firebase-admin 10.1.0 → 11.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/lib/app/core.d.ts +1 -1
- package/lib/app/core.js +1 -1
- package/lib/app/credential-factory.d.ts +1 -1
- package/lib/app/credential-factory.js +8 -8
- package/lib/app/credential-internal.d.ts +3 -1
- package/lib/app/credential-internal.js +103 -95
- package/lib/app/credential.d.ts +1 -1
- package/lib/app/credential.js +1 -1
- package/lib/app/firebase-app.d.ts +1 -1
- package/lib/app/firebase-app.js +76 -91
- package/lib/app/firebase-namespace.d.ts +1 -1
- package/lib/app/firebase-namespace.js +209 -279
- package/lib/app/index.d.ts +1 -1
- package/lib/app/index.js +4 -4
- package/lib/app/lifecycle.d.ts +1 -1
- package/lib/app/lifecycle.js +37 -43
- package/lib/app-check/app-check-api-client-internal.d.ts +1 -1
- package/lib/app-check/app-check-api-client-internal.js +54 -73
- package/lib/app-check/app-check-api.d.ts +1 -1
- package/lib/app-check/app-check-api.js +1 -1
- package/lib/app-check/app-check-namespace.d.ts +1 -1
- package/lib/app-check/app-check-namespace.js +1 -1
- package/lib/app-check/app-check.d.ts +1 -1
- package/lib/app-check/app-check.js +17 -19
- package/lib/app-check/index.d.ts +1 -1
- package/lib/app-check/index.js +7 -7
- package/lib/app-check/token-generator.d.ts +1 -1
- package/lib/app-check/token-generator.js +47 -52
- package/lib/app-check/token-verifier.d.ts +1 -1
- package/lib/app-check/token-verifier.js +46 -50
- package/lib/auth/action-code-settings-builder.d.ts +1 -1
- package/lib/auth/action-code-settings-builder.js +10 -11
- package/lib/auth/auth-api-request.d.ts +1 -1
- package/lib/auth/auth-api-request.js +355 -382
- package/lib/auth/auth-config.d.ts +1 -1
- package/lib/auth/auth-config.js +95 -106
- package/lib/auth/auth-namespace.d.ts +1 -1
- package/lib/auth/auth-namespace.js +1 -1
- package/lib/auth/auth.d.ts +1 -1
- package/lib/auth/auth.js +20 -40
- package/lib/auth/base-auth.d.ts +26 -1
- package/lib/auth/base-auth.js +162 -142
- package/lib/auth/identifier.d.ts +1 -1
- package/lib/auth/identifier.js +2 -2
- package/lib/auth/index.d.ts +1 -1
- package/lib/auth/index.js +7 -7
- package/lib/auth/tenant-manager.d.ts +1 -1
- package/lib/auth/tenant-manager.js +49 -71
- package/lib/auth/tenant.d.ts +1 -1
- package/lib/auth/tenant.js +44 -55
- package/lib/auth/token-generator.d.ts +1 -1
- package/lib/auth/token-generator.js +49 -53
- package/lib/auth/token-verifier.d.ts +1 -1
- package/lib/auth/token-verifier.js +83 -91
- package/lib/auth/user-import-builder.d.ts +1 -1
- package/lib/auth/user-import-builder.js +70 -73
- package/lib/auth/user-record.d.ts +1 -1
- package/lib/auth/user-record.js +61 -84
- package/lib/credential/index.d.ts +1 -1
- package/lib/credential/index.js +2 -2
- package/lib/database/database-namespace.d.ts +1 -1
- package/lib/database/database-namespace.js +1 -1
- package/lib/database/database.d.ts +1 -1
- package/lib/database/database.js +92 -108
- package/lib/database/index.d.ts +1 -1
- package/lib/database/index.js +10 -10
- package/lib/default-namespace.d.ts +1 -1
- package/lib/default-namespace.js +2 -2
- package/lib/esm/eventarc/index.js +5 -0
- package/lib/esm/functions/index.js +5 -0
- package/lib/eventarc/cloudevent.d.ts +84 -0
- package/lib/eventarc/cloudevent.js +19 -0
- package/lib/eventarc/eventarc-client-internal.d.ts +18 -0
- package/lib/eventarc/eventarc-client-internal.js +139 -0
- package/lib/eventarc/eventarc-utils.d.ts +31 -0
- package/lib/eventarc/eventarc-utils.js +125 -0
- package/lib/eventarc/eventarc.d.ts +107 -0
- package/lib/eventarc/eventarc.js +125 -0
- package/lib/eventarc/index.d.ts +53 -0
- package/lib/eventarc/index.js +64 -0
- package/lib/firebase-namespace-api.d.ts +1 -1
- package/lib/firebase-namespace-api.js +8 -3
- package/lib/firestore/firestore-internal.d.ts +1 -1
- package/lib/firestore/firestore-internal.js +28 -37
- package/lib/firestore/firestore-namespace.d.ts +9 -1
- package/lib/firestore/firestore-namespace.js +2 -2
- package/lib/firestore/index.d.ts +2 -2
