[Bug] Desktop Auth token refresh ignores UseEmulator() and targets production

Start in auth/src/desktop/rpcs/secure_token_request.cc, where the token URL is hard-coded as api_host, and compare it with how auth_request.cc's GetUrl() reads AuthImpl::assigned_emulator_url. Confirm the refresh request is the one hitting production before changing anything, since the reproducer has not been run. Done means GetToken(true) succeeds against the emulator on 127.0.0.1:9099.

[REQUIRED] Please fill in the following fields:

• Pre-built SDK from the website or open-source from this repo: Pre-built native SDK bundled with Firebase Unity SDK 13.17.0.
• Firebase C++ SDK version: 13.13.0.
• Problematic Firebase Component: Auth.
• Other Firebase Components in use: None.
• Platform you are using the C++ SDK on: Mac, through the Unity Editor.
• Platform you are targeting: iOS and Android; the failure occurs in the macOS Unity Editor.

[REQUIRED] Please describe the issue here:

Desktop Auth token refresh appears to ignore the endpoint configured through:

auth->UseEmulator("127.0.0.1", 9099);

Anonymous sign-in succeeds against the emulator. However, requesting an ID token for an existing authenticated user fails with “An internal error has occurred.” The user has a UID and is valid.

The failure was observed through the Unity wrapper. The standalone C++ reproducer below has not yet been compiled or run.

The desktop source shows a discrepancy:

• Auth::UseEmulator() stores the configured endpoint in AuthImpl::assigned_emulator_url.
• AuthRequest::GetUrl() uses that endpoint. Anonymous sign-in uses this method.
• SecureTokenRequest, used for token refresh, bypasses GetUrl() and constructs a production URL directly:

const char api_host[] =
    "https://securetoken.googleapis.com/v1/token?key=";

This appears to send emulator-issued refresh tokens to production. The same hard-coded endpoint is present in the installed macOS native library, although the failing HTTP request has not been captured.

Expected behavior: all Auth requests, including token refresh, should use the configured emulator.

References:

• [UseEmulator implementation PR #1437](https://github.com/firebase/firebase-cpp-sdk/pull/1437)
• [Desktop emulator URL selection](https://github.com/firebase/firebase-cpp-sdk/blob/main/auth/src/desktop/rpcs/auth_request.cc)
• [Desktop token refresh request](https://github.com/firebase/firebase-cpp-sdk/blob/main/auth/src/desktop/rpcs/secure_token_request.cc)

Steps to reproduce:

1. Start the Auth emulator on 127.0.0.1:9099.
2. Create a Firebase app.
3. Call UseEmulator() before performing authentication operations.
4. Sign in anonymously.
5. Call GetToken(false) to retrieve the fresh cached token.
6. Call GetToken(true) to exercise the refresh path immediately.

The observed failure occurs when retrieving a token for an existing authenticated user. Explicitly forcing refresh is proposed here to reproduce the suspected failing path without waiting for token expiration.

Have you reproduced this with the Firebase C++ quickstarts? No.

Issue reproduction rate: Not measured.

Relevant Code:

#include <chrono>
#include <iostream>
#include <memory>
#include <thread>

#include "firebase/app.h"
#include "firebase/auth.h"

template <typename T>
bool WaitForResult(const char* operation,
                   const firebase::Future<T>& future) {
  while (future.status() == firebase::kFutureStatusPending) {
    std::this_thread::sleep_for(std::chrono::milliseconds(10));
  }

  if (future.status() != firebase::kFutureStatusComplete) {
    std::cerr << operation << ": invalid future\n";
    return false;
  }

  if (future.error() != 0) {
    std::cerr << operation << ": error " << future.error()
              << ": " << future.error_message() << '\n';
    return false;
  }

  std::cout << operation << ": succeeded\n";
  return true;
}

int main() {
  firebase::AppOptions options;
  options.set_project_id("demo-project");
  options.set_api_key("fake-api-key");
  options.set_app_id("1:1234567890:ios:0000000000000000000000");

  std::unique_ptr<firebase::App> app(
      firebase::App::Create(options, "auth-emulator-refresh-repro"));
  std::unique_ptr<firebase::auth::Auth> auth(
      firebase::auth::Auth::GetAuth(app.get()));

  auth->UseEmulator("127.0.0.1", 9099);

  // Reproduction only: clear cached auth state before creating a new user.
  // Read current_user() first to wait for persisted state initialization.
  auth->current_user();
  auth->SignOut();

  auto sign_in = auth->SignInAnonymously();
  if (!WaitForResult("Anonymous sign-in", sign_in)) {
    return 1;
  }

  auto user = auth->current_user();
  std::cout << "User UID: " << user.uid() << '\n';

  auto cached_token = user.GetToken(false);
  if (!WaitForResult("Cached token", cached_token)) {
    return 1;
  }

  // Exercise SecureTokenRequest immediately.
  auto refreshed_token = user.GetToken(true);
  return WaitForResult("Token refresh", refreshed_token) ? 0 : 1;
}