firebase-admin 10.3.0 → 11.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -2
- package/lib/app/core.d.ts +1 -1
- package/lib/app/core.js +1 -1
- package/lib/app/credential-factory.d.ts +1 -1
- package/lib/app/credential-factory.js +8 -8
- package/lib/app/credential-internal.d.ts +1 -1
- package/lib/app/credential-internal.js +97 -106
- package/lib/app/credential.d.ts +1 -1
- package/lib/app/credential.js +1 -1
- package/lib/app/firebase-app.d.ts +1 -1
- package/lib/app/firebase-app.js +76 -91
- package/lib/app/firebase-namespace.d.ts +1 -1
- package/lib/app/firebase-namespace.js +209 -279
- package/lib/app/index.d.ts +1 -1
- package/lib/app/index.js +4 -4
- package/lib/app/lifecycle.d.ts +1 -1
- package/lib/app/lifecycle.js +37 -43
- package/lib/app-check/app-check-api-client-internal.d.ts +1 -1
- package/lib/app-check/app-check-api-client-internal.js +54 -73
- package/lib/app-check/app-check-api.d.ts +1 -1
- package/lib/app-check/app-check-api.js +1 -1
- package/lib/app-check/app-check-namespace.d.ts +1 -1
- package/lib/app-check/app-check-namespace.js +1 -1
- package/lib/app-check/app-check.d.ts +1 -1
- package/lib/app-check/app-check.js +17 -19
- package/lib/app-check/index.d.ts +1 -1
- package/lib/app-check/index.js +7 -7
- package/lib/app-check/token-generator.d.ts +1 -1
- package/lib/app-check/token-generator.js +47 -52
- package/lib/app-check/token-verifier.d.ts +1 -1
- package/lib/app-check/token-verifier.js +46 -50
- package/lib/auth/action-code-settings-builder.d.ts +1 -1
- package/lib/auth/action-code-settings-builder.js +10 -11
- package/lib/auth/auth-api-request.d.ts +1 -1
- package/lib/auth/auth-api-request.js +346 -393
- package/lib/auth/auth-config.d.ts +1 -1
- package/lib/auth/auth-config.js +95 -106
- package/lib/auth/auth-namespace.d.ts +1 -1
- package/lib/auth/auth-namespace.js +1 -1
- package/lib/auth/auth.d.ts +1 -1
- package/lib/auth/auth.js +20 -40
- package/lib/auth/base-auth.d.ts +1 -1
- package/lib/auth/base-auth.js +137 -144
- package/lib/auth/identifier.d.ts +1 -1
- package/lib/auth/identifier.js +2 -2
- package/lib/auth/index.d.ts +1 -1
- package/lib/auth/index.js +7 -7
- package/lib/auth/tenant-manager.d.ts +1 -1
- package/lib/auth/tenant-manager.js +49 -71
- package/lib/auth/tenant.d.ts +1 -1
- package/lib/auth/tenant.js +44 -55
- package/lib/auth/token-generator.d.ts +1 -1
- package/lib/auth/token-generator.js +49 -53
- package/lib/auth/token-verifier.d.ts +1 -1
- package/lib/auth/token-verifier.js +83 -91
- package/lib/auth/user-import-builder.d.ts +1 -1
- package/lib/auth/user-import-builder.js +70 -73
- package/lib/auth/user-record.d.ts +1 -1
- package/lib/auth/user-record.js +61 -84
- package/lib/credential/index.d.ts +1 -1
- package/lib/credential/index.js +2 -2
- package/lib/database/database-namespace.d.ts +1 -1
- package/lib/database/database-namespace.js +1 -1
- package/lib/database/database.d.ts +1 -1
- package/lib/database/database.js +92 -108
- package/lib/database/index.d.ts +1 -1
- package/lib/database/index.js +10 -10
- package/lib/default-namespace.d.ts +1 -1
- package/lib/default-namespace.js +2 -2
- package/lib/eventarc/cloudevent.d.ts +1 -1
- package/lib/eventarc/cloudevent.js +1 -1
- package/lib/eventarc/eventarc-client-internal.d.ts +1 -1
- package/lib/eventarc/eventarc-client-internal.js +63 -129
- package/lib/eventarc/eventarc-utils.d.ts +1 -1
- package/lib/eventarc/eventarc-utils.js +16 -32
- package/lib/eventarc/eventarc.d.ts +1 -1
- package/lib/eventarc/eventarc.js +51 -65
- package/lib/eventarc/index.d.ts +1 -1
- package/lib/eventarc/index.js +7 -7
- package/lib/firebase-namespace-api.d.ts +1 -1
- package/lib/firebase-namespace-api.js +8 -3
- package/lib/firestore/firestore-internal.d.ts +1 -1
- package/lib/firestore/firestore-internal.js +28 -37
- package/lib/firestore/firestore-namespace.d.ts +9 -1
- package/lib/firestore/firestore-namespace.js +2 -2
- package/lib/firestore/index.d.ts +2 -2
- package/lib/firestore/index.js +7 -7
- package/lib/functions/functions-api-client-internal.d.ts +1 -1