- package/lib/firestore/index.js +7 -7
- package/lib/functions/functions-api-client-internal.d.ts +32 -0
- package/lib/functions/functions-api-client-internal.js +257 -0
- package/lib/functions/functions-api.d.ts +67 -0
- package/lib/functions/functions-api.js +19 -0
- package/lib/functions/functions.d.ts +63 -0
- package/lib/functions/functions.js +97 -0
- package/lib/functions/index.d.ts +53 -0
- package/lib/functions/index.js +64 -0
- package/lib/index.d.ts +1 -1
- package/lib/index.js +14 -4
- package/lib/installations/index.d.ts +1 -1
- package/lib/installations/index.js +6 -6
- package/lib/installations/installations-namespace.d.ts +1 -1
- package/lib/installations/installations-namespace.js +1 -1
- package/lib/installations/installations-request-handler.d.ts +1 -1
- package/lib/installations/installations-request-handler.js +33 -36
- package/lib/installations/installations.d.ts +1 -1
- package/lib/installations/installations.js +17 -22
- package/lib/instance-id/index.d.ts +1 -1
- package/lib/instance-id/index.js +6 -6
- package/lib/instance-id/instance-id-namespace.d.ts +1 -1
- package/lib/instance-id/instance-id-namespace.js +1 -1
- package/lib/instance-id/instance-id.d.ts +1 -1
- package/lib/instance-id/instance-id.js +21 -26
- package/lib/machine-learning/index.d.ts +1 -1
- package/lib/machine-learning/index.js +7 -7
- package/lib/machine-learning/machine-learning-api-client.d.ts +1 -1
- package/lib/machine-learning/machine-learning-api-client.js +110 -124
- package/lib/machine-learning/machine-learning-namespace.d.ts +1 -1
- package/lib/machine-learning/machine-learning-namespace.js +1 -1
- package/lib/machine-learning/machine-learning-utils.d.ts +1 -1
- package/lib/machine-learning/machine-learning-utils.js +9 -24
- package/lib/machine-learning/machine-learning.d.ts +1 -1
- package/lib/machine-learning/machine-learning.js +146 -207
- package/lib/messaging/batch-request-internal.d.ts +1 -1
- package/lib/messaging/batch-request-internal.js +33 -35
- package/lib/messaging/index.d.ts +1 -1
- package/lib/messaging/index.js +7 -7
- package/lib/messaging/messaging-api-request-internal.d.ts +1 -1
- package/lib/messaging/messaging-api-request-internal.js +38 -40
- package/lib/messaging/messaging-api.d.ts +1 -1
- package/lib/messaging/messaging-api.js +1 -1
- package/lib/messaging/messaging-errors-internal.d.ts +1 -1
- package/lib/messaging/messaging-errors-internal.js +12 -13
- package/lib/messaging/messaging-internal.d.ts +1 -1
- package/lib/messaging/messaging-internal.js +51 -51
- package/lib/messaging/messaging-namespace.d.ts +1 -1
- package/lib/messaging/messaging-namespace.js +1 -1
- package/lib/messaging/messaging.d.ts +1 -1
- package/lib/messaging/messaging.js +184 -208
- package/lib/project-management/android-app.d.ts +1 -1
- package/lib/project-management/android-app.js +41 -43
- package/lib/project-management/app-metadata.d.ts +1 -1
- package/lib/project-management/app-metadata.js +1 -1
- package/lib/project-management/index.d.ts +1 -1
- package/lib/project-management/index.js +7 -7
- package/lib/project-management/ios-app.d.ts +1 -1
- package/lib/project-management/ios-app.js +25 -26
- package/lib/project-management/project-management-api-request-internal.d.ts +1 -1
- package/lib/project-management/project-management-api-request-internal.js +84 -89
- package/lib/project-management/project-management-namespace.d.ts +1 -1
- package/lib/project-management/project-management-namespace.js +1 -1
- package/lib/project-management/project-management.d.ts +1 -1
- package/lib/project-management/project-management.js +80 -87
- package/lib/remote-config/index.d.ts +1 -1
- package/lib/remote-config/index.js +7 -7
- package/lib/remote-config/remote-config-api-client-internal.d.ts +1 -1
- package/lib/remote-config/remote-config-api-client-internal.js +116 -154
- package/lib/remote-config/remote-config-api.d.ts +1 -1
- package/lib/remote-config/remote-config-api.js +1 -1
- package/lib/remote-config/remote-config-namespace.d.ts +1 -1
