Modules

node_modules/firebase-admin/lib/auth/action-code-settings-builder.js

@@ -0,0 +1,117 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2018 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var validator = require("../utils/validator");
+var error_1 = require("../utils/error");
+/**
+ * Defines the ActionCodeSettings builder class used to convert the
+ * ActionCodeSettings object to its corresponding server request.
+ */
+var ActionCodeSettingsBuilder = /** @class */ (function () {
+    /**
+     * ActionCodeSettingsBuilder constructor.
+     *
+     * @param {ActionCodeSettings} actionCodeSettings The ActionCodeSettings
+     *     object used to initiliaze this server request builder.
+     * @constructor
+     */
+    function ActionCodeSettingsBuilder(actionCodeSettings) {
+        if (!validator.isNonNullObject(actionCodeSettings)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, '"ActionCodeSettings" must be a non-null object.');
+        }
+        if (typeof actionCodeSettings.url === 'undefined') {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.MISSING_CONTINUE_URI);
+        }
+        else if (!validator.isURL(actionCodeSettings.url)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CONTINUE_URI);
+        }
+        this.continueUrl = actionCodeSettings.url;
+        if (typeof actionCodeSettings.handleCodeInApp !== 'undefined' &&
+            !validator.isBoolean(actionCodeSettings.handleCodeInApp)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, '"ActionCodeSettings.handleCodeInApp" must be a boolean.');
+        }
+        this.canHandleCodeInApp = actionCodeSettings.handleCodeInApp || false;
+        if (typeof actionCodeSettings.dynamicLinkDomain !== 'undefined' &&
+            !validator.isNonEmptyString(actionCodeSettings.dynamicLinkDomain)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_DYNAMIC_LINK_DOMAIN);
+        }
+        this.dynamicLinkDomain = actionCodeSettings.dynamicLinkDomain;
+        if (typeof actionCodeSettings.iOS !== 'undefined') {
+            if (!validator.isNonNullObject(actionCodeSettings.iOS)) {
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, '"ActionCodeSettings.iOS" must be a valid non-null object.');
+            }
+            else if (typeof actionCodeSettings.iOS.bundleId === 'undefined') {
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.MISSING_IOS_BUNDLE_ID);
+            }
+            else if (!validator.isNonEmptyString(actionCodeSettings.iOS.bundleId)) {
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, '"ActionCodeSettings.iOS.bundleId" must be a valid non-empty string.');
+            }
+            this.ibi = actionCodeSettings.iOS.bundleId;
+        }
+        if (typeof actionCodeSettings.android !== 'undefined') {
+            if (!validator.isNonNullObject(actionCodeSettings.android)) {
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, '"ActionCodeSettings.android" must be a valid non-null object.');
+            }
+            else if (typeof actionCodeSettings.android.packageName === 'undefined') {
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.MISSING_ANDROID_PACKAGE_NAME);
+            }
+            else if (!validator.isNonEmptyString(actionCodeSettings.android.packageName)) {
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, '"ActionCodeSettings.android.packageName" must be a valid non-empty string.');
+            }
+            else if (typeof actionCodeSettings.android.minimumVersion !== 'undefined' &&
+                !validator.isNonEmptyString(actionCodeSettings.android.minimumVersion)) {
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, '"ActionCodeSettings.android.minimumVersion" must be a valid non-empty string.');
+            }
+            else if (typeof actionCodeSettings.android.installApp !== 'undefined' &&
+                !validator.isBoolean(actionCodeSettings.android.installApp)) {
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, '"ActionCodeSettings.android.installApp" must be a valid boolean.');
+            }
+            this.apn = actionCodeSettings.android.packageName;
+            this.amv = actionCodeSettings.android.minimumVersion;
+            this.installApp = actionCodeSettings.android.installApp || false;
+        }
+    }
+    /**
+     * Returns the corresponding constructed server request corresponding to the
+     * current ActionCodeSettings.
+     *
+     * @return {EmailActionCodeRequest} The constructed EmailActionCodeRequest request.
+     */
+    ActionCodeSettingsBuilder.prototype.buildRequest = function () {
+        var request = {
+            continueUrl: this.continueUrl,
+            canHandleCodeInApp: this.canHandleCodeInApp,
+            dynamicLinkDomain: this.dynamicLinkDomain,
+            androidPackageName: this.apn,
+            androidMinimumVersion: this.amv,
+            androidInstallApp: this.installApp,
+            iOSBundleId: this.ibi,
+        };
+        // Remove all null and undefined fields from request.
+        for (var key in request) {
+            if (request.hasOwnProperty(key)) {
+                if (typeof request[key] === 'undefined' || request[key] === null) {
+                    delete request[key];
+                }
+            }
+        }
+        return request;
+    };
+    return ActionCodeSettingsBuilder;
+}());
+exports.ActionCodeSettingsBuilder = ActionCodeSettingsBuilder;

node_modules/firebase-admin/lib/auth/auth-config.js

@@ -0,0 +1,447 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2018 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var validator = require("../utils/validator");
+var deep_copy_1 = require("../utils/deep-copy");
+var error_1 = require("../utils/error");
+/**
+ * Defines the email sign-in config class used to convert client side EmailSignInConfig
+ * to a format that is understood by the Auth server.
+ */
+var EmailSignInConfig = /** @class */ (function () {
+    /**
+     * The EmailSignInConfig constructor.
+     *
+     * @param {any} response The server side response used to initialize the
+     *     EmailSignInConfig object.
+     * @constructor
+     */
+    function EmailSignInConfig(response) {
+        if (typeof response.allowPasswordSignup === 'undefined') {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INTERNAL_ERROR, 'INTERNAL ASSERT FAILED: Invalid email sign-in configuration response');
+        }
+        this.enabled = response.allowPasswordSignup;
+        this.passwordRequired = !response.enableEmailLinkSignin;
+    }
+    /**
+     * Static method to convert a client side request to a EmailSignInConfigServerRequest.
+     * Throws an error if validation fails.
+     *
+     * @param {any} options The options object to convert to a server request.
+     * @return {EmailSignInConfigServerRequest} The resulting server request.
+     */
+    EmailSignInConfig.buildServerRequest = function (options) {
+        var request = {};
+        EmailSignInConfig.validate(options);
+        if (options.hasOwnProperty('enabled')) {
+            request.allowPasswordSignup = options.enabled;
+        }
+        if (options.hasOwnProperty('passwordRequired')) {
+            request.enableEmailLinkSignin = !options.passwordRequired;
+        }
+        return request;
+    };
+    /**
+     * Validates the EmailSignInConfig options object. Throws an error on failure.
+     *
+     * @param {any} options The options object to validate.
+     */
+    EmailSignInConfig.validate = function (options) {
+        // TODO: Validate the request.
+        var validKeys = {
+            enabled: true,
+            passwordRequired: true,
+        };
+        if (!validator.isNonNullObject(options)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, '"EmailSignInConfig" must be a non-null object.');
+        }
+        // Check for unsupported top level attributes.
+        for (var key in options) {
+            if (!(key in validKeys)) {
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, "\"" + key + "\" is not a valid EmailSignInConfig parameter.");
+            }
+        }
+        // Validate content.
+        if (typeof options.enabled !== 'undefined' &&
+            !validator.isBoolean(options.enabled)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, '"EmailSignInConfig.enabled" must be a boolean.');
+        }
+        if (typeof options.passwordRequired !== 'undefined' &&
+            !validator.isBoolean(options.passwordRequired)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, '"EmailSignInConfig.passwordRequired" must be a boolean.');
+        }
+    };
+    /** @return {object} The plain object representation of the email sign-in config. */
+    EmailSignInConfig.prototype.toJSON = function () {
+        return {
+            enabled: this.enabled,
+            passwordRequired: this.passwordRequired,
+        };
+    };
+    return EmailSignInConfig;
+}());
+exports.EmailSignInConfig = EmailSignInConfig;
+/**
+ * Defines the SAMLConfig class used to convert a client side configuration to its
+ * server side representation.
+ */
+var SAMLConfig = /** @class */ (function () {
+    /**
+     * The SAMLConfig constructor.
+     *
+     * @param {any} response The server side response used to initialize the SAMLConfig object.
+     * @constructor
+     */
+    function SAMLConfig(response) {
+        if (!response ||
+            !response.idpConfig ||
+            !response.idpConfig.idpEntityId ||
+            !response.idpConfig.ssoUrl ||
+            !response.spConfig ||
+            !response.spConfig.spEntityId ||
+            !response.name ||
+            !(validator.isString(response.name) &&
+                SAMLConfig.getProviderIdFromResourceName(response.name))) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INTERNAL_ERROR, 'INTERNAL ASSERT FAILED: Invalid SAML configuration response');
+        }
+        var providerId = SAMLConfig.getProviderIdFromResourceName(response.name);
+        if (!providerId) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INTERNAL_ERROR, 'INTERNAL ASSERT FAILED: Invalid SAML configuration response');
+        }
+        this.providerId = providerId;
+        // RP config.
+        this.rpEntityId = response.spConfig.spEntityId;
+        this.callbackURL = response.spConfig.callbackUri;
+        // IdP config.
+        this.idpEntityId = response.idpConfig.idpEntityId;
+        this.ssoURL = response.idpConfig.ssoUrl;
+        this.enableRequestSigning = !!response.idpConfig.signRequest;
+        var x509Certificates = [];
+        for (var _i = 0, _a = (response.idpConfig.idpCertificates || []); _i < _a.length; _i++) {
+            var cert = _a[_i];
+            if (cert.x509Certificate) {
+                x509Certificates.push(cert.x509Certificate);
+            }
+        }
+        this.x509Certificates = x509Certificates;
+        // When enabled is undefined, it takes its default value of false.
+        this.enabled = !!response.enabled;
+        this.displayName = response.displayName;
+    }
+    /**
+     * Converts a client side request to a SAMLConfigServerRequest which is the format
+     * accepted by the backend server.
+     * Throws an error if validation fails. If the request is not a SAMLConfig request,
+     * returns null.
+     *
+     * @param {SAMLAuthProviderRequest} options The options object to convert to a server request.
+     * @param {boolean=} ignoreMissingFields Whether to ignore missing fields.
+     * @return {?SAMLConfigServerRequest} The resulting server request or null if not valid.
+     */
+    SAMLConfig.buildServerRequest = function (options, ignoreMissingFields) {
+        if (ignoreMissingFields === void 0) { ignoreMissingFields = false; }
+        var makeRequest = validator.isNonNullObject(options) &&
+            (options.providerId || ignoreMissingFields);
+        if (!makeRequest) {
+            return null;
+        }
+        var request = {};
+        // Validate options.
+        SAMLConfig.validate(options, ignoreMissingFields);
+        request.enabled = options.enabled;
+        request.displayName = options.displayName;
+        // IdP config.
+        if (options.idpEntityId || options.ssoURL || options.x509Certificates) {
+            request.idpConfig = {
+                idpEntityId: options.idpEntityId,
+                ssoUrl: options.ssoURL,
+                signRequest: options.enableRequestSigning,
+                idpCertificates: typeof options.x509Certificates === 'undefined' ? undefined : [],
+            };
+            if (options.x509Certificates) {
+                for (var _i = 0, _a = (options.x509Certificates || []); _i < _a.length; _i++) {
+                    var cert = _a[_i];
+                    request.idpConfig.idpCertificates.push({ x509Certificate: cert });
+                }
+            }
+        }
+        // RP config.
+        if (options.callbackURL || options.rpEntityId) {
+            request.spConfig = {
+                spEntityId: options.rpEntityId,
+                callbackUri: options.callbackURL,
+            };
+        }
+        return request;
+    };
+    /**
+     * Returns the provider ID corresponding to the resource name if available.
+     *
+     * @param {string} resourceName The server side resource name.
+     * @return {?string} The provider ID corresponding to the resource, null otherwise.
+     */
+    SAMLConfig.getProviderIdFromResourceName = function (resourceName) {
+        // name is of form projects/project1/inboundSamlConfigs/providerId1
+        var matchProviderRes = resourceName.match(/\/inboundSamlConfigs\/(saml\..*)$/);
+        if (!matchProviderRes || matchProviderRes.length < 2) {
+            return null;
+        }
+        return matchProviderRes[1];
+    };
+    /**
+     * @param {any} providerId The provider ID to check.
+     * @return {boolean} Whether the provider ID corresponds to a SAML provider.
+     */
+    SAMLConfig.isProviderId = function (providerId) {
+        return validator.isNonEmptyString(providerId) && providerId.indexOf('saml.') === 0;
+    };
+    /**
+     * Validates the SAMLConfig options object. Throws an error on failure.
+     *
+     * @param {SAMLAuthProviderRequest} options The options object to validate.
+     * @param {boolean=} ignoreMissingFields Whether to ignore missing fields.
+     */
+    SAMLConfig.validate = function (options, ignoreMissingFields) {
+        if (ignoreMissingFields === void 0) { ignoreMissingFields = false; }
+        var validKeys = {
+            enabled: true,
+            displayName: true,
+            providerId: true,
+            idpEntityId: true,
+            ssoURL: true,
+            x509Certificates: true,
+            rpEntityId: true,
+            callbackURL: true,
+            enableRequestSigning: true,
+        };
+        if (!validator.isNonNullObject(options)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CONFIG, '"SAMLAuthProviderConfig" must be a valid non-null object.');
+        }
+        // Check for unsupported top level attributes.
+        for (var key in options) {
+            if (!(key in validKeys)) {
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CONFIG, "\"" + key + "\" is not a valid SAML config parameter.");
+            }
+        }
+        // Required fields.
+        if (validator.isNonEmptyString(options.providerId)) {
+            if (options.providerId.indexOf('saml.') !== 0) {
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_PROVIDER_ID, '"SAMLAuthProviderConfig.providerId" must be a valid non-empty string prefixed with "saml.".');
+            }
+        }
+        else if (!ignoreMissingFields) {
+            // providerId is required and not provided correctly.
+            throw new error_1.FirebaseAuthError(!options.providerId ? error_1.AuthClientErrorCode.MISSING_PROVIDER_ID : error_1.AuthClientErrorCode.INVALID_PROVIDER_ID, '"SAMLAuthProviderConfig.providerId" must be a valid non-empty string prefixed with "saml.".');
+        }
+        if (!(ignoreMissingFields && typeof options.idpEntityId === 'undefined') &&
+            !validator.isNonEmptyString(options.idpEntityId)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CONFIG, '"SAMLAuthProviderConfig.idpEntityId" must be a valid non-empty string.');
+        }
+        if (!(ignoreMissingFields && typeof options.ssoURL === 'undefined') &&
+            !validator.isURL(options.ssoURL)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CONFIG, '"SAMLAuthProviderConfig.ssoURL" must be a valid URL string.');
+        }
+        if (!(ignoreMissingFields && typeof options.rpEntityId === 'undefined') &&
+            !validator.isNonEmptyString(options.rpEntityId)) {
+            throw new error_1.FirebaseAuthError(!options.rpEntityId ? error_1.AuthClientErrorCode.MISSING_SAML_RELYING_PARTY_CONFIG :
+                error_1.AuthClientErrorCode.INVALID_CONFIG, '"SAMLAuthProviderConfig.rpEntityId" must be a valid non-empty string.');
+        }
+        if (!(ignoreMissingFields && typeof options.callbackURL === 'undefined') &&
+            !validator.isURL(options.callbackURL)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CONFIG, '"SAMLAuthProviderConfig.callbackURL" must be a valid URL string.');
+        }
+        if (!(ignoreMissingFields && typeof options.x509Certificates === 'undefined') &&
+            !validator.isArray(options.x509Certificates)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CONFIG, '"SAMLAuthProviderConfig.x509Certificates" must be a valid array of X509 certificate strings.');
+        }
+        (options.x509Certificates || []).forEach(function (cert) {
+            if (!validator.isNonEmptyString(cert)) {
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CONFIG, '"SAMLAuthProviderConfig.x509Certificates" must be a valid array of X509 certificate strings.');
+            }
+        });
+        if (typeof options.enableRequestSigning !== 'undefined' &&
+            !validator.isBoolean(options.enableRequestSigning)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CONFIG, '"SAMLAuthProviderConfig.enableRequestSigning" must be a boolean.');
+        }
+        if (typeof options.enabled !== 'undefined' &&
+            !validator.isBoolean(options.enabled)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CONFIG, '"SAMLAuthProviderConfig.enabled" must be a boolean.');
+        }
+        if (typeof options.displayName !== 'undefined' &&
+            !validator.isString(options.displayName)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CONFIG, '"SAMLAuthProviderConfig.displayName" must be a valid string.');
+        }
+    };
+    /** @return {SAMLAuthProviderConfig} The plain object representation of the SAMLConfig. */
+    SAMLConfig.prototype.toJSON = function () {
+        return {
+            enabled: this.enabled,
+            displayName: this.displayName,
+            providerId: this.providerId,
+            idpEntityId: this.idpEntityId,
+            ssoURL: this.ssoURL,
+            x509Certificates: deep_copy_1.deepCopy(this.x509Certificates),
+            rpEntityId: this.rpEntityId,
+            callbackURL: this.callbackURL,
+            enableRequestSigning: this.enableRequestSigning,
+        };
+    };
+    return SAMLConfig;
+}());
+exports.SAMLConfig = SAMLConfig;
+/**
+ * Defines the OIDCConfig class used to convert a client side configuration to its
+ * server side representation.
+ */
+var OIDCConfig = /** @class */ (function () {
+    /**
+     * The OIDCConfig constructor.
+     *
+     * @param {any} response The server side response used to initialize the OIDCConfig object.
+     * @constructor
+     */
+    function OIDCConfig(response) {
+        if (!response ||
+            !response.issuer ||
+            !response.clientId ||
+            !response.name ||
+            !(validator.isString(response.name) &&
+                OIDCConfig.getProviderIdFromResourceName(response.name))) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INTERNAL_ERROR, 'INTERNAL ASSERT FAILED: Invalid OIDC configuration response');
+        }
+        var providerId = OIDCConfig.getProviderIdFromResourceName(response.name);
+        if (!providerId) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INTERNAL_ERROR, 'INTERNAL ASSERT FAILED: Invalid SAML configuration response');
+        }
+        this.providerId = providerId;
+        this.clientId = response.clientId;
+        this.issuer = response.issuer;
+        // When enabled is undefined, it takes its default value of false.
+        this.enabled = !!response.enabled;
+        this.displayName = response.displayName;
+    }
+    /**
+     * Converts a client side request to a OIDCConfigServerRequest which is the format
+     * accepted by the backend server.
+     * Throws an error if validation fails. If the request is not a OIDCConfig request,
+     * returns null.
+     *
+     * @param {OIDCAuthProviderRequest} options The options object to convert to a server request.
+     * @param {boolean=} ignoreMissingFields Whether to ignore missing fields.
+     * @return {?OIDCConfigServerRequest} The resulting server request or null if not valid.
+     */
+    OIDCConfig.buildServerRequest = function (options, ignoreMissingFields) {
+        if (ignoreMissingFields === void 0) { ignoreMissingFields = false; }
+        var makeRequest = validator.isNonNullObject(options) &&
+            (options.providerId || ignoreMissingFields);
+        if (!makeRequest) {
+            return null;
+        }
+        var request = {};
+        // Validate options.
+        OIDCConfig.validate(options, ignoreMissingFields);
+        request.enabled = options.enabled;
+        request.displayName = options.displayName;
+        request.issuer = options.issuer;
+        request.clientId = options.clientId;
+        return request;
+    };
+    /**
+     * Returns the provider ID corresponding to the resource name if available.
+     *
+     * @param {string} resourceName The server side resource name
+     * @return {?string} The provider ID corresponding to the resource, null otherwise.
+     */
+    OIDCConfig.getProviderIdFromResourceName = function (resourceName) {
+        // name is of form projects/project1/oauthIdpConfigs/providerId1
+        var matchProviderRes = resourceName.match(/\/oauthIdpConfigs\/(oidc\..*)$/);
+        if (!matchProviderRes || matchProviderRes.length < 2) {
+            return null;
+        }
+        return matchProviderRes[1];
+    };
+    /**
+     * @param {any} providerId The provider ID to check.
+     * @return {boolean} Whether the provider ID corresponds to an OIDC provider.
+     */
+    OIDCConfig.isProviderId = function (providerId) {
+        return validator.isNonEmptyString(providerId) && providerId.indexOf('oidc.') === 0;
+    };
+    /**
+     * Validates the OIDCConfig options object. Throws an error on failure.
+     *
+     * @param {OIDCAuthProviderRequest} options The options object to validate.
+     * @param {boolean=} ignoreMissingFields Whether to ignore missing fields.
+     */
+    OIDCConfig.validate = function (options, ignoreMissingFields) {
+        if (ignoreMissingFields === void 0) { ignoreMissingFields = false; }
+        var validKeys = {
+            enabled: true,
+            displayName: true,
+            providerId: true,
+            clientId: true,
+            issuer: true,
+        };
+        if (!validator.isNonNullObject(options)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CONFIG, '"OIDCAuthProviderConfig" must be a valid non-null object.');
+        }
+        // Check for unsupported top level attributes.
+        for (var key in options) {
+            if (!(key in validKeys)) {
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CONFIG, "\"" + key + "\" is not a valid OIDC config parameter.");
+            }
+        }
+        // Required fields.
+        if (validator.isNonEmptyString(options.providerId)) {
+            if (options.providerId.indexOf('oidc.') !== 0) {
+                throw new error_1.FirebaseAuthError(!options.providerId ? error_1.AuthClientErrorCode.MISSING_PROVIDER_ID : error_1.AuthClientErrorCode.INVALID_PROVIDER_ID, '"OIDCAuthProviderConfig.providerId" must be a valid non-empty string prefixed with "oidc.".');
+            }
+        }
+        else if (!ignoreMissingFields) {
+            throw new error_1.FirebaseAuthError(!options.providerId ? error_1.AuthClientErrorCode.MISSING_PROVIDER_ID : error_1.AuthClientErrorCode.INVALID_PROVIDER_ID, '"OIDCAuthProviderConfig.providerId" must be a valid non-empty string prefixed with "oidc.".');
+        }
+        if (!(ignoreMissingFields && typeof options.clientId === 'undefined') &&
+            !validator.isNonEmptyString(options.clientId)) {
+            throw new error_1.FirebaseAuthError(!options.clientId ? error_1.AuthClientErrorCode.MISSING_OAUTH_CLIENT_ID : error_1.AuthClientErrorCode.INVALID_OAUTH_CLIENT_ID, '"OIDCAuthProviderConfig.clientId" must be a valid non-empty string.');
+        }
+        if (!(ignoreMissingFields && typeof options.issuer === 'undefined') &&
+            !validator.isURL(options.issuer)) {
+            throw new error_1.FirebaseAuthError(!options.issuer ? error_1.AuthClientErrorCode.MISSING_ISSUER : error_1.AuthClientErrorCode.INVALID_CONFIG, '"OIDCAuthProviderConfig.issuer" must be a valid URL string.');
+        }
+        if (typeof options.enabled !== 'undefined' &&
+            !validator.isBoolean(options.enabled)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CONFIG, '"OIDCAuthProviderConfig.enabled" must be a boolean.');
+        }
+        if (typeof options.displayName !== 'undefined' &&
+            !validator.isString(options.displayName)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CONFIG, '"OIDCAuthProviderConfig.displayName" must be a valid string.');
+        }
+    };
+    /** @return {OIDCAuthProviderConfig} The plain object representation of the OIDCConfig. */
+    OIDCConfig.prototype.toJSON = function () {
+        return {
+            enabled: this.enabled,
+            displayName: this.displayName,
+            providerId: this.providerId,
+            issuer: this.issuer,
+            clientId: this.clientId,
+        };
+    };
+    return OIDCConfig;
+}());
+exports.OIDCConfig = OIDCConfig;

node_modules/firebase-admin/lib/auth/auth.js

@@ -0,0 +1,674 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2017 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+var __extends = (this && this.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (b.hasOwnProperty(p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+var user_record_1 = require("./user-record");
+var token_generator_1 = require("./token-generator");
+var auth_api_request_1 = require("./auth-api-request");
+var error_1 = require("../utils/error");
+var utils = require("../utils/index");
+var validator = require("../utils/validator");
+var token_verifier_1 = require("./token-verifier");
+var auth_config_1 = require("./auth-config");
+var tenant_manager_1 = require("./tenant-manager");
+/**
+ * Internals of an Auth instance.
+ */
+var AuthInternals = /** @class */ (function () {
+    function AuthInternals() {
+    }
+    /**
+     * Deletes the service and its associated resources.
+     *
+     * @return {Promise<()>} An empty Promise that will be fulfilled when the service is deleted.
+     */
+    AuthInternals.prototype.delete = function () {
+        // There are no resources to clean up
+        return Promise.resolve(undefined);
+    };
+    return AuthInternals;
+}());
+/**
+ * Base Auth class. Mainly used for user management APIs.
+ */
+var BaseAuth = /** @class */ (function () {
+    /**
+     * The BaseAuth class constructor.
+     *
+     * @param app The FirebaseApp to associate with this Auth instance.
+     * @param authRequestHandler The RPC request handler for this instance.
+     * @param tokenGenerator Optional token generator. If not specified, a
+     *     (non-tenant-aware) instance will be created. Use this paramter to
+     *     specify a tenant-aware tokenGenerator.
+     * @constructor
+     */
+    function BaseAuth(app, authRequestHandler, tokenGenerator) {
+        this.authRequestHandler = authRequestHandler;
+        if (tokenGenerator) {
+            this.tokenGenerator = tokenGenerator;
+        }
+        else {
+            var cryptoSigner = token_generator_1.cryptoSignerFromApp(app);
+            this.tokenGenerator = new token_generator_1.FirebaseTokenGenerator(cryptoSigner);
+        }
+        this.sessionCookieVerifier = token_verifier_1.createSessionCookieVerifier(app);
+        this.idTokenVerifier = token_verifier_1.createIdTokenVerifier(app);
+    }
+    /**
+     * Creates a new custom token that can be sent back to a client to use with
+     * signInWithCustomToken().
+     *
+     * @param {string} uid The uid to use as the JWT subject.
+     * @param {object=} developerClaims Optional additional claims to include in the JWT payload.
+     *
+     * @return {Promise<string>} A JWT for the provided payload.
+     */
+    BaseAuth.prototype.createCustomToken = function (uid, developerClaims) {
+        return this.tokenGenerator.createCustomToken(uid, developerClaims);
+    };
+    /**
+     * Verifies a JWT auth token. Returns a Promise with the tokens claims. Rejects
+     * the promise if the token could not be verified. If checkRevoked is set to true,
+     * verifies if the session corresponding to the ID token was revoked. If the corresponding
+     * user's session was invalidated, an auth/id-token-revoked error is thrown. If not specified
+     * the check is not applied.
+     *
+     * @param {string} idToken The JWT to verify.
+     * @param {boolean=} checkRevoked Whether to check if the ID token is revoked.
+     * @return {Promise<DecodedIdToken>} A Promise that will be fulfilled after a successful
+     *     verification.
+     */
+    BaseAuth.prototype.verifyIdToken = function (idToken, checkRevoked) {
+        var _this = this;
+        if (checkRevoked === void 0) { checkRevoked = false; }
+        return this.idTokenVerifier.verifyJWT(idToken)
+            .then(function (decodedIdToken) {
+            // Whether to check if the token was revoked.
+            if (!checkRevoked) {
+                return decodedIdToken;
+            }
+            return _this.verifyDecodedJWTNotRevoked(decodedIdToken, error_1.AuthClientErrorCode.ID_TOKEN_REVOKED);
+        });
+    };
+    /**
+     * Looks up the user identified by the provided user id and returns a promise that is
+     * fulfilled with a user record for the given user if that user is found.
+     *
+     * @param {string} uid The uid of the user to look up.
+     * @return {Promise<UserRecord>} A promise that resolves with the corresponding user record.
+     */
+    BaseAuth.prototype.getUser = function (uid) {
+        return this.authRequestHandler.getAccountInfoByUid(uid)
+            .then(function (response) {
+            // Returns the user record populated with server response.
+            return new user_record_1.UserRecord(response.users[0]);
+        });
+    };
+    /**
+     * Looks up the user identified by the provided email and returns a promise that is
+     * fulfilled with a user record for the given user if that user is found.
+     *
+     * @param {string} email The email of the user to look up.
+     * @return {Promise<UserRecord>} A promise that resolves with the corresponding user record.
+     */
+    BaseAuth.prototype.getUserByEmail = function (email) {
+        return this.authRequestHandler.getAccountInfoByEmail(email)
+            .then(function (response) {
+            // Returns the user record populated with server response.
+            return new user_record_1.UserRecord(response.users[0]);
+        });
+    };
+    /**
+     * Looks up the user identified by the provided phone number and returns a promise that is
+     * fulfilled with a user record for the given user if that user is found.
+     *
+     * @param {string} phoneNumber The phone number of the user to look up.
+     * @return {Promise<UserRecord>} A promise that resolves with the corresponding user record.
+     */
+    BaseAuth.prototype.getUserByPhoneNumber = function (phoneNumber) {
+        return this.authRequestHandler.getAccountInfoByPhoneNumber(phoneNumber)
+            .then(function (response) {
+            // Returns the user record populated with server response.
+            return new user_record_1.UserRecord(response.users[0]);
+        });
+    };
+    /**
+     * Exports a batch of user accounts. Batch size is determined by the maxResults argument.
+     * Starting point of the batch is determined by the pageToken argument.
+     *
+     * @param {number=} maxResults The page size, 1000 if undefined. This is also the maximum
+     *     allowed limit.
+     * @param {string=} pageToken The next page token. If not specified, returns users starting
+     *     without any offset.
+     * @return {Promise<{users: UserRecord[], pageToken?: string}>} A promise that resolves with
+     *     the current batch of downloaded users and the next page token. For the last page, an
+     *     empty list of users and no page token are returned.
+     */
+    BaseAuth.prototype.listUsers = function (maxResults, pageToken) {
+        return this.authRequestHandler.downloadAccount(maxResults, pageToken)
+            .then(function (response) {
+            // List of users to return.
+            var users = [];
+            // Convert each user response to a UserRecord.
+            response.users.forEach(function (userResponse) {
+                users.push(new user_record_1.UserRecord(userResponse));
+            });
+            // Return list of user records and the next page token if available.
+            var result = {
+                users: users,
+                pageToken: response.nextPageToken,
+            };
+            // Delete result.pageToken if undefined.
+            if (typeof result.pageToken === 'undefined') {
+                delete result.pageToken;
+            }
+            return result;
+        });
+    };
+    /**
+     * Creates a new user with the properties provided.
+     *
+     * @param {CreateRequest} properties The properties to set on the new user record to be created.
+     * @return {Promise<UserRecord>} A promise that resolves with the newly created user record.
+     */
+    BaseAuth.prototype.createUser = function (properties) {
+        var _this = this;
+        return this.authRequestHandler.createNewAccount(properties)
+            .then(function (uid) {
+            // Return the corresponding user record.
+            return _this.getUser(uid);
+        })
+            .catch(function (error) {
+            if (error.code === 'auth/user-not-found') {
+                // Something must have happened after creating the user and then retrieving it.
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INTERNAL_ERROR, 'Unable to create the user record provided.');
+            }
+            throw error;
+        });
+    };
+    /**
+     * Deletes the user identified by the provided user id and returns a promise that is
+     * fulfilled when the user is found and successfully deleted.
+     *
+     * @param {string} uid The uid of the user to delete.
+     * @return {Promise<void>} A promise that resolves when the user is successfully deleted.
+     */
+    BaseAuth.prototype.deleteUser = function (uid) {
+        return this.authRequestHandler.deleteAccount(uid)
+            .then(function (response) {
+            // Return nothing on success.
+        });
+    };
+    /**
+     * Updates an existing user with the properties provided.
+     *
+     * @param {string} uid The uid identifier of the user to update.
+     * @param {UpdateRequest} properties The properties to update on the existing user.
+     * @return {Promise<UserRecord>} A promise that resolves with the modified user record.
+     */
+    BaseAuth.prototype.updateUser = function (uid, properties) {
+        var _this = this;
+        return this.authRequestHandler.updateExistingAccount(uid, properties)
+            .then(function (existingUid) {
+            // Return the corresponding user record.
+            return _this.getUser(existingUid);
+        });
+    };
+    /**
+     * Sets additional developer claims on an existing user identified by the provided UID.
+     *
+     * @param {string} uid The user to edit.
+     * @param {object} customUserClaims The developer claims to set.
+     * @return {Promise<void>} A promise that resolves when the operation completes
+     *     successfully.
+     */
+    BaseAuth.prototype.setCustomUserClaims = function (uid, customUserClaims) {
+        return this.authRequestHandler.setCustomUserClaims(uid, customUserClaims)
+            .then(function (existingUid) {
+            // Return nothing on success.
+        });
+    };
+    /**
+     * Revokes all refresh tokens for the specified user identified by the provided UID.
+     * In addition to revoking all refresh tokens for a user, all ID tokens issued before
+     * revocation will also be revoked on the Auth backend. Any request with an ID token
+     * generated before revocation will be rejected with a token expired error.
+     *
+     * @param {string} uid The user whose tokens are to be revoked.
+     * @return {Promise<void>} A promise that resolves when the operation completes
+     *     successfully.
+     */
+    BaseAuth.prototype.revokeRefreshTokens = function (uid) {
+        return this.authRequestHandler.revokeRefreshTokens(uid)
+            .then(function (existingUid) {
+            // Return nothing on success.
+        });
+    };
+    /**
+     * Imports the list of users provided to Firebase Auth. This is useful when
+     * migrating from an external authentication system without having to use the Firebase CLI SDK.
+     * At most, 1000 users are allowed to be imported one at a time.
+     * When importing a list of password users, UserImportOptions are required to be specified.
+     *
+     * @param {UserImportRecord[]} users The list of user records to import to Firebase Auth.
+     * @param {UserImportOptions=} options The user import options, required when the users provided
+     *     include password credentials.
+     * @return {Promise<UserImportResult>} A promise that resolves when the operation completes
+     *     with the result of the import. This includes the number of successful imports, the number
+     *     of failed uploads and their corresponding errors.
+     */
+    BaseAuth.prototype.importUsers = function (users, options) {
+        return this.authRequestHandler.uploadAccount(users, options);
+    };
+    /**
+     * Creates a new Firebase session cookie with the specified options that can be used for
+     * session management (set as a server side session cookie with custom cookie policy).
+     * The session cookie JWT will have the same payload claims as the provided ID token.
+     *
+     * @param {string} idToken The Firebase ID token to exchange for a session cookie.
+     * @param {SessionCookieOptions} sessionCookieOptions The session cookie options which includes
+     *     custom session duration.
+     *
+     * @return {Promise<string>} A promise that resolves on success with the created session cookie.
+     */
+    BaseAuth.prototype.createSessionCookie = function (idToken, sessionCookieOptions) {
+        // Return rejected promise if expiresIn is not available.
+        if (!validator.isNonNullObject(sessionCookieOptions) ||
+            !validator.isNumber(sessionCookieOptions.expiresIn)) {
+            return Promise.reject(new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_SESSION_COOKIE_DURATION));
+        }
+        return this.authRequestHandler.createSessionCookie(idToken, sessionCookieOptions.expiresIn);
+    };
+    /**
+     * Verifies a Firebase session cookie. Returns a Promise with the tokens claims. Rejects
+     * the promise if the token could not be verified. If checkRevoked is set to true,
+     * verifies if the session corresponding to the session cookie was revoked. If the corresponding
+     * user's session was invalidated, an auth/session-cookie-revoked error is thrown. If not
+     * specified the check is not performed.
+     *
+     * @param {string} sessionCookie The session cookie to verify.
+     * @param {boolean=} checkRevoked Whether to check if the session cookie is revoked.
+     * @return {Promise<DecodedIdToken>} A Promise that will be fulfilled after a successful
+     *     verification.
+     */
+    BaseAuth.prototype.verifySessionCookie = function (sessionCookie, checkRevoked) {
+        var _this = this;
+        if (checkRevoked === void 0) { checkRevoked = false; }
+        return this.sessionCookieVerifier.verifyJWT(sessionCookie)
+            .then(function (decodedIdToken) {
+            // Whether to check if the token was revoked.
+            if (!checkRevoked) {
+                return decodedIdToken;
+            }
+            return _this.verifyDecodedJWTNotRevoked(decodedIdToken, error_1.AuthClientErrorCode.SESSION_COOKIE_REVOKED);
+        });
+    };
+    /**
+     * Generates the out of band email action link for password reset flows for the
+     * email specified using the action code settings provided.
+     * Returns a promise that resolves with the generated link.
+     *
+     * @param {string} email The email of the user whose password is to be reset.
+     * @param {ActionCodeSettings=} actionCodeSettings The optional action code setings which defines whether
+     *     the link is to be handled by a mobile app and the additional state information to be passed in the
+     *     deep link, etc.
+     * @return {Promise<string>} A promise that resolves with the password reset link.
+     */
+    BaseAuth.prototype.generatePasswordResetLink = function (email, actionCodeSettings) {
+        return this.authRequestHandler.getEmailActionLink('PASSWORD_RESET', email, actionCodeSettings);
+    };
+    /**
+     * Generates the out of band email action link for email verification flows for the
+     * email specified using the action code settings provided.
+     * Returns a promise that resolves with the generated link.
+     *
+     * @param {string} email The email of the user to be verified.
+     * @param {ActionCodeSettings=} actionCodeSettings The optional action code setings which defines whether
+     *     the link is to be handled by a mobile app and the additional state information to be passed in the
+     *     deep link, etc.
+     * @return {Promise<string>} A promise that resolves with the email verification link.
+     */
+    BaseAuth.prototype.generateEmailVerificationLink = function (email, actionCodeSettings) {
+        return this.authRequestHandler.getEmailActionLink('VERIFY_EMAIL', email, actionCodeSettings);
+    };
+    /**
+     * Generates the out of band email action link for email link sign-in flows for the
+     * email specified using the action code settings provided.
+     * Returns a promise that resolves with the generated link.
+     *
+     * @param {string} email The email of the user signing in.
+     * @param {ActionCodeSettings} actionCodeSettings The required action code setings which defines whether
+     *     the link is to be handled by a mobile app and the additional state information to be passed in the
+     *     deep link, etc.
+     * @return {Promise<string>} A promise that resolves with the email sign-in link.
+     */
+    BaseAuth.prototype.generateSignInWithEmailLink = function (email, actionCodeSettings) {
+        return this.authRequestHandler.getEmailActionLink('EMAIL_SIGNIN', email, actionCodeSettings);
+    };
+    /**
+     * Returns the list of existing provider configuation matching the filter provided.
+     * At most, 100 provider configs are allowed to be imported at a time.
+     *
+     * @param {AuthProviderConfigFilter} options The provider config filter to apply.
+     * @return {Promise<ListProviderConfigResults>} A promise that resolves with the list of provider configs
+     *     meeting the filter requirements.
+     */
+    BaseAuth.prototype.listProviderConfigs = function (options) {
+        var processResponse = function (response, providerConfigs) {
+            // Return list of provider configuration and the next page token if available.
+            var result = {
+                providerConfigs: providerConfigs,
+            };
+            // Delete result.pageToken if undefined.
+            if (response.hasOwnProperty('nextPageToken')) {
+                result.pageToken = response.nextPageToken;
+            }
+            return result;
+        };
+        if (options && options.type === 'oidc') {
+            return this.authRequestHandler.listOAuthIdpConfigs(options.maxResults, options.pageToken)
+                .then(function (response) {
+                // List of provider configurations to return.
+                var providerConfigs = [];
+                // Convert each provider config response to a OIDCConfig.
+                response.oauthIdpConfigs.forEach(function (configResponse) {
+                    providerConfigs.push(new auth_config_1.OIDCConfig(configResponse));
+                });
+                // Return list of provider configuration and the next page token if available.
+                return processResponse(response, providerConfigs);
+            });
+        }
+        else if (options && options.type === 'saml') {
+            return this.authRequestHandler.listInboundSamlConfigs(options.maxResults, options.pageToken)
+                .then(function (response) {
+                // List of provider configurations to return.
+                var providerConfigs = [];
+                // Convert each provider config response to a SAMLConfig.
+                response.inboundSamlConfigs.forEach(function (configResponse) {
+                    providerConfigs.push(new auth_config_1.SAMLConfig(configResponse));
+                });
+                // Return list of provider configuration and the next page token if available.
+                return processResponse(response, providerConfigs);
+            });
+        }
+        return Promise.reject(new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, "\"AuthProviderConfigFilter.type\" must be either \"saml' or \"oidc\""));
+    };
+    /**
+     * Looks up an Auth provider configuration by ID.
+     * Returns a promise that resolves with the provider configuration corresponding to the provider ID specified.
+     *
+     * @param {string} providerId  The provider ID corresponding to the provider config to return.
+     * @return {Promise<AuthProviderConfig>}
+     */
+    BaseAuth.prototype.getProviderConfig = function (providerId) {
+        if (auth_config_1.OIDCConfig.isProviderId(providerId)) {
+            return this.authRequestHandler.getOAuthIdpConfig(providerId)
+                .then(function (response) {
+                return new auth_config_1.OIDCConfig(response);
+            });
+        }
+        else if (auth_config_1.SAMLConfig.isProviderId(providerId)) {
+            return this.authRequestHandler.getInboundSamlConfig(providerId)
+                .then(function (response) {
+                return new auth_config_1.SAMLConfig(response);
+            });
+        }
+        return Promise.reject(new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_PROVIDER_ID));
+    };
+    /**
+     * Deletes the provider configuration corresponding to the provider ID passed.
+     *
+     * @param {string} providerId The provider ID corresponding to the provider config to delete.
+     * @return {Promise<void>} A promise that resolves on completion.
+     */
+    BaseAuth.prototype.deleteProviderConfig = function (providerId) {
+        if (auth_config_1.OIDCConfig.isProviderId(providerId)) {
+            return this.authRequestHandler.deleteOAuthIdpConfig(providerId);
+        }
+        else if (auth_config_1.SAMLConfig.isProviderId(providerId)) {
+            return this.authRequestHandler.deleteInboundSamlConfig(providerId);
+        }
+        return Promise.reject(new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_PROVIDER_ID));
+    };
+    /**
+     * Returns a promise that resolves with the updated AuthProviderConfig when the provider configuration corresponding
+     * to the provider ID specified is updated with the specified configuration.
+     *
+     * @param {string} providerId The provider ID corresponding to the provider config to update.
+     * @param {UpdateAuthProviderRequest} updatedConfig The updated configuration.
+     * @return {Promise<AuthProviderConfig>} A promise that resolves with the updated provider configuration.
+     */
+    BaseAuth.prototype.updateProviderConfig = function (providerId, updatedConfig) {
+        if (!validator.isNonNullObject(updatedConfig)) {
+            return Promise.reject(new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CONFIG, 'Request is missing "UpdateAuthProviderRequest" configuration.'));
+        }
+        if (auth_config_1.OIDCConfig.isProviderId(providerId)) {
+            return this.authRequestHandler.updateOAuthIdpConfig(providerId, updatedConfig)
+                .then(function (response) {
+                return new auth_config_1.OIDCConfig(response);
+            });
+        }
+        else if (auth_config_1.SAMLConfig.isProviderId(providerId)) {
+            return this.authRequestHandler.updateInboundSamlConfig(providerId, updatedConfig)
+                .then(function (response) {
+                return new auth_config_1.SAMLConfig(response);
+            });
+        }
+        return Promise.reject(new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_PROVIDER_ID));
+    };
+    /**
+     * Returns a promise that resolves with the newly created AuthProviderConfig when the new provider configuration is
+     * created.
+     * @param {AuthProviderConfig} config The provider configuration to create.
+     * @return {Promise<AuthProviderConfig>} A promise that resolves with the created provider configuration.
+     */
+    BaseAuth.prototype.createProviderConfig = function (config) {
+        if (!validator.isNonNullObject(config)) {
+            return Promise.reject(new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CONFIG, 'Request is missing "AuthProviderConfig" configuration.'));
+        }
+        if (auth_config_1.OIDCConfig.isProviderId(config.providerId)) {
+            return this.authRequestHandler.createOAuthIdpConfig(config)
+                .then(function (response) {
+                return new auth_config_1.OIDCConfig(response);
+            });
+        }
+        else if (auth_config_1.SAMLConfig.isProviderId(config.providerId)) {
+            return this.authRequestHandler.createInboundSamlConfig(config)
+                .then(function (response) {
+                return new auth_config_1.SAMLConfig(response);
+            });
+        }
+        return Promise.reject(new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_PROVIDER_ID));
+    };
+    /**
+     * Verifies the decoded Firebase issued JWT is not revoked. Returns a promise that resolves
+     * with the decoded claims on success. Rejects the promise with revocation error if revoked.
+     *
+     * @param {DecodedIdToken} decodedIdToken The JWT's decoded claims.
+     * @param {ErrorInfo} revocationErrorInfo The revocation error info to throw on revocation
+     *     detection.
+     * @return {Promise<DecodedIdToken>} A Promise that will be fulfilled after a successful
+     *     verification.
+     */
+    BaseAuth.prototype.verifyDecodedJWTNotRevoked = function (decodedIdToken, revocationErrorInfo) {
+        // Get tokens valid after time for the corresponding user.
+        return this.getUser(decodedIdToken.sub)
+            .then(function (user) {
+            // If no tokens valid after time available, token is not revoked.
+            if (user.tokensValidAfterTime) {
+                // Get the ID token authentication time and convert to milliseconds UTC.
+                var authTimeUtc = decodedIdToken.auth_time * 1000;
+                // Get user tokens valid after time in milliseconds UTC.
+                var validSinceUtc = new Date(user.tokensValidAfterTime).getTime();
+                // Check if authentication time is older than valid since time.
+                if (authTimeUtc < validSinceUtc) {
+                    throw new error_1.FirebaseAuthError(revocationErrorInfo);
+                }
+            }
+            // All checks above passed. Return the decoded token.
+            return decodedIdToken;
+        });
+    };
+    return BaseAuth;
+}());
+exports.BaseAuth = BaseAuth;
+/**
+ * The tenant aware Auth class.
+ */
+var TenantAwareAuth = /** @class */ (function (_super) {
+    __extends(TenantAwareAuth, _super);
+    /**
+     * The TenantAwareAuth class constructor.
+     *
+     * @param {object} app The app that created this tenant.
+     * @param tenantId The corresponding tenant ID.
+     * @constructor
+     */
+    function TenantAwareAuth(app, tenantId) {
+        var _this = this;
+        var cryptoSigner = token_generator_1.cryptoSignerFromApp(app);
+        var tokenGenerator = new token_generator_1.FirebaseTokenGenerator(cryptoSigner, tenantId);
+        _this = _super.call(this, app, new auth_api_request_1.TenantAwareAuthRequestHandler(app, tenantId), tokenGenerator) || this;
+        utils.addReadonlyGetter(_this, 'tenantId', tenantId);
+        return _this;
+    }
+    /**
+     * Verifies a JWT auth token. Returns a Promise with the tokens claims. Rejects
+     * the promise if the token could not be verified. If checkRevoked is set to true,
+     * verifies if the session corresponding to the ID token was revoked. If the corresponding
+     * user's session was invalidated, an auth/id-token-revoked error is thrown. If not specified
+     * the check is not applied.
+     *
+     * @param {string} idToken The JWT to verify.
+     * @param {boolean=} checkRevoked Whether to check if the ID token is revoked.
+     * @return {Promise<DecodedIdToken>} A Promise that will be fulfilled after a successful
+     *     verification.
+     */
+    TenantAwareAuth.prototype.verifyIdToken = function (idToken, checkRevoked) {
+        var _this = this;
+        if (checkRevoked === void 0) { checkRevoked = false; }
+        return _super.prototype.verifyIdToken.call(this, idToken, checkRevoked)
+            .then(function (decodedClaims) {
+            // Validate tenant ID.
+            if (decodedClaims.firebase.tenant !== _this.tenantId) {
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.MISMATCHING_TENANT_ID);
+            }
+            return decodedClaims;
+        });
+    };
+    /**
+     * Creates a new Firebase session cookie with the specified options that can be used for
+     * session management (set as a server side session cookie with custom cookie policy).
+     * The session cookie JWT will have the same payload claims as the provided ID token.
+     *
+     * @param {string} idToken The Firebase ID token to exchange for a session cookie.
+     * @param {SessionCookieOptions} sessionCookieOptions The session cookie options which includes
+     *     custom session duration.
+     *
+     * @return {Promise<string>} A promise that resolves on success with the created session cookie.
+     */
+    TenantAwareAuth.prototype.createSessionCookie = function (idToken, sessionCookieOptions) {
+        var _this = this;
+        // Validate arguments before processing.
+        if (!validator.isNonEmptyString(idToken)) {
+            return Promise.reject(new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ID_TOKEN));
+        }
+        if (!validator.isNonNullObject(sessionCookieOptions) ||
+            !validator.isNumber(sessionCookieOptions.expiresIn)) {
+            return Promise.reject(new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_SESSION_COOKIE_DURATION));
+        }
+        // This will verify the ID token and then match the tenant ID before creating the session cookie.
+        return this.verifyIdToken(idToken)
+            .then(function (decodedIdTokenClaims) {
+            return _super.prototype.createSessionCookie.call(_this, idToken, sessionCookieOptions);
+        });
+    };
+    /**
+     * Verifies a Firebase session cookie. Returns a Promise with the tokens claims. Rejects
+     * the promise if the token could not be verified. If checkRevoked is set to true,
+     * verifies if the session corresponding to the session cookie was revoked. If the corresponding
+     * user's session was invalidated, an auth/session-cookie-revoked error is thrown. If not
+     * specified the check is not performed.
+     *
+     * @param {string} sessionCookie The session cookie to verify.
+     * @param {boolean=} checkRevoked Whether to check if the session cookie is revoked.
+     * @return {Promise<DecodedIdToken>} A Promise that will be fulfilled after a successful
+     *     verification.
+     */
+    TenantAwareAuth.prototype.verifySessionCookie = function (sessionCookie, checkRevoked) {
+        var _this = this;
+        if (checkRevoked === void 0) { checkRevoked = false; }
+        return _super.prototype.verifySessionCookie.call(this, sessionCookie, checkRevoked)
+            .then(function (decodedClaims) {
+            if (decodedClaims.firebase.tenant !== _this.tenantId) {
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.MISMATCHING_TENANT_ID);
+            }
+            return decodedClaims;
+        });
+    };
+    return TenantAwareAuth;
+}(BaseAuth));
+exports.TenantAwareAuth = TenantAwareAuth;
+/**
+ * Auth service bound to the provided app.
+ * An Auth instance can have multiple tenants.
+ */
+var Auth = /** @class */ (function (_super) {
+    __extends(Auth, _super);
+    /**
+     * @param {object} app The app for this Auth service.
+     * @constructor
+     */
+    function Auth(app) {
+        var _this = _super.call(this, app, new auth_api_request_1.AuthRequestHandler(app)) || this;
+        _this.INTERNAL = new AuthInternals();
+        _this.app_ = app;
+        _this.tenantManager_ = new tenant_manager_1.TenantManager(app);
+        return _this;
+    }
+    Object.defineProperty(Auth.prototype, "app", {
+        /**
+         * Returns the app associated with this Auth instance.
+         *
+         * @return {FirebaseApp} The app associated with this Auth instance.
+         */
+        get: function () {
+            return this.app_;
+        },
+        enumerable: true,
+        configurable: true
+    });
+    /** @return The current Auth instance's tenant manager. */
+    Auth.prototype.tenantManager = function () {
+        return this.tenantManager_;
+    };
+    return Auth;
+}(BaseAuth));
+exports.Auth = Auth;

