firebase
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,2 +0,0 @@
-- Shows missing documents in Emulator UI Firestore viewer.
-- Better supports paths with special characters in Emulator UI Firestore viewer.

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "firebase-tools",
-  "version": "8.19.0",
+  "version": "8.20.0",
   "description": "Command-Line Interface for Firebase",
   "main": "./lib/index.js",
   "bin": {
@@ -73,7 +73,7 @@
     ]
   },
   "dependencies": {
-    "@google-cloud/pubsub": "^1.7.0",
+    "@google-cloud/pubsub": "^2.7.0",
     "JSONStream": "^1.2.1",
     "abort-controller": "^3.0.0",
     "archiver": "^3.0.0",
@@ -94,8 +94,7 @@
     "filesize": "^3.1.3",
     "fs-extra": "^0.23.1",
     "glob": "^7.1.2",
-    "google-auth-library": "^5.5.0",
-    "google-gax": "~1.12.0",
+    "google-auth-library": "^6.1.3",
     "inquirer": "~6.3.1",
     "js-yaml": "^3.13.1",
     "jsonschema": "^1.0.2",
@@ -179,7 +178,7 @@
     "eslint-plugin-jsdoc": "^22.1.0",
     "eslint-plugin-prettier": "^3.1.0",
     "firebase": "^7.24.0",
-    "firebase-admin": "^8.9.0",
+    "firebase-admin": "^9.4.2",
     "firebase-functions": "^3.11.0",
     "google-discovery-to-swagger": "^2.1.0",
     "mocha": "^8.2.1",

diff --git a/src/emulator/auth/operations.ts b/src/emulator/auth/operations.ts
@@ -495,7 +495,6 @@ function sendOobCode(
     );
   }
 
-  let user: UserInfo | undefined;
   let email: string;
   let mode: string;
 
@@ -509,15 +508,24 @@ function sendOobCode(
       mode = "resetPassword";
       assert(reqBody.email, "MISSING_EMAIL");
       email = canonicalizeEmailAddress(reqBody.email);
-      user = state.getUserByEmail(email);
-      assert(user, "EMAIL_NOT_FOUND");
+      assert(state.getUserByEmail(email), "EMAIL_NOT_FOUND");
       break;
     case "VERIFY_EMAIL":
       mode = "verifyEmail";
-      // Get the user from idToken, reqBody.email is ignored.
-      user = parseIdToken(state, reqBody.idToken || "").user;
-      assert(user.email, "MISSING_EMAIL");
-      email = user.email;
+
+      // Matching production behavior, reqBody.returnOobLink is used as a signal
+      // for Admin usage (instead of whether request is OAuth 2 authenticated.)
+      if (reqBody.returnOobLink && !reqBody.idToken) {
+        assert(reqBody.email, "MISSING_EMAIL");
+        email = canonicalizeEmailAddress(reqBody.email);
+        const maybeUser = state.getUserByEmail(email);
+        assert(maybeUser, "USER_NOT_FOUND");
+      } else {
+        // Get the user from idToken, reqBody.email is ignored.
+        const user = parseIdToken(state, reqBody.idToken || "").user;
+        assert(user.email, "MISSING_EMAIL");
+        email = user.email;
+      }
       break;
 
     default:

diff --git a/src/hosting/proxy.ts b/src/hosting/proxy.ts
@@ -139,7 +139,7 @@ export function proxyRequestHandler(url: string, rewriteIdentifier: string): Req
 
     proxyRes.response.headers.set("vary", makeVary(proxyRes.response.headers.get("vary")));
 
-    for (const [key, value] of proxyRes.response.headers) {
+    for (const [key, value] of Object.entries(proxyRes.response.headers.raw())) {
       res.setHeader(key, value);
     }
     res.statusCode = proxyRes.status;

diff --git a/src/test/emulators/auth/oob.spec.ts b/src/test/emulators/auth/oob.spec.ts
@@ -63,16 +63,75 @@ describeAuthEmulator("accounts:sendOobCode", ({ authApi, getClock }) => {
         expect(res.body.oobCode).to.be.a("string");
         expect(res.body.oobLink).to.be.a("string");
       });
+
+    await authApi()
+      .post("/identitytoolkit.googleapis.com/v1/accounts:sendOobCode")
+      .set("Authorization", "Bearer owner")
+      .send({ email: user.email, requestType: "VERIFY_EMAIL", returnOobLink: true })
+      .then((res) => {
+        expectStatusCode(200, res);
+        expect(res.body.email).to.equal(user.email);
+        expect(res.body.oobCode).to.be.a("string");
+        expect(res.body.oobLink).to.be.a("string");
+      });
+  });
+
+  it("should return OOB code by idToken for OAuth 2 requests as well", async () => {
+    const user = { email: "alice@example.com", password: "notasecret" };
+    const { idToken } = await registerUser(authApi(), user);
+    await authApi()
+      .post("/identitytoolkit.googleapis.com/v1/accounts:sendOobCode")
+      .set("Authorization", "Bearer owner")
+      .send({ idToken, requestType: "VERIFY_EMAIL", returnOobLink: true })
+      .then((res) => {
+        expectStatusCode(200, res);
+        expect(res.body.email).to.equal(user.email);
+        expect(res.body.oobCode).to.be.a("string");
+        expect(res.body.oobLink).to.be.a("string");
+      });
   });
 