- package/lib/remote-config/remote-config-namespace.js +1 -1
- package/lib/remote-config/remote-config.d.ts +1 -1
- package/lib/remote-config/remote-config.js +51 -59
- package/lib/security-rules/index.d.ts +1 -1
- package/lib/security-rules/index.js +7 -7
- package/lib/security-rules/security-rules-api-client-internal.d.ts +1 -1
- package/lib/security-rules/security-rules-api-client-internal.js +95 -107
- package/lib/security-rules/security-rules-internal.d.ts +1 -1
- package/lib/security-rules/security-rules-internal.js +6 -21
- package/lib/security-rules/security-rules-namespace.d.ts +1 -1
- package/lib/security-rules/security-rules-namespace.js +1 -1
- package/lib/security-rules/security-rules.d.ts +1 -1
- package/lib/security-rules/security-rules.js +82 -91
- package/lib/storage/index.d.ts +1 -1
- package/lib/storage/index.js +7 -7
- package/lib/storage/storage-namespace.d.ts +1 -1
- package/lib/storage/storage-namespace.js +1 -1
- package/lib/storage/storage.d.ts +1 -1
- package/lib/storage/storage.js +25 -30
- package/lib/utils/api-request.d.ts +3 -1
- package/lib/utils/api-request.js +278 -356
- package/lib/utils/crypto-signer.d.ts +1 -1
- package/lib/utils/crypto-signer.js +58 -93
- package/lib/utils/deep-copy.d.ts +1 -1
- package/lib/utils/deep-copy.js +3 -3
- package/lib/utils/error.d.ts +5 -1
- package/lib/utils/error.js +613 -677
- package/lib/utils/index.d.ts +43 -1
- package/lib/utils/index.js +99 -34
- package/lib/utils/jwt.d.ts +1 -1
- package/lib/utils/jwt.js +97 -123
- package/lib/utils/validator.d.ts +1 -1
- package/lib/utils/validator.js +13 -13
- package/package.json +43 -11
package/README.md
CHANGED
|
@@ -59,7 +59,7 @@ requests, code review feedback, and also pull requests.
|
|
|
59
59
|
|
|
60
60
|
## Supported Environments
|
|
61
61
|
|
|
62
|
-
We support Node.js
|
|
62
|
+
We support Node.js 14 and higher.
|
|
63
63
|
|
|
64
64
|
Please also note that the Admin SDK should only
|
|
65
65
|
be used in server-side/back-end environments controlled by the app developer.
|
package/lib/app/core.d.ts
CHANGED
package/lib/app/core.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
/*! firebase-admin
|
|
1
|
+
/*! firebase-admin v11.0.0 */
|
|
2
2
|
"use strict";
|
|
3
3
|
/*!
|
|
4
4
|
* @license
|
|
@@ -18,10 +18,10 @@
|
|
|
18
18
|
*/
|
|
19
19
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
20
20
|
exports.clearGlobalAppDefaultCred = exports.refreshToken = exports.cert = exports.applicationDefault = void 0;
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
21
|
+
const credential_internal_1 = require("./credential-internal");
|
|
22
|
+
let globalAppDefaultCred;
|
|
23
|
+
const globalCertCreds = {};
|
|
24
|
+
const globalRefreshTokenCreds = {};
|
|
25
25
|
/**
|
|
26
26
|
* Returns a credential created from the
|
|
27
27
|
* {@link https://developers.google.com/identity/protocols/application-default-credentials |
|
|
@@ -52,7 +52,7 @@ var globalRefreshTokenCreds = {};
|
|
|
52
52
|
*/
|
|
53
53
|
function applicationDefault(httpAgent) {
|
|
54
54
|
if (typeof globalAppDefaultCred === 'undefined') {
|
|
55
|
-
globalAppDefaultCred = credential_internal_1.getApplicationDefault(httpAgent);
|
|
55
|
+
globalAppDefaultCred = (0, credential_internal_1.getApplicationDefault)(httpAgent);
|
|
56
56
|
}
|
|
57
57
|
return globalAppDefaultCred;
|
|
58
58
|
}
|
|
@@ -98,7 +98,7 @@ exports.applicationDefault = applicationDefault;
|
|
|
98
98
|
* provided service account that can be used to initialize an app.
|
|
99
99
|
*/
|
|
100
100
|
function cert(serviceAccountPathOrObject, httpAgent) {
|
|
101
|
-
|
|
101
|
+
const stringifiedServiceAccount = JSON.stringify(serviceAccountPathOrObject);
|
|
102
102
|
if (!(stringifiedServiceAccount in globalCertCreds)) {
|
|
103
103
|
globalCertCreds[stringifiedServiceAccount] = new credential_internal_1.ServiceAccountCredential(serviceAccountPathOrObject, httpAgent);
|
|
104
104
|
}
|
|
@@ -134,7 +134,7 @@ exports.cert = cert;
|
|
|
134
134
|
* provided service account that can be used to initialize an app.
