[shettyvarun268]

Summary

Note: This PR is stacked on #318.

Adds IS_NOT_TENANT support to AuthOptions.tenant_id so developers can scope on_user_created and on_user_deleted triggers exclusively to default-project (non-tenant) users, matching the Node.js SDK (firebase-functions/v2/identity).

---

Usage

from firebase_functions import identity_fn

# Only triggers for users in the default project (ignores users created in any tenant)
@identity_fn.on_user_created(tenant_id=identity_fn.IS_NOT_TENANT)
def handle_default_project_user_created(event: identity_fn.AuthEvent) -> None:
    assert event.tenant_id is None
    print(f"Default-project user created: {event.data.uid}")

---

Architectural & Implementation Details

Why IS_NOT_TENANT Uses Hybrid Deploy-Time + Runtime Filtering (options.py, identity_fn.py, private/_identity_fn.py)

In Identity Platform multi-tenancy, there are three ways a developer may configure tenant_id on an Auth trigger:

1. tenant_id=None (default): Trigger for all users across the project and all tenants (eventFilters: {}).
2. tenant_id="tenant-a": Trigger only for users in "tenant-a" (eventFilters: {"tenantid": "tenant-a"}).
3. tenant_id=IS_NOT_TENANT: Trigger only for default-project users who do not belong to any tenant.

Platform Constraint: Google Cloud Eventarc does not support negative filters or empty-string filters (eventFilters: {"tenantid": ""} is rejected by the Eventarc API). To support IS_NOT_TENANT (matching the Node SDK's implementation):

• Public Sentinel Type: Defined a public Sentinel(_util.Sentinel) subclass and IS_NOT_TENANT = Sentinel(...) in firebase_functions.options (and re-exported IS_NOT_TENANT in firebase_functions.identity_fn) so private module paths do not leak into public Sphinx docs or IDE autocomplete.
• Deploy-Time (AuthOptions._endpoint): When self.tenant_id is IS_NOT_TENANT, we omit "tenantid" from event_filters in functions.yaml so Eventarc delivers all Auth events to the function (while rejecting any other Sentinel such as RESET_VALUE with a ValueError).
• Fast-Path Runtime Filtering (user_event_handler): When options.tenant_id == _options.IS_NOT_TENANT and the CloudEvent's top-level tenantid attribute is present (raw._get_attributes().get("tenantid") is not None), the handler returns immediately before parsing the CloudEvent payload or running @core.init.

---

Verification

Scenario	on_user_created(tenant_id=IS_NOT_TENANT)	on_user_created(tenant_id="tenant-a")	on_user_created() (tenant_id=None)
Default-project user (tenant_id=None)	Fires	Ignored	Fires
Tenant A user (tenant_id="tenant-a")	Ignored (filtered at runtime)	Fires	Fires
Tenant B user (tenant_id="tenant-b")	Ignored (filtered at runtime)	Ignored (filtered by Eventarc)	Fires

• Automated Checks:
  • pytest (all 147 tests passing, including test_on_user_created_is_not_tenant)
  • mypy, ruff check, ruff format --check, and ./docs/generate.sh
• End-to-End Testing:
  • Verified locally against the Firebase Auth + Functions Emulators (firebase emulators:exec).
  • Verified in production on Identity Platform across all 6 combinations of on_user_created / on_user_deleted $\times$ (IS_NOT_TENANT, specific tenant_id, and tenant_id=None).

PR Stack:

• feat(identity): add v2 Auth triggers (on_user_created and on_user_deleted) #318
• feat(identity): support IS_NOT_TENANT filtering for v2 Auth events #319

[gemini-code-assist]

Code Review

This pull request introduces support for filtering Auth event triggers to only trigger on users in the default project (no tenant) by setting tenant_id to IS_NOT_TENANT. Since Eventarc does not support empty-string filters, tenant-scoped events are filtered out at runtime. Additionally, it adds support for parsing RFC-2822 timestamps emitted by the Firebase Auth Emulator. Feedback on the changes suggests ensuring that all parsed or provided datetime objects in _parse_auth_timestamp are normalized to timezone-aware UTC datetimes to prevent returning naive datetimes or datetimes with non-UTC offsets.

[wandamora]

lgtm, ty!