Fixes for #8900 (#8901)

* fix(mcp): Fix operator precedence in auth fallback logic

Add parentheses to ensure skipAutoAuth check happens before fallback to
"Application Default Credentials" string.

Also add unit tests to cover this logic and ensure correct behavior.

* refactor: Remove variable reference for unimportant sinon stub

* Fix esm style imports and add changelog

---------

Co-authored-by: Kevin Partington <[email protected]>

Author: joehan

CHANGELOG.md

@@ -0,0 +1 @@
+- Fixed an issue where the MCP server could not successfully use Application Default Credentials. (#8896)

src/mcp/CONTRIBUTING.md

@@ -88,8 +88,8 @@ Tool files should be named `<product>/<foo_tool>`. The tool will then be listed
 
 ```typescript
 import { z } from "zod";
-import { tool } from "../../tool.js";
-import { mcpError, toContent } from "../../util.js";
+import { tool } from "../../tool";
+import { mcpError, toContent } from "../../util";
 
 export const foo_bar = tool(
   {
@@ -156,7 +156,7 @@ export const <product>Tools = [
 If this is the first tool for this product, also go to `src/mcp/tools/index.ts` and add your product:
 
 ```typescript
-import { <product>Tools } from "./<product>/index.js"
+import { <product>Tools } from "./<product>/index"
 
 const tools: Record<ServerFeature, ServerTool[]> = {
   // Exisitng tools here...

src/mcp/errors.ts

@@ -1,4 +1,4 @@
-import { CallToolResult } from "@modelcontextprotocol/sdk/types";
+import { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
 import { commandExistsSync, mcpError } from "./util";
 
 export const NO_PROJECT_ERROR = mcpError(

src/mcp/index.spec.ts

@@ -0,0 +1,63 @@
+import { expect } from "chai";
+import * as sinon from "sinon";
+import { FirebaseMcpServer } from "./index";
+import * as requireAuthModule from "../requireAuth";
+
+describe("FirebaseMcpServer.getAuthenticatedUser", () => {
+  let server: FirebaseMcpServer;
+  let requireAuthStub: sinon.SinonStub;
+
+  beforeEach(() => {
+    // Mock the methods that may cause hanging BEFORE creating the instance
+    sinon.stub(FirebaseMcpServer.prototype, "detectProjectRoot").resolves("/test/project");
+    sinon.stub(FirebaseMcpServer.prototype, "detectActiveFeatures").resolves([]);
+
+    server = new FirebaseMcpServer({});
+
+    // Mock the resolveOptions method to avoid dependency issues
+    sinon.stub(server, "resolveOptions").resolves({});
+
+    requireAuthStub = sinon.stub(requireAuthModule, "requireAuth");
+  });
+
+  afterEach(() => {
+    sinon.restore();
+  });
+
+  it("should return email when authenticated user is present", async () => {
+    const testEmail = "[email protected]";
+    requireAuthStub.resolves(testEmail);
+
+    const result = await server.getAuthenticatedUser();
+
+    expect(result).to.equal(testEmail);
+    expect(requireAuthStub.calledOnce).to.be.true;
+  });
+
+  it("should return null when no user and skipAutoAuth is true", async () => {
+    requireAuthStub.resolves(null);
+
+    const result = await server.getAuthenticatedUser(true);
+
+    expect(result).to.be.null;
+    expect(requireAuthStub.calledOnce).to.be.true;
+  });
+
+  it("should return 'Application Default Credentials' when no user and skipAutoAuth is false", async () => {
+    requireAuthStub.resolves(null);
+
+    const result = await server.getAuthenticatedUser(false);
+
+    expect(result).to.equal("Application Default Credentials");
+    expect(requireAuthStub.calledOnce).to.be.true;
+  });
+
+  it("should return null when requireAuth throws an error", async () => {
+    requireAuthStub.rejects(new Error("Auth failed"));
+
+    const result = await server.getAuthenticatedUser();
+
+    expect(result).to.be.null;
+    expect(requireAuthStub.calledOnce).to.be.true;
+  });
+});