|
|
135
135
|
*/
|
|
136
136
|
function refreshToken(refreshTokenPathOrObject, httpAgent) {
|
|
137
|
-
|
|
137
|
+
const stringifiedRefreshToken = JSON.stringify(refreshTokenPathOrObject);
|
|
138
138
|
if (!(stringifiedRefreshToken in globalRefreshTokenCreds)) {
|
|
139
139
|
globalRefreshTokenCreds[stringifiedRefreshToken] = new credential_internal_1.RefreshTokenCredential(refreshTokenPathOrObject, httpAgent);
|
|
140
140
|
}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
/*! firebase-admin
|
|
1
|
+
/*! firebase-admin v11.0.0 */
|
|
2
2
|
/*!
|
|
3
3
|
* @license
|
|
4
4
|
* Copyright 2020 Google Inc.
|
|
@@ -51,9 +51,11 @@ export declare class ComputeEngineCredential implements Credential {
|
|
|
51
51
|
private readonly httpClient;
|
|
52
52
|
private readonly httpAgent?;
|
|
53
53
|
private projectId?;
|
|
54
|
+
private accountId?;
|
|
54
55
|
constructor(httpAgent?: Agent);
|
|
55
56
|
getAccessToken(): Promise<GoogleOAuthAccessToken>;
|
|
56
57
|
getProjectId(): Promise<string>;
|
|
58
|
+
getServiceAccountEmail(): Promise<string>;
|
|
57
59
|
private buildRequest;
|
|
58
60
|
}
|
|
59
61
|
/**
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
/*! firebase-admin
|
|
1
|
+
/*! firebase-admin v11.0.0 */
|
|
2
2
|
"use strict";
|
|
3
3
|
/*!
|
|
4
4
|
* @license
|
|
@@ -18,38 +18,39 @@
|
|
|
18
18
|
*/
|
|
19
19
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
20
20
|
exports.getApplicationDefault = exports.isApplicationDefault = exports.RefreshTokenCredential = exports.ComputeEngineCredential = exports.ServiceAccountCredential = void 0;
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
21
|
+
const fs = require("fs");
|
|
22
|
+
const os = require("os");
|
|
23
|
+
const path = require("path");
|
|
24
|
+
const error_1 = require("../utils/error");
|
|
25
|
+
const api_request_1 = require("../utils/api-request");
|
|
26
|
+
const util = require("../utils/validator");
|
|
27
|
+
const GOOGLE_TOKEN_AUDIENCE = 'https://accounts.google.com/o/oauth2/token';
|
|
28
|
+
const GOOGLE_AUTH_TOKEN_HOST = 'accounts.google.com';
|
|
29
|
+
const GOOGLE_AUTH_TOKEN_PATH = '/o/oauth2/token';
|
|
30
30
|
// NOTE: the Google Metadata Service uses HTTP over a vlan
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
31
|
+
const GOOGLE_METADATA_SERVICE_HOST = 'metadata.google.internal';
|
|
32
|
+
const GOOGLE_METADATA_SERVICE_TOKEN_PATH = '/computeMetadata/v1/instance/service-accounts/default/token';
|
|
33
|
+
const GOOGLE_METADATA_SERVICE_PROJECT_ID_PATH = '/computeMetadata/v1/project/project-id';
|
|
34
|
+
const GOOGLE_METADATA_SERVICE_ACCOUNT_ID_PATH = '/computeMetadata/v1/instance/service-accounts/default/email';
|
|
35
|
+
const configDir = (() => {
|
|
35
36
|
// Windows has a dedicated low-rights location for apps at ~/Application Data
|
|
36
|
-
|
|
37
|
+
const sys = os.platform();
|
|
37
38
|
if (sys && sys.length >= 3 && sys.substring(0, 3).toLowerCase() === 'win') {
|
|
38
39
|
return process.env.APPDATA;
|
|
39
40
|
}
|
|
40
41
|
// On *nix the gcloud cli creates a . dir.
|
|
41
42
|
return process.env.HOME && path.resolve(process.env.HOME, '.config');
|
|
42
43
|
})();
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
44
|
+
const GCLOUD_CREDENTIAL_SUFFIX = 'gcloud/application_default_credentials.json';
|
|
45
|
+
const GCLOUD_CREDENTIAL_PATH = configDir && path.resolve(configDir, GCLOUD_CREDENTIAL_SUFFIX);
|
|
46
|
+
const REFRESH_TOKEN_HOST = 'www.googleapis.com';
|
|
47
|
+
const REFRESH_TOKEN_PATH = '/oauth2/v4/token';
|
|
48
|
+
const ONE_HOUR_IN_SECONDS = 60 * 60;
|
|
49
|
+
const JWT_ALGORITHM = 'RS256';
|
|
49
50
|
/**
|
|
50
51
|
* Implementation of Credential that uses a service account.
|
|
51
52
|
*/
|
|
52
|
-
|
|
53
|
+
class ServiceAccountCredential {
|
|
53
54
|
/**
|
|
54
55
|
* Creates a new ServiceAccountCredential from the given parameters.
