Update main.py

main.py

@@ -186,10 +186,10 @@ def verify_token(req):
     """
     Verify Firebase ID token and check if user is admin.
     Automatically creates admin entry in DB if email is in ADMIN_EMAILS but UID is not found.
+    Tries to extract email from token claims or firebase identities.
     Returns decoded token dict if valid admin, None otherwise.
     """
-    # Use the logger instance created in your full script
-    logger = logging.getLogger('guards_api')
+    logger = logging.getLogger('guards_api') # Assuming logger is configured as in your full script
 
     auth_header = req.headers.get("Authorization")
     if not auth_header:
@@ -207,15 +207,37 @@ def verify_token(req):
         decoded = firebase_auth.verify_id_token(token)
         logger.debug(f"Token verified successfully. Decoded token keys: {list(decoded.keys())}")
 
-        # Get user UID and email from decoded token
-        uid = decoded.get('uid')
-        email = decoded.get('email') # This should be present in the token
-        logger.debug(f"Extracted UID: {uid}, Email: {email}")
+        # Get user UID from decoded token
+        uid = decoded.get('uid') or decoded.get('user_id') # Fallback to 'user_id' if 'uid' is missing (though 'uid' should be standard)
+        logger.debug(f"Extracted UID: {uid}")
 
         if not uid:
-            logger.error("Verified token does not contain a UID.")
+            logger.error("Verified token does not contain a UID or user_id.")
             return None
 
+        # Attempt to get email from decoded token
+        email = decoded.get('email')
+        logger.debug(f"Direct email claim from token: {email}")
+
+        # If email not directly available, try to get it from firebase identities
+        if not email and 'firebase' in decoded and 'identities' in decoded['firebase']:
+            identities = decoded['firebase']['identities']
+            logger.debug(f"Firebase identities found: {identities}")
+            # Common provider emails (Google, etc.)
+            google_emails = identities.get('google.com', [])
+            if google_emails and isinstance(google_emails, list):
+                email = google_emails[0] # Take the first one if multiple
+                logger.debug(f"Email extracted from google.com identity: {email}")
+            # Add checks for other providers if needed (e.g., 'email', etc.)
+            # Fallback: check if there's a generic 'email' list
+            if not email:
+                generic_emails = identities.get('email', [])
+                if generic_emails and isinstance(generic_emails, list):
+                    email = generic_emails[0]
+                    logger.debug(f"Email extracted from generic 'email' identity: {email}")
+
+        logger.debug(f"Final extracted email: {email}")
+
         # Check if user is admin by querying Firebase Realtime Database using UID
         admins_ref = db.reference("/admins")
         admin_data = admins_ref.child(uid).get()
@@ -241,15 +263,13 @@ def verify_token(req):
                 # Return the decoded token as they are now an admin
                 return decoded
             except Exception as db_error:
-                logger.error(f"Failed to create admin entry for UID {uid} in database: {db_error}")
-                # Even if DB write fails, if they are in ADMIN_EMAILS, we could consider them authorized
-                # but it's safer to deny access if we can't record it.
-                # Alternatively: return decoded (less safe) or return None (safer)
+                logger.error(f"Failed to create admin entry for UID {uid} in database: {db_error}", exc_info=True)
+                # Deny access if we can't record it
                 return None
 
         else:
-            # User is not in the approved admin list or email not found in token
-            logger.warning(f"User {uid} ({email}) is not in the approved admin list or email not found.")
+            # User is not in the approved admin list or email not found/extractable
+            logger.warning(f"User {uid} (Email: {email}) is not in the approved admin list or email not found/extractable.")
             return None
 
     except firebase_auth.InvalidIdTokenError as e: