror of firebase/auth’s PasswordPolicy.

Properties

Property	Modifier	Type	Description
`allowedNonAlphanumericCharacters`	`readonly`	`string`	-
`customStrengthOptions`	`readonly`	{ `containsLowercaseLetter?`: `boolean`; `containsNonAlphanumericCharacter?`: `boolean`; `containsNumericCharacter?`: `boolean`; `containsUppercaseLetter?`: `boolean`; `maxPasswordLength?`: `number`; `minPasswordLength?`: `number`; }	-
`customStrengthOptions.containsLowercaseLetter?`	`readonly`	`boolean`	-
`customStrengthOptions.containsNonAlphanumericCharacter?`	`readonly`	`boolean`	-
`customStrengthOptions.containsNumericCharacter?`	`readonly`	`boolean`	-
`customStrengthOptions.containsUppercaseLetter?`	`readonly`	`boolean`	-
`customStrengthOptions.maxPasswordLength?`	`readonly`	`number`	-
`customStrengthOptions.minPasswordLength?`	`readonly`	`number`	-
`enforcementState`	`readonly`	`string`	`'ENFORCE'` or `'OFF'`.
`forceUpgradeOnSignin`	`readonly`	`boolean`	-

PasswordValidationStatus

Mirror of firebase/auth’s PasswordValidationStatus.

Properties

Property	Modifier	Type
`containsLowercaseLetter?`	`readonly`	`boolean`
`containsNonAlphanumericCharacter?`	`readonly`	`boolean`
`containsNumericCharacter?`	`readonly`	`boolean`
`containsUppercaseLetter?`	`readonly`	`boolean`
`isValid`	`readonly`	`boolean`
`meetsMaxPasswordLength?`	`readonly`	`boolean`
`meetsMinPasswordLength?`	`readonly`	`boolean`
`passwordPolicy`	`readonly`	`PasswordPolicy`

Persistence

Opaque marker for setPersistence. The sandbox records the selected session storage mode from the type field.

'COOKIE' is upstream’s fourth type (browserCookiePersistence, for SSR) — the union matches firebase/auth’s Persistence.type exactly.

Properties

Property	Modifier	Type
`type`	`readonly`	`"NONE"` \| `"SESSION"` \| `"LOCAL"` \| `"COOKIE"`

ProviderUserInfo

One linked provider on a stored user. Emulator-shaped (the Identity Toolkit providerUserInfo array) — an array rather than a single string so account linking can extend it later.

Properties

Property	Type
`providerId`	`string`

SeedUser

Properties

Property	Type	Description
`customClaims?`	`Record`<`string`, `unknown`>	-
`displayName?`	`string`	-
`email`	`string`	-
`password`	`string`	-
`providerId?`	`string`	Originating provider for this identity (e.g. `'google.com'`). Defaults to `'password'` — the natural provider for a record seeded with an email + password. A host seeding popup-flow identities passes the real provider so `listIdentities` / `IdTokenResult.signInProvider` label them correctly.
`uid`	`string`	-

SignInIdentitySpec

“Add account” field set for SandboxBackend.createSignInCredential — mirrors the emulator’s add-user form (customAttributes → customClaims).

Properties

Property	Type	Description
`customClaims?`	`Record`<`string`, `unknown`>	-
`displayName?`	`string`	-
`email`	`string`	-
`uid?`	`string`	Defaults to an opaque generated uid.

UpdateUserRequest

sandbox.updateUser request — undefined fields are left untouched; displayName: null clears it. customClaims replaces the whole map (admin setCustomUserClaims semantics).

Properties

Property	Type	Description
`customClaims?`	`Record`<`string`, `unknown`>	-
`disabled?`	`boolean`	-
`displayName?`	`string`	-
`email?`	`string`	-
`emailVerified?`	`boolean`	-
`password?`	`string`	-
`providerUserInfo?`	`ProviderUserInfo`[]	REPLACES the user’s linked OAuth providers (dedup by providerId; multiple providers per user are supported — the record’s `providerUserInfo` is an array precisely for account linking). The `password` entry is credential-derived and managed by the backend: it survives the replacement while the user has a password and cannot be linked through this field; `anonymous` is a token-level provider, never a linked entry.

User

The signed-in user. Subset of firebase/auth’s User interface containing the fields the sandbox can synthesize faithfully.

The heavier User surface the sandbox does NOT model (metadata, refreshToken, tenantId, reload(), delete(), toJSON()) is intentionally not synthesized; its absence remains visible in the public type census rather than being hidden behind placeholder values.

Properties

Property	Modifier	Type	Description
`displayName`	`readonly`	`string`	Display name, or `null` if none.
`email`	`readonly`	`string`	Email address, or `null` for anonymous users / providers that didn’t supply one.
`emailVerified?`	`readonly`	`boolean`	Whether the email has been verified. Sandbox: `false` unless the seeded/mock user set it (no verification flow). Optional on the type so host helpers that synthesize a partial `User` aren’t forced to specify it; the sandbox backend always populates it.
`isAnonymous`	`readonly`	`boolean`	True iff this user signed in via `signInAnonymously`.
`phoneNumber?`	`readonly`	`string`	E.164 phone number, or `null`. Optional on the type; always populated by the sandbox backend.
`photoURL?`	`readonly`	`string`	Profile photo URL, or `null`. Optional on the type (see emailVerified); always populated by the sandbox backend.
`providerData?`	`readonly`	`UserInfo`[]	One UserInfo per linked provider. Sandbox synthesizes a single entry from the user’s own fields for non-anonymous users; empty for anonymous. Optional on the type; always populated by the sandbox backend.
`providerId?`	`readonly`	`string`	The aggregate provider id (`'firebase'` for a real `User`; per-provider ids live in providerData). Optional on the type; always populated by the sandbox backend.
`uid`	`readonly`	`string`	Firebase UID — globally unique per project. Sandbox: minted by `signInAnonymously` or supplied via `seedUsers`.

Methods

getIdToken()

getIdToken(forceRefresh?: boolean): Promise<string>;

Get the user’s ID token, refreshing it if needed.

Sandbox: returns the cached opaque token; with forceRefresh: true mints a fresh token, caches it, and fires onIdTokenChanged listeners (matches prod — oracle: packages/conformance/observations/auth/auth-getidtoken-force-refresh.json and …/auth-onidtokenchanged-force-refresh.json).

Parameters

Parameter	Type
`forceRefresh?`	`boolean`

Returns

Promise<string>

getIdTokenResult()

getIdTokenResult(forceRefresh?: boolean): Promise<IdTokenResult>;

Get the full ID token + claims. See IdTokenResult.

Parameters

Parameter	Type
`forceRefresh?`	`boolean`

Returns

Promise<IdTokenResult>

UserCredential

Result of every sign-in method. Mirrors firebase/auth.

operationType discriminates what produced it: 'signIn' for a fresh sign-in (including createUserWithEmailAndPassword — oracle-pinned), 'link' for linkWith*, 'reauthenticate' for reauthenticateWith*.

Properties

Property	Type
`operationType`	`"signIn"` \| `"link"` \| `"reauthenticate"`
`providerId`	`string`
`user`	`User`

UserInfo

Per-provider profile info — mirror of firebase/auth’s UserInfo. Each entry in User.providerData describes one linked provider.

Properties

Property	Modifier	Type	Description
`displayName`	`readonly`	`string`	Display name from this provider, or `null`.
`email`	`readonly`	`string`	Email from this provider, or `null`.
`phoneNumber`	`readonly`	`string`	E.164 phone number from this provider, or `null`.
`photoURL`	`readonly`	`string`	Profile photo URL from this provider, or `null`.
`providerId`	`readonly`	`string`	Provider id (e.g. `'password'`, `'google.com'`).
`uid`	`readonly`	`string`	The user’s id as known to this provider.

Type Aliases

ActionCodeOperation

type ActionCodeOperation = typeof ActionCodeOperation[keyof typeof ActionCodeOperation];

AppAuth

type AppAuth = Auth & {
  app: FirebaseApp;
};

Auth handle returned by Firebase-shaped app overloads.

Type Declaration

app

readonly app: FirebaseApp;

AuthErrorMap()

type AuthErrorMap = () => Record<string, string>;

An error map — upstream’s AuthErrorMap. Passed to initializeAuth to control how much detail a thrown FirebaseError carries.

