1 |
|
2 | "use strict";
|
3 |
|
4 |
|
5 |
|
6 |
|
7 |
|
8 |
|
9 |
|
10 |
|
11 |
|
12 |
|
13 |
|
14 |
|
15 |
|
16 |
|
17 |
|
18 |
|
19 | Object.defineProperty(exports, "__esModule", { value: true });
|
20 | exports.getApplicationDefault = exports.isApplicationDefault = exports.ImpersonatedServiceAccountCredential = exports.RefreshTokenCredential = exports.ComputeEngineCredential = exports.ServiceAccountCredential = void 0;
|
21 | const fs = require("fs");
|
22 | const os = require("os");
|
23 | const path = require("path");
|
24 | const error_1 = require("../utils/error");
|
25 | const api_request_1 = require("../utils/api-request");
|
26 | const util = require("../utils/validator");
|
27 | const GOOGLE_TOKEN_AUDIENCE = 'https://accounts.google.com/o/oauth2/token';
|
28 | const GOOGLE_AUTH_TOKEN_HOST = 'accounts.google.com';
|
29 | const GOOGLE_AUTH_TOKEN_PATH = '/o/oauth2/token';
|
30 |
|
31 | const GOOGLE_METADATA_SERVICE_HOST = 'metadata.google.internal';
|
32 | const GOOGLE_METADATA_SERVICE_TOKEN_PATH = '/computeMetadata/v1/instance/service-accounts/default/token';
|
33 | const GOOGLE_METADATA_SERVICE_IDENTITY_PATH = '/computeMetadata/v1/instance/service-accounts/default/identity';
|
34 | const GOOGLE_METADATA_SERVICE_PROJECT_ID_PATH = '/computeMetadata/v1/project/project-id';
|
35 | const GOOGLE_METADATA_SERVICE_ACCOUNT_ID_PATH = '/computeMetadata/v1/instance/service-accounts/default/email';
|
36 | const configDir = (() => {
|
37 |
|
38 | const sys = os.platform();
|
39 | if (sys && sys.length >= 3 && sys.substring(0, 3).toLowerCase() === 'win') {
|
40 | return process.env.APPDATA;
|
41 | }
|
42 |
|
43 | return process.env.HOME && path.resolve(process.env.HOME, '.config');
|
44 | })();
|
45 | const GCLOUD_CREDENTIAL_SUFFIX = 'gcloud/application_default_credentials.json';
|
46 | const GCLOUD_CREDENTIAL_PATH = configDir && path.resolve(configDir, GCLOUD_CREDENTIAL_SUFFIX);
|
47 | const REFRESH_TOKEN_HOST = 'www.googleapis.com';
|
48 | const REFRESH_TOKEN_PATH = '/oauth2/v4/token';
|
49 | const ONE_HOUR_IN_SECONDS = 60 * 60;
|
50 | const JWT_ALGORITHM = 'RS256';
|
51 |
|
52 |
|
53 |
|
54 | class ServiceAccountCredential {
|
55 | |
56 |
|
57 |
|
58 |
|
59 |
|
60 |
|
61 |
|
62 |
|
63 |
|
64 |
|
65 | constructor(serviceAccountPathOrObject, httpAgent, implicit = false) {
|
66 | this.httpAgent = httpAgent;
|
67 | this.implicit = implicit;
|
68 | const serviceAccount = (typeof serviceAccountPathOrObject === 'string') ?