node_modules/firebase-admin/lib/auth/credential.js

@@ -0,0 +1,389 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2017 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+// Use untyped import syntax for Node built-ins
+var fs = require("fs");
+var os = require("os");
+var path = require("path");
+var error_1 = require("../utils/error");
+var api_request_1 = require("../utils/api-request");
+var util = require("../utils/validator");
+var GOOGLE_TOKEN_AUDIENCE = 'https://accounts.google.com/o/oauth2/token';
+var GOOGLE_AUTH_TOKEN_HOST = 'accounts.google.com';
+var GOOGLE_AUTH_TOKEN_PATH = '/o/oauth2/token';
+// NOTE: the Google Metadata Service uses HTTP over a vlan
+var GOOGLE_METADATA_SERVICE_HOST = 'metadata.google.internal';
+var GOOGLE_METADATA_SERVICE_TOKEN_PATH = '/computeMetadata/v1/instance/service-accounts/default/token';
+var GOOGLE_METADATA_SERVICE_PROJECT_ID_PATH = '/computeMetadata/v1/project/project-id';
+var configDir = (function () {
+    // Windows has a dedicated low-rights location for apps at ~/Application Data
+    var sys = os.platform();
+    if (sys && sys.length >= 3 && sys.substring(0, 3).toLowerCase() === 'win') {
+        return process.env.APPDATA;
+    }
+    // On *nix the gcloud cli creates a . dir.
+    return process.env.HOME && path.resolve(process.env.HOME, '.config');
+})();
+var GCLOUD_CREDENTIAL_SUFFIX = 'gcloud/application_default_credentials.json';
+var GCLOUD_CREDENTIAL_PATH = configDir && path.resolve(configDir, GCLOUD_CREDENTIAL_SUFFIX);
+var REFRESH_TOKEN_HOST = 'www.googleapis.com';
+var REFRESH_TOKEN_PATH = '/oauth2/v4/token';
+var ONE_HOUR_IN_SECONDS = 60 * 60;
+var JWT_ALGORITHM = 'RS256';
+/**
+ * Implementation of Credential that uses a service account.
+ */
+var ServiceAccountCredential = /** @class */ (function () {
+    /**
+     * Creates a new ServiceAccountCredential from the given parameters.
+     *
+     * @param serviceAccountPathOrObject Service account json object or path to a service account json file.
+     * @param httpAgent Optional http.Agent to use when calling the remote token server.
+     * @param implicit An optinal boolean indicating whether this credential was implicitly discovered from the
+     *   environment, as opposed to being explicitly specified by the developer.
+     *
+     * @constructor
+     */
+    function ServiceAccountCredential(serviceAccountPathOrObject, httpAgent, implicit) {
+        if (implicit === void 0) { implicit = false; }
+        this.httpAgent = httpAgent;
+        this.implicit = implicit;
+        var serviceAccount = (typeof serviceAccountPathOrObject === 'string') ?
+            ServiceAccount.fromPath(serviceAccountPathOrObject)
+            : new ServiceAccount(serviceAccountPathOrObject);
+        this.projectId = serviceAccount.projectId;
+        this.privateKey = serviceAccount.privateKey;
+        this.clientEmail = serviceAccount.clientEmail;
+        this.httpClient = new api_request_1.HttpClient();
+    }
+    ServiceAccountCredential.prototype.getAccessToken = function () {
+        var token = this.createAuthJwt_();
+        var postData = 'grant_type=urn%3Aietf%3Aparams%3Aoauth%3A' +
+            'grant-type%3Ajwt-bearer&assertion=' + token;
+        var request = {
+            method: 'POST',
+            url: "https://" + GOOGLE_AUTH_TOKEN_HOST + GOOGLE_AUTH_TOKEN_PATH,
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            data: postData,
+            httpAgent: this.httpAgent,
+        };
+        return requestAccessToken(this.httpClient, request);
+    };
+    ServiceAccountCredential.prototype.createAuthJwt_ = function () {
+        var claims = {
+            scope: [
+                'https://www.googleapis.com/auth/cloud-platform',
+                'https://www.googleapis.com/auth/firebase.database',
+                'https://www.googleapis.com/auth/firebase.messaging',
+                'https://www.googleapis.com/auth/identitytoolkit',
+                'https://www.googleapis.com/auth/userinfo.email',
+            ].join(' '),
+        };
+        var jwt = require('jsonwebtoken');
+        // This method is actually synchronous so we can capture and return the buffer.
+        return jwt.sign(claims, this.privateKey, {
+            audience: GOOGLE_TOKEN_AUDIENCE,
+            expiresIn: ONE_HOUR_IN_SECONDS,
+            issuer: this.clientEmail,
+            algorithm: JWT_ALGORITHM,
+        });
+    };
+    return ServiceAccountCredential;
+}());
+exports.ServiceAccountCredential = ServiceAccountCredential;
+/**
+ * A struct containing the properties necessary to use service account JSON credentials.
+ */
+var ServiceAccount = /** @class */ (function () {
+    function ServiceAccount(json) {
+        if (!util.isNonNullObject(json)) {
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Service account must be an object.');
+        }
+        copyAttr(this, json, 'projectId', 'project_id');
+        copyAttr(this, json, 'privateKey', 'private_key');
+        copyAttr(this, json, 'clientEmail', 'client_email');
+        var errorMessage;
+        if (!util.isNonEmptyString(this.projectId)) {
+            errorMessage = 'Service account object must contain a string "project_id" property.';
+        }
+        else if (!util.isNonEmptyString(this.privateKey)) {
+            errorMessage = 'Service account object must contain a string "private_key" property.';
+        }
+        else if (!util.isNonEmptyString(this.clientEmail)) {
+            errorMessage = 'Service account object must contain a string "client_email" property.';
+        }
+        if (typeof errorMessage !== 'undefined') {
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, errorMessage);
+        }
+        var forge = require('node-forge');
+        try {
+            forge.pki.privateKeyFromPem(this.privateKey);
+        }
+        catch (error) {
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Failed to parse private key: ' + error);
+        }
+    }
+    ServiceAccount.fromPath = function (filePath) {
+        try {
+            return new ServiceAccount(JSON.parse(fs.readFileSync(filePath, 'utf8')));
+        }
+        catch (error) {
+            // Throw a nicely formed error message if the file contents cannot be parsed
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Failed to parse service account json file: ' + error);
+        }
+    };
+    return ServiceAccount;
+}());
+/**
+ * Implementation of Credential that gets access tokens from the metadata service available
+ * in the Google Cloud Platform. This authenticates the process as the default service account
+ * of an App Engine instance or Google Compute Engine machine.
+ */
+var ComputeEngineCredential = /** @class */ (function () {
+    function ComputeEngineCredential(httpAgent) {
+        this.httpClient = new api_request_1.HttpClient();
+        this.httpAgent = httpAgent;
+    }
+    ComputeEngineCredential.prototype.getAccessToken = function () {
+        var request = this.buildRequest(GOOGLE_METADATA_SERVICE_TOKEN_PATH);
+        return requestAccessToken(this.httpClient, request);
+    };
+    ComputeEngineCredential.prototype.getProjectId = function () {
+        var _this = this;
+        if (this.projectId) {
+            return Promise.resolve(this.projectId);
+        }
+        var request = this.buildRequest(GOOGLE_METADATA_SERVICE_PROJECT_ID_PATH);
+        return this.httpClient.send(request)
+            .then(function (resp) {
+            _this.projectId = resp.text;
+            return _this.projectId;
+        })
+            .catch(function (err) {
+            var detail = (err instanceof api_request_1.HttpError) ? getDetailFromResponse(err.response) : err.message;
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, "Failed to determine project ID: " + detail);
+        });
+    };
+    ComputeEngineCredential.prototype.buildRequest = function (urlPath) {
+        return {
+            method: 'GET',
+            url: "http://" + GOOGLE_METADATA_SERVICE_HOST + urlPath,
+            headers: {
+                'Metadata-Flavor': 'Google',
+            },
+            httpAgent: this.httpAgent,
+        };
+    };
+    return ComputeEngineCredential;
+}());
+exports.ComputeEngineCredential = ComputeEngineCredential;
+/**
+ * Implementation of Credential that gets access tokens from refresh tokens.
+ */
+var RefreshTokenCredential = /** @class */ (function () {
+    /**
+     * Creates a new RefreshTokenCredential from the given parameters.
+     *
+     * @param refreshTokenPathOrObject Refresh token json object or path to a refresh token (user credentials) json file.
+     * @param httpAgent Optional http.Agent to use when calling the remote token server.
+     * @param implicit An optinal boolean indicating whether this credential was implicitly discovered from the
+     *   environment, as opposed to being explicitly specified by the developer.
+     *
+     * @constructor
+     */
+    function RefreshTokenCredential(refreshTokenPathOrObject, httpAgent, implicit) {
+        if (implicit === void 0) { implicit = false; }
+        this.httpAgent = httpAgent;
+        this.implicit = implicit;
+        this.refreshToken = (typeof refreshTokenPathOrObject === 'string') ?
+            RefreshToken.fromPath(refreshTokenPathOrObject)
+            : new RefreshToken(refreshTokenPathOrObject);
+        this.httpClient = new api_request_1.HttpClient();
+    }
+    RefreshTokenCredential.prototype.getAccessToken = function () {
+        var postData = 'client_id=' + this.refreshToken.clientId + '&' +
+            'client_secret=' + this.refreshToken.clientSecret + '&' +
+            'refresh_token=' + this.refreshToken.refreshToken + '&' +
+            'grant_type=refresh_token';
+        var request = {
+            method: 'POST',
+            url: "https://" + REFRESH_TOKEN_HOST + REFRESH_TOKEN_PATH,
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            data: postData,
+            httpAgent: this.httpAgent,
+        };
+        return requestAccessToken(this.httpClient, request);
+    };
+    return RefreshTokenCredential;
+}());
+exports.RefreshTokenCredential = RefreshTokenCredential;
+var RefreshToken = /** @class */ (function () {
+    function RefreshToken(json) {
+        copyAttr(this, json, 'clientId', 'client_id');
+        copyAttr(this, json, 'clientSecret', 'client_secret');
+        copyAttr(this, json, 'refreshToken', 'refresh_token');
+        copyAttr(this, json, 'type', 'type');
+        var errorMessage;
+        if (!util.isNonEmptyString(this.clientId)) {
+            errorMessage = 'Refresh token must contain a "client_id" property.';
+        }
+        else if (!util.isNonEmptyString(this.clientSecret)) {
+            errorMessage = 'Refresh token must contain a "client_secret" property.';
+        }
+        else if (!util.isNonEmptyString(this.refreshToken)) {
+            errorMessage = 'Refresh token must contain a "refresh_token" property.';
+        }
+        else if (!util.isNonEmptyString(this.type)) {
+            errorMessage = 'Refresh token must contain a "type" property.';
+        }
+        if (typeof errorMessage !== 'undefined') {
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, errorMessage);
+        }
+    }
+    /*
+     * Tries to load a RefreshToken from a path. Throws if the path doesn't exist or the
+     * data at the path is invalid.
+     */
+    RefreshToken.fromPath = function (filePath) {
+        try {
+            return new RefreshToken(JSON.parse(fs.readFileSync(filePath, 'utf8')));
+        }
+        catch (error) {
+            // Throw a nicely formed error message if the file contents cannot be parsed
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Failed to parse refresh token file: ' + error);
+        }
+    };
+    return RefreshToken;
+}());
+function getApplicationDefault(httpAgent) {
+    if (process.env.GOOGLE_APPLICATION_CREDENTIALS) {
+        return credentialFromFile(process.env.GOOGLE_APPLICATION_CREDENTIALS, httpAgent);
+    }
+    // It is OK to not have this file. If it is present, it must be valid.
+    if (GCLOUD_CREDENTIAL_PATH) {
+        var refreshToken = readCredentialFile(GCLOUD_CREDENTIAL_PATH, true);
+        if (refreshToken) {
+            return new RefreshTokenCredential(refreshToken, httpAgent, true);
+        }
+    }
+    return new ComputeEngineCredential(httpAgent);
+}
+exports.getApplicationDefault = getApplicationDefault;
+/**
+ * Checks if the given credential was loaded via the application default credentials mechanism. This
+ * includes all ComputeEngineCredential instances, and the ServiceAccountCredential and RefreshTokenCredential
+ * instances that were loaded from well-known files or environment variables, rather than being explicitly
+ * instantiated.
+ *
+ * @param credential The credential instance to check.
+ */
+function isApplicationDefault(credential) {
+    return credential instanceof ComputeEngineCredential ||
+        (credential instanceof ServiceAccountCredential && credential.implicit) ||
+        (credential instanceof RefreshTokenCredential && credential.implicit);
+}
+exports.isApplicationDefault = isApplicationDefault;
+/**
+ * Copies the specified property from one object to another.
+ *
+ * If no property exists by the given "key", looks for a property identified by "alt", and copies it instead.
+ * This can be used to implement behaviors such as "copy property myKey or my_key".
+ *
+ * @param to Target object to copy the property into.
+ * @param from Source object to copy the property from.
+ * @param key Name of the property to copy.
+ * @param alt Alternative name of the property to copy.
+ */
+function copyAttr(to, from, key, alt) {
+    var tmp = from[key] || from[alt];
+    if (typeof tmp !== 'undefined') {
+        to[key] = tmp;
+    }
+}
+/**
+ * Obtain a new OAuth2 token by making a remote service call.
+ */
+function requestAccessToken(client, request) {
+    return client.send(request).then(function (resp) {
+        var json = resp.data;
+        if (!json.access_token || !json.expires_in) {
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, "Unexpected response while fetching access token: " + JSON.stringify(json));
+        }
+        return json;
+    }).catch(function (err) {
+        throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, getErrorMessage(err));
+    });
+}
+/**
+ * Constructs a human-readable error message from the given Error.
+ */
+function getErrorMessage(err) {
+    var detail = (err instanceof api_request_1.HttpError) ? getDetailFromResponse(err.response) : err.message;
+    return "Error fetching access token: " + detail;
+}
+/**
+ * Extracts details from the given HTTP error response, and returns a human-readable description. If
+ * the response is JSON-formatted, looks up the error and error_description fields sent by the
+ * Google Auth servers. Otherwise returns the entire response payload as the error detail.
+ */
+function getDetailFromResponse(response) {
+    if (response.isJson() && response.data.error) {
+        var json = response.data;
+        var detail = json.error;
+        if (json.error_description) {
+            detail += ' (' + json.error_description + ')';
+        }
+        return detail;
+    }
+    return response.text || 'Missing error payload';
+}
+function credentialFromFile(filePath, httpAgent) {
+    var credentialsFile = readCredentialFile(filePath);
+    if (typeof credentialsFile !== 'object' || credentialsFile === null) {
+        throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Failed to parse contents of the credentials file as an object');
+    }
+    if (credentialsFile.type === 'service_account') {
+        return new ServiceAccountCredential(credentialsFile, httpAgent, true);
+    }
+    if (credentialsFile.type === 'authorized_user') {
+        return new RefreshTokenCredential(credentialsFile, httpAgent, true);
+    }
+    throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Invalid contents in the credentials file');
+}
+function readCredentialFile(filePath, ignoreMissing) {
+    var fileText;
+    try {
+        fileText = fs.readFileSync(filePath, 'utf8');
+    }
+    catch (error) {
+        if (ignoreMissing) {
+            return null;
+        }
+        throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, "Failed to read credentials from file " + filePath + ": " + error);
+    }
+    try {
+        return JSON.parse(fileText);
+    }
+    catch (error) {
+        throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Failed to parse contents of the credentials file as an object: ' + error);
+    }
+}

node_modules/firebase-admin/lib/auth/tenant-manager.js

@@ -0,0 +1,139 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2019 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var auth_api_request_1 = require("./auth-api-request");
+var auth_1 = require("./auth");
+var tenant_1 = require("./tenant");
+var error_1 = require("../utils/error");
+var validator = require("../utils/validator");
+/**
+ * Data structure used to help manage tenant related operations.
+ * This includes:
+ * - The ability to create, update, list, get and delete tenants for the underlying project.
+ * - Getting a TenantAwareAuth instance for running Auth related operations (user mgmt, provider config mgmt, etc)
+ *   in the context of a specified tenant.
+ */
+var TenantManager = /** @class */ (function () {
+    /**
+     * Initializes a TenantManager instance for a specified FirebaseApp.
+     * @param app The app for this TenantManager instance.
+     */
+    function TenantManager(app) {
+        this.app = app;
+        this.authRequestHandler = new auth_api_request_1.AuthRequestHandler(app);
+        this.tenantsMap = {};
+    }
+    /**
+     * Returns a TenantAwareAuth instance for the corresponding tenant ID.
+     *
+     * @param tenantId The tenant ID whose TenantAwareAuth is to be returned.
+     * @return The corresponding TenantAwareAuth instance.
+     */
+    TenantManager.prototype.authForTenant = function (tenantId) {
+        if (!validator.isNonEmptyString(tenantId)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_TENANT_ID);
+        }
+        if (typeof this.tenantsMap[tenantId] === 'undefined') {
+            this.tenantsMap[tenantId] = new auth_1.TenantAwareAuth(this.app, tenantId);
+        }
+        return this.tenantsMap[tenantId];
+    };
+    /**
+     * Looks up the tenant identified by the provided tenant ID and returns a promise that is
+     * fulfilled with the corresponding tenant if it is found.
+     *
+     * @param tenantId The tenant ID of the tenant to look up.
+     * @return A promise that resolves with the corresponding tenant.
+     */
+    TenantManager.prototype.getTenant = function (tenantId) {
+        return this.authRequestHandler.getTenant(tenantId)
+            .then(function (response) {
+            return new tenant_1.Tenant(response);
+        });
+    };
+    /**
+     * Exports a batch of tenant accounts. Batch size is determined by the maxResults argument.
+     * Starting point of the batch is determined by the pageToken argument.
+     *
+     * @param maxResults The page size, 1000 if undefined. This is also the maximum
+     *     allowed limit.
+     * @param pageToken The next page token. If not specified, returns users starting
+     *     without any offset.
+     * @return A promise that resolves with
+     *     the current batch of downloaded tenants and the next page token. For the last page, an
+     *     empty list of tenants and no page token are returned.
+     */
+    TenantManager.prototype.listTenants = function (maxResults, pageToken) {
+        return this.authRequestHandler.listTenants(maxResults, pageToken)
+            .then(function (response) {
+            // List of tenants to return.
+            var tenants = [];
+            // Convert each user response to a Tenant.
+            response.tenants.forEach(function (tenantResponse) {
+                tenants.push(new tenant_1.Tenant(tenantResponse));
+            });
+            // Return list of tenants and the next page token if available.
+            var result = {
+                tenants: tenants,
+                pageToken: response.nextPageToken,
+            };
+            // Delete result.pageToken if undefined.
+            if (typeof result.pageToken === 'undefined') {
+                delete result.pageToken;
+            }
+            return result;
+        });
+    };
+    /**
+     * Deletes the tenant identified by the provided tenant ID and returns a promise that is
+     * fulfilled when the tenant is found and successfully deleted.
+     *
+     * @param tenantId The tenant ID of the tenant to delete.
+     * @return A promise that resolves when the tenant is successfully deleted.
+     */
+    TenantManager.prototype.deleteTenant = function (tenantId) {
+        return this.authRequestHandler.deleteTenant(tenantId);
+    };
+    /**
+     * Creates a new tenant with the properties provided.
+     *
+     * @param tenantOptions The properties to set on the new tenant to be created.
+     * @return A promise that resolves with the newly created tenant.
+     */
+    TenantManager.prototype.createTenant = function (tenantOptions) {
+        return this.authRequestHandler.createTenant(tenantOptions)
+            .then(function (response) {
+            return new tenant_1.Tenant(response);
+        });
+    };
+    /**
+     * Updates an existing tenant identified by the tenant ID with the properties provided.
+     *
+     * @param tenantId The tenant identifier of the tenant to update.
+     * @param tenantOptions The properties to update on the existing tenant.
+     * @return A promise that resolves with the modified tenant.
+     */
+    TenantManager.prototype.updateTenant = function (tenantId, tenantOptions) {
+        return this.authRequestHandler.updateTenant(tenantId, tenantOptions)
+            .then(function (response) {
+            return new tenant_1.Tenant(response);
+        });
+    };
+    return TenantManager;
+}());
+exports.TenantManager = TenantManager;

node_modules/firebase-admin/lib/auth/tenant.js

@@ -0,0 +1,123 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2019 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var validator = require("../utils/validator");
+var error_1 = require("../utils/error");
+var auth_config_1 = require("./auth-config");
+/**
+ * Tenant class that defines a Firebase Auth tenant.
+ */
+var Tenant = /** @class */ (function () {
+    /**
+     * The Tenant object constructor.
+     *
+     * @param {any} response The server side response used to initialize the Tenant object.
+     * @constructor
+     */
+    function Tenant(response) {
+        var tenantId = Tenant.getTenantIdFromResourceName(response.name);
+        if (!tenantId) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INTERNAL_ERROR, 'INTERNAL ASSERT FAILED: Invalid tenant response');
+        }
+        this.tenantId = tenantId;
+        this.displayName = response.displayName;
+        try {
+            this.emailSignInConfig = new auth_config_1.EmailSignInConfig(response);
+        }
+        catch (e) {
+            // If allowPasswordSignup is undefined, it is disabled by default.
+            this.emailSignInConfig = new auth_config_1.EmailSignInConfig({
+                allowPasswordSignup: false,
+            });
+        }
+    }
+    /**
+     * Builds the corresponding server request for a TenantOptions object.
+     *
+     * @param {TenantOptions} tenantOptions The properties to convert to a server request.
+     * @param {boolean} createRequest Whether this is a create request.
+     * @return {object} The equivalent server request.
+     */
+    Tenant.buildServerRequest = function (tenantOptions, createRequest) {
+        Tenant.validate(tenantOptions, createRequest);
+        var request = {};
+        if (typeof tenantOptions.emailSignInConfig !== 'undefined') {
+            request = auth_config_1.EmailSignInConfig.buildServerRequest(tenantOptions.emailSignInConfig);
+        }
+        if (typeof tenantOptions.displayName !== 'undefined') {
+            request.displayName = tenantOptions.displayName;
+        }
+        return request;
+    };
+    /**
+     * Returns the tenant ID corresponding to the resource name if available.
+     *
+     * @param {string} resourceName The server side resource name
+     * @return {?string} The tenant ID corresponding to the resource, null otherwise.
+     */
+    Tenant.getTenantIdFromResourceName = function (resourceName) {
+        // name is of form projects/project1/tenants/tenant1
+        var matchTenantRes = resourceName.match(/\/tenants\/(.*)$/);
+        if (!matchTenantRes || matchTenantRes.length < 2) {
+            return null;
+        }
+        return matchTenantRes[1];
+    };
+    /**
+     * Validates a tenant options object. Throws an error on failure.
+     *
+     * @param {any} request The tenant options object to validate.
+     * @param {boolean} createRequest Whether this is a create request.
+     */
+    Tenant.validate = function (request, createRequest) {
+        var validKeys = {
+            displayName: true,
+            emailSignInConfig: true,
+        };
+        var label = createRequest ? 'CreateTenantRequest' : 'UpdateTenantRequest';
+        if (!validator.isNonNullObject(request)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, "\"" + label + "\" must be a valid non-null object.");
+        }
+        // Check for unsupported top level attributes.
+        for (var key in request) {
+            if (!(key in validKeys)) {
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, "\"" + key + "\" is not a valid " + label + " parameter.");
+            }
+        }
+        // Validate displayName type if provided.
+        if (typeof request.displayName !== 'undefined' &&
+            !validator.isNonEmptyString(request.displayName)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, "\"" + label + ".displayName\" must be a valid non-empty string.");
+        }
+        // Validate emailSignInConfig type if provided.
+        if (typeof request.emailSignInConfig !== 'undefined') {
+            // This will throw an error if invalid.
+            auth_config_1.EmailSignInConfig.buildServerRequest(request.emailSignInConfig);
+        }
+    };
+    /** @return {object} The plain object representation of the tenant. */
+    Tenant.prototype.toJSON = function () {
+        return {
+            tenantId: this.tenantId,
+            displayName: this.displayName,
+            emailSignInConfig: this.emailSignInConfig && this.emailSignInConfig.toJSON(),
+        };
+    };
+    return Tenant;
+}());
+exports.Tenant = Tenant;

node_modules/firebase-admin/lib/auth/token-generator.js

@@ -0,0 +1,265 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2017 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var credential_1 = require("./credential");
+var error_1 = require("../utils/error");
+var api_request_1 = require("../utils/api-request");
+var validator = require("../utils/validator");
+var utils_1 = require("../utils");
+var ALGORITHM_RS256 = 'RS256';
+var ONE_HOUR_IN_SECONDS = 60 * 60;
+// List of blacklisted claims which cannot be provided when creating a custom token
+exports.BLACKLISTED_CLAIMS = [
+    'acr', 'amr', 'at_hash', 'aud', 'auth_time', 'azp', 'cnf', 'c_hash', 'exp', 'iat', 'iss', 'jti',
+    'nbf', 'nonce',
+];
+// Audience to use for Firebase Auth Custom tokens
+var FIREBASE_AUDIENCE = 'https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit';
+/**
+ * A CryptoSigner implementation that uses an explicitly specified service account private key to
+ * sign data. Performs all operations locally, and does not make any RPC calls.
+ */
+var ServiceAccountSigner = /** @class */ (function () {
+    /**
+     * Creates a new CryptoSigner instance from the given service account credential.
+     *
+     * @param {ServiceAccountCredential} credential A service account credential.
+     */
+    function ServiceAccountSigner(credential) {
+        this.credential = credential;
+        if (!credential) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CREDENTIAL, 'INTERNAL ASSERT: Must provide a service account credential to initialize ServiceAccountSigner.');
+        }
+    }
+    /**
+     * @inheritDoc
+     */
+    ServiceAccountSigner.prototype.sign = function (buffer) {
+        var crypto = require('crypto');
+        var sign = crypto.createSign('RSA-SHA256');
+        sign.update(buffer);
+        return Promise.resolve(sign.sign(this.credential.privateKey));
+    };
+    /**
+     * @inheritDoc
+     */
+    ServiceAccountSigner.prototype.getAccountId = function () {
+        return Promise.resolve(this.credential.clientEmail);
+    };
+    return ServiceAccountSigner;
+}());
+exports.ServiceAccountSigner = ServiceAccountSigner;
+/**
+ * A CryptoSigner implementation that uses the remote IAM service to sign data. If initialized without
+ * a service account ID, attempts to discover a service account ID by consulting the local Metadata
+ * service. This will succeed in managed environments like Google Cloud Functions and App Engine.
+ *
+ * @see https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/signBlob
+ * @see https://cloud.google.com/compute/docs/storing-retrieving-metadata
+ */
+var IAMSigner = /** @class */ (function () {
+    function IAMSigner(httpClient, serviceAccountId) {
+        if (!httpClient) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, 'INTERNAL ASSERT: Must provide a HTTP client to initialize IAMSigner.');
+        }
+        if (typeof serviceAccountId !== 'undefined' && !validator.isNonEmptyString(serviceAccountId)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, 'INTERNAL ASSERT: Service account ID must be undefined or a non-empty string.');
+        }
+        this.httpClient = httpClient;
+        this.serviceAccountId = serviceAccountId;
+    }
+    /**
+     * @inheritDoc
+     */
+    IAMSigner.prototype.sign = function (buffer) {
+        var _this = this;
+        return this.getAccountId().then(function (serviceAccount) {
+            var request = {
+                method: 'POST',
+                url: "https://iam.googleapis.com/v1/projects/-/serviceAccounts/" + serviceAccount + ":signBlob",
+                data: { bytesToSign: buffer.toString('base64') },
+            };
+            return _this.httpClient.send(request);
+        }).then(function (response) {
+            // Response from IAM is base64 encoded. Decode it into a buffer and return.
+            return Buffer.from(response.data.signature, 'base64');
+        }).catch(function (err) {
+            if (err instanceof api_request_1.HttpError) {
+                var error = err.response.data;
+                if (validator.isNonNullObject(error) && error.error) {
+                    var errorCode = error.error.status;
+                    var description = 'Please refer to https://firebase.google.com/docs/auth/admin/create-custom-tokens ' +
+                        'for more details on how to use and troubleshoot this feature.';
+                    var errorMsg = error.error.message + "; " + description;
+                    throw error_1.FirebaseAuthError.fromServerError(errorCode, errorMsg, error);
+                }
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INTERNAL_ERROR, 'Error returned from server: ' + error + '. Additionally, an ' +
+                    'internal error occurred while attempting to extract the ' +
+                    'errorcode from the error.');
+            }
+            throw err;
+        });
+    };
+    /**
+     * @inheritDoc
+     */
+    IAMSigner.prototype.getAccountId = function () {
+        var _this = this;
+        if (validator.isNonEmptyString(this.serviceAccountId)) {
+            return Promise.resolve(this.serviceAccountId);
+        }
+        var request = {
+            method: 'GET',
+            url: 'http://metadata/computeMetadata/v1/instance/service-accounts/default/email',
+            headers: {
+                'Metadata-Flavor': 'Google',
+            },
+        };
+        var client = new api_request_1.HttpClient();
+        return client.send(request).then(function (response) {
+            if (!response.text) {
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INTERNAL_ERROR, 'HTTP Response missing payload');
+            }
+            _this.serviceAccountId = response.text;
+            return response.text;
+        }).catch(function (err) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CREDENTIAL, "Failed to determine service account. Make sure to initialize " +
+                "the SDK with a service account credential. Alternatively specify a service " +
+                ("account with iam.serviceAccounts.signBlob permission. Original error: " + err));
+        });
+    };
+    return IAMSigner;
+}());
+exports.IAMSigner = IAMSigner;
+/**
+ * Create a new CryptoSigner instance for the given app. If the app has been initialized with a service
+ * account credential, creates a ServiceAccountSigner. Otherwise creates an IAMSigner.
+ *
+ * @param {FirebaseApp} app A FirebaseApp instance.
+ * @return {CryptoSigner} A CryptoSigner instance.
+ */
+function cryptoSignerFromApp(app) {
+    var credential = app.options.credential;
+    if (credential instanceof credential_1.ServiceAccountCredential) {
+        return new ServiceAccountSigner(credential);
+    }
+    return new IAMSigner(new api_request_1.AuthorizedHttpClient(app), app.options.serviceAccountId);
+}
+exports.cryptoSignerFromApp = cryptoSignerFromApp;
+/**
+ * Class for generating different types of Firebase Auth tokens (JWTs).
+ */
+var FirebaseTokenGenerator = /** @class */ (function () {
+    /**
+     * @param tenantId The tenant ID to use for the generated Firebase Auth
+     *     Custom token. If absent, then no tenant ID claim will be set in the
+     *     resulting JWT.
+     */
+    function FirebaseTokenGenerator(signer, tenantId) {
+        this.tenantId = tenantId;
+        if (!validator.isNonNullObject(signer)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CREDENTIAL, 'INTERNAL ASSERT: Must provide a CryptoSigner to use FirebaseTokenGenerator.');
+        }
+        if (typeof tenantId !== 'undefined' && !validator.isNonEmptyString(tenantId)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, '`tenantId` argument must be a non-empty string.');
+        }
+        this.signer = signer;
+    }
+    /**
+     * Creates a new Firebase Auth Custom token.
+     *
+     * @param uid The user ID to use for the generated Firebase Auth Custom token.
+     * @param developerClaims Optional developer claims to include in the generated Firebase
+     *     Auth Custom token.
+     * @return A Promise fulfilled with a Firebase Auth Custom token signed with a
+     *     service account key and containing the provided payload.
+     */
+    FirebaseTokenGenerator.prototype.createCustomToken = function (uid, developerClaims) {
+        var _this = this;
+        var errorMessage;
+        if (!validator.isNonEmptyString(uid)) {
+            errorMessage = '`uid` argument must be a non-empty string uid.';
+        }
+        else if (uid.length > 128) {
+            errorMessage = '`uid` argument must a uid with less than or equal to 128 characters.';
+        }
+        else if (!this.isDeveloperClaimsValid_(developerClaims)) {
+            errorMessage = '`developerClaims` argument must be a valid, non-null object containing the developer claims.';
+        }
+        if (errorMessage) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, errorMessage);
+        }
+        var claims = {};
+        if (typeof developerClaims !== 'undefined') {
+            for (var key in developerClaims) {
+                /* istanbul ignore else */
+                if (developerClaims.hasOwnProperty(key)) {
+                    if (exports.BLACKLISTED_CLAIMS.indexOf(key) !== -1) {
+                        throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, "Developer claim \"" + key + "\" is reserved and cannot be specified.");
+                    }
+                    claims[key] = developerClaims[key];
+                }
+            }
+        }
+        return this.signer.getAccountId().then(function (account) {
+            var header = {
+                alg: ALGORITHM_RS256,
+                typ: 'JWT',
+            };
+            var iat = Math.floor(Date.now() / 1000);
+            var body = {
+                aud: FIREBASE_AUDIENCE,
+                iat: iat,
+                exp: iat + ONE_HOUR_IN_SECONDS,
+                iss: account,
+                sub: account,
+                uid: uid,
+            };
+            if (_this.tenantId) {
+                body.tenant_id = _this.tenantId;
+            }
+            if (Object.keys(claims).length > 0) {
+                body.claims = claims;
+            }
+            var token = _this.encodeSegment(header) + "." + _this.encodeSegment(body);
+            var signPromise = _this.signer.sign(Buffer.from(token));
+            return Promise.all([token, signPromise]);
+        }).then(function (_a) {
+            var token = _a[0], signature = _a[1];
+            return token + "." + _this.encodeSegment(signature);
+        });
+    };
+    FirebaseTokenGenerator.prototype.encodeSegment = function (segment) {
+        var buffer = (segment instanceof Buffer) ? segment : Buffer.from(JSON.stringify(segment));
+        return utils_1.toWebSafeBase64(buffer).replace(/\=+$/, '');
+    };
+    /**
+     * Returns whether or not the provided developer claims are valid.
+     *
+     * @param {object} [developerClaims] Optional developer claims to validate.
+     * @return {boolean} True if the provided claims are valid; otherwise, false.
+     */
+    FirebaseTokenGenerator.prototype.isDeveloperClaimsValid_ = function (developerClaims) {
+        if (typeof developerClaims === 'undefined') {
+            return true;
+        }
+        return validator.isNonNullObject(developerClaims);
+    };
+    return FirebaseTokenGenerator;
+}());
+exports.FirebaseTokenGenerator = FirebaseTokenGenerator;

node_modules/firebase-admin/lib/auth/token-verifier.js

@@ -0,0 +1,301 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2018 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var error_1 = require("../utils/error");
+var util = require("../utils/index");
+var validator = require("../utils/validator");
+var jwt = require("jsonwebtoken");
+var api_request_1 = require("../utils/api-request");
+// Audience to use for Firebase Auth Custom tokens
+var FIREBASE_AUDIENCE = 'https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit';
+exports.ALGORITHM_RS256 = 'RS256';
+// URL containing the public keys for the Google certs (whose private keys are used to sign Firebase
+// Auth ID tokens)
+var CLIENT_CERT_URL = 'https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com';
+// URL containing the public keys for Firebase session cookies. This will be updated to a different URL soon.
+var SESSION_COOKIE_CERT_URL = 'https://www.googleapis.com/identitytoolkit/v3/relyingparty/publicKeys';
+/** User facing token information related to the Firebase ID token. */
+exports.ID_TOKEN_INFO = {
+    url: 'https://firebase.google.com/docs/auth/admin/verify-id-tokens',
+    verifyApiName: 'verifyIdToken()',
+    jwtName: 'Firebase ID token',
+    shortName: 'ID token',
+    expiredErrorCode: error_1.AuthClientErrorCode.ID_TOKEN_EXPIRED,
+};
+/** User facing token information related to the Firebase session cookie. */
+exports.SESSION_COOKIE_INFO = {
+    url: 'https://firebase.google.com/docs/auth/admin/manage-cookies',
+    verifyApiName: 'verifySessionCookie()',
+    jwtName: 'Firebase session cookie',
+    shortName: 'session cookie',
+    expiredErrorCode: error_1.AuthClientErrorCode.SESSION_COOKIE_EXPIRED,
+};
+/**
+ * Class for verifying general purpose Firebase JWTs. This verifies ID tokens and session cookies.
+ */
+var FirebaseTokenVerifier = /** @class */ (function () {
+    function FirebaseTokenVerifier(clientCertUrl, algorithm, issuer, tokenInfo, app) {
+        this.clientCertUrl = clientCertUrl;
+        this.algorithm = algorithm;
+        this.issuer = issuer;
+        this.tokenInfo = tokenInfo;
+        this.app = app;
+        if (!validator.isURL(clientCertUrl)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, "The provided public client certificate URL is an invalid URL.");
+        }
+        else if (!validator.isNonEmptyString(algorithm)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, "The provided JWT algorithm is an empty string.");
+        }
+        else if (!validator.isURL(issuer)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, "The provided JWT issuer is an invalid URL.");
+        }
+        else if (!validator.isNonNullObject(tokenInfo)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, "The provided JWT information is not an object or null.");
+        }
+        else if (!validator.isURL(tokenInfo.url)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, "The provided JWT verification documentation URL is invalid.");
+        }
+        else if (!validator.isNonEmptyString(tokenInfo.verifyApiName)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, "The JWT verify API name must be a non-empty string.");
+        }
+        else if (!validator.isNonEmptyString(tokenInfo.jwtName)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, "The JWT public full name must be a non-empty string.");
+        }
+        else if (!validator.isNonEmptyString(tokenInfo.shortName)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, "The JWT public short name must be a non-empty string.");
+        }
+        else if (!validator.isNonNullObject(tokenInfo.expiredErrorCode) || !('code' in tokenInfo.expiredErrorCode)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, "The JWT expiration error code must be a non-null ErrorInfo object.");
+        }
+        this.shortNameArticle = tokenInfo.shortName.charAt(0).match(/[aeiou]/i) ? 'an' : 'a';
+        // For backward compatibility, the project ID is validated in the verification call.
+    }
+    /**
+     * Verifies the format and signature of a Firebase Auth JWT token.
+     *
+     * @param {string} jwtToken The Firebase Auth JWT token to verify.
+     * @return {Promise<DecodedIdToken>} A promise fulfilled with the decoded claims of the Firebase Auth ID
+     *                           token.
+     */
+    FirebaseTokenVerifier.prototype.verifyJWT = function (jwtToken) {
+        var _this = this;
+        if (!validator.isString(jwtToken)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, "First argument to " + this.tokenInfo.verifyApiName + " must be a " + this.tokenInfo.jwtName + " string.");
+        }
+        return util.findProjectId(this.app)
+            .then(function (projectId) {
+            return _this.verifyJWTWithProjectId(jwtToken, projectId);
+        });
+    };
+    FirebaseTokenVerifier.prototype.verifyJWTWithProjectId = function (jwtToken, projectId) {
+        var _this = this;
+        if (!validator.isNonEmptyString(projectId)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_CREDENTIAL, "Must initialize app with a cert credential or set your Firebase project ID as the " +
+                ("GOOGLE_CLOUD_PROJECT environment variable to call " + this.tokenInfo.verifyApiName + "."));
+        }
+        var fullDecodedToken = jwt.decode(jwtToken, {
+            complete: true,
+        });
+        var header = fullDecodedToken && fullDecodedToken.header;
+        var payload = fullDecodedToken && fullDecodedToken.payload;
+        var projectIdMatchMessage = " Make sure the " + this.tokenInfo.shortName + " comes from the same " +
+            "Firebase project as the service account used to authenticate this SDK.";
+        var verifyJwtTokenDocsMessage = " See " + this.tokenInfo.url + " " +
+            ("for details on how to retrieve " + this.shortNameArticle + " " + this.tokenInfo.shortName + ".");
+        var errorMessage;
+        if (!fullDecodedToken) {
+            errorMessage = "Decoding " + this.tokenInfo.jwtName + " failed. Make sure you passed the entire string JWT " +
+                ("which represents " + this.shortNameArticle + " " + this.tokenInfo.shortName + ".") + verifyJwtTokenDocsMessage;
+        }
+        else if (typeof header.kid === 'undefined') {
+            var isCustomToken = (payload.aud === FIREBASE_AUDIENCE);
+            var isLegacyCustomToken = (header.alg === 'HS256' && payload.v === 0 && 'd' in payload && 'uid' in payload.d);
+            if (isCustomToken) {
+                errorMessage = this.tokenInfo.verifyApiName + " expects " + this.shortNameArticle + " " +
+                    (this.tokenInfo.shortName + ", but was given a custom token.");
+            }
+            else if (isLegacyCustomToken) {
+                errorMessage = this.tokenInfo.verifyApiName + " expects " + this.shortNameArticle + " " +
+                    (this.tokenInfo.shortName + ", but was given a legacy custom token.");
+            }
+            else {
+                errorMessage = 'Firebase ID token has no "kid" claim.';
+            }
+            errorMessage += verifyJwtTokenDocsMessage;
+        }
+        else if (header.alg !== this.algorithm) {
+            errorMessage = this.tokenInfo.jwtName + " has incorrect algorithm. Expected \"" + this.algorithm + "\" but got " +
+                "\"" + header.alg + "\"." + verifyJwtTokenDocsMessage;
+        }
+        else if (payload.aud !== projectId) {
+            errorMessage = this.tokenInfo.jwtName + " has incorrect \"aud\" (audience) claim. Expected \"" +
+                projectId + "\" but got \"" + payload.aud + "\"." + projectIdMatchMessage +
+                verifyJwtTokenDocsMessage;
+        }
+        else if (payload.iss !== this.issuer + projectId) {
+            errorMessage = this.tokenInfo.jwtName + " has incorrect \"iss\" (issuer) claim. Expected " +
+                ("\"" + this.issuer + "\"") + projectId + "\" but got \"" +
+                payload.iss + "\"." + projectIdMatchMessage + verifyJwtTokenDocsMessage;
+        }
+        else if (typeof payload.sub !== 'string') {
+            errorMessage = this.tokenInfo.jwtName + " has no \"sub\" (subject) claim." + verifyJwtTokenDocsMessage;
+        }
+        else if (payload.sub === '') {
+            errorMessage = this.tokenInfo.jwtName + " has an empty string \"sub\" (subject) claim." + verifyJwtTokenDocsMessage;
+        }
+        else if (payload.sub.length > 128) {
+            errorMessage = this.tokenInfo.jwtName + " has \"sub\" (subject) claim longer than 128 characters." +
+                verifyJwtTokenDocsMessage;
+        }
+        if (errorMessage) {
+            return Promise.reject(new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, errorMessage));
+        }
+        return this.fetchPublicKeys().then(function (publicKeys) {
+            if (!publicKeys.hasOwnProperty(header.kid)) {
+                return Promise.reject(new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, _this.tokenInfo.jwtName + " has \"kid\" claim which does not correspond to a known public key. " +
+                    ("Most likely the " + _this.tokenInfo.shortName + " is expired, so get a fresh token from your ") +
+                    "client app and try again."));
+            }
+            else {
+                return _this.verifyJwtSignatureWithKey(jwtToken, publicKeys[header.kid]);
+            }
+        });
+    };
+    /**
+     * Verifies the JWT signature using the provided public key.
+     * @param {string} jwtToken The JWT token to verify.
+     * @param {string} publicKey The public key certificate.
+     * @return {Promise<DecodedIdToken>} A promise that resolves with the decoded JWT claims on successful
+     *     verification.
+     */
+    FirebaseTokenVerifier.prototype.verifyJwtSignatureWithKey = function (jwtToken, publicKey) {
+        var _this = this;
+        var verifyJwtTokenDocsMessage = " See " + this.tokenInfo.url + " " +
+            ("for details on how to retrieve " + this.shortNameArticle + " " + this.tokenInfo.shortName + ".");
+        return new Promise(function (resolve, reject) {
+            jwt.verify(jwtToken, publicKey, {
+                algorithms: [_this.algorithm],
+            }, function (error, decodedToken) {
+                if (error) {
+                    if (error.name === 'TokenExpiredError') {
+                        var errorMessage = _this.tokenInfo.jwtName + " has expired. Get a fresh " + _this.tokenInfo.shortName +
+                            (" from your client app and try again (auth/" + _this.tokenInfo.expiredErrorCode.code + ").") +
+                            verifyJwtTokenDocsMessage;
+                        return reject(new error_1.FirebaseAuthError(_this.tokenInfo.expiredErrorCode, errorMessage));
+                    }
+                    else if (error.name === 'JsonWebTokenError') {
+                        var errorMessage = _this.tokenInfo.jwtName + " has invalid signature." + verifyJwtTokenDocsMessage;
+                        return reject(new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, errorMessage));
+                    }
+                    return reject(new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, error.message));
+                }
+                else {
+                    // TODO(rsgowman): I think the typing on jwt.verify is wrong. It claims that this can be either a string or an
+                    // object, but the code always seems to call it as an object. Investigate and upstream typing changes if this
+                    // is actually correct.
+                    if (typeof decodedToken === 'string') {
+                        return reject(new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INTERNAL_ERROR, "Unexpected decodedToken. Expected an object but got a string: '" + decodedToken + "'"));
+                    }
+                    else {
+                        var decodedIdToken = decodedToken;
+                        decodedIdToken.uid = decodedIdToken.sub;
+                        resolve(decodedIdToken);
+                    }
+                }
+            });
+        });
+    };
+    /**
+     * Fetches the public keys for the Google certs.
+     *
+     * @return {Promise<object>} A promise fulfilled with public keys for the Google certs.
+     */
+    FirebaseTokenVerifier.prototype.fetchPublicKeys = function () {
+        var _this = this;
+        var publicKeysExist = (typeof this.publicKeys !== 'undefined');
+        var publicKeysExpiredExists = (typeof this.publicKeysExpireAt !== 'undefined');
+        var publicKeysStillValid = (publicKeysExpiredExists && Date.now() < this.publicKeysExpireAt);
+        if (publicKeysExist && publicKeysStillValid) {
+            return Promise.resolve(this.publicKeys);
+        }
+        var client = new api_request_1.HttpClient();
+        var request = {
+            method: 'GET',
+            url: this.clientCertUrl,
+            httpAgent: this.app.options.httpAgent,
+        };
+        return client.send(request).then(function (resp) {
+            if (!resp.isJson() || resp.data.error) {
+                // Treat all non-json messages and messages with an 'error' field as
+                // error responses.
+                throw new api_request_1.HttpError(resp);
+            }
+            if (resp.headers.hasOwnProperty('cache-control')) {
+                var cacheControlHeader = resp.headers['cache-control'];
+                var parts = cacheControlHeader.split(',');
+                parts.forEach(function (part) {
+                    var subParts = part.trim().split('=');
+                    if (subParts[0] === 'max-age') {
+                        var maxAge = +subParts[1];
+                        _this.publicKeysExpireAt = Date.now() + (maxAge * 1000);
+                    }
+                });
+            }
+            _this.publicKeys = resp.data;
+            return resp.data;
+        }).catch(function (err) {
+            if (err instanceof api_request_1.HttpError) {
+                var errorMessage = 'Error fetching public keys for Google certs: ';
+                var resp = err.response;
+                if (resp.isJson() && resp.data.error) {
+                    errorMessage += "" + resp.data.error;
+                    if (resp.data.error_description) {
+                        errorMessage += ' (' + resp.data.error_description + ')';
+                    }
+                }
+                else {
+                    errorMessage += "" + resp.text;
+                }
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INTERNAL_ERROR, errorMessage);
+            }
+            throw err;
+        });
+    };
+    return FirebaseTokenVerifier;
+}());
+exports.FirebaseTokenVerifier = FirebaseTokenVerifier;
+/**
+ * Creates a new FirebaseTokenVerifier to verify Firebase ID tokens.
+ *
+ * @param {FirebaseApp} app Firebase app instance.
+ * @return {FirebaseTokenVerifier}
+ */
+function createIdTokenVerifier(app) {
+    return new FirebaseTokenVerifier(CLIENT_CERT_URL, exports.ALGORITHM_RS256, 'https://securetoken.google.com/', exports.ID_TOKEN_INFO, app);
+}
+exports.createIdTokenVerifier = createIdTokenVerifier;
+/**
+ * Creates a new FirebaseTokenVerifier to verify Firebase session cookies.
+ *
+ * @param {FirebaseApp} app Firebase app instance.
+ * @return {FirebaseTokenVerifier}
+ */
+function createSessionCookieVerifier(app) {
+    return new FirebaseTokenVerifier(SESSION_COOKIE_CERT_URL, exports.ALGORITHM_RS256, 'https://session.firebase.google.com/', exports.SESSION_COOKIE_INFO, app);
+}
+exports.createSessionCookieVerifier = createSessionCookieVerifier;

