feat(auth): Added FDL deprecation support for Firebase Auth (#2752)

Added linkDomain support for ActionCodeSettings deprecating dynamicLinkDomain.
Added mobileLinksConfig support for updating project configs

---------

Co-authored-by: Pavan Shankar <pavanshankar@google.com>

Author: Xiaoshouzi-gh

etc/firebase-admin.auth.api.md

@@ -13,11 +13,13 @@ export interface ActionCodeSettings {
         installApp?: boolean;
         minimumVersion?: string;
     };
+    // @deprecated
     dynamicLinkDomain?: string;
     handleCodeInApp?: boolean;
     iOS?: {
         bundleId: string;
     };
+    linkDomain?: string;
     url: string;
 }
 
@@ -221,6 +223,11 @@ export class AuthClientErrorCode {
         message: string;
     };
     // (undocumented)
+    static INVALID_HOSTING_LINK_DOMAIN: {
+        code: string;
+        message: string;
+    };
+    // (undocumented)
     static INVALID_ID_TOKEN: {
         code: string;
         message: string;
@@ -757,6 +764,14 @@ export interface ListUsersResult {
     users: UserRecord[];
 }
 
+// @public
+export interface MobileLinksConfig {
+    domain?: MobileLinksDomain;
+}
+
+// @public
+export type MobileLinksDomain = 'HOSTING_DOMAIN' | 'FIREBASE_DYNAMIC_LINK_DOMAIN';
+
 // @public
 export interface MultiFactorConfig {
     factorIds?: AuthFactorType[];
@@ -847,6 +862,7 @@ export class PhoneMultiFactorInfo extends MultiFactorInfo {
 // @public
 export class ProjectConfig {
     readonly emailPrivacyConfig?: EmailPrivacyConfig;
+    readonly mobileLinksConfig?: MobileLinksConfig;
     get multiFactorConfig(): MultiFactorConfig | undefined;
     readonly passwordPolicyConfig?: PasswordPolicyConfig;
     get recaptchaConfig(): RecaptchaConfig | undefined;
@@ -996,6 +1012,7 @@ export interface UpdatePhoneMultiFactorInfoRequest extends BaseUpdateMultiFactor
 // @public
 export interface UpdateProjectConfigRequest {
     emailPrivacyConfig?: EmailPrivacyConfig;
+    mobileLinksConfig?: MobileLinksConfig;
     multiFactorConfig?: MultiFactorConfig;
     passwordPolicyConfig?: PasswordPolicyConfig;
     recaptchaConfig?: RecaptchaConfig;

src/auth/action-code-settings-builder.ts

@@ -94,15 +94,27 @@ export interface ActionCodeSettings {
    * configured per project. This field provides the ability to explicitly choose
    * configured per project. This fields provides the ability explicitly choose
    * one. If none is provided, the oldest domain is used by default.
+   * @deprecated use `linkDomain` instead
    */
   dynamicLinkDomain?: string;
+
+  /**
+   * Defines the custom Firebase Hosting domain to use when the link is to be opened
+   * via a specified mobile app,
+   * This is a replacement of Firebase Dynamic Link.
+   * If none is provided, 
+   * a default hosting domain will be used (for example, `example.firebaseapp.com`)
+   */
+
+  linkDomain?: string;
 }
 
 /** Defines the email action code server request. */
 interface EmailActionCodeRequest {
   continueUrl?: string;
   canHandleCodeInApp?: boolean;
   dynamicLinkDomain?: string;
+  linkDomain?: string;
   androidPackageName?: string;
   androidMinimumVersion: string;
   androidInstallApp?: boolean;
@@ -123,6 +135,7 @@ export class ActionCodeSettingsBuilder {
   private ibi?: string;
   private canHandleCodeInApp?: boolean;
   private dynamicLinkDomain?: string;
+  private linkDomain?: string;
 
   /**
    * ActionCodeSettingsBuilder constructor.
@@ -166,6 +179,14 @@ export class ActionCodeSettingsBuilder {
     }
     this.dynamicLinkDomain = actionCodeSettings.dynamicLinkDomain;
 
+    if (typeof actionCodeSettings.linkDomain !== 'undefined' &&
+      !validator.isNonEmptyString(actionCodeSettings.linkDomain)) {
+      throw new FirebaseAuthError(
+        AuthClientErrorCode.INVALID_HOSTING_LINK_DOMAIN,
+      );
+    }
+    this.linkDomain = actionCodeSettings.linkDomain;
+
     if (typeof actionCodeSettings.iOS !== 'undefined') {
       if (!validator.isNonNullObject(actionCodeSettings.iOS)) {
         throw new FirebaseAuthError(
@@ -230,6 +251,7 @@ export class ActionCodeSettingsBuilder {
       continueUrl: this.continueUrl,
       canHandleCodeInApp: this.canHandleCodeInApp,
       dynamicLinkDomain: this.dynamicLinkDomain,
+      linkDomain: this.linkDomain,
       androidPackageName: this.apn,
       androidMinimumVersion: this.amv,
       androidInstallApp: this.installApp,

src/auth/auth-config.ts

@@ -2137,6 +2137,60 @@ export interface PasswordPolicyConfig {
   constraints?: CustomStrengthOptionsConfig;
 }
 
