From fa4c6a35f01b2151cf25762106eaf00b84b65f0a Mon Sep 17 00:00:00 2001
From: Yuchen Shi <yuchenshi@google.com>
Date: Mon, 11 Oct 2021 16:52:54 -0700
Subject: [PATCH] Fix Auth Emulator deleteTenant not working with Node Admin.
 (#3817)

* Fix Auth Emulator deleteTenant not working with Node Admin.

* Add changelog.

* Add more comments.
---
 CHANGELOG.md                           |  1 +
 src/emulator/auth/server.ts            |  8 ++++++++
 src/test/emulators/auth/tenant.spec.ts | 18 ++++++++++++++++++
 3 files changed, 27 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e69de29bb2d..96407484ff8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -0,0 +1 @@
+- Fix Auth Emulator deleteTenant not working with Node Admin (#3817).
diff --git a/src/emulator/auth/server.ts b/src/emulator/auth/server.ts
index c3cd3257fd5..e3d526ce629 100644
--- a/src/emulator/auth/server.ts
+++ b/src/emulator/auth/server.ts
@@ -124,6 +124,14 @@ export async function createApp(
   // This is similar to production behavior. Safe since all APIs are cookieless.
   app.use(cors({ origin: true }));
 
+  // Workaround for clients (e.g. Node.js Admin SDK) that send request bodies
+  // with HTTP DELETE requests. Such requests are tolerated by production, but
+  // exegesis will reject them without the following hack.
+  app.delete("*", (req, _, next) => {
+    delete req.headers["content-type"];
+    next();
+  });
+
   app.get("/", (req, res) => {
     return res.json({
       authEmulator: {
diff --git a/src/test/emulators/auth/tenant.spec.ts b/src/test/emulators/auth/tenant.spec.ts
index 2f45e478d7e..d2ef6f57665 100644
--- a/src/test/emulators/auth/tenant.spec.ts
+++ b/src/test/emulators/auth/tenant.spec.ts
@@ -106,6 +106,24 @@ describeAuthEmulator("tenant management", ({ authApi }) => {
           expectStatusCode(200, res);
         });
     });
+
+    it("should delete tenants if request body is passed", async () => {
+      const projectId = "project-id";
+      const tenant = await registerTenant(authApi(), projectId, {});
+
+      await authApi()
+        .delete(
+          `/identitytoolkit.googleapis.com/v2/projects/${projectId}/tenants/${tenant.tenantId}`
+        )
+        .set("Authorization", "Bearer owner")
+        // Sets content-type and sends "{}" in request payload. This is very
+        // uncommon for HTTP DELETE requests, but clients like the Node.js Admin
+        // SDK do it anyway. We want the emulator to tolerate this.
+        .send({})
+        .then((res) => {
+          expectStatusCode(200, res);
+        });
+    });
   });
 
   describe("listTenants", () => {