|
|
55
56
|
*
|
|
@@ -60,11 +61,10 @@ var ServiceAccountCredential = /** @class */ (function () {
|
|
|
60
61
|
*
|
|
61
62
|
* @constructor
|
|
62
63
|
*/
|
|
63
|
-
|
|
64
|
-
if (implicit === void 0) { implicit = false; }
|
|
64
|
+
constructor(serviceAccountPathOrObject, httpAgent, implicit = false) {
|
|
65
65
|
this.httpAgent = httpAgent;
|
|
66
66
|
this.implicit = implicit;
|
|
67
|
-
|
|
67
|
+
const serviceAccount = (typeof serviceAccountPathOrObject === 'string') ?
|
|
68
68
|
ServiceAccount.fromPath(serviceAccountPathOrObject)
|
|
69
69
|
: new ServiceAccount(serviceAccountPathOrObject);
|
|
70
70
|
this.projectId = serviceAccount.projectId;
|
|
@@ -72,13 +72,13 @@ var ServiceAccountCredential = /** @class */ (function () {
|
|
|
72
72
|
this.clientEmail = serviceAccount.clientEmail;
|
|
73
73
|
this.httpClient = new api_request_1.HttpClient();
|
|
74
74
|
}
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
75
|
+
getAccessToken() {
|
|
76
|
+
const token = this.createAuthJwt_();
|
|
77
|
+
const postData = 'grant_type=urn%3Aietf%3Aparams%3Aoauth%3A' +
|
|
78
78
|
'grant-type%3Ajwt-bearer&assertion=' + token;
|
|
79
|
-
|
|
79
|
+
const request = {
|
|
80
80
|
method: 'POST',
|
|
81
|
-
url:
|
|
81
|
+
url: `https://${GOOGLE_AUTH_TOKEN_HOST}${GOOGLE_AUTH_TOKEN_PATH}`,
|
|
82
82
|
headers: {
|
|
83
83
|
'Content-Type': 'application/x-www-form-urlencoded',
|
|
84
84
|
},
|
|
@@ -86,10 +86,10 @@ var ServiceAccountCredential = /** @class */ (function () {
|
|
|
86
86
|
httpAgent: this.httpAgent,
|
|
87
87
|
};
|
|
88
88
|
return requestAccessToken(this.httpClient, request);
|
|
89
|
-
}
|
|
89
|
+
}
|
|
90
90
|
// eslint-disable-next-line @typescript-eslint/naming-convention
|
|
91
|
-
|
|
92
|
-
|
|
91
|
+
createAuthJwt_() {
|
|
92
|
+
const claims = {
|
|
93
93
|
scope: [
|
|
94
94
|
'https://www.googleapis.com/auth/cloud-platform',
|
|
95
95
|
'https://www.googleapis.com/auth/firebase.database',
|
|
@@ -99,7 +99,7 @@ var ServiceAccountCredential = /** @class */ (function () {
|
|
|
99
99
|
].join(' '),
|
|
100
100
|
};
|
|
101
101
|
// eslint-disable-next-line @typescript-eslint/no-var-requires
|
|
102
|
-
|
|
102
|
+
const jwt = require('jsonwebtoken');
|
|
103
103
|
// This method is actually synchronous so we can capture and return the buffer.
|
|
104
104
|
return jwt.sign(claims, this.privateKey, {
|
|
105
105
|
audience: GOOGLE_TOKEN_AUDIENCE,
|
|
@@ -107,22 +107,21 @@ var ServiceAccountCredential = /** @class */ (function () {
|
|
|
107
107
|
issuer: this.clientEmail,
|
|
108
108
|
algorithm: JWT_ALGORITHM,
|
|
109
109
|
});
|
|
110
|
-
}
|
|
111
|
-
|
|
112
|
-
}());
|
|
110
|
+
}
|
|
111
|
+
}
|
|
113
112
|
exports.ServiceAccountCredential = ServiceAccountCredential;
|
|
114
113
|
/**
|
|
115
114
|
* A struct containing the properties necessary to use service account JSON credentials.
