feature/CF3-Auth-Event-Triggers by shettyvarun268 · Pull Request #1897 · firebase/firebase-functions

shettyvarun268 · 2026-05-28T19:54:55Z

This pull request introduces support for Firebase Authentication event triggers in Cloud Functions v2 by adding the onUserCreated and onUserDeleted functions. These new triggers leverage Eventarc to listen for user lifecycle events at both the project and tenant levels, unblocking a key migration path for developers moving from V1 to V2. To ensure a maintainable implementation, a shared helper function called makeAuthTrigger was created to handle the common logic for manifest generation and event execution wrapping, effectively reducing code duplication and keeping the implementation DRY. The PR also ensures correct deployment behavior by setting the trigger region to global in the generated manifest, aligning with Eventarc's requirements for these global events and preventing location mismatch errors during deployment. Comprehensive unit tests have been added to cover standard behavior as well as edge cases involving missing or parameterized tenant IDs, ensuring robust operation in diverse environments.

gemini-code-assist

Code Review

This pull request introduces Firebase Authentication v2 triggers (onUserCreated and onUserDeleted) for Google Cloud Identity Platform, along with comprehensive unit tests. The feedback identifies three key issues: first, project and tenantId in AuthEvent should be marked as optional since they can be undefined at runtime; second, the raw event parameter should be shallow-copied instead of mutated directly to prevent side effects; and third, the truthiness check for opts.tenantId should be replaced with a strict undefined check to correctly handle empty string values.

shettyvarun268 · 2026-06-01T16:42:17Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces support for Firebase Authentication event triggers (onUserCreated and onUserDeleted) in Cloud Functions v2, including the necessary types, helper functions, and comprehensive unit tests. The feedback recommends optimizing the event trigger implementation by wrapping the handler at definition time to avoid runtime closure overhead, enhancing robustness by supporting both camelCase and lowercase tenant IDs, making the project ID regex extraction more flexible, and adding a definition-time validation check for the handler function.

shettyvarun268 · 2026-06-01T17:25:14Z

/gemini review

gemini-code-assist

Code Review

This pull request adds support for Firebase Authentication event triggers (onUserCreated and onUserDeleted) in Cloud Functions v2. The feedback suggests correctly parsing the raw CloudEvent data payload into a proper UserRecord instance using userRecordConstructor, updating the unit tests to verify this parsing, and cleaning up a duplicate argument in the copyIfPresent call.

wandamora

Thanks for making the changes!

inlined

Since you're creating new files you're going to need to edit package.json to map the import path to the actual file for both JS and .d.ts files. You also need to create a dummy file in /v2 (not /src/v2) due to a longstanding bug in eslint that follows actual paths instead of declared import paths. IDR if it's been fixed; last I checked and filed the bug report, the package maintainer tried to extort me to fix it 🫠

inlined · 2026-06-12T23:29:08Z

+
+    it("should handle IS_NOT_TENANT option", () => {
+      const func = identity.onUserCreated({ tenantId: identity.IS_NOT_TENANT }, () => null);
+      expect(func.__endpoint.eventTrigger?.eventFilters?.tenantid).to.equal("");


Just to be clear, does this mean there's a semantic difference between any of null, undefined, and ""?

Is it that unspecified listens to all tenants and "" listens to no tenant?

Thats right. Unspecified (undefined) matches the default Eventarc behavior which listens across all tenants (as well as default project users). Setting it to IS_NOT_TENANT sets the manifest filter to "", which instructs Eventarc to match only users created in the default project (no tenant). Providing a specific string scopes the trigger to that specific tenant ID.

inlined · 2026-06-12T23:30:50Z

+
+      const mockEvent = {
+        specversion: "1.0" as const,
+        source: "//identitytoolkit.googleapis.com/something-else",


This is peculiar. What are the cases for this. I clearly don't understand something about GCIP.

This test case is primarily here for defensive programming. While standard production events will include /projects/YOUR_PROJECT_ID, local emulator events, custom tests or future Eventarc routing changes might omit the /projects/ segment in source. This test ensures our regex parsing doesn't throw a runtime error and gracefully leaves event.project as undefined if raw.source has an unexpected shape. Might not be entirely necessary to keep this since we don't really expect event arc sources to change.

inlined · 2026-06-12T23:31:20Z

+      let called = false;
+      const func = identity.onUserCreated((event) => {
+        called = true;
+        expect(event.tenantId).to.be.undefined;


Is it to be present but undefined or not present?

Setting it explicitly to undefined matches the optional property definition (tenantId?: string) in the interface, while ensuring a consistent object shape for consumers who might be destructuring the payload

inlined · 2026-06-12T23:31:59Z

+    });
+
+    it("should handle Expression for tenantId", () => {
+      const param = {


You can also just call defineString and delete it with the private API later

Good point. I've updated the test to use defineString('MY_TENANT') and clean up afterward with clearParams()

inlined · 2026-06-12T23:33:10Z

+ */
+export interface AuthEvent<T> extends CloudEvent<T> {
+  /** The project identifier*/
+  project?: string;


nit: spaces between fields with comments.