Returns

Record<string, string>

AuthObserver

type AuthObserver =
  | (user: User | null) => void
  | {
  complete?: () => void;
  error?: (err: Error) => void;
  next?: (user: User | null) => void;
};

Observer shape accepted by onAuthStateChanged / onIdTokenChanged. Mirrors firebase/auth’s NextOrObserver<User | null>.

AuthProvider

type AuthProvider =
  | GoogleAuthProvider
  | FacebookAuthProvider
  | GithubAuthProvider
  | OAuthProvider
  | {
  providerId: string;
};

Union of all supported provider instance shapes. Used in the signInWithPopup / signInWithRedirect overloads (the latter is out of scope but the type makes the surface consistent).

FederatedProviderId

type FederatedProviderId = typeof FEDERATED_PROVIDER_IDS[number];

One of the first-class federated provider ids (FEDERATED_PROVIDER_IDS).

MintSessionRequest

type MintSessionRequest =
  | {
  kind: "anonymous";
}
  | {
  email: string;
  kind: "password";
  password: string;
}
  | {
  email: string;
  kind: "createPassword";
  password: string;
}
  | {
  kind: "uid";
  uid: string;
};

Request for SandboxBackend.mintDetachedSession — one variant per client sign-in shape, plus uid for existing identities (session restore, provider-bridge accept).

OperationType

type OperationType = typeof OperationType[keyof typeof OperationType];

ProviderId

type ProviderId = typeof ProviderId[keyof typeof ProviderId];

SignInMethod

type SignInMethod = typeof SignInMethod[keyof typeof SignInMethod];

Unsubscribe()

type Unsubscribe = () => void;

Returned by onAuthStateChanged / onIdTokenChanged.

Returns

void

Variables

ActionCodeOperation

const ActionCodeOperation: {
  EMAIL_SIGNIN: "EMAIL_SIGNIN";
  PASSWORD_RESET: "PASSWORD_RESET";
  RECOVER_EMAIL: "RECOVER_EMAIL";
  REVERT_SECOND_FACTOR_ADDITION: "REVERT_SECOND_FACTOR_ADDITION";
  VERIFY_AND_CHANGE_EMAIL: "VERIFY_AND_CHANGE_EMAIL";
  VERIFY_EMAIL: "VERIFY_EMAIL";
};

The operation an out-of-band action code authorizes. Mirrors firebase/auth’s ActionCodeOperation — the value ActionCodeURL.operation carries and checkActionCode returns.

These are the SDK’s normalized names, not the mode query param that appears in the link: a link carrying mode=resetPassword parses to operation 'PASSWORD_RESET', and mode=signIn parses to 'EMAIL_SIGNIN'. Oracle: observations/auth/auth-actioncodeurl-parse.json captured both mappings against firebase-js-sdk 12.13.0.

Type Declaration

EMAIL_SIGNIN

readonly EMAIL_SIGNIN: "EMAIL_SIGNIN";

PASSWORD_RESET

readonly PASSWORD_RESET: "PASSWORD_RESET";

RECOVER_EMAIL

readonly RECOVER_EMAIL: "RECOVER_EMAIL";

REVERT_SECOND_FACTOR_ADDITION

readonly REVERT_SECOND_FACTOR_ADDITION: "REVERT_SECOND_FACTOR_ADDITION";

VERIFY_AND_CHANGE_EMAIL

readonly VERIFY_AND_CHANGE_EMAIL: "VERIFY_AND_CHANGE_EMAIL";

VERIFY_EMAIL

readonly VERIFY_EMAIL: "VERIFY_EMAIL";

AuthErrorCodes

const AuthErrorCodes: {
  ADMIN_ONLY_OPERATION: "auth/admin-restricted-operation";
  ALREADY_INITIALIZED: "auth/already-initialized";
  APP_NOT_AUTHORIZED: "auth/app-not-authorized";
  APP_NOT_INSTALLED: "auth/app-not-installed";
  ARGUMENT_ERROR: "auth/argument-error";
  CAPTCHA_CHECK_FAILED: "auth/captcha-check-failed";
  CODE_EXPIRED: "auth/code-expired";
  CORDOVA_NOT_READY: "auth/cordova-not-ready";
  CORS_UNSUPPORTED: "auth/cors-unsupported";
  CREDENTIAL_ALREADY_IN_USE: "auth/credential-already-in-use";
  CREDENTIAL_MISMATCH: "auth/custom-token-mismatch";
  CREDENTIAL_TOO_OLD_LOGIN_AGAIN: "auth/requires-recent-login";
  DEPENDENT_SDK_INIT_BEFORE_AUTH: "auth/dependent-sdk-initialized-before-auth";
  DYNAMIC_LINK_NOT_ACTIVATED: "auth/dynamic-link-not-activated";
  EMAIL_CHANGE_NEEDS_VERIFICATION: "auth/email-change-needs-verification";
  EMAIL_EXISTS: "auth/email-already-in-use";
  EMULATOR_CONFIG_FAILED: "auth/emulator-config-failed";
  EXPIRED_OOB_CODE: "auth/expired-action-code";
  EXPIRED_POPUP_REQUEST: "auth/cancelled-popup-request";
  INTERNAL_ERROR: "auth/internal-error";
  INVALID_API_KEY: "auth/invalid-api-key";
  INVALID_APP_CREDENTIAL: "auth/invalid-app-credential";
  INVALID_APP_ID: "auth/invalid-app-id";
  INVALID_AUTH: "auth/invalid-user-token";
  INVALID_AUTH_EVENT: "auth/invalid-auth-event";
  INVALID_CERT_HASH: "auth/invalid-cert-hash";
  INVALID_CODE: "auth/invalid-verification-code";
  INVALID_CONTINUE_URI: "auth/invalid-continue-uri";
  INVALID_CORDOVA_CONFIGURATION: "auth/invalid-cordova-configuration";
  INVALID_CUSTOM_TOKEN: "auth/invalid-custom-token";
  INVALID_DYNAMIC_LINK_DOMAIN: "auth/invalid-dynamic-link-domain";
  INVALID_EMAIL: "auth/invalid-email";
  INVALID_EMULATOR_SCHEME: "auth/invalid-emulator-scheme";
  INVALID_HOSTING_LINK_DOMAIN: "auth/invalid-hosting-link-domain";
  INVALID_IDP_RESPONSE: "auth/invalid-credential";
  INVALID_LOGIN_CREDENTIALS: "auth/invalid-credential";
  INVALID_MESSAGE_PAYLOAD: "auth/invalid-message-payload";
  INVALID_MFA_SESSION: "auth/invalid-multi-factor-session";
  INVALID_OAUTH_CLIENT_ID: "auth/invalid-oauth-client-id";
  INVALID_OAUTH_PROVIDER: "auth/invalid-oauth-provider";
  INVALID_OOB_CODE: "auth/invalid-action-code";
  INVALID_ORIGIN: "auth/unauthorized-domain";
  INVALID_PASSWORD: "auth/wrong-password";
  INVALID_PERSISTENCE: "auth/invalid-persistence-type";
  INVALID_PHONE_NUMBER: "auth/invalid-phone-number";
  INVALID_PROVIDER_ID: "auth/invalid-provider-id";
  INVALID_RECAPTCHA_ACTION: "auth/invalid-recaptcha-action";
  INVALID_RECAPTCHA_TOKEN: "auth/invalid-recaptcha-token";
  INVALID_RECAPTCHA_VERSION: "auth/invalid-recaptcha-version";
  INVALID_RECIPIENT_EMAIL: "auth/invalid-recipient-email";
  INVALID_REQ_TYPE: "auth/invalid-req-type";
  INVALID_SENDER: "auth/invalid-sender";
  INVALID_SESSION_INFO: "auth/invalid-verification-id";
  INVALID_TENANT_ID: "auth/invalid-tenant-id";
  MFA_INFO_NOT_FOUND: "auth/multi-factor-info-not-found";
  MFA_REQUIRED: "auth/multi-factor-auth-required";
  MISSING_ANDROID_PACKAGE_NAME: "auth/missing-android-pkg-name";
  MISSING_APP_CREDENTIAL: "auth/missing-app-credential";
  MISSING_AUTH_DOMAIN: "auth/auth-domain-config-required";
  MISSING_CLIENT_TYPE: "auth/missing-client-type";
  MISSING_CODE: "auth/missing-verification-code";
  MISSING_CONTINUE_URI: "auth/missing-continue-uri";
  MISSING_IFRAME_START: "auth/missing-iframe-start";
  MISSING_IOS_BUNDLE_ID: "auth/missing-ios-bundle-id";
  MISSING_MFA_INFO: "auth/missing-multi-factor-info";
  MISSING_MFA_SESSION: "auth/missing-multi-factor-session";
  MISSING_OR_INVALID_NONCE: "auth/missing-or-invalid-nonce";
  MISSING_PASSWORD: "auth/missing-password";
  MISSING_PHONE_NUMBER: "auth/missing-phone-number";
  MISSING_RECAPTCHA_TOKEN: "auth/missing-recaptcha-token";
  MISSING_RECAPTCHA_VERSION: "auth/missing-recaptcha-version";
  MISSING_SESSION_INFO: "auth/missing-verification-id";
  MODULE_DESTROYED: "auth/app-deleted";
  NEED_CONFIRMATION: "auth/account-exists-with-different-credential";
  NETWORK_REQUEST_FAILED: "auth/network-request-failed";
  NO_AUTH_EVENT: "auth/no-auth-event";
  NO_SUCH_PROVIDER: "auth/no-such-provider";
  NULL_USER: "auth/null-user";
  OPERATION_NOT_ALLOWED: "auth/operation-not-allowed";
  OPERATION_NOT_SUPPORTED: "auth/operation-not-supported-in-this-environment";
  POPUP_BLOCKED: "auth/popup-blocked";
  POPUP_CLOSED_BY_USER: "auth/popup-closed-by-user";
  PROVIDER_ALREADY_LINKED: "auth/provider-already-linked";
  QUOTA_EXCEEDED: "auth/quota-exceeded";
  RECAPTCHA_NOT_ENABLED: "auth/recaptcha-not-enabled";
  REDIRECT_CANCELLED_BY_USER: "auth/redirect-cancelled-by-user";
  REDIRECT_OPERATION_PENDING: "auth/redirect-operation-pending";
  REJECTED_CREDENTIAL: "auth/rejected-credential";
  SECOND_FACTOR_ALREADY_ENROLLED: "auth/second-factor-already-in-use";
  SECOND_FACTOR_LIMIT_EXCEEDED: "auth/maximum-second-factor-count-exceeded";
  TENANT_ID_MISMATCH: "auth/tenant-id-mismatch";
  TIMEOUT: "auth/timeout";
  TOKEN_EXPIRED: "auth/user-token-expired";
  TOO_MANY_ATTEMPTS_TRY_LATER: "auth/too-many-requests";
  UNAUTHORIZED_DOMAIN: "auth/unauthorized-continue-uri";
  UNSUPPORTED_FIRST_FACTOR: "auth/unsupported-first-factor";
  UNSUPPORTED_PERSISTENCE: "auth/unsupported-persistence-type";
  UNSUPPORTED_TENANT_OPERATION: "auth/unsupported-tenant-operation";
  UNVERIFIED_EMAIL: "auth/unverified-email";
  USER_CANCELLED: "auth/user-cancelled";
  USER_DELETED: "auth/user-not-found";
  USER_DISABLED: "auth/user-disabled";
  USER_MISMATCH: "auth/user-mismatch";
  USER_SIGNED_OUT: "auth/user-signed-out";
  WEAK_PASSWORD: "auth/weak-password";
  WEB_STORAGE_UNSUPPORTED: "auth/web-storage-unsupported";
};