node_modules/firebase-admin/lib/auth/user-import-builder.js

@@ -0,0 +1,329 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2018 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var deep_copy_1 = require("../utils/deep-copy");
+var utils = require("../utils");
+var validator = require("../utils/validator");
+var error_1 = require("../utils/error");
+/**
+ * @param {any} obj The object to check for number field within.
+ * @param {string} key The entry key.
+ * @return {number} The corresponding number if available. Otherwise, NaN.
+ */
+function getNumberField(obj, key) {
+    if (typeof obj[key] !== 'undefined' && obj[key] !== null) {
+        return parseInt(obj[key].toString(), 10);
+    }
+    return NaN;
+}
+/**
+ * Converts a UserImportRecord to a UploadAccountUser object. Throws an error when invalid
+ * fields are provided.
+ * @param {UserImportRecord} user The UserImportRecord to conver to UploadAccountUser.
+ * @param {ValidatorFunction=} userValidator The user validator function.
+ * @return {UploadAccountUser} The corresponding UploadAccountUser to return.
+ */
+function populateUploadAccountUser(user, userValidator) {
+    var result = {
+        localId: user.uid,
+        email: user.email,
+        emailVerified: user.emailVerified,
+        displayName: user.displayName,
+        disabled: user.disabled,
+        photoUrl: user.photoURL,
+        phoneNumber: user.phoneNumber,
+        providerUserInfo: [],
+        tenantId: user.tenantId,
+        customAttributes: user.customClaims && JSON.stringify(user.customClaims),
+    };
+    if (typeof user.passwordHash !== 'undefined') {
+        if (!validator.isBuffer(user.passwordHash)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_PASSWORD_HASH);
+        }
+        result.passwordHash = utils.toWebSafeBase64(user.passwordHash);
+    }
+    if (typeof user.passwordSalt !== 'undefined') {
+        if (!validator.isBuffer(user.passwordSalt)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_PASSWORD_SALT);
+        }
+        result.salt = utils.toWebSafeBase64(user.passwordSalt);
+    }
+    if (validator.isNonNullObject(user.metadata)) {
+        if (validator.isNonEmptyString(user.metadata.creationTime)) {
+            result.createdAt = new Date(user.metadata.creationTime).getTime();
+        }
+        if (validator.isNonEmptyString(user.metadata.lastSignInTime)) {
+            result.lastLoginAt = new Date(user.metadata.lastSignInTime).getTime();
+        }
+    }
+    if (validator.isArray(user.providerData)) {
+        user.providerData.forEach(function (providerData) {
+            result.providerUserInfo.push({
+                providerId: providerData.providerId,
+                rawId: providerData.uid,
+                email: providerData.email,
+                displayName: providerData.displayName,
+                photoUrl: providerData.photoURL,
+            });
+        });
+    }
+    // Remove blank fields.
+    var key;
+    for (key in result) {
+        if (typeof result[key] === 'undefined') {
+            delete result[key];
+        }
+    }
+    if (result.providerUserInfo.length === 0) {
+        delete result.providerUserInfo;
+    }
+    // Validate the constructured user individual request. This will throw if an error
+    // is detected.
+    if (typeof userValidator === 'function') {
+        userValidator(result);
+    }
+    return result;
+}
+/**
+ * Class that provides a helper for building/validating uploadAccount requests and
+ * UserImportResult responses.
+ */
+var UserImportBuilder = /** @class */ (function () {
+    /**
+     * @param {UserImportRecord[]} users The list of user records to import.
+     * @param {UserImportOptions=} options The import options which includes hashing
+     *     algorithm details.
+     * @param {ValidatorFunction=} userRequestValidator The user request validator function.
+     * @constructor
+     */
+    function UserImportBuilder(users, options, userRequestValidator) {
+        this.requiresHashOptions = false;
+        this.validatedUsers = [];
+        this.userImportResultErrors = [];
+        this.indexMap = {};
+        this.validatedUsers = this.populateUsers(users, userRequestValidator);
+        this.validatedOptions = this.populateOptions(options, this.requiresHashOptions);
+    }
+    /**
+     * Returns the corresponding constructed uploadAccount request.
+     * @return {UploadAccountRequest} The constructed uploadAccount request.
+     */
+    UserImportBuilder.prototype.buildRequest = function () {
+        var users = this.validatedUsers.map(function (user) {
+            return deep_copy_1.deepCopy(user);
+        });
+        return deep_copy_1.deepExtend({ users: users }, deep_copy_1.deepCopy(this.validatedOptions));
+    };
+    /**
+     * Populates the UserImportResult using the client side detected errors and the server
+     * side returned errors.
+     * @return {UserImportResult} The user import result based on the returned failed
+     *     uploadAccount response.
+     */
+    UserImportBuilder.prototype.buildResponse = function (failedUploads) {
+        var _this = this;
+        // Initialize user import result.
+        var importResult = {
+            successCount: this.validatedUsers.length,
+            failureCount: this.userImportResultErrors.length,
+            errors: deep_copy_1.deepCopy(this.userImportResultErrors),
+        };
+        importResult.failureCount += failedUploads.length;
+        importResult.successCount -= failedUploads.length;
+        failedUploads.forEach(function (failedUpload) {
+            importResult.errors.push({
+                // Map backend request index to original developer provided array index.
+                index: _this.indexMap[failedUpload.index],
+                error: new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_USER_IMPORT, failedUpload.message),
+            });
+        });
+        // Sort errors by index.
+        importResult.errors.sort(function (a, b) {
+            return a.index - b.index;
+        });
+        // Return sorted result.
+        return importResult;
+    };
+    /**
+     * Validates and returns the hashing options of the uploadAccount request.
+     * Throws an error whenever an invalid or missing options is detected.
+     * @param {UserImportOptions} options The UserImportOptions.
+     * @param {boolean} requiresHashOptions Whether to require hash options.
+     * @return {UploadAccountOptions} The populated UploadAccount options.
+     */
+    UserImportBuilder.prototype.populateOptions = function (options, requiresHashOptions) {
+        var populatedOptions;
+        if (!requiresHashOptions) {
+            return {};
+        }
+        if (!validator.isNonNullObject(options)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_ARGUMENT, '"UserImportOptions" are required when importing users with passwords.');
+        }
+        if (!validator.isNonNullObject(options.hash)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.MISSING_HASH_ALGORITHM, "\"hash.algorithm\" is missing from the provided \"UserImportOptions\".");
+        }
+        if (typeof options.hash.algorithm === 'undefined' ||
+            !validator.isNonEmptyString(options.hash.algorithm)) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_HASH_ALGORITHM, "\"hash.algorithm\" must be a string matching the list of supported algorithms.");
+        }
+        var rounds;
+        switch (options.hash.algorithm) {
+            case 'HMAC_SHA512':
+            case 'HMAC_SHA256':
+            case 'HMAC_SHA1':
+            case 'HMAC_MD5':
+                if (!validator.isBuffer(options.hash.key)) {
+                    throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_HASH_KEY, "A non-empty \"hash.key\" byte buffer must be provided for " +
+                        ("hash algorithm " + options.hash.algorithm + "."));
+                }
+                populatedOptions = {
+                    hashAlgorithm: options.hash.algorithm,
+                    signerKey: utils.toWebSafeBase64(options.hash.key),
+                };
+                break;
+            case 'MD5':
+            case 'SHA1':
+            case 'SHA256':
+            case 'SHA512':
+                // MD5 is [0,8192] but SHA1, SHA256, and SHA512 are [1,8192]
+                rounds = getNumberField(options.hash, 'rounds');
+                var minRounds = options.hash.algorithm === 'MD5' ? 0 : 1;
+                if (isNaN(rounds) || rounds < minRounds || rounds > 8192) {
+                    throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_HASH_ROUNDS, "A valid \"hash.rounds\" number between " + minRounds + " and 8192 must be provided for " +
+                        ("hash algorithm " + options.hash.algorithm + "."));
+                }
+                populatedOptions = {
+                    hashAlgorithm: options.hash.algorithm,
+                    rounds: rounds,
+                };
+                break;
+            case 'PBKDF_SHA1':
+            case 'PBKDF2_SHA256':
+                rounds = getNumberField(options.hash, 'rounds');
+                if (isNaN(rounds) || rounds < 0 || rounds > 120000) {
+                    throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_HASH_ROUNDS, "A valid \"hash.rounds\" number between 0 and 120000 must be provided for " +
+                        ("hash algorithm " + options.hash.algorithm + "."));
+                }
+                populatedOptions = {
+                    hashAlgorithm: options.hash.algorithm,
+                    rounds: rounds,
+                };
+                break;
+            case 'SCRYPT':
+                if (!validator.isBuffer(options.hash.key)) {
+                    throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_HASH_KEY, "A \"hash.key\" byte buffer must be provided for " +
+                        ("hash algorithm " + options.hash.algorithm + "."));
+                }
+                rounds = getNumberField(options.hash, 'rounds');
+                if (isNaN(rounds) || rounds <= 0 || rounds > 8) {
+                    throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_HASH_ROUNDS, "A valid \"hash.rounds\" number between 1 and 8 must be provided for " +
+                        ("hash algorithm " + options.hash.algorithm + "."));
+                }
+                var memoryCost = getNumberField(options.hash, 'memoryCost');
+                if (isNaN(memoryCost) || memoryCost <= 0 || memoryCost > 14) {
+                    throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_HASH_MEMORY_COST, "A valid \"hash.memoryCost\" number between 1 and 14 must be provided for " +
+                        ("hash algorithm " + options.hash.algorithm + "."));
+                }
+                if (typeof options.hash.saltSeparator !== 'undefined' &&
+                    !validator.isBuffer(options.hash.saltSeparator)) {
+                    throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_HASH_SALT_SEPARATOR, "\"hash.saltSeparator\" must be a byte buffer.");
+                }
+                populatedOptions = {
+                    hashAlgorithm: options.hash.algorithm,
+                    signerKey: utils.toWebSafeBase64(options.hash.key),
+                    rounds: rounds,
+                    memoryCost: memoryCost,
+                    saltSeparator: utils.toWebSafeBase64(options.hash.saltSeparator || Buffer.from('')),
+                };
+                break;
+            case 'BCRYPT':
+                populatedOptions = {
+                    hashAlgorithm: options.hash.algorithm,
+                };
+                break;
+            case 'STANDARD_SCRYPT':
+                var cpuMemCost = getNumberField(options.hash, 'memoryCost');
+                if (isNaN(cpuMemCost)) {
+                    throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_HASH_MEMORY_COST, "A valid \"hash.memoryCost\" number must be provided for " +
+                        ("hash algorithm " + options.hash.algorithm + "."));
+                }
+                var parallelization = getNumberField(options.hash, 'parallelization');
+                if (isNaN(parallelization)) {
+                    throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_HASH_PARALLELIZATION, "A valid \"hash.parallelization\" number must be provided for " +
+                        ("hash algorithm " + options.hash.algorithm + "."));
+                }
+                var blockSize = getNumberField(options.hash, 'blockSize');
+                if (isNaN(blockSize)) {
+                    throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_HASH_BLOCK_SIZE, "A valid \"hash.blockSize\" number must be provided for " +
+                        ("hash algorithm " + options.hash.algorithm + "."));
+                }
+                var dkLen = getNumberField(options.hash, 'derivedKeyLength');
+                if (isNaN(dkLen)) {
+                    throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_HASH_DERIVED_KEY_LENGTH, "A valid \"hash.derivedKeyLength\" number must be provided for " +
+                        ("hash algorithm " + options.hash.algorithm + "."));
+                }
+                populatedOptions = {
+                    hashAlgorithm: options.hash.algorithm,
+                    cpuMemCost: cpuMemCost,
+                    parallelization: parallelization,
+                    blockSize: blockSize,
+                    dkLen: dkLen,
+                };
+                break;
+            default:
+                throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INVALID_HASH_ALGORITHM, "Unsupported hash algorithm provider \"" + options.hash.algorithm + "\".");
+        }
+        return populatedOptions;
+    };
+    /**
+     * Validates and returns the users list of the uploadAccount request.
+     * Whenever a user with an error is detected, the error is cached and will later be
+     * merged into the user import result. This allows the processing of valid users without
+     * failing early on the first error detected.
+     * @param {UserImportRecord[]} users The UserImportRecords to convert to UnploadAccountUser
+     *     objects.
+     * @param {ValidatorFunction=} userValidator The user validator function.
+     * @return {UploadAccountUser[]} The populated uploadAccount users.
+     */
+    UserImportBuilder.prototype.populateUsers = function (users, userValidator) {
+        var _this = this;
+        var populatedUsers = [];
+        users.forEach(function (user, index) {
+            try {
+                var result = populateUploadAccountUser(user, userValidator);
+                if (typeof result.passwordHash !== 'undefined') {
+                    _this.requiresHashOptions = true;
+                }
+                // Only users that pass client screening will be passed to backend for processing.
+                populatedUsers.push(result);
+                // Map user's index (the one to be sent to backend) to original developer provided array.
+                _this.indexMap[populatedUsers.length - 1] = index;
+            }
+            catch (error) {
+                // Save the client side error with respect to the developer provided array.
+                _this.userImportResultErrors.push({
+                    index: index,
+                    error: error,
+                });
+            }
+        });
+        return populatedUsers;
+    };
+    return UserImportBuilder;
+}());
+exports.UserImportBuilder = UserImportBuilder;

node_modules/firebase-admin/lib/auth/user-record.js

@@ -0,0 +1,188 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2017 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var deep_copy_1 = require("../utils/deep-copy");
+var utils = require("../utils");
+var error_1 = require("../utils/error");
+/**
+ * 'REDACTED', encoded as a base64 string.
+ */
+var B64_REDACTED = Buffer.from('REDACTED').toString('base64');
+/**
+ * Parses a time stamp string or number and returns the corresponding date if valid.
+ *
+ * @param {any} time The unix timestamp string or number in milliseconds.
+ * @return {string} The corresponding date as a UTC string, if valid. Otherwise, null.
+ */
+function parseDate(time) {
+    try {
+        var date = new Date(parseInt(time, 10));
+        if (!isNaN(date.getTime())) {
+            return date.toUTCString();
+        }
+    }
+    catch (e) {
+        // Do nothing. null will be returned.
+    }
+    return null;
+}
+/**
+ * User metadata class that provides metadata information like user account creation
+ * and last sign in time.
+ *
+ * @param {object} response The server side response returned from the getAccountInfo
+ *     endpoint.
+ * @constructor
+ */
+var UserMetadata = /** @class */ (function () {
+    function UserMetadata(response) {
+        // Creation date should always be available but due to some backend bugs there
+        // were cases in the past where users did not have creation date properly set.
+        // This included legacy Firebase migrating project users and some anonymous users.
+        // These bugs have already been addressed since then.
+        utils.addReadonlyGetter(this, 'creationTime', parseDate(response.createdAt));
+        utils.addReadonlyGetter(this, 'lastSignInTime', parseDate(response.lastLoginAt));
+    }
+    /** @return {object} The plain object representation of the user's metadata. */
+    UserMetadata.prototype.toJSON = function () {
+        return {
+            lastSignInTime: this.lastSignInTime,
+            creationTime: this.creationTime,
+        };
+    };
+    return UserMetadata;
+}());
+exports.UserMetadata = UserMetadata;
+/**
+ * User info class that provides provider user information for different
+ * Firebase providers like google.com, facebook.com, password, etc.
+ *
+ * @param {object} response The server side response returned from the getAccountInfo
+ *     endpoint.
+ * @constructor
+ */
+var UserInfo = /** @class */ (function () {
+    function UserInfo(response) {
+        // Provider user id and provider id are required.
+        if (!response.rawId || !response.providerId) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INTERNAL_ERROR, 'INTERNAL ASSERT FAILED: Invalid user info response');
+        }
+        utils.addReadonlyGetter(this, 'uid', response.rawId);
+        utils.addReadonlyGetter(this, 'displayName', response.displayName);
+        utils.addReadonlyGetter(this, 'email', response.email);
+        utils.addReadonlyGetter(this, 'photoURL', response.photoUrl);
+        utils.addReadonlyGetter(this, 'providerId', response.providerId);
+        utils.addReadonlyGetter(this, 'phoneNumber', response.phoneNumber);
+    }
+    /** @return {object} The plain object representation of the current provider data. */
+    UserInfo.prototype.toJSON = function () {
+        return {
+            uid: this.uid,
+            displayName: this.displayName,
+            email: this.email,
+            photoURL: this.photoURL,
+            providerId: this.providerId,
+            phoneNumber: this.phoneNumber,
+        };
+    };
+    return UserInfo;
+}());
+exports.UserInfo = UserInfo;
+/**
+ * User record class that defines the Firebase user object populated from
+ * the Firebase Auth getAccountInfo response.
+ *
+ * @param {any} response The server side response returned from the getAccountInfo
+ *     endpoint.
+ * @constructor
+ */
+var UserRecord = /** @class */ (function () {
+    function UserRecord(response) {
+        // The Firebase user id is required.
+        if (!response.localId) {
+            throw new error_1.FirebaseAuthError(error_1.AuthClientErrorCode.INTERNAL_ERROR, 'INTERNAL ASSERT FAILED: Invalid user response');
+        }
+        utils.addReadonlyGetter(this, 'uid', response.localId);
+        utils.addReadonlyGetter(this, 'email', response.email);
+        utils.addReadonlyGetter(this, 'emailVerified', !!response.emailVerified);
+        utils.addReadonlyGetter(this, 'displayName', response.displayName);
+        utils.addReadonlyGetter(this, 'photoURL', response.photoUrl);
+        utils.addReadonlyGetter(this, 'phoneNumber', response.phoneNumber);
+        // If disabled is not provided, the account is enabled by default.
+        utils.addReadonlyGetter(this, 'disabled', response.disabled || false);
+        utils.addReadonlyGetter(this, 'metadata', new UserMetadata(response));
+        var providerData = [];
+        for (var _i = 0, _a = (response.providerUserInfo || []); _i < _a.length; _i++) {
+            var entry = _a[_i];
+            providerData.push(new UserInfo(entry));
+        }
+        utils.addReadonlyGetter(this, 'providerData', providerData);
+        // If the password hash is redacted (probably due to missing permissions)
+        // then clear it out, similar to how the salt is returned. (Otherwise, it
+        // *looks* like a b64-encoded hash is present, which is confusing.)
+        if (response.passwordHash === B64_REDACTED) {
+            utils.addReadonlyGetter(this, 'passwordHash', undefined);
+        }
+        else {
+            utils.addReadonlyGetter(this, 'passwordHash', response.passwordHash);
+        }
+        utils.addReadonlyGetter(this, 'passwordSalt', response.salt);
+        try {
+            utils.addReadonlyGetter(this, 'customClaims', JSON.parse(response.customAttributes));
+        }
+        catch (e) {
+            // Ignore error.
+            utils.addReadonlyGetter(this, 'customClaims', undefined);
+        }
+        var validAfterTime = null;
+        // Convert validSince first to UTC milliseconds and then to UTC date string.
+        if (typeof response.validSince !== 'undefined') {
+            validAfterTime = parseDate(response.validSince * 1000);
+        }
+        utils.addReadonlyGetter(this, 'tokensValidAfterTime', validAfterTime || undefined);
+        utils.addReadonlyGetter(this, 'tenantId', response.tenantId);
+    }
+    /** @return {object} The plain object representation of the user record. */
+    UserRecord.prototype.toJSON = function () {
+        var json = {
+            uid: this.uid,
+            email: this.email,
+            emailVerified: this.emailVerified,
+            displayName: this.displayName,
+            photoURL: this.photoURL,
+            phoneNumber: this.phoneNumber,
+            disabled: this.disabled,
+            // Convert metadata to json.
+            metadata: this.metadata.toJSON(),
+            passwordHash: this.passwordHash,
+            passwordSalt: this.passwordSalt,
+            customClaims: deep_copy_1.deepCopy(this.customClaims),
+            tokensValidAfterTime: this.tokensValidAfterTime,
+            tenantId: this.tenantId,
+        };
+        json.providerData = [];
+        for (var _i = 0, _a = this.providerData; _i < _a.length; _i++) {
+            var entry = _a[_i];
+            // Convert each provider data to json.
+            json.providerData.push(entry.toJSON());
+        }
+        return json;
+    };
+    return UserRecord;
+}());
+exports.UserRecord = UserRecord;

node_modules/firebase-admin/lib/database/database.js

@@ -0,0 +1,209 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+var url_1 = require("url");
+var path = require("path");
+var error_1 = require("../utils/error");
+var validator = require("../utils/validator");
+var api_request_1 = require("../utils/api-request");
+/**
+ * Internals of a Database instance.
+ */
+var DatabaseInternals = /** @class */ (function () {
+    function DatabaseInternals() {
+        this.databases = {};
+    }
+    /**
+     * Deletes the service and its associated resources.
+     *
+     * @return {Promise<()>} An empty Promise that will be fulfilled when the service is deleted.
+     */
+    DatabaseInternals.prototype.delete = function () {
+        for (var _i = 0, _a = Object.keys(this.databases); _i < _a.length; _i++) {
+            var dbUrl = _a[_i];
+            var db = this.databases[dbUrl];
+            db.INTERNAL.delete();
+        }
+        return Promise.resolve(undefined);
+    };
+    return DatabaseInternals;
+}());
+var DatabaseService = /** @class */ (function () {
+    function DatabaseService(app) {
+        this.INTERNAL = new DatabaseInternals();
+        if (!validator.isNonNullObject(app) || !('options' in app)) {
+            throw new error_1.FirebaseDatabaseError({
+                code: 'invalid-argument',
+                message: 'First argument passed to admin.database() must be a valid Firebase app instance.',
+            });
+        }
+        this.appInternal = app;
+    }
+    Object.defineProperty(DatabaseService.prototype, "app", {
+        /**
+         * Returns the app associated with this DatabaseService instance.
+         *
+         * @return {FirebaseApp} The app associated with this DatabaseService instance.
+         */
+        get: function () {
+            return this.appInternal;
+        },
+        enumerable: true,
+        configurable: true
+    });
+    DatabaseService.prototype.getDatabase = function (url) {
+        var dbUrl = this.ensureUrl(url);
+        if (!validator.isNonEmptyString(dbUrl)) {
+            throw new error_1.FirebaseDatabaseError({
+                code: 'invalid-argument',
+                message: 'Database URL must be a valid, non-empty URL string.',
+            });
+        }
+        var db = this.INTERNAL.databases[dbUrl];
+        if (typeof db === 'undefined') {
+            var rtdb = require('@firebase/database');
+            var version = require('../../package.json').version;
+            db = rtdb.initStandalone(this.appInternal, dbUrl, version).instance;
+            var rulesClient_1 = new DatabaseRulesClient(this.app, dbUrl);
+            db.getRules = function () {
+                return rulesClient_1.getRules();
+            };
+            db.getRulesJSON = function () {
+                return rulesClient_1.getRulesJSON();
+            };
+            db.setRules = function (source) {
+                return rulesClient_1.setRules(source);
+            };
+            this.INTERNAL.databases[dbUrl] = db;
+        }
+        return db;
+    };
+    DatabaseService.prototype.ensureUrl = function (url) {
+        if (typeof url !== 'undefined') {
+            return url;
+        }
+        else if (typeof this.appInternal.options.databaseURL !== 'undefined') {
+            return this.appInternal.options.databaseURL;
+        }
+        throw new error_1.FirebaseDatabaseError({
+            code: 'invalid-argument',
+            message: 'Can\'t determine Firebase Database URL.',
+        });
+    };
+    return DatabaseService;
+}());
+exports.DatabaseService = DatabaseService;
+var RULES_URL_PATH = '.settings/rules.json';
+/**
+ * A helper client for managing RTDB security rules.
+ */
+var DatabaseRulesClient = /** @class */ (function () {
+    function DatabaseRulesClient(app, dbUrl) {
+        var parsedUrl = new url_1.URL(dbUrl);
+        parsedUrl.pathname = path.join(parsedUrl.pathname, RULES_URL_PATH);
+        this.dbUrl = parsedUrl.toString();
+        this.httpClient = new api_request_1.AuthorizedHttpClient(app);
+    }
+    /**
+     * Gets the currently applied security rules as a string. The return value consists of
+     * the rules source including comments.
+     *
+     * @return {Promise<string>} A promise fulfilled with the rules as a raw string.
+     */
+    DatabaseRulesClient.prototype.getRules = function () {
+        var _this = this;
+        var req = {
+            method: 'GET',
+            url: this.dbUrl,
+        };
+        return this.httpClient.send(req)
+            .then(function (resp) {
+            if (!resp.text) {
+                throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INTERNAL_ERROR, 'HTTP response missing data.');
+            }
+            return resp.text;
+        })
+            .catch(function (err) {
+            throw _this.handleError(err);
+        });
+    };
+    /**
+     * Gets the currently applied security rules as a parsed JSON object. Any comments in
+     * the original source are stripped away.
+     *
+     * @return {Promise<object>} A promise fulfilled with the parsed rules source.
+     */
+    DatabaseRulesClient.prototype.getRulesJSON = function () {
+        var _this = this;
+        var req = {
+            method: 'GET',
+            url: this.dbUrl,
+            data: { format: 'strict' },
+        };
+        return this.httpClient.send(req)
+            .then(function (resp) {
+            return resp.data;
+        })
+            .catch(function (err) {
+            throw _this.handleError(err);
+        });
+    };
+    /**
+     * Sets the specified rules on the Firebase Database instance. If the rules source is
+     * specified as a string or a Buffer, it may include comments.
+     *
+     * @param {string|Buffer|object} source Source of the rules to apply. Must not be `null`
+     *  or empty.
+     * @return {Promise<void>} Resolves when the rules are set on the Database.
+     */
+    DatabaseRulesClient.prototype.setRules = function (source) {
+        var _this = this;
+        if (!validator.isNonEmptyString(source) &&
+            !validator.isBuffer(source) &&
+            !validator.isNonNullObject(source)) {
+            var error = new error_1.FirebaseDatabaseError({
+                code: 'invalid-argument',
+                message: 'Source must be a non-empty string, Buffer or an object.',
+            });
+            return Promise.reject(error);
+        }
+        var req = {
+            method: 'PUT',
+            url: this.dbUrl,
+            data: source,
+            headers: {
+                'content-type': 'application/json; charset=utf-8',
+            },
+        };
+        return this.httpClient.send(req)
+            .then(function () {
+            return;
+        })
+            .catch(function (err) {
+            throw _this.handleError(err);
+        });
+    };
+    DatabaseRulesClient.prototype.handleError = function (err) {
+        if (err instanceof api_request_1.HttpError) {
+            return new error_1.FirebaseDatabaseError({
+                code: error_1.AppErrorCodes.INTERNAL_ERROR,
+                message: this.getErrorMessage(err),
+            });
+        }
+        return err;
+    };
+    DatabaseRulesClient.prototype.getErrorMessage = function (err) {
+        var intro = 'Error while accessing security rules';
+        try {
+            var body = err.response.data;
+            if (body && body.error) {
+                return intro + ": " + body.error.trim();
+            }
+        }
+        catch (_a) {
+            // Ignore parsing errors
+        }
+        return intro + ": " + err.response.text;
+    };
+    return DatabaseRulesClient;
+}());

node_modules/firebase-admin/lib/default-namespace.js

@@ -0,0 +1,30 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2017 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+var firebase_namespace_1 = require("./firebase-namespace");
+var firebaseAdmin = new firebase_namespace_1.FirebaseNamespace();
+// Inject a circular default export to allow users to use both:
+//
+//   import firebaseAdmin from 'firebase-admin';
+//   which becomes: var firebaseAdmin = require('firebase-admin').default;
+//
+// as well as the more correct:
+//
+//   import * as firebaseAdmin from 'firebase-admin';
+//   which becomes: var firebaseAdmin = require('firebase-admin');
+firebaseAdmin.default = firebaseAdmin;
+module.exports = firebaseAdmin;

node_modules/firebase-admin/lib/firebase-app.js

@@ -0,0 +1,386 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2017 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var credential_1 = require("./auth/credential");
+var validator = require("./utils/validator");
+var deep_copy_1 = require("./utils/deep-copy");
+var error_1 = require("./utils/error");
+/**
+ * Internals of a FirebaseApp instance.
+ */
+var FirebaseAppInternals = /** @class */ (function () {
+    function FirebaseAppInternals(credential_) {
+        this.credential_ = credential_;
+        this.isDeleted_ = false;
+        this.tokenListeners_ = [];
+    }
+    /**
+     * Gets an auth token for the associated app.
+     *
+     * @param {boolean} forceRefresh Whether or not to force a token refresh.
+     * @return {Promise<FirebaseAccessToken>} A Promise that will be fulfilled with the current or
+     *   new token.
+     */
+    FirebaseAppInternals.prototype.getToken = function (forceRefresh) {
+        var _this = this;
+        var expired = this.cachedToken_ && this.cachedToken_.expirationTime < Date.now();
+        if (this.cachedTokenPromise_ && !forceRefresh && !expired) {
+            return this.cachedTokenPromise_
+                .catch(function (error) {
+                // Update the cached token promise to avoid caching errors. Set it to resolve with the
+                // cached token if we have one (and return that promise since the token has still not
+                // expired).
+                if (_this.cachedToken_) {
+                    _this.cachedTokenPromise_ = Promise.resolve(_this.cachedToken_);
+                    return _this.cachedTokenPromise_;
+                }
+                // Otherwise, set the cached token promise to null so that it will force a refresh next
+                // time getToken() is called.
+                _this.cachedTokenPromise_ = null;
+                // And re-throw the caught error.
+                throw error;
+            });
+        }
+        else {
+            // Clear the outstanding token refresh timeout. This is a noop if the timeout is undefined.
+            clearTimeout(this.tokenRefreshTimeout_);
+            // this.credential_ may be an external class; resolving it in a promise helps us
+            // protect against exceptions and upgrades the result to a promise in all cases.
+            this.cachedTokenPromise_ = Promise.resolve(this.credential_.getAccessToken())
+                .then(function (result) {
+                // Since the developer can provide the credential implementation, we want to weakly verify
+                // the return type until the type is properly exported.
+                if (!validator.isNonNullObject(result) ||
+                    typeof result.expires_in !== 'number' ||
+                    typeof result.access_token !== 'string') {
+                    throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, "Invalid access token generated: \"" + JSON.stringify(result) + "\". Valid access " +
+                        'tokens must be an object with the "expires_in" (number) and "access_token" ' +
+                        '(string) properties.');
+                }
+                var token = {
+                    accessToken: result.access_token,
+                    expirationTime: Date.now() + (result.expires_in * 1000),
+                };
+                var hasAccessTokenChanged = (_this.cachedToken_ && _this.cachedToken_.accessToken !== token.accessToken);
+                var hasExpirationChanged = (_this.cachedToken_ && _this.cachedToken_.expirationTime !== token.expirationTime);
+                if (!_this.cachedToken_ || hasAccessTokenChanged || hasExpirationChanged) {
+                    _this.cachedToken_ = token;
+                    _this.tokenListeners_.forEach(function (listener) {
+                        listener(token.accessToken);
+                    });
+                }
+                // Establish a timeout to proactively refresh the token every minute starting at five
+                // minutes before it expires. Once a token refresh succeeds, no further retries are
+                // needed; if it fails, retry every minute until the token expires (resulting in a total
+                // of four retries: at 4, 3, 2, and 1 minutes).
+                var refreshTimeInSeconds = (result.expires_in - (5 * 60));
+                var numRetries = 4;
+                // In the rare cases the token is short-lived (that is, it expires in less than five
+                // minutes from when it was fetched), establish the timeout to refresh it after the
+                // current minute ends and update the number of retries that should be attempted before
+                // the token expires.
+                if (refreshTimeInSeconds <= 0) {
+                    refreshTimeInSeconds = result.expires_in % 60;
+                    numRetries = Math.floor(result.expires_in / 60) - 1;
+                }
+                // The token refresh timeout keeps the Node.js process alive, so only create it if this
+                // instance has not already been deleted.
+                if (numRetries && !_this.isDeleted_) {
+                    _this.setTokenRefreshTimeout(refreshTimeInSeconds * 1000, numRetries);
+                }
+                return token;
+            })
+                .catch(function (error) {
+                var errorMessage = (typeof error === 'string') ? error : error.message;
+                errorMessage = 'Credential implementation provided to initializeApp() via the ' +
+                    '"credential" property failed to fetch a valid Google OAuth2 access token with the ' +
+                    ("following error: \"" + errorMessage + "\".");
+                if (errorMessage.indexOf('invalid_grant') !== -1) {
+                    errorMessage += ' There are two likely causes: (1) your server time is not properly ' +
+                        'synced or (2) your certificate key file has been revoked. To solve (1), re-sync the ' +
+                        'time on your server. To solve (2), make sure the key ID for your key file is still ' +
+                        'present at https://console.firebase.google.com/iam-admin/serviceaccounts/project. If ' +
+                        'not, generate a new key file at ' +
+                        'https://console.firebase.google.com/project/_/settings/serviceaccounts/adminsdk.';
+                }
+                throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, errorMessage);
+            });
+            return this.cachedTokenPromise_;
+        }
+    };
+    /**
+     * Adds a listener that is called each time a token changes.
+     *
+     * @param {function(string)} listener The listener that will be called with each new token.
+     */
+    FirebaseAppInternals.prototype.addAuthTokenListener = function (listener) {
+        this.tokenListeners_.push(listener);
+        if (this.cachedToken_) {
+            listener(this.cachedToken_.accessToken);
+        }
+    };
+    /**
+     * Removes a token listener.
+     *
+     * @param {function(string)} listener The listener to remove.
+     */
+    FirebaseAppInternals.prototype.removeAuthTokenListener = function (listener) {
+        this.tokenListeners_ = this.tokenListeners_.filter(function (other) { return other !== listener; });
+    };
+    /**
+     * Deletes the FirebaseAppInternals instance.
+     */
+    FirebaseAppInternals.prototype.delete = function () {
+        this.isDeleted_ = true;
+        // Clear the token refresh timeout so it doesn't keep the Node.js process alive.
+        clearTimeout(this.tokenRefreshTimeout_);
+    };
+    /**
+     * Establishes timeout to refresh the Google OAuth2 access token used by the SDK.
+     *
+     * @param {number} delayInMilliseconds The delay to use for the timeout.
+     * @param {number} numRetries The number of times to retry fetching a new token if the prior fetch
+     *   failed.
+     */
+    FirebaseAppInternals.prototype.setTokenRefreshTimeout = function (delayInMilliseconds, numRetries) {
+        var _this = this;
+        this.tokenRefreshTimeout_ = setTimeout(function () {
+            _this.getToken(/* forceRefresh */ true)
+                .catch(function (error) {
+                // Ignore the error since this might just be an intermittent failure. If we really cannot
+                // refresh the token, an error will be logged once the existing token expires and we try
+                // to fetch a fresh one.
+                if (numRetries > 0) {
+                    _this.setTokenRefreshTimeout(60 * 1000, numRetries - 1);
+                }
+            });
+        }, delayInMilliseconds);
+    };
+    return FirebaseAppInternals;
+}());
+exports.FirebaseAppInternals = FirebaseAppInternals;
+/**
+ * Global context object for a collection of services using a shared authentication state.
+ */
+var FirebaseApp = /** @class */ (function () {
+    function FirebaseApp(options, name, firebaseInternals_) {
+        var _this = this;
+        this.firebaseInternals_ = firebaseInternals_;
+        this.services_ = {};
+        this.isDeleted_ = false;
+        this.name_ = name;
+        this.options_ = deep_copy_1.deepCopy(options);
+        if (!validator.isNonNullObject(this.options_)) {
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_APP_OPTIONS, "Invalid Firebase app options passed as the first argument to initializeApp() for the " +
+                ("app named \"" + this.name_ + "\". Options must be a non-null object."));
+        }
+        var hasCredential = ('credential' in this.options_);
+        if (!hasCredential) {
+            this.options_.credential = credential_1.getApplicationDefault(this.options_.httpAgent);
+        }
+        var credential = this.options_.credential;
+        if (typeof credential !== 'object' || credential === null || typeof credential.getAccessToken !== 'function') {
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_APP_OPTIONS, "Invalid Firebase app options passed as the first argument to initializeApp() for the " +
+                ("app named \"" + this.name_ + "\". The \"credential\" property must be an object which implements ") +
+                "the Credential interface.");
+        }
+        Object.keys(firebaseInternals_.serviceFactories).forEach(function (serviceName) {
+            // Defer calling createService() until the service is accessed
+            _this[serviceName] = _this.getService_.bind(_this, serviceName);
+        });
+        this.INTERNAL = new FirebaseAppInternals(credential);
+    }
+    /**
+     * Returns the Auth service instance associated with this app.
+     *
+     * @return {Auth} The Auth service instance of this app.
+     */
+    FirebaseApp.prototype.auth = function () {
+        var _this = this;
+        return this.ensureService_('auth', function () {
+            var authService = require('./auth/auth').Auth;
+            return new authService(_this);
+        });
+    };
+    /**
+     * Returns the Database service for the specified URL, and the current app.
+     *
+     * @return {Database} The Database service instance of this app.
+     */
+    FirebaseApp.prototype.database = function (url) {
+        var _this = this;
+        var service = this.ensureService_('database', function () {
+            var dbService = require('./database/database').DatabaseService;
+            return new dbService(_this);
+        });
+        return service.getDatabase(url);
+    };
+    /**
+     * Returns the Messaging service instance associated with this app.
+     *
+     * @return {Messaging} The Messaging service instance of this app.
+     */
+    FirebaseApp.prototype.messaging = function () {
+        var _this = this;
+        return this.ensureService_('messaging', function () {
+            var messagingService = require('./messaging/messaging').Messaging;
+            return new messagingService(_this);
+        });
+    };
+    /**
+     * Returns the Storage service instance associated with this app.
+     *
+     * @return {Storage} The Storage service instance of this app.
+     */
+    FirebaseApp.prototype.storage = function () {
+        var _this = this;
+        return this.ensureService_('storage', function () {
+            var storageService = require('./storage/storage').Storage;
+            return new storageService(_this);
+        });
+    };
+    FirebaseApp.prototype.firestore = function () {
+        var _this = this;
+        var service = this.ensureService_('firestore', function () {
+            var firestoreService = require('./firestore/firestore').FirestoreService;
+            return new firestoreService(_this);
+        });
+        return service.client;
+    };
+    /**
+     * Returns the InstanceId service instance associated with this app.
+     *
+     * @return {InstanceId} The InstanceId service instance of this app.
+     */
+    FirebaseApp.prototype.instanceId = function () {
+        var _this = this;
+        return this.ensureService_('iid', function () {
+            var iidService = require('./instance-id/instance-id').InstanceId;
+            return new iidService(_this);
+        });
+    };
+    /**
+     * Returns the ProjectManagement service instance associated with this app.
+     *
+     * @return {ProjectManagement} The ProjectManagement service instance of this app.
+     */
+    FirebaseApp.prototype.projectManagement = function () {
+        var _this = this;
+        return this.ensureService_('project-management', function () {
+            var projectManagementService = require('./project-management/project-management').ProjectManagement;
+            return new projectManagementService(_this);
+        });
+    };
+    /**
+     * Returns the SecurityRules service instance associated with this app.
+     *
+     * @return {SecurityRules} The SecurityRules service instance of this app.
+     */
+    FirebaseApp.prototype.securityRules = function () {
+        var _this = this;
+        return this.ensureService_('security-rules', function () {
+            var securityRulesService = require('./security-rules/security-rules').SecurityRules;
+            return new securityRulesService(_this);
+        });
+    };
+    Object.defineProperty(FirebaseApp.prototype, "name", {
+        /**
+         * Returns the name of the FirebaseApp instance.
+         *
+         * @return {string} The name of the FirebaseApp instance.
+         */
+        get: function () {
+            this.checkDestroyed_();
+            return this.name_;
+        },
+        enumerable: true,
+        configurable: true
+    });
+    Object.defineProperty(FirebaseApp.prototype, "options", {
+        /**
+         * Returns the options for the FirebaseApp instance.
+         *
+         * @return {FirebaseAppOptions} The options for the FirebaseApp instance.
+         */
+        get: function () {
+            this.checkDestroyed_();
+            return deep_copy_1.deepCopy(this.options_);
+        },
+        enumerable: true,
+        configurable: true
+    });
+    /**
+     * Deletes the FirebaseApp instance.
+     *
+     * @return {Promise<void>} An empty Promise fulfilled once the FirebaseApp instance is deleted.
+     */
+    FirebaseApp.prototype.delete = function () {
+        var _this = this;
+        this.checkDestroyed_();
+        this.firebaseInternals_.removeApp(this.name_);
+        this.INTERNAL.delete();
+        return Promise.all(Object.keys(this.services_).map(function (serviceName) {
+            return _this.services_[serviceName].INTERNAL.delete();
+        })).then(function () {
+            _this.services_ = {};
+            _this.isDeleted_ = true;
+        });
+    };
+    FirebaseApp.prototype.ensureService_ = function (serviceName, initializer) {
+        this.checkDestroyed_();
+        var service;
+        if (serviceName in this.services_) {
+            service = this.services_[serviceName];
+        }
+        else {
+            service = initializer();
+            this.services_[serviceName] = service;
+        }
+        return service;
+    };
+    /**
+     * Returns the service instance associated with this FirebaseApp instance (creating it on demand
+     * if needed). This is used for looking up monkeypatched service instances.
+     *
+     * @param {string} serviceName The name of the service instance to return.
+     * @return {FirebaseServiceInterface} The service instance with the provided name.
+     */
+    FirebaseApp.prototype.getService_ = function (serviceName) {
+        this.checkDestroyed_();
+        if (!(serviceName in this.services_)) {
+            this.services_[serviceName] = this.firebaseInternals_.serviceFactories[serviceName](this, this.extendApp_.bind(this));
+        }
+        return this.services_[serviceName];
+    };
+    /**
+     * Callback function used to extend an App instance at the time of service instance creation.
+     */
+    FirebaseApp.prototype.extendApp_ = function (props) {
+        deep_copy_1.deepExtend(this, props);
+    };
+    /**
+     * Throws an Error if the FirebaseApp instance has already been deleted.
+     */
+    FirebaseApp.prototype.checkDestroyed_ = function () {
+        if (this.isDeleted_) {
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.APP_DELETED, "Firebase app named \"" + this.name_ + "\" has already been deleted.");
+        }
+    };
+    return FirebaseApp;
+}());
+exports.FirebaseApp = FirebaseApp;

