Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -446,6 +446,11 @@
<artifactId>httpclient5</artifactId>
<version>5.3.1</version>
</dependency>
<dependency>
<groupId>com.nimbusds</groupId>
<artifactId>nimbus-jose-jwt</artifactId>
<version>10.6</version>
</dependency>

<!-- Test Dependencies -->
<dependency>
Expand Down
82 changes: 82 additions & 0 deletions src/main/java/com/google/firebase/fpnv/FirebasePnv.java
Original file line number Diff line number Diff line change
@@ -0,0 +1,82 @@
/*
* Copyright 2026 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

package com.google.firebase.fpnv;

import com.google.firebase.FirebaseApp;
import com.google.firebase.ImplFirebaseTrampolines;
import com.google.firebase.fpnv.internal.FirebasePnvTokenVerifier;
import com.google.firebase.internal.FirebaseService;

/**
* This class is the entry point for the Firebase Phone Number Verification (FPNV) service.
*
* <p>You can get an instance of {@link FirebasePnv} via {@link #getInstance()},
* or {@link #getInstance(FirebaseApp)} and then use it.
*/
public final class FirebasePnv {
private static final String SERVICE_ID = FirebasePnv.class.getName();
private final FirebasePnvTokenVerifier tokenVerifier;

private FirebasePnv(FirebaseApp app) {
this.tokenVerifier = new FirebasePnvTokenVerifier(app);
}

/**
* Gets the {@link FirebasePnv} instance for the default {@link FirebaseApp}.
*
* @return The {@link FirebasePnv} instance for the default {@link FirebaseApp}.
*/
public static FirebasePnv getInstance() {
return getInstance(FirebaseApp.getInstance());
}

/**
* Gets the {@link FirebasePnv} instance for the specified {@link FirebaseApp}.
*
* @return The {@link FirebasePnv} instance for the specified {@link FirebaseApp}.
*/
public static synchronized FirebasePnv getInstance(FirebaseApp app) {
FirebaseFpnvService service = ImplFirebaseTrampolines.getService(app, SERVICE_ID,
FirebaseFpnvService.class);
if (service == null) {
service = ImplFirebaseTrampolines.addService(app, new FirebaseFpnvService(app));
}
return service.getInstance();
}

/**
* Verifies a Firebase Phone Number Verification token (FPNV JWT).
*
* @param fpnvJwt The FPNV JWT string to verify.
* @return A verified {@link FirebasePnvToken}.
* @throws FirebasePnvException If verification fails.
*/
public FirebasePnvToken verifyToken(String fpnvJwt) throws FirebasePnvException {
return this.tokenVerifier.verifyToken(fpnvJwt);
}

private static class FirebaseFpnvService extends FirebaseService<FirebasePnv> {
FirebaseFpnvService(FirebaseApp app) {
super(SERVICE_ID, new FirebasePnv(app));
}
}
}





28 changes: 28 additions & 0 deletions src/main/java/com/google/firebase/fpnv/FirebasePnvErrorCode.java
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
/*
* Copyright 2026 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

package com.google.firebase.fpnv;

/**
* Error codes that are used in {@link FirebasePnv}.
*/
public enum FirebasePnvErrorCode {
INVALID_ARGUMENT,
INVALID_TOKEN,
TOKEN_EXPIRED,
INTERNAL_ERROR,
SERVICE_ERROR,
}
44 changes: 44 additions & 0 deletions src/main/java/com/google/firebase/fpnv/FirebasePnvException.java
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
/*
* Copyright 2026 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

package com.google.firebase.fpnv;

/**
* Generic exception related to Firebase Phone Number Verification.
* Check the error code and message for more
* details.
*/
public class FirebasePnvException extends RuntimeException {

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

This exception extends RuntimeException, but it is declared in the throws clause of FirebasePnv.verifyToken(). This is misleading for users of the API and inconsistent with standard Java practices. To align with other exceptions in the Firebase Admin SDK (like FirebaseAuthException), this should be a checked exception. Please change it to extend Exception.