The full auth/* error-code map, captured verbatim from Firebase Auth 12.13.0. The oracle suite pins representative values and the total count.

Type Declaration

ADMIN_ONLY_OPERATION

readonly ADMIN_ONLY_OPERATION: "auth/admin-restricted-operation";

ALREADY_INITIALIZED

readonly ALREADY_INITIALIZED: "auth/already-initialized";

APP_NOT_AUTHORIZED

readonly APP_NOT_AUTHORIZED: "auth/app-not-authorized";

APP_NOT_INSTALLED

readonly APP_NOT_INSTALLED: "auth/app-not-installed";

ARGUMENT_ERROR

readonly ARGUMENT_ERROR: "auth/argument-error";

CAPTCHA_CHECK_FAILED

readonly CAPTCHA_CHECK_FAILED: "auth/captcha-check-failed";

CODE_EXPIRED

readonly CODE_EXPIRED: "auth/code-expired";

CORDOVA_NOT_READY

readonly CORDOVA_NOT_READY: "auth/cordova-not-ready";

CORS_UNSUPPORTED

readonly CORS_UNSUPPORTED: "auth/cors-unsupported";

CREDENTIAL_ALREADY_IN_USE

readonly CREDENTIAL_ALREADY_IN_USE: "auth/credential-already-in-use";

CREDENTIAL_MISMATCH

readonly CREDENTIAL_MISMATCH: "auth/custom-token-mismatch";

CREDENTIAL_TOO_OLD_LOGIN_AGAIN

readonly CREDENTIAL_TOO_OLD_LOGIN_AGAIN: "auth/requires-recent-login";

DEPENDENT_SDK_INIT_BEFORE_AUTH

readonly DEPENDENT_SDK_INIT_BEFORE_AUTH: "auth/dependent-sdk-initialized-before-auth";

DYNAMIC_LINK_NOT_ACTIVATED

readonly DYNAMIC_LINK_NOT_ACTIVATED: "auth/dynamic-link-not-activated";

EMAIL_CHANGE_NEEDS_VERIFICATION

readonly EMAIL_CHANGE_NEEDS_VERIFICATION: "auth/email-change-needs-verification";

EMAIL_EXISTS

readonly EMAIL_EXISTS: "auth/email-already-in-use";

EMULATOR_CONFIG_FAILED

readonly EMULATOR_CONFIG_FAILED: "auth/emulator-config-failed";

EXPIRED_OOB_CODE

readonly EXPIRED_OOB_CODE: "auth/expired-action-code";

EXPIRED_POPUP_REQUEST

readonly EXPIRED_POPUP_REQUEST: "auth/cancelled-popup-request";

INTERNAL_ERROR

readonly INTERNAL_ERROR: "auth/internal-error";

INVALID_API_KEY

readonly INVALID_API_KEY: "auth/invalid-api-key";

INVALID_APP_CREDENTIAL

readonly INVALID_APP_CREDENTIAL: "auth/invalid-app-credential";

INVALID_APP_ID

readonly INVALID_APP_ID: "auth/invalid-app-id";

INVALID_AUTH

readonly INVALID_AUTH: "auth/invalid-user-token";

INVALID_AUTH_EVENT

readonly INVALID_AUTH_EVENT: "auth/invalid-auth-event";

INVALID_CERT_HASH

readonly INVALID_CERT_HASH: "auth/invalid-cert-hash";

INVALID_CODE

readonly INVALID_CODE: "auth/invalid-verification-code";

INVALID_CONTINUE_URI

readonly INVALID_CONTINUE_URI: "auth/invalid-continue-uri";

INVALID_CORDOVA_CONFIGURATION

readonly INVALID_CORDOVA_CONFIGURATION: "auth/invalid-cordova-configuration";

INVALID_CUSTOM_TOKEN

readonly INVALID_CUSTOM_TOKEN: "auth/invalid-custom-token";

INVALID_DYNAMIC_LINK_DOMAIN

readonly INVALID_DYNAMIC_LINK_DOMAIN: "auth/invalid-dynamic-link-domain";

INVALID_EMAIL

readonly INVALID_EMAIL: "auth/invalid-email";

INVALID_EMULATOR_SCHEME

readonly INVALID_EMULATOR_SCHEME: "auth/invalid-emulator-scheme";

INVALID_HOSTING_LINK_DOMAIN

readonly INVALID_HOSTING_LINK_DOMAIN: "auth/invalid-hosting-link-domain";

INVALID_IDP_RESPONSE

readonly INVALID_IDP_RESPONSE: "auth/invalid-credential";

INVALID_LOGIN_CREDENTIALS

readonly INVALID_LOGIN_CREDENTIALS: "auth/invalid-credential";

INVALID_MESSAGE_PAYLOAD

readonly INVALID_MESSAGE_PAYLOAD: "auth/invalid-message-payload";

INVALID_MFA_SESSION

readonly INVALID_MFA_SESSION: "auth/invalid-multi-factor-session";

INVALID_OAUTH_CLIENT_ID

readonly INVALID_OAUTH_CLIENT_ID: "auth/invalid-oauth-client-id";

INVALID_OAUTH_PROVIDER

readonly INVALID_OAUTH_PROVIDER: "auth/invalid-oauth-provider";

INVALID_OOB_CODE

readonly INVALID_OOB_CODE: "auth/invalid-action-code";