node_modules/firebase-admin/lib/firebase-namespace.js

@@ -0,0 +1,440 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2017 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var fs = require("fs");
+var deep_copy_1 = require("./utils/deep-copy");
+var error_1 = require("./utils/error");
+var firebase_app_1 = require("./firebase-app");
+var credential_1 = require("./auth/credential");
+var validator = require("./utils/validator");
+var DEFAULT_APP_NAME = '[DEFAULT]';
+/**
+ * Constant holding the environment variable name with the default config.
+ * If the environment variable contains a string that starts with '{' it will be parsed as JSON,
+ * otherwise it will be assumed to be pointing to a file.
+ */
+exports.FIREBASE_CONFIG_VAR = 'FIREBASE_CONFIG';
+var globalAppDefaultCred;
+var globalCertCreds = {};
+var globalRefreshTokenCreds = {};
+/**
+ * Internals of a FirebaseNamespace instance.
+ */
+var FirebaseNamespaceInternals = /** @class */ (function () {
+    function FirebaseNamespaceInternals(firebase_) {
+        this.firebase_ = firebase_;
+        this.serviceFactories = {};
+        this.apps_ = {};
+        this.appHooks_ = {};
+    }
+    /**
+     * Initializes the FirebaseApp instance.
+     *
+     * @param {FirebaseAppOptions} options Optional options for the FirebaseApp instance. If none present
+     *                             will try to initialize from the FIREBASE_CONFIG environment variable.
+     *                             If the environment variable contains a string that starts with '{'
+     *                             it will be parsed as JSON,
+     *                             otherwise it will be assumed to be pointing to a file.
+     * @param {string} [appName] Optional name of the FirebaseApp instance.
+     *
+     * @return {FirebaseApp} A new FirebaseApp instance.
+     */
+    FirebaseNamespaceInternals.prototype.initializeApp = function (options, appName) {
+        if (appName === void 0) { appName = DEFAULT_APP_NAME; }
+        if (typeof options === 'undefined') {
+            options = this.loadOptionsFromEnvVar();
+            options.credential = credential_1.getApplicationDefault();
+        }
+        if (typeof appName !== 'string' || appName === '') {
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_APP_NAME, "Invalid Firebase app name \"" + appName + "\" provided. App name must be a non-empty string.");
+        }
+        else if (appName in this.apps_) {
+            if (appName === DEFAULT_APP_NAME) {
+                throw new error_1.FirebaseAppError(error_1.AppErrorCodes.DUPLICATE_APP, 'The default Firebase app already exists. This means you called initializeApp() ' +
+                    'more than once without providing an app name as the second argument. In most cases ' +
+                    'you only need to call initializeApp() once. But if you do want to initialize ' +
+                    'multiple apps, pass a second argument to initializeApp() to give each app a unique ' +
+                    'name.');
+            }
+            else {
+                throw new error_1.FirebaseAppError(error_1.AppErrorCodes.DUPLICATE_APP, "Firebase app named \"" + appName + "\" already exists. This means you called initializeApp() " +
+                    'more than once with the same app name as the second argument. Make sure you provide a ' +
+                    'unique name every time you call initializeApp().');
+            }
+        }
+        var app = new firebase_app_1.FirebaseApp(options, appName, this);
+        this.apps_[appName] = app;
+        this.callAppHooks_(app, 'create');
+        return app;
+    };
+    /**
+     * Returns the FirebaseApp instance with the provided name (or the default FirebaseApp instance
+     * if no name is provided).
+     *
+     * @param {string} [appName=DEFAULT_APP_NAME] Optional name of the FirebaseApp instance to return.
+     * @return {FirebaseApp} The FirebaseApp instance which has the provided name.
+     */
+    FirebaseNamespaceInternals.prototype.app = function (appName) {
+        if (appName === void 0) { appName = DEFAULT_APP_NAME; }
+        if (typeof appName !== 'string' || appName === '') {
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_APP_NAME, "Invalid Firebase app name \"" + appName + "\" provided. App name must be a non-empty string.");
+        }
+        else if (!(appName in this.apps_)) {
+            var errorMessage = (appName === DEFAULT_APP_NAME)
+                ? 'The default Firebase app does not exist. ' : "Firebase app named \"" + appName + "\" does not exist. ";
+            errorMessage += 'Make sure you call initializeApp() before using any of the Firebase services.';
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.NO_APP, errorMessage);
+        }
+        return this.apps_[appName];
+    };
+    Object.defineProperty(FirebaseNamespaceInternals.prototype, "apps", {
+        /*
+         * Returns an array of all the non-deleted FirebaseApp instances.
+         *
+         * @return {Array<FirebaseApp>} An array of all the non-deleted FirebaseApp instances
+         */
+        get: function () {
+            var _this = this;
+            // Return a copy so the caller cannot mutate the array
+            return Object.keys(this.apps_).map(function (appName) { return _this.apps_[appName]; });
+        },
+        enumerable: true,
+        configurable: true
+    });
+    /*
+     * Removes the specified FirebaseApp instance.
+     *
+     * @param {string} appName The name of the FirebaseApp instance to remove.
+     */
+    FirebaseNamespaceInternals.prototype.removeApp = function (appName) {
+        if (typeof appName === 'undefined') {
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_APP_NAME, "No Firebase app name provided. App name must be a non-empty string.");
+        }
+        var appToRemove = this.app(appName);
+        this.callAppHooks_(appToRemove, 'delete');
+        delete this.apps_[appName];
+    };
+    /*
+     * Registers a new service on this Firebase namespace.
+     *
+     * @param {string} serviceName The name of the Firebase service to register.
+     * @param {FirebaseServiceFactory} createService A factory method to generate an instance of the Firebase service.
+     * @param {object} [serviceProperties] Optional properties to extend this Firebase namespace with.
+     * @param {AppHook} [appHook] Optional callback that handles app-related events like app creation and deletion.
+     * @return {FirebaseServiceNamespace<FirebaseServiceInterface>} The Firebase service's namespace.
+     */
+    FirebaseNamespaceInternals.prototype.registerService = function (serviceName, createService, serviceProperties, appHook) {
+        var _this = this;
+        var errorMessage;
+        if (typeof serviceName === 'undefined') {
+            errorMessage = "No service name provided. Service name must be a non-empty string.";
+        }
+        else if (typeof serviceName !== 'string' || serviceName === '') {
+            errorMessage = "Invalid service name \"" + serviceName + "\" provided. Service name must be a non-empty string.";
+        }
+        else if (serviceName in this.serviceFactories) {
+            errorMessage = "Firebase service named \"" + serviceName + "\" has already been registered.";
+        }
+        if (typeof errorMessage !== 'undefined') {
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INTERNAL_ERROR, "INTERNAL ASSERT FAILED: " + errorMessage);
+        }
+        this.serviceFactories[serviceName] = createService;
+        if (appHook) {
+            this.appHooks_[serviceName] = appHook;
+        }
+        var serviceNamespace;
+        // The service namespace is an accessor function which takes a FirebaseApp instance
+        // or uses the default app if no FirebaseApp instance is provided
+        serviceNamespace = function (appArg) {
+            if (typeof appArg === 'undefined') {
+                appArg = _this.app();
+            }
+            // Forward service instance lookup to the FirebaseApp
+            return appArg[serviceName]();
+        };
+        // ... and a container for service-level properties.
+        if (serviceProperties !== undefined) {
+            deep_copy_1.deepExtend(serviceNamespace, serviceProperties);
+        }
+        // Monkey-patch the service namespace onto the Firebase namespace
+        this.firebase_[serviceName] = serviceNamespace;
+        return serviceNamespace;
+    };
+    /**
+     * Calls the app hooks corresponding to the provided event name for each service within the
+     * provided FirebaseApp instance.
+     *
+     * @param {FirebaseApp} app The FirebaseApp instance whose app hooks to call.
+     * @param {string} eventName The event name representing which app hooks to call.
+     */
+    FirebaseNamespaceInternals.prototype.callAppHooks_ = function (app, eventName) {
+        var _this = this;
+        Object.keys(this.serviceFactories).forEach(function (serviceName) {
+            if (_this.appHooks_[serviceName]) {
+                _this.appHooks_[serviceName](eventName, app);
+            }
+        });
+    };
+    /**
+     * Parse the file pointed to by the FIREBASE_CONFIG_VAR, if it exists.
+     * Or if the FIREBASE_CONFIG_ENV contains a valid JSON object, parse it directly.
+     * If the environment variable contains a string that starts with '{' it will be parsed as JSON,
+     * otherwise it will be assumed to be pointing to a file.
+     */
+    FirebaseNamespaceInternals.prototype.loadOptionsFromEnvVar = function () {
+        var config = process.env[exports.FIREBASE_CONFIG_VAR];
+        if (!validator.isNonEmptyString(config)) {
+            return {};
+        }
+        try {
+            var contents = config.startsWith('{') ? config : fs.readFileSync(config, 'utf8');
+            return JSON.parse(contents);
+        }
+        catch (error) {
+            // Throw a nicely formed error message if the file contents cannot be parsed
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_APP_OPTIONS, 'Failed to parse app options file: ' + error);
+        }
+    };
+    return FirebaseNamespaceInternals;
+}());
+exports.FirebaseNamespaceInternals = FirebaseNamespaceInternals;
+var firebaseCredential = {
+    cert: function (serviceAccountPathOrObject, httpAgent) {
+        var stringifiedServiceAccount = JSON.stringify(serviceAccountPathOrObject);
+        if (!(stringifiedServiceAccount in globalCertCreds)) {
+            globalCertCreds[stringifiedServiceAccount] = new credential_1.ServiceAccountCredential(serviceAccountPathOrObject, httpAgent);
+        }
+        return globalCertCreds[stringifiedServiceAccount];
+    },
+    refreshToken: function (refreshTokenPathOrObject, httpAgent) {
+        var stringifiedRefreshToken = JSON.stringify(refreshTokenPathOrObject);
+        if (!(stringifiedRefreshToken in globalRefreshTokenCreds)) {
+            globalRefreshTokenCreds[stringifiedRefreshToken] = new credential_1.RefreshTokenCredential(refreshTokenPathOrObject, httpAgent);
+        }
+        return globalRefreshTokenCreds[stringifiedRefreshToken];
+    },
+    applicationDefault: function (httpAgent) {
+        if (typeof globalAppDefaultCred === 'undefined') {
+            globalAppDefaultCred = credential_1.getApplicationDefault(httpAgent);
+        }
+        return globalAppDefaultCred;
+    },
+};
+/**
+ * Global Firebase context object.
+ */
+var FirebaseNamespace = /** @class */ (function () {
+    /* tslint:enable */
+    function FirebaseNamespace() {
+        // Hack to prevent Babel from modifying the object returned as the default admin namespace.
+        /* tslint:disable:variable-name */
+        this.__esModule = true;
+        /* tslint:enable:variable-name */
+        this.credential = firebaseCredential;
+        this.SDK_VERSION = '8.9.2';
+        /* tslint:disable */
+        // TODO(jwenger): Database is the only consumer of firebase.Promise. We should update it to use
+        // use the native Promise and then remove this.
+        this.Promise = Promise;
+        this.INTERNAL = new FirebaseNamespaceInternals(this);
+    }
+    Object.defineProperty(FirebaseNamespace.prototype, "auth", {
+        /**
+         * Gets the `Auth` service namespace. The returned namespace can be used to get the
+         * `Auth` service for the default app or an explicitly specified app.
+         */
+        get: function () {
+            var _this = this;
+            var fn = function (app) {
+                return _this.ensureApp(app).auth();
+            };
+            var auth = require('./auth/auth').Auth;
+            return Object.assign(fn, { Auth: auth });
+        },
+        enumerable: true,
+        configurable: true
+    });
+    Object.defineProperty(FirebaseNamespace.prototype, "database", {
+        /**
+         * Gets the `Database` service namespace. The returned namespace can be used to get the
+         * `Database` service for the default app or an explicitly specified app.
+         */
+        get: function () {
+            var _this = this;
+            var fn = function (app) {
+                return _this.ensureApp(app).database();
+            };
+            return Object.assign(fn, require('@firebase/database'));
+        },
+        enumerable: true,
+        configurable: true
+    });
+    Object.defineProperty(FirebaseNamespace.prototype, "messaging", {
+        /**
+         * Gets the `Messaging` service namespace. The returned namespace can be used to get the
+         * `Messaging` service for the default app or an explicitly specified app.
+         */
+        get: function () {
+            var _this = this;
+            var fn = function (app) {
+                return _this.ensureApp(app).messaging();
+            };
+            var messaging = require('./messaging/messaging').Messaging;
+            return Object.assign(fn, { Messaging: messaging });
+        },
+        enumerable: true,
+        configurable: true
+    });
+    Object.defineProperty(FirebaseNamespace.prototype, "storage", {
+        /**
+         * Gets the `Storage` service namespace. The returned namespace can be used to get the
+         * `Storage` service for the default app or an explicitly specified app.
+         */
+        get: function () {
+            var _this = this;
+            var fn = function (app) {
+                return _this.ensureApp(app).storage();
+            };
+            var storage = require('./storage/storage').Storage;
+            return Object.assign(fn, { Storage: storage });
+        },
+        enumerable: true,
+        configurable: true
+    });
+    Object.defineProperty(FirebaseNamespace.prototype, "firestore", {
+        /**
+         * Gets the `Firestore` service namespace. The returned namespace can be used to get the
+         * `Firestore` service for the default app or an explicitly specified app.
+         */
+        get: function () {
+            var _this = this;
+            var fn = function (app) {
+                return _this.ensureApp(app).firestore();
+            };
+            var firestore = require('@google-cloud/firestore');
+            fn = Object.assign(fn, firestore.Firestore);
+            // `v1beta1` and `v1` are lazy-loaded in the Firestore SDK. We use the same trick here
+            // to avoid triggering this lazy-loading upon initialization.
+            Object.defineProperty(fn, 'v1beta1', {
+                get: function () {
+                    return firestore.v1beta1;
+                },
+            });
+            Object.defineProperty(fn, 'v1', {
+                get: function () {
+                    return firestore.v1;
+                },
+            });
+            return fn;
+        },
+        enumerable: true,
+        configurable: true
+    });
+    Object.defineProperty(FirebaseNamespace.prototype, "instanceId", {
+        /**
+         * Gets the `InstanceId` service namespace. The returned namespace can be used to get the
+         * `Instance` service for the default app or an explicitly specified app.
+         */
+        get: function () {
+            var _this = this;
+            var fn = function (app) {
+                return _this.ensureApp(app).instanceId();
+            };
+            var instanceId = require('./instance-id/instance-id').InstanceId;
+            return Object.assign(fn, { InstanceId: instanceId });
+        },
+        enumerable: true,
+        configurable: true
+    });
+    Object.defineProperty(FirebaseNamespace.prototype, "projectManagement", {
+        /**
+         * Gets the `ProjectManagement` service namespace. The returned namespace can be used to get the
+         * `ProjectManagement` service for the default app or an explicitly specified app.
+         */
+        get: function () {
+            var _this = this;
+            var fn = function (app) {
+                return _this.ensureApp(app).projectManagement();
+            };
+            var projectManagement = require('./project-management/project-management').ProjectManagement;
+            return Object.assign(fn, { ProjectManagement: projectManagement });
+        },
+        enumerable: true,
+        configurable: true
+    });
+    Object.defineProperty(FirebaseNamespace.prototype, "securityRules", {
+        /**
+         * Gets the `SecurityRules` service namespace. The returned namespace can be used to get the
+         * `SecurityRules` service for the default app or an explicitly specified app.
+         */
+        get: function () {
+            var _this = this;
+            var fn = function (app) {
+                return _this.ensureApp(app).securityRules();
+            };
+            var securityRules = require('./security-rules/security-rules').SecurityRules;
+            return Object.assign(fn, { SecurityRules: securityRules });
+        },
+        enumerable: true,
+        configurable: true
+    });
+    /**
+     * Initializes the FirebaseApp instance.
+     *
+     * @param {FirebaseAppOptions} [options] Optional options for the FirebaseApp instance.
+     *   If none present will try to initialize from the FIREBASE_CONFIG environment variable.
+     *   If the environment variable contains a string that starts with '{' it will be parsed as JSON,
+     *   otherwise it will be assumed to be pointing to a file.
+     * @param {string} [appName] Optional name of the FirebaseApp instance.
+     *
+     * @return {FirebaseApp} A new FirebaseApp instance.
+     */
+    FirebaseNamespace.prototype.initializeApp = function (options, appName) {
+        return this.INTERNAL.initializeApp(options, appName);
+    };
+    /**
+     * Returns the FirebaseApp instance with the provided name (or the default FirebaseApp instance
+     * if no name is provided).
+     *
+     * @param {string} [appName] Optional name of the FirebaseApp instance to return.
+     * @return {FirebaseApp} The FirebaseApp instance which has the provided name.
+     */
+    FirebaseNamespace.prototype.app = function (appName) {
+        return this.INTERNAL.app(appName);
+    };
+    Object.defineProperty(FirebaseNamespace.prototype, "apps", {
+        /*
+         * Returns an array of all the non-deleted FirebaseApp instances.
+         *
+         * @return {Array<FirebaseApp>} An array of all the non-deleted FirebaseApp instances
+         */
+        get: function () {
+            return this.INTERNAL.apps;
+        },
+        enumerable: true,
+        configurable: true
+    });
+    FirebaseNamespace.prototype.ensureApp = function (app) {
+        if (typeof app === 'undefined') {
+            app = this.app();
+        }
+        return app;
+    };
+    return FirebaseNamespace;
+}());
+exports.FirebaseNamespace = FirebaseNamespace;

node_modules/firebase-admin/lib/firebase-service.js

@@ -0,0 +1,18 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2017 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

node_modules/firebase-admin/lib/firestore/firestore.js

@@ -0,0 +1,120 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2017 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var error_1 = require("../utils/error");
+var credential_1 = require("../auth/credential");
+var validator = require("../utils/validator");
+var utils = require("../utils/index");
+/**
+ * Internals of a Firestore instance.
+ */
+var FirestoreInternals = /** @class */ (function () {
+    function FirestoreInternals() {
+    }
+    /**
+     * Deletes the service and its associated resources.
+     *
+     * @return {Promise<()>} An empty Promise that will be fulfilled when the service is deleted.
+     */
+    FirestoreInternals.prototype.delete = function () {
+        // There are no resources to clean up.
+        return Promise.resolve();
+    };
+    return FirestoreInternals;
+}());
+var FirestoreService = /** @class */ (function () {
+    function FirestoreService(app) {
+        this.INTERNAL = new FirestoreInternals();
+        this.firestoreClient = initFirestore(app);
+        this.appInternal = app;
+    }
+    Object.defineProperty(FirestoreService.prototype, "app", {
+        /**
+         * Returns the app associated with this Storage instance.
+         *
+         * @return {FirebaseApp} The app associated with this Storage instance.
+         */
+        get: function () {
+            return this.appInternal;
+        },
+        enumerable: true,
+        configurable: true
+    });
+    Object.defineProperty(FirestoreService.prototype, "client", {
+        get: function () {
+            return this.firestoreClient;
+        },
+        enumerable: true,
+        configurable: true
+    });
+    return FirestoreService;
+}());
+exports.FirestoreService = FirestoreService;
+function getFirestoreOptions(app) {
+    if (!validator.isNonNullObject(app) || !('options' in app)) {
+        throw new error_1.FirebaseFirestoreError({
+            code: 'invalid-argument',
+            message: 'First argument passed to admin.firestore() must be a valid Firebase app instance.',
+        });
+    }
+    var projectId = utils.getExplicitProjectId(app);
+    var credential = app.options.credential;
+    var firebaseVersion = require('../../package.json').version;
+    if (credential instanceof credential_1.ServiceAccountCredential) {
+        return {
+            credentials: {
+                private_key: credential.privateKey,
+                client_email: credential.clientEmail,
+            },
+            // When the SDK is initialized with ServiceAccountCredentials an explicit projectId is
+            // guaranteed to be available.
+            projectId: projectId,
+            firebaseVersion: firebaseVersion,
+        };
+    }
+    else if (credential_1.isApplicationDefault(app.options.credential)) {
+        // Try to use the Google application default credentials.
+        // If an explicit project ID is not available, let Firestore client discover one from the
+        // environment. This prevents the users from having to set GOOGLE_CLOUD_PROJECT in GCP runtimes.
+        return validator.isNonEmptyString(projectId) ? { projectId: projectId, firebaseVersion: firebaseVersion } : { firebaseVersion: firebaseVersion };
+    }
+    throw new error_1.FirebaseFirestoreError({
+        code: 'invalid-credential',
+        message: 'Failed to initialize Google Cloud Firestore client with the available credentials. ' +
+            'Must initialize the SDK with a certificate credential or application default credentials ' +
+            'to use Cloud Firestore API.',
+    });
+}
+exports.getFirestoreOptions = getFirestoreOptions;
+function initFirestore(app) {
+    var options = getFirestoreOptions(app);
+    var firestoreDatabase;
+    try {
+        // Lazy-load the Firestore implementation here, which in turns loads gRPC.
+        firestoreDatabase = require('@google-cloud/firestore').Firestore;
+    }
+    catch (err) {
+        throw new error_1.FirebaseFirestoreError({
+            code: 'missing-dependencies',
+            message: 'Failed to import the Cloud Firestore client library for Node.js. '
+                + 'Make sure to install the "@google-cloud/firestore" npm package. '
+                + ("Original error: " + err),
+        });
+    }
+    return new firestoreDatabase(options);
+}

node_modules/firebase-admin/lib/index.js

@@ -0,0 +1,26 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2017 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+var firebase = require("./default-namespace");
+// Only Node.js has a process variable that is of [[Class]] process
+var processGlobal = typeof process !== 'undefined' ? process : 0;
+if (Object.prototype.toString.call(processGlobal) !== '[object process]') {
+    var message = "\n======== WARNING! ========\n\nfirebase-admin appears to have been installed in an unsupported environment.\nThis package should only be used in server-side or backend Node.js environments,\nand should not be used in web browsers or other client-side environments.\n\nUse the Firebase JS SDK for client-side Firebase integrations:\n\nhttps://firebase.google.com/docs/web/setup\n";
+    // tslint:disable-next-line:no-console
+    console.error(message);
+}
+module.exports = firebase;

node_modules/firebase-admin/lib/instance-id/instance-id-request.js

@@ -0,0 +1,115 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2017 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var error_1 = require("../utils/error");
+var api_request_1 = require("../utils/api-request");
+var utils = require("../utils/index");
+var validator = require("../utils/validator");
+/** Firebase IID backend host. */
+var FIREBASE_IID_HOST = 'console.firebase.google.com';
+/** Firebase IID backend path. */
+var FIREBASE_IID_PATH = '/v1/';
+/** Firebase IID request timeout duration in milliseconds. */
+var FIREBASE_IID_TIMEOUT = 10000;
+/** HTTP error codes raised by the backend server. */
+var ERROR_CODES = {
+    400: 'Malformed instance ID argument.',
+    401: 'Request not authorized.',
+    403: 'Project does not match instance ID or the client does not have sufficient privileges.',
+    404: 'Failed to find the instance ID.',
+    409: 'Already deleted.',
+    429: 'Request throttled out by the backend server.',
+    500: 'Internal server error.',
+    503: 'Backend servers are over capacity. Try again later.',
+};
+/**
+ * Class that provides mechanism to send requests to the Firebase Instance ID backend endpoints.
+ */
+var FirebaseInstanceIdRequestHandler = /** @class */ (function () {
+    /**
+     * @param {FirebaseApp} app The app used to fetch access tokens to sign API requests.
+     *
+     * @constructor
+     */
+    function FirebaseInstanceIdRequestHandler(app) {
+        this.app = app;
+        this.host = FIREBASE_IID_HOST;
+        this.timeout = FIREBASE_IID_TIMEOUT;
+        this.httpClient = new api_request_1.AuthorizedHttpClient(app);
+    }
+    FirebaseInstanceIdRequestHandler.prototype.deleteInstanceId = function (instanceId) {
+        if (!validator.isNonEmptyString(instanceId)) {
+            return Promise.reject(new error_1.FirebaseInstanceIdError(error_1.InstanceIdClientErrorCode.INVALID_INSTANCE_ID, 'Instance ID must be a non-empty string.'));
+        }
+        return this.invokeRequestHandler(new api_request_1.ApiSettings(instanceId, 'DELETE'));
+    };
+    /**
+     * Invokes the request handler based on the API settings object passed.
+     *
+     * @param {ApiSettings} apiSettings The API endpoint settings to apply to request and response.
+     * @return {Promise<void>} A promise that resolves when the request is complete.
+     */
+    FirebaseInstanceIdRequestHandler.prototype.invokeRequestHandler = function (apiSettings) {
+        var _this = this;
+        return this.getPathPrefix()
+            .then(function (path) {
+            var req = {
+                url: "https://" + _this.host + path + apiSettings.getEndpoint(),
+                method: apiSettings.getHttpMethod(),
+                timeout: _this.timeout,
+            };
+            return _this.httpClient.send(req);
+        })
+            .then(function (response) {
+            // return nothing on success
+        })
+            .catch(function (err) {
+            if (err instanceof api_request_1.HttpError) {
+                var response = err.response;
+                var errorMessage = (response.isJson() && 'error' in response.data) ?
+                    response.data.error : response.text;
+                var template = ERROR_CODES[response.status];
+                var message = template ?
+                    "Instance ID \"" + apiSettings.getEndpoint() + "\": " + template : errorMessage;
+                throw new error_1.FirebaseInstanceIdError(error_1.InstanceIdClientErrorCode.API_ERROR, message);
+            }
+            // In case of timeouts and other network errors, the HttpClient returns a
+            // FirebaseError wrapped in the response. Simply throw it here.
+            throw err;
+        });
+    };
+    FirebaseInstanceIdRequestHandler.prototype.getPathPrefix = function () {
+        var _this = this;
+        if (this.path) {
+            return Promise.resolve(this.path);
+        }
+        return utils.findProjectId(this.app)
+            .then(function (projectId) {
+            if (!validator.isNonEmptyString(projectId)) {
+                // Assert for an explicit projct ID (either via AppOptions or the cert itself).
+                throw new error_1.FirebaseInstanceIdError(error_1.InstanceIdClientErrorCode.INVALID_PROJECT_ID, 'Failed to determine project ID for InstanceId. Initialize the '
+                    + 'SDK with service account credentials or set project ID as an app option. '
+                    + 'Alternatively set the GOOGLE_CLOUD_PROJECT environment variable.');
+            }
+            _this.path = FIREBASE_IID_PATH + ("project/" + projectId + "/instanceId/");
+            return _this.path;
+        });
+    };
+    return FirebaseInstanceIdRequestHandler;
+}());
+exports.FirebaseInstanceIdRequestHandler = FirebaseInstanceIdRequestHandler;

node_modules/firebase-admin/lib/instance-id/instance-id.js

@@ -0,0 +1,80 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2017 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var error_1 = require("../utils/error");
+var instance_id_request_1 = require("./instance-id-request");
+var validator = require("../utils/validator");
+/**
+ * Internals of an InstanceId service instance.
+ */
+var InstanceIdInternals = /** @class */ (function () {
+    function InstanceIdInternals() {
+    }
+    /**
+     * Deletes the service and its associated resources.
+     *
+     * @return {Promise<()>} An empty Promise that will be fulfilled when the service is deleted.
+     */
+    InstanceIdInternals.prototype.delete = function () {
+        // There are no resources to clean up
+        return Promise.resolve(undefined);
+    };
+    return InstanceIdInternals;
+}());
+var InstanceId = /** @class */ (function () {
+    /**
+     * @param {FirebaseApp} app The app for this InstanceId service.
+     * @constructor
+     */
+    function InstanceId(app) {
+        this.INTERNAL = new InstanceIdInternals();
+        if (!validator.isNonNullObject(app) || !('options' in app)) {
+            throw new error_1.FirebaseInstanceIdError(error_1.InstanceIdClientErrorCode.INVALID_ARGUMENT, 'First argument passed to admin.instanceId() must be a valid Firebase app instance.');
+        }
+        this.app_ = app;
+        this.requestHandler = new instance_id_request_1.FirebaseInstanceIdRequestHandler(app);
+    }
+    /**
+     * Deletes the specified instance ID from Firebase. This can be used to delete an instance ID
+     * and associated user data from a Firebase project, pursuant to the General Data Protection
+     * Regulation (GDPR).
+     *
+     * @param {string} instanceId The instance ID to be deleted
+     * @return {Promise<void>} A promise that resolves when the instance ID is successfully deleted.
+     */
+    InstanceId.prototype.deleteInstanceId = function (instanceId) {
+        return this.requestHandler.deleteInstanceId(instanceId)
+            .then(function (result) {
+            // Return nothing on success
+        });
+    };
+    Object.defineProperty(InstanceId.prototype, "app", {
+        /**
+         * Returns the app associated with this InstanceId instance.
+         *
+         * @return {FirebaseApp} The app associated with this InstanceId instance.
+         */
+        get: function () {
+            return this.app_;
+        },
+        enumerable: true,
+        configurable: true
+    });
+    return InstanceId;
+}());
+exports.InstanceId = InstanceId;

node_modules/firebase-admin/lib/messaging/batch-request.js

@@ -0,0 +1,128 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2019 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var api_request_1 = require("../utils/api-request");
+var error_1 = require("../utils/error");
+var PART_BOUNDARY = '__END_OF_PART__';
+var TEN_SECONDS_IN_MILLIS = 10000;
+/**
+ * An HTTP client that can be used to make batch requests. This client is not tied to any service
+ * (FCM or otherwise). Therefore it can be used to make batch requests to any service that allows
+ * it. If this requirement ever arises we can move this implementation to the utils module
+ * where it can be easily shared among other modules.
+ */
+var BatchRequestClient = /** @class */ (function () {
+    /**
+     * @param {HttpClient} httpClient The client that will be used to make HTTP calls.
+     * @param {string} batchUrl The URL that accepts batch requests.
+     * @param {object=} commonHeaders Optional headers that will be included in all requests.
+     *
+     * @constructor
+     */
+    function BatchRequestClient(httpClient, batchUrl, commonHeaders) {
+        this.httpClient = httpClient;
+        this.batchUrl = batchUrl;
+        this.commonHeaders = commonHeaders;
+    }
+    /**
+     * Sends the given array of sub requests as a single batch, and parses the results into an array
+     * of HttpResponse objects.
+     *
+     * @param {SubRequest[]} requests An array of sub requests to send.
+     * @return {Promise<HttpResponse[]>} A promise that resolves when the send operation is complete.
+     */
+    BatchRequestClient.prototype.send = function (requests) {
+        var _this = this;
+        requests = requests.map(function (req) {
+            req.headers = Object.assign({}, _this.commonHeaders, req.headers);
+            return req;
+        });
+        var requestHeaders = {
+            'Content-Type': "multipart/mixed; boundary=" + PART_BOUNDARY,
+        };
+        var request = {
+            method: 'POST',
+            url: this.batchUrl,
+            data: this.getMultipartPayload(requests),
+            headers: Object.assign({}, this.commonHeaders, requestHeaders),
+            timeout: TEN_SECONDS_IN_MILLIS,
+        };
+        return this.httpClient.send(request).then(function (response) {
+            if (!response.multipart) {
+                throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INTERNAL_ERROR, 'Expected a multipart response.');
+            }
+            return response.multipart.map(function (buff) {
+                return api_request_1.parseHttpResponse(buff, request);
+            });
+        });
+    };
+    BatchRequestClient.prototype.getMultipartPayload = function (requests) {
+        var buffer = '';
+        requests.forEach(function (request, idx) {
+            buffer += createPart(request, PART_BOUNDARY, idx);
+        });
+        buffer += "--" + PART_BOUNDARY + "--\r\n";
+        return Buffer.from(buffer, 'utf-8');
+    };
+    return BatchRequestClient;
+}());
+exports.BatchRequestClient = BatchRequestClient;
+/**
+ * Creates a single part in a multipart HTTP request body. The part consists of several headers
+ * followed by the serialized sub request as the body. As per the requirements of the FCM batch
+ * API, sets the content-type header to application/http, and the content-transfer-encoding to
+ * binary.
+ *
+ * @param {SubRequest} request A sub request that will be used to populate the part.
+ * @param {string} boundary Multipart boundary string.
+ * @param {number} idx An index number that is used to set the content-id header.
+ * @return {string} The part as a string that can be included in the HTTP body.
+ */
+function createPart(request, boundary, idx) {
+    var serializedRequest = serializeSubRequest(request);
+    var part = "--" + boundary + "\r\n";
+    part += "Content-Length: " + serializedRequest.length + "\r\n";
+    part += 'Content-Type: application/http\r\n';
+    part += "content-id: " + (idx + 1) + "\r\n";
+    part += 'content-transfer-encoding: binary\r\n';
+    part += '\r\n';
+    part += serializedRequest + "\r\n";
+    return part;
+}
+/**
+ * Serializes a sub request into a string that can be embedded in a multipart HTTP request. The
+ * format of the string is the wire format of a typical HTTP request, consisting of a header and a
+ * body.
+ *
+ * @param request {SubRequest} The sub request to be serialized.
+ * @return {string} String representation of the SubRequest.
+ */
+function serializeSubRequest(request) {
+    var requestBody = JSON.stringify(request.body);
+    var messagePayload = "POST " + request.url + " HTTP/1.1\r\n";
+    messagePayload += "Content-Length: " + requestBody.length + "\r\n";
+    messagePayload += 'Content-Type: application/json; charset=UTF-8\r\n';
+    if (request.headers) {
+        Object.keys(request.headers).forEach(function (key) {
+            messagePayload += key + ": " + request.headers[key] + "\r\n";
+        });
+    }
+    messagePayload += '\r\n';
+    messagePayload += requestBody;
+    return messagePayload;
+}

node_modules/firebase-admin/lib/messaging/messaging-api-request.js

@@ -0,0 +1,125 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2017 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var api_request_1 = require("../utils/api-request");
+var messaging_errors_1 = require("./messaging-errors");
+var batch_request_1 = require("./batch-request");
+// FCM backend constants
+var FIREBASE_MESSAGING_TIMEOUT = 10000;
+var FIREBASE_MESSAGING_BATCH_URL = 'https://fcm.googleapis.com/batch';
+var FIREBASE_MESSAGING_HTTP_METHOD = 'POST';
+var FIREBASE_MESSAGING_HEADERS = {
+    'X-Firebase-Client': 'fire-admin-node/8.9.2',
+};
+var LEGACY_FIREBASE_MESSAGING_HEADERS = {
+    'X-Firebase-Client': 'fire-admin-node/8.9.2',
+    'access_token_auth': 'true',
+};
+/**
+ * Class that provides a mechanism to send requests to the Firebase Cloud Messaging backend.
+ */
+var FirebaseMessagingRequestHandler = /** @class */ (function () {
+    /**
+     * @param {FirebaseApp} app The app used to fetch access tokens to sign API requests.
+     * @constructor
+     */
+    function FirebaseMessagingRequestHandler(app) {
+        this.httpClient = new api_request_1.AuthorizedHttpClient(app);
+        this.batchClient = new batch_request_1.BatchRequestClient(this.httpClient, FIREBASE_MESSAGING_BATCH_URL, FIREBASE_MESSAGING_HEADERS);
+    }
+    /**
+     * Invokes the request handler with the provided request data.
+     *
+     * @param {string} host The host to which to send the request.
+     * @param {string} path The path to which to send the request.
+     * @param {object} requestData The request data.
+     * @return {Promise<object>} A promise that resolves with the response.
+     */
+    FirebaseMessagingRequestHandler.prototype.invokeRequestHandler = function (host, path, requestData) {
+        var request = {
+            method: FIREBASE_MESSAGING_HTTP_METHOD,
+            url: "https://" + host + path,
+            data: requestData,
+            headers: LEGACY_FIREBASE_MESSAGING_HEADERS,
+            timeout: FIREBASE_MESSAGING_TIMEOUT,
+        };
+        return this.httpClient.send(request).then(function (response) {
+            // Send non-JSON responses to the catch() below where they will be treated as errors.
+            if (!response.isJson()) {
+                throw new api_request_1.HttpError(response);
+            }
+            // Check for backend errors in the response.
+            var errorCode = messaging_errors_1.getErrorCode(response.data);
+            if (errorCode) {
+                throw new api_request_1.HttpError(response);
+            }
+            // Return entire response.
+            return response.data;
+        })
+            .catch(function (err) {
+            if (err instanceof api_request_1.HttpError) {
+                throw messaging_errors_1.createFirebaseError(err);
+            }
+            // Re-throw the error if it already has the proper format.
+            throw err;
+        });
+    };
+    /**
+     * Sends the given array of sub requests as a single batch to FCM, and parses the result into
+     * a BatchResponse object.
+     *
+     * @param {SubRequest[]} requests An array of sub requests to send.
+     * @return {Promise<BatchResponse>} A promise that resolves when the send operation is complete.
+     */
+    FirebaseMessagingRequestHandler.prototype.sendBatchRequest = function (requests) {
+        var _this = this;
+        return this.batchClient.send(requests)
+            .then(function (responses) {
+            return responses.map(function (part) {
+                return _this.buildSendResponse(part);
+            });
+        }).then(function (responses) {
+            var successCount = responses.filter(function (resp) { return resp.success; }).length;
+            return {
+                responses: responses,
+                successCount: successCount,
+                failureCount: responses.length - successCount,
+            };
+        }).catch(function (err) {
+            if (err instanceof api_request_1.HttpError) {
+                throw messaging_errors_1.createFirebaseError(err);
+            }
+            // Re-throw the error if it already has the proper format.
+            throw err;
+        });
+    };
+    FirebaseMessagingRequestHandler.prototype.buildSendResponse = function (response) {
+        var result = {
+            success: response.status === 200,
+        };
+        if (result.success) {
+            result.messageId = response.data.name;
+        }
+        else {
+            result.error = messaging_errors_1.createFirebaseError(new api_request_1.HttpError(response));
+        }
+        return result;
+    };
+    return FirebaseMessagingRequestHandler;
+}());
+exports.FirebaseMessagingRequestHandler = FirebaseMessagingRequestHandler;

node_modules/firebase-admin/lib/messaging/messaging-errors.js

@@ -0,0 +1,105 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2019 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var error_1 = require("../utils/error");
+var validator = require("../utils/validator");
+/**
+ * Creates a new FirebaseMessagingError by extracting the error code, message and other relevant
+ * details from an HTTP error response.
+ *
+ * @param {HttpError} err The HttpError to convert into a Firebase error
+ * @return {FirebaseMessagingError} A Firebase error that can be returned to the user.
+ */
+function createFirebaseError(err) {
+    if (err.response.isJson()) {
+        // For JSON responses, map the server response to a client-side error.
+        var json = err.response.data;
+        var errorCode = getErrorCode(json);
+        var errorMessage = getErrorMessage(json);
+        return error_1.FirebaseMessagingError.fromServerError(errorCode, errorMessage, json);
+    }
+    // Non-JSON response
+    var error;
+    switch (err.response.status) {
+        case 400:
+            error = error_1.MessagingClientErrorCode.INVALID_ARGUMENT;
+            break;
+        case 401:
+        case 403:
+            error = error_1.MessagingClientErrorCode.AUTHENTICATION_ERROR;
+            break;
+        case 500:
+            error = error_1.MessagingClientErrorCode.INTERNAL_ERROR;
+            break;
+        case 503:
+            error = error_1.MessagingClientErrorCode.SERVER_UNAVAILABLE;
+            break;
+        default:
+            // Treat non-JSON responses with unexpected status codes as unknown errors.
+            error = error_1.MessagingClientErrorCode.UNKNOWN_ERROR;
+    }
+    return new error_1.FirebaseMessagingError({
+        code: error.code,
+        message: error.message + " Raw server response: \"" + err.response.text + "\". Status code: " +
+            (err.response.status + "."),
+    });
+}
+exports.createFirebaseError = createFirebaseError;
+/**
+ * @param {object} response The response to check for errors.
+ * @return {string|null} The error code if present; null otherwise.
+ */
+function getErrorCode(response) {
+    if (validator.isNonNullObject(response) && 'error' in response) {
+        var error = response.error;
+        if (validator.isString(error)) {
+            return error;
+        }
+        if (validator.isArray(error.details)) {
+            var fcmErrorType = 'type.googleapis.com/google.firebase.fcm.v1.FcmError';
+            for (var _i = 0, _a = error.details; _i < _a.length; _i++) {
+                var element = _a[_i];
+                if (element['@type'] === fcmErrorType) {
+                    return element.errorCode;
+                }
+            }
+        }
+        if ('status' in error) {
+            return error.status;
+        }
+        else {
+            return error.message;
+        }
+    }
+    return null;
+}
+exports.getErrorCode = getErrorCode;
+/**
+ * Extracts error message from the given response object.
+ *
+ * @param {object} response The response to check for errors.
+ * @return {string|null} The error message if present; null otherwise.
+ */
+function getErrorMessage(response) {
+    if (validator.isNonNullObject(response) &&
+        'error' in response &&
+        validator.isNonEmptyString(response.error.message)) {
+        return response.error.message;
+    }
+    return null;
+}

