feat: support two-phase non-interactive firebase login - #10777
Merged
Conversation
### Description Allows headless tools and AI agents to log the Firebase CLI into Google/Firebase in non-interactive environments using a two-phase login flow. - Initiating `firebase login --non-interactive` generates a PKCE `codeVerifier` and `sessionId`, writes it to the local `configstore`, and outputs a login URL with a verification code instructions. - Exchanging the code via `firebase login <auth_code>` retrieves the stored PKCE state, performs the remote token exchange, and records the active user session. ### Before and After Command Outputs #### Before Running `firebase login --non-interactive` threw an error immediately: ``` Cannot run login in non-interactive mode. See login:ci to generate a token for use in non-interactive environments. ``` #### After 1. Initiating the login: ``` $ firebase login --non-interactive To sign in to the Firebase CLI: 1. Take note of your session ID: 97548 2. Visit the URL below on any device and follow the instructions to get your code: https://auth.firebase.tools/login?code_challenge=MgMej1pXyJBOCEl4o5VQ1zPAEF4JRgW6WCNHnH1lBfA&session=97548b2c-fe34-4813-9d9d-93827425952a&attest=lWAgfQyI5wQ491SwVqsd8JCGXKWgKacAab60RXJMSqQ 3. Complete the login by running: firebase login <authorizationCode> ``` 2. Completing the login with the authorization code: ``` $ firebase login 4/0AdkVLPyTQOoo2mMMCsGpTl9ks_ozOmRGapvrd24bFQHaBmZ376AmaRNYx4nTs-HzU4Jnug ✔ Success! Logged in as joehanley@google.com ``` ### Scenarios Tested - Initiating the login flow in non-interactive mode. - Exchanging code with correct/matching state successfully. - Exchanging code when no login state is present or state fails verification. - Verified that full project listing commands (`projects:list`) works successfully post-authentication. ### Sample Commands `firebase login --non-interactive` `firebase login <authCode>`
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request introduces support for a two-phase non-interactive authentication flow to firebase login using login [auth_code], allowing headless tools and agents to log in. It refactors the remote login logic in src/auth.ts into start and complete phases, updates the login command in src/commands/login.ts to handle these phases, and adds corresponding unit tests in src/commands/login.spec.ts. Feedback on the changes highlights a potential crash when accessing result.user.email without a truthiness check, and multiple violations of the repository style guide regarding the use of any as an escape hatch in error catch blocks and test assertions.
joehan
requested review from
bkendall and
christhompsongoogle
and removed request for
bkendall,
christhompsongoogle and
richieforeman
July 27, 2026 17:04
maneesht
reviewed
Jul 30, 2026
maneesht
reviewed
Jul 30, 2026
| logger.info(); | ||
| if (typeof result.user === "object" && result.user && result.user.email) { | ||
| utils.logSuccess("Success! Logged in as " + clc.bold(result.user.email)); | ||
| } else { |
Contributor
There was a problem hiding this comment.
Curious: are there situations where the result doesn't have a user object?
Member
Author
There was a problem hiding this comment.
No, I don't think there are... this seems like some likely excessively defensive coding by Jetski.
maneesht
reviewed
Jul 30, 2026
joehan
enabled auto-merge (squash)
July 31, 2026 17:27
tagboola
pushed a commit
that referenced
this pull request
Aug 5, 2026
* feat: support two-phase non-interactive firebase login ### Description Allows headless tools and AI agents to log the Firebase CLI into Google/Firebase in non-interactive environments using a two-phase login flow. - Initiating `firebase login --non-interactive` generates a PKCE `codeVerifier` and `sessionId`, writes it to the local `configstore`, and outputs a login URL with a verification code instructions. - Exchanging the code via `firebase login <auth_code>` retrieves the stored PKCE state, performs the remote token exchange, and records the active user session. ### Before and After Command Outputs #### Before Running `firebase login --non-interactive` threw an error immediately: ``` Cannot run login in non-interactive mode. See login:ci to generate a token for use in non-interactive environments. ``` #### After 1. Initiating the login: ``` $ firebase login --non-interactive To sign in to the Firebase CLI: 1. Take note of your session ID: 97548 2. Visit the URL below on any device and follow the instructions to get your code: https://auth.firebase.tools/login?code_challenge=MgMej1pXyJBOCEl4o5VQ1zPAEF4JRgW6WCNHnH1lBfA&session=97548b2c-fe34-4813-9d9d-93827425952a&attest=lWAgfQyI5wQ491SwVqsd8JCGXKWgKacAab60RXJMSqQ 3. Complete the login by running: firebase login <authorizationCode> ``` 2. Completing the login with the authorization code: ``` $ firebase login 4/0AdkVLPyTQOoo2mMMCsGpTl9ks_ozOmRGapvrd24bFQHaBmZ376AmaRNYx4nTs-HzU4Jnug ✔ Success! Logged in as joehanley@google.com ``` ### Scenarios Tested - Initiating the login flow in non-interactive mode. - Exchanging code with correct/matching state successfully. - Exchanging code when no login state is present or state fails verification. - Verified that full project listing commands (`projects:list`) works successfully post-authentication. ### Sample Commands `firebase login --non-interactive` `firebase login <authCode>` * refactor: address code review comments on any cast and truthy checks * refactor: address PR review feedback on two-phase non-interactive login * docs: document two-phase login flow usage in changelog
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Allows headless tools and AI agents to log the Firebase CLI into Google/Firebase in non-interactive environments using a two-phase login flow.
firebase login --non-interactivegenerates a PKCEcodeVerifierandsessionId, writes it to the localconfigstore, and outputs a login URL with a verification code instructions.firebase login <auth_code>retrieves the stored PKCE state, performs the remote token exchange, and records the active user session.Before and After Command Outputs
Before
Running
firebase login --non-interactivethrew an error immediately:After
Scenarios Tested
projects:list) works successfully post-authentication.Sample Commands
firebase login --non-interactivefirebase login <authCode>