- package/lib/functions/functions-api-client-internal.js +71 -93
- package/lib/functions/functions-api.d.ts +1 -1
- package/lib/functions/functions-api.js +1 -1
- package/lib/functions/functions.d.ts +1 -1
- package/lib/functions/functions.js +13 -15
- package/lib/functions/index.d.ts +1 -1
- package/lib/functions/index.js +7 -7
- package/lib/index.d.ts +1 -1
- package/lib/index.js +14 -4
- package/lib/installations/index.d.ts +1 -1
- package/lib/installations/index.js +6 -6
- package/lib/installations/installations-namespace.d.ts +1 -1
- package/lib/installations/installations-namespace.js +1 -1
- package/lib/installations/installations-request-handler.d.ts +1 -1
- package/lib/installations/installations-request-handler.js +33 -36
- package/lib/installations/installations.d.ts +1 -1
- package/lib/installations/installations.js +17 -22
- package/lib/instance-id/index.d.ts +1 -1
- package/lib/instance-id/index.js +6 -6
- package/lib/instance-id/instance-id-namespace.d.ts +1 -1
- package/lib/instance-id/instance-id-namespace.js +1 -1
- package/lib/instance-id/instance-id.d.ts +1 -1
- package/lib/instance-id/instance-id.js +21 -26
- package/lib/machine-learning/index.d.ts +1 -1
- package/lib/machine-learning/index.js +7 -7
- package/lib/machine-learning/machine-learning-api-client.d.ts +1 -1
- package/lib/machine-learning/machine-learning-api-client.js +110 -124
- package/lib/machine-learning/machine-learning-namespace.d.ts +1 -1
- package/lib/machine-learning/machine-learning-namespace.js +1 -1
- package/lib/machine-learning/machine-learning-utils.d.ts +1 -1
- package/lib/machine-learning/machine-learning-utils.js +9 -24
- package/lib/machine-learning/machine-learning.d.ts +1 -1
- package/lib/machine-learning/machine-learning.js +146 -207
- package/lib/messaging/batch-request-internal.d.ts +1 -1
- package/lib/messaging/batch-request-internal.js +33 -35
- package/lib/messaging/index.d.ts +1 -1
- package/lib/messaging/index.js +7 -7
- package/lib/messaging/messaging-api-request-internal.d.ts +1 -1
- package/lib/messaging/messaging-api-request-internal.js +38 -40
- package/lib/messaging/messaging-api.d.ts +1 -1
- package/lib/messaging/messaging-api.js +1 -1
- package/lib/messaging/messaging-errors-internal.d.ts +1 -1
- package/lib/messaging/messaging-errors-internal.js +12 -13
- package/lib/messaging/messaging-internal.d.ts +1 -1
- package/lib/messaging/messaging-internal.js +51 -51
- package/lib/messaging/messaging-namespace.d.ts +1 -1
- package/lib/messaging/messaging-namespace.js +1 -1
- package/lib/messaging/messaging.d.ts +1 -1
- package/lib/messaging/messaging.js +184 -208
- package/lib/project-management/android-app.d.ts +1 -1
- package/lib/project-management/android-app.js +41 -43
- package/lib/project-management/app-metadata.d.ts +1 -1
- package/lib/project-management/app-metadata.js +1 -1
- package/lib/project-management/index.d.ts +1 -1
- package/lib/project-management/index.js +7 -7
- package/lib/project-management/ios-app.d.ts +1 -1
- package/lib/project-management/ios-app.js +25 -26
- package/lib/project-management/project-management-api-request-internal.d.ts +1 -1
- package/lib/project-management/project-management-api-request-internal.js +84 -89
- package/lib/project-management/project-management-namespace.d.ts +1 -1
- package/lib/project-management/project-management-namespace.js +1 -1
- package/lib/project-management/project-management.d.ts +1 -1
- package/lib/project-management/project-management.js +80 -87
- package/lib/remote-config/index.d.ts +1 -1
- package/lib/remote-config/index.js +7 -7
- package/lib/remote-config/remote-config-api-client-internal.d.ts +1 -1
- package/lib/remote-config/remote-config-api-client-internal.js +116 -154
- package/lib/remote-config/remote-config-api.d.ts +1 -1
- package/lib/remote-config/remote-config-api.js +1 -1
- package/lib/remote-config/remote-config-namespace.d.ts +1 -1
- package/lib/remote-config/remote-config-namespace.js +1 -1
- package/lib/remote-config/remote-config.d.ts +1 -1
