feat(auth): Add support for FPNV

.github/scripts/generate_changelog.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2020 Google Inc.
+# Copyright 2020 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

.github/scripts/publish_preflight_check.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2020 Google Inc.
+# Copyright 2020 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

.github/scripts/run_all_tests.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2020 Google Inc.
+# Copyright 2020 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

.github/workflows/ci.yml

@@ -12,10 +12,10 @@ jobs:
 
     steps:
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
     - name: Set up Go ${{ matrix.go }}
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
       with:
         go-version: ${{ matrix.go }}
 

.github/workflows/nightly.yml

@@ -1,4 +1,4 @@
-# Copyright 2021 Google Inc.
+# Copyright 2021 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -29,12 +29,12 @@ jobs:
 
     steps:
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         ref: ${{ github.event.client_payload.ref || github.ref }}
 
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
       with:
         go-version: '1.23'
 
@@ -53,7 +53,7 @@ jobs:
 
     - name: Send email on failure
       if: failure()
-      uses: firebase/firebase-admin-node/.github/actions/send-email@master
+      uses: firebase/firebase-admin-node/.github/actions/send-email@2e2b36a84ba28679bcb7aecdacabfec0bded2d48 # Admin Node SDK v13.6.0
       with:
         api-key: ${{ secrets.OSS_BOT_MAILGUN_KEY }}
         domain: ${{ secrets.OSS_BOT_MAILGUN_DOMAIN }}
@@ -68,7 +68,7 @@ jobs:
 
     - name: Send email on cancelled
       if: cancelled()
-      uses: firebase/firebase-admin-node/.github/actions/send-email@master
+      uses: firebase/firebase-admin-node/.github/actions/send-email@2e2b36a84ba28679bcb7aecdacabfec0bded2d48 # Admin Node SDK v13.6.0
       with:
         api-key: ${{ secrets.OSS_BOT_MAILGUN_KEY }}
         domain: ${{ secrets.OSS_BOT_MAILGUN_DOMAIN }}

.github/workflows/release.yml

@@ -1,4 +1,4 @@
-# Copyright 2020 Google Inc.
+# Copyright 2020 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -36,16 +36,12 @@ jobs:
 
     runs-on: ubuntu-latest
 
-    # When manually triggering the build, the requester can specify a target branch or a tag
-    # via the 'ref' client parameter.
     steps:
     - name: Check out code
-      uses: actions/checkout@v4
-      with:
-        ref: ${{ github.event.client_payload.ref || github.ref }}
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
       with:
         go-version: '1.23'
 
@@ -71,57 +67,34 @@ jobs:
     #   3. with the label 'release:publish', and
     #   4. the title prefix '[chore] Release '.
     if: github.event.pull_request.merged &&
-      github.ref == 'refs/heads/dev' &&
+      github.base_ref == 'dev' &&
       contains(github.event.pull_request.labels.*.name, 'release:publish') &&
       startsWith(github.event.pull_request.title, '[chore] Release ')
 
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      pull-requests: write
 
     steps:
     - name: Checkout source for publish
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
+        ref: dev
         persist-credentials: false
 
     - name: Publish preflight check
       id: preflight
       run: ./.github/scripts/publish_preflight_check.sh
 
-    # We authorize this step with an access token that has write access to the master branch.
-    - name: Merge to master
-      uses: actions/github-script@v7
-      with:
-        github-token: ${{ secrets.FIREBASE_GITHUB_TOKEN }}
-        script: |
-            github.rest.repos.merge({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              base: 'master',
-              head: 'dev'
-            })
-
-    # See: https://cli.github.com/manual/gh_release_create
-    - name: Create release tag
+    # Create a PR to merge dev into master.
+    - name: Create Release PR
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: gh release create ${{ steps.preflight.outputs.version }}
-            --title "Firebase Admin Go SDK ${{ steps.preflight.outputs.version }}"
-            --notes '${{ steps.preflight.outputs.changelog }}'
-            --target "master"
-
-    # Post to Twitter if explicitly opted-in by adding the label 'release:tweet'.
-    - name: Post to Twitter
-      if: success() &&
-        contains(github.event.pull_request.labels.*.name, 'release:tweet')
-      uses: firebase/firebase-admin-node/.github/actions/send-tweet@master
-      with:
-        status: >
-          ${{ steps.preflight.outputs.version }} of @Firebase Admin Go SDK is available.
-          https://github.com/firebase/firebase-admin-go/releases/tag/${{ steps.preflight.outputs.version }}
-        consumer-key: ${{ secrets.FIREBASE_TWITTER_CONSUMER_KEY }}
-        consumer-secret: ${{ secrets.FIREBASE_TWITTER_CONSUMER_SECRET }}
-        access-token: ${{ secrets.FIREBASE_TWITTER_ACCESS_TOKEN }}
-        access-token-secret: ${{ secrets.FIREBASE_TWITTER_ACCESS_TOKEN_SECRET }}
-      continue-on-error: true
+        RELEASE_BODY: ${{ steps.preflight.outputs.changelog }}
+        RELEASE_TITLE: "[chore] Release ${{ steps.preflight.outputs.version }}"
+      run: |
+        gh pr create \
+          --base master \
+          --head dev \
+          --title "$RELEASE_TITLE" \
+          --body "$RELEASE_BODY"

