firebase_token_auth 0.1.0 → 1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0b8bb47628efe00351023a731bcc1d839aa731c79195c4248dec9cce886c4863
-  data.tar.gz: 44126b4a7a3fababeccb799edf9a09706da7064b01aaa79a39889149df186dbd
+  metadata.gz: b80452c76a12e4f2cb4728f5b681073dfb6efe70ff15664c572b21e414e1f08e
+  data.tar.gz: 962a2a3c6e80569c3191b4366a0c1d55b42e6197fc3b967a1ab3446fca3bcdb9
 SHA512:
-  metadata.gz: bd940772d542601ba17e1a776be82b88ff70e01b568125498a0554e91b5eede3e81157bef226373257b80612f41711b501053f43368e1f6a99e17fe53e79b1d2
-  data.tar.gz: a286c00748d9e31f14e38de4b6a2e4deaed0117f9b4eeabc186d30cc5fcb24c692f5cd2097d3c28120ffc269480b5957c3b7407baf920505a0ae26aa5ced9454
+  metadata.gz: daa8b971bd3390f5a9a239064b318b47f50ecb84afbd87bb21bca65725fcabc5f79046407e1a60e23be78e0352780657c4d7d2ec993a6edb7b4b89344879054d
+  data.tar.gz: 961d9740f5b618d7bd73be5e578a3d14e576914510479c7328f57db1652c46b642d63430dbe460d666b040c81fd1c0671ff7633acfb354b01ee19c474eaa6f70

data/.github/workflows/test.yml

@@ -0,0 +1,56 @@
+name: rspec
+
+on: push
+
+jobs:
+  rspec:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        ruby: [ 2.4, 2.5, 2.6, 2.7, "3.0" ]
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+
+      - name: Configure Bundler
+        run: |
+          gem update --system
+          gem --version
+          gem install -N bundler -v 2
+
+      - uses: actions/cache@v1
+        with:
+          path: vendor/bundle
+          key: ${{ runner.os }}-gem-${{ hashFiles(format('{0}{1}', github.workspace, '/Gemfile.lock')) }}
+          restore-keys: ${{ runner.os }}-gem-
+
+      - name: Install ruby dependencies
+        run: |
+          bundle check || bundle install --jobs 4 --retry 3 --path vendor/bundle
+
+      - name: rspec
+        run: |
+          bundle exec rspec
+        env:
+          TEST_UID: ${{ secrets.TEST_UID }}
+          TEST_PROJECT_ID: ${{ secrets.TEST_PROJECT_ID }}
+          TEST_WEB_API_KEY: ${{ secrets.TEST_WEB_API_KEY }}
+          TEST_USER_EMAIL: ${{ secrets.TEST_USER_EMAIL }}
+          GOOGLE_ACCOUNT_TYPE: ${{ secrets.GOOGLE_ACCOUNT_TYPE }}
+          GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
+          GOOGLE_CLIENT_EMAIL: ${{ secrets.GOOGLE_CLIENT_EMAIL }}
+          GOOGLE_PRIVATE_KEY: ${{ secrets.GOOGLE_PRIVATE_KEY }}
+
+      - name: slack notification
+        uses: 8398a7/action-slack@v2
+        if: always()
+        with:
+          status: ${{ job.status }}
+          author_name: 'github action firebase_token_auth build'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

data/.gitignore

@@ -12,3 +12,4 @@
 .rspec_status
 
 Gemfile.lock
+.ruby-version

data/.rubocop.yml

@@ -9,3 +9,6 @@ Style/Documentation:
 
 Layout/IndentationConsistency:
   EnforcedStyle: indented_internal_methods
+
+Style/BracesAroundHashParameters:
+  EnforcedStyle: braces

data/README.md

@@ -1,8 +1,10 @@
 # FirebaseTokenAuth
 
-Welcome to your new gem! In this directory, you'll find the files you need to be able to package up your Ruby library into a gem. Put your Ruby code in the file `lib/firebase_token_auth`. To experiment with that code, run `bin/console` for an interactive prompt.
-
-TODO: Delete this and the text above, and describe your gem
+FirebaseTokenAuth is an Firebase Auth Client. It supports below.
+- verify id_token method
+- create custom token
+- fetch user info by uid/email
+- update user info
 
