Fix Auth Emulator deleteTenant not working with Node Admin. (firebase…

…#3817)

* Fix Auth Emulator deleteTenant not working with Node Admin.

* Add changelog.

* Add more comments.

CHANGELOG.md

@@ -0,0 +1 @@
+- Fix Auth Emulator deleteTenant not working with Node Admin (#3817).

src/emulator/auth/server.ts

@@ -124,6 +124,14 @@ export async function createApp(
   // This is similar to production behavior. Safe since all APIs are cookieless.
   app.use(cors({ origin: true }));
 
+  // Workaround for clients (e.g. Node.js Admin SDK) that send request bodies
+  // with HTTP DELETE requests. Such requests are tolerated by production, but
+  // exegesis will reject them without the following hack.
+  app.delete("*", (req, _, next) => {
+    delete req.headers["content-type"];
+    next();
+  });
+
   app.get("/", (req, res) => {
     return res.json({
       authEmulator: {

src/test/emulators/auth/tenant.spec.ts

@@ -106,6 +106,24 @@ describeAuthEmulator("tenant management", ({ authApi }) => {
           expectStatusCode(200, res);
         });
     });
+
+    it("should delete tenants if request body is passed", async () => {
+      const projectId = "project-id";
+      const tenant = await registerTenant(authApi(), projectId, {});
+
+      await authApi()
+        .delete(
+          `/identitytoolkit.googleapis.com/v2/projects/${projectId}/tenants/${tenant.tenantId}`
+        )
+        .set("Authorization", "Bearer owner")
+        // Sets content-type and sends "{}" in request payload. This is very
+        // uncommon for HTTP DELETE requests, but clients like the Node.js Admin
+        // SDK do it anyway. We want the emulator to tolerate this.
+        .send({})
+        .then((res) => {
+          expectStatusCode(200, res);
+        });
+    });
   });
 
   describe("listTenants", () => {