Prototype of login via prototyper in Studio #8938

joehan · 2025-08-04T22:51:40Z

Description

Early prototype of a noninteractive login flow for use in Studio prototyper.

Using it

Roughly, we'll do something like:

import fbt from "firebase-tools"
const res = await fbt.login({prototyperLogin: true});

// Show the user the sessionId and send them to the URI to do the login flow
console.log(res.sessionId);
console.log(res.uri);
// After the flow, user copy + pastes an authorization code
// We pass that to res.authorize to exchange it for a OAuth token and save their creds to configstore
await res.authorize(authCode);
}

gemini-code-assist

Summary of Changes

Hello @joehan, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a new, non-interactive login flow specifically designed for the Studio prototyper environment. It extends the existing authentication module with a programmatic way to initiate and complete user login, bypassing traditional interactive prompts and reauthentication checks when enabled.

Highlights

New Non-Interactive Login Flow: I've introduced a new loginPrototyper function in src/auth.ts. This function facilitates a non-interactive login flow, returning a URI for the user to initiate authentication and an authorize method to complete the process with an authorization code. This is designed for environments like the Studio prototyper where direct user interaction with the CLI for login is not feasible.
Integration with login Command: The login command in src/commands/login.ts has been updated to accept a new prototyperLogin option. When this option is provided, the command delegates to the new loginPrototyper function, enabling the non-interactive flow. This allows programmatic login via the firebase-tools module.
Bypassing Interactive Checks: To support the non-interactive nature of the prototyper login, I've modified the login command's logic to bypass the standard nonInteractive error and the reauth check when the prototyperLogin option is active. This ensures the flow can proceed without requiring user prompts or checking for existing credentials.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments or fill out our survey to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces a prototype for a non-interactive login flow for Studio. The changes are well-contained, adding a new loginPrototyper function and integrating it into the existing login command. My review focuses on improving error handling and robustness, and I've identified a critical issue with command-line option processing that could affect the default login behavior. Overall, this is a good starting point for the new feature.

gemini-code-assist · 2025-08-04T22:53:55Z

src/commands/login.ts

    // Default to using the authorization code flow when the end
    // user is within a cloud-based environment, and therefore,
    // the authorization callback couldn't redirect to localhost.
-    const useLocalhost = isCloudEnvironment() ? false : options.localhost;
-
+    const useLocalhost = isCloudEnvironment() ? false : !!options.localhost;


The logic for determining useLocalhost appears to be incorrect. The --no-localhost option implies that using localhost is the default behavior (true). If options.localhost is undefined when the flag is not provided, !!options.localhost evaluates to false, which is the opposite of the intended default. This would break the standard login flow for users not in a cloud environment.

Suggested change

const useLocalhost = isCloudEnvironment() ? false : !!options.localhost;

const useLocalhost = isCloudEnvironment() ? false : options.localhost !== false;

gemini-code-assist · 2025-08-04T22:53:56Z

src/auth.ts

+  const attestToken = (
+    await authProxyClient.post<{ session_id: string }, { token: string }>("/attest", {
+      session_id: sessionId,
+    })
+  ).body?.token;


The current implementation doesn't handle the case where authProxyClient.post returns a response without a body or a body without a token. This would result in attestToken being undefined, which would then be embedded in the loginUrl, likely breaking the authentication flow.

Please add a check for the token and throw an error if it's missing.

Suggested change

const attestToken = (

await authProxyClient.post<{ session_id: string }, { token: string }>("/attest", {

session_id: sessionId,

})

).body?.token;

const attestRes = await authProxyClient.post<{ session_id: string }, { token: string }>("/attest", {

session_id: sessionId,

});

const attestToken = attestRes.body?.token;

if (!attestToken) {

throw new FirebaseError("Failed to get attestation token, please try again.");

}

gemini-code-assist · 2025-08-04T22:53:56Z

src/auth.ts

+        return {
+          user: jwt.decode(tokens.id_token!, { json: true }) as any as User,
+          tokens: tokens,
+          scopes: SCOPES,
+        };


The jwt.decode function can return null or a string, and tokens.id_token can be undefined. The current code uses a non-null assertion ! and a broad type cast as any as User, which can lead to runtime errors or incorrect data being returned if the token is invalid or missing. It's safer to handle these cases explicitly to ensure type safety and prevent unexpected runtime failures.

const decodedUser = jwt.decode(tokens.id_token || "", { json: true }); if (!decodedUser || typeof decodedUser === "string") { throw new FirebaseError("Authentication failed: could not decode user token."); } return { user: decodedUser as User, tokens: tokens, scopes: SCOPES, };

gemini-code-assist · 2025-08-04T22:53:56Z

src/auth.ts

+      } catch (e) {
+        throw new FirebaseError(
+          "Unable to authenticate using the provided code. Please try again.",
+        );
+      }


The catch block currently swallows the original error, which can make debugging difficult if an unexpected issue occurs during authorization. It would be helpful to log the original error for better diagnostics.

} catch (e: unknown) { logger.debug("Prototyper login authorization failed:", e); throw new FirebaseError( "Unable to authenticate using the provided code. Please try again.", ); }

Prototype of login via prototyper in Studio

a3e984f

github-project-automation bot added this to [Cloud] Extensions + Functions Aug 4, 2025

gemini-code-assist bot reviewed Aug 4, 2025

View reviewed changes

joehan added 3 commits August 4, 2025 16:24

Actually record it

13bbdcf

Merge remote-tracking branch 'origin/master' into jh-prototyper-auth

23cfabd

Fleshing this out with consent and extra query param

381f8bb

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Prototype of login via prototyper in Studio #8938

Prototype of login via prototyper in Studio #8938

Uh oh!

joehan commented Aug 4, 2025 •

edited

Loading

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Aug 4, 2025

Uh oh!

gemini-code-assist bot Aug 4, 2025

Uh oh!

gemini-code-assist bot Aug 4, 2025

Uh oh!

gemini-code-assist bot Aug 4, 2025

Uh oh!

Uh oh!

	const useLocalhost = isCloudEnvironment() ? false : !!options.localhost;
	const useLocalhost = isCloudEnvironment() ? false : options.localhost !== false;

Prototype of login via prototyper in Studio #8938

Are you sure you want to change the base?

Prototype of login via prototyper in Studio #8938

Uh oh!

Conversation

joehan commented Aug 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Using it

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

joehan commented Aug 4, 2025 •

edited

Loading