0

I am developing an API for a third-party application not related to Firebase. This API consist of cloud functions to create and add users to database, retrieve user information and so on. These functions are created using the admin SDK. Example of a function that adds a user looks like this:


export const getUser = functions.https.onRequest(async (req, res) => {
    res.set('Access-Control-Allow-Origin', '*');
    if (req.method === 'OPTIONS') {
        res.set('Access-Control-Allow-Headers', 'Content-Type');
        res.set('Access-Control-Max-Age', '3600');
        res.status(204).send('');
    } else {
    
        
        const utils = ethers.utils;
        const method = req.method;
        const body = req.body;
        const address = body.address;
        const userAddress = utils.getAddress(address);
    
        let logging = "received address: " + address + " checksum address: " + userAddress;
        let success = false;

        const db = admin.firestore();
        const collectionRef = db.collection('users');
        
        // Count all matching documents
        const query = collectionRef.where("userAddress", "==", userAddress);
        const snapshot = await query.get();

        // If no documents match, there is no matching user
        console.log(snapshot.docs.length);
        if (snapshot.docs.length != 1) {
            logging += "User does not exist in database.";
            res.send({success: success, logging: logging});
            return;
        }
        
        const data = snapshot.docs[0].data();

        if (data != undefined) {
            const createdAt = data.createdAt;
            const emailAddress = data.emailAddress;
            const userAddress = data.userAddress;
            const updatedAt = data.updatedAt;
            const userName = data.userName;
            success = true;

            res.send({success: success, createdAt: createdAt, emailAddress: emailAddress, userAddress: userAddress, updatedAt: updatedAt, userName: userName, logging: logging});
        } 
    }
});

NOTE: These functions are NOT going to be called by the third-party application users, only by the third-party application itself.

I am pretty new at programming so I understand that this may not be the best way to code this functionality and I'm greatful for any tips you might have here as well. Anyway, back to my question. I'm trying to mimic the way that my customer is going to invoke these functions. So to test it, I'm using the following code:

function runGetUser() {
    // test values
    const address = 'myMetaMaskWalletAddress';
    axios({
        method: 'POST',
        url: 'http://127.0.0.1:5001/cloud-functions/us-central1/user-getUser',
        data: { "address": address },
    }).then((response) => {
        console.log(response.data);
    }).catch((error) => {
      console.log(error);
    }); 
};

This works fine. However, I do not want anyone to be able to invoke these functions when I actually deploy them later. So I have been reading Firebase docs and googling on how to setup proper authentication and authorization measures. What I have found is setting up a service account and using gcloud CLI to download credentials and then invoke the functions with these credentials set. Is there not a way that I could configure this so that I query my API for an authorization token (from the file where the axios request is) that I then put in the axios request and then invoke the function with this? How do I do this in that case? Right now also, since I'm testing locally, on the "cloud function server-side" as you can see in my cloud function example, I'm allowing all requests. How do I filter here so that only the axios request with the proper authorization token/(header?) is authorized to invoke this function?

Thank you for taking the time to read this. Best regards,

Aliz

I tried following the instructions on this page: https://cloud.google.com/functions/docs/securing/authenticating#gcloud where I tried to just invoke the functions from the Gcloud CLI. I followed the instructions and ran the command "gcloud auth login --update-adc", and got the response: "Application default credentials (ADC) were updated." Then I tried to invoke a function I have "helloWorld" to just see that it works with the following command: curl -H "Authorization: bearer $(gcloud auth print-identity-token)" \http://127.0.0.1:5001/cloud-functions/us-central1/helloWorld", and I got the following response: "curl: (3) URL using bad/illegal format or missing URL". So I don't know what to do more.

Alice Pettersson
  • 1

0 Answers0