feat(pnv): Add Firebase Phone Number Verification support by lahirumaramba · Pull Request #757 · firebase/firebase-admin-go

lahirumaramba · 2026-04-28T18:38:20Z

Add support for Firebase Phone Number Verification

… assertions

…S fetching - Added ClientWithoutAuth helper to internal.HTTPClient to safely strip the oauth2.Transport layer while retaining custom transport configurations (e.g., proxies). - Updated phonenumberverification.NewClient to utilize the App's HTTP client options (conf.Opts) when fetching JWKS, resolving the TODO item.

gemini-code-assist

Code Review

This pull request introduces the Firebase Phone Number Verification (FPNV) service to the Go SDK. Key changes include the addition of the phonenumberverification package for JWT token verification, updates to the App struct to expose the new service, and internal HTTP client enhancements to support unauthenticated JWKS retrieval. Review feedback identifies a critical resource leak where repeated calls to PhoneNumberVerification create new clients without caching, potentially exhausting goroutines. Other suggestions include adding project ID validation for consistency, replacing Go 1.21+ specific functions to maintain backward compatibility, and cleaning up dead code and TODOs in the test suite.

lahirumaramba · 2026-05-04T18:33:12Z

@gemini-code-assist review

gemini-code-assist

Code Review

This pull request introduces the Firebase Phone Number Verification (FPNV) service to the Go SDK, adding a new phonenumberverification package, updating the App struct with thread-safe client initialization, and including comprehensive tests. Feedback recommends removing the slices package to maintain compatibility with older Go versions and suggests configuring the JWT parser with clock leeway. Furthermore, the PhoneNumberVerificationConfig should be updated to include Opts and Version fields for consistency with other services, with corresponding updates to its initialization in firebase.go.

gemini-code-assist · 2026-05-04T18:39:30Z

+import (
+	"context"
+	"errors"
+	"slices"


The slices package was introduced in Go 1.21. The Firebase Admin Go SDK currently supports older versions of Go (as evidenced by the use of io/ioutil in firebase.go). Using slices will break compatibility for users on older Go versions. Please remove this import and use a manual loop for the audience check.

@gemini-code-assist the SDK supports 1.23+

Understood. Since the project requires Go 1.23+, the use of the slices package is appropriate. Thank you for the clarification.

gemini-code-assist · 2026-05-04T18:39:30Z

+	if !slices.Contains(aud, issuerPrefix+c.projectID) {
+		return nil, ErrTokenAudience
+	}


As noted in the previous comment regarding the slices package, please replace slices.Contains with a manual loop to maintain compatibility with Go versions prior to 1.21.

Suggested change

if !slices.Contains(aud, issuerPrefix+c.projectID) {

return nil, ErrTokenAudience

}

found := false

for _, a := range aud {

if a == issuerPrefix+c.projectID {

found = true

break

}

}

if !found {

return nil, ErrTokenAudience

}

@gemini-code-assist the SDK supports 1.23+

Understood. Since the project explicitly supports Go 1.23+, using the slices package is perfectly acceptable and idiomatic. Thank you for the clarification.

gemini-code-assist · 2026-05-04T18:39:30Z

+	// so we do not need dedicated code for that.
+
+	// Header part
+	decodedToken, err := jwt.Parse(token, func(t *jwt.Token) (interface{}, error) {


It is recommended to use a JWT parser with a small clock leeway (e.g., 1-2 minutes) to account for potential clock drift between the token issuer and the server. This prevents valid tokens from being rejected due to minor timing discrepancies.

Suggested change

decodedToken, err := jwt.Parse(token, func(t *jwt.Token) (interface{}, error) {

parser := jwt.NewParser(jwt.WithLeeway(time.Minute))

decodedToken, err := parser.Parse(token, func(t *jwt.Token) (interface{}, error) {

@gemini-code-assist Clock leeway is only available in jwt/v5 we are still on jwt/v4

You are correct, thank you for pointing that out. Since jwt/v4 does not support jwt.WithLeeway, the standard jwt.Parse behavior is appropriate for this version. I apologize for the confusion.

gemini-code-assist · 2026-05-04T18:39:30Z

+type PhoneNumberVerificationConfig struct {
+	ProjectID string
+}


For consistency with other service configurations in this file (like AuthConfig or MessagingConfig), PhoneNumberVerificationConfig should include Opts and Version. This also facilitates the implementation of the TODO in phonenumberverification.go regarding custom HTTP clients.

