Is the beforeUserSignedIn Trigger Supported in Firebase Extensions for Custom Claims?

Firebase Extensions for Authentication only support the onCreate and onDelete triggers. The beforeUserSignedIn trigger isn’t supported for extensions, and attempting to use it in your extension’s extension.yaml will result in errors like the one you encountered.

Workaround Options

1. Use onCreate Triggers:
   If your goal is to set custom claims on newly created users, you can use an onCreate trigger. Note that this trigger runs only when the account is first created—not on every sign‐in. The client’s token will only include the new custom claims after they sign in again.

   JAVASCRIPTCopied
   const functions = require('firebase-functions');
   const { initializeApp } = require('firebase-admin/app');
   const { getAuth } = require('firebase-admin/auth');
   const { getDatabase } = require('firebase-admin/database');
   
   initializeApp();
   
   exports.processSignUp = functions.auth.user().onCreate(async (user) => {
     if (
       user.email &&
       user.email.endsWith('@admin.example.com') &&
       user.emailVerified
     ) {
       const customClaims = {
         admin: true,
         accessLevel: 9
       };
   
       try {
         // Set custom user claims on this newly created user.
         await getAuth().setCustomUserClaims(user.uid, customClaims);
   
         // Update real-time database to notify client to force refresh.
         const metadataRef = getDatabase().ref('metadata/' + user.uid);
         await metadataRef.set({ refreshTime: new Date().getTime() });
       } catch (error) {
         console.log(error);
       }
     }
   });

2. Custom Cloud Functions Outside Extensions:
   If you require modifying claims during sign‐in (i.e. a true “before sign-in” behavior), you would need to build a custom solution outside of the Extensions framework. This might involve deploying your own Cloud Function (not within an extension) that uses the Firebase Admin SDK to set claims based on your logic. However, keep in mind that custom claims only take effect once the user obtains a new ID token—typically after signing in again.

Summary

There isn’t a supported workaround within Firebase Extensions to use the beforeUserSignedIn trigger. The extension framework currently only supports the onCreate and onDelete triggers for Firebase Authentication events, so you’ll need to adjust your implementation accordingly.