|
69 | ServiceAccount.fromPath(serviceAccountPathOrObject)
|
70 | : new ServiceAccount(serviceAccountPathOrObject);
|
71 | this.projectId = serviceAccount.projectId;
|
72 | this.privateKey = serviceAccount.privateKey;
|
73 | this.clientEmail = serviceAccount.clientEmail;
|
74 | this.httpClient = new api_request_1.HttpClient();
|
75 | }
|
76 | getAccessToken() {
|
77 | const token = this.createAuthJwt_();
|
78 | const postData = 'grant_type=urn%3Aietf%3Aparams%3Aoauth%3A' +
|
79 | 'grant-type%3Ajwt-bearer&assertion=' + token;
|
80 | const request = {
|
81 | method: 'POST',
|
82 | url: `https://${GOOGLE_AUTH_TOKEN_HOST}${GOOGLE_AUTH_TOKEN_PATH}`,
|
83 | headers: {
|
84 | 'Content-Type': 'application/x-www-form-urlencoded',
|
85 | },
|
86 | data: postData,
|
87 | httpAgent: this.httpAgent,
|
88 | };
|
89 | return requestAccessToken(this.httpClient, request);
|
90 | }
|
91 |
|
92 | createAuthJwt_() {
|
93 | const claims = {
|
94 | scope: [
|
95 | 'https://www.googleapis.com/auth/cloud-platform',
|
96 | 'https://www.googleapis.com/auth/firebase.database',
|
97 | 'https://www.googleapis.com/auth/firebase.messaging',
|
98 | 'https://www.googleapis.com/auth/identitytoolkit',
|
99 | 'https://www.googleapis.com/auth/userinfo.email',
|
100 | ].join(' '),
|
101 | };
|
102 |
|
103 | const jwt = require('jsonwebtoken');
|
104 |
|
105 | return jwt.sign(claims, this.privateKey, {
|
106 | audience: GOOGLE_TOKEN_AUDIENCE,
|
107 | expiresIn: ONE_HOUR_IN_SECONDS,
|
108 | issuer: this.clientEmail,
|
109 | algorithm: JWT_ALGORITHM,
|
110 | });
|
111 | }
|
112 | }
|
113 | exports.ServiceAccountCredential = ServiceAccountCredential;
|
114 |
|
115 |
|
116 |
|
117 | class ServiceAccount {
|
118 | static fromPath(filePath) {
|
119 | try {
|
120 | return new ServiceAccount(JSON.parse(fs.readFileSync(filePath, 'utf8')));
|
121 | }
|
122 | catch (error) {
|
123 |
|
124 | throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Failed to parse service account json file: ' + error);
|
125 | }
|
126 | }
|
127 | constructor(json) {
|
128 | if (!util.isNonNullObject(json)) {
|
129 | throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Service account must be an object.');
|
130 | }
|
131 | copyAttr(this, json, 'projectId', 'project_id');
|
132 | copyAttr(this, json, 'privateKey', 'private_key');
|
133 | copyAttr(this, json, 'clientEmail', 'client_email');
|
134 | let errorMessage;
|
135 | if (!util.isNonEmptyString(this.projectId)) {
|
136 | errorMessage = 'Service account object must contain a string "project_id" property.';
|
137 | }
|
138 | else if (!util.isNonEmptyString(this.privateKey)) {
|
139 | errorMessage = 'Service account object must contain a string "private_key" property.';
|
140 | }
|
141 | else if (!util.isNonEmptyString(this.clientEmail)) {
|
142 | errorMessage = 'Service account object must contain a string "client_email" property.';
|
143 | }
|
144 | if (typeof errorMessage !== 'undefined') {
|
145 | throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, errorMessage);
|
146 | }
|
147 |
|
148 | const forge = require('node-forge');
|
149 | try {
|
150 | forge.pki.privateKeyFromPem(this.privateKey);
|
151 | }
|
152 | catch (error) {
|
153 | throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Failed to parse private key: ' + error);
|
154 | }
|
155 | }
|
156 | }
|
157 |
|
158 |
|
159 |
|
160 |
|
161 |
|
162 | class ComputeEngineCredential {
|
163 | constructor(httpAgent) {
|
164 | this.httpClient = new api_request_1.HttpClient();
|
165 | this.httpAgent = httpAgent;
|
166 | }
|
167 | getAccessToken() {
|
168 | const request = this.buildRequest(GOOGLE_METADATA_SERVICE_TOKEN_PATH);
|
169 | return requestAccessToken(this.httpClient, request);
|
170 | }
|
171 | |
172 |
|
173 |
|
174 |
|
175 |
|
176 | getIDToken(audience) {
|
177 | const request = this.buildRequest(`${GOOGLE_METADATA_SERVICE_IDENTITY_PATH}?audience=${audience}`);
|
178 | return requestIDToken(this.httpClient, request);
|
179 | }
|
180 | getProjectId() {
|
181 | if (this.projectId) {
|
182 | return Promise.resolve(this.projectId);
|
183 | }
|
184 | const request = this.buildRequest(GOOGLE_METADATA_SERVICE_PROJECT_ID_PATH);
|
185 | return this.httpClient.send(request)
|
186 | .then((resp) => {
|
187 | this.projectId = resp.text;
|
188 | return this.projectId;
|
189 | })
|
