Support verifyBeforeUpdateEmail in the Auth Emulator

[ghinda]

[REQUIRED] Environment info

firebase-tools: 13.2.0 firebase: 10.8.0

Platform: Arch

[REQUIRED] Test case

createUserWithEmailAndPassword(auth, '[email protected]', 'testing')
verifyBeforeUpdateEmail(currentUser, '[email protected]')

curl http://localhost:9099/emulator/v1/projects/project-test/oobCodes

[REQUIRED] Steps to reproduce

Change the email address of an existing Firebase Auth user, using verifyBeforeUpdateEmail instead of updateEmail.

[REQUIRED] Expected behavior

The method should generate an oob code and show the url in the Emulator logs. It should also be available in the list of generated oob codes at http://localhost:9099/emulator/v1/projects/project-test/oobCodes.

Now that Email Enumeration Protection is enabled by default for new projects, and the updateEmail method is marked as deprecated (and requires switching to verifyBeforeUpdateEmail), we should have support for verifyBeforeUpdateEmail in the emulator.

[REQUIRED] Actual behavior

Throws an 501 (Not Implemented) error because of missing Firebase Auth REST API for accounts:sendOobCode in the emulator.

POST http://localhost:9099/identitytoolkit.googleapis.com/v1/accounts:sendOobCode?key=123 501 (Not Implemented)

[aalej]

Hey @ghinda, thanks for the detailed report. The Auth emulator currently does not support this feature yet. We do understand its importance since new projects have Email Enumeration Protection enabled by default. However, we won't be able to provide a detailed timeline as to when this feature would be implemented.