Add FAC Verify Token API (#26)

* (feat): Add FAC Verify token API

- Re-try with all the keys when kid is not present in the token header.
- Add JWKS key fetcher
- Add public API for FAC verify token

* Add ref docs and unit tests

* PR fixes

* Update api extractor report

* Add more tests for token-verifier

* export jwks key pairs

* PR fixes

* More PR fixes

* Update src/app-check/index.ts

Co-authored-by: Kevin Cheung <[email protected]>

Co-authored-by: Kevin Cheung <[email protected]>

Author: lahirumaramba

docgen/content-sources/node/toc.yaml

@@ -19,6 +19,18 @@ toc:
   - title: "App"
     path: /docs/reference/admin/node/admin.app.App-1
 
+- title: "admin.appCheck"
+  path: /docs/reference/admin/node/admin.appCheck
+  section:
+  - title: "AppCheck"
+    path: /docs/reference/admin/node/admin.appCheck.AppCheck-1
+  - title: "AppCheckToken"
+    path: /docs/reference/admin/node/admin.appCheck.AppCheckToken
+  - title: "DecodedAppCheckToken"
+    path: /docs/reference/admin/node/admin.appCheck.DecodedAppCheckToken
+  - title: "VerifyAppCheckTokenResponse"
+    path: /docs/reference/admin/node/admin.appCheck.VerifyAppCheckTokenResponse
+
 - title: "admin.auth"
   path: /docs/reference/admin/node/admin.auth
   section:

etc/firebase-admin.api.md

@@ -52,11 +52,26 @@ export namespace appCheck {
         // (undocumented)
         app: app.App;
         createToken(appId: string): Promise<AppCheckToken>;
+        verifyToken(appCheckToken: string): Promise<VerifyAppCheckTokenResponse>;
     }
     export interface AppCheckToken {
         token: string;
         ttlMillis: number;
     }
+    export interface DecodedAppCheckToken {
+        // (undocumented)
+        [key: string]: any;
+        app_id: string;
+        aud: string[];
+        exp: number;
+        iat: number;
+        iss: string;
+        sub: string;
+    }
+    export interface VerifyAppCheckTokenResponse {
+        appId: string;
+        token: appCheck.DecodedAppCheckToken;
+    }
 }
 
 // @public

package-lock.json

@@ -61,6 +61,7 @@
     "@types/node": "^10.10.0",
     "dicer": "^0.3.0",
     "jsonwebtoken": "^8.5.1",
+    "jwks-rsa": "^2.0.2",
     "node-forge": "^0.10.0"
   },
   "optionalDependencies": {

package.json

@@ -205,6 +205,7 @@ export type AppCheckErrorCode =
   | 'permission-denied'
   | 'unauthenticated'
   | 'not-found'
+  | 'app-check-token-expired'
   | 'unknown-error';
 
 /**