Firebase-functions: Document event.auth for uid and admin

Created on 15 Nov 2017 · 13Comments · Source: firebase/firebase-functions

As per discussion in this StackOverflow answer, Cloud Function events from Realtime Database includes an undocumented object auth. It includes an admin boolean field, and optionally, a variable object that contains an uid field.

{
  "admin": false,
  "variable": {
    "provider": "<PROVIDER>",
    "provider_id": "<PROVIDER>",
    "user_id": "<UID>",
    "token": {
      // Decoded auth token claims such as sub, aud, iat, exp, etc.
    },
    "uid": "<UID>"
  }
}

This is helpful for a Cloud Function to decide if an event should be ignored depending on who triggered it, and would also help avoiding an infinite loop.

I have consulted the Text Moderation with Cloud Functions sample code. Unfortunately, a separated field would not be helpful in an delete event.

Please document the event.auth object and make it an official public API. Thanks!

Source

EdmondChuiHW

👍9

Most helpful comment

Working on it! It'll be a part of our 1.0.0 release (date TBD)

laurenzlong on 26 Feb 2018

❤10

All 13 comments

+1
This data could for example be used in cloud functions to stop flooding attacks from certain accounts, that could be quite hard to do with only security rules.

daevid66 on 16 Nov 2017

👍3

This feature has not been documented because, while it was necessary to make some of our approved APIs work, it did not get approval as an externally facing API. We are working on a new shape for Events in GCF that _will_ meet the bar, but it will look different from this.

inlined on 16 Nov 2017

👍3

Should we expect this to change in the future and this data not be available?

patrickmichalina on 21 Nov 2017

👍1

It may change in format, but the functionality will not disappear.

laurenzlong on 21 Nov 2017

👍1

@patrickmichalina We will not break already-deployed functions, but there will eventually be an SDK update that may make this field go away.

inlined on 21 Nov 2017

👍3

I see, so it sounds unsafe to reference at this time. It would be super useful to acquire current user credentials to persist in the DB during function execution. Great work by the way, changing the way I build my apps!

patrickmichalina on 21 Nov 2017

Yep, you got it. Thanks for the kind words!

laurenzlong on 21 Nov 2017

👍1

@laurenzlong @inlined thanks for the info. Is there a milestone or some place for us to see the progress (now that the issue is closed)?

EdmondChuiHW on 21 Nov 2017

Thanks for the question. Any changes to interface will be part of release notes (https://github.com/firebase/firebase-functions/releases). Unfortunately, the team doesn't currently have the bandwidth to maintain a public feature/milestone tracker.

laurenzlong on 21 Nov 2017

👍3

Hi,

How is the state of this? It would be great to have this functionality.

Thank you!