Fix storage emulator crash on invalid JWT and add unit tests

src/emulator/storage/rules/runtime.spec.ts

@@ -0,0 +1,48 @@
+import { expect } from "chai";
+import { createAuthExpressionValue } from "./runtime";
+import { RulesetOperationMethod } from "./types";
+
+describe("Storage Rules Runtime", () => {
+  describe("createAuthExpressionValue", () => {
+    it("should return null if token is missing", () => {
+      const opts = {
+        file: {},
+        method: RulesetOperationMethod.GET,
+        path: "test/path",
+        projectId: "test-project",
+      };
+
+      const result = createAuthExpressionValue(opts);
+      expect(result).to.deep.equal({ null_value: null });
+    });
+
+    it("should return null if token is invalid", () => {
+      const opts = {
+        file: {},
+        token: "invalid-token",
+        method: RulesetOperationMethod.GET,
+        path: "test/path",
+        projectId: "test-project",
+      };
+
+      const result = createAuthExpressionValue(opts);
+      expect(result).to.deep.equal({ null_value: null });
+    });
+
+    it("should return auth value if token is valid (or at least decodable)", () => {
+      // Dummy token with payload: {"user_id": "test_user"}
+      const token = "eyJhbGciOiJub25lIn0.eyJ1c2VyX2lkIjoidGVzdF91c2VyIn0.";
+      const opts = {
+        file: {},
+        token: token,
+        method: RulesetOperationMethod.GET,
+        path: "test/path",
+        projectId: "test-project",
+      };
+
+      const result = createAuthExpressionValue(opts);
+      expect(result.map_value?.fields.uid).to.deep.equal({ string_value: "test_user" });
+      expect(result.map_value?.fields.token).to.exist;
+    });
+  });
+});

src/emulator/storage/rules/runtime.ts

@@ -62,7 +62,7 @@
     issues: StorageRulesIssues;
   }> {
     if (opts.method === RulesetOperationMethod.LIST && this.rulesVersion < 2) {
       const issues = new StorageRulesIssues();
       issues.warnings.push(
         "Permission denied. List operations are only allowed for rules_version='2'.",
       );
@@ -75,7 +75,7 @@
     return this.runtime.verifyWithRuleset(this.rulesetName, opts, runtimeVariableOverrides);
   }
 
   unload() {
     throw new Error("NOT_IMPLEMENTED");
   }
 }
@@ -86,11 +86,11 @@
     public warnings: string[] = [],
   ) {}
 
   static fromResponse(resp: RuntimeActionResponse) {
     return new StorageRulesIssues(resp.errors || [], resp.warnings || []);
   }
 
   get all() {
     return [...this.errors, ...this.warnings];
   }
 
@@ -109,18 +109,18 @@
   private _requestCount = 0;
   private _requests: {
     [s: number]: {
       handler: (rap: any) => void;
       request: RuntimeActionRequest;
     };
   } = {};
   private _childprocess?: ChildProcess;
   private _alive = false;
 
   get alive() {
     return this._alive;
   }
 
   async start(autoDownload = true) {
     if (this.alive) {
       return;
     }
@@ -167,7 +167,7 @@
     });
 
     // This catches error when spawning the java process
     this._childprocess.on("error", (err: any) => {
       void handleEmulatorProcessError(Emulators.STORAGE, err);
     });
 
@@ -193,7 +193,7 @@
         let rap;
         try {
           rap = JSON.parse(serializedRuntimeActionResponse) as RuntimeActionResponse;
         } catch (err: any) {
           EmulatorLogger.forEmulator(Emulators.STORAGE).log(
             "INFO",
             serializedRuntimeActionResponse,
@@ -210,7 +210,7 @@
         const request = this._requests[id];
 
         if (rap.status !== "ok" && !("action" in rap)) {
           console.warn(`[RULES] ${rap.status}: ${rap.message}`);
           rap.errors.forEach(console.warn.bind(console));
           return;
         }
@@ -389,6 +389,10 @@
   }
 }
 
+/**
+ * Converts a JS object to an ExpressionValue for the rules runtime.
+ * @internal
+ */
 function toExpressionValue(obj: any): ExpressionValue {
   if (typeof obj === "string") {
     return { string_value: obj };
@@ -470,21 +474,32 @@
   }
 }
 
-function createAuthExpressionValue(opts: RulesetVerificationOpts): ExpressionValue {
+/**
+ * Creates an ExpressionValue for the auth object in rules.
+ * @internal
+ */
+export function createAuthExpressionValue(opts: RulesetVerificationOpts): ExpressionValue {
   if (!opts.token) {
     return toExpressionValue(null);
-  } else {
-    const tokenPayload = jwt.decode(opts.token, { json: true }) as any;
-
-    const jsonValue = {
-      uid: tokenPayload.user_id,
-      token: tokenPayload,
-    };
+  }
+  const tokenPayload = jwt.decode(opts.token, { json: true });
 
-    return toExpressionValue(jsonValue);
+  if (typeof tokenPayload !== "object" || !tokenPayload) {
+    return toExpressionValue(null);
   }
+
+  const jsonValue = {
+    uid: "user_id" in tokenPayload ? tokenPayload.user_id : undefined,
+    token: tokenPayload,
+  };
+
+  return toExpressionValue(jsonValue);
 }
 
+/**
+ * Creates an ExpressionValue for the request object in rules.
+ * @internal
+ */
 function createRequestExpressionValue(opts: RulesetVerificationOpts): ExpressionValue {
   const fields: { [s: string]: ExpressionValue } = {
     path: {