190 | .catch((err) => {
|
191 | const detail = (err instanceof api_request_1.HttpError) ? getDetailFromResponse(err.response) : err.message;
|
192 | throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, `Failed to determine project ID: ${detail}`);
|
193 | });
|
194 | }
|
195 | getServiceAccountEmail() {
|
196 | if (this.accountId) {
|
197 | return Promise.resolve(this.accountId);
|
198 | }
|
199 | const request = this.buildRequest(GOOGLE_METADATA_SERVICE_ACCOUNT_ID_PATH);
|
200 | return this.httpClient.send(request)
|
201 | .then((resp) => {
|
202 | this.accountId = resp.text;
|
203 | return this.accountId;
|
204 | })
|
205 | .catch((err) => {
|
206 | const detail = (err instanceof api_request_1.HttpError) ? getDetailFromResponse(err.response) : err.message;
|
207 | throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, `Failed to determine service account email: ${detail}`);
|
208 | });
|
209 | }
|
210 | buildRequest(urlPath) {
|
211 | return {
|
212 | method: 'GET',
|
213 | url: `http://${GOOGLE_METADATA_SERVICE_HOST}${urlPath}`,
|
214 | headers: {
|
215 | 'Metadata-Flavor': 'Google',
|
216 | },
|
217 | httpAgent: this.httpAgent,
|
218 | };
|
219 | }
|
220 | }
|
221 | exports.ComputeEngineCredential = ComputeEngineCredential;
|
222 |
|
223 |
|
224 |
|
225 | class RefreshTokenCredential {
|
226 | |
227 |
|
228 |
|
229 |
|
230 |
|
231 |
|
232 |
|
233 |
|
234 |
|
235 |
|
236 |
|
237 | constructor(refreshTokenPathOrObject, httpAgent, implicit = false) {
|
238 | this.httpAgent = httpAgent;
|
239 | this.implicit = implicit;
|
240 | this.refreshToken = (typeof refreshTokenPathOrObject === 'string') ?
|
241 | RefreshToken.fromPath(refreshTokenPathOrObject)
|
242 | : new RefreshToken(refreshTokenPathOrObject);
|
243 | this.httpClient = new api_request_1.HttpClient();
|
244 | }
|
245 | getAccessToken() {
|
246 | const postData = 'client_id=' + this.refreshToken.clientId + '&' +
|
247 | 'client_secret=' + this.refreshToken.clientSecret + '&' +
|
248 | 'refresh_token=' + this.refreshToken.refreshToken + '&' +
|
249 | 'grant_type=refresh_token';
|
250 | const request = {
|
251 | method: 'POST',
|
252 | url: `https://${REFRESH_TOKEN_HOST}${REFRESH_TOKEN_PATH}`,
|
253 | headers: {
|
254 | 'Content-Type': 'application/x-www-form-urlencoded',
|
255 | },
|
256 | data: postData,
|
257 | httpAgent: this.httpAgent,
|
258 | };
|
259 | return requestAccessToken(this.httpClient, request);
|
260 | }
|
261 | }
|
262 | exports.RefreshTokenCredential = RefreshTokenCredential;
|
263 | class RefreshToken {
|
264 | |
265 |
|
266 |
|
267 |
|
268 | static fromPath(filePath) {
|
269 | try {
|
270 | return new RefreshToken(JSON.parse(fs.readFileSync(filePath, 'utf8')));
|
271 | }
|
272 | catch (error) {
|
273 |
|
274 | throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Failed to parse refresh token file: ' + error);
|
275 | }
|
276 | }
|
277 | constructor(json) {
|
278 | copyAttr(this, json, 'clientId', 'client_id');
|
279 | copyAttr(this, json, 'clientSecret', 'client_secret');
|
280 | copyAttr(this, json, 'refreshToken', 'refresh_token');
|
281 | copyAttr(this, json, 'type', 'type');
|
282 | let errorMessage;
|
283 | if (!util.isNonEmptyString(this.clientId)) {
|
284 | errorMessage = 'Refresh token must contain a "client_id" property.';
|
285 | }
|
286 | else if (!util.isNonEmptyString(this.clientSecret)) {
|
287 | errorMessage = 'Refresh token must contain a "client_secret" property.';
|
288 | }
|
289 | else if (!util.isNonEmptyString(this.refreshToken)) {
|
290 | errorMessage = 'Refresh token must contain a "refresh_token" property.';
|
291 | }
|
292 | else if (!util.isNonEmptyString(this.type)) {
|
293 | errorMessage = 'Refresh token must contain a "type" property.';
|
294 | }
|
295 | if (typeof errorMessage !== 'undefined') {
|
296 | throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, errorMessage);
|
297 | }
|
298 | }
|
299 | }
|
300 |
|
301 |
|
302 |
|
303 | class ImpersonatedServiceAccountCredential {
|
304 | |
305 |
|
306 |
|
307 |
|
308 |
|
309 |
|
310 |
|
311 |
|
312 |
|
313 |
|
314 |
|
315 | constructor(impersonatedServiceAccountPathOrObject, httpAgent, implicit = false) {
|
316 | this.httpAgent = httpAgent;
|
317 | this.implicit = implicit;
|
318 | this.impersonatedServiceAccount = (typeof impersonatedServiceAccountPathOrObject === 'string') ?