node_modules/firebase-admin/lib/messaging/messaging-types.js

@@ -0,0 +1,502 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2019 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var index_1 = require("../utils/index");
+var error_1 = require("../utils/error");
+var validator = require("../utils/validator");
+/**
+ * Checks if the given Message object is valid. Recursively validates all the child objects
+ * included in the message (android, apns, data etc.). If successful, transforms the message
+ * in place by renaming the keys to what's expected by the remote FCM service.
+ *
+ * @param {Message} Message An object to be validated.
+ */
+function validateMessage(message) {
+    if (!validator.isNonNullObject(message)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'Message must be a non-null object');
+    }
+    var anyMessage = message;
+    if (anyMessage.topic) {
+        // If the topic name is prefixed, remove it.
+        if (anyMessage.topic.startsWith('/topics/')) {
+            anyMessage.topic = anyMessage.topic.replace(/^\/topics\//, '');
+        }
+        // Checks for illegal characters and empty string.
+        if (!/^[a-zA-Z0-9-_.~%]+$/.test(anyMessage.topic)) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'Malformed topic name');
+        }
+    }
+    var targets = [anyMessage.token, anyMessage.topic, anyMessage.condition];
+    if (targets.filter(function (v) { return validator.isNonEmptyString(v); }).length !== 1) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'Exactly one of topic, token or condition is required');
+    }
+    validateStringMap(message.data, 'data');
+    validateAndroidConfig(message.android);
+    validateWebpushConfig(message.webpush);
+    validateApnsConfig(message.apns);
+    validateFcmOptions(message.fcmOptions);
+    validateNotification(message.notification);
+}
+exports.validateMessage = validateMessage;
+/**
+ * Checks if the given object only contains strings as child values.
+ *
+ * @param {object} map An object to be validated.
+ * @param {string} label A label to be included in the errors thrown.
+ */
+function validateStringMap(map, label) {
+    if (typeof map === 'undefined') {
+        return;
+    }
+    else if (!validator.isNonNullObject(map)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, label + " must be a non-null object");
+    }
+    Object.keys(map).forEach(function (key) {
+        if (!validator.isString(map[key])) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, label + " must only contain string values");
+        }
+    });
+}
+/**
+ * Checks if the given WebpushConfig object is valid. The object must have valid headers and data.
+ *
+ * @param {WebpushConfig} config An object to be validated.
+ */
+function validateWebpushConfig(config) {
+    if (typeof config === 'undefined') {
+        return;
+    }
+    else if (!validator.isNonNullObject(config)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'webpush must be a non-null object');
+    }
+    validateStringMap(config.headers, 'webpush.headers');
+    validateStringMap(config.data, 'webpush.data');
+}
+/**
+ * Checks if the given ApnsConfig object is valid. The object must have valid headers and a
+ * payload.
+ *
+ * @param {ApnsConfig} config An object to be validated.
+ */
+function validateApnsConfig(config) {
+    if (typeof config === 'undefined') {
+        return;
+    }
+    else if (!validator.isNonNullObject(config)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'apns must be a non-null object');
+    }
+    validateStringMap(config.headers, 'apns.headers');
+    validateApnsPayload(config.payload);
+    validateApnsFcmOptions(config.fcmOptions);
+}
+/**
+ * Checks if the given ApnsFcmOptions object is valid.
+ *
+ * @param {ApnsFcmOptions} fcmOptions An object to be validated.
+ */
+function validateApnsFcmOptions(fcmOptions) {
+    if (typeof fcmOptions === 'undefined') {
+        return;
+    }
+    else if (!validator.isNonNullObject(fcmOptions)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'fcmOptions must be a non-null object');
+    }
+    if (typeof fcmOptions.imageUrl !== 'undefined' &&
+        !validator.isURL(fcmOptions.imageUrl)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'imageUrl must be a valid URL string');
+    }
+    if (typeof fcmOptions.analyticsLabel !== 'undefined' && !validator.isString(fcmOptions.analyticsLabel)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'analyticsLabel must be a string value');
+    }
+    var propertyMappings = {
+        imageUrl: 'image',
+    };
+    Object.keys(propertyMappings).forEach(function (key) {
+        if (key in fcmOptions && propertyMappings[key] in fcmOptions) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, "Multiple specifications for " + key + " in ApnsFcmOptions");
+        }
+    });
+    index_1.renameProperties(fcmOptions, propertyMappings);
+}
+/**
+ * Checks if the given FcmOptions object is valid.
+ *
+ * @param {FcmOptions} fcmOptions An object to be validated.
+ */
+function validateFcmOptions(fcmOptions) {
+    if (typeof fcmOptions === 'undefined') {
+        return;
+    }
+    else if (!validator.isNonNullObject(fcmOptions)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'fcmOptions must be a non-null object');
+    }
+    if (typeof fcmOptions.analyticsLabel !== 'undefined' && !validator.isString(fcmOptions.analyticsLabel)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'analyticsLabel must be a string value');
+    }
+}
+/**
+ * Checks if the given Notification object is valid.
+ *
+ * @param {Notification} notification An object to be validated.
+ */
+function validateNotification(notification) {
+    if (typeof notification === 'undefined') {
+        return;
+    }
+    else if (!validator.isNonNullObject(notification)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'notification must be a non-null object');
+    }
+    if (typeof notification.imageUrl !== 'undefined' && !validator.isURL(notification.imageUrl)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'notification.imageUrl must be a valid URL string');
+    }
+    var propertyMappings = {
+        imageUrl: 'image',
+    };
+    Object.keys(propertyMappings).forEach(function (key) {
+        if (key in notification && propertyMappings[key] in notification) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, "Multiple specifications for " + key + " in Notification");
+        }
+    });
+    index_1.renameProperties(notification, propertyMappings);
+}
+/**
+ * Checks if the given ApnsPayload object is valid. The object must have a valid aps value.
+ *
+ * @param {ApnsPayload} payload An object to be validated.
+ */
+function validateApnsPayload(payload) {
+    if (typeof payload === 'undefined') {
+        return;
+    }
+    else if (!validator.isNonNullObject(payload)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'apns.payload must be a non-null object');
+    }
+    validateAps(payload.aps);
+}
+/**
+ * Checks if the given Aps object is valid. The object must have a valid alert. If the validation
+ * is successful, transforms the input object by renaming the keys to valid APNS payload keys.
+ *
+ * @param {Aps} aps An object to be validated.
+ */
+function validateAps(aps) {
+    if (typeof aps === 'undefined') {
+        return;
+    }
+    else if (!validator.isNonNullObject(aps)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'apns.payload.aps must be a non-null object');
+    }
+    validateApsAlert(aps.alert);
+    validateApsSound(aps.sound);
+    var propertyMappings = {
+        contentAvailable: 'content-available',
+        mutableContent: 'mutable-content',
+        threadId: 'thread-id',
+    };
+    Object.keys(propertyMappings).forEach(function (key) {
+        if (key in aps && propertyMappings[key] in aps) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, "Multiple specifications for " + key + " in Aps");
+        }
+    });
+    index_1.renameProperties(aps, propertyMappings);
+    var contentAvailable = aps['content-available'];
+    if (typeof contentAvailable !== 'undefined' && contentAvailable !== 1) {
+        if (contentAvailable === true) {
+            aps['content-available'] = 1;
+        }
+        else {
+            delete aps['content-available'];
+        }
+    }
+    var mutableContent = aps['mutable-content'];
+    if (typeof mutableContent !== 'undefined' && mutableContent !== 1) {
+        if (mutableContent === true) {
+            aps['mutable-content'] = 1;
+        }
+        else {
+            delete aps['mutable-content'];
+        }
+    }
+}
+function validateApsSound(sound) {
+    if (typeof sound === 'undefined' || validator.isNonEmptyString(sound)) {
+        return;
+    }
+    else if (!validator.isNonNullObject(sound)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'apns.payload.aps.sound must be a non-empty string or a non-null object');
+    }
+    if (!validator.isNonEmptyString(sound.name)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'apns.payload.aps.sound.name must be a non-empty string');
+    }
+    var volume = sound.volume;
+    if (typeof volume !== 'undefined') {
+        if (!validator.isNumber(volume)) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'apns.payload.aps.sound.volume must be a number');
+        }
+        if (volume < 0 || volume > 1) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'apns.payload.aps.sound.volume must be in the interval [0, 1]');
+        }
+    }
+    var soundObject = sound;
+    var key = 'critical';
+    var critical = soundObject[key];
+    if (typeof critical !== 'undefined' && critical !== 1) {
+        if (critical === true) {
+            soundObject[key] = 1;
+        }
+        else {
+            delete soundObject[key];
+        }
+    }
+}
+/**
+ * Checks if the given alert object is valid. Alert could be a string or a complex object.
+ * If specified as an object, it must have valid localization parameters. If successful, transforms
+ * the input object by renaming the keys to valid APNS payload keys.
+ *
+ * @param {string | ApsAlert} alert An alert string or an object to be validated.
+ */
+function validateApsAlert(alert) {
+    if (typeof alert === 'undefined' || validator.isString(alert)) {
+        return;
+    }
+    else if (!validator.isNonNullObject(alert)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'apns.payload.aps.alert must be a string or a non-null object');
+    }
+    var apsAlert = alert;
+    if (validator.isNonEmptyArray(apsAlert.locArgs) &&
+        !validator.isNonEmptyString(apsAlert.locKey)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'apns.payload.aps.alert.locKey is required when specifying locArgs');
+    }
+    if (validator.isNonEmptyArray(apsAlert.titleLocArgs) &&
+        !validator.isNonEmptyString(apsAlert.titleLocKey)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'apns.payload.aps.alert.titleLocKey is required when specifying titleLocArgs');
+    }
+    if (validator.isNonEmptyArray(apsAlert.subtitleLocArgs) &&
+        !validator.isNonEmptyString(apsAlert.subtitleLocKey)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'apns.payload.aps.alert.subtitleLocKey is required when specifying subtitleLocArgs');
+    }
+    var propertyMappings = {
+        locKey: 'loc-key',
+        locArgs: 'loc-args',
+        titleLocKey: 'title-loc-key',
+        titleLocArgs: 'title-loc-args',
+        subtitleLocKey: 'subtitle-loc-key',
+        subtitleLocArgs: 'subtitle-loc-args',
+        actionLocKey: 'action-loc-key',
+        launchImage: 'launch-image',
+    };
+    index_1.renameProperties(apsAlert, propertyMappings);
+}
+/**
+ * Checks if the given AndroidConfig object is valid. The object must have valid ttl, data,
+ * and notification fields. If successful, transforms the input object by renaming keys to valid
+ * Android keys. Also transforms the ttl value to the format expected by FCM service.
+ *
+ * @param {AndroidConfig} config An object to be validated.
+ */
+function validateAndroidConfig(config) {
+    if (typeof config === 'undefined') {
+        return;
+    }
+    else if (!validator.isNonNullObject(config)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'android must be a non-null object');
+    }
+    if (typeof config.ttl !== 'undefined') {
+        if (!validator.isNumber(config.ttl) || config.ttl < 0) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'TTL must be a non-negative duration in milliseconds');
+        }
+        var duration = transformMillisecondsToSecondsString(config.ttl);
+        config.ttl = duration;
+    }
+    validateStringMap(config.data, 'android.data');
+    validateAndroidNotification(config.notification);
+    validateAndroidFcmOptions(config.fcmOptions);
+    var propertyMappings = {
+        collapseKey: 'collapse_key',
+        restrictedPackageName: 'restricted_package_name',
+    };
+    index_1.renameProperties(config, propertyMappings);
+}
+/**
+ * Checks if the given AndroidNotification object is valid. The object must have valid color and
+ * localization parameters. If successful, transforms the input object by renaming keys to valid
+ * Android keys.
+ *
+ * @param {AndroidNotification} notification An object to be validated.
+ */
+function validateAndroidNotification(notification) {
+    if (typeof notification === 'undefined') {
+        return;
+    }
+    else if (!validator.isNonNullObject(notification)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'android.notification must be a non-null object');
+    }
+    if (typeof notification.color !== 'undefined' && !/^#[0-9a-fA-F]{6}$/.test(notification.color)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'android.notification.color must be in the form #RRGGBB');
+    }
+    if (validator.isNonEmptyArray(notification.bodyLocArgs) &&
+        !validator.isNonEmptyString(notification.bodyLocKey)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'android.notification.bodyLocKey is required when specifying bodyLocArgs');
+    }
+    if (validator.isNonEmptyArray(notification.titleLocArgs) &&
+        !validator.isNonEmptyString(notification.titleLocKey)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'android.notification.titleLocKey is required when specifying titleLocArgs');
+    }
+    if (typeof notification.imageUrl !== 'undefined' &&
+        !validator.isURL(notification.imageUrl)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'android.notification.imageUrl must be a valid URL string');
+    }
+    if (typeof notification.eventTimestamp !== 'undefined') {
+        if (!(notification.eventTimestamp instanceof Date)) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'android.notification.eventTimestamp must be a valid `Date` object');
+        }
+        // Convert timestamp to RFC3339 UTC "Zulu" format, example "2014-10-02T15:01:23.045123456Z"
+        var zuluTimestamp = notification.eventTimestamp.toISOString();
+        notification.eventTimestamp = zuluTimestamp;
+    }
+    if (typeof notification.vibrateTimingsMillis !== 'undefined') {
+        if (!validator.isNonEmptyArray(notification.vibrateTimingsMillis)) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'android.notification.vibrateTimingsMillis must be a non-empty array of numbers');
+        }
+        var vibrateTimings_1 = [];
+        notification.vibrateTimingsMillis.forEach(function (value) {
+            if (!validator.isNumber(value) || value < 0) {
+                throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'android.notification.vibrateTimingsMillis must be non-negative durations in milliseconds');
+            }
+            var duration = transformMillisecondsToSecondsString(value);
+            vibrateTimings_1.push(duration);
+        });
+        notification.vibrateTimingsMillis = vibrateTimings_1;
+    }
+    if (typeof notification.priority !== 'undefined') {
+        var priority = 'PRIORITY_' + notification.priority.toUpperCase();
+        notification.priority = priority;
+    }
+    if (typeof notification.visibility !== 'undefined') {
+        var visibility = notification.visibility.toUpperCase();
+        notification.visibility = visibility;
+    }
+    validateLightSettings(notification.lightSettings);
+    var propertyMappings = {
+        clickAction: 'click_action',
+        bodyLocKey: 'body_loc_key',
+        bodyLocArgs: 'body_loc_args',
+        titleLocKey: 'title_loc_key',
+        titleLocArgs: 'title_loc_args',
+        channelId: 'channel_id',
+        imageUrl: 'image',
+        eventTimestamp: 'event_time',
+        localOnly: 'local_only',
+        priority: 'notification_priority',
+        vibrateTimingsMillis: 'vibrate_timings',
+        defaultVibrateTimings: 'default_vibrate_timings',
+        defaultSound: 'default_sound',
+        lightSettings: 'light_settings',
+        defaultLightSettings: 'default_light_settings',
+        notificationCount: 'notification_count',
+    };
+    index_1.renameProperties(notification, propertyMappings);
+}
+/**
+ * Checks if the given LightSettings object is valid. The object must have valid color and
+ * light on/off duration parameters. If successful, transforms the input object by renaming
+ * keys to valid Android keys.
+ *
+ * @param {LightSettings} lightSettings An object to be validated.
+ */
+function validateLightSettings(lightSettings) {
+    if (typeof lightSettings === 'undefined') {
+        return;
+    }
+    else if (!validator.isNonNullObject(lightSettings)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'android.notification.lightSettings must be a non-null object');
+    }
+    if (!validator.isNumber(lightSettings.lightOnDurationMillis) || lightSettings.lightOnDurationMillis < 0) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'android.notification.lightSettings.lightOnDurationMillis must be a non-negative duration in milliseconds');
+    }
+    var durationOn = transformMillisecondsToSecondsString(lightSettings.lightOnDurationMillis);
+    lightSettings.lightOnDurationMillis = durationOn;
+    if (!validator.isNumber(lightSettings.lightOffDurationMillis) || lightSettings.lightOffDurationMillis < 0) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'android.notification.lightSettings.lightOffDurationMillis must be a non-negative duration in milliseconds');
+    }
+    var durationOff = transformMillisecondsToSecondsString(lightSettings.lightOffDurationMillis);
+    lightSettings.lightOffDurationMillis = durationOff;
+    if (!validator.isString(lightSettings.color) ||
+        (!/^#[0-9a-fA-F]{6}$/.test(lightSettings.color) && !/^#[0-9a-fA-F]{8}$/.test(lightSettings.color))) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'android.notification.lightSettings.color must be in the form #RRGGBB or #RRGGBBAA format');
+    }
+    var colorString = lightSettings.color.length === 7 ? lightSettings.color + 'FF' : lightSettings.color;
+    var rgb = /^#?([0-9a-fA-F]{2})([0-9a-fA-F]{2})([0-9a-fA-F]{2})([0-9a-fA-F]{2})$/i.exec(colorString);
+    if (!rgb || rgb.length < 4) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INTERNAL_ERROR, 'regex to extract rgba values from ' + colorString + ' failed.');
+    }
+    var color = {
+        red: parseInt(rgb[1], 16) / 255.0,
+        green: parseInt(rgb[2], 16) / 255.0,
+        blue: parseInt(rgb[3], 16) / 255.0,
+        alpha: parseInt(rgb[4], 16) / 255.0,
+    };
+    lightSettings.color = color;
+    var propertyMappings = {
+        lightOnDurationMillis: 'light_on_duration',
+        lightOffDurationMillis: 'light_off_duration',
+    };
+    index_1.renameProperties(lightSettings, propertyMappings);
+}
+/**
+ * Checks if the given AndroidFcmOptions object is valid.
+ *
+ * @param {AndroidFcmOptions} fcmOptions An object to be validated.
+ */
+function validateAndroidFcmOptions(fcmOptions) {
+    if (typeof fcmOptions === 'undefined') {
+        return;
+    }
+    else if (!validator.isNonNullObject(fcmOptions)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'fcmOptions must be a non-null object');
+    }
+    if (typeof fcmOptions.analyticsLabel !== 'undefined' && !validator.isString(fcmOptions.analyticsLabel)) {
+        throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'analyticsLabel must be a string value');
+    }
+}
+/**
+ * Transforms milliseconds to the format expected by FCM service.
+ * Returns the duration in seconds with up to nine fractional
+ * digits, terminated by 's'. Example: "3.5s".
+ *
+ * @param {number} milliseconds The duration in milliseconds.
+ * @return {string} The resulting formatted string in seconds with up to nine fractional
+ * digits, terminated by 's'.
+ */
+function transformMillisecondsToSecondsString(milliseconds) {
+    var duration;
+    var seconds = Math.floor(milliseconds / 1000);
+    var nanos = (milliseconds - seconds * 1000) * 1000000;
+    if (nanos > 0) {
+        var nanoString = nanos.toString();
+        while (nanoString.length < 9) {
+            nanoString = '0' + nanoString;
+        }
+        duration = seconds + "." + nanoString + "s";
+    }
+    else {
+        duration = seconds + "s";
+    }
+    return duration;
+}

node_modules/firebase-admin/lib/messaging/messaging.js

@@ -0,0 +1,800 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2017 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var deep_copy_1 = require("../utils/deep-copy");
+var messaging_types_1 = require("./messaging-types");
+var messaging_api_request_1 = require("./messaging-api-request");
+var error_1 = require("../utils/error");
+var utils = require("../utils");
+var validator = require("../utils/validator");
+// FCM endpoints
+var FCM_SEND_HOST = 'fcm.googleapis.com';
+var FCM_SEND_PATH = '/fcm/send';
+var FCM_TOPIC_MANAGEMENT_HOST = 'iid.googleapis.com';
+var FCM_TOPIC_MANAGEMENT_ADD_PATH = '/iid/v1:batchAdd';
+var FCM_TOPIC_MANAGEMENT_REMOVE_PATH = '/iid/v1:batchRemove';
+// Maximum messages that can be included in a batch request.
+var FCM_MAX_BATCH_SIZE = 500;
+// Key renames for the messaging notification payload object.
+var CAMELCASED_NOTIFICATION_PAYLOAD_KEYS_MAP = {
+    bodyLocArgs: 'body_loc_args',
+    bodyLocKey: 'body_loc_key',
+    clickAction: 'click_action',
+    titleLocArgs: 'title_loc_args',
+    titleLocKey: 'title_loc_key',
+};
+// Key renames for the messaging options object.
+var CAMELCASE_OPTIONS_KEYS_MAP = {
+    dryRun: 'dry_run',
+    timeToLive: 'time_to_live',
+    collapseKey: 'collapse_key',
+    mutableContent: 'mutable_content',
+    contentAvailable: 'content_available',
+    restrictedPackageName: 'restricted_package_name',
+};
+// Key renames for the MessagingDeviceResult object.
+var MESSAGING_DEVICE_RESULT_KEYS_MAP = {
+    message_id: 'messageId',
+    registration_id: 'canonicalRegistrationToken',
+};
+// Key renames for the MessagingDevicesResponse object.
+var MESSAGING_DEVICES_RESPONSE_KEYS_MAP = {
+    canonical_ids: 'canonicalRegistrationTokenCount',
+    failure: 'failureCount',
+    success: 'successCount',
+    multicast_id: 'multicastId',
+};
+// Key renames for the MessagingDeviceGroupResponse object.
+var MESSAGING_DEVICE_GROUP_RESPONSE_KEYS_MAP = {
+    success: 'successCount',
+    failure: 'failureCount',
+    failed_registration_ids: 'failedRegistrationTokens',
+};
+// Key renames for the MessagingTopicResponse object.
+var MESSAGING_TOPIC_RESPONSE_KEYS_MAP = {
+    message_id: 'messageId',
+};
+// Key renames for the MessagingConditionResponse object.
+var MESSAGING_CONDITION_RESPONSE_KEYS_MAP = {
+    message_id: 'messageId',
+};
+// Keys which are not allowed in the messaging data payload object.
+exports.BLACKLISTED_DATA_PAYLOAD_KEYS = ['from'];
+// Keys which are not allowed in the messaging options object.
+exports.BLACKLISTED_OPTIONS_KEYS = [
+    'condition', 'data', 'notification', 'registrationIds', 'registration_ids', 'to',
+];
+/**
+ * Maps a raw FCM server response to a MessagingDevicesResponse object.
+ *
+ * @param {object} response The raw FCM server response to map.
+ *
+ * @return {MessagingDeviceGroupResponse} The mapped MessagingDevicesResponse object.
+ */
+function mapRawResponseToDevicesResponse(response) {
+    // Rename properties on the server response
+    utils.renameProperties(response, MESSAGING_DEVICES_RESPONSE_KEYS_MAP);
+    if ('results' in response) {
+        response.results.forEach(function (messagingDeviceResult) {
+            utils.renameProperties(messagingDeviceResult, MESSAGING_DEVICE_RESULT_KEYS_MAP);
+            // Map the FCM server's error strings to actual error objects.
+            if ('error' in messagingDeviceResult) {
+                var newError = error_1.FirebaseMessagingError.fromServerError(messagingDeviceResult.error, /* message */ undefined, messagingDeviceResult.error);
+                messagingDeviceResult.error = newError;
+            }
+        });
+    }
+    return response;
+}
+/**
+ * Maps a raw FCM server response to a MessagingDeviceGroupResponse object.
+ *
+ * @param {object} response The raw FCM server response to map.
+ *
+ * @return {MessagingDeviceGroupResponse} The mapped MessagingDeviceGroupResponse object.
+ */
+function mapRawResponseToDeviceGroupResponse(response) {
+    // Rename properties on the server response
+    utils.renameProperties(response, MESSAGING_DEVICE_GROUP_RESPONSE_KEYS_MAP);
+    // Add the 'failedRegistrationTokens' property if it does not exist on the response, which
+    // it won't when the 'failureCount' property has a value of 0)
+    response.failedRegistrationTokens = response.failedRegistrationTokens || [];
+    return response;
+}
+/**
+ * Maps a raw FCM server response to a MessagingTopicManagementResponse object.
+ *
+ * @param {object} response The raw FCM server response to map.
+ *
+ * @return {MessagingTopicManagementResponse} The mapped MessagingTopicManagementResponse object.
+ */
+function mapRawResponseToTopicManagementResponse(response) {
+    // Add the success and failure counts.
+    var result = {
+        successCount: 0,
+        failureCount: 0,
+        errors: [],
+    };
+    if ('results' in response) {
+        response.results.forEach(function (tokenManagementResult, index) {
+            // Map the FCM server's error strings to actual error objects.
+            if ('error' in tokenManagementResult) {
+                result.failureCount += 1;
+                var newError = error_1.FirebaseMessagingError.fromTopicManagementServerError(tokenManagementResult.error, /* message */ undefined, tokenManagementResult.error);
+                result.errors.push({
+                    index: index,
+                    error: newError,
+                });
+            }
+            else {
+                result.successCount += 1;
+            }
+        });
+    }
+    return result;
+}
+/**
+ * Internals of a Messaging instance.
+ */
+var MessagingInternals = /** @class */ (function () {
+    function MessagingInternals() {
+    }
+    /**
+     * Deletes the service and its associated resources.
+     *
+     * @return {Promise<()>} An empty Promise that will be fulfilled when the service is deleted.
+     */
+    MessagingInternals.prototype.delete = function () {
+        // There are no resources to clean up.
+        return Promise.resolve(undefined);
+    };
+    return MessagingInternals;
+}());
+/**
+ * Messaging service bound to the provided app.
+ */
+var Messaging = /** @class */ (function () {
+    /**
+     * @param {FirebaseApp} app The app for this Messaging service.
+     * @constructor
+     */
+    function Messaging(app) {
+        this.INTERNAL = new MessagingInternals();
+        if (!validator.isNonNullObject(app) || !('options' in app)) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_ARGUMENT, 'First argument passed to admin.messaging() must be a valid Firebase app instance.');
+        }
+        this.appInternal = app;
+        this.messagingRequestHandler = new messaging_api_request_1.FirebaseMessagingRequestHandler(app);
+    }
+    Object.defineProperty(Messaging.prototype, "app", {
+        /**
+         * Returns the app associated with this Messaging instance.
+         *
+         * @return {FirebaseApp} The app associated with this Messaging instance.
+         */
+        get: function () {
+            return this.appInternal;
+        },
+        enumerable: true,
+        configurable: true
+    });
+    /**
+     * Sends a message via Firebase Cloud Messaging (FCM).
+     *
+     * @param {Message} message The message to be sent.
+     * @param {boolean=} dryRun Whether to send the message in the dry-run (validation only) mode.
+     *
+     * @return {Promise<string>} A Promise fulfilled with a message ID string.
+     */
+    Messaging.prototype.send = function (message, dryRun) {
+        var _this = this;
+        var copy = deep_copy_1.deepCopy(message);
+        messaging_types_1.validateMessage(copy);
+        if (typeof dryRun !== 'undefined' && !validator.isBoolean(dryRun)) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_ARGUMENT, 'dryRun must be a boolean');
+        }
+        return this.getUrlPath()
+            .then(function (urlPath) {
+            var request = { message: copy };
+            if (dryRun) {
+                request.validate_only = true;
+            }
+            return _this.messagingRequestHandler.invokeRequestHandler(FCM_SEND_HOST, urlPath, request);
+        })
+            .then(function (response) {
+            return response.name;
+        });
+    };
+    /**
+     * Sends all the messages in the given array via Firebase Cloud Messaging. Employs batching to
+     * send the entire list as a single RPC call. Compared to the send() method, this method is a
+     * significantly more efficient way to send multiple messages.
+     *
+     * The responses list obtained from the return value corresponds to the order of input messages.
+     * An error from this method indicates a total failure -- i.e. none of the messages in the
+     * list could be sent. Partial failures are indicated by a BatchResponse return value.
+     *
+     * @param {Message[]} messages A non-empty array containing up to 500 messages.
+     * @param {boolean=} dryRun Whether to send the message in the dry-run (validation only) mode.
+     *
+     * @return {Promise<BatchResponse>} A Promise fulfilled with an object representing the result
+     *     of the send operation.
+     */
+    Messaging.prototype.sendAll = function (messages, dryRun) {
+        var _this = this;
+        if (validator.isArray(messages) && messages.constructor !== Array) {
+            // In more recent JS specs, an array-like object might have a constructor that is not of
+            // Array type. Our deepCopy() method doesn't handle them properly. Convert such objects to
+            // a regular array here before calling deepCopy(). See issue #566 for details.
+            messages = Array.from(messages);
+        }
+        var copy = deep_copy_1.deepCopy(messages);
+        if (!validator.isNonEmptyArray(copy)) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_ARGUMENT, 'messages must be a non-empty array');
+        }
+        if (copy.length > FCM_MAX_BATCH_SIZE) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_ARGUMENT, "messages list must not contain more than " + FCM_MAX_BATCH_SIZE + " items");
+        }
+        if (typeof dryRun !== 'undefined' && !validator.isBoolean(dryRun)) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_ARGUMENT, 'dryRun must be a boolean');
+        }
+        return this.getUrlPath()
+            .then(function (urlPath) {
+            var requests = copy.map(function (message) {
+                messaging_types_1.validateMessage(message);
+                var request = { message: message };
+                if (dryRun) {
+                    request.validate_only = true;
+                }
+                return {
+                    url: "https://" + FCM_SEND_HOST + urlPath,
+                    body: request,
+                };
+            });
+            return _this.messagingRequestHandler.sendBatchRequest(requests);
+        });
+    };
+    /**
+     * Sends the given multicast message to all the FCM registration tokens specified in it.
+     *
+     * This method uses the sendAll() API under the hood to send the given
+     * message to all the target recipients. The responses list obtained from the return value
+     * corresponds to the order of tokens in the MulticastMessage. An error from this method
+     * indicates a total failure -- i.e. none of the tokens in the list could be sent to. Partial
+     * failures are indicated by a BatchResponse return value.
+     *
+     * @param {MulticastMessage} message A multicast message containing up to 500 tokens.
+     * @param {boolean=} dryRun Whether to send the message in the dry-run (validation only) mode.
+     *
+     * @return {Promise<BatchResponse>} A Promise fulfilled with an object representing the result
+     *     of the send operation.
+     */
+    Messaging.prototype.sendMulticast = function (message, dryRun) {
+        var copy = deep_copy_1.deepCopy(message);
+        if (!validator.isNonNullObject(copy)) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_ARGUMENT, 'MulticastMessage must be a non-null object');
+        }
+        if (!validator.isNonEmptyArray(copy.tokens)) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_ARGUMENT, 'tokens must be a non-empty array');
+        }
+        if (copy.tokens.length > FCM_MAX_BATCH_SIZE) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_ARGUMENT, "tokens list must not contain more than " + FCM_MAX_BATCH_SIZE + " items");
+        }
+        var messages = copy.tokens.map(function (token) {
+            return {
+                token: token,
+                android: copy.android,
+                apns: copy.apns,
+                data: copy.data,
+                notification: copy.notification,
+                webpush: copy.webpush,
+                fcmOptions: copy.fcmOptions,
+            };
+        });
+        return this.sendAll(messages, dryRun);
+    };
+    /**
+     * Sends an FCM message to a single device or an array of devices.
+     *
+     * @param {string|string[]} registrationTokenOrTokens The registration token or an array of
+     *     registration tokens for the device(s) to which to send the message.
+     * @param {MessagingPayload} payload The message payload.
+     * @param {MessagingOptions} [options = {}] Optional options to alter the message.
+     *
+     * @return {Promise<MessagingDevicesResponse|MessagingDeviceGroupResponse>} A Promise fulfilled
+     *     with the server's response after the message has been sent.
+     */
+    Messaging.prototype.sendToDevice = function (registrationTokenOrTokens, payload, options) {
+        var _this = this;
+        if (options === void 0) { options = {}; }
+        // Validate the input argument types. Since these are common developer errors when getting
+        // started, throw an error instead of returning a rejected promise.
+        this.validateRegistrationTokensType(registrationTokenOrTokens, 'sendToDevice', error_1.MessagingClientErrorCode.INVALID_RECIPIENT);
+        this.validateMessagingPayloadAndOptionsTypes(payload, options);
+        return Promise.resolve()
+            .then(function () {
+            // Validate the contents of the input arguments. Because we are now in a promise, any thrown
+            // error will cause this method to return a rejected promise.
+            _this.validateRegistrationTokens(registrationTokenOrTokens, 'sendToDevice', error_1.MessagingClientErrorCode.INVALID_RECIPIENT);
+            var payloadCopy = _this.validateMessagingPayload(payload);
+            var optionsCopy = _this.validateMessagingOptions(options);
+            var request = deep_copy_1.deepCopy(payloadCopy);
+            deep_copy_1.deepExtend(request, optionsCopy);
+            if (validator.isString(registrationTokenOrTokens)) {
+                request.to = registrationTokenOrTokens;
+            }
+            else {
+                request.registration_ids = registrationTokenOrTokens;
+            }
+            return _this.messagingRequestHandler.invokeRequestHandler(FCM_SEND_HOST, FCM_SEND_PATH, request);
+        })
+            .then(function (response) {
+            // The sendToDevice() and sendToDeviceGroup() methods both set the `to` query parameter in
+            // the underlying FCM request. If the provided registration token argument is actually a
+            // valid notification key, the response from the FCM server will be a device group response.
+            // If that is the case, we map the response to a MessagingDeviceGroupResponse.
+            // See b/35394951 for more context.
+            if ('multicast_id' in response) {
+                return mapRawResponseToDevicesResponse(response);
+            }
+            else {
+                return mapRawResponseToDeviceGroupResponse(response);
+            }
+        });
+    };
+    /**
+     * Sends an FCM message to a device group.
+     *
+     * @param {string} notificationKey The notification key representing the device group to which to
+     *     send the message.
+     * @param {MessagingPayload} payload The message payload.
+     * @param {MessagingOptions} [options = {}] Optional options to alter the message.
+     *
+     * @return {Promise<MessagingDeviceGroupResponse|MessagingDevicesResponse>} A Promise fulfilled
+     *     with the server's response after the message has been sent.
+     */
+    Messaging.prototype.sendToDeviceGroup = function (notificationKey, payload, options) {
+        var _this = this;
+        if (options === void 0) { options = {}; }
+        if (!validator.isNonEmptyString(notificationKey)) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_RECIPIENT, 'Notification key provided to sendToDeviceGroup() must be a non-empty string.');
+        }
+        else if (notificationKey.indexOf(':') !== -1) {
+            // It is possible the developer provides a registration token instead of a notification key
+            // to this method. We can detect some of those cases by checking to see if the string contains
+            // a colon. Not all registration tokens will contain a colon (only newer ones will), but no
+            // notification keys will contain a colon, so we can use it as a rough heuristic.
+            // See b/35394951 for more context.
+            return Promise.reject(new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_RECIPIENT, 'Notification key provided to sendToDeviceGroup() has the format of a registration token. ' +
+                'You should use sendToDevice() instead.'));
+        }
+        // Validate the types of the payload and options arguments. Since these are common developer
+        // errors, throw an error instead of returning a rejected promise.
+        this.validateMessagingPayloadAndOptionsTypes(payload, options);
+        return Promise.resolve()
+            .then(function () {
+            // Validate the contents of the payload and options objects. Because we are now in a
+            // promise, any thrown error will cause this method to return a rejected promise.
+            var payloadCopy = _this.validateMessagingPayload(payload);
+            var optionsCopy = _this.validateMessagingOptions(options);
+            var request = deep_copy_1.deepCopy(payloadCopy);
+            deep_copy_1.deepExtend(request, optionsCopy);
+            request.to = notificationKey;
+            return _this.messagingRequestHandler.invokeRequestHandler(FCM_SEND_HOST, FCM_SEND_PATH, request);
+        })
+            .then(function (response) {
+            // The sendToDevice() and sendToDeviceGroup() methods both set the `to` query parameter in
+            // the underlying FCM request. If the provided notification key argument has an invalid
+            // format (that is, it is either a registration token or some random string), the response
+            // from the FCM server will default to a devices response (which we detect by looking for
+            // the `multicast_id` property). If that is the case, we either throw an error saying the
+            // provided notification key is invalid (if the message failed to send) or map the response
+            // to a MessagingDevicesResponse (if the message succeeded).
+            // See b/35394951 for more context.
+            if ('multicast_id' in response) {
+                if (response.success === 0) {
+                    throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_RECIPIENT, 'Notification key provided to sendToDeviceGroup() is invalid.');
+                }
+                else {
+                    return mapRawResponseToDevicesResponse(response);
+                }
+            }
+            return mapRawResponseToDeviceGroupResponse(response);
+        });
+    };
+    /**
+     * Sends an FCM message to a topic.
+     *
+     * @param {string} topic The name of the topic to which to send the message.
+     * @param {MessagingPayload} payload The message payload.
+     * @param {MessagingOptions} [options = {}] Optional options to alter the message.
+     *
+     * @return {Promise<MessagingTopicResponse>} A Promise fulfilled with the server's response after
+     *     the message has been sent.
+     */
+    Messaging.prototype.sendToTopic = function (topic, payload, options) {
+        var _this = this;
+        if (options === void 0) { options = {}; }
+        // Validate the input argument types. Since these are common developer errors when getting
+        // started, throw an error instead of returning a rejected promise.
+        this.validateTopicType(topic, 'sendToTopic', error_1.MessagingClientErrorCode.INVALID_RECIPIENT);
+        this.validateMessagingPayloadAndOptionsTypes(payload, options);
+        // Prepend the topic with /topics/ if necessary.
+        topic = this.normalizeTopic(topic);
+        return Promise.resolve()
+            .then(function () {
+            // Validate the contents of the payload and options objects. Because we are now in a
+            // promise, any thrown error will cause this method to return a rejected promise.
+            var payloadCopy = _this.validateMessagingPayload(payload);
+            var optionsCopy = _this.validateMessagingOptions(options);
+            _this.validateTopic(topic, 'sendToTopic', error_1.MessagingClientErrorCode.INVALID_RECIPIENT);
+            var request = deep_copy_1.deepCopy(payloadCopy);
+            deep_copy_1.deepExtend(request, optionsCopy);
+            request.to = topic;
+            return _this.messagingRequestHandler.invokeRequestHandler(FCM_SEND_HOST, FCM_SEND_PATH, request);
+        })
+            .then(function (response) {
+            // Rename properties on the server response
+            utils.renameProperties(response, MESSAGING_TOPIC_RESPONSE_KEYS_MAP);
+            return response;
+        });
+    };
+    /**
+     * Sends an FCM message to a condition.
+     *
+     * @param {string} condition The condition to which to send the message.
+     * @param {MessagingPayload} payload The message payload.
+     * @param {MessagingOptions} [options = {}] Optional options to alter the message.
+     *
+     * @return {Promise<MessagingConditionResponse>} A Promise fulfilled with the server's response
+     *     after the message has been sent.
+     */
+    Messaging.prototype.sendToCondition = function (condition, payload, options) {
+        var _this = this;
+        if (options === void 0) { options = {}; }
+        if (!validator.isNonEmptyString(condition)) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_RECIPIENT, 'Condition provided to sendToCondition() must be a non-empty string.');
+        }
+        // Validate the types of the payload and options arguments. Since these are common developer
+        // errors, throw an error instead of returning a rejected promise.
+        this.validateMessagingPayloadAndOptionsTypes(payload, options);
+        // The FCM server rejects conditions which are surrounded in single quotes. When the condition
+        // is stringified over the wire, double quotes in it get converted to \" which the FCM server
+        // does not properly handle. We can get around this by replacing internal double quotes with
+        // single quotes.
+        condition = condition.replace(/"/g, '\'');
+        return Promise.resolve()
+            .then(function () {
+            // Validate the contents of the payload and options objects. Because we are now in a
+            // promise, any thrown error will cause this method to return a rejected promise.
+            var payloadCopy = _this.validateMessagingPayload(payload);
+            var optionsCopy = _this.validateMessagingOptions(options);
+            var request = deep_copy_1.deepCopy(payloadCopy);
+            deep_copy_1.deepExtend(request, optionsCopy);
+            request.condition = condition;
+            return _this.messagingRequestHandler.invokeRequestHandler(FCM_SEND_HOST, FCM_SEND_PATH, request);
+        })
+            .then(function (response) {
+            // Rename properties on the server response
+            utils.renameProperties(response, MESSAGING_CONDITION_RESPONSE_KEYS_MAP);
+            return response;
+        });
+    };
+    /**
+     * Subscribes a single device or an array of devices to a topic.
+     *
+     * @param {string|string[]} registrationTokenOrTokens The registration token or an array of
+     *     registration tokens to subscribe to the topic.
+     * @param {string} topic The topic to which to subscribe.
+     *
+     * @return {Promise<MessagingTopicManagementResponse>} A Promise fulfilled with the parsed FCM
+     *   server response.
+     */
+    Messaging.prototype.subscribeToTopic = function (registrationTokenOrTokens, topic) {
+        return this.sendTopicManagementRequest(registrationTokenOrTokens, topic, 'subscribeToTopic', FCM_TOPIC_MANAGEMENT_ADD_PATH);
+    };
+    /**
+     * Unsubscribes a single device or an array of devices from a topic.
+     *
+     * @param {string|string[]} registrationTokenOrTokens The registration token or an array of
+     *     registration tokens to unsubscribe from the topic.
+     * @param {string} topic The topic to which to subscribe.
+     *
+     * @return {Promise<MessagingTopicManagementResponse>} A Promise fulfilled with the parsed FCM
+     *   server response.
+     */
+    Messaging.prototype.unsubscribeFromTopic = function (registrationTokenOrTokens, topic) {
+        return this.sendTopicManagementRequest(registrationTokenOrTokens, topic, 'unsubscribeFromTopic', FCM_TOPIC_MANAGEMENT_REMOVE_PATH);
+    };
+    Messaging.prototype.getUrlPath = function () {
+        var _this = this;
+        if (this.urlPath) {
+            return Promise.resolve(this.urlPath);
+        }
+        return utils.findProjectId(this.app)
+            .then(function (projectId) {
+            if (!validator.isNonEmptyString(projectId)) {
+                // Assert for an explicit project ID (either via AppOptions or the cert itself).
+                throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_ARGUMENT, 'Failed to determine project ID for Messaging. Initialize the '
+                    + 'SDK with service account credentials or set project ID as an app option. '
+                    + 'Alternatively set the GOOGLE_CLOUD_PROJECT environment variable.');
+            }
+            _this.urlPath = "/v1/projects/" + projectId + "/messages:send";
+            return _this.urlPath;
+        });
+    };
+    /**
+     * Helper method which sends and handles topic subscription management requests.
+     *
+     * @param {string|string[]} registrationTokenOrTokens The registration token or an array of
+     *     registration tokens to unsubscribe from the topic.
+     * @param {string} topic The topic to which to subscribe.
+     * @param {string} methodName The name of the original method called.
+     * @param {string} path The endpoint path to use for the request.
+     *
+     * @return {Promise<MessagingTopicManagementResponse>} A Promise fulfilled with the parsed server
+     *   response.
+     */
+    Messaging.prototype.sendTopicManagementRequest = function (registrationTokenOrTokens, topic, methodName, path) {
+        var _this = this;
+        this.validateRegistrationTokensType(registrationTokenOrTokens, methodName);
+        this.validateTopicType(topic, methodName);
+        // Prepend the topic with /topics/ if necessary.
+        topic = this.normalizeTopic(topic);
+        return Promise.resolve()
+            .then(function () {
+            // Validate the contents of the input arguments. Because we are now in a promise, any thrown
+            // error will cause this method to return a rejected promise.
+            _this.validateRegistrationTokens(registrationTokenOrTokens, methodName);
+            _this.validateTopic(topic, methodName);
+            // Ensure the registration token(s) input argument is an array.
+            var registrationTokensArray = registrationTokenOrTokens;
+            if (validator.isString(registrationTokenOrTokens)) {
+                registrationTokensArray = [registrationTokenOrTokens];
+            }
+            var request = {
+                to: topic,
+                registration_tokens: registrationTokensArray,
+            };
+            return _this.messagingRequestHandler.invokeRequestHandler(FCM_TOPIC_MANAGEMENT_HOST, path, request);
+        })
+            .then(function (response) {
+            return mapRawResponseToTopicManagementResponse(response);
+        });
+    };
+    /**
+     * Validates the types of the messaging payload and options. If invalid, an error will be thrown.
+     *
+     * @param {MessagingPayload} payload The messaging payload to validate.
+     * @param {MessagingOptions} options The messaging options to validate.
+     */
+    Messaging.prototype.validateMessagingPayloadAndOptionsTypes = function (payload, options) {
+        // Validate the payload is an object
+        if (!validator.isNonNullObject(payload)) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'Messaging payload must be an object with at least one of the "data" or "notification" properties.');
+        }
+        // Validate the options argument is an object
+        if (!validator.isNonNullObject(options)) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_OPTIONS, 'Messaging options must be an object.');
+        }
+    };
+    /**
+     * Validates the messaging payload. If invalid, an error will be thrown.
+     *
+     * @param {MessagingPayload} payload The messaging payload to validate.
+     *
+     * @return {MessagingPayload} A copy of the provided payload with whitelisted properties switched
+     *     from camelCase to underscore_case.
+     */
+    Messaging.prototype.validateMessagingPayload = function (payload) {
+        var payloadCopy = deep_copy_1.deepCopy(payload);
+        var payloadKeys = Object.keys(payloadCopy);
+        var validPayloadKeys = ['data', 'notification'];
+        var containsDataOrNotificationKey = false;
+        payloadKeys.forEach(function (payloadKey) {
+            // Validate the payload does not contain any invalid keys
+            if (validPayloadKeys.indexOf(payloadKey) === -1) {
+                throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, "Messaging payload contains an invalid \"" + payloadKey + "\" property. Valid properties are " +
+                    "\"data\" and \"notification\".");
+            }
+            else {
+                containsDataOrNotificationKey = true;
+            }
+        });
+        // Validate the payload contains at least one of the "data" and "notification" keys
+        if (!containsDataOrNotificationKey) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, 'Messaging payload must contain at least one of the "data" or "notification" properties.');
+        }
+        var validatePayload = function (payloadKey, value) {
+            // Validate each top-level key in the payload is an object
+            if (!validator.isNonNullObject(value)) {
+                throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, "Messaging payload contains an invalid value for the \"" + payloadKey + "\" property. " +
+                    "Value must be an object.");
+            }
+            Object.keys(value).forEach(function (subKey) {
+                if (!validator.isString(value[subKey])) {
+                    // Validate all sub-keys have a string value
+                    throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, "Messaging payload contains an invalid value for the \"" + payloadKey + "." + subKey + "\" " +
+                        "property. Values must be strings.");
+                }
+                else if (payloadKey === 'data' && /^google\./.test(subKey)) {
+                    // Validate the data payload does not contain keys which start with 'google.'.
+                    throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, "Messaging payload contains the blacklisted \"data." + subKey + "\" property.");
+                }
+            });
+        };
+        if (payloadCopy.data !== undefined) {
+            validatePayload('data', payloadCopy.data);
+        }
+        if (payloadCopy.notification !== undefined) {
+            validatePayload('notification', payloadCopy.notification);
+        }
+        // Validate the data payload object does not contain blacklisted properties
+        if ('data' in payloadCopy) {
+            exports.BLACKLISTED_DATA_PAYLOAD_KEYS.forEach(function (blacklistedKey) {
+                if (blacklistedKey in payloadCopy.data) {
+                    throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_PAYLOAD, "Messaging payload contains the blacklisted \"data." + blacklistedKey + "\" property.");
+                }
+            });
+        }
+        // Convert whitelisted camelCase keys to underscore_case
+        if (payloadCopy.notification) {
+            utils.renameProperties(payloadCopy.notification, CAMELCASED_NOTIFICATION_PAYLOAD_KEYS_MAP);
+        }
+        return payloadCopy;
+    };
+    /**
+     * Validates the messaging options. If invalid, an error will be thrown.
+     *
+     * @param {MessagingOptions} options The messaging options to validate.
+     *
+     * @return {MessagingOptions} A copy of the provided options with whitelisted properties switched
+     *   from camelCase to underscore_case.
+     */
+    Messaging.prototype.validateMessagingOptions = function (options) {
+        var optionsCopy = deep_copy_1.deepCopy(options);
+        // Validate the options object does not contain blacklisted properties
+        exports.BLACKLISTED_OPTIONS_KEYS.forEach(function (blacklistedKey) {
+            if (blacklistedKey in optionsCopy) {
+                throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_OPTIONS, "Messaging options contains the blacklisted \"" + blacklistedKey + "\" property.");
+            }
+        });
+        // Convert whitelisted camelCase keys to underscore_case
+        utils.renameProperties(optionsCopy, CAMELCASE_OPTIONS_KEYS_MAP);
+        // Validate the options object contains valid values for whitelisted properties
+        if ('collapse_key' in optionsCopy && !validator.isNonEmptyString(optionsCopy.collapse_key)) {
+            var keyName = ('collapseKey' in options) ? 'collapseKey' : 'collapse_key';
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_OPTIONS, "Messaging options contains an invalid value for the \"" + keyName + "\" property. Value must " +
+                'be a non-empty string.');
+        }
+        else if ('dry_run' in optionsCopy && !validator.isBoolean(optionsCopy.dry_run)) {
+            var keyName = ('dryRun' in options) ? 'dryRun' : 'dry_run';
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_OPTIONS, "Messaging options contains an invalid value for the \"" + keyName + "\" property. Value must " +
+                'be a boolean.');
+        }
+        else if ('priority' in optionsCopy && !validator.isNonEmptyString(optionsCopy.priority)) {
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_OPTIONS, 'Messaging options contains an invalid value for the "priority" property. Value must ' +
+                'be a non-empty string.');
+        }
+        else if ('restricted_package_name' in optionsCopy &&
+            !validator.isNonEmptyString(optionsCopy.restricted_package_name)) {
+            var keyName = ('restrictedPackageName' in options) ? 'restrictedPackageName' : 'restricted_package_name';
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_OPTIONS, "Messaging options contains an invalid value for the \"" + keyName + "\" property. Value must " +
+                'be a non-empty string.');
+        }
+        else if ('time_to_live' in optionsCopy && !validator.isNumber(optionsCopy.time_to_live)) {
+            var keyName = ('timeToLive' in options) ? 'timeToLive' : 'time_to_live';
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_OPTIONS, "Messaging options contains an invalid value for the \"" + keyName + "\" property. Value must " +
+                'be a number.');
+        }
+        else if ('content_available' in optionsCopy && !validator.isBoolean(optionsCopy.content_available)) {
+            var keyName = ('contentAvailable' in options) ? 'contentAvailable' : 'content_available';
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_OPTIONS, "Messaging options contains an invalid value for the \"" + keyName + "\" property. Value must " +
+                'be a boolean.');
+        }
+        else if ('mutable_content' in optionsCopy && !validator.isBoolean(optionsCopy.mutable_content)) {
+            var keyName = ('mutableContent' in options) ? 'mutableContent' : 'mutable_content';
+            throw new error_1.FirebaseMessagingError(error_1.MessagingClientErrorCode.INVALID_OPTIONS, "Messaging options contains an invalid value for the \"" + keyName + "\" property. Value must " +
+                'be a boolean.');
+        }
+        return optionsCopy;
+    };
+    /**
+     * Validates the type of the provided registration token(s). If invalid, an error will be thrown.
+     *
+     * @param {string|string[]} registrationTokenOrTokens The registration token(s) to validate.
+     * @param {string} method The method name to use in error messages.
+     * @param {ErrorInfo?} [errorInfo] The error info to use if the registration tokens are invalid.
+     */
+    Messaging.prototype.validateRegistrationTokensType = function (registrationTokenOrTokens, methodName, errorInfo) {
+        if (errorInfo === void 0) { errorInfo = error_1.MessagingClientErrorCode.INVALID_ARGUMENT; }
+        if (!validator.isNonEmptyArray(registrationTokenOrTokens) &&
+            !validator.isNonEmptyString(registrationTokenOrTokens)) {
+            throw new error_1.FirebaseMessagingError(errorInfo, "Registration token(s) provided to " + methodName + "() must be a non-empty string or a " +
+                'non-empty array.');
+        }
+    };
+    /**
+     * Validates the provided registration tokens. If invalid, an error will be thrown.
+     *
+     * @param {string|string[]} registrationTokenOrTokens The registration token or an array of
+     *     registration tokens to validate.
+     * @param {string} method The method name to use in error messages.
+     * @param {errorInfo?} [ErrorInfo] The error info to use if the registration tokens are invalid.
+     */
+    Messaging.prototype.validateRegistrationTokens = function (registrationTokenOrTokens, methodName, errorInfo) {
+        if (errorInfo === void 0) { errorInfo = error_1.MessagingClientErrorCode.INVALID_ARGUMENT; }
+        if (validator.isArray(registrationTokenOrTokens)) {
+            // Validate the array contains no more than 1,000 registration tokens.
+            if (registrationTokenOrTokens.length > 1000) {
+                throw new error_1.FirebaseMessagingError(errorInfo, "Too many registration tokens provided in a single request to " + methodName + "(). Batch " +
+                    'your requests to contain no more than 1,000 registration tokens per request.');
+            }
+            // Validate the array contains registration tokens which are non-empty strings.
+            registrationTokenOrTokens.forEach(function (registrationToken, index) {
+                if (!validator.isNonEmptyString(registrationToken)) {
+                    throw new error_1.FirebaseMessagingError(errorInfo, "Registration token provided to " + methodName + "() at index " + index + " must be a " +
+                        'non-empty string.');
+                }
+            });
+        }
+    };
+    /**
+     * Validates the type of the provided topic. If invalid, an error will be thrown.
+     *
+     * @param {string} topic The topic to validate.
+     * @param {string} method The method name to use in error messages.
+     * @param {ErrorInfo?} [errorInfo] The error info to use if the topic is invalid.
+     */
+    Messaging.prototype.validateTopicType = function (topic, methodName, errorInfo) {
+        if (errorInfo === void 0) { errorInfo = error_1.MessagingClientErrorCode.INVALID_ARGUMENT; }
+        if (!validator.isNonEmptyString(topic)) {
+            throw new error_1.FirebaseMessagingError(errorInfo, "Topic provided to " + methodName + "() must be a string which matches the format " +
+                '"/topics/[a-zA-Z0-9-_.~%]+".');
+        }
+    };
+    /**
+     * Validates the provided topic. If invalid, an error will be thrown.
+     *
+     * @param {string} topic The topic to validate.
+     * @param {string} method The method name to use in error messages.
+     * @param {ErrorInfo?} [errorInfo] The error info to use if the topic is invalid.
+     */
+    Messaging.prototype.validateTopic = function (topic, methodName, errorInfo) {
+        if (errorInfo === void 0) { errorInfo = error_1.MessagingClientErrorCode.INVALID_ARGUMENT; }
+        if (!validator.isTopic(topic)) {
+            throw new error_1.FirebaseMessagingError(errorInfo, "Topic provided to " + methodName + "() must be a string which matches the format " +
+                '"/topics/[a-zA-Z0-9-_.~%]+".');
+        }
+    };
+    /**
+     * Normalizes the provided topic name by prepending it with '/topics/', if necessary.
+     *
+     * @param {string} topic The topic name to normalize.
+     *
+     * @return {string} The normalized topic name.
+     */
+    Messaging.prototype.normalizeTopic = function (topic) {
+        if (!/^\/topics\//.test(topic)) {
+            topic = "/topics/" + topic;
+        }
+        return topic;
+    };
+    return Messaging;
+}());
+exports.Messaging = Messaging;