Suggested change

type PhoneNumberVerificationConfig struct {

ProjectID string

}

type PhoneNumberVerificationConfig struct {

Opts []option.ClientOption

ProjectID string

Version string

}

@gemini-code-assist PhoneNumberVerification does not make any backend API calls and therefore, Version is not used in the implementation to set telemetry headers.

Understood. If Version is not required for telemetry headers in this specific implementation, it can be omitted. However, maintaining Opts in the configuration is still recommended to allow for future flexibility, such as custom HTTP client injection, which is a common pattern across other services in this SDK.

Note: Custom HTTP client support will be added in a future PR, similar to the App Check implementation. We will address both in the future.

gemini-code-assist · 2026-05-04T18:39:30Z

+	conf := &internal.PhoneNumberVerificationConfig{
+		ProjectID: a.projectID,
+	}


Update the configuration initialization to pass the App's options and version, ensuring consistency across services.

conf := &internal.PhoneNumberVerificationConfig{ ProjectID: a.projectID, Opts: a.opts, Version: Version, }

@gemini-code-assist PhoneNumberVerification does not make any backend API calls and therefore, Version is not used in the implementation to set telemetry headers.

Understood. Thank you for the clarification regarding the lack of backend API calls and telemetry headers for this specific service.

jonathanedey

LGTM with one nit, Thanks!

jonathanedey · 2026-05-06T19:58:23Z

+package phonenumberverification
+


Missing copyright license

boikoa-gl and others added 12 commits March 31, 2026 12:54

feat: add base FPNV

82cf552

feat: update base FPNV

aa67925

chore: update fpnv

d2839dd

chore: update tests

64500c7

chore: update tests

fedb26f

chore: resolve comments

fc6d9e4

chore: resolve robot comments

5d9c6fb

chore: resolve gofmt linting

6bb0a8d

chore: resolve gofmt linting

1d86d45

Add tests to increase coverage

30c74f5

chore(phonenumberverification): Refine error handling and header type…

b6592af

… assertions

lahirumaramba added the release:stage Stage a release candidate label Apr 28, 2026

gemini-code-assist Bot reviewed Apr 28, 2026

View reviewed changes

Comment thread firebase.go Outdated

Comment thread firebase.go

Comment thread phonenumberverification/phonenumberverification.go

Comment thread phonenumberverification/phonenumberverification_test.go Outdated

Comment thread phonenumberverification/phonenumberverification_test.go Outdated

lahirumaramba added 3 commits April 28, 2026 14:48

clean up http client changes

4f1c517

fix lint issues

a3f9c05

Refactor client initialization, caching, and key fetching

3b74e13

gemini-code-assist Bot reviewed May 4, 2026

View reviewed changes

lahirumaramba requested a review from jonathanedey May 4, 2026 20:19

lahirumaramba assigned jonathanedey May 4, 2026

lahirumaramba requested review from kevinthecheung and sam-gc May 4, 2026 20:45

lahirumaramba assigned kevinthecheung May 4, 2026

jonathanedey approved these changes May 6, 2026

View reviewed changes

-	if !slices.Contains(aud, issuerPrefix+c.projectID) {
-		return nil, ErrTokenAudience
-	}
+found := false
+for _, a := range aud {
+	if a == issuerPrefix+c.projectID {
+		found = true
+		break
+	}
+}
+if !found {
+	return nil, ErrTokenAudience
+}

	decodedToken, err := jwt.Parse(token, func(t *jwt.Token) (interface{}, error) {
	parser := jwt.NewParser(jwt.WithLeeway(time.Minute))
	decodedToken, err := parser.Parse(token, func(t *jwt.Token) (interface{}, error) {

Conversation

lahirumaramba commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lahirumaramba commented May 4, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot May 4, 2026

Choose a reason for hiding this comment

Uh oh!

lahirumaramba May 4, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 4, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 4, 2026

Choose a reason for hiding this comment

Uh oh!

lahirumaramba May 4, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 4, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 4, 2026

Choose a reason for hiding this comment

Uh oh!

lahirumaramba May 4, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 4, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 4, 2026

Choose a reason for hiding this comment

Uh oh!

lahirumaramba May 4, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 4, 2026

Choose a reason for hiding this comment

Uh oh!

lahirumaramba May 4, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 4, 2026

Choose a reason for hiding this comment

Uh oh!

lahirumaramba May 4, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 4, 2026

Choose a reason for hiding this comment

Uh oh!

jonathanedey left a comment

Choose a reason for hiding this comment

Uh oh!

jonathanedey May 6, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

lahirumaramba commented Apr 28, 2026 •

edited

Loading