@exposify/firebase 0.0.1 → 0.0.2

package/README.md

@@ -70,7 +70,11 @@ broker as the authorization server, and the client sends the user through
 sign-in. Tool calls then reach Firestore with the `Authorization` the broker
 resolves for that user, never the broker token itself, so your rules still
 decide. Requests without a connection are refused rather
-than run anonymously; pass `authRequired: false` to allow them.
+than run anonymously; pass `authRequired: false` to allow them. The
+exception: when the project has no sign-in method yet (add the Firebase
+preset in the dashboard), agents use the function signed out, as the
+anonymous user, with no sign-in asked. The startup log says which it is
+(`[agentready] How agents sign in: ...`).
 
 `auth: hostedBroker()` does the same explicitly. If the function is
 reached through a URL other than the one it sees (a custom domain or a

package/dist/index.cjs

@@ -807,13 +807,19 @@ function createFirebaseMcpHandler(options = {}) {
   if (!auth) return core;
   const brokerGate = authRequired ? (0, import_core2.createBrokerGate)(auth) : null;
   return async (req) => {
+    let open = false;
     if (brokerGate) {
       const own = (0, import_core2.publicRequestUrl)(req.url, req.headers);
       const isPrm = own.endsWith(import_core2.PRM_PATH);
       const resource = brokerGate.resourceFor(functionPublicUrl(isPrm ? own.slice(0, -import_core2.PRM_PATH.length) : own, functionName));
-      if (isPrm) return brokerGate.metadataResponse(req.method, resource);
-      const result = await brokerGate.check(req.headers, resource, `${resource}${import_core2.PRM_PATH}`);
-      if (!result.ok) return result.response;
+      open = await (0, import_core2.reportAppLogin)(auth, resource, null, { stacks: ["firebase-admin"], why: "Firebase Auth sign-in for agents is the Firebase preset in the dashboard's sign-in methods.", log: logReady }) === "open";
+      if (open) {
+        if (isPrm) return new Response("not found", { status: 404 });
+      } else {
+        if (isPrm) return brokerGate.metadataResponse(req.method, resource);
+        const result = await brokerGate.check(req.headers, resource, `${resource}${import_core2.PRM_PATH}`);
+        if (!result.ok) return result.response;
+      }
     }
     let resolved;
     try {
@@ -822,7 +828,7 @@ function createFirebaseMcpHandler(options = {}) {
       console.error(`${LOG_PREFIX} auth resolver failed`, err);
       return Response.json({ error: "internal MCP server error" }, { status: 503 });
     }
-    if (authRequired && !resolved.get("authorization")) {
+    if (authRequired && !open && !resolved.get("authorization")) {
       return Response.json({ error: "unauthorized" }, { status: 401, headers: { "www-authenticate": "Bearer" } });
     }
     resolvedAuth.set(req, resolved);

package/dist/index.js

@@ -10,6 +10,7 @@ import {
   KnowledgeBase,
   PRM_PATH,
   publicRequestUrl,
+  reportAppLogin,
   startupLogEnabled
 } from "@exposify/core";
 import { loadDocsFromFs } from "@exposify/core/node";
@@ -786,13 +787,19 @@ function createFirebaseMcpHandler(options = {}) {
   if (!auth) return core;
   const brokerGate = authRequired ? createBrokerGate(auth) : null;
   return async (req) => {
+    let open = false;
     if (brokerGate) {
       const own = publicRequestUrl(req.url, req.headers);
       const isPrm = own.endsWith(PRM_PATH);
       const resource = brokerGate.resourceFor(functionPublicUrl(isPrm ? own.slice(0, -PRM_PATH.length) : own, functionName));
-      if (isPrm) return brokerGate.metadataResponse(req.method, resource);
-      const result = await brokerGate.check(req.headers, resource, `${resource}${PRM_PATH}`);
-      if (!result.ok) return result.response;
+      open = await reportAppLogin(auth, resource, null, { stacks: ["firebase-admin"], why: "Firebase Auth sign-in for agents is the Firebase preset in the dashboard's sign-in methods.", log: logReady }) === "open";
+      if (open) {
+        if (isPrm) return new Response("not found", { status: 404 });
+      } else {
+        if (isPrm) return brokerGate.metadataResponse(req.method, resource);
+        const result = await brokerGate.check(req.headers, resource, `${resource}${PRM_PATH}`);
+        if (!result.ok) return result.response;
+      }
     }
     let resolved;
     try {
@@ -801,7 +808,7 @@ function createFirebaseMcpHandler(options = {}) {
       console.error(`${LOG_PREFIX} auth resolver failed`, err);
       return Response.json({ error: "internal MCP server error" }, { status: 503 });
     }
-    if (authRequired && !resolved.get("authorization")) {
+    if (authRequired && !open && !resolved.get("authorization")) {
       return Response.json({ error: "unauthorized" }, { status: 401, headers: { "www-authenticate": "Bearer" } });
     }
     resolvedAuth.set(req, resolved);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/firebase",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "license": "MIT",
   "engines": {
     "node": ">=20.19"
@@ -29,7 +29,7 @@
     "prepack": "yarn build"
   },
   "dependencies": {
-    "@exposify/core": "0.3.13",
+    "@exposify/core": "0.3.14",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "zod": "^3.24.0"
   },