INVALID_ORIGIN

readonly INVALID_ORIGIN: "auth/unauthorized-domain";

INVALID_PASSWORD

readonly INVALID_PASSWORD: "auth/wrong-password";

INVALID_PERSISTENCE

readonly INVALID_PERSISTENCE: "auth/invalid-persistence-type";

INVALID_PHONE_NUMBER

readonly INVALID_PHONE_NUMBER: "auth/invalid-phone-number";

INVALID_PROVIDER_ID

readonly INVALID_PROVIDER_ID: "auth/invalid-provider-id";

INVALID_RECAPTCHA_ACTION

readonly INVALID_RECAPTCHA_ACTION: "auth/invalid-recaptcha-action";

INVALID_RECAPTCHA_TOKEN

readonly INVALID_RECAPTCHA_TOKEN: "auth/invalid-recaptcha-token";

INVALID_RECAPTCHA_VERSION

readonly INVALID_RECAPTCHA_VERSION: "auth/invalid-recaptcha-version";

INVALID_RECIPIENT_EMAIL

readonly INVALID_RECIPIENT_EMAIL: "auth/invalid-recipient-email";

INVALID_REQ_TYPE

readonly INVALID_REQ_TYPE: "auth/invalid-req-type";

INVALID_SENDER

readonly INVALID_SENDER: "auth/invalid-sender";

INVALID_SESSION_INFO

readonly INVALID_SESSION_INFO: "auth/invalid-verification-id";

INVALID_TENANT_ID

readonly INVALID_TENANT_ID: "auth/invalid-tenant-id";

MFA_INFO_NOT_FOUND

readonly MFA_INFO_NOT_FOUND: "auth/multi-factor-info-not-found";

MFA_REQUIRED

readonly MFA_REQUIRED: "auth/multi-factor-auth-required";

MISSING_ANDROID_PACKAGE_NAME

readonly MISSING_ANDROID_PACKAGE_NAME: "auth/missing-android-pkg-name";

MISSING_APP_CREDENTIAL

readonly MISSING_APP_CREDENTIAL: "auth/missing-app-credential";

MISSING_AUTH_DOMAIN

readonly MISSING_AUTH_DOMAIN: "auth/auth-domain-config-required";

MISSING_CLIENT_TYPE

readonly MISSING_CLIENT_TYPE: "auth/missing-client-type";

MISSING_CODE

readonly MISSING_CODE: "auth/missing-verification-code";

MISSING_CONTINUE_URI

readonly MISSING_CONTINUE_URI: "auth/missing-continue-uri";

MISSING_IFRAME_START

readonly MISSING_IFRAME_START: "auth/missing-iframe-start";

MISSING_IOS_BUNDLE_ID

readonly MISSING_IOS_BUNDLE_ID: "auth/missing-ios-bundle-id";

MISSING_MFA_INFO

readonly MISSING_MFA_INFO: "auth/missing-multi-factor-info";

MISSING_MFA_SESSION

readonly MISSING_MFA_SESSION: "auth/missing-multi-factor-session";

MISSING_OR_INVALID_NONCE

readonly MISSING_OR_INVALID_NONCE: "auth/missing-or-invalid-nonce";

MISSING_PASSWORD

readonly MISSING_PASSWORD: "auth/missing-password";

MISSING_PHONE_NUMBER

readonly MISSING_PHONE_NUMBER: "auth/missing-phone-number";

MISSING_RECAPTCHA_TOKEN

readonly MISSING_RECAPTCHA_TOKEN: "auth/missing-recaptcha-token";

MISSING_RECAPTCHA_VERSION

readonly MISSING_RECAPTCHA_VERSION: "auth/missing-recaptcha-version";

MISSING_SESSION_INFO

readonly MISSING_SESSION_INFO: "auth/missing-verification-id";

MODULE_DESTROYED

readonly MODULE_DESTROYED: "auth/app-deleted";

NEED_CONFIRMATION

readonly NEED_CONFIRMATION: "auth/account-exists-with-different-credential";

NETWORK_REQUEST_FAILED

readonly NETWORK_REQUEST_FAILED: "auth/network-request-failed";

NO_AUTH_EVENT

readonly NO_AUTH_EVENT: "auth/no-auth-event";

NO_SUCH_PROVIDER

readonly NO_SUCH_PROVIDER: "auth/no-such-provider";

NULL_USER

readonly NULL_USER: "auth/null-user";

OPERATION_NOT_ALLOWED

readonly OPERATION_NOT_ALLOWED: "auth/operation-not-allowed";

OPERATION_NOT_SUPPORTED

readonly OPERATION_NOT_SUPPORTED: "auth/operation-not-supported-in-this-environment";

POPUP_BLOCKED

readonly POPUP_BLOCKED: "auth/popup-blocked";

POPUP_CLOSED_BY_USER

readonly POPUP_CLOSED_BY_USER: "auth/popup-closed-by-user";

PROVIDER_ALREADY_LINKED

readonly PROVIDER_ALREADY_LINKED: "auth/provider-already-linked";

QUOTA_EXCEEDED

readonly QUOTA_EXCEEDED: "auth/quota-exceeded";

RECAPTCHA_NOT_ENABLED

readonly RECAPTCHA_NOT_ENABLED: "auth/recaptcha-not-enabled";

REDIRECT_CANCELLED_BY_USER

readonly REDIRECT_CANCELLED_BY_USER: "auth/redirect-cancelled-by-user";

REDIRECT_OPERATION_PENDING

readonly REDIRECT_OPERATION_PENDING: "auth/redirect-operation-pending";

REJECTED_CREDENTIAL

readonly REJECTED_CREDENTIAL: "auth/rejected-credential";

SECOND_FACTOR_ALREADY_ENROLLED

readonly SECOND_FACTOR_ALREADY_ENROLLED: "auth/second-factor-already-in-use";

SECOND_FACTOR_LIMIT_EXCEEDED

readonly SECOND_FACTOR_LIMIT_EXCEEDED: "auth/maximum-second-factor-count-exceeded";

TENANT_ID_MISMATCH

readonly TENANT_ID_MISMATCH: "auth/tenant-id-mismatch";

TIMEOUT

readonly TIMEOUT: "auth/timeout";

TOKEN_EXPIRED

readonly TOKEN_EXPIRED: "auth/user-token-expired";

TOO_MANY_ATTEMPTS_TRY_LATER

readonly TOO_MANY_ATTEMPTS_TRY_LATER: "auth/too-many-requests";

UNAUTHORIZED_DOMAIN

readonly UNAUTHORIZED_DOMAIN: "auth/unauthorized-continue-uri";

UNSUPPORTED_FIRST_FACTOR

readonly UNSUPPORTED_FIRST_FACTOR: "auth/unsupported-first-factor";

UNSUPPORTED_PERSISTENCE

readonly UNSUPPORTED_PERSISTENCE: "auth/unsupported-persistence-type";

UNSUPPORTED_TENANT_OPERATION

readonly UNSUPPORTED_TENANT_OPERATION: "auth/unsupported-tenant-operation";

UNVERIFIED_EMAIL

readonly UNVERIFIED_EMAIL: "auth/unverified-email";

USER_CANCELLED

readonly USER_CANCELLED: "auth/user-cancelled";

USER_DELETED

readonly USER_DELETED: "auth/user-not-found";

USER_DISABLED

readonly USER_DISABLED: "auth/user-disabled";

USER_MISMATCH

readonly USER_MISMATCH: "auth/user-mismatch";

USER_SIGNED_OUT

readonly USER_SIGNED_OUT: "auth/user-signed-out";

WEAK_PASSWORD

readonly WEAK_PASSWORD: "auth/weak-password";

WEB_STORAGE_UNSUPPORTED

readonly WEB_STORAGE_UNSUPPORTED: "auth/web-storage-unsupported";

browserCookiePersistence

const browserCookiePersistence: Persistence;

Cookie-backed, for SSR. The fourth member of upstream’s Persistence.type union.

browserLocalPersistence

const browserLocalPersistence: Persistence;

localStorage-backed. Firebase’s default.

browserPopupRedirectResolver

const browserPopupRedirectResolver: {
};

browserPopupRedirectResolver — upstream’s default resolver, the thing a browser getAuth() wires in so signInWithPopup can open a window.

The sandbox has no window to open, and it already has a FIRST-CLASS, pluggable equivalent: AuthFlowResolver, installed via sandbox.setAuthFlowResolver. So this export exists to satisfy the idiomatic initializeAuth(app, { popupRedirectResolver: browserPopupRedirectResolver }) without changing anything: passing it is accepted and ignored, and popup/redirect sign-in resolves through the sandbox’s own resolver seam instead.