|
|
116
115
|
*/
|
|
117
|
-
|
|
118
|
-
|
|
116
|
+
class ServiceAccount {
|
|
117
|
+
constructor(json) {
|
|
119
118
|
if (!util.isNonNullObject(json)) {
|
|
120
119
|
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Service account must be an object.');
|
|
121
120
|
}
|
|
122
121
|
copyAttr(this, json, 'projectId', 'project_id');
|
|
123
122
|
copyAttr(this, json, 'privateKey', 'private_key');
|
|
124
123
|
copyAttr(this, json, 'clientEmail', 'client_email');
|
|
125
|
-
|
|
124
|
+
let errorMessage;
|
|
126
125
|
if (!util.isNonEmptyString(this.projectId)) {
|
|
127
126
|
errorMessage = 'Service account object must contain a string "project_id" property.';
|
|
128
127
|
}
|
|
@@ -136,7 +135,7 @@ var ServiceAccount = /** @class */ (function () {
|
|
|
136
135
|
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, errorMessage);
|
|
137
136
|
}
|
|
138
137
|
// eslint-disable-next-line @typescript-eslint/no-var-requires
|
|
139
|
-
|
|
138
|
+
const forge = require('node-forge');
|
|
140
139
|
try {
|
|
141
140
|
forge.pki.privateKeyFromPem(this.privateKey);
|
|
142
141
|
}
|
|
@@ -144,7 +143,7 @@ var ServiceAccount = /** @class */ (function () {
|
|
|
144
143
|
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Failed to parse private key: ' + error);
|
|
145
144
|
}
|
|
146
145
|
}
|
|
147
|
-
|
|
146
|
+
static fromPath(filePath) {
|
|
148
147
|
try {
|
|
149
148
|
return new ServiceAccount(JSON.parse(fs.readFileSync(filePath, 'utf8')));
|
|
150
149
|
}
|
|
@@ -152,56 +151,68 @@ var ServiceAccount = /** @class */ (function () {
|
|
|
152
151
|
// Throw a nicely formed error message if the file contents cannot be parsed
|
|
153
152
|
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Failed to parse service account json file: ' + error);
|
|
154
153
|
}
|
|
155
|
-
}
|
|
156
|
-
|
|
157
|
-
}());
|
|
154
|
+
}
|
|
155
|
+
}
|
|
158
156
|
/**
|
|
159
157
|
* Implementation of Credential that gets access tokens from the metadata service available
|
|
160
158
|
* in the Google Cloud Platform. This authenticates the process as the default service account
|
|
161
159
|
* of an App Engine instance or Google Compute Engine machine.
|
|
162
160
|
*/
|
|
163
|
-
|
|
164
|
-
|
|
161
|
+
class ComputeEngineCredential {
|
|
162
|
+
constructor(httpAgent) {
|
|
165
163
|
this.httpClient = new api_request_1.HttpClient();
|
|
166
164
|
this.httpAgent = httpAgent;
|
|
167
165
|
}
|
|
168
|
-
|
|
169
|
-
|
|
166
|
+
getAccessToken() {
|
|
167
|
+
const request = this.buildRequest(GOOGLE_METADATA_SERVICE_TOKEN_PATH);
|
|
170
168
|
return requestAccessToken(this.httpClient, request);
|
|
171
|
-
}
|
|
172
|
-
|
|
173
|
-
var _this = this;
|
|
169
|
+
}
|
|
170
|
+
getProjectId() {
|
|
174
171
|
if (this.projectId) {
|
|
175
172
|
return Promise.resolve(this.projectId);
|
|
176
173
|
}
|
|
177
|
-
|
|
174
|
+
const request = this.buildRequest(GOOGLE_METADATA_SERVICE_PROJECT_ID_PATH);
|
|
175
|
+
return this.httpClient.send(request)
|
|
176
|
+
.then((resp) => {
|
|
177
|
+
this.projectId = resp.text;
|
|
178
|
+
return this.projectId;
|
|
179
|
+
})
|
|
180
|
+
.catch((err) => {
|
|
181
|
+
const detail = (err instanceof api_request_1.HttpError) ? getDetailFromResponse(err.response) : err.message;
|
|
182
|
+
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, `Failed to determine project ID: ${detail}`);
|
|
183
|
+
});
|
|
184
|
+
}
|
|
185
|
+
getServiceAccountEmail() {
|
|
186
|
+
if (this.accountId) {
|
|
187
|
+
return Promise.resolve(this.accountId);
|
|
188
|
+
}
|
|
189
|
+
const request = this.buildRequest(GOOGLE_METADATA_SERVICE_ACCOUNT_ID_PATH);
|
|
178
190
|
return this.httpClient.send(request)
|
|
179
|
-
.then(
|
|
180
|
-
|
|
181
|
-
return
|
|
191
|
+
.then((resp) => {
|
|
192
|
+
this.accountId = resp.text;
|
|
193
|
+
return this.accountId;
|
|
182
194
|
})
|
|
183
|
-
.catch(
|
|
184
|
-
|
|
185
|
-
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL,
|
|
195
|
+
.catch((err) => {
|
|
196
|
+
const detail = (err instanceof api_request_1.HttpError) ? getDetailFromResponse(err.response) : err.message;
|
|
197
|
+
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, `Failed to determine service account email: ${detail}`);
|
|
186
198
|
});
|
|
187
|
-
}
|
|
188
|
-
|
|
199
|
+
}
|
|
200
|
+
buildRequest(urlPath) {
|
|
189
201
|
return {
|
|
190
202
|
method: 'GET',
|
|
191
|
-
url:
|
|
203
|
+
url: `http://${GOOGLE_METADATA_SERVICE_HOST}${urlPath}`,
|
|
192
204
|
headers: {
|
|
193
205
|
'Metadata-Flavor': 'Google',
|
|
194
206
|
},
|
|
195
207
|
httpAgent: this.httpAgent,
|
|
196
208
|
};
|
|
197
|
-
}
|
|
198
|
-
|
|
199
|
-
}());
|
|
209
|
+
}
|
|
210
|
+
}
|
|
200
211
|
exports.ComputeEngineCredential = ComputeEngineCredential;
|
|
201
212
|
/**
|
|
202
213
|
* Implementation of Credential that gets access tokens from refresh tokens.