 ## Installation
 
@@ -22,17 +24,131 @@ Or install it yourself as:
 
 ## Usage
 
-TODO: Write usage instructions here
+on Rails, config/initializers/firebase_token_auth.rb
+```ruby
+FirebaseTokenAuth.configure do |config|
+  ## for id_token_verify
+  # firebase web console => project settings => general => project ID
+  config.project_id = "your_project_id" # required
+
+  # firebase web console => project settings => service account => firebase admin sdk => generate new private key
+  # pass string of path to credential file to config.json_key_io
+  config.json_key_io = "#{Rails.root}/path/to/service_account_credentials.json"
+  # Or content of json key file wrapped with StringIO
+  # config.json_key_io = StringIO.new('{ ... }')
+
+  # Or set environment variables
+  # ENV['GOOGLE_ACCOUNT_TYPE'] = 'service_account'
+  # ENV['GOOGLE_CLIENT_ID'] = '000000000000000000000'
+  # ENV['GOOGLE_CLIENT_EMAIL'] = 'xxxx@xxxx.iam.gserviceaccount.com'
+  # ENV['GOOGLE_PRIVATE_KEY'] = '-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n\'
+end
+```
+for more detail. see [here](https://github.com/googleapis/google-auth-library-ruby#example-service-account).
+
+### token verify
+```ruby
+require 'firebase_token_auth'
+
+FirebaseTokenAuth.configure do |config|
+  config.project_id = 'your_project_id'
+end
+
+client = Firebase.build
+result = client.verify_id_token(id_token)
+
+puts result.uid
+# => "hMPHt8RyDpOsHi1oH5XaVirSYyq2"
+
+puts result.id_token.payload # you can see decoded id_token payload
+# => {"iss"=>"https://securetoken.google.com/<your_project_id>",
+#  "aud"=>"<your_project_id>",
+#  "auth_time"=>1594494935,
+#  "user_id"=>"hMPHt8RyDpOsHi1oH5XaVirSYyq2",
+#  "sub"=>"hMPHt8RyDpOsHi1oH5XaVirSYyq2",
+#  "iat"=>1594494935,
+#  "exp"=>1594498535,
+#  "email"=>"<your_user_email>",
+#  "email_verified"=>false,
+#  "firebase"=>{"identities"=>{"email"=>["<your_user_email>"]}, "sign_in_provider"=>"custom"}}
+
+puts result.id_token.header
+# => {"alg"=>"RS256", "kid"=>"7623e10a045140f1cfd4be0466cf80352b59f81e", "typ"=>"JWT"}
+```
+
+### custom token create
+```ruby
+require 'firebase_token_auth'
 
-## Development
+FirebaseTokenAuth.configure do |config|
+  config.project_id = 'your_project_id'
+  config.json_key_io = "#{Rails.root}/path/to/service_account_credentials.json"
+end
 
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+client = FirebaseTokenAuth.new
+c_token = client.create_custom_token(test_uid)
+puts c_token
+# => "eyJhbGciOXXX.eyJpc3MiOiJmaXJlYmFzXXXX.v7y7LoBXXXXX" # dummy
+```
 
-To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+### fetch users info from firebase
+```ruby
+require 'firebase_token_auth'
+
+FirebaseTokenAuth.configure do |config|
+  config.project_id = 'your_project_id'
+  config.json_key_io = "#{Rails.root}/path/to/service_account_credentials.json"
+end
+
+client = FirebaseTokenAuth.new
+result = client.user_search_by_email(test_user_email)
+# result = client.user_search_by_uid(test_uid)
+puts result
+# => [{:created_at=>1594132097140,
+#   :custom_auth=>true,
+#   :disabled=>false,
+#   :email=>"<your_user_email>",
+#   :email_verified=>false,
+#   :last_login_at=>1594495792373,
+#   :local_id=>"hMPHt8RyDpOsHi1oH5XaVirSYyq2",
+#   :password_hash=>"REDACTED",
+#   :password_updated_at=>1594132097140,
+#   :provider_user_info=>
+#    [{:email=>"<your_user_email>",
+#      :federated_id=>"<your_user_email>",
+#      :provider_id=>"password",
+#      :raw_id=>"<your_user_email>"}],
+#   :valid_since=>1594132097}]
+```
+
+### update user info
+```ruby
+require 'firebase_token_auth'
+
+FirebaseTokenAuth.configure do |config|
+  config.project_id = 'your_project_id'
+  config.json_key_io = "#{Rails.root}/path/to/service_account_credentials.json"
+end
+
+client = FirebaseTokenAuth.new
+# NOTE: parameter_name is snake_case
+update_params = { # ref. https://firebase.google.com/docs/reference/rest/auth#section-update-profile
+  display_name: 'updated_name',
+}
+result = client.update_user(test_uid, update_params)
+puts result
+# => {:display_name=>"updated_name",
+#  :email=>"<your_user_email>",
+#  :email_verified=>false,
+#  :kind=>"identitytoolkit#SetAccountInfoResponse",
+#  :local_id=>"hMPHt8RyDpOsHi1oH5XaVirSYyq2",
+#  :password_hash=>"REDACTED",
+#  :provider_user_info=>[{:display_name=>"updated_name", :federated_id=>"<your_user_email>", :provider_id=>"password"}]}
+```
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/firebase_token_auth.
+Bug reports and pull requests are welcome on GitHub at https://github.com/miyataka/firebase_token_auth.
 
 
 ## License

data/firebase_token_auth.gemspec

@@ -10,7 +10,7 @@ Gem::Specification.new do |spec|
   spec.description   = 'Firebase Authentication API wrapper for serverside. It support custom token auth. Of course it has id_token verify feature.'
   spec.homepage      = 'https://github.com/miyataka/firebase_token_auth'
   spec.license       = 'MIT'
-  spec.required_ruby_version = Gem::Requirement.new('>= 2.3.0')
+  spec.required_ruby_version = Gem::Requirement.new('>= 2.4.0')
 
   spec.metadata['homepage_uri'] = spec.homepage
   spec.metadata['source_code_uri'] = spec.homepage
@@ -24,6 +24,6 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ['lib']
 
-  spec.add_dependency 'google-api-client'
+  spec.add_dependency 'google-apis-identitytoolkit_v3'
   spec.add_dependency 'jwt'
 end

data/lib/firebase_token_auth.rb

@@ -3,8 +3,6 @@ require 'firebase_token_auth/version'
 require 'firebase_token_auth/configuration'
 require 'firebase_token_auth/client'
 
-require 'pry-byebug'
-
 module FirebaseTokenAuth
   class Error < StandardError; end
 

data/lib/firebase_token_auth/admin_client.rb

@@ -13,5 +13,18 @@ module FirebaseTokenAuth
       request = Google::Apis::IdentitytoolkitV3::GetAccountInfoRequest.new(**params)
       service.get_account_info(request)
     end
+
+    def update_existing_account(uid, attributes)
+      update_params = { local_id: uid }.merge!(permit_attributes(attributes))
+      request = Google::Apis::IdentitytoolkitV3::SetAccountInfoRequest.new(**update_params)
+      service.set_account_info(request)
+    end
+
+    private
+
+      def permit_attributes(attr_hash)
+        permit_keys = %i[disabled display_name email email_verified password phone_number photo_url multi_factor]
+        attr_hash.select { |k, _v| permit_keys.include?(k) }
+      end
   end
 end

