Skip to content

Commit b86b8e9

Browse files
daytonmuxlahirumaramba
daytonmux
authored and
lahirumaramba
committed
feat(auth): Enhance emulator support across authentication classes
- Updated constructors in `AuthResourceUrlBuilder`, `TenantAwareAuthResourceUrlBuilder`, `AuthHttpClient`, and `AbstractAuthRequestHandler` to accept an optional emulator host parameter. - Modified token generation and verification methods in `BaseAuth` to utilize the emulator mode based on the new parameter. - Added tests to ensure correct behavior of emulator settings, including persistence after environment variable changes. - Improved handling of emulator state in `TenantManager` and `TenantAwareAuth` classes.
1 parent c9db870 commit b86b8e9

5 files changed

Lines changed: 193 additions & 28 deletions

File tree

‎src/auth/auth-api-request.ts‎

Lines changed: 34 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -127,14 +127,15 @@ class AuthResourceUrlBuilder {
127127
/**
128128
* The resource URL builder constructor.
129129
*
130-
* @param projectId - The resource project ID.
130+
* @param app - The app for this URL builder.
131131
* @param version - The endpoint API version.
132+
* @param emulatorHost - Optional emulator host captured at init time.
132133
* @constructor
133134
*/
134-
constructor(protected app: App, protected version: string = 'v1') {
135-
if (useEmulator()) {
135+
constructor(protected app: App, protected version: string = 'v1', emHost?: string) {
136+
if (emHost) {
136137
this.urlFormat = utils.formatString(FIREBASE_AUTH_EMULATOR_BASE_URL_FORMAT, {
137-
host: emulatorHost()
138+
host: emHost
138139
});
139140
} else {
140141
this.urlFormat = FIREBASE_AUTH_BASE_URL_FORMAT;
@@ -191,16 +192,17 @@ class TenantAwareAuthResourceUrlBuilder extends AuthResourceUrlBuilder {
191192
/**
192193
* The tenant aware resource URL builder constructor.
193194
*
194-
* @param projectId - The resource project ID.
195+
* @param app - The app for this URL builder.
195196
* @param version - The endpoint API version.
196197
* @param tenantId - The tenant ID.
198+
* @param emHost - Optional emulator host captured at init time.
197199
* @constructor
198200
*/
199-
constructor(protected app: App, protected version: string, protected tenantId: string) {
200-
super(app, version);
201-
if (useEmulator()) {
201+
constructor(protected app: App, protected version: string, protected tenantId: string, emHost?: string) {
202+
super(app, version, emHost);
203+
if (emHost) {
202204
this.urlFormat = utils.formatString(FIREBASE_AUTH_EMULATOR_TENANT_URL_FORMAT, {
203-
host: emulatorHost()
205+
host: emHost
204206
});
205207
} else {
206208
this.urlFormat = FIREBASE_AUTH_TENANT_URL_FORMAT;
@@ -229,8 +231,15 @@ class TenantAwareAuthResourceUrlBuilder extends AuthResourceUrlBuilder {
229231
*/
230232
class AuthHttpClient extends AuthorizedHttpClient {
231233

234+
private readonly isEmulator: boolean;
235+
236+
constructor(app: FirebaseApp, isEmulator: boolean) {
237+
super(app);
238+
this.isEmulator = isEmulator;
239+
}
240+
232241
protected getToken(): Promise<string> {
233-
if (useEmulator()) {
242+
if (this.isEmulator) {
234243
return Promise.resolve('owner');
235244
}
236245

@@ -1048,6 +1057,7 @@ const LIST_INBOUND_SAML_CONFIGS = new ApiSettings('/inboundSamlConfigs', 'GET')
10481057
export abstract class AbstractAuthRequestHandler {
10491058

10501059
protected readonly httpClient: AuthorizedHttpClient;
1060+
public readonly emulatorHostValue: string | undefined;
10511061
private authUrlBuilder: AuthResourceUrlBuilder;
10521062
private projectConfigUrlBuilder: AuthResourceUrlBuilder;
10531063

