auth

Author: samtstern

auth/custom_claims.js

@@ -1,4 +1,6 @@
 'use strict';
+const express = require('express');
+
 const admin = require('firebase-admin');
 admin.initializeApp();
 
@@ -77,3 +79,76 @@ admin
     console.log(error);
   });
 // [END set_custom_user_claims_incremental]
+
+function customClaimsCloudFunction() {
+  // [START auth_custom_claims_cloud_function]
+  const functions = require('firebase-functions');
+
+  const admin = require('firebase-admin');
+  admin.initializeApp();
+
+  // On sign up.
+  exports.processSignUp = functions.auth.user().onCreate(async (user) => {
+    // Check if user meets role criteria.
+    if (
+      user.email &&
+      user.email.endsWith('@admin.example.com') &&
+      user.emailVerified
+    ) {
+      const customClaims = {
+        admin: true,
+        accessLevel: 9
+      };
+
+      try {
+        // Set custom user claims on this newly created user.
+        await admin.auth().setCustomUserClaims(user.uid, customClaims);
+
+        // Update real-time database to notify client to force refresh.
+        const metadataRef = admin.database().ref("metadata/" + user.uid);
+
+        // Set the refresh time to the current UTC timestamp.
+        // This will be captured on the client to force a token refresh.
+        await  metadataRef.set({refreshTime: new Date().getTime()});
+      } catch (error) {
+        console.log(error);
+      }
+    }
+  });
+  // [END auth_custom_claims_cloud_function]
+}
+
+function customClaimsServer() {
+  const app = express();
+
+  // [START auth_custom_claims_server]
+  app.post('/setCustomClaims', async (req, res) => {
+    // Get the ID token passed.
+    const idToken = req.body.idToken;
+
+    // Verify the ID token and decode its payload.
+    const claims = await admin.auth().verifyIdToken(idToken);
+
+    // Verify user is eligible for additional privileges.
+    if (
+      typeof claims.email !== 'undefined' &&
+      typeof claims.email_verified !== 'undefined' &&
+      claims.email_verified &&
+      claims.email.endsWith('@admin.example.com')
+    ) {
+      // Add custom claims for additional privileges.
+      await admin.auth().setCustomUserClaims(claims.sub, {
+        admin: true
+      });
+
+      // Tell client to refresh token on user.
+      res.end(JSON.stringify({
+        status: 'success'
+      }));
+    } else {
+      // Return nothing.
+      res.end(JSON.stringify({ status: 'ineligible' }));
+    }
+  });
+  // [END auth_custom_claims_server]
+}