Firebase Authentication Account removal

Issue

I'm trying to remove a Firebase Authentication account in my Android Java app. I have the account info in both Firebase Authentication and Firestore. Firestore removal is okay with me, but the Firebase Authentication removal is problematic. So I'm trying to display all the users to a RecyclerView, and when I click remove, the user will get removed from both the Firebase Auth and Firestore. I looked up online and saw the getUserByEmail() method from the FirebaseAuth but cannot use it. Please help, thank you.

Solution

When you call delete() on a FirebaseUser to delete the user from Firebase Authentication, it doesn't mean that the data that exists in Firestore will also be deleted. No, you have to write code for that, because those operations are not related in any way.

There are three ways in which you can solve this problem.

1. As soon as the operation for deleting the user from Firebase Authentication completes successfully, you have to create a reference on the client that points to the document that corresponds to the user and then you call delete(), to wipe user data from Firestore.

2. You create a Cloud Function for Firebase that does that for you.

3. If you don't want to write code for that, then you can use a Firebase Exception called Firestore User Document which:

Creates a document in a specified Firestore collection whenever a new user is created in Firebase Authentication. The document is populated with fields that you select from the user record. You can also choose to delete the user's document when the user is deleted from Firebase Authentication.

It's up to you to choose which solution is more convenient for you.

Edit:

To delete the user from Firestore and from the Firebase Authentication, please use the following lines of Java code:

FirebaseUser firebaseUser = FirebaseAuth.getInstance().getCurrentUser();
if (firebaseUser != null) {
    String uid = firebaseUser.getUid();
    FirebaseFirestore db = FirebaseFirestore.getInstance();
    db.collection("users").document(uid).delete().addOnCompleteListener(new OnCompleteListener<Void>() {
        @Override
        public void onComplete(@NonNull Task<Void> userDocDeleteTask) {
            if (userDocDeleteTask.isSuccessful()) {
                Log.d(TAG, "User document successfully deleted from Firestore.");
                firebaseUser.delete().addOnCompleteListener(new OnCompleteListener<Void>() {
                    @Override
                    public void onComplete(@NonNull Task<Void> firebaseUserDeleteTask) {
                        if (firebaseUserDeleteTask.isSuccessful()) {
                            Log.d(TAG, "User document successfully deleted from Firebase Authentication.");
                        } else {
                            Log.d(TAG, firebaseUserDeleteTask.getException().getMessage());
                        }
                    }
                });
            } else {
                Log.d(TAG, userDocDeleteTask.getException().getMessage());
            }
        }
    });
}

Edit2:

According to your last comment, the above operation will indeed work only to delete the logged-in user. However, anything else would be a huge security risk, as it would allow users of your app to delete each other's accounts. This will never be possible from the client-side perspective.

On the other hand, the Admin SDKs for Firebase Authentication are designed to be used in a trusted environment, like a server that you control or Cloud Functions for Firebase. Because of that, they can perform certain operations that the client-side SDKs don't, such as deleting user accounts by using their UID.

Answered By - Alex Mamo