Done! Added blank lines between fields in AuthEvent

inlined · 2026-06-12T23:38:51Z

+    eventTrigger: {
+      eventType,
+      eventFilters: {},
+      retry: false, // Default retry policy


I'm curious: if it's the default, why does it need to be specified? Do we need to fix something elsewhere?

While false is the default behavior on the GCP side, all other v2 event provider endpoints in the SDK explicitly initialize retry: opts.retry ?? false to ensure a fully populated manifest definition before applying overrides. Leaving it explicit here keeps this consistent with the rest of the SDK

inlined · 2026-06-12T23:40:25Z

+      retry: false, // Default retry policy
+      // Firebase Auth event triggers are global by nature, and Eventarc requires the trigger
+      // region to be set to "global" even if the Cloud Function is deployed regionally.
+      region: "global",


I wonder if the CLI should also set this? That way we're defensive against other SDKs in other languages getting it wrong? We now have automatic region setting (I think that was added in my absence?) so that should be compatible with the coding style there.

Okay noted. I've implemented a dedicated autheventarc service definition in firebase-tools. The CLI now defensively intercepts v2 Auth Eventarc triggers during deploy validation and automatically ensures endpoint.eventTrigger.region = 'global', matching the pattern used for Test Lab and Firebase Alerts. I'll send in another PR for that.

inlined · 2026-06-12T23:41:30Z

+  };
+  if (opts.tenantId !== undefined) {
+    if (opts.tenantId === IS_NOT_TENANT) {
+      endpoint.eventTrigger.eventFilters["tenantid"] = "";


I thought IS_NOT_TENANT already is "", making this a safe assignment in all cases?

IS_NOT_TENANT is actually assigned to RESET_VALUE (which is the special { __type: 'reset' }), rather than ''. Because of this, we have to check for IS_NOT_TENANT explicitly so we can map it to '' in the manifest filters, preventing the manifest from serializing the sentinel object.

inlined · 2026-06-12T23:43:28Z

+  return func;
+}
+
+const USER_CREATED_EVENT = "google.firebase.auth.user.v2.created";


Nit: Space before block comments

Done! Added blank lines before the block comments.

inlined · 2026-06-12T23:44:41Z

@@ -1 +1,2 @@
- fix(v1): Call onInit for schedule.onRun functions (#1801)
+fix(v1): Call onInit for schedule.onRun functions (#1801)
+Added support for Firebase Authentication event triggers in Cloud Functions v2 (`onUserCreated` and `onUserDeleted`). (#1897)


Leave it out of changelogs while we're testing.

Noted. Removed it from the change logs

shettyvarun268 added 2 commits May 28, 2026 19:53

First draft

add0702

Merge branch 'master' into feature/CF3-Auth-Event-Triggers

4a2ff28

gemini-code-assist Bot reviewed May 28, 2026

View reviewed changes

Comment thread src/v2/providers/identity.ts

Comment thread src/v2/providers/identity.ts

Comment thread src/v2/providers/identity.ts Outdated

shettyvarun268 added 4 commits May 28, 2026 19:56

adding changelog

9bfec3e

Resolve merge conflict in CHANGELOG.md

739932d

adding changelog

4f80659

addressing review feedback

eb622de

shettyvarun268 changed the title ~~First draft~~ feature/CF3-Auth-Event-Triggers Jun 1, 2026

gemini-code-assist Bot reviewed Jun 1, 2026

View reviewed changes

Comment thread src/v2/providers/identity.ts

shettyvarun268 added 2 commits June 1, 2026 16:57

Apply performance and robustness optimizations from review

a672029

optimizing changes

f967006

gemini-code-assist Bot reviewed Jun 1, 2026

View reviewed changes

Comment thread src/v2/providers/identity.ts

Comment thread src/v2/providers/identity.ts Outdated

Comment thread src/v2/providers/identity.ts Outdated

Comment thread spec/v2/providers/identity.spec.ts

shettyvarun268 added 2 commits June 1, 2026 17:42

gemini review comments

2d48954

linting fixes

ddf575c

shettyvarun268 marked this pull request as ready for review June 1, 2026 18:21

shettyvarun268 requested review from ajperel and wandamora June 1, 2026 18:21

wandamora reviewed Jun 1, 2026

View reviewed changes

Comment thread src/v2/providers/identity.ts

wandamora reviewed Jun 1, 2026

View reviewed changes

Comment thread src/v2/providers/identity.ts Outdated

wandamora reviewed Jun 1, 2026

View reviewed changes

Comment thread src/v2/providers/identity.ts Outdated

wandamora reviewed Jun 1, 2026

View reviewed changes

Comment thread src/v2/providers/identity.ts

shettyvarun268 added 2 commits June 3, 2026 17:38

Addressing comments

0c2b694

lint

04dfa3a

wandamora approved these changes Jun 3, 2026

View reviewed changes

shettyvarun268 requested a review from inlined June 12, 2026 19:53

inlined reviewed Jun 12, 2026

View reviewed changes

addressing comments

3be1da4

Conversation

shettyvarun268 commented May 28, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

shettyvarun268 commented Jun 1, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

shettyvarun268 commented Jun 1, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wandamora left a comment

Choose a reason for hiding this comment

Uh oh!

inlined left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels