@aglyn/shared-util-fbserver 1.0.0-beta.149 → 1.0.0-beta.151

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/shared-util-fbserver",
-  "version": "1.0.0-beta.149",
+  "version": "1.0.0-beta.151",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {

package/src/lib/fbserver.d.ts

@@ -26,6 +26,16 @@ export declare let fbAdminApp: App;
  * Firebase's own round trip here is the honest price of a door that cannot
  * reach the cheap check. It has no callers today, so the price is zero and
  * the next caller inherits the strict behaviour rather than the loose one.
+ *
+ * ⛔ IT IS STRICT, NOT CORRECT, FOR AN SSO ACCOUNT (AGL-3229). Firebase's
+ * `checkRevoked` answers itself with `getUser(sub)` on the handle that
+ * verified the token — here the project pool, where a GCIP tenant uid does
+ * not exist. It throws `auth/user-not-found`, which reads as a bad
+ * credential, so this refuses every SSO user rather than checking them. The
+ * console's own handle routes the lookup to the pool the token names; this
+ * one cannot, which is why it still has no callers. A door that must admit
+ * SSO accounts belongs behind `firebaseAdmin.app().auth()`, above this
+ * boundary.
  */
 export declare function verifyIdToken(idToken: string): Promise<import("firebase-admin/auth").DecodedIdToken>;
 /**

package/src/lib/fbserver.js

@@ -53,6 +53,16 @@ export let fbAdminApp;
  * Firebase's own round trip here is the honest price of a door that cannot
  * reach the cheap check. It has no callers today, so the price is zero and
  * the next caller inherits the strict behaviour rather than the loose one.
+ *
+ * ⛔ IT IS STRICT, NOT CORRECT, FOR AN SSO ACCOUNT (AGL-3229). Firebase's
+ * `checkRevoked` answers itself with `getUser(sub)` on the handle that
+ * verified the token — here the project pool, where a GCIP tenant uid does
+ * not exist. It throws `auth/user-not-found`, which reads as a bad
+ * credential, so this refuses every SSO user rather than checking them. The
+ * console's own handle routes the lookup to the pool the token names; this
+ * one cannot, which is why it still has no callers. A door that must admit
+ * SSO accounts belongs behind `firebaseAdmin.app().auth()`, above this
+ * boundary.
  */ export function verifyIdToken(idToken) {
     return getAuth(fbAdminApp).verifyIdToken(idToken, true);
 }

package/src/lib/fbserver.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/shared/util/fbserver/src/lib/fbserver.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2022 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { cert, getApp, getApps, initializeApp, type App } from 'firebase-admin/app'\nimport { getAuth } from 'firebase-admin/auth'\nimport { FieldValue, Timestamp, getFirestore } from 'firebase-admin/firestore'\n\nexport let fbAdminApp: App\n\n/**\n * @ignore - default module loading invokes\n *\n * Initializes the firebase-admin default app on import. Guarded on the\n * FULL credential (`FIREBASE_PRIVATE_KEY` + `NEXT_PUBLIC_FIREBASE_PROJECT_ID`):\n * every runtime environment sets both, so init runs exactly as before there —\n * but a BUILD with partial credentials previously crashed at module load\n * (App Router page-data collection evaluates route modules; the workspace\n * root `.env` supplies the private key but not the NEXT_PUBLIC project id,\n * so `cert()` threw \"must contain a string project_id\"), taking the whole\n * build down. Skipping init when any piece is absent lets the module load\n * cleanly at build time (firebase-admin is never actually invoked during\n * collection) while leaving runtime behavior untouched.\n */\n;(function main(): void {\n  if (getApps().length) {\n    fbAdminApp = getApp()\n    return\n  }\n  const privateKey = process.env.FIREBASE_PRIVATE_KEY\n  const projectId = process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID\n  // ALL THREE, because `cert()` requires all three (AGL-1152). This guard\n  // checked two of them and let a missing `FIREBASE_CLIENT_EMAIL` through to\n  // throw \"must contain a string client_email\" at module load — the very\n  // partial-credential crash the comment above describes, from the one field\n  // it forgot to name. Nine tenant suites failed to load on it.