OXIESEC PANEL

Name	Size	Modified	Perms
📁 ..	-	08/12/2024 10:36:28 AM	rwxr-xr-x
📁 Cache	-	08/12/2024 10:36:42 AM	rwxr-xr-x
📄 ConvertsDates.php	538 bytes	08/12/2024 10:36:29 AM	rw-r--r--
📁 Domain	-	08/12/2024 10:36:42 AM	rwxr-xr-x
📁 Exception	-	08/12/2024 10:36:42 AM	rwxr-xr-x
📄 Generator.php	1.84 KB	08/12/2024 10:36:29 AM	rw-r--r--
📄 Handler.php	1.15 KB	08/12/2024 10:36:29 AM	rw-r--r--
📄 HttpKeyStore.php	2.68 KB	08/12/2024 10:36:29 AM	rw-r--r--
📄 TenantAwareGenerator.php	2.03 KB	08/12/2024 10:36:29 AM	rw-r--r--
📄 TenantAwareVerifier.php	1.4 KB	08/12/2024 10:36:29 AM	rw-r--r--
📄 Verifier.php	3.89 KB	08/12/2024 10:36:29 AM	rw-r--r--

Editing: TenantAwareVerifier.php

<?php

declare(strict_types=1);

namespace Firebase\Auth\Token;

use Firebase\Auth\Token\Domain\Verifier;
use Firebase\Auth\Token\Exception\InvalidToken;
use Lcobucci\JWT\Token;
use Lcobucci\JWT\Token\Plain;

final class TenantAwareVerifier implements Verifier
{
    private string $tenantId;

private Verifier $baseVerifier;

public function __construct(string $tenantId, Verifier $baseVerifier)
    {
        $this->tenantId = $tenantId;
        $this->baseVerifier = $baseVerifier;
    }

public function verifyIdToken($token): Token
    {
        $token = $this->baseVerifier->verifyIdToken($token);

if (!($token instanceof Plain)) {
            throw new InvalidToken($token, 'The ID token could not be decrypted');
        }

$claim = $token->claims()->get('firebase');

$tenant = null;
        if (\is_object($claim) && \property_exists($claim, 'tenant')) {
            $tenant = $claim->tenant;
        } elseif (\is_array($claim)) {
            $tenant = $claim['tenant'] ?? null;
        }

if (!\is_string($tenant)) {
            throw new InvalidToken($token, 'The ID token does not contain a tenant identifier');
        }

if ($tenant !== $this->tenantId) {
            throw new InvalidToken($token, "The token's tenant ID did not match with the expected tenant ID");
        }

return $token;
    }
}