@@ -1102,17 +1112,21 @@ export abstract class AbstractAuthRequestHandler {
11021112

11031113
/**
11041114
* @param app - The app used to fetch access tokens to sign API requests.
1115+
* @param emHost - Optional emulator host override. When provided (including
1116+
* null for explicitly no emulator), this value is used instead of reading
1117+
* from the FIREBASE_AUTH_EMULATOR_HOST environment variable.
11051118
* @constructor
11061119
*/
1107-
constructor(protected readonly app: App) {
1120+
constructor(protected readonly app: App, emHost?: string | null) {
11081121
if (typeof app !== 'object' || app === null || !('options' in app)) {
11091122
throw new FirebaseAuthError(
11101123
authClientErrorCode.INVALID_ARGUMENT,
11111124
'First argument passed to admin.auth() must be a valid Firebase app instance.',
11121125
);
11131126
}
11141127

1115-
this.httpClient = new AuthHttpClient(app as FirebaseApp);
1128+
this.emulatorHostValue = emHost !== undefined ? (emHost || undefined) : emulatorHost();
1129+
this.httpClient = new AuthHttpClient(app as FirebaseApp, !!this.emulatorHostValue);
11161130
}
11171131

11181132
/**
@@ -2135,21 +2149,21 @@ export class AuthRequestHandler extends AbstractAuthRequestHandler {
21352149
*/
21362150
constructor(app: App) {
21372151
super(app);
2138-
this.authResourceUrlBuilder = new AuthResourceUrlBuilder(app, 'v2');
2152+
this.authResourceUrlBuilder = new AuthResourceUrlBuilder(app, 'v2', this.emulatorHostValue);
21392153
}
21402154

21412155
/**
21422156
* @returns A new Auth user management resource URL builder instance.
21432157
*/
21442158
protected newAuthUrlBuilder(): AuthResourceUrlBuilder {
2145-
return new AuthResourceUrlBuilder(this.app, 'v1');
2159+
return new AuthResourceUrlBuilder(this.app, 'v1', this.emulatorHostValue);
21462160
}
21472161

21482162
/**
21492163
* @returns A new project config resource URL builder instance.
21502164
*/
21512165
protected newProjectConfigUrlBuilder(): AuthResourceUrlBuilder {
2152-
return new AuthResourceUrlBuilder(this.app, 'v2');
2166+
return new AuthResourceUrlBuilder(this.app, 'v2', this.emulatorHostValue);
21532167
}
21542168

21552169
/**
@@ -2306,24 +2320,25 @@ export class TenantAwareAuthRequestHandler extends AbstractAuthRequestHandler {
23062320
*
23072321
* @param app - The app used to fetch access tokens to sign API requests.
23082322
* @param tenantId - The request handler's tenant ID.
2323+
* @param emHost - Optional emulator host override captured at init time.
23092324
* @constructor
23102325
*/
2311-
constructor(app: App, private readonly tenantId: string) {
2312-
super(app);
2326+
constructor(app: App, private readonly tenantId: string, emHost?: string | null) {
2327+
super(app, emHost);
23132328
}
23142329

23152330
/**
23162331
* @returns A new Auth user management resource URL builder instance.
23172332
*/
23182333
protected newAuthUrlBuilder(): AuthResourceUrlBuilder {
2319-
return new TenantAwareAuthResourceUrlBuilder(this.app, 'v1', this.tenantId);
2334+
return new TenantAwareAuthResourceUrlBuilder(this.app, 'v1', this.tenantId, this.emulatorHostValue);
23202335
}
23212336

23222337
/**
23232338
* @returns A new project config resource URL builder instance.
23242339
*/
23252340
protected newProjectConfigUrlBuilder(): AuthResourceUrlBuilder {
2326-
return new TenantAwareAuthResourceUrlBuilder(this.app, 'v2', this.tenantId);
2341+
return new TenantAwareAuthResourceUrlBuilder(this.app, 'v2', this.tenantId, this.emulatorHostValue);
23272342
}
23282343