Suggested change
public class FirebasePnvException extends RuntimeException {
public class FirebasePnvException extends Exception {

private final FirebasePnvErrorCode errorCode;

/**
* Exception that created from {@link FirebasePnvErrorCode} and {@link String} message.
*
* @param authErrorCode {@link FirebasePnvErrorCode}
* @param message {@link String}
*/
public FirebasePnvException(
FirebasePnvErrorCode authErrorCode,
String message
) {
super(message);
this.errorCode = authErrorCode;
Comment on lines +33 to +38

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The parameter name authErrorCode is confusing in the context of FPNV (Firebase Phone Number Verification). A more descriptive name like errorCode or fpnvErrorCode would improve clarity.

Suggested change
public FirebasePnvException(
FirebasePnvErrorCode authErrorCode,
String message
) {
super(message);
this.errorCode = authErrorCode;
public FirebasePnvException(
FirebasePnvErrorCode errorCode,
String message
) {
super(message);
this.errorCode = errorCode;
}

}

public FirebasePnvErrorCode getFpnvErrorCode() {
return errorCode;
}
}
80 changes: 80 additions & 0 deletions src/main/java/com/google/firebase/fpnv/FirebasePnvToken.java
Original file line number Diff line number Diff line change
@@ -0,0 +1,80 @@
/*
* Copyright 2026 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

package com.google.firebase.fpnv;

import static com.google.common.base.Preconditions.checkArgument;

import com.google.common.collect.ImmutableMap;
import java.util.List;
import java.util.Map;

/**
* Represents a verified Firebase Phone Number Verification token.
*/
public class FirebasePnvToken {
private final Map<String, Object> claims;

public FirebasePnvToken(Map<String, Object> claims) {
// this.claims = claims != null ? Collections.unmodifiableMap(claims) : Collections.emptyMap();
checkArgument(claims != null && claims.containsKey("sub"),
"Claims map must at least contain sub");
this.claims = ImmutableMap.copyOf(claims);
}

/**
* Returns the issuer identifier for the issuer of the response.
*/
public String getIssuer() {
return (String) claims.get("iss");
}

/**
* Returns the phone number of the user.
* This corresponds to the 'sub' claim in the JWT.
*/
public String getPhoneNumber() {
return (String) claims.get("sub");
}

/**
* Returns the audience for which this token is intended.
*/
public List<String> getAudience() {
return (List<String>) claims.get("aud");
}
Comment on lines +56 to +58

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The 'aud' (audience) claim in a JWT can be either a single string or a list of strings. This implementation assumes it's always a List<String> and will throw a ClassCastException if the token contains a single string audience. The code should handle both cases gracefully.

Suggested change
public List<String> getAudience() {
return (List<String>) claims.get("aud");
}
public List<String> getAudience() {
Object audience = claims.get("aud");
if (audience instanceof String) {
return com.google.common.collect.ImmutableList.of((String) audience);
}
return (List<String>) audience;
}


/**
* Returns the expiration time in seconds since the Unix epoch.
*/
public long getExpirationTime() {
return (long) claims.get("exp");
}
Comment on lines +63 to +65

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

This method will throw a ClassCastException at runtime. The claims map contains a java.util.Date object for the 'exp' claim from the JWT library, which cannot be directly cast to a long. You should get the Date object and then convert it to seconds since the Unix epoch by calling getTime() / 1000.

Suggested change
public long getExpirationTime() {
return (long) claims.get("exp");
}
public long getExpirationTime() {
return ((java.util.Date) claims.get("exp")).getTime() / 1000L;
}


/**
* Returns the issued-at time in seconds since the Unix epoch.
*/
public long getIssuedAt() {
return (long) claims.get("iat");
}
Comment on lines +70 to +72

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

This method will throw a ClassCastException at runtime. The claims map contains a java.util.Date object for the 'iat' claim from the JWT library, which cannot be directly cast to a long. You should get the Date object and then convert it to seconds since the Unix epoch by calling getTime() / 1000.

Suggested change
public long getIssuedAt() {
return (long) claims.get("iat");
}
public long getIssuedAt() {
return ((java.util.Date) claims.get("iat")).getTime() / 1000L;
}


/**
* Returns the entire map of claims.
*/
public Map<String, Object> getClaims() {
return claims;
}
}
Loading