- package/lib/remote-config/remote-config.js +51 -59
- package/lib/security-rules/index.d.ts +1 -1
- package/lib/security-rules/index.js +7 -7
- package/lib/security-rules/security-rules-api-client-internal.d.ts +1 -1
- package/lib/security-rules/security-rules-api-client-internal.js +95 -107
- package/lib/security-rules/security-rules-internal.d.ts +1 -1
- package/lib/security-rules/security-rules-internal.js +6 -21
- package/lib/security-rules/security-rules-namespace.d.ts +1 -1
- package/lib/security-rules/security-rules-namespace.js +1 -1
- package/lib/security-rules/security-rules.d.ts +1 -1
- package/lib/security-rules/security-rules.js +82 -91
- package/lib/storage/index.d.ts +1 -1
- package/lib/storage/index.js +7 -7
- package/lib/storage/storage-namespace.d.ts +1 -1
- package/lib/storage/storage-namespace.js +1 -1
- package/lib/storage/storage.d.ts +1 -1
- package/lib/storage/storage.js +25 -30
- package/lib/utils/api-request.d.ts +3 -1
- package/lib/utils/api-request.js +278 -356
- package/lib/utils/crypto-signer.d.ts +1 -1
- package/lib/utils/crypto-signer.js +58 -93
- package/lib/utils/deep-copy.d.ts +1 -1
- package/lib/utils/deep-copy.js +3 -3
- package/lib/utils/error.d.ts +1 -1
- package/lib/utils/error.js +611 -681
- package/lib/utils/index.d.ts +1 -1
- package/lib/utils/index.js +38 -43
- package/lib/utils/jwt.d.ts +1 -1
- package/lib/utils/jwt.js +97 -123
- package/lib/utils/validator.d.ts +1 -1
- package/lib/utils/validator.js +13 -13
- package/package.json +5 -5
package/README.md
CHANGED
|
@@ -59,8 +59,7 @@ requests, code review feedback, and also pull requests.
|
|
|
59
59
|
|
|
60
60
|
## Supported Environments
|
|
61
61
|
|
|
62
|
-
We support Node.js
|
|
63
|
-
you to use Node.js 14 or higher as we will drop support for Node.js 12 in the next major version.
|
|
62
|
+
We support Node.js 14 and higher.
|
|
64
63
|
|
|
65
64
|
Please also note that the Admin SDK should only
|
|
66
65
|
be used in server-side/back-end environments controlled by the app developer.
|
package/lib/app/core.d.ts
CHANGED
package/lib/app/core.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
/*! firebase-admin
|
|
1
|
+
/*! firebase-admin v11.0.0 */
|
|
2
2
|
"use strict";
|
|
3
3
|
/*!
|
|
4
4
|
* @license
|
|
@@ -18,10 +18,10 @@
|
|
|
18
18
|
*/
|
|
19
19
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
20
20
|
exports.clearGlobalAppDefaultCred = exports.refreshToken = exports.cert = exports.applicationDefault = void 0;
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
21
|
+
const credential_internal_1 = require("./credential-internal");
|
|
22
|
+
let globalAppDefaultCred;
|
|
23
|
+
const globalCertCreds = {};
|
|
24
|
+
const globalRefreshTokenCreds = {};
|
|
25
25
|
/**
|
|
26
26
|
* Returns a credential created from the
|
|
27
27
|
* {@link https://developers.google.com/identity/protocols/application-default-credentials |
|
|
@@ -52,7 +52,7 @@ var globalRefreshTokenCreds = {};
|
|
|
52
52
|
*/
|
|
53
53
|
function applicationDefault(httpAgent) {
|
|
54
54
|
if (typeof globalAppDefaultCred === 'undefined') {
|
|
55
|
-
globalAppDefaultCred = credential_internal_1.getApplicationDefault(httpAgent);
|
|
55
|
+
globalAppDefaultCred = (0, credential_internal_1.getApplicationDefault)(httpAgent);
|
|
56
56
|
}
|
|
57
57
|
return globalAppDefaultCred;
|
|
58
58
|
}
|
|
@@ -98,7 +98,7 @@ exports.applicationDefault = applicationDefault;
|
|
|
98
98
|
* provided service account that can be used to initialize an app.
|
|
99
99
|
*/
|
|
100
100
|
function cert(serviceAccountPathOrObject, httpAgent) {
|
|
101
|
-
|
|
101
|
+
const stringifiedServiceAccount = JSON.stringify(serviceAccountPathOrObject);
|
|
102
102
|
if (!(stringifiedServiceAccount in globalCertCreds)) {
|
|
103
103
|
globalCertCreds[stringifiedServiceAccount] = new credential_internal_1.ServiceAccountCredential(serviceAccountPathOrObject, httpAgent);
|
|
104
104
|
}
|
|
@@ -134,7 +134,7 @@ exports.cert = cert;
|
|
|
134
134
|
* provided service account that can be used to initialize an app.
