Custom claims does not seem to be passed

[beingadrian]

Hi!

Recently I've run into an issue with tokens with custom claims. The claims do not seem to be passed by the plugin when recreating the tokens on the server side.

Context

1. I log in and my back-end API sends back a custom token with custom claims
2. I call Firebase's signInWithCustomToken and get an ID token back (this ID token has the claims)
3. On a different page, inside withAuthUserTokenSSR I call AuthUser.getIdToken and I get an ID token back (this ID token does not have claims)
4. Given the missing claims, further authenticated requests to my back-end API will result in insufficient claims

Investigation

After a little dive into the source code, I find the following line:

next-firebase-auth/src/firebaseAdmin.js

Line 96 in f429935

const customToken = await admin.auth().createCustomToken(AuthUser.id)

Here it seems that the new tokens are only created with the user ID and the claims are not passed from the original ID token.

Claims could be passed by adding the second parameter:
https://firebase.google.com/docs/auth/admin/create-custom-tokens#create_custom_tokens_using_the_firebase_admin_sdk

--

I'm not sure if I've missed something here, but please let me know if there's a way around this.

Thank you!

[kmjennison]

Thanks! Opened an issue here:
#317