10000 Hack App Check API to test the REGAPIC client · oktest145/firebase-admin-python@5ffa694 · GitHub
[go: up one dir, main page]
Skip to content

Commit 5ffa694

Browse files
lahirumarambalahirumaramba
committed
Hack App Check API to test the REGAPIC client
1 parent b0de3f5 commit 5ffa694

File tree

23 files changed

+8811
-0
lines changed

23 files changed

+8811
-0
lines changed

‎firebase_admin/_token_gen.py

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,8 @@
4747
MAX_TOKEN_LIFETIME_SECONDS = int(datetime.timedelta(hours=1).total_seconds())
4848
FIREBASE_AUDIENCE = ('https://identitytoolkit.googleapis.com/google.'
4949
'identity.identitytoolkit.v1.IdentityToolkit')
50+
FIREBASE_APP_CHECK_AUDIENCE = ('https://firebaseappcheck.googleapis.com/google.'
51+
'firebase.appcheck.v1beta.TokenExchangeService')
5052
RESERVED_CLAIMS = set([
5153
'acr', 'amr', 'at_hash', 'aud', 'auth_time', 'azp', 'cnf', 'c_hash',
5254
'exp', 'firebase', 'iat', 'iss', 'jti', 'nbf', 'nonce', 'sub'
@@ -206,6 +208,31 @@ def create_custom_token(self, uid, developer_claims=None, tenant_id=None):
206208
raise TokenSignError(msg, error)
207209

208210

211+
def create_custom_token_fac(self, app_id):
212+
"""Builds and signs a Firebase custom FAC token."""
213+
214+
if not app_id or not isinstance(app_id, str):
215+
raise ValueError('app_id must be a string.')
216+
217+
signing_provider = self.signing_provider
218+
now = int(time.time())
219+
payload = {
220+
'iss': signing_provider.signer_email,
221+
'sub': signing_provider.signer_email,
222+
'aud': FIREBASE_APP_CHECK_AUDIENCE,
223+
'app_id': app_id,
224+
'iat': now,
225+
'exp': now + MAX_TOKEN_LIFETIME_SECONDS,
226+
}
227+
228+
header = {'alg': signing_provider.alg, 'typ': 'JWT'}
229+
try:
230+
return jwt.encode(signing_provider.signer, payload, header=header)
231+
except google.auth.exceptions.TransportError as error:
232+
msg = 'Failed to sign custom token. {0}'.format(error)
233+
raise TokenSignError(msg, error)
234+
235+
209236
def create_session_cookie(self, id_token, expires_in):
210237
"""Creates a session cookie from the provided ID token."""
211238
id_token = id_token.decode('utf-8') if isinstance(id_token, bytes) else id_token

‎firebase_admin/appcheck.py

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# Copyright 2021 Google Inc.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
"""Firebase App Check module.
16+
"""
17+
18+
try:
19+
from google.firebase import appcheck_v1beta
20+
existing = globals().keys()
21+
for key, value in appcheck_v1beta.__dict__.items():
22+
if not key.startswith('_') and key not in existing:
23+
globals()[key] = value
24+
except ImportError:
25+
raise ImportError('Failed to import the Firebase App Check library for Python. Make sure '
26+
'to install the "google-cloud-firestore" module.')
27+
28+
from firebase_admin import _token_gen
29+
from firebase_admin import _utils
30+
31+
32+
_FAC_ATTRIBUTE = '_appcheck'
33+
34+
35+
def _get_fac_service(app=None):
36+
return _utils.get_app_service(app, _FAC_ATTRIBUTE, _AppCheckClient.from_app)
37+
38+
def create_token(app_id, app=None):
39+
project_id = _get_fac_service(app).project_id()
40+
token = _get_fac_service(app).token_generator().create_custom_token_fac(app_id)
41+
payload = {}
42+
payload['app'] = 'projects/{project_number}/apps/{app_id}'.format(
43+
project_number=project_id, app_id=app_id)
44+
payload['custom_token'] = token
45+
return _get_fac_service(app).get().exchange_custom_token(payload)
46+
47+
48+
class _AppCheckClient:
49+
"""Holds a Firebase App Check client instance."""
50+
51+
def __init__(self, credentials, project, token_generator):
52+
self._project = project
53+
self._client = appcheck_v1beta.services.token_exchange_service.TokenExchangeServiceClient(
54+
credentials=credentials, transport='rest')
55+
self._token_generator = token_generator
56+
57+
def get(self):
58+
return self._client
59+
60+
def project_id(self):
61+
return self._project
62+
63+
def token_generator(self):
64+
return self._token_generator
65+
66+
@classmethod
67+
def from_app(cls, app):
68+
"""Creates a new _FirestoreClient for the specified app."""
69+
credentials = app.credential.get_credential()
70+
project = app.project_id
71+
token_generator = _token_gen.TokenGenerator(app, http_client=None)
72+
if not project:
73+
raise ValueError(
74+
'Project ID is required to access Firestore. Either set the projectId option, '
75+
'or use service account credentials. Alternatively, set the GOOGLE_CLOUD_PROJECT '
76+
'environment variable.')
77+
return _AppCheckClient(credentials, project, token_generator)