|
|
135
135
|
*/
|
|
136
136
|
function refreshToken(refreshTokenPathOrObject, httpAgent) {
|
|
137
|
-
|
|
137
|
+
const stringifiedRefreshToken = JSON.stringify(refreshTokenPathOrObject);
|
|
138
138
|
if (!(stringifiedRefreshToken in globalRefreshTokenCreds)) {
|
|
139
139
|
globalRefreshTokenCreds[stringifiedRefreshToken] = new credential_internal_1.RefreshTokenCredential(refreshTokenPathOrObject, httpAgent);
|
|
140
140
|
}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
/*! firebase-admin
|
|
1
|
+
/*! firebase-admin v11.0.0 */
|
|
2
2
|
"use strict";
|
|
3
3
|
/*!
|
|
4
4
|
* @license
|
|
@@ -18,39 +18,39 @@
|
|
|
18
18
|
*/
|
|
19
19
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
20
20
|
exports.getApplicationDefault = exports.isApplicationDefault = exports.RefreshTokenCredential = exports.ComputeEngineCredential = exports.ServiceAccountCredential = void 0;
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
21
|
+
const fs = require("fs");
|
|
22
|
+
const os = require("os");
|
|
23
|
+
const path = require("path");
|
|
24
|
+
const error_1 = require("../utils/error");
|
|
25
|
+
const api_request_1 = require("../utils/api-request");
|
|
26
|
+
const util = require("../utils/validator");
|
|
27
|
+
const GOOGLE_TOKEN_AUDIENCE = 'https://accounts.google.com/o/oauth2/token';
|
|
28
|
+
const GOOGLE_AUTH_TOKEN_HOST = 'accounts.google.com';
|
|
29
|
+
const GOOGLE_AUTH_TOKEN_PATH = '/o/oauth2/token';
|
|
30
30
|
// NOTE: the Google Metadata Service uses HTTP over a vlan
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
31
|
+
const GOOGLE_METADATA_SERVICE_HOST = 'metadata.google.internal';
|
|
32
|
+
const GOOGLE_METADATA_SERVICE_TOKEN_PATH = '/computeMetadata/v1/instance/service-accounts/default/token';
|
|
33
|
+
const GOOGLE_METADATA_SERVICE_PROJECT_ID_PATH = '/computeMetadata/v1/project/project-id';
|
|
34
|
+
const GOOGLE_METADATA_SERVICE_ACCOUNT_ID_PATH = '/computeMetadata/v1/instance/service-accounts/default/email';
|
|
35
|
+
const configDir = (() => {
|
|
36
36
|
// Windows has a dedicated low-rights location for apps at ~/Application Data
|
|
37
|
-
|
|
37
|
+
const sys = os.platform();
|
|
38
38
|
if (sys && sys.length >= 3 && sys.substring(0, 3).toLowerCase() === 'win') {
|
|
39
39
|
return process.env.APPDATA;
|
|
40
40
|
}
|
|
41
41
|
// On *nix the gcloud cli creates a . dir.
|
|
42
42
|
return process.env.HOME && path.resolve(process.env.HOME, '.config');
|
|
43
43
|
})();
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
44
|
+
const GCLOUD_CREDENTIAL_SUFFIX = 'gcloud/application_default_credentials.json';
|
|
45
|
+
const GCLOUD_CREDENTIAL_PATH = configDir && path.resolve(configDir, GCLOUD_CREDENTIAL_SUFFIX);
|
|
46
|
+
const REFRESH_TOKEN_HOST = 'www.googleapis.com';
|
|
47
|
+
const REFRESH_TOKEN_PATH = '/oauth2/v4/token';
|
|
48
|
+
const ONE_HOUR_IN_SECONDS = 60 * 60;
|
|
49
|
+
const JWT_ALGORITHM = 'RS256';
|
|
50
50
|
/**
|
|
51
51
|
* Implementation of Credential that uses a service account.
|
|
52
52
|
*/
|
|
53
|
-
|
|
53
|
+
class ServiceAccountCredential {
|
|
54
54
|
/**
|
|
55
55
|
* Creates a new ServiceAccountCredential from the given parameters.
|
|
56
56
|
*
|
|
@@ -61,11 +61,10 @@ var ServiceAccountCredential = /** @class */ (function () {
|
|
|
61
61
|
*
|
|
62
62
|
* @constructor
|
|
63
63
|
*/
|
|
64
|
-
|
|
65
|
-
if (implicit === void 0) { implicit = false; }
|
|
64
|
+
constructor(serviceAccountPathOrObject, httpAgent, implicit = false) {
|
|
66
65
|
this.httpAgent = httpAgent;
|
|
67
66
|
this.implicit = implicit;
|
|
68
|
-
|
|
67
|
+
const serviceAccount = (typeof serviceAccountPathOrObject === 'string') ?