data/lib/firebase_token_auth/client.rb

@@ -5,6 +5,7 @@ require 'jwt'
 require 'firebase_token_auth/public_key_manager'
 require 'firebase_token_auth/validator'
 require 'firebase_token_auth/admin_client'
+require 'firebase_token_auth/exceptions'
 
 module FirebaseTokenAuth
   ALGORITHM = 'RS256'.freeze
@@ -25,7 +26,7 @@ module FirebaseTokenAuth
     end
 
     def verify_id_token(id_token, options = {})
-      raise if id_token.nil? || id_token.empty?
+      raise ArgumentError, 'Firebase ID token must not null or blank strings.' if id_token.nil? || id_token.empty?
 
       public_key_id, decoded_jwt = validator.extract_kid(id_token)
       public_key_manager.refresh_publickeys!
@@ -36,8 +37,7 @@ module FirebaseTokenAuth
     end
 
     def create_custom_token(uid, additional_claims = nil)
-      # TODO: implement Error
-      raise unless configuration.configured_for_custom_token?
+      raise ConfigurationError, 'To create custom token, You must configure credentials via json or environmental variables.' unless configuration.configured_for_custom_token?
 
       now_seconds = Time.now.to_i
       payload = { iss: configuration.client_email,
@@ -58,6 +58,10 @@ module FirebaseTokenAuth
       admin_client.get_account_info({ local_id: [uid] })&.users&.map(&:to_h)
     end
 
+    def update_user(uid, attribute_hash)
+      admin_client.update_existing_account(uid, attribute_hash).to_h
+    end
+
     private
 
       def admin_client

data/lib/firebase_token_auth/configuration.rb

@@ -24,8 +24,7 @@ module FirebaseTokenAuth
     end
 
     def prepare
-      # TODO: implement error
-      raise unless project_id
+      raise ConfigurationError, 'project_id is required to use firebase_token_auth gem.' unless project_id
       return unless configured_for_custom_token?
 
       @auth = if json_key_io
@@ -45,7 +44,7 @@ module FirebaseTokenAuth
         @private_key = OpenSSL::PKey::RSA.new(parsed['private_key'])
         @client_email = parsed['client_email']
       else
-        @private_key = OpenSSL::PKey::RSA.new(ENV['GOOGLE_PRIVATE_KEY'])
+        @private_key = OpenSSL::PKey::RSA.new(unescape(ENV['GOOGLE_PRIVATE_KEY']))
         @client_email = ENV['GOOGLE_CLIENT_EMAIL']
       end
     end
@@ -53,5 +52,11 @@ module FirebaseTokenAuth
     def configured_for_custom_token?
       json_key_io || (ENV['GOOGLE_PRIVATE_KEY'] && ENV['GOOGLE_CLIENT_EMAIL'])
     end
+
+    def unescape(str)
+      str = str.gsub('\n', "\n")
+      str = str[1..-2] if str.start_with?('"') && str.end_with?('"')
+      str
+    end
   end
 end