|
319 | ImpersonatedServiceAccount.fromPath(impersonatedServiceAccountPathOrObject)
|
320 | : new ImpersonatedServiceAccount(impersonatedServiceAccountPathOrObject);
|
321 | this.httpClient = new api_request_1.HttpClient();
|
322 | }
|
323 | getAccessToken() {
|
324 | const postData = 'client_id=' + this.impersonatedServiceAccount.clientId + '&' +
|
325 | 'client_secret=' + this.impersonatedServiceAccount.clientSecret + '&' +
|
326 | 'refresh_token=' + this.impersonatedServiceAccount.refreshToken + '&' +
|
327 | 'grant_type=refresh_token';
|
328 | const request = {
|
329 | method: 'POST',
|
330 | url: `https://${REFRESH_TOKEN_HOST}${REFRESH_TOKEN_PATH}`,
|
331 | headers: {
|
332 | 'Content-Type': 'application/x-www-form-urlencoded',
|
333 | },
|
334 | data: postData,
|
335 | httpAgent: this.httpAgent,
|
336 | };
|
337 | return requestAccessToken(this.httpClient, request);
|
338 | }
|
339 | }
|
340 | exports.ImpersonatedServiceAccountCredential = ImpersonatedServiceAccountCredential;
|
341 |
|
342 |
|
343 |
|
344 | class ImpersonatedServiceAccount {
|
345 | |
346 |
|
347 |
|
348 |
|
349 | static fromPath(filePath) {
|
350 | try {
|
351 | return new ImpersonatedServiceAccount(JSON.parse(fs.readFileSync(filePath, 'utf8')));
|
352 | }
|
353 | catch (error) {
|
354 |
|
355 | throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Failed to parse impersonated service account file: ' + error);
|
356 | }
|
357 | }
|
358 | constructor(json) {
|
359 | const sourceCredentials = json['source_credentials'];
|
360 | if (sourceCredentials) {
|
361 | copyAttr(this, sourceCredentials, 'clientId', 'client_id');
|
362 | copyAttr(this, sourceCredentials, 'clientSecret', 'client_secret');
|
363 | copyAttr(this, sourceCredentials, 'refreshToken', 'refresh_token');
|
364 | copyAttr(this, sourceCredentials, 'type', 'type');
|
365 | }
|
366 | let errorMessage;
|
367 | if (!util.isNonEmptyString(this.clientId)) {
|
368 | errorMessage = 'Impersonated Service Account must contain a "source_credentials.client_id" property.';
|
369 | }
|
370 | else if (!util.isNonEmptyString(this.clientSecret)) {
|
371 | errorMessage = 'Impersonated Service Account must contain a "source_credentials.client_secret" property.';
|
372 | }
|
373 | else if (!util.isNonEmptyString(this.refreshToken)) {
|
374 | errorMessage = 'Impersonated Service Account must contain a "source_credentials.refresh_token" property.';
|
375 | }
|
376 | else if (!util.isNonEmptyString(this.type)) {
|
377 | errorMessage = 'Impersonated Service Account must contain a "source_credentials.type" property.';
|
378 | }
|
379 | if (typeof errorMessage !== 'undefined') {
|
380 | throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, errorMessage);
|
381 | }
|
382 | }
|
383 | }
|
384 |
|
385 |
|
386 |
|
387 |
|
388 |
|
389 |
|
390 |
|
391 |
|
392 | function isApplicationDefault(credential) {
|
393 | return credential instanceof ComputeEngineCredential ||
|
394 | (credential instanceof ServiceAccountCredential && credential.implicit) ||
|
395 | (credential instanceof RefreshTokenCredential && credential.implicit) ||
|
396 | (credential instanceof ImpersonatedServiceAccountCredential && credential.implicit);
|
397 | }
|
398 | exports.isApplicationDefault = isApplicationDefault;
|
399 | function getApplicationDefault(httpAgent) {
|
400 | if (process.env.GOOGLE_APPLICATION_CREDENTIALS) {
|
401 | return credentialFromFile(process.env.GOOGLE_APPLICATION_CREDENTIALS, httpAgent, false);
|
402 | }
|
403 |
|
404 | if (GCLOUD_CREDENTIAL_PATH) {
|
405 | const credential = credentialFromFile(GCLOUD_CREDENTIAL_PATH, httpAgent, true);
|
406 | if (credential)
|
407 | return credential;
|
408 | }
|
409 | return new ComputeEngineCredential(httpAgent);