|
|
69
68
|
ServiceAccount.fromPath(serviceAccountPathOrObject)
|
|
70
69
|
: new ServiceAccount(serviceAccountPathOrObject);
|
|
71
70
|
this.projectId = serviceAccount.projectId;
|
|
@@ -73,13 +72,13 @@ var ServiceAccountCredential = /** @class */ (function () {
|
|
|
73
72
|
this.clientEmail = serviceAccount.clientEmail;
|
|
74
73
|
this.httpClient = new api_request_1.HttpClient();
|
|
75
74
|
}
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
75
|
+
getAccessToken() {
|
|
76
|
+
const token = this.createAuthJwt_();
|
|
77
|
+
const postData = 'grant_type=urn%3Aietf%3Aparams%3Aoauth%3A' +
|
|
79
78
|
'grant-type%3Ajwt-bearer&assertion=' + token;
|
|
80
|
-
|
|
79
|
+
const request = {
|
|
81
80
|
method: 'POST',
|
|
82
|
-
url:
|
|
81
|
+
url: `https://${GOOGLE_AUTH_TOKEN_HOST}${GOOGLE_AUTH_TOKEN_PATH}`,
|
|
83
82
|
headers: {
|
|
84
83
|
'Content-Type': 'application/x-www-form-urlencoded',
|
|
85
84
|
},
|
|
@@ -87,10 +86,10 @@ var ServiceAccountCredential = /** @class */ (function () {
|
|
|
87
86
|
httpAgent: this.httpAgent,
|
|
88
87
|
};
|
|
89
88
|
return requestAccessToken(this.httpClient, request);
|
|
90
|
-
}
|
|
89
|
+
}
|
|
91
90
|
// eslint-disable-next-line @typescript-eslint/naming-convention
|
|
92
|
-
|
|
93
|
-
|
|
91
|
+
createAuthJwt_() {
|
|
92
|
+
const claims = {
|
|
94
93
|
scope: [
|
|
95
94
|
'https://www.googleapis.com/auth/cloud-platform',
|
|
96
95
|
'https://www.googleapis.com/auth/firebase.database',
|
|
@@ -100,7 +99,7 @@ var ServiceAccountCredential = /** @class */ (function () {
|
|
|
100
99
|
].join(' '),
|
|
101
100
|
};
|
|
102
101
|
// eslint-disable-next-line @typescript-eslint/no-var-requires
|
|
103
|
-
|
|
102
|
+
const jwt = require('jsonwebtoken');
|
|
104
103
|
// This method is actually synchronous so we can capture and return the buffer.
|
|
105
104
|
return jwt.sign(claims, this.privateKey, {
|
|
106
105
|
audience: GOOGLE_TOKEN_AUDIENCE,
|
|
@@ -108,22 +107,21 @@ var ServiceAccountCredential = /** @class */ (function () {
|
|
|
108
107
|
issuer: this.clientEmail,
|
|
109
108
|
algorithm: JWT_ALGORITHM,
|
|
110
109
|
});
|
|
111
|
-
}
|
|
112
|
-
|
|
113
|
-
}());
|
|
110
|
+
}
|
|
111
|
+
}
|
|
114
112
|
exports.ServiceAccountCredential = ServiceAccountCredential;
|
|
115
113
|
/**
|
|
116
114
|
* A struct containing the properties necessary to use service account JSON credentials.
|
|
117
115
|
*/
|
|
118
|
-
|
|
119
|
-
|
|
116
|
+
class ServiceAccount {
|
|
117
|
+
constructor(json) {
|
|
120
118
|
if (!util.isNonNullObject(json)) {
|
|
121
119
|
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Service account must be an object.');
|
|
122
120
|
}
|
|
123
121
|
copyAttr(this, json, 'projectId', 'project_id');
|
|
124
122
|
copyAttr(this, json, 'privateKey', 'private_key');
|
|
125
123
|
copyAttr(this, json, 'clientEmail', 'client_email');
|
|
126
|
-
|
|
124
|
+
let errorMessage;
|
|
127
125
|
if (!util.isNonEmptyString(this.projectId)) {
|
|
128
126
|
errorMessage = 'Service account object must contain a string "project_id" property.';
|
|
129
127
|
}
|
|
@@ -137,7 +135,7 @@ var ServiceAccount = /** @class */ (function () {
|
|
|
137
135
|
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, errorMessage);
|
|
138
136
|
}
|
|
139
137
|
// eslint-disable-next-line @typescript-eslint/no-var-requires
|
|
140
|
-
|
|
138
|
+
const forge = require('node-forge');
|
|
141
139
|
try {
|
|
142
140
|
forge.pki.privateKeyFromPem(this.privateKey);
|
|
143
141
|
}
|
|
@@ -145,7 +143,7 @@ var ServiceAccount = /** @class */ (function () {
|
|
|
145
143
|
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Failed to parse private key: ' + error);
|
|
146
144
|
}
|
|
147
145
|
}
|
|
148
|
-
|
|
146
|
+
static fromPath(filePath) {
|
|
149
147
|
try {
|
|
150
148
|
return new ServiceAccount(JSON.parse(fs.readFileSync(filePath, 'utf8')));
|
|
151
149
|
}
|
|
@@ -153,72 +151,68 @@ var ServiceAccount = /** @class */ (function () {
|
|
|
153
151
|
// Throw a nicely formed error message if the file contents cannot be parsed
|
|
154
152
|
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Failed to parse service account json file: ' + error);
|
|
155
153
|
}
|
|
156
|
-
}
|
|
157
|
-
|
|
158
|
-
}());
|
|
154
|
+
}
|
|
155
|
+
}
|
|
159
156
|
/**
|
|
160
157
|
* Implementation of Credential that gets access tokens from the metadata service available
|
|
161
158
|
* in the Google Cloud Platform. This authenticates the process as the default service account
|
|
162
159
|
* of an App Engine instance or Google Compute Engine machine.