-  it("should error when trying to verify email without idToken", async () => {
+  it("should error when trying to verify email without idToken or email", async () => {
     const user = { email: "alice@example.com", password: "notasecret" };
     await registerUser(authApi(), user);
 
     await authApi()
       .post("/identitytoolkit.googleapis.com/v1/accounts:sendOobCode")
       .query({ key: "fake-api-key" })
-      // Just email, no idToken. (It works for password reset but not verify.)
+      .send({ requestType: "VERIFY_EMAIL" })
+      .then((res) => {
+        expectStatusCode(400, res);
+        expect(res.body.error)
+          .to.have.property("message")
+          .equal("INVALID_ID_TOKEN");
+      });
+
+    await authApi()
+      .post("/identitytoolkit.googleapis.com/v1/accounts:sendOobCode")
+      .set("Authorization", "Bearer owner")
+      // This causes a different error message to be returned, see below.
+      .send({ returnOobLink: true, requestType: "VERIFY_EMAIL" })
+      .then((res) => {
+        expectStatusCode(400, res);
+        expect(res.body.error)
+          .to.have.property("message")
+          .equal("MISSING_EMAIL");
+      });
+
+    const oobs = await inspectOobs(authApi());
+    expect(oobs).to.have.length(0);
+  });
+
+  it("should error when trying to verify email without idToken if not returnOobLink", async () => {
+    const user = await registerUser(authApi(), {
+      email: "alice@example.com",
+      password: "notasecret",
+    });
+
+    await authApi()
+      .post("/identitytoolkit.googleapis.com/v1/accounts:sendOobCode")
+      .query({ key: "fake-api-key" })
+      // email here is ignored because returnOobLink is not set.
       .send({ email: user.email, requestType: "VERIFY_EMAIL" })
       .then((res) => {
         expectStatusCode(400, res);
@@ -85,6 +144,22 @@ describeAuthEmulator("accounts:sendOobCode", ({ authApi, getClock }) => {
     expect(oobs).to.have.length(0);
   });
 
+  it("should error when trying to verify email not associated with any user", async () => {
+    await authApi()
+      .post("/identitytoolkit.googleapis.com/v1/accounts:sendOobCode")
+      .set("Authorization", "Bearer owner")
+      .send({ email: "nosuchuser@example.com", returnOobLink: true, requestType: "VERIFY_EMAIL" })
+      .then((res) => {
+        expectStatusCode(400, res);
+        expect(res.body.error)
+          .to.have.property("message")
+          .equal("USER_NOT_FOUND");
+      });
+
+    const oobs = await inspectOobs(authApi());
+    expect(oobs).to.have.length(0);
+  });
+
   it("should error when verifying email for accounts without email", async () => {
     const { idToken } = await registerAnonUser(authApi());
 

diff --git a/src/test/hosting/functionsProxy.spec.ts b/src/test/hosting/functionsProxy.spec.ts
@@ -132,6 +132,31 @@ describe("functionsProxy", () => {
       });
   });
 
+  it("should pass through multiple set-cookie headers", async () => {
+    nock("http://localhost:7778")
+      .get("/project-foo/us-central1/bar/")
+      .reply(200, "crisp", {
+        "Set-Cookie": ["foo=bar", "bar=zap"],
+      });
+
+    const options = cloneDeep(fakeOptions);
+    options.targets = ["functions"];
+
+    const mwGenerator = functionsProxy(options);
+    const mw = await mwGenerator(fakeRewrite);
+    const spyMw = sinon.spy(mw);
+
+    return supertest(spyMw)
+      .get("/")
+      .expect("crisp")
+      .then((res) => {
+        expect(res.header["set-cookie"]).to.have.length(2);
+        expect(res.header["set-cookie"]).to.include("foo=bar");
+        expect(res.header["set-cookie"]).to.include("bar=zap");
+        expect(spyMw.calledOnce).to.be.true;
+      });
+  });
+
   it("should pass through normal 404 errors", async () => {
     nock("https://us-central1-project-foo.cloudfunctions.net")
       .get("/bar/404.html")
Original file line number	Diff line number	Diff line change
		@@ -1,2 +0,0 @@
		- Shows missing documents in Emulator UI Firestore viewer.
		- Better supports paths with special characters in Emulator UI Firestore viewer.