fix(auth,web): return signInSecondFactor from getIdTokenResult

AUTHORS

@@ -71,3 +71,4 @@ kfurue <pulpits.37-shims@icloud.com>
 Max Wojczuk <developer@mwojczuk.xyz>
 Julian Pscheid <julian@pscheid.com>
 Artem Shevchenko <art.shevchen@gmail.com>
+Bilal Aksoy <sloeyeleet@gmail.com>

packages/firebase_auth/firebase_auth_web/lib/src/interop/auth.dart

@@ -325,6 +325,10 @@ class IdTokenResult extends JsObjectWrapper<auth_interop.IdTokenResultImpl> {
   /// Note, this does not map to provider IDs.
   String? get signInProvider => jsObject.signInProvider?.toDart;
 
+  /// The type of second factor associated with this session, provided the
+  /// user was multi-factor authenticated (for example, phone or totp).
+  String? get signInSecondFactor => jsObject.signInSecondFactor?.toDart;
+
   /// The Firebase Auth ID token JWT string.
   String get token => jsObject.token.toDart;
 }

packages/firebase_auth/firebase_auth_web/lib/src/interop/auth_interop.dart

@@ -298,6 +298,7 @@ extension type IdTokenResultImpl._(JSObject _) implements JSObject {
   external JSString get expirationTime;
   external JSString get issuedAtTime;
   external JSString? get signInProvider;
+  external JSString? get signInSecondFactor;
   external JSString get token;
 }
 

packages/firebase_auth/firebase_auth_web/lib/src/utils/web_utils.dart

@@ -231,6 +231,7 @@ IdTokenResult convertWebIdTokenResult(
       expirationTimestamp:
           webIdTokenResult.expirationTime.millisecondsSinceEpoch,
       signInProvider: webIdTokenResult.signInProvider,
+      signInSecondFactor: webIdTokenResult.signInSecondFactor,
     ),
   );
 }

packages/firebase_auth/firebase_auth_web/test/convert_web_id_token_result_test.dart

@@ -0,0 +1,65 @@
+// Copyright 2026 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+@TestOn('browser')
+library;
+
+import 'dart:js_interop';
+import 'dart:js_interop_unsafe';
+
+import 'package:firebase_auth_web/src/interop/auth.dart' as auth_interop;
+import 'package:firebase_auth_web/src/interop/auth_interop.dart'
+    as auth_js_interop;
+import 'package:firebase_auth_web/src/utils/web_utils.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  // Shaped like the object the JS SDK's getIdTokenResult() resolves to.
+  JSObject buildJsIdTokenResult({String? signInSecondFactor}) {
+    final firebaseClaim = JSObject()..['sign_in_provider'] = 'password'.toJS;
+    if (signInSecondFactor != null) {
+      firebaseClaim['sign_in_second_factor'] = signInSecondFactor.toJS;
+    }
+    return JSObject()
+      ..['claims'] = (JSObject()..['firebase'] = firebaseClaim)
+      ..['token'] = 'test-token'.toJS
+      ..['authTime'] = 'Fri, 22 Sep 2017 01:49:58 GMT'.toJS
+      ..['issuedAtTime'] = 'Fri, 22 Sep 2017 01:49:58 GMT'.toJS
+      ..['expirationTime'] = 'Fri, 22 Sep 2017 02:49:58 GMT'.toJS
+      ..['signInProvider'] = 'password'.toJS
+      ..['signInSecondFactor'] = signInSecondFactor?.toJS;
+  }
+
+  Future<auth_interop.IdTokenResult> getIdTokenResult(JSObject jsResult) {
+    JSPromise<JSObject> fakeGetIdTokenResult(JSBoolean? forceRefresh) =>
+        Future<JSObject>.value(jsResult).toJS;
+    final jsUser = JSObject()..['getIdTokenResult'] = fakeGetIdTokenResult.toJS;
+    final user = auth_interop.User.getInstance(
+      jsUser as auth_js_interop.UserJsImpl,
+    )!;
+    return user.getIdTokenResult(false);
+  }
+
+  group('convertWebIdTokenResult', () {
+    test('passes signInSecondFactor through', () async {
+      final result = convertWebIdTokenResult(
+        await getIdTokenResult(
+          buildJsIdTokenResult(signInSecondFactor: 'totp'),
+        ),
+      );
+
+      expect(result.signInProvider, 'password');
+      expect(result.signInSecondFactor, 'totp');
+    });
+
+    test('returns null signInSecondFactor without a second factor', () async {
+      final result = convertWebIdTokenResult(
+        await getIdTokenResult(buildJsIdTokenResult()),
+      );
+
+      expect(result.signInProvider, 'password');
+      expect(result.signInSecondFactor, isNull);
+    });
+  });
+}