.github/workflows/tag_release.yml

@@ -0,0 +1,49 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Tag Release
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - 'firebase.go'
+
+jobs:
+  tag_release:
+    if: startsWith(github.event.head_commit.message, '[chore] Release ')
+
+    runs-on: ubuntu-latest
+    environment: Release
+    permissions:
+      contents: write
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+    - name: Publish preflight check
+      id: preflight
+      run: ./.github/scripts/publish_preflight_check.sh
+
+    - name: Create release tag
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        RELEASE_VER: ${{ steps.preflight.outputs.version }}
+        RELEASE_NOTES: ${{ steps.preflight.outputs.changelog }}
+      run: gh release create "$RELEASE_VER" \
+            --title "Firebase Admin Go SDK $RELEASE_VER" \
+            --notes "$RELEASE_NOTES" \
+            --target "master"

AGENTS.md

@@ -0,0 +1,124 @@
+# Firebase Admin Go SDK - Agent Guide
+
+This document provides a comprehensive guide for AI agents to understand the conventions, design patterns, and architecture of the Firebase Admin Go SDK. Adhering to these guidelines is crucial for making idiomatic and consistent code contributions.
+
+## 1. High-Level Overview
+
+The Firebase Admin Go SDK enables server-side (backend) applications to interact with Firebase services. Its design emphasizes idiomatic Go, thread-safety, and a consistent, discoverable API surface.
+
+## 2. Directory Structure
+
+-   `firebase.go`: The primary entry point for initializing a Firebase `App` instance.
+-   `internal/`: Contains private implementation details, such as HTTP clients and utility functions, that are not part of the public API.
+-   `auth/`, `db/`, `messaging/`, etc.: Each directory contains a specific Firebase service client.
+-   `*_test.go`: Unit tests are located alongside the code they test (e.g., `auth/auth_test.go`).
+-   `integration/`: Contains integration tests that make live network calls to Firebase services.
+-   `snippets/`: Contains code snippets used in documentation.
+-   `errorutils/`: Contains common error type checkers and other error handling utils.
+-   `testdata/`: Contains mock data used in some tests.
+
+## 3. Core Design Patterns
+
+-   **Initialization:** The SDK is initialized by creating an `App` instance via `firebase.NewApp()`. This `App` object is the central point for accessing all service clients.
+-   **Service Clients:** Service clients (e.g., `auth.Client`, `db.Client`) are obtained from the `App` instance (e.g., `app.Auth(ctx)`). These clients are lightweight and are typically created as needed.
+-   **Error Handling:** Errors are handled using standard Go idioms. Firbase errors are defined in `internal/errors.go` however these errors can be further modified within each service. This modification is applied using that service's set `internal.HTTPClient.CreateErrFn` value.
+-   **HTTP Communication:** All outgoing HTTP requests are managed by a centralized client located in `internal/http_client.go`. This ensures consistent handling of authentication, retries, and error parsing.
+-   **Asynchronous Operations:** The SDK uses `context.Context` to manage deadlines, cancellations, and request-scoped values for all asynchronous operations.
+
+## 4. Coding Style and Naming Conventions
+
+-   **Naming:**
+    -   Public functions, types, and fields use `PascalCase`.
+    -   Private functions and types use `camelCase`.
+    -   Constants are written in `PascalCase`.
+
+## 5. Testing Philosophy
+
+-   **Unit Tests:** Unit tests follow the `*_test.go` naming pattern and are placed in the same directory as the code under test. They use standard Go testing packages and mocks to isolate dependencies.
+-   **Integration Tests:** Integration tests are located in the `integration/` directory. They are designed to run against actual Firebase services and require a configured Firebase project.
+
+## 6. Dependency Management
+
+-   **Manager:** The SDK uses Go Modules for dependency management.
+-   **Manifest:** Dependencies are declared in the `go.mod` file.
+-   **Command:** To add or update dependencies, use `go get` or `go mod tidy`.
+
+## 7. Critical Developer Journeys
+
+### Journey 1: How to Add a New API Method
+
+1.  **Define Public Method:** Add the new method or change to the appropriate service client files (e.g., `auth/user_mgt.go`).
+2.  **Internal Logic:** Implement the core logic within the service package.
+3.  **HTTP Client:** Use the client in `internal/http_client.go` to make the API calls.
+4.  **Error Handling:** New or updated error codes implemented in the appropriate location.
+5.  **Testing:**
+    -   Add unit tests in the corresponding `*_test.go` file (e.g., `auth/user_mgt_test.go`).
+    -   Add integration tests in the `integration/` directory if applicable.
+6.  **Snippets:** (Optional) Add or update code snippets in the `snippets/` directory.
+
+### Journey 2: How to Deprecate a Field/Method in an Existing API
+
+1.  **Add Deprecation Note:** Locate where the deprecated object is defined and add a deprecation warning with a note (e.g. `// Deprecated: Use X instead.`).
+
+## 8. Critical Do's and Don'ts
+
+-   **DO:** Use the centralized HTTP client in `internal/http_client.go` for all network calls.
+-   **DO:** Pass `context.Context` as the first argument to all functions that perform I/O or other blocking operations.
+-   **DO:** Run `go fmt` after implementing a change and fix any linting errors.
+-   **DON'T:** Expose types or functions from the `internal/` directory in the public API.
+-   **DON'T:** Introduce new third-party dependencies without a strong, documented justification and team consensus.
+
+## 9. Branch Creation
+- When creating a new barnch use the format `agentName-short-description`.
+    * Example: `jules-auth-token-parsing`
+    * Example: `gemini-add-storage-file-signer`
+
+
+## 10. Commit and Pull Request Generation
+
+After implementing and testing a change, you may create a commit and pull request which must follow the following these rules:
+
+### Commit and Pull Request Title Format:
+Use the [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) specification: `type(scope): subject`
+- `type` should be one of `feat`, `fix` or `chore`.
+- `scope` should be the service package changed (e.g., `auth`, `rtdb`, `deps`).
+    - **Note**: Some services use specific abbreviations. Use the abbreviation if one exists. Common abbreviations include:
+        - `messaging` -> `fcm`
+        - `dataconnect` -> `fdc`
+        - `database` -> `rtdb`
+        - `appcheck` -> `fac`
+- `subject` should be a brief summary of the change depending on the action:
+    - For pull requests this should focus on the larger goal the included commits achieve.
+        - Example: `fix(auth): Resolved issue with custom token verification`
+    - For commits this should focus on the specific changes made in that commit.
+        - Example: `fix(auth): Added a new token verification check`
+
+### Commit Body:
+    This should be a brief explanation of code changes.
+
+Example:
+```
+feat(fcm): Added `SendEachForMulticast` support for multicast messages
+
+Added a new `SendEachForMulticast` method to the messaging client. This method wraps the `SendEach` method and sends the same message to each token.
+```
+
+### Pull Request Body:
+- A brief explanation of the problem and the solution.
+- A summary of the testing strategy (e.g., "Added a new unit test to verify the fix.").
+- A **Context Sources** section that lists the `id` and repository path of every `AGENTS.md` file you used.
+
+Example:
+```
+feat(fcm): Added support for multicast messages
+
+This change introduces a new `SendEachForMulticast` method to the messaging client, allowing developers to send a single message to multiple tokens efficiently.
+
+Testing: Added unit tests in `messaging_test.go` with a mock server and an integration test in `integration/messaging_test.go`.
+
+Context Sources Used:
+- id: firebase-admin-go (`/AGENTS.md`)
+```
+
+## 11. Metadata
+- id: firebase-admin-go

CONTRIBUTING.md

@@ -148,8 +148,12 @@ Set up your Firebase project as follows:
 
 2. Enable Firestore:
    1. Go to the Firebase Console, and select **Firestore Database** from the **Build** menu.
-   2. Click on the **Create database** button. You can choose to set up Firestore either in
-   the production mode or in the test mode.
+   2. Click on the **Create database** button and create a default database. You can choose
+   to set up Firestore either in the production mode or in the test mode.
+   > **Note:** Integration tests are run against both the default database and an additional
+   database named "testing-database".
+   3. After the default database is created, click the **Add database** button to create a
+   second database named "testing-database". 
 
 
 3. Enable Realtime Database:

appcheck/appcheck.go

@@ -1,4 +1,4 @@
-// Copyright 2022 Google Inc. All Rights Reserved.
+// Copyright 2022 Google LLC All Rights Reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.

auth/auth.go

@@ -1,4 +1,4 @@
-// Copyright 2017 Google Inc. All Rights Reserved.
+// Copyright 2017 Google LLC All Rights Reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.

auth/auth_appengine.go

@@ -1,7 +1,7 @@
 //go:build appengine
 // +build appengine
 
-// Copyright 2017 Google Inc. All Rights Reserved.
+// Copyright 2017 Google LLC All Rights Reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.

auth/auth_std.go

@@ -1,7 +1,7 @@
 //go:build !appengine
 // +build !appengine
 
-// Copyright 2017 Google Inc. All Rights Reserved.
+// Copyright 2017 Google LLC All Rights Reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.

auth/auth_test.go

@@ -1,4 +1,4 @@
-// Copyright 2017 Google Inc. All Rights Reserved.
+// Copyright 2017 Google LLC All Rights Reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.