node_modules/firebase-admin/lib/project-management/android-app.js

@@ -0,0 +1,122 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2018 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var error_1 = require("../utils/error");
+var validator = require("../utils/validator");
+var project_management_api_request_1 = require("./project-management-api-request");
+var app_metadata_1 = require("./app-metadata");
+var AndroidApp = /** @class */ (function () {
+    function AndroidApp(appId, requestHandler) {
+        this.appId = appId;
+        this.requestHandler = requestHandler;
+        if (!validator.isNonEmptyString(appId)) {
+            throw new error_1.FirebaseProjectManagementError('invalid-argument', 'appId must be a non-empty string.');
+        }
+        this.resourceName = "projects/-/androidApps/" + appId;
+    }
+    AndroidApp.prototype.getMetadata = function () {
+        return this.requestHandler.getResource(this.resourceName)
+            .then(function (responseData) {
+            project_management_api_request_1.assertServerResponse(validator.isNonNullObject(responseData), responseData, 'getMetadata()\'s responseData must be a non-null object.');
+            var requiredFieldsList = ['name', 'appId', 'projectId', 'packageName'];
+            requiredFieldsList.forEach(function (requiredField) {
+                project_management_api_request_1.assertServerResponse(validator.isNonEmptyString(responseData[requiredField]), responseData, "getMetadata()'s responseData." + requiredField + " must be a non-empty string.");
+            });
+            var metadata = {
+                platform: app_metadata_1.AppPlatform.ANDROID,
+                resourceName: responseData.name,
+                appId: responseData.appId,
+                displayName: responseData.displayName || null,
+                projectId: responseData.projectId,
+                packageName: responseData.packageName,
+            };
+            return metadata;
+        });
+    };
+    AndroidApp.prototype.setDisplayName = function (newDisplayName) {
+        return this.requestHandler.setDisplayName(this.resourceName, newDisplayName);
+    };
+    AndroidApp.prototype.getShaCertificates = function () {
+        return this.requestHandler.getAndroidShaCertificates(this.resourceName)
+            .then(function (responseData) {
+            project_management_api_request_1.assertServerResponse(validator.isNonNullObject(responseData), responseData, 'getShaCertificates()\'s responseData must be a non-null object.');
+            if (!responseData.certificates) {
+                return [];
+            }
+            project_management_api_request_1.assertServerResponse(validator.isArray(responseData.certificates), responseData, '"certificates" field must be present in the getShaCertificates() response data.');
+            var requiredFieldsList = ['name', 'shaHash'];
+            return responseData.certificates.map(function (certificateJson) {
+                requiredFieldsList.forEach(function (requiredField) {
+                    project_management_api_request_1.assertServerResponse(validator.isNonEmptyString(certificateJson[requiredField]), responseData, "getShaCertificates()'s responseData.certificates[]." + requiredField + " must be a "
+                        + "non-empty string.");
+                });
+                return new ShaCertificate(certificateJson.shaHash, certificateJson.name);
+            });
+        });
+    };
+    AndroidApp.prototype.addShaCertificate = function (certificateToAdd) {
+        return this.requestHandler.addAndroidShaCertificate(this.resourceName, certificateToAdd);
+    };
+    AndroidApp.prototype.deleteShaCertificate = function (certificateToDelete) {
+        if (!certificateToDelete.resourceName) {
+            throw new error_1.FirebaseProjectManagementError('invalid-argument', 'Specified certificate does not include a resourceName. (Use AndroidApp.getShaCertificates() to retrieve ' +
+                'certificates with a resourceName.');
+        }
+        return this.requestHandler.deleteResource(certificateToDelete.resourceName);
+    };
+    /**
+     * @return {Promise<string>} A promise that resolves to a UTF-8 JSON string, typically intended to
+     *     be written to a JSON file.
+     */
+    AndroidApp.prototype.getConfig = function () {
+        return this.requestHandler.getConfig(this.resourceName)
+            .then(function (responseData) {
+            project_management_api_request_1.assertServerResponse(validator.isNonNullObject(responseData), responseData, 'getConfig()\'s responseData must be a non-null object.');
+            var base64ConfigFileContents = responseData.configFileContents;
+            project_management_api_request_1.assertServerResponse(validator.isBase64String(base64ConfigFileContents), responseData, "getConfig()'s responseData.configFileContents must be a base64 string.");
+            return Buffer.from(base64ConfigFileContents, 'base64').toString('utf8');
+        });
+    };
+    return AndroidApp;
+}());
+exports.AndroidApp = AndroidApp;
+var ShaCertificate = /** @class */ (function () {
+    /**
+     * Creates a ShaCertificate using the given hash. The ShaCertificate's type (eg. 'sha256') is
+     * automatically determined from the hash itself.
+     *
+     * @param shaHash The sha256 or sha1 hash for this certificate.
+     * @param resourceName The Firebase resource name for this certificate. This does not need to be
+     *     set when creating a new certificate.
+     */
+    function ShaCertificate(shaHash, resourceName) {
+        this.shaHash = shaHash;
+        this.resourceName = resourceName;
+        if (/^[a-fA-F0-9]{40}$/.test(shaHash)) {
+            this.certType = 'sha1';
+        }
+        else if (/^[a-fA-F0-9]{64}$/.test(shaHash)) {
+            this.certType = 'sha256';
+        }
+        else {
+            throw new error_1.FirebaseProjectManagementError('invalid-argument', 'shaHash must be either a sha256 hash or a sha1 hash.');
+        }
+    }
+    return ShaCertificate;
+}());
+exports.ShaCertificate = ShaCertificate;

node_modules/firebase-admin/lib/project-management/app-metadata.js

@@ -0,0 +1,24 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2019 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var AppPlatform;
+(function (AppPlatform) {
+    AppPlatform["PLATFORM_UNKNOWN"] = "PLATFORM_UNKNOWN";
+    AppPlatform["IOS"] = "IOS";
+    AppPlatform["ANDROID"] = "ANDROID";
+})(AppPlatform = exports.AppPlatform || (exports.AppPlatform = {}));

node_modules/firebase-admin/lib/project-management/ios-app.js

@@ -0,0 +1,69 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2018 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var error_1 = require("../utils/error");
+var validator = require("../utils/validator");
+var project_management_api_request_1 = require("./project-management-api-request");
+var app_metadata_1 = require("./app-metadata");
+var IosApp = /** @class */ (function () {
+    function IosApp(appId, requestHandler) {
+        this.appId = appId;
+        this.requestHandler = requestHandler;
+        if (!validator.isNonEmptyString(appId)) {
+            throw new error_1.FirebaseProjectManagementError('invalid-argument', 'appId must be a non-empty string.');
+        }
+        this.resourceName = "projects/-/iosApps/" + appId;
+    }
+    IosApp.prototype.getMetadata = function () {
+        return this.requestHandler.getResource(this.resourceName)
+            .then(function (responseData) {
+            project_management_api_request_1.assertServerResponse(validator.isNonNullObject(responseData), responseData, 'getMetadata()\'s responseData must be a non-null object.');
+            var requiredFieldsList = ['name', 'appId', 'projectId', 'bundleId'];
+            requiredFieldsList.forEach(function (requiredField) {
+                project_management_api_request_1.assertServerResponse(validator.isNonEmptyString(responseData[requiredField]), responseData, "getMetadata()'s responseData." + requiredField + " must be a non-empty string.");
+            });
+            var metadata = {
+                platform: app_metadata_1.AppPlatform.IOS,
+                resourceName: responseData.name,
+                appId: responseData.appId,
+                displayName: responseData.displayName || null,
+                projectId: responseData.projectId,
+                bundleId: responseData.bundleId,
+            };
+            return metadata;
+        });
+    };
+    IosApp.prototype.setDisplayName = function (newDisplayName) {
+        return this.requestHandler.setDisplayName(this.resourceName, newDisplayName);
+    };
+    /**
+     * @return {Promise<string>} A promise that resolves to a UTF-8 XML string, typically intended to
+     *     be written to a plist file.
+     */
+    IosApp.prototype.getConfig = function () {
+        return this.requestHandler.getConfig(this.resourceName)
+            .then(function (responseData) {
+            project_management_api_request_1.assertServerResponse(validator.isNonNullObject(responseData), responseData, 'getConfig()\'s responseData must be a non-null object.');
+            var base64ConfigFileContents = responseData.configFileContents;
+            project_management_api_request_1.assertServerResponse(validator.isBase64String(base64ConfigFileContents), responseData, "getConfig()'s responseData.configFileContents must be a base64 string.");
+            return Buffer.from(base64ConfigFileContents, 'base64').toString('utf8');
+        });
+    };
+    return IosApp;
+}());
+exports.IosApp = IosApp;

node_modules/firebase-admin/lib/project-management/project-management-api-request.js

@@ -0,0 +1,271 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2018 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var api_request_1 = require("../utils/api-request");
+var error_1 = require("../utils/error");
+var validator = require("../utils/validator");
+/** Project management backend host and port. */
+var PROJECT_MANAGEMENT_HOST_AND_PORT = 'firebase.googleapis.com:443';
+/** Project management backend path. */
+var PROJECT_MANAGEMENT_PATH = '/v1/';
+/** Project management beta backend path. */
+var PROJECT_MANAGEMENT_BETA_PATH = '/v1beta1/';
+/** Project management request header. */
+var PROJECT_MANAGEMENT_HEADERS = {
+    'X-Client-Version': 'Node/Admin/8.9.2',
+};
+/** Project management request timeout duration in milliseconds. */
+var PROJECT_MANAGEMENT_TIMEOUT_MILLIS = 10000;
+var LIST_APPS_MAX_PAGE_SIZE = 100;
+var CERT_TYPE_API_MAP = {
+    sha1: 'SHA_1',
+    sha256: 'SHA_256',
+};
+function assertServerResponse(condition, responseData, message) {
+    if (!condition) {
+        throw new error_1.FirebaseProjectManagementError('invalid-server-response', message + " Response data: " + JSON.stringify(responseData, null, 2));
+    }
+}
+exports.assertServerResponse = assertServerResponse;
+/**
+ * Class that provides mechanism to send requests to the Firebase project management backend
+ * endpoints.
+ *
+ * @private
+ */
+var ProjectManagementRequestHandler = /** @class */ (function () {
+    /**
+     * @param {FirebaseApp} app The app used to fetch access tokens to sign API requests.
+     * @constructor
+     */
+    function ProjectManagementRequestHandler(app) {
+        this.baseUrl = "https://" + PROJECT_MANAGEMENT_HOST_AND_PORT + PROJECT_MANAGEMENT_PATH;
+        this.baseBetaUrl = "https://" + PROJECT_MANAGEMENT_HOST_AND_PORT + PROJECT_MANAGEMENT_BETA_PATH;
+        this.httpClient = new api_request_1.AuthorizedHttpClient(app);
+    }
+    ProjectManagementRequestHandler.wrapAndRethrowHttpError = function (errStatusCode, errText) {
+        var errorCode;
+        var errorMessage;
+        switch (errStatusCode) {
+            case 400:
+                errorCode = 'invalid-argument';
+                errorMessage = 'Invalid argument provided.';
+                break;
+            case 401:
+            case 403:
+                errorCode = 'authentication-error';
+                errorMessage = 'An error occurred when trying to authenticate. Make sure the credential '
+                    + 'used to authenticate this SDK has the proper permissions. See '
+                    + 'https://firebase.google.com/docs/admin/setup for setup instructions.';
+                break;
+            case 404:
+                errorCode = 'not-found';
+                errorMessage = 'The specified entity could not be found.';
+                break;
+            case 409:
+                errorCode = 'already-exists';
+                errorMessage = 'The specified entity already exists.';
+                break;
+            case 500:
+                errorCode = 'internal-error';
+                errorMessage = 'An internal error has occurred. Please retry the request.';
+                break;
+            case 503:
+                errorCode = 'service-unavailable';
+                errorMessage = 'The server could not process the request in time. See the error '
+                    + 'documentation for more details.';
+                break;
+            default:
+                errorCode = 'unknown-error';
+                errorMessage = 'An unknown server error was returned.';
+        }
+        if (!errText) {
+            errText = '<missing>';
+        }
+        throw new error_1.FirebaseProjectManagementError(errorCode, errorMessage + " Status code: " + errStatusCode + ". Raw server response: \"" + errText + "\".");
+    };
+    /**
+     * @param {string} parentResourceName Fully-qualified resource name of the project whose Android
+     *     apps you want to list.
+     */
+    ProjectManagementRequestHandler.prototype.listAndroidApps = function (parentResourceName) {
+        return this.invokeRequestHandler('GET', parentResourceName + "/androidApps?page_size=" + LIST_APPS_MAX_PAGE_SIZE, 
+        /* requestData */ null, 'v1beta1');
+    };
+    /**
+     * @param {string} parentResourceName Fully-qualified resource name of the project whose iOS apps
+     *     you want to list.
+     */
+    ProjectManagementRequestHandler.prototype.listIosApps = function (parentResourceName) {
+        return this.invokeRequestHandler('GET', parentResourceName + "/iosApps?page_size=" + LIST_APPS_MAX_PAGE_SIZE, 
+        /* requestData */ null, 'v1beta1');
+    };
+    /**
+     * @param {string} parentResourceName Fully-qualified resource name of the project whose iOS apps
+     *     you want to list.
+     */
+    ProjectManagementRequestHandler.prototype.listAppMetadata = function (parentResourceName) {
+        return this.invokeRequestHandler('GET', parentResourceName + ":searchApps?page_size=" + LIST_APPS_MAX_PAGE_SIZE, 
+        /* requestData */ null, 'v1beta1');
+    };
+    /**
+     * @param {string} parentResourceName Fully-qualified resource name of the project that you want
+     *     to create the Android app within.
+     */
+    ProjectManagementRequestHandler.prototype.createAndroidApp = function (parentResourceName, packageName, displayName) {
+        var _this = this;
+        var requestData = {
+            packageName: packageName,
+        };
+        if (validator.isNonEmptyString(displayName)) {
+            requestData.displayName = displayName;
+        }
+        return this
+            .invokeRequestHandler('POST', parentResourceName + "/androidApps", requestData, 'v1beta1')
+            .then(function (responseData) {
+            assertServerResponse(validator.isNonNullObject(responseData), responseData, "createAndroidApp's responseData must be a non-null object.");
+            assertServerResponse(validator.isNonEmptyString(responseData.name), responseData, "createAndroidApp's responseData.name must be a non-empty string.");
+            return _this.pollRemoteOperationWithExponentialBackoff(responseData.name);
+        });
+    };
+    /**
+     * @param {string} parentResourceName Fully-qualified resource name of the project that you want
+     *     to create the iOS app within.
+     */
+    ProjectManagementRequestHandler.prototype.createIosApp = function (parentResourceName, bundleId, displayName) {
+        var _this = this;
+        var requestData = {
+            bundleId: bundleId,
+        };
+        if (validator.isNonEmptyString(displayName)) {
+            requestData.displayName = displayName;
+        }
+        return this
+            .invokeRequestHandler('POST', parentResourceName + "/iosApps", requestData, 'v1beta1')
+            .then(function (responseData) {
+            assertServerResponse(validator.isNonNullObject(responseData), responseData, "createIosApp's responseData must be a non-null object.");
+            assertServerResponse(validator.isNonEmptyString(responseData.name), responseData, "createIosApp's responseData.name must be a non-empty string.");
+            return _this.pollRemoteOperationWithExponentialBackoff(responseData.name);
+        });
+    };
+    /**
+     * @param {string} resourceName Fully-qualified resource name of the entity whose display name you
+     *     want to set.
+     */
+    ProjectManagementRequestHandler.prototype.setDisplayName = function (resourceName, newDisplayName) {
+        var requestData = {
+            displayName: newDisplayName,
+        };
+        return this
+            .invokeRequestHandler('PATCH', resourceName + "?update_mask=display_name", requestData, 'v1beta1')
+            .then(function () { return undefined; });
+    };
+    /**
+     * @param {string} parentResourceName Fully-qualified resource name of the Android app whose SHA
+     *     certificates you want to get.
+     */
+    ProjectManagementRequestHandler.prototype.getAndroidShaCertificates = function (parentResourceName) {
+        return this.invokeRequestHandler('GET', parentResourceName + "/sha", /* requestData */ null, 'v1beta1');
+    };
+    /**
+     * @param {string} parentResourceName Fully-qualified resource name of the Android app that you
+     *     want to add the given SHA certificate to.
+     */
+    ProjectManagementRequestHandler.prototype.addAndroidShaCertificate = function (parentResourceName, certificate) {
+        var requestData = {
+            shaHash: certificate.shaHash,
+            certType: CERT_TYPE_API_MAP[certificate.certType],
+        };
+        return this
+            .invokeRequestHandler('POST', parentResourceName + "/sha", requestData, 'v1beta1')
+            .then(function () { return undefined; });
+    };
+    /**
+     * @param {string} parentResourceName Fully-qualified resource name of the app whose config you
+     *     want to get.
+     */
+    ProjectManagementRequestHandler.prototype.getConfig = function (parentResourceName) {
+        return this.invokeRequestHandler('GET', parentResourceName + "/config", /* requestData */ null, 'v1beta1');
+    };
+    /**
+     * @param {string} parentResourceName Fully-qualified resource name of the entity that you want to
+     *     get.
+     */
+    ProjectManagementRequestHandler.prototype.getResource = function (parentResourceName) {
+        return this.invokeRequestHandler('GET', parentResourceName, /* requestData */ null, 'v1beta1');
+    };
+    /**
+     * @param {string} resourceName Fully-qualified resource name of the entity that you want to
+     *     delete.
+     */
+    ProjectManagementRequestHandler.prototype.deleteResource = function (resourceName) {
+        return this
+            .invokeRequestHandler('DELETE', resourceName, /* requestData */ null, 'v1beta1')
+            .then(function () { return undefined; });
+    };
+    ProjectManagementRequestHandler.prototype.pollRemoteOperationWithExponentialBackoff = function (operationResourceName) {
+        var _this = this;
+        var poller = new api_request_1.ExponentialBackoffPoller();
+        return poller.poll(function () {
+            return _this.invokeRequestHandler('GET', operationResourceName, /* requestData */ null)
+                .then(function (responseData) {
+                if (responseData.error) {
+                    var errStatusCode = responseData.error.code || 500;
+                    var errText = responseData.error.message || JSON.stringify(responseData.error);
+                    ProjectManagementRequestHandler.wrapAndRethrowHttpError(errStatusCode, errText);
+                }
+                if (!responseData.done) {
+                    // Continue polling.
+                    return null;
+                }
+                // Polling complete. Resolve with operation response JSON.
+                return responseData.response;
+            });
+        });
+    };
+    /**
+     * Invokes the request handler with the provided request data.
+     */
+    ProjectManagementRequestHandler.prototype.invokeRequestHandler = function (method, path, requestData, apiVersion) {
+        if (apiVersion === void 0) { apiVersion = 'v1'; }
+        var baseUrlToUse = (apiVersion === 'v1') ? this.baseUrl : this.baseBetaUrl;
+        var request = {
+            method: method,
+            url: "" + baseUrlToUse + path,
+            headers: PROJECT_MANAGEMENT_HEADERS,
+            data: requestData,
+            timeout: PROJECT_MANAGEMENT_TIMEOUT_MILLIS,
+        };
+        return this.httpClient.send(request)
+            .then(function (response) {
+            // Send non-JSON responses to the catch() below, where they will be treated as errors.
+            if (!response.isJson()) {
+                throw new api_request_1.HttpError(response);
+            }
+            return response.data;
+        })
+            .catch(function (err) {
+            if (err instanceof api_request_1.HttpError) {
+                ProjectManagementRequestHandler.wrapAndRethrowHttpError(err.response.status, err.response.text);
+            }
+            throw err;
+        });
+    };
+    return ProjectManagementRequestHandler;
+}());
+exports.ProjectManagementRequestHandler = ProjectManagementRequestHandler;

node_modules/firebase-admin/lib/project-management/project-management.js

@@ -0,0 +1,224 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2018 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var error_1 = require("../utils/error");
+var utils = require("../utils/index");
+var validator = require("../utils/validator");
+var android_app_1 = require("./android-app");
+var ios_app_1 = require("./ios-app");
+var project_management_api_request_1 = require("./project-management-api-request");
+var app_metadata_1 = require("./app-metadata");
+/**
+ * Internals of a Project Management instance.
+ */
+var ProjectManagementInternals = /** @class */ (function () {
+    function ProjectManagementInternals() {
+    }
+    /**
+     * Deletes the service and its associated resources.
+     *
+     * @return {Promise<void>} An empty Promise that will be resolved when the service is deleted.
+     */
+    ProjectManagementInternals.prototype.delete = function () {
+        // There are no resources to clean up.
+        return Promise.resolve();
+    };
+    return ProjectManagementInternals;
+}());
+/**
+ * ProjectManagement service bound to the provided app.
+ */
+var ProjectManagement = /** @class */ (function () {
+    /**
+     * @param {object} app The app for this ProjectManagement service.
+     * @constructor
+     */
+    function ProjectManagement(app) {
+        this.app = app;
+        this.INTERNAL = new ProjectManagementInternals();
+        if (!validator.isNonNullObject(app) || !('options' in app)) {
+            throw new error_1.FirebaseProjectManagementError('invalid-argument', 'First argument passed to admin.projectManagement() must be a valid Firebase app '
+                + 'instance.');
+        }
+        this.requestHandler = new project_management_api_request_1.ProjectManagementRequestHandler(app);
+    }
+    /**
+     * Lists up to 100 Firebase Android apps associated with this Firebase project.
+     */
+    ProjectManagement.prototype.listAndroidApps = function () {
+        return this.listPlatformApps('android', 'listAndroidApps()');
+    };
+    /**
+     * Lists up to 100 Firebase iOS apps associated with this Firebase project.
+     */
+    ProjectManagement.prototype.listIosApps = function () {
+        return this.listPlatformApps('ios', 'listIosApps()');
+    };
+    /**
+     * Returns an AndroidApp object for the given appId. No RPC is made.
+     */
+    ProjectManagement.prototype.androidApp = function (appId) {
+        return new android_app_1.AndroidApp(appId, this.requestHandler);
+    };
+    /**
+     * Returns an IosApp object for the given appId. No RPC is made.
+     */
+    ProjectManagement.prototype.iosApp = function (appId) {
+        return new ios_app_1.IosApp(appId, this.requestHandler);
+    };
+    /**
+     * Returns a ShaCertificate object for the given shaHash. No RPC is made.
+     */
+    ProjectManagement.prototype.shaCertificate = function (shaHash) {
+        return new android_app_1.ShaCertificate(shaHash);
+    };
+    /**
+     * Creates a new Firebase Android app, associated with this Firebase project.
+     */
+    ProjectManagement.prototype.createAndroidApp = function (packageName, displayName) {
+        var _this = this;
+        return this.getResourceName()
+            .then(function (resourceName) {
+            return _this.requestHandler.createAndroidApp(resourceName, packageName, displayName);
+        })
+            .then(function (responseData) {
+            project_management_api_request_1.assertServerResponse(validator.isNonNullObject(responseData), responseData, 'createAndroidApp()\'s responseData must be a non-null object.');
+            project_management_api_request_1.assertServerResponse(validator.isNonEmptyString(responseData.appId), responseData, "\"responseData.appId\" field must be present in createAndroidApp()'s response data.");
+            return new android_app_1.AndroidApp(responseData.appId, _this.requestHandler);
+        });
+    };
+    /**
+     * Creates a new Firebase iOS app, associated with this Firebase project.
+     */
+    ProjectManagement.prototype.createIosApp = function (bundleId, displayName) {
+        var _this = this;
+        return this.getResourceName()
+            .then(function (resourceName) {
+            return _this.requestHandler.createIosApp(resourceName, bundleId, displayName);
+        })
+            .then(function (responseData) {
+            project_management_api_request_1.assertServerResponse(validator.isNonNullObject(responseData), responseData, 'createIosApp()\'s responseData must be a non-null object.');
+            project_management_api_request_1.assertServerResponse(validator.isNonEmptyString(responseData.appId), responseData, "\"responseData.appId\" field must be present in createIosApp()'s response data.");
+            return new ios_app_1.IosApp(responseData.appId, _this.requestHandler);
+        });
+    };
+    /**
+     * Lists up to 100 Firebase apps associated with this Firebase project.
+     */
+    ProjectManagement.prototype.listAppMetadata = function () {
+        var _this = this;
+        return this.getResourceName()
+            .then(function (resourceName) {
+            return _this.requestHandler.listAppMetadata(resourceName);
+        })
+            .then(function (responseData) {
+            return _this.getProjectId()
+                .then(function (projectId) {
+                return _this.transformResponseToAppMetadata(responseData, projectId);
+            });
+        });
+    };
+    /**
+     * Update display name of the project
+     */
+    ProjectManagement.prototype.setDisplayName = function (newDisplayName) {
+        var _this = this;
+        return this.getResourceName()
+            .then(function (resourceName) {
+            return _this.requestHandler.setDisplayName(resourceName, newDisplayName);
+        });
+    };
+    ProjectManagement.prototype.transformResponseToAppMetadata = function (responseData, projectId) {
+        this.assertListAppsResponseData(responseData, 'listAppMetadata()');
+        if (!responseData.apps) {
+            return [];
+        }
+        return responseData.apps.map(function (appJson) {
+            project_management_api_request_1.assertServerResponse(validator.isNonEmptyString(appJson.appId), responseData, "\"apps[].appId\" field must be present in the listAppMetadata() response data.");
+            project_management_api_request_1.assertServerResponse(validator.isNonEmptyString(appJson.platform), responseData, "\"apps[].platform\" field must be present in the listAppMetadata() response data.");
+            var metadata = {
+                appId: appJson.appId,
+                platform: app_metadata_1.AppPlatform[appJson.platform] || app_metadata_1.AppPlatform.PLATFORM_UNKNOWN,
+                projectId: projectId,
+                resourceName: appJson.name,
+            };
+            if (appJson.displayName) {
+                metadata.displayName = appJson.displayName;
+            }
+            return metadata;
+        });
+    };
+    ProjectManagement.prototype.getResourceName = function () {
+        return this.getProjectId()
+            .then(function (projectId) {
+            return "projects/" + projectId;
+        });
+    };
+    ProjectManagement.prototype.getProjectId = function () {
+        var _this = this;
+        if (this.projectId) {
+            return Promise.resolve(this.projectId);
+        }
+        return utils.findProjectId(this.app)
+            .then(function (projectId) {
+            // Assert that a specific project ID was provided within the app.
+            if (!validator.isNonEmptyString(projectId)) {
+                throw new error_1.FirebaseProjectManagementError('invalid-project-id', 'Failed to determine project ID. Initialize the SDK with service account credentials, or '
+                    + 'set project ID as an app option. Alternatively, set the GOOGLE_CLOUD_PROJECT '
+                    + 'environment variable.');
+            }
+            _this.projectId = projectId;
+            return _this.projectId;
+        });
+    };
+    /**
+     * Lists up to 100 Firebase apps for a specified platform, associated with this Firebase project.
+     */
+    ProjectManagement.prototype.listPlatformApps = function (platform, callerName) {
+        var _this = this;
+        return this.getResourceName()
+            .then(function (resourceName) {
+            return (platform === 'android') ?
+                _this.requestHandler.listAndroidApps(resourceName)
+                : _this.requestHandler.listIosApps(resourceName);
+        })
+            .then(function (responseData) {
+            _this.assertListAppsResponseData(responseData, callerName);
+            if (!responseData.apps) {
+                return [];
+            }
+            return responseData.apps.map(function (appJson) {
+                project_management_api_request_1.assertServerResponse(validator.isNonEmptyString(appJson.appId), responseData, "\"apps[].appId\" field must be present in the " + callerName + " response data.");
+                if (platform === 'android') {
+                    return new android_app_1.AndroidApp(appJson.appId, _this.requestHandler);
+                }
+                else {
+                    return new ios_app_1.IosApp(appJson.appId, _this.requestHandler);
+                }
+            });
+        });
+    };
+    ProjectManagement.prototype.assertListAppsResponseData = function (responseData, callerName) {
+        project_management_api_request_1.assertServerResponse(validator.isNonNullObject(responseData), responseData, callerName + "'s responseData must be a non-null object.");
+        if (responseData.apps) {
+            project_management_api_request_1.assertServerResponse(validator.isArray(responseData.apps), responseData, "\"apps\" field must be present in the " + callerName + " response data.");
+        }
+    };
+    return ProjectManagement;
+}());
+exports.ProjectManagement = ProjectManagement;

node_modules/firebase-admin/lib/security-rules/security-rules-api-client.js

@@ -0,0 +1,236 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2019 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var api_request_1 = require("../utils/api-request");
+var error_1 = require("../utils/error");
+var security_rules_utils_1 = require("./security-rules-utils");
+var utils = require("../utils/index");
+var validator = require("../utils/validator");
+var RULES_V1_API = 'https://firebaserules.googleapis.com/v1';
+var FIREBASE_VERSION_HEADER = {
+    'X-Firebase-Client': 'fire-admin-node/8.9.2',
+};
+/**
+ * Class that facilitates sending requests to the Firebase security rules backend API.
+ *
+ * @private
+ */
+var SecurityRulesApiClient = /** @class */ (function () {
+    function SecurityRulesApiClient(app) {
+        this.app = app;
+        if (!validator.isNonNullObject(app) || !('options' in app)) {
+            throw new security_rules_utils_1.FirebaseSecurityRulesError('invalid-argument', 'First argument passed to admin.securityRules() must be a valid Firebase app '
+                + 'instance.');
+        }
+        this.httpClient = new api_request_1.AuthorizedHttpClient(app);
+    }
+    SecurityRulesApiClient.prototype.getRuleset = function (name) {
+        var _this = this;
+        return Promise.resolve()
+            .then(function () {
+            return _this.getRulesetName(name);
+        })
+            .then(function (rulesetName) {
+            return _this.getResource(rulesetName);
+        });
+    };
+    SecurityRulesApiClient.prototype.createRuleset = function (ruleset) {
+        var _this = this;
+        if (!validator.isNonNullObject(ruleset) ||
+            !validator.isNonNullObject(ruleset.source) ||
+            !validator.isNonEmptyArray(ruleset.source.files)) {
+            var err = new security_rules_utils_1.FirebaseSecurityRulesError('invalid-argument', 'Invalid rules content.');
+            return Promise.reject(err);
+        }
+        for (var _i = 0, _a = ruleset.source.files; _i < _a.length; _i++) {
+            var rf = _a[_i];
+            if (!validator.isNonNullObject(rf) ||
+                !validator.isNonEmptyString(rf.name) ||
+                !validator.isNonEmptyString(rf.content)) {
+                var err = new security_rules_utils_1.FirebaseSecurityRulesError('invalid-argument', "Invalid rules file argument: " + JSON.stringify(rf));
+                return Promise.reject(err);
+            }
+        }
+        return this.getUrl()
+            .then(function (url) {
+            var request = {
+                method: 'POST',
+                url: url + "/rulesets",
+                data: ruleset,
+            };
+            return _this.sendRequest(request);
+        });
+    };
+    SecurityRulesApiClient.prototype.deleteRuleset = function (name) {
+        var _this = this;
+        return this.getUrl()
+            .then(function (url) {
+            var rulesetName = _this.getRulesetName(name);
+            var request = {
+                method: 'DELETE',
+                url: url + "/" + rulesetName,
+            };
+            return _this.sendRequest(request);
+        });
+    };
+    SecurityRulesApiClient.prototype.listRulesets = function (pageSize, pageToken) {
+        var _this = this;
+        if (pageSize === void 0) { pageSize = 100; }
+        if (!validator.isNumber(pageSize)) {
+            var err = new security_rules_utils_1.FirebaseSecurityRulesError('invalid-argument', 'Invalid page size.');
+            return Promise.reject(err);
+        }
+        if (pageSize < 1 || pageSize > 100) {
+            var err = new security_rules_utils_1.FirebaseSecurityRulesError('invalid-argument', 'Page size must be between 1 and 100.');
+            return Promise.reject(err);
+        }
+        if (typeof pageToken !== 'undefined' && !validator.isNonEmptyString(pageToken)) {
+            var err = new security_rules_utils_1.FirebaseSecurityRulesError('invalid-argument', 'Next page token must be a non-empty string.');
+            return Promise.reject(err);
+        }
+        var data = {
+            pageSize: pageSize,
+            pageToken: pageToken,
+        };
+        if (!pageToken) {
+            delete data.pageToken;
+        }
+        return this.getUrl()
+            .then(function (url) {
+            var request = {
+                method: 'GET',
+                url: url + "/rulesets",
+                data: data,
+            };
+            return _this.sendRequest(request);
+        });
+    };
+    SecurityRulesApiClient.prototype.getRelease = function (name) {
+        return this.getResource("releases/" + name);
+    };
+    SecurityRulesApiClient.prototype.updateRelease = function (name, rulesetName) {
+        var _this = this;
+        return this.getUrl()
+            .then(function (url) {
+            return _this.getReleaseDescription(name, rulesetName)
+                .then(function (release) {
+                var request = {
+                    method: 'PATCH',
+                    url: url + "/releases/" + name,
+                    data: { release: release },
+                };
+                return _this.sendRequest(request);
+            });
+        });
+    };
+    SecurityRulesApiClient.prototype.getUrl = function () {
+        return this.getProjectIdPrefix()
+            .then(function (projectIdPrefix) {
+            return RULES_V1_API + "/" + projectIdPrefix;
+        });
+    };
+    SecurityRulesApiClient.prototype.getProjectIdPrefix = function () {
+        var _this = this;
+        if (this.projectIdPrefix) {
+            return Promise.resolve(this.projectIdPrefix);
+        }
+        return utils.findProjectId(this.app)
+            .then(function (projectId) {
+            if (!validator.isNonEmptyString(projectId)) {
+                throw new security_rules_utils_1.FirebaseSecurityRulesError('invalid-argument', 'Failed to determine project ID. Initialize the SDK with service account credentials, or '
+                    + 'set project ID as an app option. Alternatively, set the GOOGLE_CLOUD_PROJECT '
+                    + 'environment variable.');
+            }
+            _this.projectIdPrefix = "projects/" + projectId;
+            return _this.projectIdPrefix;
+        });
+    };
+    /**
+     * Gets the specified resource from the rules API. Resource names must be the short names without project
+     * ID prefix (e.g. `rulesets/ruleset-name`).
+     *
+     * @param {string} name Full qualified name of the resource to get.
+     * @returns {Promise<T>} A promise that fulfills with the resource.
+     */
+    SecurityRulesApiClient.prototype.getResource = function (name) {
+        var _this = this;
+        return this.getUrl()
+            .then(function (url) {
+            var request = {
+                method: 'GET',
+                url: url + "/" + name,
+            };
+            return _this.sendRequest(request);
+        });
+    };
+    SecurityRulesApiClient.prototype.getReleaseDescription = function (name, rulesetName) {
+        var _this = this;
+        return this.getProjectIdPrefix()
+            .then(function (projectIdPrefix) {
+            return {
+                name: projectIdPrefix + "/releases/" + name,
+                rulesetName: projectIdPrefix + "/" + _this.getRulesetName(rulesetName),
+            };
+        });
+    };
+    SecurityRulesApiClient.prototype.getRulesetName = function (name) {
+        if (!validator.isNonEmptyString(name)) {
+            throw new security_rules_utils_1.FirebaseSecurityRulesError('invalid-argument', 'Ruleset name must be a non-empty string.');
+        }
+        if (name.indexOf('/') !== -1) {
+            throw new security_rules_utils_1.FirebaseSecurityRulesError('invalid-argument', 'Ruleset name must not contain any "/" characters.');
+        }
+        return "rulesets/" + name;
+    };
+    SecurityRulesApiClient.prototype.sendRequest = function (request) {
+        var _this = this;
+        request.headers = FIREBASE_VERSION_HEADER;
+        return this.httpClient.send(request)
+            .then(function (resp) {
+            return resp.data;
+        })
+            .catch(function (err) {
+            throw _this.toFirebaseError(err);
+        });
+    };
+    SecurityRulesApiClient.prototype.toFirebaseError = function (err) {
+        if (err instanceof error_1.PrefixedFirebaseError) {
+            return err;
+        }
+        var response = err.response;
+        if (!response.isJson()) {
+            return new security_rules_utils_1.FirebaseSecurityRulesError('unknown-error', "Unexpected response with status: " + response.status + " and body: " + response.text);
+        }
+        var error = response.data.error || {};
+        var code = 'unknown-error';
+        if (error.status && error.status in ERROR_CODE_MAPPING) {
+            code = ERROR_CODE_MAPPING[error.status];
+        }
+        var message = error.message || "Unknown server error: " + response.text;
+        return new security_rules_utils_1.FirebaseSecurityRulesError(code, message);
+    };
+    return SecurityRulesApiClient;
+}());
+exports.SecurityRulesApiClient = SecurityRulesApiClient;
+var ERROR_CODE_MAPPING = {
+    INVALID_ARGUMENT: 'invalid-argument',
+    NOT_FOUND: 'not-found',
+    RESOURCE_EXHAUSTED: 'resource-exhausted',
+    UNAUTHENTICATED: 'authentication-error',
+    UNKNOWN: 'unknown-error',
+};

node_modules/firebase-admin/lib/security-rules/security-rules-utils.js

@@ -0,0 +1,40 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2019 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+var __extends = (this && this.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (b.hasOwnProperty(p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+var error_1 = require("../utils/error");
+var FirebaseSecurityRulesError = /** @class */ (function (_super) {
+    __extends(FirebaseSecurityRulesError, _super);
+    function FirebaseSecurityRulesError(code, message) {
+        return _super.call(this, 'security-rules', code, message) || this;
+    }
+    return FirebaseSecurityRulesError;
+}(error_1.PrefixedFirebaseError));
+exports.FirebaseSecurityRulesError = FirebaseSecurityRulesError;

node_modules/firebase-admin/lib/security-rules/security-rules.js

@@ -0,0 +1,302 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2019 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var validator = require("../utils/validator");
+var security_rules_api_client_1 = require("./security-rules-api-client");
+var security_rules_utils_1 = require("./security-rules-utils");
+var RulesetMetadataListImpl = /** @class */ (function () {
+    function RulesetMetadataListImpl(response) {
+        if (!validator.isNonNullObject(response) || !validator.isArray(response.rulesets)) {
+            throw new security_rules_utils_1.FirebaseSecurityRulesError('invalid-argument', "Invalid ListRulesets response: " + JSON.stringify(response));
+        }
+        this.rulesets = response.rulesets.map(function (rs) {
+            return {
+                name: stripProjectIdPrefix(rs.name),
+                createTime: new Date(rs.createTime).toUTCString(),
+            };
+        });
+        if (response.nextPageToken) {
+            this.nextPageToken = response.nextPageToken;
+        }
+    }
+    return RulesetMetadataListImpl;
+}());
+/**
+ * Represents a set of Firebase security rules.
+ */
+var Ruleset = /** @class */ (function () {
+    function Ruleset(ruleset) {
+        if (!validator.isNonNullObject(ruleset) ||
+            !validator.isNonEmptyString(ruleset.name) ||
+            !validator.isNonEmptyString(ruleset.createTime) ||
+            !validator.isNonNullObject(ruleset.source)) {
+            throw new security_rules_utils_1.FirebaseSecurityRulesError('invalid-argument', "Invalid Ruleset response: " + JSON.stringify(ruleset));
+        }
+        this.name = stripProjectIdPrefix(ruleset.name);
+        this.createTime = new Date(ruleset.createTime).toUTCString();
+        this.source = ruleset.source.files || [];
+    }
+    return Ruleset;
+}());
+exports.Ruleset = Ruleset;
+/**
+ * SecurityRules service bound to the provided app.
+ */
+var SecurityRules = /** @class */ (function () {
+    /**
+     * @param {object} app The app for this SecurityRules service.
+     * @constructor
+     */
+    function SecurityRules(app) {
+        this.app = app;
+        this.INTERNAL = new SecurityRulesInternals();
+        this.client = new security_rules_api_client_1.SecurityRulesApiClient(app);
+    }
+    /**
+     * Gets the Ruleset identified by the given name. The input name should be the short name string without
+     * the project ID prefix. For example, to retrieve the `projects/project-id/rulesets/my-ruleset`, pass the
+     * short name "my-ruleset". Rejects with a `not-found` error if the specified Ruleset cannot be found.
+     *
+     * @param {string} name Name of the Ruleset to retrieve.
+     * @returns {Promise<Ruleset>} A promise that fulfills with the specified Ruleset.
+     */
+    SecurityRules.prototype.getRuleset = function (name) {
+        return this.client.getRuleset(name)
+            .then(function (rulesetResponse) {
+            return new Ruleset(rulesetResponse);
+        });
+    };
+    /**
+     * Gets the Ruleset currently applied to Cloud Firestore. Rejects with a `not-found` error if no Ruleset is
+     * applied on Firestore.
+     *
+     * @returns {Promise<Ruleset>} A promise that fulfills with the Firestore Ruleset.
+     */
+    SecurityRules.prototype.getFirestoreRuleset = function () {
+        return this.getRulesetForRelease(SecurityRules.CLOUD_FIRESTORE);
+    };
+    /**
+     * Creates a new ruleset from the given source, and applies it to Cloud Firestore.
+     *
+     * @param {string|Buffer} source Rules source to apply.
+     * @returns {Promise<Ruleset>} A promise that fulfills when the ruleset is created and released.
+     */
+    SecurityRules.prototype.releaseFirestoreRulesetFromSource = function (source) {
+        var _this = this;
+        return Promise.resolve()
+            .then(function () {
+            var rulesFile = _this.createRulesFileFromSource('firestore.rules', source);
+            return _this.createRuleset(rulesFile);
+        })
+            .then(function (ruleset) {
+            return _this.releaseFirestoreRuleset(ruleset)
+                .then(function () {
+                return ruleset;
+            });
+        });
+    };
+    /**
+     * Makes the specified ruleset the currently applied ruleset for Cloud Firestore.
+     *
+     * @param {string|RulesetMetadata} ruleset Name of the ruleset to apply or a RulesetMetadata object containing
+     *   the name.
+     * @returns {Promise<void>} A promise that fulfills when the ruleset is released.
+     */
+    SecurityRules.prototype.releaseFirestoreRuleset = function (ruleset) {
+        return this.releaseRuleset(ruleset, SecurityRules.CLOUD_FIRESTORE);
+    };
+    /**
+     * Gets the Ruleset currently applied to a Cloud Storage bucket. Rejects with a `not-found` error if no Ruleset is
+     * applied on the bucket.
+     *
+     * @param {string=} bucket Optional name of the Cloud Storage bucket to be retrieved. If not specified,
+     *   retrieves the ruleset applied on the default bucket configured via `AppOptions`.
+     * @returns {Promise<Ruleset>} A promise that fulfills with the Cloud Storage Ruleset.
+     */
+    SecurityRules.prototype.getStorageRuleset = function (bucket) {
+        var _this = this;
+        return Promise.resolve()
+            .then(function () {
+            return _this.getBucketName(bucket);
+        })
+            .then(function (bucketName) {
+            return _this.getRulesetForRelease(SecurityRules.FIREBASE_STORAGE + "/" + bucketName);
+        });
+    };
+    /**
+     * Creates a new ruleset from the given source, and applies it to a Cloud Storage bucket.
+     *
+     * @param {string|Buffer} source Rules source to apply.
+     * @param {string=} bucket Optional name of the Cloud Storage bucket to apply the rules on. If not specified,
+     *   applies the ruleset on the default bucket configured via `AppOptions`.
+     * @returns {Promise<Ruleset>} A promise that fulfills when the ruleset is created and released.
+     */
+    SecurityRules.prototype.releaseStorageRulesetFromSource = function (source, bucket) {
+        var _this = this;
+        return Promise.resolve()
+            .then(function () {
+            // Bucket name is not required until the last step. But since there's a createRuleset step
+            // before then, make sure to run this check and fail early if the bucket name is invalid.
+            _this.getBucketName(bucket);
+            var rulesFile = _this.createRulesFileFromSource('storage.rules', source);
+            return _this.createRuleset(rulesFile);
+        })
+            .then(function (ruleset) {
+            return _this.releaseStorageRuleset(ruleset, bucket)
+                .then(function () {
+                return ruleset;
+            });
+        });
+    };
+    /**
+     * Makes the specified ruleset the currently applied ruleset for a Cloud Storage bucket.
+     *
+     * @param {string|RulesetMetadata} ruleset Name of the ruleset to apply or a RulesetMetadata object containing
+     *   the name.
+     * @param {string=} bucket Optional name of the Cloud Storage bucket to apply the rules on. If not specified,
+     *   applies the ruleset on the default bucket configured via `AppOptions`.
+     * @returns {Promise<void>} A promise that fulfills when the ruleset is released.
+     */
+    SecurityRules.prototype.releaseStorageRuleset = function (ruleset, bucket) {
+        var _this = this;
+        return Promise.resolve()
+            .then(function () {
+            return _this.getBucketName(bucket);
+        })
+            .then(function (bucketName) {
+            return _this.releaseRuleset(ruleset, SecurityRules.FIREBASE_STORAGE + "/" + bucketName);
+        });
+    };
+    /**
+     * Creates a `RulesFile` with the given name and source. Throws if any of the arguments are invalid. This is a
+     * local operation, and does not involve any network API calls.
+     *
+     * @param {string} name Name to assign to the rules file.
+     * @param {string|Buffer} source Contents of the rules file.
+     * @returns {RulesFile} A new rules file instance.
+     */
+    SecurityRules.prototype.createRulesFileFromSource = function (name, source) {
+        if (!validator.isNonEmptyString(name)) {
+            throw new security_rules_utils_1.FirebaseSecurityRulesError('invalid-argument', 'Name must be a non-empty string.');
+        }
+        var content;
+        if (validator.isNonEmptyString(source)) {
+            content = source;
+        }
+        else if (validator.isBuffer(source)) {
+            content = source.toString('utf-8');
+        }
+        else {
+            throw new security_rules_utils_1.FirebaseSecurityRulesError('invalid-argument', 'Source must be a non-empty string or a Buffer.');
+        }
+        return {
+            name: name,
+            content: content,
+        };
+    };
+    /**
+     * Creates a new `Ruleset` from the given `RulesFile`.
+     *
+     * @param {RulesFile} file Rules file to include in the new Ruleset.
+     * @returns {Promise<Ruleset>} A promise that fulfills with the newly created Ruleset.
+     */
+    SecurityRules.prototype.createRuleset = function (file) {
+        var ruleset = {
+            source: {
+                files: [file],
+            },
+        };
+        return this.client.createRuleset(ruleset)
+            .then(function (rulesetResponse) {
+            return new Ruleset(rulesetResponse);
+        });
+    };
+    /**
+     * Deletes the Ruleset identified by the given name. The input name should be the short name string without
+     * the project ID prefix. For example, to delete the `projects/project-id/rulesets/my-ruleset`, pass the
+     * short name "my-ruleset". Rejects with a `not-found` error if the specified Ruleset cannot be found.
+     *
+     * @param {string} name Name of the Ruleset to delete.
+     * @returns {Promise<Ruleset>} A promise that fulfills when the Ruleset is deleted.
+     */
+    SecurityRules.prototype.deleteRuleset = function (name) {
+        return this.client.deleteRuleset(name);
+    };
+    /**
+     * Retrieves a page of rulesets.
+     *
+     * @param {number=} pageSize The page size, 100 if undefined. This is also the maximum allowed limit.
+     * @param {string=} nextPageToken The next page token. If not specified, returns rulesets starting
+     *   without any offset.
+     * @returns {Promise<RulesetMetadataList>} A promise that fulfills a page of rulesets.
+     */
+    SecurityRules.prototype.listRulesetMetadata = function (pageSize, nextPageToken) {
+        if (pageSize === void 0) { pageSize = 100; }
+        return this.client.listRulesets(pageSize, nextPageToken)
+            .then(function (response) {
+            return new RulesetMetadataListImpl(response);
+        });
+    };
+    SecurityRules.prototype.getRulesetForRelease = function (releaseName) {
+        var _this = this;
+        return this.client.getRelease(releaseName)
+            .then(function (release) {
+            var rulesetName = release.rulesetName;
+            if (!validator.isNonEmptyString(rulesetName)) {
+                throw new security_rules_utils_1.FirebaseSecurityRulesError('not-found', "Ruleset name not found for " + releaseName + ".");
+            }
+            return _this.getRuleset(stripProjectIdPrefix(rulesetName));
+        });
+    };
+    SecurityRules.prototype.releaseRuleset = function (ruleset, releaseName) {
+        if (!validator.isNonEmptyString(ruleset) &&
+            (!validator.isNonNullObject(ruleset) || !validator.isNonEmptyString(ruleset.name))) {
+            var err = new security_rules_utils_1.FirebaseSecurityRulesError('invalid-argument', 'ruleset must be a non-empty name or a RulesetMetadata object.');
+            return Promise.reject(err);
+        }
+        var rulesetName = validator.isString(ruleset) ? ruleset : ruleset.name;
+        return this.client.updateRelease(releaseName, rulesetName)
+            .then(function () {
+            return;
+        });
+    };
+    SecurityRules.prototype.getBucketName = function (bucket) {
+        var bucketName = (typeof bucket !== 'undefined') ? bucket : this.app.options.storageBucket;
+        if (!validator.isNonEmptyString(bucketName)) {
+            throw new security_rules_utils_1.FirebaseSecurityRulesError('invalid-argument', 'Bucket name not specified or invalid. Specify a default bucket name via the ' +
+                'storageBucket option when initializing the app, or specify the bucket name ' +
+                'explicitly when calling the rules API.');
+        }
+        return bucketName;
+    };
+    SecurityRules.CLOUD_FIRESTORE = 'cloud.firestore';
+    SecurityRules.FIREBASE_STORAGE = 'firebase.storage';
+    return SecurityRules;
+}());
+exports.SecurityRules = SecurityRules;
+var SecurityRulesInternals = /** @class */ (function () {
+    function SecurityRulesInternals() {
+    }
+    SecurityRulesInternals.prototype.delete = function () {
+        return Promise.resolve();
+    };
+    return SecurityRulesInternals;
+}());
+function stripProjectIdPrefix(name) {
+    return name.split('/').pop();
+}