|
|
163
160
|
*/
|
|
164
|
-
|
|
165
|
-
|
|
161
|
+
class ComputeEngineCredential {
|
|
162
|
+
constructor(httpAgent) {
|
|
166
163
|
this.httpClient = new api_request_1.HttpClient();
|
|
167
164
|
this.httpAgent = httpAgent;
|
|
168
165
|
}
|
|
169
|
-
|
|
170
|
-
|
|
166
|
+
getAccessToken() {
|
|
167
|
+
const request = this.buildRequest(GOOGLE_METADATA_SERVICE_TOKEN_PATH);
|
|
171
168
|
return requestAccessToken(this.httpClient, request);
|
|
172
|
-
}
|
|
173
|
-
|
|
174
|
-
var _this = this;
|
|
169
|
+
}
|
|
170
|
+
getProjectId() {
|
|
175
171
|
if (this.projectId) {
|
|
176
172
|
return Promise.resolve(this.projectId);
|
|
177
173
|
}
|
|
178
|
-
|
|
174
|
+
const request = this.buildRequest(GOOGLE_METADATA_SERVICE_PROJECT_ID_PATH);
|
|
179
175
|
return this.httpClient.send(request)
|
|
180
|
-
.then(
|
|
181
|
-
|
|
182
|
-
return
|
|
176
|
+
.then((resp) => {
|
|
177
|
+
this.projectId = resp.text;
|
|
178
|
+
return this.projectId;
|
|
183
179
|
})
|
|
184
|
-
.catch(
|
|
185
|
-
|
|
186
|
-
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL,
|
|
180
|
+
.catch((err) => {
|
|
181
|
+
const detail = (err instanceof api_request_1.HttpError) ? getDetailFromResponse(err.response) : err.message;
|
|
182
|
+
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, `Failed to determine project ID: ${detail}`);
|
|
187
183
|
});
|
|
188
|
-
}
|
|
189
|
-
|
|
190
|
-
var _this = this;
|
|
184
|
+
}
|
|
185
|
+
getServiceAccountEmail() {
|
|
191
186
|
if (this.accountId) {
|
|
192
187
|
return Promise.resolve(this.accountId);
|
|
193
188
|
}
|
|
194
|
-
|
|
189
|
+
const request = this.buildRequest(GOOGLE_METADATA_SERVICE_ACCOUNT_ID_PATH);
|
|
195
190
|
return this.httpClient.send(request)
|
|
196
|
-
.then(
|
|
197
|
-
|
|
198
|
-
return
|
|
191
|
+
.then((resp) => {
|
|
192
|
+
this.accountId = resp.text;
|
|
193
|
+
return this.accountId;
|
|
199
194
|
})
|
|
200
|
-
.catch(
|
|
201
|
-
|
|
202
|
-
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL,
|
|
195
|
+
.catch((err) => {
|
|
196
|
+
const detail = (err instanceof api_request_1.HttpError) ? getDetailFromResponse(err.response) : err.message;
|
|
197
|
+
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, `Failed to determine service account email: ${detail}`);
|
|
203
198
|
});
|
|
204
|
-
}
|
|
205
|
-
|
|
199
|
+
}
|
|
200
|
+
buildRequest(urlPath) {
|
|
206
201
|
return {
|
|
207
202
|
method: 'GET',
|
|
208
|
-
url:
|
|
203
|
+
url: `http://${GOOGLE_METADATA_SERVICE_HOST}${urlPath}`,
|
|
209
204
|
headers: {
|
|
210
205
|
'Metadata-Flavor': 'Google',
|
|
211
206
|
},
|
|
212
207
|
httpAgent: this.httpAgent,
|
|
213
208
|
};
|
|
214
|
-
}
|
|
215
|
-
|
|
216
|
-
}());
|
|
209
|
+
}
|
|
210
|
+
}
|
|
217
211
|
exports.ComputeEngineCredential = ComputeEngineCredential;
|
|
218
212
|
/**
|
|
219
213
|
* Implementation of Credential that gets access tokens from refresh tokens.