data/lib/firebase_token_auth/exceptions.rb

@@ -0,0 +1,104 @@
+module FirebaseTokenAuth
+  class APIError < StandardError; end
+  class NetworkError < APIError; end
+
+  class HttpError < APIError
+    attr_reader :response
+
+    def initialize(message, response)
+      super(message)
+      @response = response
+    end
+  end
+
+  class ClientError < HttpError; end
+
+  class BadRequest                  < ClientError; end # status: 400
+  class Unauthorized                < ClientError; end # status: 401
+  class PaymentRequired             < ClientError; end # status: 402
+  class Forbidden                   < ClientError; end # status: 403
+  class NotFound                    < ClientError; end # status: 404
+  class MethodNotAllowed            < ClientError; end # status: 405
+  class NotAcceptable               < ClientError; end # status: 406
+  class ProxyAuthenticationRequired < ClientError; end # status: 407
+  class RequestTimeout              < ClientError; end # status: 408
+  class Conflict                    < ClientError; end # status: 409
+  class Gone                        < ClientError; end # status: 410
+  class LengthRequired              < ClientError; end # status: 411
+  class PreconditionFailed          < ClientError; end # status: 412
+  class PayloadTooLarge             < ClientError; end # status: 413
+  class URITooLong                  < ClientError; end # status: 414
+  class UnsupportedMediaType        < ClientError; end # status: 415
+  class RangeNotSatisfiable         < ClientError; end # status: 416
+  class ExpectationFailed           < ClientError; end # status: 417
+  class ImaTeapot                   < ClientError; end # status: 418
+  class MisdirectedRequest          < ClientError; end # status: 421
+  class UnprocessableEntity         < ClientError; end # status: 422
+  class Locked                      < ClientError; end # status: 423
+  class FailedDependency            < ClientError; end # status: 424
+  class UpgradeRequired             < ClientError; end # status: 426
+  class PreconditionRequired        < ClientError; end # status: 428
+  class TooManyRequests             < ClientError; end # status: 429
+  class RequestHeaderFieldsTooLarge < ClientError; end # status: 431
+  class UnavailableForLegalReasons  < ClientError; end # status: 451
+
+  class ServerError < HttpError; end
+
+  class InternalServerError           < ServerError; end # status: 500
+  class NotImplemented                < ServerError; end # status: 501
+  class BadGateway                    < ServerError; end # status: 502
+  class ServiceUnavailable            < ServerError; end # status: 503
+  class GatewayTimeout                < ServerError; end # status: 504
+  class HTTPVersionNotSupported       < ServerError; end # status: 505
+  class VariantAlsoNegotiates         < ServerError; end # status: 506
+  class InsufficientStorage           < ServerError; end # status: 507
+  class LoopDetected                  < ServerError; end # status: 508
+  class NotExtended                   < ServerError; end # status: 510
+  class NetworkAuthenticationRequired < ServerError; end # status: 511
+
+  STATUS_TO_EXCEPTION_MAPPING = {
+    '400' => BadRequest,
+    '401' => Unauthorized,
+    '402' => PaymentRequired,
+    '403' => Forbidden,
+    '404' => NotFound,
+    '405' => MethodNotAllowed,
+    '406' => NotAcceptable,
+    '407' => ProxyAuthenticationRequired,
+    '408' => RequestTimeout,
+    '409' => Conflict,
+    '410' => Gone,
+    '411' => LengthRequired,
+    '412' => PreconditionFailed,
+    '413' => PayloadTooLarge,
+    '414' => URITooLong,
+    '415' => UnsupportedMediaType,
+    '416' => RangeNotSatisfiable,
+    '417' => ExpectationFailed,
+    '418' => ImaTeapot,
+    '421' => MisdirectedRequest,
+    '422' => UnprocessableEntity,
+    '423' => Locked,
+    '424' => FailedDependency,
+    '426' => UpgradeRequired,
+    '428' => PreconditionRequired,
+    '429' => TooManyRequests,
+    '431' => RequestHeaderFieldsTooLarge,
+    '451' => UnavailableForLegalReasons,
+    '500' => InternalServerError,
+    '501' => NotImplemented,
+    '502' => BadGateway,
+    '503' => ServiceUnavailable,
+    '504' => GatewayTimeout,
+    '505' => HTTPVersionNotSupported,
+    '506' => VariantAlsoNegotiates,
+    '507' => InsufficientStorage,
+    '508' => LoopDetected,
+    '510' => NotExtended,
+    '511' => NetworkAuthenticationRequired
+  }.freeze
+
+  class ValidationError < StandardError; end
+  class ConfigurationError < StandardError; end
+  class ArgumentError < StandardError; end
+end

