How to fix auth/invalid-last-sign-in-time: Last sign-in time must be valid UTC date in Firebase

// Correct - ISO 8601 UTC with "Z"
const correctTimestamp = "2025-01-15T10:30:00.000Z";

// Also acceptable (without milliseconds)
const correctTimestampSimple = "2025-01-15T10:30:00Z";

// WRONG - Local time without timezone
const wrong1 = "2025-01-15T10:30:00";

// WRONG - With timezone offset instead of "Z"
const wrong2 = "2025-01-15T10:30:00+00:00";

// WRONG - JavaScript Date object (not string)
const wrong3 = new Date();

// WRONG - Milliseconds since epoch
const wrong4 = "1736929800000";

// WRONG - Custom format
const wrong5 = "January 15, 2025 10:30:00";

function isValidFirebaseTimestamp(timestamp) {
  if (typeof timestamp !== 'string') return false;
  // Must end with Z (UTC) and match ISO 8601 pattern
  const isoPattern = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{3})?Z$/;
  return isoPattern.test(timestamp) && !isNaN(Date.parse(timestamp));
}

const date = new Date();
const firebaseTimestamp = date.toISOString(); // "2025-01-15T10:30:00.000Z"

const milliseconds = 1736929800000;
const date = new Date(milliseconds);
const firebaseTimestamp = date.toISOString();

const localTimeString = "2025-01-15T10:30:00";
const date = new Date(localTimeString + "Z"); // Add Z to treat as UTC
const firebaseTimestamp = date.toISOString();

const timezoneString = "2025-01-15T10:30:00-05:00"; // EST
const date = new Date(timezoneString);
const firebaseTimestamp = date.toISOString(); // Converts to UTC

function toFirebaseTimestamp(input) {
  if (input instanceof Date) {
    return input.toISOString();
  } else if (typeof input === 'string') {
    // Try to parse as date
    const date = new Date(input);
    if (isNaN(date.getTime())) {
      throw new Error('Invalid date string');
    }
    return date.toISOString();
  } else if (typeof input === 'number') {
    // Assume milliseconds
    return new Date(input).toISOString();
  } else {
    throw new Error('Unsupported input type');
  }
}

const admin = require('firebase-admin');
const serviceAccount = require('./serviceAccountKey.json');

admin.initializeApp({
  credential: admin.credential.cert(serviceAccount),
});

async function updateUserLastSignIn(uid, timestamp) {
  try {
    // First, validate the timestamp
    if (!isValidFirebaseTimestamp(timestamp)) {
      throw new Error('Invalid timestamp format');
    }

    // Update the user
    await admin.auth().updateUser(uid, {
      lastSignInTime: timestamp,
    });

    console.log('User updated successfully');
  } catch (error) {
    console.error('Error updating user:', error.message);
    throw error;
  }
}

// Usage
const userId = 'user123';
const validTimestamp = new Date().toISOString(); // Current time in UTC

updateUserLastSignIn(userId, validTimestamp)
  .then(() => console.log('Done'))
  .catch(console.error);

async function migrateUsers(legacyUsers) {
  const admin = require('firebase-admin');

  for (const legacyUser of legacyUsers) {
    try {
      // Convert legacy timestamp to Firebase format
      const firebaseTimestamp = convertLegacyTimestamp(legacyUser.lastLogin);

      // Create or update user in Firebase
      await admin.auth().updateUser(legacyUser.id, {
        email: legacyUser.email,
        displayName: legacyUser.name,
        lastSignInTime: firebaseTimestamp,
        // Other fields as needed
      });

      console.log('Migrated user: ' + legacyUser.email);

      // Add delay to avoid rate limiting
      await new Promise(resolve => setTimeout(resolve, 100));

    } catch (error) {
      console.error('Failed to migrate user ' + legacyUser.email + ':', error.message);
      // Log error but continue with other users
    }
  }
}

function convertLegacyTimestamp(legacyTimestamp) {
  // Handle various legacy formats
  if (legacyTimestamp instanceof Date) {
    return legacyTimestamp.toISOString();
  }

  if (typeof legacyTimestamp === 'string') {
    // Try common formats
    const formats = [
      'YYYY-MM-DD HH:mm:ss',
      'MM/DD/YYYY HH:mm:ss',
      'DD-MM-YYYY HH:mm:ss',
      // Add other formats your system uses
    ];

    for (const format of formats) {
      try {
        // Use a library like moment.js or date-fns for parsing
        const date = parseDate(legacyTimestamp, format);
        if (date) return date.toISOString();
      } catch (e) {
        // Try next format
      }
    }
  }