23292344
/**

‎src/auth/base-auth.ts‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -117,9 +117,10 @@ export interface SessionCookieOptions {
117117
* @internal
118118
*/
119119
export function createFirebaseTokenGenerator(app: App,
120-
tenantId?: string): FirebaseTokenGenerator {
120+
tenantId?: string, isEmulator?: boolean): FirebaseTokenGenerator {
121121
try {
122-
const signer = useEmulator() ? new EmulatedSigner() : cryptoSignerFromApp(app);
122+
const shouldEmulate = isEmulator !== undefined ? isEmulator : useEmulator();
123+
const signer = shouldEmulate ? new EmulatedSigner() : cryptoSignerFromApp(app);
123124
return new FirebaseTokenGenerator(signer, tenantId);
124125
} catch (err) {
125126
throw handleCryptoSignerError(err);
@@ -139,6 +140,7 @@ export abstract class BaseAuth {
139140
protected readonly authBlockingTokenVerifier: FirebaseTokenVerifier;
140141
/** @internal */
141142
protected readonly sessionCookieVerifier: FirebaseTokenVerifier;
143+
private readonly emulatorMode: boolean;
142144

143145
/**
144146
* The BaseAuth class constructor.
@@ -155,6 +157,8 @@ export abstract class BaseAuth {
155157
app: App,
156158
/** @internal */ protected readonly authRequestHandler: AbstractAuthRequestHandler,
157159
tokenGenerator?: FirebaseTokenGenerator) {
160+
this.emulatorMode = !!this.authRequestHandler.emulatorHostValue;
161+
158162
if (tokenGenerator) {
159163
this.tokenGenerator = tokenGenerator;
160164
} else {
@@ -211,7 +215,7 @@ export abstract class BaseAuth {
211215
* promise.
212216
*/
213217
public verifyIdToken(idToken: string, checkRevoked = false): Promise<DecodedIdToken> {
214-
const isEmulator = useEmulator();
218+
const isEmulator = this.emulatorMode;
215219
return this.idTokenVerifier.verifyJWT(idToken, isEmulator)
216220
.then((decodedIdToken: DecodedIdToken) => {
217221
// Whether to check if the token was revoked.
@@ -717,7 +721,7 @@ export abstract class BaseAuth {
717721
*/
718722
public verifySessionCookie(
719723
sessionCookie: string, checkRevoked = false): Promise<DecodedIdToken> {
720-
const isEmulator = useEmulator();
724+
const isEmulator = this.emulatorMode;
721725
return this.sessionCookieVerifier.verifyJWT(sessionCookie, isEmulator)
722726
.then((decodedIdToken: DecodedIdToken) => {
723727
// Whether to check if the token was revoked.
@@ -1095,10 +1099,10 @@ export abstract class BaseAuth {
10951099
/** @alpha */
10961100
// eslint-disable-next-line @typescript-eslint/naming-convention
10971101
public _verifyAuthBlockingToken(
1098-
token: string,
1102+
token: string,
10991103
audience?: string
11001104
): Promise<DecodedAuthBlockingToken> {
1101-
const isEmulator = useEmulator();
1105+
const isEmulator = this.emulatorMode;
11021106
return this.authBlockingTokenVerifier._verifyAuthBlockingToken(token, isEmulator, audience)
11031107
.then((decodedAuthBlockingToken: DecodedAuthBlockingToken) => {
11041108
return decodedAuthBlockingToken;