Branded rather than left as a bare {} so a host can recognize it.

browserSessionPersistence

const browserSessionPersistence: Persistence;

sessionStorage-backed.

debugErrorMap

const debugErrorMap: AuthErrorMap;

debugErrorMap — upstream’s verbose map: full human-readable messages on every auth error, at the cost of bundle size.

The sandbox ALWAYS throws with a full message (see auth-errors.ts: every makeAuthError call site passes real prose), so the debug map is effectively already in force and installing it changes nothing. Exported as an accepted no-op token.

FEDERATED_PROVIDER_IDS

const FEDERATED_PROVIDER_IDS: readonly ["google.com", "apple.com", "facebook.com", "github.com", "twitter.com", "microsoft.com", "yahoo.com"];

The canonical federated (OAuth) provider ids the sandbox supports as FIRST-CLASS: the dedicated provider classes’ PROVIDER_IDs (GoogleAuthProvider / FacebookAuthProvider / GithubAuthProvider) plus the standard Firebase IdP set reached through the generic OAuthProvider (Apple, Twitter, Microsoft, Yahoo — the same federated ids the emulator console recognizes).

NOT an allowlist: the backend accepts ANY provider id (custom OAuthProvider('oidc.acme') etc. work end-to-end). This constant exists so admin surfaces (Studio’s user editor, provider toggles) can enumerate the supported set mechanically instead of hardcoding copies. password / anonymous / phone are deliberately absent — they’re credential- derived sign-in methods, not federated links.

indexedDBLocalPersistence

const indexedDBLocalPersistence: Persistence;

IndexedDB-backed. Long-term, same observable class as browserLocalPersistence — hence the shared 'LOCAL' type.

inMemoryPersistence

const inMemoryPersistence: Persistence;

No persistence — session dies with the tab.

OperationType

const OperationType: {
  LINK: "link";
  REAUTHENTICATE: "reauthenticate";
  SIGN_IN: "signIn";
};

What produced a UserCredential. Mirrors firebase/auth’s OperationType — the discriminant signInWith* / linkWith* / reauthenticateWith* set on their results.

SIGN_IN is 'signIn', NOT 'register': a fresh createUserWithEmailAndPassword also reports 'signIn'. Oracle: observations/auth/auth-createUser-operationType.json.

Type Declaration

LINK

readonly LINK: "link";

REAUTHENTICATE

readonly REAUTHENTICATE: "reauthenticate";

SIGN_IN

readonly SIGN_IN: "signIn";

prodErrorMap

const prodErrorMap: AuthErrorMap;

prodErrorMap — upstream’s minified map: error codes without the message text, to save bytes in production builds.

NOT honored, deliberately. Installing it upstream STRIPS the messages; doing that in a sandbox whose entire purpose is to tell a developer what went wrong would be actively hostile. Accepted and ignored — the sandbox keeps throwing full messages.

ProviderId

const ProviderId: {
  FACEBOOK: "facebook.com";
  GITHUB: "github.com";
  GOOGLE: "google.com";
  PASSWORD: "password";
  PHONE: "phone";
  TWITTER: "twitter.com";
};

Aggregate provider ids. Mirrors firebase/auth’s ProviderId.

Note the shape upstream chose: the anonymous and custom-token sign-in paths have NO entry here (they are not federated identity providers), which is why UserCredential.providerId is null for both.

Type Declaration

FACEBOOK

readonly FACEBOOK: "facebook.com";

GITHUB

readonly GITHUB: "github.com";

GOOGLE

readonly GOOGLE: "google.com";

PASSWORD

readonly PASSWORD: "password";

PHONE

readonly PHONE: "phone";

TWITTER

readonly TWITTER: "twitter.com";

sandbox

const sandbox: {
  assertAuthProviderEnabled: void;
  clearUsers: void;
  createSignInCredential: UserCredential;
  createUser: AuthUserRecord;
  delegateProviderEnforcement: void;
  deleteUser: void;
  exportUsers: SeedUser[];
  getAuthProviderConfig: {
     enabled: boolean;
     providerId: string;
  }[];
  listAuthMail: OutboundAuthMail[];
  listIdentities: {
     customClaims: Record<string, unknown>;
     displayName: string | null;
     email: string | null;
     isAnonymous: boolean;
     providerId: string;
     providerUserInfo: ProviderUserInfo[];
     uid: string;
  }[];
  listUsers: AuthUserRecord[];
  mintSession: MintedSession;
  mockActionCode: void;
  mockSignInResult: void;
  restoreSession: User;
  seedUsers: void;
  setAuthFlowResolver: void;
  setAuthMailResolver: void;
  setAuthProviderConfig: void;
  setUser: void;
  subscribeAuthProviderConfig: Unsubscribe;
  subscribeUsers: Unsubscribe;
  takeAuthMail: OutboundAuthMail;
  updateProfile: AuthUserRecord;
  updateUser: AuthUserRecord;
};

Type Declaration

assertAuthProviderEnabled()

assertAuthProviderEnabled(auth: Auth, providerId: string): void;

Parameters

Parameter	Type
`auth`	`Auth`
`providerId`	`string`

Returns

void

clearUsers()

clearUsers(auth: Auth): void;

Parameters

Parameter	Type
`auth`	`Auth`

Returns

void

createSignInCredential()

createSignInCredential(auth: Auth, request:
  | {
  providerId: string;
  uid: string;
}
  | {
  providerId: string;
  spec: SignInIdentitySpec;
}): UserCredential;

Parameters

Parameter	Type
`auth`	`Auth`
`request`	\| { `providerId`: `string`; `uid`: `string`; } \| { `providerId`: `string`; `spec`: `SignInIdentitySpec`; }

Returns

UserCredential

createUser()

createUser(auth: Auth, request: CreateUserRequest): AuthUserRecord;

Parameters

Parameter	Type
`auth`	`Auth`
`request`	`CreateUserRequest`

Returns

AuthUserRecord

delegateProviderEnforcement()

delegateProviderEnforcement(auth: Auth, delegated: boolean): void;

Parameters

Parameter	Type
`auth`	`Auth`
`delegated`	`boolean`

Returns

void

deleteUser()

deleteUser(auth: Auth, uid: string): void;

Parameters

Parameter	Type
`auth`	`Auth`
`uid`	`string`

Returns

void

exportUsers()

exportUsers(auth: Auth): SeedUser[];

Parameters

Parameter	Type
`auth`	`Auth`

Returns

SeedUser[]

getAuthProviderConfig()

getAuthProviderConfig(auth: Auth): {
  enabled: boolean;
  providerId: string;
}[];

Parameters

Parameter	Type
`auth`	`Auth`

Returns

{ enabled: boolean; providerId: string; }[]

listAuthMail()

listAuthMail(auth: Auth): OutboundAuthMail[];

Parameters

Parameter	Type
`auth`	`Auth`

Returns

OutboundAuthMail[]

listIdentities()

listIdentities(auth: Auth): {
  customClaims: Record<string, unknown>;
  displayName: string | null;
  email: string | null;
  isAnonymous: boolean;
  providerId: string;
  providerUserInfo: ProviderUserInfo[];
  uid: string;
}[];

Parameters

Parameter	Type
`auth`	`Auth`

Returns

{ customClaims: Record<string, unknown>; displayName: string | null; email: string | null; isAnonymous: boolean; providerId: string; providerUserInfo: ProviderUserInfo[]; uid: string; }[]

listUsers()

listUsers(auth: Auth): AuthUserRecord[];

Parameters

Parameter	Type
`auth`	`Auth`

Returns

AuthUserRecord[]

mintSession()

mintSession(auth: Auth, request: MintSessionRequest): MintedSession;

Parameters

Parameter	Type
`auth`	`Auth`
`request`	`MintSessionRequest`

Returns

MintedSession

mockActionCode()

mockActionCode(
   auth: Auth,
   code: string,
   spec: AuthActionCode): void;

Parameters

Parameter	Type
`auth`	`Auth`
`code`	`string`
`spec`	`AuthActionCode`

Returns

void

mockSignInResult()

mockSignInResult(auth: Auth, result: UserCredential): void;

Parameters

Parameter	Type
`auth`	`Auth`
`result`	`UserCredential`

Returns

void

restoreSession()

restoreSession(auth: Auth, uid: string): User;