src/mcp/index.ts

@@ -9,27 +9,27 @@ import {
   ListToolsRequestSchema,
   CallToolResult,
 } from "@modelcontextprotocol/sdk/types.js";
-import { checkFeatureActive, mcpError } from "./util.js";
-import { ClientConfig, SERVER_FEATURES, ServerFeature } from "./types.js";
-import { availableTools } from "./tools/index.js";
-import { ServerTool, ServerToolContext } from "./tool.js";
-import { configstore } from "../configstore.js";
-import { Command } from "../command.js";
-import { requireAuth } from "../requireAuth.js";
-import { Options } from "../options.js";
-import { getProjectId } from "../projectUtils.js";
-import { mcpAuthError, NO_PROJECT_ERROR, mcpGeminiError } from "./errors.js";
-import { trackGA4 } from "../track.js";
-import { Config } from "../config.js";
-import { loadRC } from "../rc.js";
-import { EmulatorHubClient } from "../emulator/hubClient.js";
-import { Emulators } from "../emulator/types.js";
+import { checkFeatureActive, mcpError } from "./util";
+import { ClientConfig, SERVER_FEATURES, ServerFeature } from "./types";
+import { availableTools } from "./tools/index";
+import { ServerTool, ServerToolContext } from "./tool";
+import { configstore } from "../configstore";
+import { Command } from "../command";
+import { requireAuth } from "../requireAuth";
+import { Options } from "../options";
+import { getProjectId } from "../projectUtils";
+import { mcpAuthError, NO_PROJECT_ERROR, mcpGeminiError } from "./errors";
+import { trackGA4 } from "../track";
+import { Config } from "../config";
+import { loadRC } from "../rc";
+import { EmulatorHubClient } from "../emulator/hubClient";
+import { Emulators } from "../emulator/types";
 import { existsSync } from "node:fs";
-import { ensure, check } from "../ensureApiEnabled.js";
-import * as api from "../api.js";
-import { LoggingStdioServerTransport } from "./logging-transport.js";
-import { isFirebaseStudio } from "../env.js";
-import { timeoutFallback } from "../timeout.js";
+import { ensure, check } from "../ensureApiEnabled";
+import * as api from "../api";
+import { LoggingStdioServerTransport } from "./logging-transport";
+import { isFirebaseStudio } from "../env";
+import { timeoutFallback } from "../timeout";
 
 const SERVER_VERSION = "0.2.0";
 
@@ -233,7 +233,7 @@ export class FirebaseMcpServer {
       this.log("debug", `calling requireAuth`);
       const email = await requireAuth(await this.resolveOptions(), skipAutoAuth);
       this.log("debug", `detected authenticated account: ${email || "<none>"}`);
-      return email ?? skipAutoAuth ? null : "Application Default Credentials";
+      return email ?? (skipAutoAuth ? null : "Application Default Credentials");
     } catch (e) {
       this.log("debug", `error in requireAuth: ${e}`);
       return null;

src/mcp/tool.ts

@@ -1,4 +1,4 @@
-import { CallToolResult } from "@modelcontextprotocol/sdk/types";
+import { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
 import { z, ZodTypeAny } from "zod";
 import { zodToJsonSchema } from "zod-to-json-schema";
 import type { FirebaseMcpServer } from "./index";

src/mcp/tools/apphosting/fetch_logs.ts

@@ -1,11 +1,11 @@
 import { z } from "zod";
-import { tool } from "../../tool.js";
-import { toContent } from "../../util.js";
-import { Backend, getBackend, getTraffic, listBuilds, Traffic } from "../../../gcp/apphosting.js";
-import { last } from "../../../utils.js";
-import { FirebaseError } from "../../../error.js";
-import { fetchServiceLogs } from "../../../gcp/run.js";
-import { listEntries } from "../../../gcp/cloudlogging.js";
+import { tool } from "../../tool";
+import { toContent } from "../../util";
+import { Backend, getBackend, getTraffic, listBuilds, Traffic } from "../../../gcp/apphosting";
+import { last } from "../../../utils";
+import { FirebaseError } from "../../../error";
+import { fetchServiceLogs } from "../../../gcp/run";
+import { listEntries } from "../../../gcp/cloudlogging";
 
 export const fetch_logs = tool(
   {

src/mcp/tools/apphosting/list_backends.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
-import { tool } from "../../tool.js";
-import { toContent } from "../../util.js";
+import { tool } from "../../tool";
+import { toContent } from "../../util";
 import {
   Backend,
   Domain,
@@ -9,7 +9,7 @@ import {
   listDomains,
   parseBackendName,
   Traffic,
-} from "../../../gcp/apphosting.js";
+} from "../../../gcp/apphosting";
 
 export const list_backends = tool(
   {

src/mcp/tools/auth/disable_user.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
-import { tool } from "../../tool.js";
-import { toContent } from "../../util.js";
-import { disableUser } from "../../../gcp/auth.js";
+import { tool } from "../../tool";
+import { toContent } from "../../util";
+import { disableUser } from "../../../gcp/auth";
 
 export const disable_user = tool(
   {

src/mcp/tools/auth/get_user.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
-import { tool } from "../../tool.js";
-import { mcpError, toContent } from "../../util.js";
-import { findUser } from "../../../gcp/auth.js";
+import { tool } from "../../tool";
+import { mcpError, toContent } from "../../util";
+import { findUser } from "../../../gcp/auth";
 
 export const get_user = tool(
   {