|
|
220
214
|
*/
|
|
221
|
-
|
|
215
|
+
class RefreshTokenCredential {
|
|
222
216
|
/**
|
|
223
217
|
* Creates a new RefreshTokenCredential from the given parameters.
|
|
224
218
|
*
|
|
@@ -230,8 +224,7 @@ var RefreshTokenCredential = /** @class */ (function () {
|
|
|
230
224
|
*
|
|
231
225
|
* @constructor
|
|
232
226
|
*/
|
|
233
|
-
|
|
234
|
-
if (implicit === void 0) { implicit = false; }
|
|
227
|
+
constructor(refreshTokenPathOrObject, httpAgent, implicit = false) {
|
|
235
228
|
this.httpAgent = httpAgent;
|
|
236
229
|
this.implicit = implicit;
|
|
237
230
|
this.refreshToken = (typeof refreshTokenPathOrObject === 'string') ?
|
|
@@ -239,14 +232,14 @@ var RefreshTokenCredential = /** @class */ (function () {
|
|
|
239
232
|
: new RefreshToken(refreshTokenPathOrObject);
|
|
240
233
|
this.httpClient = new api_request_1.HttpClient();
|
|
241
234
|
}
|
|
242
|
-
|
|
243
|
-
|
|
235
|
+
getAccessToken() {
|
|
236
|
+
const postData = 'client_id=' + this.refreshToken.clientId + '&' +
|
|
244
237
|
'client_secret=' + this.refreshToken.clientSecret + '&' +
|
|
245
238
|
'refresh_token=' + this.refreshToken.refreshToken + '&' +
|
|
246
239
|
'grant_type=refresh_token';
|
|
247
|
-
|
|
240
|
+
const request = {
|
|
248
241
|
method: 'POST',
|
|
249
|
-
url:
|
|
242
|
+
url: `https://${REFRESH_TOKEN_HOST}${REFRESH_TOKEN_PATH}`,
|
|
250
243
|
headers: {
|
|
251
244
|
'Content-Type': 'application/x-www-form-urlencoded',
|
|
252
245
|
},
|
|
@@ -254,17 +247,16 @@ var RefreshTokenCredential = /** @class */ (function () {
|
|
|
254
247
|
httpAgent: this.httpAgent,
|
|
255
248
|
};
|
|
256
249
|
return requestAccessToken(this.httpClient, request);
|
|
257
|
-
}
|
|
258
|
-
|
|
259
|
-
}());
|
|
250
|
+
}
|
|
251
|
+
}
|
|
260
252
|
exports.RefreshTokenCredential = RefreshTokenCredential;
|
|
261
|
-
|
|
262
|
-
|
|
253
|
+
class RefreshToken {
|
|
254
|
+
constructor(json) {
|
|
263
255
|
copyAttr(this, json, 'clientId', 'client_id');
|
|
264
256
|
copyAttr(this, json, 'clientSecret', 'client_secret');
|
|
265
257
|
copyAttr(this, json, 'refreshToken', 'refresh_token');
|
|
266
258
|
copyAttr(this, json, 'type', 'type');
|
|
267
|
-
|
|
259
|
+
let errorMessage;
|
|
268
260
|
if (!util.isNonEmptyString(this.clientId)) {
|
|
269
261
|
errorMessage = 'Refresh token must contain a "client_id" property.';
|
|
270
262
|
}
|
|
@@ -285,7 +277,7 @@ var RefreshToken = /** @class */ (function () {
|
|
|
285
277
|
* Tries to load a RefreshToken from a path. Throws if the path doesn't exist or the
|
|
286
278
|
* data at the path is invalid.
|
|
287
279
|
*/
|
|
288
|
-
|
|
280
|
+
static fromPath(filePath) {
|
|
289
281
|
try {
|
|
290
282
|
return new RefreshToken(JSON.parse(fs.readFileSync(filePath, 'utf8')));
|
|
291
283
|
}
|
|
@@ -293,9 +285,8 @@ var RefreshToken = /** @class */ (function () {
|
|
|
293
285
|
// Throw a nicely formed error message if the file contents cannot be parsed
|
|
294
286
|
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Failed to parse refresh token file: ' + error);
|
|
295
287
|
}
|
|
296
|
-
}
|
|
297
|
-
|
|
298
|
-
}());
|
|
288
|
+
}
|
|
289
|
+
}
|
|
299
290
|
/**
|
|
300
291
|
* Checks if the given credential was loaded via the application default credentials mechanism. This
|
|
301
292
|
* includes all ComputeEngineCredential instances, and the ServiceAccountCredential and RefreshTokenCredential
|
|
@@ -316,7 +307,7 @@ function getApplicationDefault(httpAgent) {
|
|
|
316
307
|
}
|
|
317
308
|
// It is OK to not have this file. If it is present, it must be valid.
