Skip to content

Commit 2668d56

Browse files
committed
Merge remote-tracking branch 'origin/master' into rsgowman/enable_anon_auth
2 parents c644b73 + 01d8177 commit 2668d56

32 files changed

+610
-709
lines changed

.github/ISSUE_TEMPLATE/general-bug-report.md

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,6 @@ assignees: ''
77

88
---
99

10-
**Thank you for submitting your issue. We are operating at reduced capacity from Dec 18 2020 to Jan 4 2021. Please expect delayed responses. For more urgent requests please reach us via our support channels https://firebase.google.com/support**
11-
1210
### [READ] Step 1: Are you in the right place?
1311

1412
* For issues related to __the code in this repository__ file a Github issue.

.github/workflows/nightly.yml

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# Copyright 2021 Google Inc.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
name: Nightly Builds
16+
17+
on:
18+
# Runs every day at 06:00 AM (PT) and 08:00 PM (PT) / 04:00 AM (UTC) and 02:00 PM (UTC)
19+
schedule:
20+
- cron: "0 4,14 * * *"
21+
22+
jobs:
23+
nightly:
24+
25+
runs-on: ubuntu-latest
26+
27+
steps:
28+
- name: Checkout source for staging
29+
uses: actions/checkout@v2
30+
with:
31+
ref: ${{ github.event.client_payload.ref || github.ref }}
32+
33+
- name: Set up Node.js
34+
uses: actions/setup-node@v1
35+
with:
36+
node-version: 10.x
37+
38+
- name: Install and build
39+
run: |
40+
npm ci
41+
npm run build
42+
npm run build:tests
43+
44+
- name: Run unit tests
45+
run: npm test
46+
47+
- name: Verify public API
48+
run: npm run api-extractor
49+
50+
- name: Run integration tests
51+
run: ./.github/scripts/run_integration_tests.sh
52+
env:
53+
FIREBASE_SERVICE_ACCT_KEY: ${{ secrets.FIREBASE_SERVICE_ACCT_KEY }}
54+
FIREBASE_API_KEY: ${{ secrets.FIREBASE_API_KEY }}
55+
56+
- name: Package release artifacts
57+
run: |
58+
npm pack
59+
mkdir -p dist
60+
cp *.tgz dist/
61+
62+
# Attach the packaged artifacts to the workflow output. These can be manually
63+
# downloaded for later inspection if necessary.
64+
- name: Archive artifacts
65+
uses: actions/upload-artifact@v1
66+
with:
67+
name: dist
68+
path: dist

CONTRIBUTING.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,7 @@ following credentials from the project:
146146
2. *Web API key*: This is displayed in the "Settings > General" tab of the
147147
console. Copy it and save to a new text file at `test/resources/apikey.txt`.
148148

149-
Then set up your Firebase/GCP project as follows:
149+
Then set up your Firebase/Google Cloud project as follows:
150150

151151
1. Enable Firestore: Go to the Firebase Console, and select "Database" from
152152
the "Develop" menu. Click on the "Create database" button. You may choose
@@ -160,15 +160,15 @@ Then set up your Firebase/GCP project as follows:
160160
https://console.developers.google.com/apis/api/firebaseml.googleapis.com/overview)
161161
and make sure your project is selected. If the API is not already enabled, click Enable.
162162
4. Enable the IAM API: Go to the
163-
[Google Cloud Platform Console](https://console.cloud.google.com) and make
164-
sure your Firebase/GCP project is selected. Select "APIs & Services >
163+
[Google Cloud Console](https://console.cloud.google.com) and make
164+
sure your Firebase/Google Cloud project is selected. Select "APIs & Services >
165165
Dashboard" from the main menu, and click the "ENABLE APIS AND SERVICES"
166166
button. Search for and enable the "Identity and Access Management (IAM)
167167
API".
168168
5. Grant your service account the 'Firebase Authentication Admin' role. This is
169169
required to ensure that exported user records contain the password hashes of
170170
the user accounts:
171-
1. Go to [Google Cloud Platform Console / IAM & admin](https://console.cloud.google.com/iam-admin).
171+
1. Go to [Google Cloud Console / IAM & admin](https://console.cloud.google.com/iam-admin).
172172
2. Find your service account in the list, and click the 'pencil' icon to edit it's permissions.
173173
3. Click 'ADD ANOTHER ROLE' and choose 'Firebase Authentication Admin'.
174174
4. Click 'SAVE'.

package-lock.json

Lines changed: 13 additions & 13 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@
6969
},
7070
"devDependencies": {
7171
"@firebase/app": "^0.6.13",
72-
"@firebase/auth": "^0.15.2",
72+
"@firebase/auth": "^0.16.2",
7373
"@firebase/auth-types": "^0.10.1",
7474
"@microsoft/api-extractor": "^7.11.2",
7575
"@types/bcrypt": "^2.0.0",

src/auth/auth-api-request.ts

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2117,10 +2117,6 @@ function emulatorHost(): string | undefined {
21172117
/**
21182118
* When true the SDK should communicate with the Auth Emulator for all API
21192119
* calls and also produce unsigned tokens.
2120-
*
2121-
* This alone does <b>NOT<b> short-circuit ID Token verification.
2122-
* For security reasons that must be explicitly disabled through
2123-
* setJwtVerificationEnabled(false);
21242120
*/
21252121
export function useEmulator(): boolean {
21262122
return !!emulatorHost();

src/auth/auth.ts

Lines changed: 16 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,11 @@ import {
2525
AbstractAuthRequestHandler, AuthRequestHandler, TenantAwareAuthRequestHandler, useEmulator,
2626
} from './auth-api-request';
2727
import { AuthClientErrorCode, FirebaseAuthError, ErrorInfo } from '../utils/error';
28-
import { FirebaseServiceInterface, FirebaseServiceInternalsInterface } from '../firebase-service';
2928
import * as utils from '../utils/index';
3029
import * as validator from '../utils/validator';
3130
import { auth } from './index';
3231
import {
33-
FirebaseTokenVerifier, createSessionCookieVerifier, createIdTokenVerifier, ALGORITHM_RS256
32+
FirebaseTokenVerifier, createSessionCookieVerifier, createIdTokenVerifier
3433
} from './token-verifier';
3534
import {
3635
SAMLConfig, OIDCConfig, OIDCConfigServerResponse, SAMLConfigServerResponse,
@@ -59,22 +58,6 @@ import BaseAuthInterface = auth.BaseAuth;
5958
import AuthInterface = auth.Auth;
6059
import TenantAwareAuthInterface = auth.TenantAwareAuth;
6160

62-
/**
63-
* Internals of an Auth instance.
64-
*/
65-
class AuthInternals implements FirebaseServiceInternalsInterface {
66-
/**
67-
* Deletes the service and its associated resources.
68-
*
69-
* @return {Promise<()>} An empty Promise that will be fulfilled when the service is deleted.
70-
*/
71-
public delete(): Promise<void> {
72-
// There are no resources to clean up
73-
return Promise.resolve(undefined);
74-
}
75-
}
76-
77-
7861
/**
7962
* Base Auth class. Mainly used for user management APIs.
8063
*/
@@ -132,15 +115,16 @@ export class BaseAuth<T extends AbstractAuthRequestHandler> implements BaseAuthI
132115
* verification.
133116
*/
134117
public verifyIdToken(idToken: string, checkRevoked = false): Promise<DecodedIdToken> {
135-
return this.idTokenVerifier.verifyJWT(idToken)
118+
const isEmulator = useEmulator();
119+
return this.idTokenVerifier.verifyJWT(idToken, isEmulator)
136120
.then((decodedIdToken: DecodedIdToken) => {
137121
// Whether to check if the token was revoked.
138-
if (!checkRevoked) {
139-
return decodedIdToken;
122+
if (checkRevoked || isEmulator) {
123+
return this.verifyDecodedJWTNotRevoked(
124+
decodedIdToken,
125+
AuthClientErrorCode.ID_TOKEN_REVOKED);
140126
}
141-
return this.verifyDecodedJWTNotRevoked(
142-
decodedIdToken,
143-
AuthClientErrorCode.ID_TOKEN_REVOKED);
127+
return decodedIdToken;
144128
});
145129
}
146130

@@ -460,15 +444,16 @@ export class BaseAuth<T extends AbstractAuthRequestHandler> implements BaseAuthI
460444
*/
461445
public verifySessionCookie(
462446
sessionCookie: string, checkRevoked = false): Promise<DecodedIdToken> {
463-
return this.sessionCookieVerifier.verifyJWT(sessionCookie)
447+
const isEmulator = useEmulator();
448+
return this.sessionCookieVerifier.verifyJWT(sessionCookie, isEmulator)
464449
.then((decodedIdToken: DecodedIdToken) => {
465450
// Whether to check if the token was revoked.
466-
if (!checkRevoked) {
467-
return decodedIdToken;
451+
if (checkRevoked || isEmulator) {
452+
return this.verifyDecodedJWTNotRevoked(
453+
decodedIdToken,
454+
AuthClientErrorCode.SESSION_COOKIE_REVOKED);
468455
}
469-
return this.verifyDecodedJWTNotRevoked(
470-
decodedIdToken,
471-
AuthClientErrorCode.SESSION_COOKIE_REVOKED);
456+
return decodedIdToken;
472457
});
473458
}
474459

@@ -692,28 +677,6 @@ export class BaseAuth<T extends AbstractAuthRequestHandler> implements BaseAuthI
692677
return decodedIdToken;
693678
});
694679
}
695-
696-
/**
697-
* Enable or disable ID token verification. This is used to safely short-circuit token verification with the
698-
* Auth emulator. When disabled ONLY unsigned tokens will pass verification, production tokens will not pass.
699-
*
700-
* WARNING: This is a dangerous method that will compromise your app's security and break your app in
701-
* production. Developers should never call this method, it is for internal testing use only.
702-
*
703-
* @internal
704-
*/
705-
// @ts-expect-error: this method appears unused but is used privately.
706-
private setJwtVerificationEnabled(enabled: boolean): void {
707-
if (!enabled && !useEmulator()) {
708-
// We only allow verification to be disabled in conjunction with
709-
// the emulator environment variable.
710-
throw new Error('This method is only available when connected to the Authentication emulator.');
711-
}
712-
713-
const algorithm = enabled ? ALGORITHM_RS256 : 'none';
714-
this.idTokenVerifier.setAlgorithm(algorithm);
715-
this.sessionCookieVerifier.setAlgorithm(algorithm);
716-
}
717680
}
718681

719682

@@ -820,10 +783,8 @@ export class TenantAwareAuth
820783
* Auth service bound to the provided app.
821784
* An Auth instance can have multiple tenants.
822785
*/
823-
export class Auth extends BaseAuth<AuthRequestHandler>
824-
implements FirebaseServiceInterface, AuthInterface {
786+
export class Auth extends BaseAuth<AuthRequestHandler> implements AuthInterface {
825787

826-
public INTERNAL: AuthInternals = new AuthInternals();
827788
private readonly tenantManager_: TenantManager;
828789
private readonly app_: FirebaseApp;
829790

0 commit comments

Comments
 (0)