Is it possible to differentiate a request triggered from Cloud Functions in Firestore rules from a user authenticated one?

user_1527470 0
Viewed 56

The "Extend with Cloud Functions" section of the docs says:

Cloud Functions execute in a trusted environment, which means they are authorized as a service account on your project. You can perform reads and writes using the Firebase Admin SDK:

The API reference for rules says the request.auth will contain the uid and token map. Neither firebase.identities nor firebase.sign_in_provider seem to contain a "serviceAccount" key to specify how the request are authorised.

Use case: I have implemented a role based mechanic for users and would like to allow an operation for some roles and allow delete: if request.auth.uid != null && isOneOfRoles(['super-admin', 'admin']);. I cannot solely rely on checking request.auth.uid != null;.

firebase-security google-cloud-functions google-cloud-firestore firebase-authentication firebase
1 Answers

Requests made from Cloud Functions using the firebase-admin SDK will not be evaluated by Security Rules. They use service account authorization which means they are exempt from rules.

You could attempt to use the Web SDK from Cloud Functions if you want to authorize as a user and have your writes protected by security rules. You could use Custom Auth to create user accounts for use within Cloud Functions, although this would probably slow things down as you'd have to authenticate inside every function call before using the SDK.

user_3249770
Related