|
410 | }
|
411 | exports.getApplicationDefault = getApplicationDefault;
|
412 |
|
413 |
|
414 |
|
415 |
|
416 |
|
417 |
|
418 |
|
419 |
|
420 |
|
421 |
|
422 |
|
423 | function copyAttr(to, from, key, alt) {
|
424 | const tmp = from[key] || from[alt];
|
425 | if (typeof tmp !== 'undefined') {
|
426 | to[key] = tmp;
|
427 | }
|
428 | }
|
429 |
|
430 |
|
431 |
|
432 | function requestAccessToken(client, request) {
|
433 | return client.send(request).then((resp) => {
|
434 | const json = resp.data;
|
435 | if (!json.access_token || !json.expires_in) {
|
436 | throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, `Unexpected response while fetching access token: ${JSON.stringify(json)}`);
|
437 | }
|
438 | return json;
|
439 | }).catch((err) => {
|
440 | throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, getErrorMessage(err));
|
441 | });
|
442 | }
|
443 |
|
444 |
|
445 |
|
446 | function requestIDToken(client, request) {
|
447 | return client.send(request).then((resp) => {
|
448 | if (!resp.text) {
|
449 | throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Unexpected response while fetching id token: response.text is undefined');
|
450 | }
|
451 | return resp.text;
|
452 | }).catch((err) => {
|
453 | throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, getErrorMessage(err));
|
454 | });
|
455 | }
|
456 |
|
457 |
|
458 |
|
459 | function getErrorMessage(err) {
|
460 | const detail = (err instanceof api_request_1.HttpError) ? getDetailFromResponse(err.response) : err.message;
|
461 | return `Error fetching access token: ${detail}`;
|
462 | }
|
463 |
|
464 |
|
465 |
|
466 |
|
467 |
|
468 | function getDetailFromResponse(response) {
|
469 | if (response.isJson() && response.data.error) {
|
470 | const json = response.data;
|
471 | let detail = json.error;
|
472 | if (json.error_description) {
|
473 | detail += ' (' + json.error_description + ')';
|
474 | }
|
475 | return detail;
|
476 | }
|
477 | return response.text || 'Missing error payload';
|
478 | }
|
479 | function credentialFromFile(filePath, httpAgent, ignoreMissing) {
|
480 | const credentialsFile = readCredentialFile(filePath, ignoreMissing);
|
481 | if (typeof credentialsFile !== 'object' || credentialsFile === null) {
|
482 | if (ignoreMissing) {
|
483 | return null;
|
484 | }
|
485 | throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Failed to parse contents of the credentials file as an object');
|
486 | }
|
487 | if (credentialsFile.type === 'service_account') {
|
488 | return new ServiceAccountCredential(credentialsFile, httpAgent, true);
|
489 | }
|
490 | if (credentialsFile.type === 'authorized_user') {
|
491 | return new RefreshTokenCredential(credentialsFile, httpAgent, true);
|
492 | }
|
493 | if (credentialsFile.type === 'impersonated_service_account') {
|
494 | return new ImpersonatedServiceAccountCredential(credentialsFile, httpAgent, true);
|
495 | }
|
496 | throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Invalid contents in the credentials file');
|
497 | }
|
498 | function readCredentialFile(filePath, ignoreMissing) {
|
499 | let fileText;
|
500 | try {
|
501 | fileText = fs.readFileSync(filePath, 'utf8');
|
502 | }
|
503 | catch (error) {
|
504 | if (ignoreMissing) {
|
505 | return null;
|
506 | }
|
507 | throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, `Failed to read credentials from file ${filePath}: ` + error);
|
508 | }
|
509 | try {
|
510 | return JSON.parse(fileText);
|
511 | }
|
512 | catch (error) {
|
513 | throw new error_1.FirebaseAppError(error_1.AppErrorCodes.INVALID_CREDENTIAL, 'Failed to parse contents of the credentials file as an object: ' + error);
|
514 | }
|
515 | }
|