Parameters

Parameter	Type
`auth`	`Auth`
`uid`	`string`

Returns

User

seedUsers()

seedUsers(auth: Auth, users: readonly SeedUser[]): void;

Parameters

Parameter	Type
`auth`	`Auth`
`users`	readonly `SeedUser`[]

Returns

void

setAuthFlowResolver()

setAuthFlowResolver(auth: Auth, resolver: AuthFlowResolver): void;

Parameters

Parameter	Type
`auth`	`Auth`
`resolver`	`AuthFlowResolver`

Returns

void

setAuthMailResolver()

setAuthMailResolver(auth: Auth, resolver: AuthMailResolver): void;

Parameters

Parameter	Type
`auth`	`Auth`
`resolver`	`AuthMailResolver`

Returns

void

setAuthProviderConfig()

setAuthProviderConfig(
   auth: Auth,
   providerId: string,
   enabled: boolean): void;

Parameters

Parameter	Type
`auth`	`Auth`
`providerId`	`string`
`enabled`	`boolean`

Returns

void

setUser()

setUser(auth: Auth, user: User): void;

Parameters

Parameter	Type
`auth`	`Auth`
`user`	`User`

Returns

void

subscribeAuthProviderConfig()

subscribeAuthProviderConfig(auth: Auth, callback: () => void): Unsubscribe;

Parameters

Parameter	Type
`auth`	`Auth`
`callback`	() => `void`

Returns

Unsubscribe

subscribeUsers()

subscribeUsers(auth: Auth, callback: () => void): Unsubscribe;

Parameters

Parameter	Type
`auth`	`Auth`
`callback`	() => `void`

Returns

Unsubscribe

takeAuthMail()

takeAuthMail(auth: Auth, email?: string): OutboundAuthMail;

Parameters

Parameter	Type
`auth`	`Auth`
`email?`	`string`

Returns

OutboundAuthMail

updateProfile()

updateProfile(
   auth: Auth,
   uid: string,
   profile: {
  displayName?: string | null;
  photoURL?: string | null;
}): AuthUserRecord;

Parameters

Parameter	Type
`auth`	`Auth`
`uid`	`string`
`profile`	{ `displayName?`: `string` \| `null`; `photoURL?`: `string` \| `null`; }
`profile.displayName?`	`string` \| `null`
`profile.photoURL?`	`string` \| `null`

Returns

AuthUserRecord

updateUser()

updateUser(
   auth: Auth,
   uid: string,
   update: UpdateUserRequest): AuthUserRecord;

Parameters

Parameter	Type
`auth`	`Auth`
`uid`	`string`
`update`	`UpdateUserRequest`

Returns

AuthUserRecord

SignInMethod

const SignInMethod: {
  EMAIL_LINK: "emailLink";
  EMAIL_PASSWORD: "password";
  FACEBOOK: "facebook.com";
  GITHUB: "github.com";
  GOOGLE: "google.com";
  PHONE: "phone";
  TWITTER: "twitter.com";
};

Sign-in method ids. Mirrors firebase/auth’s SignInMethod.

Distinct from ProviderId precisely because one provider can carry several methods: EmailAuthProvider ('password') signs in with EITHER EMAIL_PASSWORD ('password') or EMAIL_LINK ('emailLink'). That split is what AuthCredential.signInMethod discriminates, and it is what the email-link family turns on.

Type Declaration

EMAIL_LINK

readonly EMAIL_LINK: "emailLink";

EMAIL_PASSWORD

readonly EMAIL_PASSWORD: "password";

FACEBOOK

readonly FACEBOOK: "facebook.com";

GITHUB

readonly GITHUB: "github.com";

GOOGLE

readonly GOOGLE: "google.com";

PHONE

readonly PHONE: "phone";

TWITTER

readonly TWITTER: "twitter.com";

TARGET_SYMBOL

const TARGET_SYMBOL: unique symbol;

Branded handle for Auth. Set on every handle returned by getAuth; consumers don’t read it. Exposed only so the dispatch helpers in this package can recover routing without a WeakMap lookup.

Functions

applyActionCode()

function applyActionCode(auth: Auth, code: string): Promise<void>;

applyActionCode(auth, code) — mirror of firebase/auth. Redeems a code and performs its state change.

auth/invalid-action-code for a code the sandbox never issued — ORACLE-BACKED (auth-action-code-invalid captured exactly this against prod, for both a bogus code and the empty string). auth/expired-action-code for a code staged as expired.

Single-use: the code is burned on redemption, so a replay throws auth/invalid-action-code — matching prod.

Parameters

Parameter	Type
`auth`	`Auth`
`code`	`string`

Returns

Promise<void>

beforeAuthStateChanged()

function beforeAuthStateChanged(
   auth: Auth,
   callback: (user: User) => void | Promise<void>,
   onAbort?: () => void): Unsubscribe;

Parameters

Parameter	Type
`auth`	`Auth`
`callback`	(`user`: `User`) => `void` \| `Promise`<`void`>
`onAbort?`	() => `void`

Returns

Unsubscribe

checkActionCode()

function checkActionCode(auth: Auth, code: string): Promise<ActionCodeInfo>;

checkActionCode(auth, code) — mirror of firebase/auth. Inspects a code WITHOUT redeeming it, so the subsequent applyActionCode / confirmPasswordReset still finds it. Throws auth/invalid-action-code / auth/expired-action-code for a code that is not live.

Parameters

Parameter	Type
`auth`	`Auth`
`code`	`string`

Returns

Promise<ActionCodeInfo>

confirmPasswordReset()

function confirmPasswordReset(
   auth: Auth,
   code: string,
newPassword: string): Promise<void>;

confirmPasswordReset(auth, code, newPassword) — mirror of firebase/auth. Redeems a reset code and sets the new password.

Real behavior on the sandbox: afterwards signInWithEmailAndPassword(auth, email, newPassword) succeeds and the OLD password throws auth/wrong-password. The new password runs the same strength check createUserWithEmailAndPassword does, so a reset cannot install a password the create path would have rejected (auth/weak-password).

Parameters

Parameter	Type
`auth`	`Auth`
`code`	`string`
`newPassword`	`string`

Returns

Promise<void>

connectAuthEmulator()

function connectAuthEmulator(
   auth: Auth,
   url: string,
   options?: {
  disableWarnings?: boolean;
}): void;

Parameters

Parameter	Type
`auth`	`Auth`
`url`	`string`
`options?`	{ `disableWarnings?`: `boolean`; }
`options.disableWarnings?`	`boolean`

Returns

void

createUserWithEmailAndPassword()

function createUserWithEmailAndPassword(
   auth: Auth,
   email: string,
password: string): Promise<UserCredential>;

Parameters

Parameter	Type
`auth`	`Auth`
`email`	`string`
`password`	`string`

Returns

Promise<UserCredential>

deleteUser()

function deleteUser(user: User): Promise<void>;

Parameters

Parameter	Type
`user`	`User`

Returns

Promise<void>

getAdditionalUserInfo()

function getAdditionalUserInfo(userCredential: UserCredential): AdditionalUserInfo;

getAdditionalUserInfo(userCredential) — mirror of firebase/auth.

Reads the info the sandbox recorded on the credential when it minted it. isNewUser is true only when the credential came from a flow that CREATED the identity (createUserWithEmailAndPassword, signInAnonymously, a first-time email-link sign-in, a link that upgraded an anonymous account).

Oracle (observations/auth/auth-additional-user-info-shape.json): against prod an anonymous sign-in yields { isNewUser: true, providerId: null, profile: {} } — note providerId: null, not 'anonymous', because anonymous is not a federated provider.

