Delay promise for revoke (#195)

* adding a 1 second delay before revoking a token

Author: avishalom

src/auth/auth-api-request.ts

@@ -536,6 +536,9 @@ export class FirebaseAuthRequestHandler {
    * In addition to revoking all refresh tokens for a user, all ID tokens issued
    * before revocation will also be revoked on the Auth backend. Any request with an
    * ID token generated before revocation will be rejected with a token expired error.
+   * Note that due to the fact that the timestamp is stored in seconds, any tokens minted in
+   * the same second as the revocation will still be valid. If there is a chance that a token
+   * was minted in the last second, delay for 1 second before revoking.
    *
    * @param {string} uid The user whose tokens are to be revoked.
    * @return {Promise<string>} A promise that resolves when the operation completes

test/integration/auth.spec.ts

@@ -167,7 +167,9 @@ describe('admin.auth', () => {
       })
       .then((decodedIdToken) => {
         // Verification should succeed. Revoke that user's session.
-        return admin.auth().revokeRefreshTokens(decodedIdToken.sub);
+        return new Promise((resolve) => setTimeout(() => resolve(
+          admin.auth().revokeRefreshTokens(decodedIdToken.sub)
+        ), 1000));
       })
       .then(() => {
         // verifyIdToken without checking revocation should still succeed.