|
|
203
214
|
*/
|
|
204
|
-
|
|
215
|
+
class RefreshTokenCredential {
|
|
205
216
|
/**
|
|
206
217
|
* Creates a new RefreshTokenCredential from the given parameters.
|
|
207
218
|
*
|
|
@@ -213,8 +224,7 @@ var RefreshTokenCredential = /** @class */ (function () {
|
|
|
213
224
|
*
|
|
214
225
|
* @constructor
|
|
215
226
|
*/
|
|
216
|
-
|
|
217
|
-
if (implicit === void 0) { implicit = false; }
|
|
227
|
+
constructor(refreshTokenPathOrObject, httpAgent, implicit = false) {
|
|
218
228
|
this.httpAgent = httpAgent;
|
|
219
229
|
this.implicit = implicit;
|
|
220
230
|
this.refreshToken = (typeof refreshTokenPathOrObject === 'string') ?
|
|
@@ -222,14 +232,14 @@ var RefreshTokenCredential = /** @class */ (function () {
|
|
|
222
232
|
: new RefreshToken(refreshTokenPathOrObject);
|
|
223
233
|
this.httpClient = new api_request_1.HttpClient();
|
|
224
234
|
}
|
|
225
|
-
|
|
226
|
-
|
|
235
|
+
getAccessToken() {
|
|
236
|
+
const postData = 'client_id=' + this.refreshToken.clientId + '&' +
|
|
227
237
|
'client_secret=' + this.refreshToken.clientSecret + '&' +
|
|
228
238
|
'refresh_token=' + this.refreshToken.refreshToken + '&' +
|
|
229
239
|
'grant_type=refresh_token';
|
|
230
|
-
|
|
240
|
+
const request = {
|
|
231
241
|
method: 'POST',
|
|
232
|
-
url:
|
|
242
|
+
url: `https://${REFRESH_TOKEN_HOST}${REFRESH_TOKEN_PATH}`,
|
|
233
243
|
headers: {
|
|
234
244
|
'Content-Type': 'application/x-www-form-urlencoded',
|
|
235
245
|
},
|
|
@@ -237,17 +247,16 @@ var RefreshTokenCredential = /** @class */ (function () {
|
|
|
237
247
|
httpAgent: this.httpAgent,
|
|
238
248
|
};
|
|
239
249
|
return requestAccessToken(this.httpClient, request);
|
|
240
|
-
}
|
|
241
|
-
|
|
242
|
-
}());
|
|
250
|
+
}
|
|
251
|
+
}
|
|
243
252
|
exports.RefreshTokenCredential = RefreshTokenCredential;
|
|
244
|
-
|
|
245
|
-
|
|
253
|
+
class RefreshToken {
|
|
254
|
+
constructor(json) {
|
|
246
255
|
copyAttr(this, json, 'clientId', 'client_id');
|
|
247
256
|
copyAttr(this, json, 'clientSecret', 'client_secret');
|
|
248
257
|
copyAttr(this, json, 'refreshToken', 'refresh_token');
|
|
249
258
|
copyAttr(this, json, 'type', 'type');
|
|
250
|
-
|
|
259
|
+
let errorMessage;
|
|
251
260
|
if (!util.isNonEmptyString(this.clientId)) {
|
|
252
261
|
errorMessage = 'Refresh token must contain a "client_id" property.';
|
|
253
262
|
}
|
|
@@ -268,7 +277,7 @@ var RefreshToken = /** @class */ (function () {
|
|
|
268
277
|
* Tries to load a RefreshToken from a path. Throws if the path doesn't exist or the
|
|
269
278
|
* data at the path is invalid.
|
|
270
279
|
*/
|
|
271
|
-
|
|
280
|
+
static fromPath(filePath) {
|
|
272
281
|
try {
|
|
273
282
|
return new RefreshToken(JSON.parse(fs.readFileSync(filePath, 'utf8')));
|
|
274
283
|
}
|
|
@@ -276,9 +285,8 @@ var RefreshToken = /** @class */ (function () {
|
|
|
276
285
|
// Throw a nicely formed error message if the file contents cannot be parsed
|
|
277
286
|
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Failed to parse refresh token file: ' + error);
|
|
278
287
|
}
|
|
279
|
-
}
|
|
280
|
-
|
|
281
|
-
}());
|
|
288
|
+
}
|
|
289
|
+
}
|
|
282
290
|
/**
|
|
283
291
|
* Checks if the given credential was loaded via the application default credentials mechanism. This
|
|
284
292
|
* includes all ComputeEngineCredential instances, and the ServiceAccountCredential and RefreshTokenCredential
|
|
@@ -299,7 +307,7 @@ function getApplicationDefault(httpAgent) {
|
|
|
299
307
|
}
|
|
300
308
|
// It is OK to not have this file. If it is present, it must be valid.