+/**
+ * Configuration for settings related to univeral links (iOS)
+ * and app links (Android).
+ */
+export interface MobileLinksConfig {
+  /**
+   * Use Firebase Hosting or dynamic link domain as the out-of-band code domain.
+   */
+  domain?: MobileLinksDomain;
+}
+
+/**
+ * Open code in app domain to use for app links and universal links.
+ */
+export type MobileLinksDomain = 'HOSTING_DOMAIN' | 'FIREBASE_DYNAMIC_LINK_DOMAIN';
+
+/**
+ * Defines the MobileLinksAuthConfig class used for validation.
+ *
+ * @internal
+ */
+export class MobileLinksAuthConfig {
+  public static validate(options: MobileLinksConfig): void {
+    if (!validator.isNonNullObject(options)) {
+      throw new FirebaseAuthError(
+        AuthClientErrorCode.INVALID_CONFIG,
+        '"MobileLinksConfig" must be a non-null object.',
+      );
+    }
+
+    const validKeys = {
+      domain: true,
+    };
+
+    for (const key in options) {
+      if (!(key in validKeys)) {
+        throw new FirebaseAuthError(
+          AuthClientErrorCode.INVALID_CONFIG,
+          `"${key}" is not a valid "MobileLinksConfig" parameter.`,
+        );
+      }
+    }
+
+    if (typeof options.domain !== 'undefined'
+      && options.domain !== 'HOSTING_DOMAIN'
+      && options.domain !== 'FIREBASE_DYNAMIC_LINK_DOMAIN') {
+      throw new FirebaseAuthError(
+        AuthClientErrorCode.INVALID_CONFIG,
+        '"MobileLinksConfig.domain" must be either "HOSTING_DOMAIN" or "FIREBASE_DYNAMIC_LINK_DOMAIN".',
+      );
+    }
+  }
+}
+
 /**
  * A password policy's enforcement state.
  */

src/auth/base-auth.ts

@@ -749,7 +749,7 @@ export abstract class BaseAuth {
    *     minimumVersion: '12'
    *   },
    *   handleCodeInApp: true,
-   *   dynamicLinkDomain: 'custom.page.link'
+   *   linkDomain: 'project-id.firebaseapp.com'
    * };
    * admin.auth()
    *     .generatePasswordResetLink('user@example.com', actionCodeSettings)
@@ -802,7 +802,7 @@ export abstract class BaseAuth {
    *     minimumVersion: '12'
    *   },
    *   handleCodeInApp: true,
-   *   dynamicLinkDomain: 'custom.page.link'
+   *   linkDomain: 'project-id.firebaseapp.com'
    * };
    * admin.auth()
    *     .generateEmailVerificationLink('user@example.com', actionCodeSettings)
@@ -883,7 +883,7 @@ export abstract class BaseAuth {
    *     minimumVersion: '12'
    *   },
    *   handleCodeInApp: true,
-   *   dynamicLinkDomain: 'custom.page.link'
+   *   linkDomain: 'project-id.firebaseapp.com'
    * };
    * admin.auth()
    *     .generateEmailVerificationLink('user@example.com', actionCodeSettings)

src/auth/index.ts

@@ -104,6 +104,8 @@ export {
   PasswordPolicyEnforcementState,
   CustomStrengthOptionsConfig,
   EmailPrivacyConfig,
+  MobileLinksConfig,
+  MobileLinksDomain,
 } from './auth-config';
 
 export {

src/auth/project-config.ts

@@ -29,6 +29,8 @@ import {
   PasswordPolicyConfig,
   EmailPrivacyConfig,
   EmailPrivacyAuthConfig,
+  MobileLinksConfig,
+  MobileLinksAuthConfig,
 } from './auth-config';
 import { deepCopy } from '../utils/deep-copy';
 
@@ -60,6 +62,11 @@ export interface UpdateProjectConfigRequest {
    * The email privacy configuration to update on the project
    */
   emailPrivacyConfig?: EmailPrivacyConfig;
+
+  /**
+   * The mobile links configuration for the project
+   */
+  mobileLinksConfig?: MobileLinksConfig;
 }
 