Parameters

Parameter	Type
`userCredential`	`UserCredential`

Returns

AdditionalUserInfo

getAuth()

Call Signature

function getAuth(): AppAuth;

Returns

AppAuth

Call Signature

function getAuth(sandbox: Sandbox): Auth;

Parameters

Parameter	Type
`sandbox`	`Sandbox`

Returns

Auth

Call Signature

function getAuth(app: FirebaseApp): AppAuth;

Parameters

Parameter	Type
`app`	`FirebaseApp`

Returns

AppAuth

Call Signature

function getAuth(target?:
  | FirebaseApp
  | Sandbox): Auth;

Parameters

Parameter	Type
`target?`	\| `FirebaseApp` \| `Sandbox`

Returns

Auth

getIdToken()

function getIdToken(user: User, forceRefresh?: boolean): Promise<string>;

Parameters

Parameter	Type
`user`	`User`
`forceRefresh?`	`boolean`

Returns

Promise<string>

getIdTokenResult()

function getIdTokenResult(user: User, forceRefresh?: boolean): Promise<IdTokenResult>;

Parameters

Parameter	Type
`user`	`User`
`forceRefresh?`	`boolean`

Returns

Promise<IdTokenResult>

getRedirectResult()

function getRedirectResult(auth: Auth, _resolver?: AuthFlowResolver): Promise<UserCredential>;

Parameters

Parameter	Type
`auth`	`Auth`
`_resolver?`	`AuthFlowResolver`

Returns

Promise<UserCredential>

initializeAuth()

Call Signature

function initializeAuth(app: FirebaseApp, deps?: unknown): AppAuth;

Parameters

Parameter	Type
`app`	`FirebaseApp`
`deps?`	`unknown`

Returns

AppAuth

Call Signature

function initializeAuth(app: Sandbox, deps?: unknown): Auth;

Parameters

Parameter	Type
`app`	`Sandbox`
`deps?`	`unknown`

Returns

Auth

isSignInWithEmailLink()

function isSignInWithEmailLink(auth: Auth, link: string): boolean;

isSignInWithEmailLink(auth, link) — mirror of firebase/auth.

A pure predicate over the string: no network, no project, no state. True iff the link parses AND its operation is EMAIL_SIGNIN. Never throws — garbage in, false out. Oracle-pinned on all five cases the capture covers.

auth is unused (upstream takes it for signature symmetry and tenant plumbing, neither of which changes the answer) but is kept in the signature so consumer code is identical across the two SDKs.

Parameters

Parameter	Type
`auth`	`Auth`
`link`	`string`

Returns

boolean

linkWithCredential()

function linkWithCredential(user: User, credential: AuthCredential): Promise<UserCredential>;

linkWithCredential(user, credential) — mirror of firebase/auth.

The anonymous upgrade is the flow this exists for: a user who has been writing data as anonymous-1 links an email credential and keeps the SAME uid, so everything they created is still theirs. isAnonymous flips to false; providerData gains the provider.

Rejects with:

auth/provider-already-linked — the account already carries this provider (one identity per provider, always).
auth/email-already-in-use — the email credential belongs to a different account. An address can back only one identity, so the link cannot be granted without stealing it.

Returns a UserCredential with operationType: 'link'.

Parameters

Parameter	Type
`user`	`User`
`credential`	`AuthCredential`

Returns

Promise<UserCredential>

linkWithPopup()

function linkWithPopup(
   user: User,
   provider: AuthProvider,
resolver?: AuthFlowResolver): Promise<UserCredential>;

linkWithPopup(user, provider, resolver?) — mirror of firebase/auth.

Runs the SAME resolver seam as signInWithPopup, with authType: 'link' so a host UI can tell the two apart and say “link your Google account” rather than “sign in”. The resolved credential names the provider to attach; the sandbox performs the attach.

Parameters

Parameter	Type
`user`	`User`
`provider`	`AuthProvider`
`resolver?`	`AuthFlowResolver`

Returns

Promise<UserCredential>

linkWithRedirect()

function linkWithRedirect(
   user: User,
   provider: AuthProvider,
resolver?: AuthFlowResolver): Promise<UserCredential>;

linkWithRedirect(user, provider, resolver?) — mirror of firebase/auth. The sandbox has no navigation, so the resolver resolves inline and the link completes immediately — the same simplification signInWithRedirect makes, and the same observable outcome a real redirect produces once it returns.

Parameters

Parameter	Type
`user`	`User`
`provider`	`AuthProvider`
`resolver?`	`AuthFlowResolver`

Returns

Promise<UserCredential>

onAuthStateChanged()

function onAuthStateChanged(auth: Auth, observer: AuthObserver): Unsubscribe;

Parameters

Parameter	Type
`auth`	`Auth`
`observer`	`AuthObserver`

Returns

Unsubscribe

onIdTokenChanged()

function onIdTokenChanged(auth: Auth, observer: AuthObserver): Unsubscribe;

Parameters

Parameter	Type
`auth`	`Auth`
`observer`	`AuthObserver`

Returns

Unsubscribe

parseActionCodeURL()

function parseActionCodeURL(link: string): ActionCodeURL;

parseActionCodeURL(link) — free-function mirror of ActionCodeURL.parseLink. Upstream ships both and they agree; the oracle capture asserts that agreement (parseActionCodeURLAgrees: true).

Parameters

Parameter	Type
`link`	`string`

Returns

ActionCodeURL

reauthenticateWithCredential()

function reauthenticateWithCredential(user: User, credential: AuthCredential): Promise<UserCredential>;

reauthenticateWithCredential(user, credential) — mirror of firebase/auth.

Really re-verifies: an email credential is checked against the stored password exactly as signInWithEmailAndPassword checks it, so a wrong password throws auth/wrong-password and a credential belonging to a DIFFERENT account throws auth/user-mismatch (the check that stops “reauthenticate as someone else” from silently succeeding).

On success mints a fresh ID token, so getIdTokenResult(user).authTime advances — the observable trace of a fresh sign-in, and the thing prod’s recent-login gate reads.

Parameters

Parameter	Type
`user`	`User`
`credential`	`AuthCredential`

Returns

Promise<UserCredential>

reauthenticateWithPopup()

function reauthenticateWithPopup(
   user: User,
   provider: AuthProvider,
resolver?: AuthFlowResolver): Promise<UserCredential>;

reauthenticateWithPopup(user, provider, resolver?) — mirror of firebase/auth. Runs the shared resolver seam with authType: 'reauth', so a host UI can present “confirm it’s you” rather than a fresh sign-in.

The resolved credential must be for THE SAME user — a resolver that hands back a different uid throws auth/user-mismatch. Without that check, “re-authentication” would accept anyone.

Parameters

Parameter	Type
`user`	`User`
`provider`	`AuthProvider`
`resolver?`	`AuthFlowResolver`

Returns

Promise<UserCredential>

reauthenticateWithRedirect()

function reauthenticateWithRedirect(
   user: User,
   provider: AuthProvider,
resolver?: AuthFlowResolver): Promise<UserCredential>;

reauthenticateWithRedirect(user, provider, resolver?) — mirror of firebase/auth. Resolves inline (the sandbox has no navigation), same as signInWithRedirect.

Parameters

Parameter	Type
`user`	`User`
`provider`	`AuthProvider`
`resolver?`	`AuthFlowResolver`

Returns

Promise<UserCredential>

reload()

function reload(user: User): Promise<void>;

Parameters

Parameter	Type
`user`	`User`

Returns

Promise<void>

revokeAccessToken()

function revokeAccessToken(auth: Auth, token: string): Promise<void>;

revokeAccessToken(auth, token) — mirror of firebase/auth.

In production this tells the IDENTITY PROVIDER (in practice: Apple) to revoke an OAuth access token — a call that leaves Firebase entirely and lands on Apple’s servers. It exists because Apple requires an app that offers “Sign in with Apple” to also offer account deletion that revokes the token.

There is no external IdP behind a sandbox sign-in, so there is no token out there to revoke and nothing this call could truthfully do. It is an ACCEPTED NO-OP: it resolves, so the account-deletion flow an app must ship runs end to end against the sandbox, and it changes no sandbox state, because claiming otherwise would be a lie. diverged-documented.

Parameters

Parameter	Type
`auth`	`Auth`
`token`	`string`

Returns

Promise<void>

sendEmailVerification()

function sendEmailVerification(user: User, settings?: ActionCodeSettings): Promise<void>;

sendEmailVerification(user, settings?) — mirror of firebase/auth.

Throws auth/missing-email for a user with no email on the account (an anonymous user). Oracle-backed: auth-sendemailverification-shape captured exactly that code against prod for an anonymous user.

On success the message is mailed and NOTHING ELSE HAPPENS — user.emailVerified stays false. Verification happens when the code in that message is redeemed (applyActionCode), not when it is sent. Modeling that gap faithfully is the whole point: agent code that gates on emailVerified must see it stay false here, exactly as it would in production.

Parameters

Parameter	Type
`user`	`User`
`settings?`	`ActionCodeSettings`

Returns

Promise<void>

sendPasswordResetEmail()

function sendPasswordResetEmail(
   auth: Auth,
   email: string,
settings?: ActionCodeSettings): Promise<void>;

sendPasswordResetEmail(auth, email, settings?) — mirror of firebase/auth.