|
|
301
309
|
if (GCLOUD_CREDENTIAL_PATH) {
|
|
302
|
-
|
|
310
|
+
const refreshToken = readCredentialFile(GCLOUD_CREDENTIAL_PATH, true);
|
|
303
311
|
if (refreshToken) {
|
|
304
312
|
return new RefreshTokenCredential(refreshToken, httpAgent, true);
|
|
305
313
|
}
|
|
@@ -319,7 +327,7 @@ exports.getApplicationDefault = getApplicationDefault;
|
|
|
319
327
|
* @param alt - Alternative name of the property to copy.
|
|
320
328
|
*/
|
|
321
329
|
function copyAttr(to, from, key, alt) {
|
|
322
|
-
|
|
330
|
+
const tmp = from[key] || from[alt];
|
|
323
331
|
if (typeof tmp !== 'undefined') {
|
|
324
332
|
to[key] = tmp;
|
|
325
333
|
}
|
|
@@ -328,13 +336,13 @@ function copyAttr(to, from, key, alt) {
|
|
|
328
336
|
* Obtain a new OAuth2 token by making a remote service call.
|
|
329
337
|
*/
|
|
330
338
|
function requestAccessToken(client, request) {
|
|
331
|
-
return client.send(request).then(
|
|
332
|
-
|
|
339
|
+
return client.send(request).then((resp) => {
|
|
340
|
+
const json = resp.data;
|
|
333
341
|
if (!json.access_token || !json.expires_in) {
|
|
334
|
-
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL,
|
|
342
|
+
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, `Unexpected response while fetching access token: ${JSON.stringify(json)}`);
|
|
335
343
|
}
|
|
336
344
|
return json;
|
|
337
|
-
}).catch(
|
|
345
|
+
}).catch((err) => {
|
|
338
346
|
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, getErrorMessage(err));
|
|
339
347
|
});
|
|
340
348
|
}
|
|
@@ -342,8 +350,8 @@ function requestAccessToken(client, request) {
|
|
|
342
350
|
* Constructs a human-readable error message from the given Error.
|
|
343
351
|
*/
|
|
344
352
|
function getErrorMessage(err) {
|
|
345
|
-
|
|
346
|
-
return
|
|
353
|
+
const detail = (err instanceof api_request_1.HttpError) ? getDetailFromResponse(err.response) : err.message;
|
|
354
|
+
return `Error fetching access token: ${detail}`;
|
|
347
355
|
}
|
|
348
356
|
/**
|
|
349
357
|
* Extracts details from the given HTTP error response, and returns a human-readable description. If
|
|
@@ -352,8 +360,8 @@ function getErrorMessage(err) {
|
|
|
352
360
|
*/
|
|
353
361
|
function getDetailFromResponse(response) {
|
|
354
362
|
if (response.isJson() && response.data.error) {
|
|
355
|
-
|
|
356
|
-
|
|
363
|
+
const json = response.data;
|
|
364
|
+
let detail = json.error;
|
|
357
365
|
if (json.error_description) {
|
|
358
366
|
detail += ' (' + json.error_description + ')';
|
|
359
367
|
}
|
|
@@ -362,7 +370,7 @@ function getDetailFromResponse(response) {
|
|
|
362
370
|
return response.text || 'Missing error payload';
|
|
363
371
|
}
|
|
364
372
|
function credentialFromFile(filePath, httpAgent) {
|
|
365
|
-
|
|
373
|
+
const credentialsFile = readCredentialFile(filePath);
|
|
366
374
|
if (typeof credentialsFile !== 'object' || credentialsFile === null) {
|
|
367
375
|
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Failed to parse contents of the credentials file as an object');
|
|
368
376
|
}
|
|
@@ -375,7 +383,7 @@ function credentialFromFile(filePath, httpAgent) {
|
|
|
375
383
|
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Invalid contents in the credentials file');
|
|
376
384
|
}
|
|
377
385
|
function readCredentialFile(filePath, ignoreMissing) {
|
|
378
|
-
|
|
386
|
+
let fileText;
|
|
379
387
|
try {
|
|
380
388
|
fileText = fs.readFileSync(filePath, 'utf8');
|
|
381
389
|
}
|
|
@@ -383,7 +391,7 @@ function readCredentialFile(filePath, ignoreMissing) {
|
|
|
383
391
|
if (ignoreMissing) {
|
|
384
392
|
return null;
|
|
385
393
|
}
|
|
386
|
-
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL,
|
|
394
|
+
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, `Failed to read credentials from file ${filePath}: ` + error);
|
|
387
395
|
}
|
|
388
396
|
try {
|
|
389
397
|
return JSON.parse(fileText);
|
package/lib/app/credential.d.ts
CHANGED
package/lib/app/credential.js
CHANGED