‎src/auth/tenant-manager.ts‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -76,12 +76,15 @@ export class TenantAwareAuth extends BaseAuth {
7676
*
7777
* @param app - The app that created this tenant.
7878
* @param tenantId - The corresponding tenant ID.
79+
* @param emHost - Optional emulator host captured at init time.
7980
* @constructor
8081
* @internal
8182
*/
82-
constructor(app: App, tenantId: string) {
83+
constructor(app: App, tenantId: string, emHost?: string | null) {
84+
const emIsSet = emHost !== undefined;
8385
super(app, new TenantAwareAuthRequestHandler(
84-
app, tenantId), createFirebaseTokenGenerator(app, tenantId));
86+
app, tenantId, emHost), createFirebaseTokenGenerator(
87+
app, tenantId, emIsSet ? !!emHost : undefined));
8588
utils.addReadonlyGetter(this, 'tenantId', tenantId);
8689
}
8790

@@ -148,6 +151,7 @@ export class TenantAwareAuth extends BaseAuth {
148151
export class TenantManager {
149152
private readonly authRequestHandler: AuthRequestHandler;
150153
private readonly tenantsMap: {[key: string]: TenantAwareAuth};
154+
private readonly emulatorHost: string | undefined;
151155

152156
/**
153157
* Initializes a TenantManager instance for a specified FirebaseApp.
@@ -159,6 +163,7 @@ export class TenantManager {
159163
*/
160164
constructor(private readonly app: App) {
161165
this.authRequestHandler = new AuthRequestHandler(app);
166+
this.emulatorHost = this.authRequestHandler.emulatorHostValue;
162167
this.tenantsMap = {};
163168
}
164169

@@ -174,7 +179,7 @@ export class TenantManager {
174179
throw new FirebaseAuthError(authClientErrorCode.INVALID_TENANT_ID);
175180
}
176181
if (typeof this.tenantsMap[tenantId] === 'undefined') {
177-
this.tenantsMap[tenantId] = new TenantAwareAuth(this.app, tenantId);
182+
this.tenantsMap[tenantId] = new TenantAwareAuth(this.app, tenantId, this.emulatorHost ?? null);
178183
}
179184
return this.tenantsMap[tenantId];
180185
}

‎test/unit/auth/auth-api-request.spec.ts‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -959,6 +959,50 @@ AUTH_REQUEST_HANDLER_TESTS.forEach((handler) => {
959959
});
960960
});
961961
});
962+
963+
it('should keep using emulator after env var is deleted', () => {
964+
const emulatorHost = 'localhost:9099';
965+
process.env.FIREBASE_AUTH_EMULATOR_HOST = emulatorHost;
966+
967+
const stub = sinon.stub(HttpClient.prototype, 'send').resolves(expectedResult);
968+
stubs.push(stub);
969+
970+
const requestHandler = handler.init(mockApp);
971+
delete process.env.FIREBASE_AUTH_EMULATOR_HOST;
972+
973+
return requestHandler.getAccountInfoByUid('uid')
974+
.then(() => {
975+
expect(stub).to.have.been.calledOnce.and.calledWith({
976+
method,
977+
url: `http://${emulatorHost}/identitytoolkit.googleapis.com${path}`,
978+
data,
979+
headers: expectedHeadersEmulator,
980+
timeout,
981+
});
982+
});
983+
});
984+
985+
it('should not use emulator when env var is set after initialization', () => {
986+
delete process.env.FIREBASE_AUTH_EMULATOR_HOST;
987+
988+
const stub = sinon.stub(HttpClient.prototype, 'send').resolves(expectedResult);
989+
stubs.push(stub);
990+
991+
const requestHandler = handler.init(mockApp);
992+
process.env.FIREBASE_AUTH_EMULATOR_HOST = 'localhost:9099';
993+
994+
return requestHandler.getAccountInfoByUid('uid')
995+
.then(() => {
996+
expect(stub).to.have.been.calledOnce.and.calledWith({
997+
method,
998+
url: `https://${host}${path}`,
999+
data,
1000+
headers: expectedHeaders,
1001+
timeout,
1002+
});
1003+
delete process.env.FIREBASE_AUTH_EMULATOR_HOST;
1004+
});
1005+
});
9621006
});
9631007

9641008
describe('createSessionCookie', () => {

0 commit comments

Comments
 (0)