Migration Guide

firebase auth:export users.json --format=json --project your-project-id

package main

import (
	"context"
	"encoding/json"
	"log"
	"os"

	authsome "github.com/xraph/authsome"
	"github.com/xraph/authsome/id"
	"github.com/xraph/authsome/user"
)

type FirebaseUser struct {
	LocalID       string `json:"localId"`
	Email         string `json:"email"`
	DisplayName   string `json:"displayName"`
	PhotoURL      string `json:"photoUrl"`
	EmailVerified bool   `json:"emailVerified"`
	Disabled      bool   `json:"disabled"`
}

type FirebaseExport struct {
	Users []FirebaseUser `json:"users"`
}

func main() {
	ctx := context.Background()
	eng := setupEngine() // Your engine setup

	data, _ := os.ReadFile("users.json")
	var export FirebaseExport
	json.Unmarshal(data, &export)

	for _, fu := range export.Users {
		if fu.Disabled {
			continue
		}
		u := &user.User{
			ID:            id.NewUserID(),
			Email:         fu.Email,
			Name:          fu.DisplayName,
			AvatarURL:     fu.PhotoURL,
			EmailVerified: fu.EmailVerified,
			Metadata: map[string]any{
				"firebase_id":       fu.LocalID,
				"requires_password_reset": true,
			},
		}
		if err := eng.Store().CreateUser(ctx, u); err != nil {
			log.Printf("skip %s: %v", fu.Email, err)
		}
	}
}

curl -X POST "https://YOUR_DOMAIN.auth0.com/api/v2/jobs/users-exports" \
  -H "Authorization: Bearer $AUTH0_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "format": "json",
    "fields": [
      {"name": "user_id"},
      {"name": "email"},
      {"name": "name"},
      {"name": "picture"},
      {"name": "email_verified"},
      {"name": "identities"}
    ]
  }'

SELECT
  id,
  email,
  raw_user_meta_data->>'full_name' as name,
  raw_user_meta_data->>'avatar_url' as avatar_url,
  email_confirmed_at IS NOT NULL as email_verified,
  encrypted_password,
  created_at
FROM auth.users
WHERE deleted_at IS NULL;

u := &user.User{
	ID:            id.NewUserID(),
	Email:         supabaseUser.Email,
	Name:          supabaseUser.Name,
	EmailVerified: supabaseUser.EmailVerified,
	PasswordHash:  supabaseUser.EncryptedPassword, // bcrypt hash, compatible
}

import "github.com/xraph/authsome/tokenformat"

// Configure Authsome to accept your existing JWTs
jwtFmt, _ := tokenformat.NewJWT(tokenformat.JWTConfig{
	Issuer:     "your-existing-issuer",
	Audience:   "your-app",
	SigningKey:  existingPublicKey,
	SigningMethod: "RS256",
})

eng, _ := authsome.NewEngine(
	authsome.WithStore(store),
	authsome.WithDefaultTokenFormat(jwtFmt),
)

// middleware that tries Authsome first, falls back to legacy
func migrationMiddleware(authsomeEng *authsome.Engine, legacyAuth LegacyAuth) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			token := extractBearerToken(r)

			// Try Authsome first
			session, err := authsomeEng.ResolveSessionByToken(r.Context(), token)
			if err == nil {
				ctx := setUser(r.Context(), session.UserID)
				next.ServeHTTP(w, r.WithContext(ctx))
				return
			}

			// Fall back to legacy system
			userID, err := legacyAuth.ValidateToken(token)
			if err != nil {
				http.Error(w, "Unauthorized", 401)
				return
			}

			// Optionally: migrate the user to Authsome in the background
			go migrateUserToAuthsome(authsomeEng, legacyAuth, userID)

			ctx := setUser(r.Context(), userID)
			next.ServeHTTP(w, r.WithContext(ctx))
		})
	}
}