Modify getUpdateMask to no longer ignore customClaims and sessionClaims #1184
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Attempts to fix: #1135 - sessionClaims content not getting added to the decoded token
From my personal testing, adding
sessionClaims
orcustomerClaims
through a blocking function does not work.The emulator code is expecting both of these keys to show up in the
updateMask
of the blocking function's response.https://github.com/firebase/firebase-tools/blob/30771f6498f32791cd2e88ac142611df58d32b7e/src/emulator/auth/operations.ts#L3083-L3117
I of course do not know what the internal firebase auth platform is expecting to receive in the
updateMask
, so these changes may not be the correct approach.The test that is removed in the PR notes that the updateMask "should return empty on only customClaims and sessionClaims", and the consuming code will actually return an empty response if only the claims values are set:
firebase-functions/src/common/providers/identity.ts
Lines 863 to 872 in cc18326
I do not see any mention of this requirement in the documentation: https://firebase.google.com/docs/auth/extend-with-blocking-functions
I am happy to update these fixes if the internal firebase auth implementation is expecting a different response (which will also require an update to the firebase-tools emulators).