\n  const clientEmail = process.env.FIREBASE_CLIENT_EMAIL\n  if (!privateKey || !projectId || !clientEmail) return\n  fbAdminApp = initializeApp({\n    projectId: process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID,\n    databaseURL: process.env.NEXT_PUBLIC_FIREBASE_DATABASE_URL,\n    serviceAccountId: clientEmail,\n    credential: cert({\n      projectId,\n      clientEmail,\n      // https://stackoverflow.com/a/41044630/1332513\n      privateKey: privateKey.replace(/\\\\n/g, '\\n'),\n    }),\n  })\n})()\n\n/**\n * `checkRevoked: true`, unconditionally (AGL-1881).\n *\n * This helper sits BELOW the nx boundary that holds the console's cached\n * revocation check, so it cannot share it — and it is a bare `verifyIdToken`\n * exported from a shared lib, which is the exact shape that spread the\n * problem in the first place: 172 of 175 call sites had the flag off. Paying\n * Firebase's own round trip here is the honest price of a door that cannot\n * reach the cheap check. It has no callers today, so the price is zero and\n * the next caller inherits the strict behaviour rather than the loose one.\n */\nexport function verifyIdToken(idToken: string) {\n  return getAuth(fbAdminApp).verifyIdToken(idToken, true)\n}\n\n/**\n * Optional Firestore database override (AGL-1490). Unset — the default in\n * every environment today — targets the `(default)` database exactly as\n * before. Set, it points every Admin-SDK Firestore accessor at the named\n * database (e.g. one created by `gcloud firestore databases restore` during\n * disaster recovery, see docs/DISASTER_RECOVERY.md) by configuration instead\n * of a code change. Read at call time, not module load, so a process\n * restarted with new env — and a spec toggling `process.env` — sees the\n * current value. An empty string is normalized to undefined so the SDK's own\n * `(default)` fallback applies.\n */\nexport function firestoreDatabaseId(): string | undefined {\n  return process.env.FIRESTORE_DATABASE_ID || undefined\n}\n\n/**\n * Compatibility facade replacing firebase-admin v14's removed namespace API\n * (`import * as admin from 'firebase-admin'`) so existing call sites\n * (`fbAdmin.firestore()`, `fbAdmin.firestore.Timestamp`, `fbAdmin.auth()`)\n * keep working unchanged, backed internally by the modular SDK.\n */\nfunction firestoreNamespace(app?: App) {\n  // `getFirestore(app, undefined)` resolves to the `(default)` database —\n  // the SDK falls back via `databaseId || DEFAULT_DATABASE_ID` — so behavior\n  // with FIRESTORE_DATABASE_ID unset is identical to `getFirestore(app)`.\n  return getFirestore(app ?? fbAdminApp, firestoreDatabaseId())\n}\nfirestoreNamespace.FieldValue = FieldValue\nfirestoreNamespace.Timestamp = Timestamp\n\nconst fbAdmin = {\n  firestore: firestoreNamespace,\n  auth: (app?: App) => getAuth(app ?? fbAdminApp),\n}\n\nexport { fbAdmin }\nexport default fbAdmin\n"],"names":["cert","getApp","getApps","initializeApp","getAuth","FieldValue","Timestamp","getFirestore","fbAdminApp","main","length","privateKey","process","env","FIREBASE_PRIVATE_KEY","projectId","NEXT_PUBLIC_FIREBASE_PROJECT_ID","clientEmail","FIREBASE_CLIENT_EMAIL","databaseURL","NEXT_PUBLIC_FIREBASE_DATABASE_URL","serviceAccountId","credential","replace","verifyIdToken","idToken","firestoreDatabaseId","FIRESTORE_DATABASE_ID","undefined","firestoreNamespace","app","fbAdmin","firestore","auth"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,IAAI,EAAEC,MAAM,EAAEC,OAAO,EAAEC,aAAa,QAAkB,qBAAoB;AACnF,SAASC,OAAO,QAAQ,sBAAqB;AAC7C,SAASC,UAAU,EAAEC,SAAS,EAAEC,YAAY,QAAQ,2BAA0B;AAE9E,OAAO,IAAIC,WAgBV;AAAC,CAAA,SAASC;IACT,IAAIP,UAAUQ,MAAM,EAAE;QACpBF,aAAaP;QACb;IACF;IACA,MAAMU,aAAaC,QAAQC,GAAG,CAACC,oBAAoB;IACnD,MAAMC,YAAYH,QAAQC,GAAG,CAACG,+BAA+B;IAC7D,wEAAwE;IACxE,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAMC,cAAcL,QAAQC,GAAG,CAACK,qBAAqB;IACrD,IAAI,CAACP,cAAc,CAACI,aAAa,CAACE,aAAa;IAC/CT,aAAaL,cAAc;QACzBY,WAAWH,QAAQC,GAAG,CAACG,+BAA+B;QACtDG,aAAaP,QAAQC,GAAG,CAACO,iCAAiC;QAC1DC,kBAAkBJ;QAClBK,YAAYtB,KAAK;YACfe;YACAE;YACA,+CAA+C;YAC/CN,YAAYA,WAAWY,OAAO,CAAC,QAAQ;QACzC;IACF;AACF,CAAA;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASC,cAAcC,OAAe;IAC3C,OAAOrB,QAAQI,YAAYgB,aAAa,CAACC,SAAS;AACpD;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASC;IACd,OAAOd,QAAQC,GAAG,CAACc,qBAAqB,IAAIC;AAC9C;AAEA;;;;;CAKC,GACD,SAASC,mBAAmBC,GAAS;IACnC,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,OAAOvB,aAAauB,cAAAA,MAAOtB,YAAYkB;AACzC;AACAG,mBAAmBxB,UAAU,GAAGA;AAChCwB,mBAAmBvB,SAAS,GAAGA;AAE/B,MAAMyB,UAAU;IACdC,WAAWH;IACXI,MAAM,CAACH,MAAc1B,QAAQ0B,cAAAA,MAAOtB;AACtC;AAEA,SAASuB,OAAO,GAAE;AAClB,eAAeA,QAAO"}
+{"version":3,"sources":["../../../../../../../libs/shared/util/fbserver/src/lib/fbserver.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2022 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { cert, getApp, getApps, initializeApp, type App } from 'firebase-admin/app'\nimport { getAuth } from 'firebase-admin/auth'\nimport { FieldValue, Timestamp, getFirestore } from 'firebase-admin/firestore'\n\nexport let fbAdminApp: App\n\n/**\n * @ignore - default module loading invokes\n *\n * Initializes the firebase-admin default app on import. Guarded on the\n * FULL credential (`FIREBASE_PRIVATE_KEY` + `NEXT_PUBLIC_FIREBASE_PROJECT_ID`):\n * every runtime environment sets both, so init runs exactly as before there —\n * but a BUILD with partial credentials previously crashed at module load\n * (App Router page-data collection evaluates route modules; the workspace\n * root `.env` supplies the private key but not the NEXT_PUBLIC project id,\n * so `cert()` threw \"must contain a string project_id\"), taking the whole\n * build down. Skipping init when any piece is absent lets the module load\n * cleanly at build time (firebase-admin is never actually invoked during\n * collection) while leaving runtime behavior untouched.\n */\n;(function main(): void {\n  if (getApps().length) {\n    fbAdminApp = getApp()\n    return\n  }\n  const privateKey = process.env.FIREBASE_PRIVATE_KEY\n  const projectId = process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID\n  // ALL THREE, because `cert()` requires all three (AGL-1152). This guard\n  // checked two of them and let a missing `FIREBASE_CLIENT_EMAIL` through to\n  // throw \"must contain a string client_email\" at module load — the very\n  // partial-credential crash the comment above describes, from the one field\n  // it forgot to name. Nine tenant suites failed to load on it.\n  const clientEmail = process.env.FIREBASE_CLIENT_EMAIL\n  if (!privateKey || !projectId || !clientEmail) return\n  fbAdminApp = initializeApp({\n    projectId: process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID,\n    databaseURL: process.env.NEXT_PUBLIC_FIREBASE_DATABASE_URL,\n    serviceAccountId: clientEmail,\n    credential: cert({\n      projectId,\n      clientEmail,\n      // https://stackoverflow.com/a/41044630/1332513\n      privateKey: privateKey.replace(/\\\\n/g, '\\n'),\n    }),\n  })\n})()\n\n/**\n * `checkRevoked: true`, unconditionally (AGL-1881).\n *\n * This helper sits BELOW the nx boundary that holds the console's cached\n * revocation check, so it cannot share it — and it is a bare `verifyIdToken`\n * exported from a shared lib, which is the exact shape that spread the\n * problem in the first place: 172 of 175 call sites had the flag off. Paying\n * Firebase's own round trip here is the honest price of a door that cannot\n * reach the cheap check. It has no callers today, so the price is zero and\n * the next caller inherits the strict behaviour rather than the loose one.