node_modules/firebase-admin/lib/storage/storage.js

@@ -0,0 +1,130 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2017 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var error_1 = require("../utils/error");
+var credential_1 = require("../auth/credential");
+var utils = require("../utils/index");
+var validator = require("../utils/validator");
+/**
+ * Internals of a Storage instance.
+ */
+var StorageInternals = /** @class */ (function () {
+    function StorageInternals() {
+    }
+    /**
+     * Deletes the service and its associated resources.
+     *
+     * @return {Promise<()>} An empty Promise that will be fulfilled when the service is deleted.
+     */
+    StorageInternals.prototype.delete = function () {
+        // There are no resources to clean up.
+        return Promise.resolve();
+    };
+    return StorageInternals;
+}());
+/**
+ * Storage service bound to the provided app.
+ */
+var Storage = /** @class */ (function () {
+    /**
+     * @param {FirebaseApp} app The app for this Storage service.
+     * @constructor
+     */
+    function Storage(app) {
+        this.INTERNAL = new StorageInternals();
+        if (!validator.isNonNullObject(app) || !('options' in app)) {
+            throw new error_1.FirebaseError({
+                code: 'storage/invalid-argument',
+                message: 'First argument passed to admin.storage() must be a valid Firebase app instance.',
+            });
+        }
+        var storage;
+        try {
+            storage = require('@google-cloud/storage').Storage;
+        }
+        catch (err) {
+            throw new error_1.FirebaseError({
+                code: 'storage/missing-dependencies',
+                message: 'Failed to import the Cloud Storage client library for Node.js. '
+                    + 'Make sure to install the "@google-cloud/storage" npm package. '
+                    + ("Original error: " + err),
+            });
+        }
+        var projectId = utils.getExplicitProjectId(app);
+        var credential = app.options.credential;
+        if (credential instanceof credential_1.ServiceAccountCredential) {
+            this.storageClient = new storage({
+                // When the SDK is initialized with ServiceAccountCredentials an explicit projectId is
+                // guaranteed to be available.
+                projectId: projectId,
+                credentials: {
+                    private_key: credential.privateKey,
+                    client_email: credential.clientEmail,
+                },
+            });
+        }
+        else if (credential_1.isApplicationDefault(app.options.credential)) {
+            // Try to use the Google application default credentials.
+            this.storageClient = new storage();
+        }
+        else {
+            throw new error_1.FirebaseError({
+                code: 'storage/invalid-credential',
+                message: 'Failed to initialize Google Cloud Storage client with the available credential. ' +
+                    'Must initialize the SDK with a certificate credential or application default credentials ' +
+                    'to use Cloud Storage API.',
+            });
+        }
+        this.appInternal = app;
+    }
+    /**
+     * Returns a reference to a Google Cloud Storage bucket. Returned reference can be used to upload
+     * and download content from Google Cloud Storage.
+     *
+     * @param {string=} name Optional name of the bucket to be retrieved. If name is not specified,
+     *   retrieves a reference to the default bucket.
+     * @return {Bucket} A Bucket object from the @google-cloud/storage library.
+     */
+    Storage.prototype.bucket = function (name) {
+        var bucketName = (typeof name !== 'undefined')
+            ? name : this.appInternal.options.storageBucket;
+        if (validator.isNonEmptyString(bucketName)) {
+            return this.storageClient.bucket(bucketName);
+        }
+        throw new error_1.FirebaseError({
+            code: 'storage/invalid-argument',
+            message: 'Bucket name not specified or invalid. Specify a valid bucket name via the ' +
+                'storageBucket option when initializing the app, or specify the bucket name ' +
+                'explicitly when calling the getBucket() method.',
+        });
+    };
+    Object.defineProperty(Storage.prototype, "app", {
+        /**
+         * Returns the app associated with this Storage instance.
+         *
+         * @return {FirebaseApp} The app associated with this Storage instance.
+         */
+        get: function () {
+            return this.appInternal;
+        },
+        enumerable: true,
+        configurable: true
+    });
+    return Storage;
+}());
+exports.Storage = Storage;

node_modules/firebase-admin/lib/utils/api-request.js

@@ -0,0 +1,833 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2017 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+var __extends = (this && this.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (b.hasOwnProperty(p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+var error_1 = require("./error");
+var validator = require("./validator");
+var http = require("http");
+var https = require("https");
+var url = require("url");
+var events_1 = require("events");
+var DefaultHttpResponse = /** @class */ (function () {
+    /**
+     * Constructs a new HttpResponse from the given LowLevelResponse.
+     */
+    function DefaultHttpResponse(resp) {
+        this.status = resp.status;
+        this.headers = resp.headers;
+        this.text = resp.data;
+        try {
+            if (!resp.data) {
+                throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INTERNAL_ERROR, 'HTTP response missing data.');
+            }
+            this.parsedData = JSON.parse(resp.data);
+        }
+        catch (err) {
+            this.parsedData = undefined;
+            this.parseError = err;
+        }
+        this.request = resp.config.method + " " + resp.config.url;
+    }
+    Object.defineProperty(DefaultHttpResponse.prototype, "data", {
+        get: function () {
+            if (this.isJson()) {
+                return this.parsedData;
+            }
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.UNABLE_TO_PARSE_RESPONSE, "Error while parsing response data: \"" + this.parseError.toString() + "\". Raw server " +
+                ("response: \"" + this.text + "\". Status code: \"" + this.status + "\". Outgoing ") +
+                ("request: \"" + this.request + ".\""));
+        },
+        enumerable: true,
+        configurable: true
+    });
+    DefaultHttpResponse.prototype.isJson = function () {
+        return typeof this.parsedData !== 'undefined';
+    };
+    return DefaultHttpResponse;
+}());
+/**
+ * Represents a multipart HTTP response. Parts that constitute the response body can be accessed
+ * via the multipart getter. Getters for text and data throw errors.
+ */
+var MultipartHttpResponse = /** @class */ (function () {
+    function MultipartHttpResponse(resp) {
+        this.status = resp.status;
+        this.headers = resp.headers;
+        this.multipart = resp.multipart;
+    }
+    Object.defineProperty(MultipartHttpResponse.prototype, "text", {
+        get: function () {
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.UNABLE_TO_PARSE_RESPONSE, 'Unable to parse multipart payload as text');
+        },
+        enumerable: true,
+        configurable: true
+    });
+    Object.defineProperty(MultipartHttpResponse.prototype, "data", {
+        get: function () {
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.UNABLE_TO_PARSE_RESPONSE, 'Unable to parse multipart payload as JSON');
+        },
+        enumerable: true,
+        configurable: true
+    });
+    MultipartHttpResponse.prototype.isJson = function () {
+        return false;
+    };
+    return MultipartHttpResponse;
+}());
+var HttpError = /** @class */ (function (_super) {
+    __extends(HttpError, _super);
+    function HttpError(response) {
+        var _this = _super.call(this, "Server responded with status " + response.status + ".") || this;
+        _this.response = response;
+        // Set the prototype so that instanceof checks will work correctly.
+        // See: https://github.com/Microsoft/TypeScript/issues/13965
+        Object.setPrototypeOf(_this, HttpError.prototype);
+        return _this;
+    }
+    return HttpError;
+}(Error));
+exports.HttpError = HttpError;
+/**
+ * Default retry configuration for HTTP requests. Retries up to 4 times on connection reset and timeout errors
+ * as well as HTTP 503 errors. Exposed as a function to ensure that every HttpClient gets its own RetryConfig
+ * instance.
+ */
+function defaultRetryConfig() {
+    return {
+        maxRetries: 4,
+        statusCodes: [503],
+        ioErrorCodes: ['ECONNRESET', 'ETIMEDOUT'],
+        backOffFactor: 0.5,
+        maxDelayInMillis: 60 * 1000,
+    };
+}
+exports.defaultRetryConfig = defaultRetryConfig;
+/**
+ * Ensures that the given RetryConfig object is valid.
+ *
+ * @param retry The configuration to be validated.
+ */
+function validateRetryConfig(retry) {
+    if (!validator.isNumber(retry.maxRetries) || retry.maxRetries < 0) {
+        throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_ARGUMENT, 'maxRetries must be a non-negative integer');
+    }
+    if (typeof retry.backOffFactor !== 'undefined') {
+        if (!validator.isNumber(retry.backOffFactor) || retry.backOffFactor < 0) {
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_ARGUMENT, 'backOffFactor must be a non-negative number');
+        }
+    }
+    if (!validator.isNumber(retry.maxDelayInMillis) || retry.maxDelayInMillis < 0) {
+        throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_ARGUMENT, 'maxDelayInMillis must be a non-negative integer');
+    }
+    if (typeof retry.statusCodes !== 'undefined' && !validator.isArray(retry.statusCodes)) {
+        throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_ARGUMENT, 'statusCodes must be an array');
+    }
+    if (typeof retry.ioErrorCodes !== 'undefined' && !validator.isArray(retry.ioErrorCodes)) {
+        throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_ARGUMENT, 'ioErrorCodes must be an array');
+    }
+}
+var HttpClient = /** @class */ (function () {
+    function HttpClient(retry) {
+        if (retry === void 0) { retry = defaultRetryConfig(); }
+        this.retry = retry;
+        if (this.retry) {
+            validateRetryConfig(this.retry);
+        }
+    }
+    /**
+     * Sends an HTTP request to a remote server. If the server responds with a successful response (2xx), the returned
+     * promise resolves with an HttpResponse. If the server responds with an error (3xx, 4xx, 5xx), the promise rejects
+     * with an HttpError. In case of all other errors, the promise rejects with a FirebaseAppError. If a request fails
+     * due to a low-level network error, transparently retries the request once before rejecting the promise.
+     *
+     * If the request data is specified as an object, it will be serialized into a JSON string. The application/json
+     * content-type header will also be automatically set in this case. For all other payload types, the content-type
+     * header should be explicitly set by the caller. To send a JSON leaf value (e.g. "foo", 5), parse it into JSON,
+     * and pass as a string or a Buffer along with the appropriate content-type header.
+     *
+     * @param {HttpRequest} config HTTP request to be sent.
+     * @return {Promise<HttpResponse>} A promise that resolves with the response details.
+     */
+    HttpClient.prototype.send = function (config) {
+        return this.sendWithRetry(config);
+    };
+    /**
+     * Sends an HTTP request. In the event of an error, retries the HTTP request according to the
+     * RetryConfig set on the HttpClient.
+     *
+     * @param {HttpRequestConfig} config HTTP request to be sent.
+     * @param {number} retryAttempts Number of retries performed up to now.
+     * @return {Promise<HttpResponse>} A promise that resolves with the response details.
+     */
+    HttpClient.prototype.sendWithRetry = function (config, retryAttempts) {
+        var _this = this;
+        if (retryAttempts === void 0) { retryAttempts = 0; }
+        return AsyncHttpCall.invoke(config)
+            .then(function (resp) {
+            return _this.createHttpResponse(resp);
+        })
+            .catch(function (err) {
+            var _a = _this.getRetryDelayMillis(retryAttempts, err), delayMillis = _a[0], canRetry = _a[1];
+            if (canRetry && _this.retry && delayMillis <= _this.retry.maxDelayInMillis) {
+                return _this.waitForRetry(delayMillis).then(function () {
+                    return _this.sendWithRetry(config, retryAttempts + 1);
+                });
+            }
+            if (err.response) {
+                throw new HttpError(_this.createHttpResponse(err.response));
+            }
+            if (err.code === 'ETIMEDOUT') {
+                throw new error_1.FirebaseAppError(error_1.AppErrorCodes.NETWORK_TIMEOUT, "Error while making request: " + err.message + ".");
+            }
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.NETWORK_ERROR, "Error while making request: " + err.message + ". Error code: " + err.code);
+        });
+    };
+    HttpClient.prototype.createHttpResponse = function (resp) {
+        if (resp.multipart) {
+            return new MultipartHttpResponse(resp);
+        }
+        return new DefaultHttpResponse(resp);
+    };
+    HttpClient.prototype.waitForRetry = function (delayMillis) {
+        if (delayMillis > 0) {
+            return new Promise(function (resolve) {
+                setTimeout(resolve, delayMillis);
+            });
+        }
+        return Promise.resolve();
+    };
+    /**
+     * Checks if a failed request is eligible for a retry, and if so returns the duration to wait before initiating
+     * the retry.
+     *
+     * @param {number} retryAttempts Number of retries completed up to now.
+     * @param {LowLevelError} err The last encountered error.
+     * @returns {[number, boolean]} A 2-tuple where the 1st element is the duration to wait before another retry, and the
+     *     2nd element is a boolean indicating whether the request is eligible for a retry or not.
+     */
+    HttpClient.prototype.getRetryDelayMillis = function (retryAttempts, err) {
+        if (!this.isRetryEligible(retryAttempts, err)) {
+            return [0, false];
+        }
+        var response = err.response;
+        if (response && response.headers['retry-after']) {
+            var delayMillis = this.parseRetryAfterIntoMillis(response.headers['retry-after']);
+            if (delayMillis > 0) {
+                return [delayMillis, true];
+            }
+        }
+        return [this.backOffDelayMillis(retryAttempts), true];
+    };
+    HttpClient.prototype.isRetryEligible = function (retryAttempts, err) {
+        if (!this.retry) {
+            return false;
+        }
+        if (retryAttempts >= this.retry.maxRetries) {
+            return false;
+        }
+        if (err.response) {
+            var statusCodes = this.retry.statusCodes || [];
+            return statusCodes.indexOf(err.response.status) !== -1;
+        }
+        if (err.code) {
+            var retryCodes = this.retry.ioErrorCodes || [];
+            return retryCodes.indexOf(err.code) !== -1;
+        }
+        return false;
+    };
+    /**
+     * Parses the Retry-After HTTP header as a milliseconds value. Return value is negative if the Retry-After header
+     * contains an expired timestamp or otherwise malformed.
+     */
+    HttpClient.prototype.parseRetryAfterIntoMillis = function (retryAfter) {
+        var delaySeconds = parseInt(retryAfter, 10);
+        if (!isNaN(delaySeconds)) {
+            return delaySeconds * 1000;
+        }
+        var date = new Date(retryAfter);
+        if (!isNaN(date.getTime())) {
+            return date.getTime() - Date.now();
+        }
+        return -1;
+    };
+    HttpClient.prototype.backOffDelayMillis = function (retryAttempts) {
+        if (retryAttempts === 0) {
+            return 0;
+        }
+        if (!this.retry) {
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INTERNAL_ERROR, 'Expected this.retry to exist.');
+        }
+        var backOffFactor = this.retry.backOffFactor || 0;
+        var delayInSeconds = (Math.pow(2, retryAttempts)) * backOffFactor;
+        return Math.min(delayInSeconds * 1000, this.retry.maxDelayInMillis);
+    };
+    return HttpClient;
+}());
+exports.HttpClient = HttpClient;
+/**
+ * Parses a full HTTP response message containing both a header and a body.
+ *
+ * @param {string|Buffer} response The HTTP response to be parsed.
+ * @param {HttpRequestConfig} config The request configuration that resulted in the HTTP response.
+ * @return {HttpResponse} An object containing the parsed HTTP status, headers and the body.
+ */
+function parseHttpResponse(response, config) {
+    var responseText = validator.isBuffer(response) ?
+        response.toString('utf-8') : response;
+    var endOfHeaderPos = responseText.indexOf('\r\n\r\n');
+    var headerLines = responseText.substring(0, endOfHeaderPos).split('\r\n');
+    var statusLine = headerLines[0];
+    var status = statusLine.trim().split(/\s/)[1];
+    var headers = {};
+    headerLines.slice(1).forEach(function (line) {
+        var colonPos = line.indexOf(':');
+        var name = line.substring(0, colonPos).trim().toLowerCase();
+        var value = line.substring(colonPos + 1).trim();
+        headers[name] = value;
+    });
+    var data = responseText.substring(endOfHeaderPos + 4);
+    if (data.endsWith('\n')) {
+        data = data.slice(0, -1);
+    }
+    if (data.endsWith('\r')) {
+        data = data.slice(0, -1);
+    }
+    var lowLevelResponse = {
+        status: parseInt(status, 10),
+        headers: headers,
+        data: data,
+        config: config,
+        request: null,
+    };
+    if (!validator.isNumber(lowLevelResponse.status)) {
+        throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INTERNAL_ERROR, 'Malformed HTTP status line.');
+    }
+    return new DefaultHttpResponse(lowLevelResponse);
+}
+exports.parseHttpResponse = parseHttpResponse;
+/**
+ * A helper class for sending HTTP requests over the wire. This is a wrapper around the standard
+ * http and https packages of Node.js, providing content processing, timeouts and error handling.
+ * It also wraps the callback API of the Node.js standard library in a more flexible Promise API.
+ */
+var AsyncHttpCall = /** @class */ (function () {
+    function AsyncHttpCall(config) {
+        var _this = this;
+        try {
+            this.config = new HttpRequestConfigImpl(config);
+            this.options = this.config.buildRequestOptions();
+            this.entity = this.config.buildEntity(this.options.headers);
+            this.promise = new Promise(function (resolve, reject) {
+                _this.resolve = resolve;
+                _this.reject = reject;
+                _this.execute();
+            });
+        }
+        catch (err) {
+            this.promise = Promise.reject(this.enhanceError(err, null));
+        }
+    }
+    /**
+     * Sends an HTTP request based on the provided configuration.
+     */
+    AsyncHttpCall.invoke = function (config) {
+        return new AsyncHttpCall(config).promise;
+    };
+    AsyncHttpCall.prototype.execute = function () {
+        var _this = this;
+        var transport = this.options.protocol === 'https:' ? https : http;
+        var req = transport.request(this.options, function (res) {
+            _this.handleResponse(res, req);
+        });
+        // Handle errors
+        req.on('error', function (err) {
+            if (req.aborted) {
+                return;
+            }
+            _this.enhanceAndReject(err, null, req);
+        });
+        var timeout = this.config.timeout;
+        if (timeout) {
+            // Listen to timeouts and throw an error.
+            req.setTimeout(timeout, function () {
+                req.abort();
+                _this.rejectWithError("timeout of " + timeout + "ms exceeded", 'ETIMEDOUT', req);
+            });
+        }
+        // Send the request
+        req.end(this.entity);
+    };
+    AsyncHttpCall.prototype.handleResponse = function (res, req) {
+        if (req.aborted) {
+            return;
+        }
+        if (!res.statusCode) {
+            throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INTERNAL_ERROR, 'Expected a statusCode on the response from a ClientRequest');
+        }
+        var response = {
+            status: res.statusCode,
+            headers: res.headers,
+            request: req,
+            data: undefined,
+            config: this.config,
+        };
+        var boundary = this.getMultipartBoundary(res.headers);
+        var respStream = this.uncompressResponse(res);
+        if (boundary) {
+            this.handleMultipartResponse(response, respStream, boundary);
+        }
+        else {
+            this.handleRegularResponse(response, respStream);
+        }
+    };
+    /**
+     * Extracts multipart boundary from the HTTP header. The content-type header of a multipart
+     * response has the form 'multipart/subtype; boundary=string'.
+     *
+     * If the content-type header does not exist, or does not start with
+     * 'multipart/', then null will be returned.
+     */
+    AsyncHttpCall.prototype.getMultipartBoundary = function (headers) {
+        var contentType = headers['content-type'];
+        if (!contentType || !contentType.startsWith('multipart/')) {
+            return null;
+        }
+        var segments = contentType.split(';');
+        var emptyObject = {};
+        var headerParams = segments.slice(1)
+            .map(function (segment) { return segment.trim().split('='); })
+            .reduce(function (curr, params) {
+            // Parse key=value pairs in the content-type header into properties of an object.
+            if (params.length === 2) {
+                var keyValuePair = {};
+                keyValuePair[params[0]] = params[1];
+                return Object.assign(curr, keyValuePair);
+            }
+            return curr;
+        }, emptyObject);
+        return headerParams.boundary;
+    };
+    AsyncHttpCall.prototype.uncompressResponse = function (res) {
+        // Uncompress the response body transparently if required.
+        var respStream = res;
+        var encodings = ['gzip', 'compress', 'deflate'];
+        if (res.headers['content-encoding'] && encodings.indexOf(res.headers['content-encoding']) !== -1) {
+            // Add the unzipper to the body stream processing pipeline.
+            var zlib = require('zlib');
+            respStream = respStream.pipe(zlib.createUnzip());
+            // Remove the content-encoding in order to not confuse downstream operations.
+            delete res.headers['content-encoding'];
+        }
+        return respStream;
+    };
+    AsyncHttpCall.prototype.handleMultipartResponse = function (response, respStream, boundary) {
+        var _this = this;
+        var dicer = require('dicer');
+        var multipartParser = new dicer({ boundary: boundary });
+        var responseBuffer = [];
+        multipartParser.on('part', function (part) {
+            var tempBuffers = [];
+            part.on('data', function (partData) {
+                tempBuffers.push(partData);
+            });
+            part.on('end', function () {
+                responseBuffer.push(Buffer.concat(tempBuffers));
+            });
+        });
+        multipartParser.on('finish', function () {
+            response.data = undefined;
+            response.multipart = responseBuffer;
+            _this.finalizeResponse(response);
+        });
+        respStream.pipe(multipartParser);
+    };
+    AsyncHttpCall.prototype.handleRegularResponse = function (response, respStream) {
+        var _this = this;
+        var responseBuffer = [];
+        respStream.on('data', function (chunk) {
+            responseBuffer.push(chunk);
+        });
+        respStream.on('error', function (err) {
+            var req = response.request;
+            if (req && req.aborted) {
+                return;
+            }
+            _this.enhanceAndReject(err, null, req);
+        });
+        respStream.on('end', function () {
+            response.data = Buffer.concat(responseBuffer).toString();
+            _this.finalizeResponse(response);
+        });
+    };
+    /**
+     * Finalizes the current HTTP call in-flight by either resolving or rejecting the associated
+     * promise. In the event of an error, adds additional useful information to the returned error.
+     */
+    AsyncHttpCall.prototype.finalizeResponse = function (response) {
+        if (response.status >= 200 && response.status < 300) {
+            this.resolve(response);
+        }
+        else {
+            this.rejectWithError('Request failed with status code ' + response.status, null, response.request, response);
+        }
+    };
+    /**
+     * Creates a new error from the given message, and enhances it with other information available.
+     * Then the promise associated with this HTTP call is rejected with the resulting error.
+     */
+    AsyncHttpCall.prototype.rejectWithError = function (message, code, request, response) {
+        var error = new Error(message);
+        this.enhanceAndReject(error, code, request, response);
+    };
+    AsyncHttpCall.prototype.enhanceAndReject = function (error, code, request, response) {
+        this.reject(this.enhanceError(error, code, request, response));
+    };
+    /**
+     * Enhances the given error by adding more information to it. Specifically, the HttpRequestConfig,
+     * the underlying request and response will be attached to the error.
+     */
+    AsyncHttpCall.prototype.enhanceError = function (error, code, request, response) {
+        error.config = this.config;
+        if (code) {
+            error.code = code;
+        }
+        error.request = request;
+        error.response = response;
+        return error;
+    };
+    return AsyncHttpCall;
+}());
+/**
+ * An adapter class for extracting options and entity data from an HttpRequestConfig.
+ */
+var HttpRequestConfigImpl = /** @class */ (function () {
+    function HttpRequestConfigImpl(config) {
+        this.config = config;
+    }
+    Object.defineProperty(HttpRequestConfigImpl.prototype, "method", {
+        get: function () {
+            return this.config.method;
+        },
+        enumerable: true,
+        configurable: true
+    });
+    Object.defineProperty(HttpRequestConfigImpl.prototype, "url", {
+        get: function () {
+            return this.config.url;
+        },
+        enumerable: true,
+        configurable: true
+    });
+    Object.defineProperty(HttpRequestConfigImpl.prototype, "headers", {
+        get: function () {
+            return this.config.headers;
+        },
+        enumerable: true,
+        configurable: true
+    });
+    Object.defineProperty(HttpRequestConfigImpl.prototype, "data", {
+        get: function () {
+            return this.config.data;
+        },
+        enumerable: true,
+        configurable: true
+    });
+    Object.defineProperty(HttpRequestConfigImpl.prototype, "timeout", {
+        get: function () {
+            return this.config.timeout;
+        },
+        enumerable: true,
+        configurable: true
+    });
+    Object.defineProperty(HttpRequestConfigImpl.prototype, "httpAgent", {
+        get: function () {
+            return this.config.httpAgent;
+        },
+        enumerable: true,
+        configurable: true
+    });
+    HttpRequestConfigImpl.prototype.buildRequestOptions = function () {
+        var parsed = this.buildUrl();
+        var protocol = parsed.protocol;
+        var port = parsed.port;
+        if (!port) {
+            var isHttps = protocol === 'https:';
+            port = isHttps ? '443' : '80';
+        }
+        return {
+            protocol: protocol,
+            hostname: parsed.hostname,
+            port: port,
+            path: parsed.path,
+            method: this.method,
+            agent: this.httpAgent,
+            headers: Object.assign({}, this.headers),
+        };
+    };
+    HttpRequestConfigImpl.prototype.buildEntity = function (headers) {
+        var data;
+        if (!this.hasEntity() || !this.isEntityEnclosingRequest()) {
+            return data;
+        }
+        if (validator.isBuffer(this.data)) {
+            data = this.data;
+        }
+        else if (validator.isObject(this.data)) {
+            data = Buffer.from(JSON.stringify(this.data), 'utf-8');
+            if (typeof headers['content-type'] === 'undefined') {
+                headers['content-type'] = 'application/json;charset=utf-8';
+            }
+        }
+        else if (validator.isString(this.data)) {
+            data = Buffer.from(this.data, 'utf-8');
+        }
+        else {
+            throw new Error('Request data must be a string, a Buffer or a json serializable object');
+        }
+        // Add Content-Length header if data exists.
+        headers['Content-Length'] = data.length.toString();
+        return data;
+    };
+    HttpRequestConfigImpl.prototype.buildUrl = function () {
+        var fullUrl = this.urlWithProtocol();
+        if (!this.hasEntity() || this.isEntityEnclosingRequest()) {
+            return url.parse(fullUrl);
+        }
+        if (!validator.isObject(this.data)) {
+            throw new Error(this.method + " requests cannot have a body");
+        }
+        // Parse URL and append data to query string.
+        var parsedUrl = new url.URL(fullUrl);
+        var dataObj = this.data;
+        for (var key in dataObj) {
+            if (dataObj.hasOwnProperty(key)) {
+                parsedUrl.searchParams.append(key, dataObj[key]);
+            }
+        }
+        return url.parse(parsedUrl.toString());
+    };
+    HttpRequestConfigImpl.prototype.urlWithProtocol = function () {
+        var fullUrl = this.url;
+        if (fullUrl.startsWith('http://') || fullUrl.startsWith('https://')) {
+            return fullUrl;
+        }
+        return "https://" + fullUrl;
+    };
+    HttpRequestConfigImpl.prototype.hasEntity = function () {
+        return !!this.data;
+    };
+    HttpRequestConfigImpl.prototype.isEntityEnclosingRequest = function () {
+        // GET and HEAD requests do not support entity (body) in request.
+        return this.method !== 'GET' && this.method !== 'HEAD';
+    };
+    return HttpRequestConfigImpl;
+}());
+var AuthorizedHttpClient = /** @class */ (function (_super) {
+    __extends(AuthorizedHttpClient, _super);
+    function AuthorizedHttpClient(app) {
+        var _this = _super.call(this) || this;
+        _this.app = app;
+        return _this;
+    }
+    AuthorizedHttpClient.prototype.send = function (request) {
+        var _this = this;
+        return this.app.INTERNAL.getToken().then(function (accessTokenObj) {
+            var requestCopy = Object.assign({}, request);
+            requestCopy.headers = Object.assign({}, request.headers);
+            var authHeader = 'Authorization';
+            requestCopy.headers[authHeader] = "Bearer " + accessTokenObj.accessToken;
+            if (!requestCopy.httpAgent && _this.app.options.httpAgent) {
+                requestCopy.httpAgent = _this.app.options.httpAgent;
+            }
+            return _super.prototype.send.call(_this, requestCopy);
+        });
+    };
+    return AuthorizedHttpClient;
+}(HttpClient));
+exports.AuthorizedHttpClient = AuthorizedHttpClient;
+/**
+ * Class that defines all the settings for the backend API endpoint.
+ *
+ * @param {string} endpoint The Firebase Auth backend endpoint.
+ * @param {HttpMethod} httpMethod The http method for that endpoint.
+ * @constructor
+ */
+var ApiSettings = /** @class */ (function () {
+    function ApiSettings(endpoint, httpMethod) {
+        if (httpMethod === void 0) { httpMethod = 'POST'; }
+        this.endpoint = endpoint;
+        this.httpMethod = httpMethod;
+        this.setRequestValidator(null)
+            .setResponseValidator(null);
+    }
+    /** @return {string} The backend API endpoint. */
+    ApiSettings.prototype.getEndpoint = function () {
+        return this.endpoint;
+    };
+    /** @return {HttpMethod} The request HTTP method. */
+    ApiSettings.prototype.getHttpMethod = function () {
+        return this.httpMethod;
+    };
+    /**
+     * @param {ApiCallbackFunction} requestValidator The request validator.
+     * @return {ApiSettings} The current API settings instance.
+     */
+    ApiSettings.prototype.setRequestValidator = function (requestValidator) {
+        var nullFunction = function (_) { return undefined; };
+        this.requestValidator = requestValidator || nullFunction;
+        return this;
+    };
+    /** @return {ApiCallbackFunction} The request validator. */
+    ApiSettings.prototype.getRequestValidator = function () {
+        return this.requestValidator;
+    };
+    /**
+     * @param {ApiCallbackFunction} responseValidator The response validator.
+     * @return {ApiSettings} The current API settings instance.
+     */
+    ApiSettings.prototype.setResponseValidator = function (responseValidator) {
+        var nullFunction = function (_) { return undefined; };
+        this.responseValidator = responseValidator || nullFunction;
+        return this;
+    };
+    /** @return {ApiCallbackFunction} The response validator. */
+    ApiSettings.prototype.getResponseValidator = function () {
+        return this.responseValidator;
+    };
+    return ApiSettings;
+}());
+exports.ApiSettings = ApiSettings;
+/**
+ * Class used for polling an endpoint with exponential backoff.
+ *
+ * Example usage:
+ * ```
+ * const poller = new ExponentialBackoffPoller();
+ * poller
+ *     .poll(() => {
+ *       return myRequestToPoll()
+ *           .then((responseData: any) => {
+ *             if (!isValid(responseData)) {
+ *               // Continue polling.
+ *               return null;
+ *             }
+ *
+ *             // Polling complete. Resolve promise with final response data.
+ *             return responseData;
+ *           });
+ *     })
+ *     .then((responseData: any) => {
+ *       console.log(`Final response: ${responseData}`);
+ *     });
+ * ```
+ */
+var ExponentialBackoffPoller = /** @class */ (function (_super) {
+    __extends(ExponentialBackoffPoller, _super);
+    function ExponentialBackoffPoller(initialPollingDelayMillis, maxPollingDelayMillis, masterTimeoutMillis) {
+        if (initialPollingDelayMillis === void 0) { initialPollingDelayMillis = 1000; }
+        if (maxPollingDelayMillis === void 0) { maxPollingDelayMillis = 10000; }
+        if (masterTimeoutMillis === void 0) { masterTimeoutMillis = 60000; }
+        var _this = _super.call(this) || this;
+        _this.initialPollingDelayMillis = initialPollingDelayMillis;
+        _this.maxPollingDelayMillis = maxPollingDelayMillis;
+        _this.masterTimeoutMillis = masterTimeoutMillis;
+        _this.numTries = 0;
+        _this.completed = false;
+        return _this;
+    }
+    /**
+     * Poll the provided callback with exponential backoff.
+     *
+     * @param {() => Promise<object>} callback The callback to be called for each poll. If the
+     *     callback resolves to a falsey value, polling will continue. Otherwise, the truthy
+     *     resolution will be used to resolve the promise returned by this method.
+     * @return {Promise<object>} A Promise which resolves to the truthy value returned by the provided
+     *     callback when polling is complete.
+     */
+    ExponentialBackoffPoller.prototype.poll = function (callback) {
+        var _this = this;
+        if (this.pollCallback) {
+            throw new Error('poll() can only be called once per instance of ExponentialBackoffPoller');
+        }
+        this.pollCallback = callback;
+        this.on('poll', this.repoll);
+        this.masterTimer = setTimeout(function () {
+            if (_this.completed) {
+                return;
+            }
+            _this.markCompleted();
+            _this.reject(new Error('ExponentialBackoffPoller deadline exceeded - Master timeout reached'));
+        }, this.masterTimeoutMillis);
+        return new Promise(function (resolve, reject) {
+            _this.resolve = resolve;
+            _this.reject = reject;
+            _this.repoll();
+        });
+    };
+    ExponentialBackoffPoller.prototype.repoll = function () {
+        var _this = this;
+        this.pollCallback()
+            .then(function (result) {
+            if (_this.completed) {
+                return;
+            }
+            if (!result) {
+                _this.repollTimer =
+                    setTimeout(function () { return _this.emit('poll'); }, _this.getPollingDelayMillis());
+                _this.numTries++;
+                return;
+            }
+            _this.markCompleted();
+            _this.resolve(result);
+        })
+            .catch(function (err) {
+            if (_this.completed) {
+                return;
+            }
+            _this.markCompleted();
+            _this.reject(err);
+        });
+    };
+    ExponentialBackoffPoller.prototype.getPollingDelayMillis = function () {
+        var increasedPollingDelay = Math.pow(2, this.numTries) * this.initialPollingDelayMillis;
+        return Math.min(increasedPollingDelay, this.maxPollingDelayMillis);
+    };
+    ExponentialBackoffPoller.prototype.markCompleted = function () {
+        this.completed = true;
+        if (this.masterTimer) {
+            clearTimeout(this.masterTimer);
+        }
+        if (this.repollTimer) {
+            clearTimeout(this.repollTimer);
+        }
+    };
+    return ExponentialBackoffPoller;
+}(events_1.EventEmitter));
+exports.ExponentialBackoffPoller = ExponentialBackoffPoller;

node_modules/firebase-admin/lib/utils/deep-copy.js

@@ -0,0 +1,75 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2017 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Returns a deep copy of an object or array.
+ *
+ * @param {object|array} value The object or array to deep copy.
+ * @return {object|array} A deep copy of the provided object or array.
+ */
+function deepCopy(value) {
+    return deepExtend(undefined, value);
+}
+exports.deepCopy = deepCopy;
+/**
+ * Copies properties from source to target (recursively allows extension of objects and arrays).
+ * Scalar values in the target are over-written. If target is undefined, an object of the
+ * appropriate type will be created (and returned).
+ *
+ * We recursively copy all child properties of plain objects in the source - so that namespace-like
+ * objects are merged.
+ *
+ * Note that the target can be a function, in which case the properties in the source object are
+ * copied onto it as static properties of the function.
+ *
+ * @param {any} target The value which is being extended.
+ * @param {any} source The value whose properties are extending the target.
+ * @return {any} The target value.
+ */
+function deepExtend(target, source) {
+    if (!(source instanceof Object)) {
+        return source;
+    }
+    switch (source.constructor) {
+        case Date:
+            // Treat Dates like scalars; if the target date object had any child
+            // properties - they will be lost!
+            var dateValue = source;
+            return new Date(dateValue.getTime());
+        case Object:
+            if (target === undefined) {
+                target = {};
+            }
+            break;
+        case Array:
+            // Always copy the array source and overwrite the target.
+            target = [];
+            break;
+        default:
+            // Not a plain Object - treat it as a scalar.
+            return source;
+    }
+    for (var prop in source) {
+        if (!source.hasOwnProperty(prop)) {
+            continue;
+        }
+        target[prop] = deepExtend(target[prop], source[prop]);
+    }
+    return target;
+}
+exports.deepExtend = deepExtend;

