@fireemu/darwin-arm64 0.16.0 → 0.17.0

package/README.md

@@ -1,7 +1,7 @@
 # @fireemu/darwin-arm64
 
 The [fireemu](https://www.npmjs.com/package/fireemu) daemon built for `darwin-arm64`
-(Rust target `aarch64-apple-darwin`), version 0.16.0.
+(Rust target `aarch64-apple-darwin`), version 0.17.0.
 
 macOS 13 or newer on Apple silicon.
 

package/bin/runner-node/app-check-token.mjs

@@ -0,0 +1,53 @@
+// Withholding an App Check token from a callable that could consume it (specification 13.4).
+//
+// Without the trusted protocol the runner has no `skipTokenVerification`, so the installed
+// onCall wrapper hands a presented `X-Firebase-AppCheck` to the Admin SDK's `verifyToken`, and
+// with `consumeAppCheckToken: true` that call consumes the token against the production App
+// Check API. The daemon's proxy already removes the field for such callables, but a request can
+// reach this runner on other paths too: a task dispatched to a queue a configured manifest named
+// after the callable, for one. So the runner applies the same rule at the one point every path
+// shares, using its own discovery of what the export is, whatever trigger type the daemon
+// assigned to the name.
+
+const APP_CHECK_HEADER = "x-firebase-appcheck";
+const TRUSTED_DEBUG_FEATURE = "skipTokenVerification";
+
+/// Whether the trusted protocol is active: the daemon turns `skipTokenVerification` on (with
+/// `FIREBASE_DEBUG_MODE`) only when it verifies App Check itself.
+export function tokenVerificationSkipped(env) {
+  if (env.FIREBASE_DEBUG_MODE !== "true") return false;
+  let features;
+  try {
+    features = JSON.parse(env.FIREBASE_DEBUG_FEATURES ?? "{}");
+  } catch {
+    return false;
+  }
+  return features?.[TRUSTED_DEBUG_FEATURE] === true;
+}
+
+/// Whether a request to the export behind `spec` (this runner's own discovery) must not carry
+/// an App Check token: a callable whose `consumeAppCheckToken` is not known to be off, while
+/// App Check is off.
+export function withholdsAppCheckToken(spec, env) {
+  const trigger = spec?.trigger;
+  const mayConsume =
+    trigger?.type === "http" &&
+    trigger.callable === true &&
+    trigger.consumeAppCheckToken !== "disabled";
+  return mayConsume && !tokenVerificationSkipped(env);
+}
+
+/// Removes every `X-Firebase-AppCheck` field from a Node request, from both `headers` and
+/// `rawHeaders`.
+export function removeAppCheckToken(req) {
+  delete req.headers[APP_CHECK_HEADER];
+  if (Array.isArray(req.rawHeaders)) {
+    const kept = [];
+    for (let i = 0; i + 1 < req.rawHeaders.length; i += 2) {
+      if (String(req.rawHeaders[i]).toLowerCase() !== APP_CHECK_HEADER) {
+        kept.push(req.rawHeaders[i], req.rawHeaders[i + 1]);
+      }
+    }
+    req.rawHeaders = kept;
+  }
+}

package/bin/runner-node/index.mjs

@@ -19,6 +19,7 @@ import { createRuntimeClock } from "./clock.mjs";
 import { execFileSync, spawn } from "node:child_process";
 import { url as inspectorUrl } from "node:inspector";
 import { instrumentCallables } from "./callable-app-check.mjs";
+import { removeAppCheckToken, withholdsAppCheckToken } from "./app-check-token.mjs";
 import { blockingFailure } from "./blocking-error.mjs";
 import { blockingEvent, loadIdentityParsers, portedIdentityParsers } from "./blocking-event.mjs";
 import { blockingResult } from "./blocking-response.mjs";
@@ -1320,6 +1321,9 @@ async function makeHttpServer(functions, manifest) {
         .send(`no HTTP function ${req.params.project}/${req.params.region}/${req.params.name}`);
       return;
     }
+    // Without App Check a callable that could consume a token never sees one, whichever path
+    // the request took here (spec 13.4; app-check-token.mjs).
+    if (withholdsAppCheckToken(spec, process.env)) removeAppCheckToken(req);
     // The function sees the path relative to its mount point: drop the three route segments.
     const original = req.url;
     const queryAt = original.indexOf("?");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fireemu/darwin-arm64",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "The fireemu daemon for darwin-arm64",
   "homepage": "https://github.com/t-k/fireemu#readme",
   "repository": {