@fireemu/linux-x64 0.15.0 → 0.17.0

package/README.md

@@ -1,7 +1,7 @@
 # @fireemu/linux-x64
 
 The [fireemu](https://www.npmjs.com/package/fireemu) daemon built for `linux-x64`
-(Rust target `x86_64-unknown-linux-musl`), version 0.15.0.
+(Rust target `x86_64-unknown-linux-musl`), version 0.17.0.
 
 Statically linked against musl: any glibc or musl distribution, including distroless and Alpine.
 

package/bin/runner-node/app-check-token.mjs

@@ -0,0 +1,53 @@
+// Withholding an App Check token from a callable that could consume it (specification 13.4).
+//
+// Without the trusted protocol the runner has no `skipTokenVerification`, so the installed
+// onCall wrapper hands a presented `X-Firebase-AppCheck` to the Admin SDK's `verifyToken`, and
+// with `consumeAppCheckToken: true` that call consumes the token against the production App
+// Check API. The daemon's proxy already removes the field for such callables, but a request can
+// reach this runner on other paths too: a task dispatched to a queue a configured manifest named
+// after the callable, for one. So the runner applies the same rule at the one point every path
+// shares, using its own discovery of what the export is, whatever trigger type the daemon
+// assigned to the name.
+
+const APP_CHECK_HEADER = "x-firebase-appcheck";
+const TRUSTED_DEBUG_FEATURE = "skipTokenVerification";
+
+/// Whether the trusted protocol is active: the daemon turns `skipTokenVerification` on (with
+/// `FIREBASE_DEBUG_MODE`) only when it verifies App Check itself.
+export function tokenVerificationSkipped(env) {
+  if (env.FIREBASE_DEBUG_MODE !== "true") return false;
+  let features;
+  try {
+    features = JSON.parse(env.FIREBASE_DEBUG_FEATURES ?? "{}");
+  } catch {
+    return false;
+  }
+  return features?.[TRUSTED_DEBUG_FEATURE] === true;
+}
+
+/// Whether a request to the export behind `spec` (this runner's own discovery) must not carry
+/// an App Check token: a callable whose `consumeAppCheckToken` is not known to be off, while
+/// App Check is off.
+export function withholdsAppCheckToken(spec, env) {
+  const trigger = spec?.trigger;
+  const mayConsume =
+    trigger?.type === "http" &&
+    trigger.callable === true &&
+    trigger.consumeAppCheckToken !== "disabled";
+  return mayConsume && !tokenVerificationSkipped(env);
+}
+
+/// Removes every `X-Firebase-AppCheck` field from a Node request, from both `headers` and
+/// `rawHeaders`.
+export function removeAppCheckToken(req) {
+  delete req.headers[APP_CHECK_HEADER];
+  if (Array.isArray(req.rawHeaders)) {
+    const kept = [];
+    for (let i = 0; i + 1 < req.rawHeaders.length; i += 2) {
+      if (String(req.rawHeaders[i]).toLowerCase() !== APP_CHECK_HEADER) {
+        kept.push(req.rawHeaders[i], req.rawHeaders[i + 1]);
+      }
+    }
+    req.rawHeaders = kept;
+  }
+}

package/bin/runner-node/index.mjs

@@ -19,6 +19,7 @@ import { createRuntimeClock } from "./clock.mjs";
 import { execFileSync, spawn } from "node:child_process";
 import { url as inspectorUrl } from "node:inspector";
 import { instrumentCallables } from "./callable-app-check.mjs";
+import { removeAppCheckToken, withholdsAppCheckToken } from "./app-check-token.mjs";
 import { blockingFailure } from "./blocking-error.mjs";
 import { blockingEvent, loadIdentityParsers, portedIdentityParsers } from "./blocking-event.mjs";
 import { blockingResult } from "./blocking-response.mjs";
@@ -1320,6 +1321,9 @@ async function makeHttpServer(functions, manifest) {
         .send(`no HTTP function ${req.params.project}/${req.params.region}/${req.params.name}`);
       return;
     }
+    // Without App Check a callable that could consume a token never sees one, whichever path
+    // the request took here (spec 13.4; app-check-token.mjs).
+    if (withholdsAppCheckToken(spec, process.env)) removeAppCheckToken(req);
     // The function sees the path relative to its mount point: drop the three route segments.
     const original = req.url;
     const queryAt = original.indexOf("?");
@@ -1508,11 +1512,22 @@ async function invoke(functions, manifest, msg) {
           await fn({ ...msg.event, data: storageObjectInRecordedOrder(msg.event.data) });
           return;
         case "pubsub":
-        // A custom event reaches the handler as the CloudEvent itself, exactly as the official
-        // Eventarc emulator POSTs it to the functions emulator.
-        case "eventarc":
           await fn(msg.event);
           return;
+        case "eventarc": {
+          // Eventarc Standard delivers binary CloudEvents. The production JSON body parser
+          // admits objects and arrays before invoking the function; the emulator sends a
+          // structured envelope instead. Strict conversion omits datacontenttype for JSON.
+          const contentType = msg.event.datacontenttype;
+          const jsonBody = contentType === undefined ||
+            (typeof contentType === "string" && /^application\/json(?:\s*;|$)/i.test(contentType.trim()));
+          if (strictProfile() && jsonBody && Object.hasOwn(msg.event, "data") &&
+              (msg.event.data === null || typeof msg.event.data !== "object")) {
+            throw new SyntaxError("Eventarc binary JSON body must be an object or array");
+          }
+          await fn(msg.event);
+          return;
+        }
         case "auth":
           throw new Error("Auth user events are delivered to v1 auth.user() handlers only");
         default:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fireemu/linux-x64",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "The fireemu daemon for linux-x64",
   "homepage": "https://github.com/t-k/fireemu#readme",
   "repository": {