 /**
@@ -71,6 +78,7 @@ export interface ProjectConfigServerResponse {
   recaptchaConfig?: RecaptchaAuthServerConfig;
   passwordPolicyConfig?: PasswordPolicyAuthServerConfig;
   emailPrivacyConfig?: EmailPrivacyConfig;
+  mobileLinksConfig?: MobileLinksConfig;
 }
 
 /**
@@ -82,6 +90,7 @@ export interface ProjectConfigClientRequest {
   recaptchaConfig?: RecaptchaAuthServerConfig;
   passwordPolicyConfig?: PasswordPolicyAuthServerConfig;
   emailPrivacyConfig?: EmailPrivacyConfig;
+  mobileLinksConfig?: MobileLinksConfig;
 }
 
 /**
@@ -128,6 +137,11 @@ export class ProjectConfig {
    */
   public readonly emailPrivacyConfig?: EmailPrivacyConfig;
 
+  /**
+   * The mobile links configuration for the project
+   */
+  public readonly mobileLinksConfig?: MobileLinksConfig
+  
   /**
    * Validates a project config options object. Throws an error on failure.
    *
@@ -146,6 +160,7 @@ export class ProjectConfig {
       recaptchaConfig: true,
       passwordPolicyConfig: true,
       emailPrivacyConfig: true,
+      mobileLinksConfig: true,
     }
     // Check for unsupported top level attributes.
     for (const key in request) {
@@ -179,6 +194,11 @@ export class ProjectConfig {
     if (typeof request.emailPrivacyConfig !== 'undefined') {
       EmailPrivacyAuthConfig.validate(request.emailPrivacyConfig);
     }
+
+    // Validate Mobile Links Config if provided.
+    if (typeof request.mobileLinksConfig !== 'undefined') {
+      MobileLinksAuthConfig.validate(request.mobileLinksConfig);
+    }
   }
 
   /**
@@ -206,6 +226,9 @@ export class ProjectConfig {
     if (typeof configOptions.emailPrivacyConfig !== 'undefined') {
       request.emailPrivacyConfig = configOptions.emailPrivacyConfig;
     }
+    if (typeof configOptions.mobileLinksConfig !== 'undefined') {
+      request.mobileLinksConfig = configOptions.mobileLinksConfig;
+    }
     return request;
   }
 
@@ -234,6 +257,9 @@ export class ProjectConfig {
     if (typeof response.emailPrivacyConfig !== 'undefined') {
       this.emailPrivacyConfig = response.emailPrivacyConfig;
     }
+    if (typeof response.mobileLinksConfig !== 'undefined') {
+      this.mobileLinksConfig = response.mobileLinksConfig;
+    }
   }
   /**
    * Returns a JSON-serializable representation of this object.
@@ -248,6 +274,7 @@ export class ProjectConfig {
       recaptchaConfig: deepCopy(this.recaptchaConfig),
       passwordPolicyConfig: deepCopy(this.passwordPolicyConfig),
       emailPrivacyConfig: deepCopy(this.emailPrivacyConfig),
+      mobileLinksConfig: deepCopy(this.mobileLinksConfig),
     };
     if (typeof json.smsRegionConfig === 'undefined') {
       delete json.smsRegionConfig;
@@ -264,6 +291,9 @@ export class ProjectConfig {
     if (typeof json.emailPrivacyConfig === 'undefined') {
       delete json.emailPrivacyConfig;
     }
+    if (typeof json.mobileLinksConfig === 'undefined') {
+      delete json.mobileLinksConfig;
+    }
     return json;
   }
 }

src/utils/error.ts

@@ -471,6 +471,11 @@ export class AuthClientErrorCode {
     message: 'The provided dynamic link domain is not configured or authorized ' +
       'for the current project.',
   };
+  public static INVALID_HOSTING_LINK_DOMAIN = {
+    code: 'invalid-hosting-link-domain',
+    message: 'The provided hosting link domain is not configured in Firebase ' +
+      'Hosting or is not owned by the current project.',
+  };
   public static INVALID_EMAIL_VERIFIED = {
     code: 'invalid-email-verified',
     message: 'The emailVerified field must be a boolean.',
@@ -933,6 +938,8 @@ const AUTH_SERVER_TO_CLIENT_CODE: ServerToClientCode = {
   INVALID_CONTINUE_URI: 'INVALID_CONTINUE_URI',
   // Dynamic link domain in provided ActionCodeSettings is not authorized.
   INVALID_DYNAMIC_LINK_DOMAIN: 'INVALID_DYNAMIC_LINK_DOMAIN',
+  // Hosting link domain in provided ActionCodeSettings is not owned by the current project.
+  INVALID_HOSTING_LINK_DOMAIN: 'INVALID_HOSTING_LINK_DOMAIN',
   // uploadAccount provides an email that already exists.
   DUPLICATE_EMAIL: 'EMAIL_ALREADY_EXISTS',
   // uploadAccount provides a localId that already exists.