\n *\n * ⛔ IT IS STRICT, NOT CORRECT, FOR AN SSO ACCOUNT (AGL-3229). Firebase's\n * `checkRevoked` answers itself with `getUser(sub)` on the handle that\n * verified the token — here the project pool, where a GCIP tenant uid does\n * not exist. It throws `auth/user-not-found`, which reads as a bad\n * credential, so this refuses every SSO user rather than checking them. The\n * console's own handle routes the lookup to the pool the token names; this\n * one cannot, which is why it still has no callers. A door that must admit\n * SSO accounts belongs behind `firebaseAdmin.app().auth()`, above this\n * boundary.\n */\nexport function verifyIdToken(idToken: string) {\n  return getAuth(fbAdminApp).verifyIdToken(idToken, true)\n}\n\n/**\n * Optional Firestore database override (AGL-1490). Unset — the default in\n * every environment today — targets the `(default)` database exactly as\n * before. Set, it points every Admin-SDK Firestore accessor at the named\n * database (e.g. one created by `gcloud firestore databases restore` during\n * disaster recovery, see docs/DISASTER_RECOVERY.md) by configuration instead\n * of a code change. Read at call time, not module load, so a process\n * restarted with new env — and a spec toggling `process.env` — sees the\n * current value. An empty string is normalized to undefined so the SDK's own\n * `(default)` fallback applies.\n */\nexport function firestoreDatabaseId(): string | undefined {\n  return process.env.FIRESTORE_DATABASE_ID || undefined\n}\n\n/**\n * Compatibility facade replacing firebase-admin v14's removed namespace API\n * (`import * as admin from 'firebase-admin'`) so existing call sites\n * (`fbAdmin.firestore()`, `fbAdmin.firestore.Timestamp`, `fbAdmin.auth()`)\n * keep working unchanged, backed internally by the modular SDK.\n */\nfunction firestoreNamespace(app?: App) {\n  // `getFirestore(app, undefined)` resolves to the `(default)` database —\n  // the SDK falls back via `databaseId || DEFAULT_DATABASE_ID` — so behavior\n  // with FIRESTORE_DATABASE_ID unset is identical to `getFirestore(app)`.\n  return getFirestore(app ?? fbAdminApp, firestoreDatabaseId())\n}\nfirestoreNamespace.FieldValue = FieldValue\nfirestoreNamespace.Timestamp = Timestamp\n\nconst fbAdmin = {\n  firestore: firestoreNamespace,\n  auth: (app?: App) => getAuth(app ?? fbAdminApp),\n}\n\nexport { fbAdmin }\nexport default fbAdmin\n"],"names":["cert","getApp","getApps","initializeApp","getAuth","FieldValue","Timestamp","getFirestore","fbAdminApp","main","length","privateKey","process","env","FIREBASE_PRIVATE_KEY","projectId","NEXT_PUBLIC_FIREBASE_PROJECT_ID","clientEmail","FIREBASE_CLIENT_EMAIL","databaseURL","NEXT_PUBLIC_FIREBASE_DATABASE_URL","serviceAccountId","credential","replace","verifyIdToken","idToken","firestoreDatabaseId","FIRESTORE_DATABASE_ID","undefined","firestoreNamespace","app","fbAdmin","firestore","auth"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,IAAI,EAAEC,MAAM,EAAEC,OAAO,EAAEC,aAAa,QAAkB,qBAAoB;AACnF,SAASC,OAAO,QAAQ,sBAAqB;AAC7C,SAASC,UAAU,EAAEC,SAAS,EAAEC,YAAY,QAAQ,2BAA0B;AAE9E,OAAO,IAAIC,WAgBV;AAAC,CAAA,SAASC;IACT,IAAIP,UAAUQ,MAAM,EAAE;QACpBF,aAAaP;QACb;IACF;IACA,MAAMU,aAAaC,QAAQC,GAAG,CAACC,oBAAoB;IACnD,MAAMC,YAAYH,QAAQC,GAAG,CAACG,+BAA+B;IAC7D,wEAAwE;IACxE,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAMC,cAAcL,QAAQC,GAAG,CAACK,qBAAqB;IACrD,IAAI,CAACP,cAAc,CAACI,aAAa,CAACE,aAAa;IAC/CT,aAAaL,cAAc;QACzBY,WAAWH,QAAQC,GAAG,CAACG,+BAA+B;QACtDG,aAAaP,QAAQC,GAAG,CAACO,iCAAiC;QAC1DC,kBAAkBJ;QAClBK,YAAYtB,KAAK;YACfe;YACAE;YACA,+CAA+C;YAC/CN,YAAYA,WAAWY,OAAO,CAAC,QAAQ;QACzC;IACF;AACF,CAAA;AAEA;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,OAAO,SAASC,cAAcC,OAAe;IAC3C,OAAOrB,QAAQI,YAAYgB,aAAa,CAACC,SAAS;AACpD;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASC;IACd,OAAOd,QAAQC,GAAG,CAACc,qBAAqB,IAAIC;AAC9C;AAEA;;;;;CAKC,GACD,SAASC,mBAAmBC,GAAS;IACnC,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,OAAOvB,aAAauB,cAAAA,MAAOtB,YAAYkB;AACzC;AACAG,mBAAmBxB,UAAU,GAAGA;AAChCwB,mBAAmBvB,SAAS,GAAGA;AAE/B,MAAMyB,UAAU;IACdC,WAAWH;IACXI,MAAM,CAACH,MAAc1B,QAAQ0B,cAAAA,MAAOtB;AACtC;AAEA,SAASuB,OAAO,GAAE;AAClB,eAAeA,QAAO"}