Firebase Admin: Acess database on behalf of third party admin

Question

I'm using Oauth2 to authenticate third party Firebase project owners with their Google account to grant access to their Firestore Cloud Platform Projects. My goal is to get database triggers running, not from my own database, but on a database owned by a third party admin, i.e a database I do not own or have direct access to.

For my own admin I would use, with my own service account:

const admin = require('firebase-admin');

const serviceAccount = require('./path/to/serviceAccountKey.json');

admin.initializeApp({
  credential: admin.credential.cert(serviceAccount)
});

const db = admin.firestore();

Is there a way for a third party Firebase admin to grant access to their database without manually sharing their project?

Open to options that are not exclusively via firebase-admin sdk?

Possible options would maybe something like:

1. Get third party access via Oauth
2. Exisiting Google Cloud API to get either their serviceAccount.json or Firebase Project Settings via Oauth permission or otherwise.

To achieve this:

const admin = require('firebase-admin');
    
   //Maybe this??
    const thirdPartyServiceAccount = require('./path/to/serviceAccountKey.json');
    
    admin.initializeApp({
      credential: admin.credential.cert(serviceAccount)
    });
    
   //Or this??  
    admin.initializeApp({
      credential: admin.credential.refreshToken(thirdPartyRefreshToken)
    });


    const thirdPartyDB = admin.firestore();

Similar questions do not seem to address my use case

How to use Admin SDK with limited privileges on Firestore?

Answer 1

When writing backend code to access Firestore using firebase-admin or any of the Google Cloud SDKs (not the web and mobile clients), all access is granted through the service account account that's used to initialize the SDK. This is the case for pretty much all Google Cloud products, and the auth system is called Cloud IAM.

If you want to give some party access to your database, the typical procedure is to create a service account, and grant it access to only the permissions that party needs. They can then use that service account to initialize the SDK they want to use, and IAM will make sure that the account can only take whatever actions have been allowed.