Support for creating custom tokens without service account credentials

CHANGELOG.md

@@ -1,5 +1,8 @@
 # Unreleased
 
+- [changed] Admin SDK can now create custom tokens without being initialized
+  with service account credentials. When a service account private key is not
+  available, the SDK uses the remote IAM service to sign JWTs in the cloud.
 - [changed] Admin SDK can now read the Firebase/GCP project ID from both
   `GCLOUD_PROJECT` and `GOOGLE_CLOUD_PROJECT` environment variables.
 

src/auth/auth.ts

@@ -16,7 +16,7 @@
 
 import {UserRecord, CreateRequest, UpdateRequest} from './user-record';
 import {FirebaseApp} from '../firebase-app';
-import {FirebaseTokenGenerator} from './token-generator';
+import {FirebaseTokenGenerator, signerFromApp} from './token-generator';
 import {FirebaseAuthRequestHandler} from './auth-api-request';
 import {AuthClientErrorCode, FirebaseAuthError, ErrorInfo} from '../utils/error';
 import {FirebaseServiceInterface, FirebaseServiceInternalsInterface} from '../firebase-service';
@@ -26,6 +26,7 @@ import {
 
 import * as utils from '../utils/index';
 import * as validator from '../utils/validator';
+import { FirebaseTokenVerifier, newSessionCookieVerifier, newIdTokenVerifier } from './token-verifier';
 
 
 /**
@@ -84,6 +85,8 @@ export class Auth implements FirebaseServiceInterface {
 
   private app_: FirebaseApp;
   private tokenGenerator_: FirebaseTokenGenerator;
+  private idTokenVerifier_: FirebaseTokenVerifier;
+  private sessionCookieVerifier_: FirebaseTokenVerifier;
   private authRequestHandler: FirebaseAuthRequestHandler;
 
   /**
@@ -99,27 +102,10 @@ export class Auth implements FirebaseServiceInterface {
     }
 
     this.app_ = app;
+    this.tokenGenerator_ = new FirebaseTokenGenerator(signerFromApp(app));
     const projectId = utils.getProjectId(app);
-
-    // TODO (inlined): plumb this into a factory method for tokenGenerator_ once we
-    // can generate custom tokens from access tokens.
-    let serviceAccount;
-    if (typeof app.options.credential.getCertificate === 'function') {
-      serviceAccount = app.options.credential.getCertificate();
-    }
-    if (serviceAccount) {
-      // Cert credentials and Application Default Credentials created from a service account file
-      // provide a certificate we can use to mint custom tokens and verify ID tokens.
-      this.tokenGenerator_ = new FirebaseTokenGenerator(serviceAccount);
-    } else if (validator.isNonEmptyString(projectId)) {
-      // Google infrastructure like GAE, GCE, and GCF store the GCP / Firebase project ID in an
-      // environment variable that we can use to get verifyIdToken() to work. createCustomToken()
-      // still won't work since it requires a private key and client email which we do not have.
-      const cert: any = {
-        projectId,
-      };
-      this.tokenGenerator_ = new FirebaseTokenGenerator(cert);
-    }
+    this.sessionCookieVerifier_ = newSessionCookieVerifier(projectId);
+    this.idTokenVerifier_ = newIdTokenVerifier(projectId);
     // Initialize auth request handler with the app.
     this.authRequestHandler = new FirebaseAuthRequestHandler(app);
   }
@@ -165,14 +151,7 @@ export class Auth implements FirebaseServiceInterface {
    *     verification.
    */
   public verifyIdToken(idToken: string, checkRevoked: boolean = false): Promise<object> {
-    if (typeof this.tokenGenerator_ === 'undefined') {
-      throw new FirebaseAuthError(
-        AuthClientErrorCode.INVALID_CREDENTIAL,
-        'Must initialize app with a cert credential or set your Firebase project ID as the ' +
-        'GOOGLE_CLOUD_PROJECT environment variable to call auth().verifyIdToken().',
-      );
-    }
-    return this.tokenGenerator_.verifyIdToken(idToken)
+    return this.idTokenVerifier_.verifyJWT(idToken)
       .then((decodedIdToken: DecodedIdToken) => {
         // Whether to check if the token was revoked.
         if (!checkRevoked) {
@@ -408,7 +387,7 @@ export class Auth implements FirebaseServiceInterface {
         'GOOGLE_CLOUD_PROJECT environment variable to call auth().verifySessionCookie().',
       );
     }
-    return this.tokenGenerator_.verifySessionCookie(sessionCookie)
+    return this.sessionCookieVerifier_.verifyJWT(sessionCookie)
       .then((decodedIdToken: DecodedIdToken) => {
         // Whether to check if the token was revoked.
         if (!checkRevoked) {