diff --git a/README.md b/README.md index 6aa7bdc..22352a2 100644 --- a/README.md +++ b/README.md @@ -129,18 +129,16 @@ See the [ID Token section of the OpenID Connect spec](http://openid.net/specs/op - `idToken` The ID token to verify. - `env` is an optional parameter. but this is using to detect should use emulator or not. -### `WorkersKVStoreSingle.getOrInitialize(cacheKey: string, cfKVNamespace: KVNamespace): WorkersKVStoreSingle` - -WorkersKVStoreSingle is created as a singleton object. This is because the Module Worker syntax only use environment variables at the time of request. +### `authObj.verifySessionCookie(sessionCookie: string, env?: EmulatorEnv): Promise` -This caches the public key used to verify the Firebase ID token in the [Workers KV](https://developers.cloudflare.com/workers/runtime-apis/kv/). +Verifies a Firebase session cookie. Returns a Promise with the cookie claims. Rejects the promise if the cookie could not be verified. -This is implemented `KeyStorer` interface. +See [Verify Session Cookies](https://firebase.google.com/docs/auth/admin/manage-cookies#verify_session_cookie_and_check_permissions) for code samples and detailed documentation. -- `cacheKey` specifies the key of the public key cache. -- `cfKVNamespace` specifies the KV namespace which is bound your workers. +- `sessionCookie` The session cookie to verify. +- `env` is an optional parameter. but this is using to detect should use emulator or not. -### `createSessionCookie(idToken: string, sessionCookieOptions: SessionCookieOptions, env?: EmulatorEnv): Promise` +### `authObj.createSessionCookie(idToken: string, sessionCookieOptions: SessionCookieOptions, env?: EmulatorEnv): Promise` Creates a new Firebase session cookie with the specified options. The created JWT string can be set as a server-side session cookie with a custom cookie policy, and be used for session management. The session cookie JWT will have the same payload claims as the provided ID token. See [Manage Session Cookies](https://firebase.google.com/docs/auth/admin/manage-cookies) for code samples and detailed documentation. @@ -150,14 +148,24 @@ Creates a new Firebase session cookie with the specified options. The created JW **Required** service acccount credential to use this API. You need to set the credentials with `Auth.getOrInitialize`. -### `verifySessionCookie(sessionCookie: string, env?: EmulatorEnv): Promise` +### `WorkersKVStoreSingle.getOrInitialize(cacheKey: string, cfKVNamespace: KVNamespace): WorkersKVStoreSingle` -Verifies a Firebase session cookie. Returns a Promise with the cookie claims. Rejects the promise if the cookie could not be verified. +WorkersKVStoreSingle is created as a singleton object. This is because the Module Worker syntax only use environment variables at the time of request. -See [Verify Session Cookies](https://firebase.google.com/docs/auth/admin/manage-cookies#verify_session_cookie_and_check_permissions) for code samples and detailed documentation. +This caches the public key used to verify the Firebase ID token in the [Workers KV](https://developers.cloudflare.com/workers/runtime-apis/kv/). -- `sessionCookie` The session cookie to verify. -- `env` is an optional parameter. but this is using to detect should use emulator or not. +This is implemented `KeyStorer` interface. + +- `cacheKey` specifies the key of the public key cache. +- `cfKVNamespace` specifies the KV namespace which is bound your workers. + +### `AdminAuthApiClient.getOrInitialize(projectId: string, credential: Credential, retryConfig?: RetryConfig): AdminAuthApiClient` + +AdminAuthApiClient is created as a singleton object. This is because the Module Worker syntax only use environment variables at the time of request. + +You can send request with the [Admin Auth API](https://cloud.google.com/identity-platform/docs/reference/rest). To generate an access token, you will use the `Credential` class. For instance, if you want to generate an access token from a Service Account JSON, you need to specify `ServiceAccountCredential` as a parameter during initialization. + +By specifying the [`roles/firebaseauth.admin`](https://firebase.google.com/docs/projects/iam/roles-predefined-product#app-distro) role to the Service Account, it becomes available for use. If you want finer control over permissions, create a Custom Role based on the [Access Control](https://cloud.google.com/identity-platform/docs/access-control) guide and assign it to the Service Account. ### `emulatorHost(env?: EmulatorEnv): string | undefined` diff --git a/package.json b/package.json index 1dd47ff..e4a5948 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "firebase-auth-cloudflare-workers", - "version": "1.2.0", + "version": "1.2.1", "description": "Zero-dependencies firebase auth library for Cloudflare Workers.", "author": "codehex", "license": "MIT", @@ -25,7 +25,8 @@ "lint": "eslint --ext .ts .", "lint-fix": "eslint --fix --ext .ts .", "prepublish": "run-p build:*", - "wrangler": "wrangler" + "wrangler": "wrangler", + "version": "pnpm run build && git add -A dist" }, "devDependencies": { "@cloudflare/workers-types": "^4.20240208.0", diff --git a/src/index.ts b/src/index.ts index 317fa98..507b8b3 100644 --- a/src/index.ts +++ b/src/index.ts @@ -1,4 +1,6 @@ import { BaseAuth } from './auth'; +import { AuthApiClient } from './auth-api-requests'; +import type { RetryConfig } from './client'; import type { Credential } from './credential'; import type { KeyStorer } from './key-store'; import { WorkersKVStore } from './key-store'; @@ -8,17 +10,25 @@ export { emulatorHost, useEmulator } from './emulator'; export type { KeyStorer }; export type { EmulatorEnv } from './emulator'; export type { FirebaseIdToken } from './token-verifier'; +export type { RetryConfig }; export class Auth extends BaseAuth { private static instance?: Auth; + private static withCredential?: Auth; private constructor(projectId: string, keyStore: KeyStorer, credential?: Credential) { super(projectId, keyStore, credential); } static getOrInitialize(projectId: string, keyStore: KeyStorer, credential?: Credential): Auth { + if (!Auth.withCredential && credential !== undefined) { + Auth.withCredential = new Auth(projectId, keyStore, credential); + } + if (Auth.withCredential) { + return Auth.withCredential; + } if (!Auth.instance) { - Auth.instance = new Auth(projectId, keyStore, credential); + Auth.instance = new Auth(projectId, keyStore); } return Auth.instance; } @@ -38,3 +48,18 @@ export class WorkersKVStoreSingle extends WorkersKVStore { return WorkersKVStoreSingle.instance; } } + +export class AdminAuthApiClient extends AuthApiClient { + private static instance?: AdminAuthApiClient; + + private constructor(projectId: string, credential: Credential, retryConfig?: RetryConfig) { + super(projectId, credential, retryConfig); + } + + static getOrInitialize(projectId: string, credential: Credential, retryConfig?: RetryConfig) { + if (!AdminAuthApiClient.instance) { + AdminAuthApiClient.instance = new AdminAuthApiClient(projectId, credential, retryConfig); + } + return AdminAuthApiClient.instance; + } +} diff --git a/src/version.ts b/src/version.ts index 6252e59..46f91af 100644 --- a/src/version.ts +++ b/src/version.ts @@ -1 +1 @@ -export const version = '1.2.0'; +export const version = '1.2.1';