  // If conversion fails, use current time
  console.warn('Could not parse timestamp: ' + legacyTimestamp + ', using current time');
  return new Date().toISOString();
}

const assert = require('assert');

describe('Timestamp conversion', () => {
  it('should convert Date object to Firebase format', () => {
    const date = new Date('2025-01-15T10:30:00Z');
    const result = toFirebaseTimestamp(date);
    assert.strictEqual(result, '2025-01-15T10:30:00.000Z');
  });

  it('should convert ISO string to Firebase format', () => {
    const result = toFirebaseTimestamp('2025-01-15T10:30:00Z');
    assert.strictEqual(result, '2025-01-15T10:30:00.000Z');
  });

  it('should reject invalid timestamp strings', () => {
    assert.throws(() => toFirebaseTimestamp('invalid-date'));
  });

  it('should handle milliseconds since epoch', () => {
    const ms = 1736929800000; // 2025-01-15T10:30:00Z
    const result = toFirebaseTimestamp(ms);
    assert.strictEqual(result, '2025-01-15T10:30:00.000Z');
  });
});

describe('Firebase timestamp validation', () => {
  it('should accept valid Firebase timestamps', () => {
    assert(isValidFirebaseTimestamp('2025-01-15T10:30:00.000Z'));
    assert(isValidFirebaseTimestamp('2025-01-15T10:30:00Z'));
  });

  it('should reject timestamps without Z', () => {
    assert(!isValidFirebaseTimestamp('2025-01-15T10:30:00'));
  });

  it('should reject timestamps with timezone offset', () => {
    assert(!isValidFirebaseTimestamp('2025-01-15T10:30:00+00:00'));
  });
});

describe('User update integration', () => {
  let testUserId;

  before(async () => {
    // Create a test user
    const user = await admin.auth().createUser({
      email: '[email protected]',
      password: 'test123',
    });
    testUserId = user.uid;
  });

  after(async () => {
    // Clean up test user
    await admin.auth().deleteUser(testUserId);
  });

  it('should update user with valid timestamp', async () => {
    const timestamp = new Date().toISOString();

    await admin.auth().updateUser(testUserId, {
      lastSignInTime: timestamp,
    });

    const updatedUser = await admin.auth().getUser(testUserId);
    assert.strictEqual(updatedUser.metadata.lastSignInTime, timestamp);
  });

  it('should reject invalid timestamp', async () => {
    const invalidTimestamp = 'invalid-date';

    try {
      await admin.auth().updateUser(testUserId, {
        lastSignInTime: invalidTimestamp,
      });
      assert.fail('Should have thrown error');
    } catch (error) {
      assert(error.code === 'auth/invalid-last-sign-in-time');
    }
  });
});

async function safeUpdateUser(uid, updates) {
  try {
    // Validate timestamp if present
    if (updates.lastSignInTime) {
      if (!isValidFirebaseTimestamp(updates.lastSignInTime)) {
        throw new Error('Invalid lastSignInTime format');
      }
    }

    const result = await admin.auth().updateUser(uid, updates);

    // Log successful update
    console.log({
      event: 'user_updated',
      userId: uid,
      timestamp: new Date().toISOString(),
      fields: Object.keys(updates),
    });

    return result;

  } catch (error) {
    // Log detailed error information
    console.error({
      event: 'user_update_failed',
      userId: uid,
      errorCode: error.code,
      errorMessage: error.message,
      timestamp: new Date().toISOString(),
      updates: updates,
      stack: error.stack,
    });

    // Re-throw for caller to handle
    throw error;
  }
}

# Example alert policy (Google Cloud Monitoring)
alert_policy:
  display_name: "High Firebase user update failure rate"
  condition:
    condition_threshold:
      filter: 'metric.type="logging.googleapis.com/user_defined" resource.type="global" metric.labels.event="user_update_failed"'
      aggregations:
        alignment_period: "300s"
        per_series_aligner: ALIGN_RATE
      comparison: COMPARISON_GT
      threshold_value: 0.05  # 5% failure rate
      duration: "600s"  # 10 minutes
  notification_channels:
    - "projects/project-id/notificationChannels/123456"