MFA UpdateUser fails with "Illegal trailing data" when EnrollmentTimestamp is set

[deresmos]

Environment

• firebase-admin-go: v4.20.0

Problem

Calling UpdateUser with an MFA factor whose EnrollmentTimestamp is non-zero fails with:

{
  "error": {
    "code": 400,
    "message": "Invalid value at 'mfa.enrollments[0].enrolled_at' (type.googleapis.com/google.protobuf.Timestamp), Field 'enrolledAt', Invalid time format: Illegal trailing data in input string",
    "errors": [
      {
        "message": "Invalid value at 'mfa.enrollments[0].enrolled_at' (type.googleapis.com/google.protobuf.Timestamp), Field 'enrolledAt', Invalid time format: Illegal trailing data in input string",
        "reason": "invalid"
      }
    ],
    "status": "INVALID_ARGUMENT",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.BadRequest",
        "fieldViolations": [
          {
            "field": "mfa.enrollments[0].enrolled_at",
            "description": "Invalid value at 'mfa.enrollments[0].enrolled_at' (type.googleapis.com/google.protobuf.Timestamp), Field 'enrolledAt', Invalid time format: Illegal trailing data in input string"
          }
        ]
      }
    ]
  }
}

Reproduction

user := (&auth.UserToUpdate{}).MFASettings(auth.MultiFactorSettings{
    EnrolledFactors: []*auth.MultiFactorInfo{
        {
            UID:                 "someuid",
            DisplayName:         "My phone",
            FactorID:            "phone",
            EnrollmentTimestamp: time.Now().Unix() * 1000,
            Phone:               &auth.PhoneMultiFactorInfo{PhoneNumber: "+11234567890"},
        },
    },
})

_, err := client.UpdateUser(ctx, "someuid", user)
// err: "Illegal trailing data in input string"

Setting EnrollmentTimestamp to 0 avoids the error.

[Ackberry]

Hey @lahirumaramba , I would like to take this issue. I am enrolled in Codepath's AI301 Open source capstone course where I do open source contributions. I would love to contribute to firebase admin go sdk (i like go). I would go ahead and plan further if it is okay :)

[rootkiller6788]

Ran into this too while looking at the MFA update path. It's two things stacked in convertMultiFactorInfoToServerFormat.

First, the layout is "2006-01-02T15:04:05Z07:00Z" and that trailing Z is a literal, so you get output like 53140-03-29T09:33:20+08:00Z. The backend parses the offset fine and then trips over the extra Z, which is the "Illegal trailing data" you're seeing.

Second, EnrollmentTimestamp is milliseconds — GetUser fills it from t.Unix() * 1000 and the integration test passes it straight back into UpdateUser — but the code was handing it to time.Unix as seconds, so even a well-formed string would land somewhere around year 53000.

Both go away with time.UnixMilli(...).UTC().Format(time.RFC3339). Patch ready on my side, I'll send it over shortly.