FR: Get IDTokens from test users

[aaahrens]

Is there any way to get ID tokens from test users without having to use the c++ sdk or the node client? Just curious for testing purposes. Mocking an auth flow would be super nice

[belek]

+1. Really need this feature!

[hiranya911]

Create a custom token and exchange it for an ID token via the REST API. See how we do it in our integration tests: https://github.com/firebase/firebase-admin-go/blob/master/integration/auth/auth_test.go#L199

Or you can just mint a fake ID token yourself: https://github.com/firebase/firebase-admin-go/blob/master/auth/auth_test.go#L428

[rohansingh]

@hiranya911 Is it by design that the verifyCustomToken endpoint isn't implemented in auth.Client?

[hiranya911]

Yes, that's not an operation we expect developers to use in typical flows. It's only use is for testing as far as I can tell (we use it in our own integration tests).

[rohansingh]

@hiranya911 That makes sense, though having the method implemented would enable a couple scenarios:

1. Testing, as you've mentioned. This is my main use case, and while I could definitely just do the same thing in my own tests, it'd be nice to just have it implemented. I'm strongly of the opinion that tests should be considered a first-class use case.

2. I can't quite put my finger on it at the moment, but having verifyCustomToken might also allow something around using Firebase Auth in situations where a Firebase client SDK isn't available? Not sure.

3. It would make it easy for an application to verify a custom token that it previously issued. I know that the application could just implement its own JWT verification, but just like the first scenario, it'd be nice to just have it implemented.

4. Very minor side benefit: less likely to have invalid issues like Token verification failure for generated tokens firebase-admin-python#51, where users mistakenly try to verify a custom token against a VerifyIDToken method.

If you're not absolutely against it, I'm happy to open a PR.

[hiranya911]

@bojeil-google what do you think?

[bojeil-google]

verifyCustomToken is a client API. We prefer to keep it this way. It is treated as such from the Auth server. and could be subject to similar restrictions that other client APIs are subject to. That said, I will relay this request to the rest of the team.

[rohansingh]

That makes sense. As an alternative to introducing it to the auth.Client interface, I think it could also be helpful to have some sort of test helper that wraps the functionality. I know it's only about 20 lines of code and I've already replicated it in my own tests, but it'd be nice to have upstreamed.