data/lib/firebase_token_auth/public_key_manager.rb

@@ -19,7 +19,7 @@ module FirebaseTokenAuth
     private
 
       def fetch_publickeys_hash
-        res = Net::HTTP.get_response(URI(PUBLIC_KEY_URL))
+        res = exception_handler(Net::HTTP.get_response(URI(PUBLIC_KEY_URL)))
         @public_keys = JSON.parse(res.body).transform_values! { |v| OpenSSL::X509::Certificate.new(v) }
         @expire_time = cache_control_header_to_expire_time(res['Cache-Control'])
       end
@@ -31,5 +31,12 @@ module FirebaseTokenAuth
       def cache_control_header_to_expire_time(cache_control_header)
         Time.now.to_i + cache_control_header.match(/max-age=([0-9]*)/)[1].to_i
       end
+
+      def exception_handler(response)
+        error = STATUS_TO_EXCEPTION_MAPPING[response.code]
+        raise error.new("Receieved an error response #{response.code} #{error.to_s.split('::').last}: #{response.body}", response) if error
+
+        response
+      end
   end
 end

data/lib/firebase_token_auth/validator.rb

@@ -7,13 +7,13 @@ module FirebaseTokenAuth
       payload = decoded_jwt[0]
       header = decoded_jwt[1]
       issuer = ISSUER_BASE_URL + project_id
-      raise unless header['kid']
-      raise unless header['alg'] == ALGORITHM
-      raise unless payload['aud'] == project_id
-      raise unless payload['iss'] == issuer
-      raise unless payload['sub'].is_a?(String)
-      raise if payload['sub'].empty?
-      raise if payload['sub'].size > 128
+      raise ValidationError, 'Firebase ID token has no "kid" claim.' unless header['kid']
+      raise ValidationError, "Firebase ID token has incorrect algorithm. Expected \"#{ALGORITHM}\" but got \"#{header['alg']}\"." unless header['alg'] == ALGORITHM
+      raise ValidationError, "Firebase ID token has incorrect \"aud\" (audience) claim. Expected \"#{project_id}\" but got \"#{payload['aud']}\"." unless payload['aud'] == project_id
+      raise ValidationError, "Firebase ID token has \"iss\" (issuer) claim. Expected \"#{issuer}\" but got \"#{payload['iss']}\"." unless payload['iss'] == issuer
+      raise ValidationError, 'Firebase ID token has no "sub" (subject) claim.' unless payload['sub'].is_a?(String)
+      raise ValidationError, 'Firebase ID token has an empty string "sub" (subject) claim.' if payload['sub'].empty?
+      raise ValidationError, 'Firebase ID token has "sub" (subject) claim longer than 128 characters.' if payload['sub'].size > 128
     end
 
     def extract_kid(id_token)

data/lib/firebase_token_auth/version.rb

@@ -1,3 +1,3 @@
 module FirebaseTokenAuth
-  VERSION = '0.1.0'.freeze
+  VERSION = '1.2.1'.freeze
 end

metadata

@@ -1,17 +1,17 @@
 --- !ruby/object:Gem::Specification
 name: firebase_token_auth
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 1.2.1
 platform: ruby
 authors:
 - miyataka
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2020-07-08 00:00:00.000000000 Z
+date: 2021-02-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: google-api-client
+  name: google-apis-identitytoolkit_v3
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -46,6 +46,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/workflows/test.yml"
 - ".gitignore"
 - ".rspec"
 - ".rubocop.yml"
@@ -61,6 +62,7 @@ files:
 - lib/firebase_token_auth/admin_client.rb
 - lib/firebase_token_auth/client.rb
 - lib/firebase_token_auth/configuration.rb
+- lib/firebase_token_auth/exceptions.rb
 - lib/firebase_token_auth/public_key_manager.rb
 - lib/firebase_token_auth/validator.rb
 - lib/firebase_token_auth/version.rb
@@ -78,14 +80,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.3.0
+      version: 2.4.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
+rubygems_version: 3.0.3
 signing_key:
 specification_version: 4
 summary: Firebase Authentication API wrapper for serverside. It support custom token