node_modules/firebase-admin/lib/utils/error.js

@@ -0,0 +1,942 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2017 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+var __extends = (this && this.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (b.hasOwnProperty(p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+var deep_copy_1 = require("../utils/deep-copy");
+/**
+ * Firebase error code structure. This extends Error.
+ *
+ * @param {ErrorInfo} errorInfo The error information (code and message).
+ * @constructor
+ */
+var FirebaseError = /** @class */ (function (_super) {
+    __extends(FirebaseError, _super);
+    function FirebaseError(errorInfo) {
+        var _this = _super.call(this, errorInfo.message) || this;
+        _this.errorInfo = errorInfo;
+        /* tslint:disable:max-line-length */
+        // Set the prototype explicitly. See the following link for more details:
+        // https://github.com/Microsoft/TypeScript/wiki/Breaking-Changes#extending-built-ins-like-error-array-and-map-may-no-longer-work
+        /* tslint:enable:max-line-length */
+        _this.__proto__ = FirebaseError.prototype;
+        return _this;
+    }
+    Object.defineProperty(FirebaseError.prototype, "code", {
+        /** @return {string} The error code. */
+        get: function () {
+            return this.errorInfo.code;
+        },
+        enumerable: true,
+        configurable: true
+    });
+    Object.defineProperty(FirebaseError.prototype, "message", {
+        /** @return {string} The error message. */
+        get: function () {
+            return this.errorInfo.message;
+        },
+        enumerable: true,
+        configurable: true
+    });
+    /** @return {object} The object representation of the error. */
+    FirebaseError.prototype.toJSON = function () {
+        return {
+            code: this.code,
+            message: this.message,
+        };
+    };
+    return FirebaseError;
+}(Error));
+exports.FirebaseError = FirebaseError;
+/**
+ * A FirebaseError with a prefix in front of the error code.
+ *
+ * @param {string} codePrefix The prefix to apply to the error code.
+ * @param {string} code The error code.
+ * @param {string} message The error message.
+ * @constructor
+ */
+var PrefixedFirebaseError = /** @class */ (function (_super) {
+    __extends(PrefixedFirebaseError, _super);
+    function PrefixedFirebaseError(codePrefix, code, message) {
+        var _this = _super.call(this, {
+            code: codePrefix + "/" + code,
+            message: message,
+        }) || this;
+        _this.codePrefix = codePrefix;
+        /* tslint:disable:max-line-length */
+        // Set the prototype explicitly. See the following link for more details:
+        // https://github.com/Microsoft/TypeScript/wiki/Breaking-Changes#extending-built-ins-like-error-array-and-map-may-no-longer-work
+        /* tslint:enable:max-line-length */
+        _this.__proto__ = PrefixedFirebaseError.prototype;
+        return _this;
+    }
+    /**
+     * Allows the error type to be checked without needing to know implementation details
+     * of the code prefixing.
+     *
+     * @param {string} code The non-prefixed error code to test against.
+     * @return {boolean} True if the code matches, false otherwise.
+     */
+    PrefixedFirebaseError.prototype.hasCode = function (code) {
+        return this.codePrefix + "/" + code === this.code;
+    };
+    return PrefixedFirebaseError;
+}(FirebaseError));
+exports.PrefixedFirebaseError = PrefixedFirebaseError;
+/**
+ * Firebase App error code structure. This extends PrefixedFirebaseError.
+ *
+ * @param {string} code The error code.
+ * @param {string} message The error message.
+ * @constructor
+ */
+var FirebaseAppError = /** @class */ (function (_super) {
+    __extends(FirebaseAppError, _super);
+    function FirebaseAppError(code, message) {
+        var _this = _super.call(this, 'app', code, message) || this;
+        /* tslint:disable:max-line-length */
+        // Set the prototype explicitly. See the following link for more details:
+        // https://github.com/Microsoft/TypeScript/wiki/Breaking-Changes#extending-built-ins-like-error-array-and-map-may-no-longer-work
+        /* tslint:enable:max-line-length */
+        _this.__proto__ = FirebaseAppError.prototype;
+        return _this;
+    }
+    return FirebaseAppError;
+}(PrefixedFirebaseError));
+exports.FirebaseAppError = FirebaseAppError;
+/**
+ * Firebase Auth error code structure. This extends PrefixedFirebaseError.
+ *
+ * @param {ErrorInfo} info The error code info.
+ * @param {string} [message] The error message. This will override the default
+ *     message if provided.
+ * @constructor
+ */
+var FirebaseAuthError = /** @class */ (function (_super) {
+    __extends(FirebaseAuthError, _super);
+    function FirebaseAuthError(info, message) {
+        var _this = 
+        // Override default message if custom message provided.
+        _super.call(this, 'auth', info.code, message || info.message) || this;
+        /* tslint:disable:max-line-length */
+        // Set the prototype explicitly. See the following link for more details:
+        // https://github.com/Microsoft/TypeScript/wiki/Breaking-Changes#extending-built-ins-like-error-array-and-map-may-no-longer-work
+        /* tslint:enable:max-line-length */
+        _this.__proto__ = FirebaseAuthError.prototype;
+        return _this;
+    }
+    /**
+     * Creates the developer-facing error corresponding to the backend error code.
+     *
+     * @param {string} serverErrorCode The server error code.
+     * @param {string} [message] The error message. The default message is used
+     *     if not provided.
+     * @param {object} [rawServerResponse] The error's raw server response.
+     * @return {FirebaseAuthError} The corresponding developer-facing error.
+     */
+    FirebaseAuthError.fromServerError = function (serverErrorCode, message, rawServerResponse) {
+        // serverErrorCode could contain additional details:
+        // ERROR_CODE : Detailed message which can also contain colons
+        var colonSeparator = (serverErrorCode || '').indexOf(':');
+        var customMessage = null;
+        if (colonSeparator !== -1) {
+            customMessage = serverErrorCode.substring(colonSeparator + 1).trim();
+            serverErrorCode = serverErrorCode.substring(0, colonSeparator).trim();
+        }
+        // If not found, default to internal error.
+        var clientCodeKey = AUTH_SERVER_TO_CLIENT_CODE[serverErrorCode] || 'INTERNAL_ERROR';
+        var error = deep_copy_1.deepCopy(AuthClientErrorCode[clientCodeKey]);
+        // Server detailed message should have highest priority.
+        error.message = customMessage || message || error.message;
+        if (clientCodeKey === 'INTERNAL_ERROR' && typeof rawServerResponse !== 'undefined') {
+            try {
+                error.message += " Raw server response: \"" + JSON.stringify(rawServerResponse) + "\"";
+            }
+            catch (e) {
+                // Ignore JSON parsing error.
+            }
+        }
+        return new FirebaseAuthError(error);
+    };
+    return FirebaseAuthError;
+}(PrefixedFirebaseError));
+exports.FirebaseAuthError = FirebaseAuthError;
+/**
+ * Firebase Database error code structure. This extends FirebaseError.
+ *
+ * @param {ErrorInfo} info The error code info.
+ * @param {string} [message] The error message. This will override the default
+ *     message if provided.
+ * @constructor
+ */
+var FirebaseDatabaseError = /** @class */ (function (_super) {
+    __extends(FirebaseDatabaseError, _super);
+    function FirebaseDatabaseError(info, message) {
+        // Override default message if custom message provided.
+        return _super.call(this, { code: 'database/' + info.code, message: message || info.message }) || this;
+    }
+    return FirebaseDatabaseError;
+}(FirebaseError));
+exports.FirebaseDatabaseError = FirebaseDatabaseError;
+/**
+ * Firebase Firestore error code structure. This extends FirebaseError.
+ *
+ * @param {ErrorInfo} info The error code info.
+ * @param {string} [message] The error message. This will override the default
+ *     message if provided.
+ * @constructor
+ */
+var FirebaseFirestoreError = /** @class */ (function (_super) {
+    __extends(FirebaseFirestoreError, _super);
+    function FirebaseFirestoreError(info, message) {
+        // Override default message if custom message provided.
+        return _super.call(this, { code: 'firestore/' + info.code, message: message || info.message }) || this;
+    }
+    return FirebaseFirestoreError;
+}(FirebaseError));
+exports.FirebaseFirestoreError = FirebaseFirestoreError;
+/**
+ * Firebase instance ID error code structure. This extends FirebaseError.
+ *
+ * @param {ErrorInfo} info The error code info.
+ * @param {string} [message] The error message. This will override the default
+ *     message if provided.
+ * @constructor
+ */
+var FirebaseInstanceIdError = /** @class */ (function (_super) {
+    __extends(FirebaseInstanceIdError, _super);
+    function FirebaseInstanceIdError(info, message) {
+        // Override default message if custom message provided.
+        return _super.call(this, { code: 'instance-id/' + info.code, message: message || info.message }) || this;
+    }
+    return FirebaseInstanceIdError;
+}(FirebaseError));
+exports.FirebaseInstanceIdError = FirebaseInstanceIdError;
+/**
+ * Firebase Messaging error code structure. This extends PrefixedFirebaseError.
+ *
+ * @param {ErrorInfo} info The error code info.
+ * @param {string} [message] The error message. This will override the default message if provided.
+ * @constructor
+ */
+var FirebaseMessagingError = /** @class */ (function (_super) {
+    __extends(FirebaseMessagingError, _super);
+    function FirebaseMessagingError(info, message) {
+        var _this = 
+        // Override default message if custom message provided.
+        _super.call(this, 'messaging', info.code, message || info.message) || this;
+        /* tslint:disable:max-line-length */
+        // Set the prototype explicitly. See the following link for more details:
+        // https://github.com/Microsoft/TypeScript/wiki/Breaking-Changes#extending-built-ins-like-error-array-and-map-may-no-longer-work
+        /* tslint:enable:max-line-length */
+        _this.__proto__ = FirebaseMessagingError.prototype;
+        return _this;
+    }
+    /**
+     * Creates the developer-facing error corresponding to the backend error code.
+     *
+     * @param {string} serverErrorCode The server error code.
+     * @param {string} [message] The error message. The default message is used
+     *     if not provided.
+     * @param {object} [rawServerResponse] The error's raw server response.
+     * @return {FirebaseMessagingError} The corresponding developer-facing error.
+     */
+    FirebaseMessagingError.fromServerError = function (serverErrorCode, message, rawServerResponse) {
+        // If not found, default to unknown error.
+        var clientCodeKey = 'UNKNOWN_ERROR';
+        if (serverErrorCode && serverErrorCode in MESSAGING_SERVER_TO_CLIENT_CODE) {
+            clientCodeKey = MESSAGING_SERVER_TO_CLIENT_CODE[serverErrorCode];
+        }
+        var error = deep_copy_1.deepCopy(MessagingClientErrorCode[clientCodeKey]);
+        error.message = message || error.message;
+        if (clientCodeKey === 'UNKNOWN_ERROR' && typeof rawServerResponse !== 'undefined') {
+            try {
+                error.message += " Raw server response: \"" + JSON.stringify(rawServerResponse) + "\"";
+            }
+            catch (e) {
+                // Ignore JSON parsing error.
+            }
+        }
+        return new FirebaseMessagingError(error);
+    };
+    FirebaseMessagingError.fromTopicManagementServerError = function (serverErrorCode, message, rawServerResponse) {
+        // If not found, default to unknown error.
+        var clientCodeKey = TOPIC_MGT_SERVER_TO_CLIENT_CODE[serverErrorCode] || 'UNKNOWN_ERROR';
+        var error = deep_copy_1.deepCopy(MessagingClientErrorCode[clientCodeKey]);
+        error.message = message || error.message;
+        if (clientCodeKey === 'UNKNOWN_ERROR' && typeof rawServerResponse !== 'undefined') {
+            try {
+                error.message += " Raw server response: \"" + JSON.stringify(rawServerResponse) + "\"";
+            }
+            catch (e) {
+                // Ignore JSON parsing error.
+            }
+        }
+        return new FirebaseMessagingError(error);
+    };
+    return FirebaseMessagingError;
+}(PrefixedFirebaseError));
+exports.FirebaseMessagingError = FirebaseMessagingError;
+/**
+ * Firebase project management error code structure. This extends PrefixedFirebaseError.
+ *
+ * @param {ProjectManagementErrorCode} code The error code.
+ * @param {string} message The error message.
+ * @constructor
+ */
+var FirebaseProjectManagementError = /** @class */ (function (_super) {
+    __extends(FirebaseProjectManagementError, _super);
+    function FirebaseProjectManagementError(code, message) {
+        var _this = _super.call(this, 'project-management', code, message) || this;
+        /* tslint:disable:max-line-length */
+        // Set the prototype explicitly. See the following link for more details:
+        // https://github.com/Microsoft/TypeScript/wiki/Breaking-Changes#extending-built-ins-like-error-array-and-map-may-no-longer-work
+        /* tslint:enable:max-line-length */
+        _this.__proto__ = FirebaseProjectManagementError.prototype;
+        return _this;
+    }
+    return FirebaseProjectManagementError;
+}(PrefixedFirebaseError));
+exports.FirebaseProjectManagementError = FirebaseProjectManagementError;
+/**
+ * App client error codes and their default messages.
+ */
+var AppErrorCodes = /** @class */ (function () {
+    function AppErrorCodes() {
+    }
+    AppErrorCodes.APP_DELETED = 'app-deleted';
+    AppErrorCodes.DUPLICATE_APP = 'duplicate-app';
+    AppErrorCodes.INVALID_ARGUMENT = 'invalid-argument';
+    AppErrorCodes.INTERNAL_ERROR = 'internal-error';
+    AppErrorCodes.INVALID_APP_NAME = 'invalid-app-name';
+    AppErrorCodes.INVALID_APP_OPTIONS = 'invalid-app-options';
+    AppErrorCodes.INVALID_CREDENTIAL = 'invalid-credential';
+    AppErrorCodes.NETWORK_ERROR = 'network-error';
+    AppErrorCodes.NETWORK_TIMEOUT = 'network-timeout';
+    AppErrorCodes.NO_APP = 'no-app';
+    AppErrorCodes.UNABLE_TO_PARSE_RESPONSE = 'unable-to-parse-response';
+    return AppErrorCodes;
+}());
+exports.AppErrorCodes = AppErrorCodes;
+/**
+ * Auth client error codes and their default messages.
+ */
+var AuthClientErrorCode = /** @class */ (function () {
+    function AuthClientErrorCode() {
+    }
+    AuthClientErrorCode.BILLING_NOT_ENABLED = {
+        code: 'billing-not-enabled',
+        message: 'Feature requires billing to be enabled.',
+    };
+    AuthClientErrorCode.CLAIMS_TOO_LARGE = {
+        code: 'claims-too-large',
+        message: 'Developer claims maximum payload size exceeded.',
+    };
+    AuthClientErrorCode.CONFIGURATION_EXISTS = {
+        code: 'configuration-exists',
+        message: 'A configuration already exists with the provided identifier.',
+    };
+    AuthClientErrorCode.CONFIGURATION_NOT_FOUND = {
+        code: 'configuration-not-found',
+        message: 'There is no configuration corresponding to the provided identifier.',
+    };
+    AuthClientErrorCode.ID_TOKEN_EXPIRED = {
+        code: 'id-token-expired',
+        message: 'The provided Firebase ID token is expired.',
+    };
+    AuthClientErrorCode.INVALID_ARGUMENT = {
+        code: 'argument-error',
+        message: 'Invalid argument provided.',
+    };
+    AuthClientErrorCode.INVALID_CONFIG = {
+        code: 'invalid-config',
+        message: 'The provided configuration is invalid.',
+    };
+    AuthClientErrorCode.EMAIL_ALREADY_EXISTS = {
+        code: 'email-already-exists',
+        message: 'The email address is already in use by another account.',
+    };
+    AuthClientErrorCode.FORBIDDEN_CLAIM = {
+        code: 'reserved-claim',
+        message: 'The specified developer claim is reserved and cannot be specified.',
+    };
+    AuthClientErrorCode.INVALID_ID_TOKEN = {
+        code: 'invalid-id-token',
+        message: 'The provided ID token is not a valid Firebase ID token.',
+    };
+    AuthClientErrorCode.ID_TOKEN_REVOKED = {
+        code: 'id-token-revoked',
+        message: 'The Firebase ID token has been revoked.',
+    };
+    AuthClientErrorCode.INTERNAL_ERROR = {
+        code: 'internal-error',
+        message: 'An internal error has occurred.',
+    };
+    AuthClientErrorCode.INVALID_CLAIMS = {
+        code: 'invalid-claims',
+        message: 'The provided custom claim attributes are invalid.',
+    };
+    AuthClientErrorCode.INVALID_CONTINUE_URI = {
+        code: 'invalid-continue-uri',
+        message: 'The continue URL must be a valid URL string.',
+    };
+    AuthClientErrorCode.INVALID_CREATION_TIME = {
+        code: 'invalid-creation-time',
+        message: 'The creation time must be a valid UTC date string.',
+    };
+    AuthClientErrorCode.INVALID_CREDENTIAL = {
+        code: 'invalid-credential',
+        message: 'Invalid credential object provided.',
+    };
+    AuthClientErrorCode.INVALID_DISABLED_FIELD = {
+        code: 'invalid-disabled-field',
+        message: 'The disabled field must be a boolean.',
+    };
+    AuthClientErrorCode.INVALID_DISPLAY_NAME = {
+        code: 'invalid-display-name',
+        message: 'The displayName field must be a valid string.',
+    };
+    AuthClientErrorCode.INVALID_DYNAMIC_LINK_DOMAIN = {
+        code: 'invalid-dynamic-link-domain',
+        message: 'The provided dynamic link domain is not configured or authorized ' +
+            'for the current project.',
+    };
+    AuthClientErrorCode.INVALID_EMAIL_VERIFIED = {
+        code: 'invalid-email-verified',
+        message: 'The emailVerified field must be a boolean.',
+    };
+    AuthClientErrorCode.INVALID_EMAIL = {
+        code: 'invalid-email',
+        message: 'The email address is improperly formatted.',
+    };
+    AuthClientErrorCode.INVALID_HASH_ALGORITHM = {
+        code: 'invalid-hash-algorithm',
+        message: 'The hash algorithm must match one of the strings in the list of ' +
+            'supported algorithms.',
+    };
+    AuthClientErrorCode.INVALID_HASH_BLOCK_SIZE = {
+        code: 'invalid-hash-block-size',
+        message: 'The hash block size must be a valid number.',
+    };
+    AuthClientErrorCode.INVALID_HASH_DERIVED_KEY_LENGTH = {
+        code: 'invalid-hash-derived-key-length',
+        message: 'The hash derived key length must be a valid number.',
+    };
+    AuthClientErrorCode.INVALID_HASH_KEY = {
+        code: 'invalid-hash-key',
+        message: 'The hash key must a valid byte buffer.',
+    };
+    AuthClientErrorCode.INVALID_HASH_MEMORY_COST = {
+        code: 'invalid-hash-memory-cost',
+        message: 'The hash memory cost must be a valid number.',
+    };
+    AuthClientErrorCode.INVALID_HASH_PARALLELIZATION = {
+        code: 'invalid-hash-parallelization',
+        message: 'The hash parallelization must be a valid number.',
+    };
+    AuthClientErrorCode.INVALID_HASH_ROUNDS = {
+        code: 'invalid-hash-rounds',
+        message: 'The hash rounds must be a valid number.',
+    };
+    AuthClientErrorCode.INVALID_HASH_SALT_SEPARATOR = {
+        code: 'invalid-hash-salt-separator',
+        message: 'The hashing algorithm salt separator field must be a valid byte buffer.',
+    };
+    AuthClientErrorCode.INVALID_LAST_SIGN_IN_TIME = {
+        code: 'invalid-last-sign-in-time',
+        message: 'The last sign-in time must be a valid UTC date string.',
+    };
+    AuthClientErrorCode.INVALID_NAME = {
+        code: 'invalid-name',
+        message: 'The resource name provided is invalid.',
+    };
+    AuthClientErrorCode.INVALID_OAUTH_CLIENT_ID = {
+        code: 'invalid-oauth-client-id',
+        message: 'The provided OAuth client ID is invalid.',
+    };
+    AuthClientErrorCode.INVALID_PAGE_TOKEN = {
+        code: 'invalid-page-token',
+        message: 'The page token must be a valid non-empty string.',
+    };
+    AuthClientErrorCode.INVALID_PASSWORD = {
+        code: 'invalid-password',
+        message: 'The password must be a string with at least 6 characters.',
+    };
+    AuthClientErrorCode.INVALID_PASSWORD_HASH = {
+        code: 'invalid-password-hash',
+        message: 'The password hash must be a valid byte buffer.',
+    };
+    AuthClientErrorCode.INVALID_PASSWORD_SALT = {
+        code: 'invalid-password-salt',
+        message: 'The password salt must be a valid byte buffer.',
+    };
+    AuthClientErrorCode.INVALID_PHONE_NUMBER = {
+        code: 'invalid-phone-number',
+        message: 'The phone number must be a non-empty E.164 standard compliant identifier ' +
+            'string.',
+    };
+    AuthClientErrorCode.INVALID_PHOTO_URL = {
+        code: 'invalid-photo-url',
+        message: 'The photoURL field must be a valid URL.',
+    };
+    AuthClientErrorCode.INVALID_PROJECT_ID = {
+        code: 'invalid-project-id',
+        message: 'Invalid parent project. Either parent project doesn\'t exist or didn\'t enable multi-tenancy.',
+    };
+    AuthClientErrorCode.INVALID_PROVIDER_DATA = {
+        code: 'invalid-provider-data',
+        message: 'The providerData must be a valid array of UserInfo objects.',
+    };
+    AuthClientErrorCode.INVALID_PROVIDER_ID = {
+        code: 'invalid-provider-id',
+        message: 'The providerId must be a valid supported provider identifier string.',
+    };
+    AuthClientErrorCode.INVALID_SESSION_COOKIE_DURATION = {
+        code: 'invalid-session-cookie-duration',
+        message: 'The session cookie duration must be a valid number in milliseconds ' +
+            'between 5 minutes and 2 weeks.',
+    };
+    AuthClientErrorCode.INVALID_TENANT_ID = {
+        code: 'invalid-tenant-id',
+        message: 'The tenant ID must be a valid non-empty string.',
+    };
+    AuthClientErrorCode.INVALID_TENANT_TYPE = {
+        code: 'invalid-tenant-type',
+        message: 'Tenant type must be either "full_service" or "lightweight".',
+    };
+    AuthClientErrorCode.INVALID_UID = {
+        code: 'invalid-uid',
+        message: 'The uid must be a non-empty string with at most 128 characters.',
+    };
+    AuthClientErrorCode.INVALID_USER_IMPORT = {
+        code: 'invalid-user-import',
+        message: 'The user record to import is invalid.',
+    };
+    AuthClientErrorCode.INVALID_TOKENS_VALID_AFTER_TIME = {
+        code: 'invalid-tokens-valid-after-time',
+        message: 'The tokensValidAfterTime must be a valid UTC number in seconds.',
+    };
+    AuthClientErrorCode.MISMATCHING_TENANT_ID = {
+        code: 'mismatching-tenant-id',
+        message: 'User tenant ID does not match with the current TenantAwareAuth tenant ID.',
+    };
+    AuthClientErrorCode.MISSING_ANDROID_PACKAGE_NAME = {
+        code: 'missing-android-pkg-name',
+        message: 'An Android Package Name must be provided if the Android App is ' +
+            'required to be installed.',
+    };
+    AuthClientErrorCode.MISSING_CONFIG = {
+        code: 'missing-config',
+        message: 'The provided configuration is missing required attributes.',
+    };
+    AuthClientErrorCode.MISSING_CONTINUE_URI = {
+        code: 'missing-continue-uri',
+        message: 'A valid continue URL must be provided in the request.',
+    };
+    AuthClientErrorCode.MISSING_DISPLAY_NAME = {
+        code: 'missing-display-name',
+        message: 'The resource being created or edited is missing a valid display name.',
+    };
+    AuthClientErrorCode.MISSING_IOS_BUNDLE_ID = {
+        code: 'missing-ios-bundle-id',
+        message: 'The request is missing an iOS Bundle ID.',
+    };
+    AuthClientErrorCode.MISSING_ISSUER = {
+        code: 'missing-issuer',
+        message: 'The OAuth/OIDC configuration issuer must not be empty.',
+    };
+    AuthClientErrorCode.MISSING_HASH_ALGORITHM = {
+        code: 'missing-hash-algorithm',
+        message: 'Importing users with password hashes requires that the hashing ' +
+            'algorithm and its parameters be provided.',
+    };
+    AuthClientErrorCode.MISSING_OAUTH_CLIENT_ID = {
+        code: 'missing-oauth-client-id',
+        message: 'The OAuth/OIDC configuration client ID must not be empty.',
+    };
+    AuthClientErrorCode.MISSING_PROVIDER_ID = {
+        code: 'missing-provider-id',
+        message: 'A valid provider ID must be provided in the request.',
+    };
+    AuthClientErrorCode.MISSING_SAML_RELYING_PARTY_CONFIG = {
+        code: 'missing-saml-relying-party-config',
+        message: 'The SAML configuration provided is missing a relying party configuration.',
+    };
+    AuthClientErrorCode.MAXIMUM_USER_COUNT_EXCEEDED = {
+        code: 'maximum-user-count-exceeded',
+        message: 'The maximum allowed number of users to import has been exceeded.',
+    };
+    AuthClientErrorCode.MISSING_UID = {
+        code: 'missing-uid',
+        message: 'A uid identifier is required for the current operation.',
+    };
+    AuthClientErrorCode.OPERATION_NOT_ALLOWED = {
+        code: 'operation-not-allowed',
+        message: 'The given sign-in provider is disabled for this Firebase project. ' +
+            'Enable it in the Firebase console, under the sign-in method tab of the ' +
+            'Auth section.',
+    };
+    AuthClientErrorCode.PHONE_NUMBER_ALREADY_EXISTS = {
+        code: 'phone-number-already-exists',
+        message: 'The user with the provided phone number already exists.',
+    };
+    AuthClientErrorCode.PROJECT_NOT_FOUND = {
+        code: 'project-not-found',
+        message: 'No Firebase project was found for the provided credential.',
+    };
+    AuthClientErrorCode.INSUFFICIENT_PERMISSION = {
+        code: 'insufficient-permission',
+        message: 'Credential implementation provided to initializeApp() via the "credential" property ' +
+            'has insufficient permission to access the requested resource. See ' +
+            'https://firebase.google.com/docs/admin/setup for details on how to authenticate this SDK ' +
+            'with appropriate permissions.',
+    };
+    AuthClientErrorCode.QUOTA_EXCEEDED = {
+        code: 'quota-exceeded',
+        message: 'The project quota for the specified operation has been exceeded.',
+    };
+    AuthClientErrorCode.SESSION_COOKIE_EXPIRED = {
+        code: 'session-cookie-expired',
+        message: 'The Firebase session cookie is expired.',
+    };
+    AuthClientErrorCode.SESSION_COOKIE_REVOKED = {
+        code: 'session-cookie-revoked',
+        message: 'The Firebase session cookie has been revoked.',
+    };
+    AuthClientErrorCode.TENANT_NOT_FOUND = {
+        code: 'tenant-not-found',
+        message: 'There is no tenant corresponding to the provided identifier.',
+    };
+    AuthClientErrorCode.UID_ALREADY_EXISTS = {
+        code: 'uid-already-exists',
+        message: 'The user with the provided uid already exists.',
+    };
+    AuthClientErrorCode.UNAUTHORIZED_DOMAIN = {
+        code: 'unauthorized-continue-uri',
+        message: 'The domain of the continue URL is not whitelisted. Whitelist the domain in the ' +
+            'Firebase console.',
+    };
+    AuthClientErrorCode.UNSUPPORTED_TENANT_OPERATION = {
+        code: 'unsupported-tenant-operation',
+        message: 'This operation is not supported in a multi-tenant context.',
+    };
+    AuthClientErrorCode.USER_NOT_FOUND = {
+        code: 'user-not-found',
+        message: 'There is no user record corresponding to the provided identifier.',
+    };
+    AuthClientErrorCode.NOT_FOUND = {
+        code: 'not-found',
+        message: 'The requested resource was not found.',
+    };
+    return AuthClientErrorCode;
+}());
+exports.AuthClientErrorCode = AuthClientErrorCode;
+/**
+ * Messaging client error codes and their default messages.
+ */
+var MessagingClientErrorCode = /** @class */ (function () {
+    function MessagingClientErrorCode() {
+    }
+    MessagingClientErrorCode.INVALID_ARGUMENT = {
+        code: 'invalid-argument',
+        message: 'Invalid argument provided.',
+    };
+    MessagingClientErrorCode.INVALID_RECIPIENT = {
+        code: 'invalid-recipient',
+        message: 'Invalid message recipient provided.',
+    };
+    MessagingClientErrorCode.INVALID_PAYLOAD = {
+        code: 'invalid-payload',
+        message: 'Invalid message payload provided.',
+    };
+    MessagingClientErrorCode.INVALID_DATA_PAYLOAD_KEY = {
+        code: 'invalid-data-payload-key',
+        message: 'The data message payload contains an invalid key. See the reference documentation ' +
+            'for the DataMessagePayload type for restricted keys.',
+    };
+    MessagingClientErrorCode.PAYLOAD_SIZE_LIMIT_EXCEEDED = {
+        code: 'payload-size-limit-exceeded',
+        message: 'The provided message payload exceeds the FCM size limits. See the error documentation ' +
+            'for more details.',
+    };
+    MessagingClientErrorCode.INVALID_OPTIONS = {
+        code: 'invalid-options',
+        message: 'Invalid message options provided.',
+    };
+    MessagingClientErrorCode.INVALID_REGISTRATION_TOKEN = {
+        code: 'invalid-registration-token',
+        message: 'Invalid registration token provided. Make sure it matches the registration token ' +
+            'the client app receives from registering with FCM.',
+    };
+    MessagingClientErrorCode.REGISTRATION_TOKEN_NOT_REGISTERED = {
+        code: 'registration-token-not-registered',
+        message: 'The provided registration token is not registered. A previously valid registration ' +
+            'token can be unregistered for a variety of reasons. See the error documentation for more ' +
+            'details. Remove this registration token and stop using it to send messages.',
+    };
+    MessagingClientErrorCode.MISMATCHED_CREDENTIAL = {
+        code: 'mismatched-credential',
+        message: 'The credential used to authenticate this SDK does not have permission to send ' +
+            'messages to the device corresponding to the provided registration token. Make sure the ' +
+            'credential and registration token both belong to the same Firebase project.',
+    };
+    MessagingClientErrorCode.INVALID_PACKAGE_NAME = {
+        code: 'invalid-package-name',
+        message: 'The message was addressed to a registration token whose package name does not match ' +
+            'the provided "restrictedPackageName" option.',
+    };
+    MessagingClientErrorCode.DEVICE_MESSAGE_RATE_EXCEEDED = {
+        code: 'device-message-rate-exceeded',
+        message: 'The rate of messages to a particular device is too high. Reduce the number of ' +
+            'messages sent to this device and do not immediately retry sending to this device.',
+    };
+    MessagingClientErrorCode.TOPICS_MESSAGE_RATE_EXCEEDED = {
+        code: 'topics-message-rate-exceeded',
+        message: 'The rate of messages to subscribers to a particular topic is too high. Reduce the ' +
+            'number of messages sent for this topic, and do not immediately retry sending to this topic.',
+    };
+    MessagingClientErrorCode.MESSAGE_RATE_EXCEEDED = {
+        code: 'message-rate-exceeded',
+        message: 'Sending limit exceeded for the message target.',
+    };
+    MessagingClientErrorCode.THIRD_PARTY_AUTH_ERROR = {
+        code: 'third-party-auth-error',
+        message: 'A message targeted to an iOS device could not be sent because the required APNs ' +
+            'SSL certificate was not uploaded or has expired. Check the validity of your development ' +
+            'and production certificates.',
+    };
+    MessagingClientErrorCode.TOO_MANY_TOPICS = {
+        code: 'too-many-topics',
+        message: 'The maximum number of topics the provided registration token can be subscribed to ' +
+            'has been exceeded.',
+    };
+    MessagingClientErrorCode.AUTHENTICATION_ERROR = {
+        code: 'authentication-error',
+        message: 'An error occurred when trying to authenticate to the FCM servers. Make sure the ' +
+            'credential used to authenticate this SDK has the proper permissions. See ' +
+            'https://firebase.google.com/docs/admin/setup for setup instructions.',
+    };
+    MessagingClientErrorCode.SERVER_UNAVAILABLE = {
+        code: 'server-unavailable',
+        message: 'The FCM server could not process the request in time. See the error documentation ' +
+            'for more details.',
+    };
+    MessagingClientErrorCode.INTERNAL_ERROR = {
+        code: 'internal-error',
+        message: 'An internal error has occurred. Please retry the request.',
+    };
+    MessagingClientErrorCode.UNKNOWN_ERROR = {
+        code: 'unknown-error',
+        message: 'An unknown server error was returned.',
+    };
+    return MessagingClientErrorCode;
+}());
+exports.MessagingClientErrorCode = MessagingClientErrorCode;
+var InstanceIdClientErrorCode = /** @class */ (function () {
+    function InstanceIdClientErrorCode() {
+    }
+    InstanceIdClientErrorCode.INVALID_ARGUMENT = {
+        code: 'invalid-argument',
+        message: 'Invalid argument provided.',
+    };
+    InstanceIdClientErrorCode.INVALID_PROJECT_ID = {
+        code: 'invalid-project-id',
+        message: 'Invalid project ID provided.',
+    };
+    InstanceIdClientErrorCode.INVALID_INSTANCE_ID = {
+        code: 'invalid-instance-id',
+        message: 'Invalid instance ID provided.',
+    };
+    InstanceIdClientErrorCode.API_ERROR = {
+        code: 'api-error',
+        message: 'Instance ID API call failed.',
+    };
+    return InstanceIdClientErrorCode;
+}());
+exports.InstanceIdClientErrorCode = InstanceIdClientErrorCode;
+/** @const {ServerToClientCode} Auth server to client enum error codes. */
+var AUTH_SERVER_TO_CLIENT_CODE = {
+    // Feature being configured or used requires a billing account.
+    BILLING_NOT_ENABLED: 'BILLING_NOT_ENABLED',
+    // Claims payload is too large.
+    CLAIMS_TOO_LARGE: 'CLAIMS_TOO_LARGE',
+    // Configuration being added already exists.
+    CONFIGURATION_EXISTS: 'CONFIGURATION_EXISTS',
+    // Configuration not found.
+    CONFIGURATION_NOT_FOUND: 'CONFIGURATION_NOT_FOUND',
+    // Provided credential has insufficient permissions.
+    INSUFFICIENT_PERMISSION: 'INSUFFICIENT_PERMISSION',
+    // Provided configuration has invalid fields.
+    INVALID_CONFIG: 'INVALID_CONFIG',
+    // Provided configuration identifier is invalid.
+    INVALID_CONFIG_ID: 'INVALID_PROVIDER_ID',
+    // ActionCodeSettings missing continue URL.
+    INVALID_CONTINUE_URI: 'INVALID_CONTINUE_URI',
+    // Dynamic link domain in provided ActionCodeSettings is not authorized.
+    INVALID_DYNAMIC_LINK_DOMAIN: 'INVALID_DYNAMIC_LINK_DOMAIN',
+    // uploadAccount provides an email that already exists.
+    DUPLICATE_EMAIL: 'EMAIL_ALREADY_EXISTS',
+    // uploadAccount provides a localId that already exists.
+    DUPLICATE_LOCAL_ID: 'UID_ALREADY_EXISTS',
+    // setAccountInfo email already exists.
+    EMAIL_EXISTS: 'EMAIL_ALREADY_EXISTS',
+    // Reserved claim name.
+    FORBIDDEN_CLAIM: 'FORBIDDEN_CLAIM',
+    // Invalid claims provided.
+    INVALID_CLAIMS: 'INVALID_CLAIMS',
+    // Invalid session cookie duration.
+    INVALID_DURATION: 'INVALID_SESSION_COOKIE_DURATION',
+    // Invalid email provided.
+    INVALID_EMAIL: 'INVALID_EMAIL',
+    // Invalid tenant display name. This can be thrown on CreateTenant and UpdateTenant.
+    INVALID_DISPLAY_NAME: 'INVALID_DISPLAY_NAME',
+    // Invalid ID token provided.
+    INVALID_ID_TOKEN: 'INVALID_ID_TOKEN',
+    // Invalid tenant/parent resource name.
+    INVALID_NAME: 'INVALID_NAME',
+    // OIDC configuration has an invalid OAuth client ID.
+    INVALID_OAUTH_CLIENT_ID: 'INVALID_OAUTH_CLIENT_ID',
+    // Invalid page token.
+    INVALID_PAGE_SELECTION: 'INVALID_PAGE_TOKEN',
+    // Invalid phone number.
+    INVALID_PHONE_NUMBER: 'INVALID_PHONE_NUMBER',
+    // Invalid agent project. Either agent project doesn't exist or didn't enable multi-tenancy.
+    INVALID_PROJECT_ID: 'INVALID_PROJECT_ID',
+    // Invalid provider ID.
+    INVALID_PROVIDER_ID: 'INVALID_PROVIDER_ID',
+    // Invalid service account.
+    INVALID_SERVICE_ACCOUNT: 'INVALID_SERVICE_ACCOUNT',
+    // Invalid tenant type.
+    INVALID_TENANT_TYPE: 'INVALID_TENANT_TYPE',
+    // Missing Android package name.
+    MISSING_ANDROID_PACKAGE_NAME: 'MISSING_ANDROID_PACKAGE_NAME',
+    // Missing configuration.
+    MISSING_CONFIG: 'MISSING_CONFIG',
+    // Missing configuration identifier.
+    MISSING_CONFIG_ID: 'MISSING_PROVIDER_ID',
+    // Missing tenant display name: This can be thrown on CreateTenant and UpdateTenant.
+    MISSING_DISPLAY_NAME: 'MISSING_DISPLAY_NAME',
+    // Missing iOS bundle ID.
+    MISSING_IOS_BUNDLE_ID: 'MISSING_IOS_BUNDLE_ID',
+    // Missing OIDC issuer.
+    MISSING_ISSUER: 'MISSING_ISSUER',
+    // No localId provided (deleteAccount missing localId).
+    MISSING_LOCAL_ID: 'MISSING_UID',
+    // OIDC configuration is missing an OAuth client ID.
+    MISSING_OAUTH_CLIENT_ID: 'MISSING_OAUTH_CLIENT_ID',
+    // Missing provider ID.
+    MISSING_PROVIDER_ID: 'MISSING_PROVIDER_ID',
+    // Missing SAML RP config.
+    MISSING_SAML_RELYING_PARTY_CONFIG: 'MISSING_SAML_RELYING_PARTY_CONFIG',
+    // Empty user list in uploadAccount.
+    MISSING_USER_ACCOUNT: 'MISSING_UID',
+    // Password auth disabled in console.
+    OPERATION_NOT_ALLOWED: 'OPERATION_NOT_ALLOWED',
+    // Provided credential has insufficient permissions.
+    PERMISSION_DENIED: 'INSUFFICIENT_PERMISSION',
+    // Phone number already exists.
+    PHONE_NUMBER_EXISTS: 'PHONE_NUMBER_ALREADY_EXISTS',
+    // Project not found.
+    PROJECT_NOT_FOUND: 'PROJECT_NOT_FOUND',
+    // In multi-tenancy context: project creation quota exceeded.
+    QUOTA_EXCEEDED: 'QUOTA_EXCEEDED',
+    // Tenant not found.
+    TENANT_NOT_FOUND: 'TENANT_NOT_FOUND',
+    // Tenant ID mismatch.
+    TENANT_ID_MISMATCH: 'MISMATCHING_TENANT_ID',
+    // Token expired error.
+    TOKEN_EXPIRED: 'ID_TOKEN_EXPIRED',
+    // Continue URL provided in ActionCodeSettings has a domain that is not whitelisted.
+    UNAUTHORIZED_DOMAIN: 'UNAUTHORIZED_DOMAIN',
+    // Operation is not supported in a multi-tenant context.
+    UNSUPPORTED_TENANT_OPERATION: 'UNSUPPORTED_TENANT_OPERATION',
+    // User on which action is to be performed is not found.
+    USER_NOT_FOUND: 'USER_NOT_FOUND',
+    // Password provided is too weak.
+    WEAK_PASSWORD: 'INVALID_PASSWORD',
+};
+/** @const {ServerToClientCode} Messaging server to client enum error codes. */
+var MESSAGING_SERVER_TO_CLIENT_CODE = {
+    /* GENERIC ERRORS */
+    // Generic invalid message parameter provided.
+    InvalidParameters: 'INVALID_ARGUMENT',
+    // Mismatched sender ID.
+    MismatchSenderId: 'MISMATCHED_CREDENTIAL',
+    // FCM server unavailable.
+    Unavailable: 'SERVER_UNAVAILABLE',
+    // FCM server internal error.
+    InternalServerError: 'INTERNAL_ERROR',
+    /* SEND ERRORS */
+    // Invalid registration token format.
+    InvalidRegistration: 'INVALID_REGISTRATION_TOKEN',
+    // Registration token is not registered.
+    NotRegistered: 'REGISTRATION_TOKEN_NOT_REGISTERED',
+    // Registration token does not match restricted package name.
+    InvalidPackageName: 'INVALID_PACKAGE_NAME',
+    // Message payload size limit exceeded.
+    MessageTooBig: 'PAYLOAD_SIZE_LIMIT_EXCEEDED',
+    // Invalid key in the data message payload.
+    InvalidDataKey: 'INVALID_DATA_PAYLOAD_KEY',
+    // Invalid time to live option.
+    InvalidTtl: 'INVALID_OPTIONS',
+    // Device message rate exceeded.
+    DeviceMessageRateExceeded: 'DEVICE_MESSAGE_RATE_EXCEEDED',
+    // Topics message rate exceeded.
+    TopicsMessageRateExceeded: 'TOPICS_MESSAGE_RATE_EXCEEDED',
+    // Invalid APNs credentials.
+    InvalidApnsCredential: 'THIRD_PARTY_AUTH_ERROR',
+    /* FCM v1 canonical error codes */
+    NOT_FOUND: 'REGISTRATION_TOKEN_NOT_REGISTERED',
+    PERMISSION_DENIED: 'MISMATCHED_CREDENTIAL',
+    RESOURCE_EXHAUSTED: 'MESSAGE_RATE_EXCEEDED',
+    UNAUTHENTICATED: 'THIRD_PARTY_AUTH_ERROR',
+    /* FCM v1 new error codes */
+    APNS_AUTH_ERROR: 'THIRD_PARTY_AUTH_ERROR',
+    INTERNAL: 'INTERNAL_ERROR',
+    INVALID_ARGUMENT: 'INVALID_ARGUMENT',
+    QUOTA_EXCEEDED: 'MESSAGE_RATE_EXCEEDED',
+    SENDER_ID_MISMATCH: 'MISMATCHED_CREDENTIAL',
+    THIRD_PARTY_AUTH_ERROR: 'THIRD_PARTY_AUTH_ERROR',
+    UNAVAILABLE: 'SERVER_UNAVAILABLE',
+    UNREGISTERED: 'REGISTRATION_TOKEN_NOT_REGISTERED',
+    UNSPECIFIED_ERROR: 'UNKNOWN_ERROR',
+};
+/** @const {ServerToClientCode} Topic management (IID) server to client enum error codes. */
+var TOPIC_MGT_SERVER_TO_CLIENT_CODE = {
+    /* TOPIC SUBSCRIPTION MANAGEMENT ERRORS */
+    NOT_FOUND: 'REGISTRATION_TOKEN_NOT_REGISTERED',
+    INVALID_ARGUMENT: 'INVALID_REGISTRATION_TOKEN',
+    TOO_MANY_TOPICS: 'TOO_MANY_TOPICS',
+    RESOURCE_EXHAUSTED: 'TOO_MANY_TOPICS',
+    PERMISSION_DENIED: 'AUTHENTICATION_ERROR',
+    DEADLINE_EXCEEDED: 'SERVER_UNAVAILABLE',
+    INTERNAL: 'INTERNAL_ERROR',
+    UNKNOWN: 'UNKNOWN_ERROR',
+};

node_modules/firebase-admin/lib/utils/index.js

@@ -0,0 +1,164 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2017 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var credential_1 = require("../auth/credential");
+var validator = require("./validator");
+/**
+ * Renames properties on an object given a mapping from old to new property names.
+ *
+ * For example, this can be used to map underscore_cased properties to camelCase.
+ *
+ * @param {object} obj The object whose properties to rename.
+ * @param {object} keyMap The mapping from old to new property names.
+ */
+function renameProperties(obj, keyMap) {
+    Object.keys(keyMap).forEach(function (oldKey) {
+        if (oldKey in obj) {
+            var newKey = keyMap[oldKey];
+            // The old key's value takes precedence over the new key's value.
+            obj[newKey] = obj[oldKey];
+            delete obj[oldKey];
+        }
+    });
+}
+exports.renameProperties = renameProperties;
+/**
+ * Defines a new read-only property directly on an object and returns the object.
+ *
+ * @param {object} obj The object on which to define the property.
+ * @param {string} prop The name of the property to be defined or modified.
+ * @param {any} value The value associated with the property.
+ */
+function addReadonlyGetter(obj, prop, value) {
+    Object.defineProperty(obj, prop, {
+        value: value,
+        // Make this property read-only.
+        writable: false,
+        // Include this property during enumeration of obj's properties.
+        enumerable: true,
+    });
+}
+exports.addReadonlyGetter = addReadonlyGetter;
+/**
+ * Returns the Google Cloud project ID associated with a Firebase app, if it's explicitly
+ * specified in either the Firebase app options, credentials or the local environment.
+ * Otherwise returns null.
+ *
+ * @param {FirebaseApp} app A Firebase app to get the project ID from.
+ *
+ * @return {string} A project ID string or null.
+ */
+function getExplicitProjectId(app) {
+    var options = app.options;
+    if (validator.isNonEmptyString(options.projectId)) {
+        return options.projectId;
+    }
+    var credential = app.options.credential;
+    if (credential instanceof credential_1.ServiceAccountCredential) {
+        return credential.projectId;
+    }
+    var projectId = process.env.GOOGLE_CLOUD_PROJECT || process.env.GCLOUD_PROJECT;
+    if (validator.isNonEmptyString(projectId)) {
+        return projectId;
+    }
+    return null;
+}
+exports.getExplicitProjectId = getExplicitProjectId;
+/**
+ * Determines the Google Cloud project ID associated with a Firebase app. This method
+ * first checks if a project ID is explicitly specified in either the Firebase app options,
+ * credentials or the local environment in that order. If no explicit project ID is
+ * configured, but the SDK has been initialized with ComputeEngineCredentials, this
+ * method attempts to discover the project ID from the local metadata service.
+ *
+ * @param {FirebaseApp} app A Firebase app to get the project ID from.
+ *
+ * @return {Promise<string | null>} A project ID string or null.
+ */
+function findProjectId(app) {
+    var projectId = getExplicitProjectId(app);
+    if (projectId) {
+        return Promise.resolve(projectId);
+    }
+    var credential = app.options.credential;
+    if (credential instanceof credential_1.ComputeEngineCredential) {
+        return credential.getProjectId();
+    }
+    return Promise.resolve(null);
+}
+exports.findProjectId = findProjectId;
+/**
+ * Encodes data using web-safe-base64.
+ *
+ * @param {Buffer} data The raw data byte input.
+ * @return {string} The base64-encoded result.
+ */
+function toWebSafeBase64(data) {
+    return data.toString('base64').replace(/\//g, '_').replace(/\+/g, '-');
+}
+exports.toWebSafeBase64 = toWebSafeBase64;
+/**
+ * Formats a string of form 'project/{projectId}/{api}' and replaces
+ * with corresponding arguments {projectId: '1234', api: 'resource'}
+ * and returns output: 'project/1234/resource'.
+ *
+ * @param {string} str The original string where the param need to be
+ *     replaced.
+ * @param {object=} params The optional parameters to replace in the
+ *     string.
+ * @return {string} The resulting formatted string.
+ */
+function formatString(str, params) {
+    var formatted = str;
+    Object.keys(params || {}).forEach(function (key) {
+        formatted = formatted.replace(new RegExp('{' + key + '}', 'g'), params[key]);
+    });
+    return formatted;
+}
+exports.formatString = formatString;
+/**
+ * Generates the update mask for the provided object.
+ * Note this will ignore the last key with value undefined.
+ *
+ * @param {[key: string]: any} obj The object to generate the update mask for.
+ * @return {Array<string>} The computed update mask list.
+ */
+function generateUpdateMask(obj) {
+    var updateMask = [];
+    if (!validator.isNonNullObject(obj)) {
+        return updateMask;
+    }
+    var _loop_1 = function (key) {
+        if (obj.hasOwnProperty(key) && typeof obj[key] !== 'undefined') {
+            var maskList = generateUpdateMask(obj[key]);
+            if (maskList.length > 0) {
+                maskList.forEach(function (mask) {
+                    updateMask.push(key + "." + mask);
+                });
+            }
+            else {
+                updateMask.push(key);
+            }
+        }
+    };
+    for (var key in obj) {
+        _loop_1(key);
+    }
+    return updateMask;
+}
+exports.generateUpdateMask = generateUpdateMask;

node_modules/firebase-admin/lib/utils/validator.js

@@ -0,0 +1,237 @@
+/*! firebase-admin v8.9.2 */
+"use strict";
+/*!
+ * Copyright 2017 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+var url = require("url");
+/**
+ * Validates that a value is a byte buffer.
+ *
+ * @param {any} value The value to validate.
+ * @return {boolean} Whether the value is byte buffer or not.
+ */
+function isBuffer(value) {
+    return value instanceof Buffer;
+}
+exports.isBuffer = isBuffer;
+/**
+ * Validates that a value is an array.
+ *
+ * @param {any} value The value to validate.
+ * @return {boolean} Whether the value is an array or not.
+ */
+function isArray(value) {
+    return Array.isArray(value);
+}
+exports.isArray = isArray;
+/**
+ * Validates that a value is a non-empty array.
+ *
+ * @param {any} value The value to validate.
+ * @return {boolean} Whether the value is a non-empty array or not.
+ */
+function isNonEmptyArray(value) {
+    return isArray(value) && value.length !== 0;
+}
+exports.isNonEmptyArray = isNonEmptyArray;
+/**
+ * Validates that a value is a boolean.
+ *
+ * @param {any} value The value to validate.
+ * @return {boolean} Whether the value is a boolean or not.
+ */
+function isBoolean(value) {
+    return typeof value === 'boolean';
+}
+exports.isBoolean = isBoolean;
+/**
+ * Validates that a value is a number.
+ *
+ * @param {any} value The value to validate.
+ * @return {boolean} Whether the value is a number or not.
+ */
+function isNumber(value) {
+    return typeof value === 'number' && !isNaN(value);
+}
+exports.isNumber = isNumber;
+/**
+ * Validates that a value is a string.
+ *
+ * @param {any} value The value to validate.
+ * @return {boolean} Whether the value is a string or not.
+ */
+function isString(value) {
+    return typeof value === 'string';
+}
+exports.isString = isString;
+/**
+ * Validates that a value is a base64 string.
+ *
+ * @param {any} value The value to validate.
+ * @return {boolean} Whether the value is a base64 string or not.
+ */
+function isBase64String(value) {
+    if (!isString(value)) {
+        return false;
+    }
+    return /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value);
+}
+exports.isBase64String = isBase64String;
+/**
+ * Validates that a value is a non-empty string.
+ *
+ * @param {any} value The value to validate.
+ * @return {boolean} Whether the value is a non-empty string or not.
+ */
+function isNonEmptyString(value) {
+    return isString(value) && value !== '';
+}
+exports.isNonEmptyString = isNonEmptyString;
+/**
+ * Validates that a value is a nullable object.
+ *
+ * @param {any} value The value to validate.
+ * @return {boolean} Whether the value is an object or not.
+ */
+function isObject(value) {
+    return typeof value === 'object' && !isArray(value);
+}
+exports.isObject = isObject;
+/**
+ * Validates that a value is a non-null object.
+ *
+ * @param {any} value The value to validate.
+ * @return {boolean} Whether the value is a non-null object or not.
+ */
+function isNonNullObject(value) {
+    return isObject(value) && value !== null;
+}
+exports.isNonNullObject = isNonNullObject;
+/**
+ * Validates that a string is a valid Firebase Auth uid.
+ *
+ * @param {any} uid The string to validate.
+ * @return {boolean} Whether the string is a valid Firebase Auth uid.
+ */
+function isUid(uid) {
+    return typeof uid === 'string' && uid.length > 0 && uid.length <= 128;
+}
+exports.isUid = isUid;
+/**
+ * Validates that a string is a valid Firebase Auth password.
+ *
+ * @param {any} password The password string to validate.
+ * @return {boolean} Whether the string is a valid Firebase Auth password.
+ */
+function isPassword(password) {
+    // A password must be a string of at least 6 characters.
+    return typeof password === 'string' && password.length >= 6;
+}
+exports.isPassword = isPassword;
+/**
+ * Validates that a string is a valid email.
+ *
+ * @param {any} email The string to validate.
+ * @return {boolean} Whether the string is valid email or not.
+ */
+function isEmail(email) {
+    if (typeof email !== 'string') {
+        return false;
+    }
+    // There must at least one character before the @ symbol and another after.
+    var re = /^[^@]+@[^@]+$/;
+    return re.test(email);
+}
+exports.isEmail = isEmail;
+/**
+ * Validates that a string is a valid phone number.
+ *
+ * @param {any} phoneNumber The string to validate.
+ * @return {boolean} Whether the string is a valid phone number or not.
+ */
+function isPhoneNumber(phoneNumber) {
+    if (typeof phoneNumber !== 'string') {
+        return false;
+    }
+    // Phone number validation is very lax here. Backend will enforce E.164
+    // spec compliance and will normalize accordingly.
+    // The phone number string must be non-empty and starts with a plus sign.
+    var re1 = /^\+/;
+    // The phone number string must contain at least one alphanumeric character.
+    var re2 = /[\da-zA-Z]+/;
+    return re1.test(phoneNumber) && re2.test(phoneNumber);
+}
+exports.isPhoneNumber = isPhoneNumber;
+/**
+ * Validates that a string is a valid web URL.
+ *
+ * @param {any} urlStr The string to validate.
+ * @return {boolean} Whether the string is valid web URL or not.
+ */
+function isURL(urlStr) {
+    if (typeof urlStr !== 'string') {
+        return false;
+    }
+    // Lookup illegal characters.
+    var re = /[^a-z0-9\:\/\?\#\[\]\@\!\$\&\'\(\)\*\+\,\;\=\.\-\_\~\%]/i;
+    if (re.test(urlStr)) {
+        return false;
+    }
+    try {
+        var uri = url.parse(urlStr);
+        var scheme = uri.protocol;
+        var slashes = uri.slashes;
+        var hostname = uri.hostname;
+        var pathname = uri.pathname;
+        if ((scheme !== 'http:' && scheme !== 'https:') || !slashes) {
+            return false;
+        }
+        // Validate hostname: Can contain letters, numbers, underscore and dashes separated by a dot.
+        // Each zone must not start with a hyphen or underscore.
+        if (!hostname || !/^[a-zA-Z0-9]+[\w\-]*([\.]?[a-zA-Z0-9]+[\w\-]*)*$/.test(hostname)) {
+            return false;
+        }
+        // Allow for pathnames: (/chars+)*/?
+        // Where chars can be a combination of: a-z A-Z 0-9 - _ . ~ ! $ & ' ( ) * + , ; = : @ %
+        var pathnameRe = /^(\/[\w\-\.\~\!\$\'\(\)\*\+\,\;\=\:\@\%]+)*\/?$/;
+        // Validate pathname.
+        if (pathname &&
+            pathname !== '/' &&
+            !pathnameRe.test(pathname)) {
+            return false;
+        }
+        // Allow any query string and hash as long as no invalid character is used.
+    }
+    catch (e) {
+        return false;
+    }
+    return true;
+}
+exports.isURL = isURL;
+/**
+ * Validates that the provided topic is a valid FCM topic name.
+ *
+ * @param {any} topic The topic to validate.
+ * @return {boolean} Whether the provided topic is a valid FCM topic name.
+ */
+function isTopic(topic) {
+    if (typeof topic !== 'string') {
+        return false;
+    }
+    var VALID_TOPIC_REGEX = /^(\/topics\/)?(private\/)?[a-zA-Z0-9-_.~%]+$/;
+    return VALID_TOPIC_REGEX.test(topic);
+}
+exports.isTopic = isTopic;