Identity Platform / Firebase Error (auth/invalid-refresh-token)

Question

I am in the process of upgrading an existing working Firebase Auth project to Identity Platform to benefit from the goodness of tenants.

I am currently testing this against the local emulator and am facing the following issues:

• My users no longer show up in the emulator. I reckon, however, that the behaviour is expected since I am creating users against a tenant and no longer the default project users "pool"
• The users do not show up in the GCP console either. Yet, the getUserByEmail() method in a Cloud Function returns the registered users. I therefore have no clue where these users are currently created...

Authenticating users via generateSignInWithEmailLink() works fine.

However, a few steps in the funnel after this, when using the await user?.getIdToken(true) method, I am getting the following error: Uncaught (in promise) FirebaseError: Firebase: Error (auth/invalid-refresh-token) and can't figure out why.

Interestingly, the user.getIdTokenResult() method works fine and does not yield any error.

My entire snippet:

 const getCurrentUser = async (): Promise<Auth["currentUser"]> => {
    return new Promise((resolve, reject) => {
      const unsubscribe = onAuthStateChanged(
        auth,
        async (user) => {
          if (user) {
            if (document.referrer.includes("stripe")) {
            //   console.log({ user });
            await user?.getIdToken(true);
            console.log({ after: user });
           }
            state.isAuthenticated.value = true;
            state.user.value = user;
            try {
           
              const { claims } = await user.getIdTokenResult();
             
              state.claims.value = claims;
              if (typeof claims.roles === "string") {
              
                if (claims.active && claims.roles.includes("account_owner")) {
                  state.isActive.value = true;
                }
              }
            } catch (e) {
              console.log(e);
              if (e instanceof Error) {
                throw new Error();
              }
            }
          }
          unsubscribe();
          resolve(user);
        },
        (e) => {
          if (e instanceof Error) {
            state.error.value = e.message;
            logClientError(e as Error);
          }
          reject(e);
        }
      );
    });
  };

For reference, I am working with a Vue 3 / Vite repo.

Any suggestion would be welcome,

Thanks,

S.

Answer 1

Just a quick follow-up here for anyone looking for an answer to this. I raised a bug report on the firebase-tools Github and:

• Users not appearing in the Emulator UI: behaviour confirmed by the firebase team. The emulator does not not support multi-tenancy at the moment. In my experience, however, working with the emulator with multi-tenants, the basic functionalities seem to work: creating users, retrieving them. Impossible however to visualise them or export them.

• Refresh token error: bug confirmed by the firebase team and in the process of being triaged. Will likely take some time before being fixed (if ever?). So for now, even if far from being ideal, I have added conditional checks to my code to skip the force refresh of the token on localhost. Instead, I log out and log back in with the users I am expecting to see some changes in the claims for, as this process does not error. Another solution would be to use an actual Firebase Auth instance and not the local emulator, but it feels a bit messy to combine localhost/emulator resources and actual ones, even with a dev account.

The GH issue: here.