Resolves for an address no account owns, WITHOUT throwing and without mailing anything. That is not laziness: it is Email Enumeration Protection, and the oracle confirmed prod behaves exactly this way (auth-sendpasswordresetemail-unknown-user: resolvedForUnknownUser: true). A shim that threw auth/user-not-found here would hand agent code a working account oracle that production deliberately took away.

A malformed address still throws auth/invalid-email — also oracle-confirmed.

Parameters

Parameter	Type
`auth`	`Auth`
`email`	`string`
`settings?`	`ActionCodeSettings`

Returns

Promise<void>

sendSignInLinkToEmail()

function sendSignInLinkToEmail(
   auth: Auth,
   email: string,
settings: ActionCodeSettings): Promise<void>;

sendSignInLinkToEmail(auth, email, settings) — mirror of firebase/auth.

settings.url is REQUIRED and settings.handleCodeInApp must be true — both enforced client-side, both oracle-pinned (see the file docstring). Unlike sendPasswordResetEmail, this one does NOT require an existing account: sending a sign-in link to an unknown address is the sign-UP path, and the account is created when the link is redeemed.

Parameters

Parameter	Type
`auth`	`Auth`
`email`	`string`
`settings`	`ActionCodeSettings`

Returns

Promise<void>

setPersistence()

function setPersistence(auth: Auth, persistence: Persistence): Promise<void>;

Parameters

Parameter	Type
`auth`	`Auth`
`persistence`	`Persistence`

Returns

Promise<void>

signInAnonymously()

function signInAnonymously(auth: Auth): Promise<UserCredential>;

Parameters

Parameter	Type
`auth`	`Auth`

Returns

Promise<UserCredential>

signInWithCredential()

function signInWithCredential(auth: Auth, credential: AuthCredential): Promise<UserCredential>;

Parameters

Parameter	Type
`auth`	`Auth`
`credential`	`AuthCredential`

Returns

Promise<UserCredential>

signInWithCustomToken()

function signInWithCustomToken(auth: Auth, customToken: string): Promise<UserCredential>;

signInWithCustomToken(auth, customToken) — mirror of firebase/auth.

In production a custom token is a JWT your BACKEND signs with a service account, asserting “this is user X, with these claims”. The client exchanges it for a session. It is the standard bridge from an existing auth system into Firebase.

The sandbox has no service-account key and no signature to verify, so it treats the token as what it structurally is: a claim of identity. It accepts a token in either of two shapes —

a JSON object {"uid": "...", "claims": {...}} (optionally base64url-encoded), which is exactly the payload admin.auth().createCustomToken(uid, claims) signs. This is the shape the pyric-admin mirror mints, so the two sides compose: mint on the admin side, redeem here.
a real three-part JWT, whose middle segment is decoded and read for uid / claims. The SIGNATURE IS NOT VERIFIED — the sandbox has no key and says so rather than pretending.

Anything else throws auth/invalid-custom-token — ORACLE-BACKED (auth-signinwithcustomtoken-invalid captured exactly that code from prod for both a malformed token and the empty string).

The identity is created if it does not exist (matching prod: a custom token for an unknown uid mints that account), and the credential carries providerId: null — custom-token sign-in is not a federated provider, the same rule anonymous sign-in follows.

Parameters

Parameter	Type
`auth`	`Auth`
`customToken`	`string`

Returns

Promise<UserCredential>

signInWithEmailAndPassword()

function signInWithEmailAndPassword(
   auth: Auth,
   email: string,
password: string): Promise<UserCredential>;

Parameters

Parameter	Type
`auth`	`Auth`
`email`	`string`
`password`	`string`

Returns

Promise<UserCredential>

signInWithEmailLink()

function signInWithEmailLink(
   auth: Auth,
   email: string,
link: string): Promise<UserCredential>;

signInWithEmailLink(auth, email, link) — mirror of firebase/auth. Redeems the code in the link and signs the user in.

Creates the account if the address is new — a first-time email-link sign-in IS a sign-up, and getAdditionalUserInfo(cred).isNewUser reports it honestly. Either way the account comes out emailVerified: true, because redeeming a code that was mailed to that address is proof the user controls it. (An account born this way has NO password: signInWithEmailAndPassword against it fails until one is set, exactly as in prod.)

Throws auth/argument-error for a link with no oobCode (oracle-backed), and auth/invalid-action-code for a code the sandbox never issued or that has already been redeemed (single-use).

Parameters

Parameter	Type
`auth`	`Auth`
`email`	`string`
`link`	`string`

Returns

Promise<UserCredential>

signInWithPopup()

function signInWithPopup(
   auth: Auth,
   provider: AuthProvider,
resolver?: AuthFlowResolver): Promise<UserCredential>;

Parameters

Parameter	Type
`auth`	`Auth`
`provider`	`AuthProvider`
`resolver?`	`AuthFlowResolver`

Returns

Promise<UserCredential>

signInWithRedirect()

function signInWithRedirect(
   auth: Auth,
   provider: AuthProvider,
resolver?: AuthFlowResolver): Promise<void>;

Parameters

Parameter	Type
`auth`	`Auth`
`provider`	`AuthProvider`
`resolver?`	`AuthFlowResolver`

Returns

Promise<void>

signOut()

function signOut(auth: Auth): Promise<void>;

Parameters

Parameter	Type
`auth`	`Auth`

Returns

Promise<void>

unlink()

function unlink(user: User, providerId: string): Promise<User>;

unlink(user, providerId) — mirror of firebase/auth. Detaches a provider and returns the updated user.

auth/no-such-provider when it was never linked — ORACLE-BACKED (auth-unlink-provider captured exactly this code against prod).

Unlinking the 'password' provider takes the password with it, so signInWithEmailAndPassword for that account stops working — which is the observable point of doing it. Unlinking the LAST provider does not re-anonymize the account: isAnonymous describes how an identity was born, not what it currently carries.

Parameters

Parameter	Type
`user`	`User`
`providerId`	`string`

Returns

Promise<User>

updateCurrentUser()

function updateCurrentUser(auth: Auth, user: User): Promise<void>;

Parameters

Parameter	Type
`auth`	`Auth`
`user`	`User`

Returns

Promise<void>

updateEmail()

function updateEmail(user: User, newEmail: string): Promise<void>;

Parameters

Parameter	Type
`user`	`User`
`newEmail`	`string`

Returns

Promise<void>

updatePassword()

function updatePassword(user: User, newPassword: string): Promise<void>;

Parameters

Parameter	Type
`user`	`User`
`newPassword`	`string`

Returns

Promise<void>

updateProfile()

function updateProfile(user: User, profile: {
  displayName?: string;
  photoURL?: string;
}): Promise<void>;

Parameters

Parameter	Type
`user`	`User`
`profile`	{ `displayName?`: `string`; `photoURL?`: `string`; }
`profile.displayName?`	`string`
`profile.photoURL?`	`string`

Returns

Promise<void>

useDeviceLanguage()

function useDeviceLanguage(auth: Auth): void;

Parameters

Parameter	Type
`auth`	`Auth`

Returns

void

validatePassword()

function validatePassword(auth: Auth, password: string): Promise<PasswordValidationStatus>;

validatePassword(auth, password) — mirror of firebase/auth.

Checks a password against the project policy WITHOUT attempting a sign-up, so a UI can show live strength feedback as the user types. Returns the same PasswordValidationStatus shape prod returns, with only the requirements the policy actually sets — see the note on SANDBOX_PASSWORD_POLICY about why unset is not false.

Parameters

Parameter	Type
`auth`	`Auth`
`password`	`string`

Returns

Promise<PasswordValidationStatus>

verifyBeforeUpdateEmail()

function verifyBeforeUpdateEmail(
   user: User,
   newEmail: string,
settings?: ActionCodeSettings): Promise<void>;

verifyBeforeUpdateEmail(user, newEmail, settings?) — mirror of firebase/auth.

Mails a code to the NEW address and returns. The account’s email does NOT change yet — it changes when that code is redeemed, which is the one guarantee separating this API from a bare updateEmail: the user must prove they control the new address before it becomes theirs.

Parameters

Parameter	Type
`user`	`User`
`newEmail`	`string`
`settings?`	`ActionCodeSettings`

Returns

Promise<void>

verifyPasswordResetCode()

function verifyPasswordResetCode(auth: Auth, code: string): Promise<string>;

verifyPasswordResetCode(auth, code) — mirror of firebase/auth. Checks a reset code and returns the account’s email. Does NOT redeem it — confirmPasswordReset does.

Parameters

Parameter	Type
`auth`	`Auth`
`code`	`string`

Returns

Promise<string>