|
|
318
309
|
if (GCLOUD_CREDENTIAL_PATH) {
|
|
319
|
-
|
|
310
|
+
const refreshToken = readCredentialFile(GCLOUD_CREDENTIAL_PATH, true);
|
|
320
311
|
if (refreshToken) {
|
|
321
312
|
return new RefreshTokenCredential(refreshToken, httpAgent, true);
|
|
322
313
|
}
|
|
@@ -336,7 +327,7 @@ exports.getApplicationDefault = getApplicationDefault;
|
|
|
336
327
|
* @param alt - Alternative name of the property to copy.
|
|
337
328
|
*/
|
|
338
329
|
function copyAttr(to, from, key, alt) {
|
|
339
|
-
|
|
330
|
+
const tmp = from[key] || from[alt];
|
|
340
331
|
if (typeof tmp !== 'undefined') {
|
|
341
332
|
to[key] = tmp;
|
|
342
333
|
}
|
|
@@ -345,13 +336,13 @@ function copyAttr(to, from, key, alt) {
|
|
|
345
336
|
* Obtain a new OAuth2 token by making a remote service call.
|
|
346
337
|
*/
|
|
347
338
|
function requestAccessToken(client, request) {
|
|
348
|
-
return client.send(request).then(
|
|
349
|
-
|
|
339
|
+
return client.send(request).then((resp) => {
|
|
340
|
+
const json = resp.data;
|
|
350
341
|
if (!json.access_token || !json.expires_in) {
|
|
351
|
-
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL,
|
|
342
|
+
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, `Unexpected response while fetching access token: ${JSON.stringify(json)}`);
|
|
352
343
|
}
|
|
353
344
|
return json;
|
|
354
|
-
}).catch(
|
|
345
|
+
}).catch((err) => {
|
|
355
346
|
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, getErrorMessage(err));
|
|
356
347
|
});
|
|
357
348
|
}
|
|
@@ -359,8 +350,8 @@ function requestAccessToken(client, request) {
|
|
|
359
350
|
* Constructs a human-readable error message from the given Error.
|
|
360
351
|
*/
|
|
361
352
|
function getErrorMessage(err) {
|
|
362
|
-
|
|
363
|
-
return
|
|
353
|
+
const detail = (err instanceof api_request_1.HttpError) ? getDetailFromResponse(err.response) : err.message;
|
|
354
|
+
return `Error fetching access token: ${detail}`;
|
|
364
355
|
}
|
|
365
356
|
/**
|
|
366
357
|
* Extracts details from the given HTTP error response, and returns a human-readable description. If
|
|
@@ -369,8 +360,8 @@ function getErrorMessage(err) {
|
|
|
369
360
|
*/
|
|
370
361
|
function getDetailFromResponse(response) {
|
|
371
362
|
if (response.isJson() && response.data.error) {
|
|
372
|
-
|
|
373
|
-
|
|
363
|
+
const json = response.data;
|
|
364
|
+
let detail = json.error;
|
|
374
365
|
if (json.error_description) {
|
|
375
366
|
detail += ' (' + json.error_description + ')';
|
|
376
367
|
}
|
|
@@ -379,7 +370,7 @@ function getDetailFromResponse(response) {
|
|
|
379
370
|
return response.text || 'Missing error payload';
|
|
380
371
|
}
|
|
381
372
|
function credentialFromFile(filePath, httpAgent) {
|
|
382
|
-
|
|
373
|
+
const credentialsFile = readCredentialFile(filePath);
|
|
383
374
|
if (typeof credentialsFile !== 'object' || credentialsFile === null) {
|
|
384
375
|
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Failed to parse contents of the credentials file as an object');
|
|
385
376
|
}
|
|
@@ -392,7 +383,7 @@ function credentialFromFile(filePath, httpAgent) {
|
|
|
392
383
|
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Invalid contents in the credentials file');
|
|
393
384
|
}
|
|
394
385
|
function readCredentialFile(filePath, ignoreMissing) {
|
|
395
|
-
|
|
386
|
+
let fileText;
|
|
396
387
|
try {
|
|
397
388
|
fileText = fs.readFileSync(filePath, 'utf8');
|
|
398
389
|
}
|
|
@@ -400,7 +391,7 @@ function readCredentialFile(filePath, ignoreMissing) {
|
|
|
400
391
|
if (ignoreMissing) {
|
|
401
392
|
return null;
|
|
402
393
|
}
|
|
403
|
-
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL,
|
|
394
|
+
throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, `Failed to read credentials from file ${filePath}: ` + error);
|
|
404
395
|
}
|
|
405
396
|
try {
|
|
406
397
|
return JSON.parse(fileText);
|
package/lib/app/credential.d.ts
CHANGED
package/lib/app/credential.js
CHANGED