‎google/firebase/appcheck/__init__.py

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
# -*- coding: utf-8 -*-
2+
# Copyright 2020 Google LLC
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
#
16+
17+
from google.firebase.appcheck_v1beta.services.config_service.client import ConfigServiceClient
18+
from google.firebase.appcheck_v1beta.services.token_exchange_service.client import TokenExchangeServiceClient
19+
20+
from google.firebase.appcheck_v1beta.types.configuration import AppAttestConfig
21+
from google.firebase.appcheck_v1beta.types.configuration import BatchGetAppAttestConfigsRequest
22+
from google.firebase.appcheck_v1beta.types.configuration import BatchGetAppAttestConfigsResponse
23+
from google.firebase.appcheck_v1beta.types.configuration import BatchGetDeviceCheckConfigsRequest
24+
from google.firebase.appcheck_v1beta.types.configuration import BatchGetDeviceCheckConfigsResponse
25+
from google.firebase.appcheck_v1beta.types.configuration import BatchGetRecaptchaConfigsRequest
26+
from google.firebase.appcheck_v1beta.types.configuration import BatchGetRecaptchaConfigsResponse
27+
from google.firebase.appcheck_v1beta.types.configuration import BatchGetSafetyNetConfigsRequest
28+
from google.firebase.appcheck_v1beta.types.configuration import BatchGetSafetyNetConfigsResponse
29+
from google.firebase.appcheck_v1beta.types.configuration import BatchUpdateServicesRequest
30+
from google.firebase.appcheck_v1beta.types.configuration import BatchUpdateServicesResponse
31+
from google.firebase.appcheck_v1beta.types.configuration import CreateDebugTokenRequest
32+
from google.firebase.appcheck_v1beta.types.configuration import DebugToken
33+
from google.firebase.appcheck_v1beta.types.configuration import DeleteDebugTokenRequest
34+
from google.firebase.appcheck_v1beta.types.configuration import DeviceCheckConfig
35+
from google.firebase.appcheck_v1beta.types.configuration import GetAppAttestConfigRequest
36+
from google.firebase.appcheck_v1beta.types.configuration import GetDebugTokenRequest
37+
from google.firebase.appcheck_v1beta.types.configuration import GetDeviceCheckConfigRequest
38+
from google.firebase.appcheck_v1beta.types.configuration import GetRecaptchaConfigRequest
39+
from google.firebase.appcheck_v1beta.types.configuration import GetSafetyNetConfigRequest
40+
from google.firebase.appcheck_v1beta.types.configuration import GetServiceRequest
41+
from google.firebase.appcheck_v1beta.types.configuration import ListDebugTokensRequest
42+
from google.firebase.appcheck_v1beta.types.configuration import ListDebugTokensResponse
43+
from google.firebase.appcheck_v1beta.types.configuration import ListServicesRequest
44+
from google.firebase.appcheck_v1beta.types.configuration import ListServicesResponse
45+
from google.firebase.appcheck_v1beta.types.configuration import RecaptchaConfig
46+
from google.firebase.appcheck_v1beta.types.configuration import SafetyNetConfig
47+
from google.firebase.appcheck_v1beta.types.configuration import Service
48+
from google.firebase.appcheck_v1beta.types.configuration import UpdateAppAttestConfigRequest
49+
from google.firebase.appcheck_v1beta.types.configuration import UpdateDebugTokenRequest
50+
from google.firebase.appcheck_v1beta.types.configuration import UpdateDeviceCheckConfigRequest
51+
from google.firebase.appcheck_v1beta.types.configuration import UpdateRecaptchaConfigRequest
52+
from google.firebase.appcheck_v1beta.types.configuration import UpdateSafetyNetConfigRequest
53+
from google.firebase.appcheck_v1beta.types.configuration import UpdateServiceRequest
54+
from google.firebase.appcheck_v1beta.types.token_exchange_service import AppAttestChallengeResponse
55+
from google.firebase.appcheck_v1beta.types.token_exchange_service import AttestationTokenResponse
56+
from google.firebase.appcheck_v1beta.types.token_exchange_service import ExchangeAppAttestAssertionRequest
57+
from google.firebase.appcheck_v1beta.types.token_exchange_service import ExchangeAppAttestAttestationRequest
58+
from google.firebase.appcheck_v1beta.types.token_exchange_service import ExchangeAppAttestAttestationResponse
59+
from google.firebase.appcheck_v1beta.types.token_exchange_service import ExchangeCustomTokenRequest
60+
from google.firebase.appcheck_v1beta.types.token_exchange_service import ExchangeDebugTokenRequest
61+
from google.firebase.appcheck_v1beta.types.token_exchange_service import ExchangeDeviceCheckTokenRequest
62+
from google.firebase.appcheck_v1beta.types.token_exchange_service import ExchangeRecaptchaTokenRequest
63+
from google.firebase.appcheck_v1beta.types.token_exchange_service import ExchangeSafetyNetTokenRequest
64+
from google.firebase.appcheck_v1beta.types.token_exchange_service import GenerateAppAttestChallengeRequest
65+
from google.firebase.appcheck_v1beta.types.token_exchange_service import GetPublicJwkSetRequest
66+
from google.firebase.appcheck_v1beta.types.token_exchange_service import PublicJwk
67+
from google.firebase.appcheck_v1beta.types.token_exchange_service import PublicJwkSet
68+
69+
__all__ = ('ConfigServiceClient',
70+
'TokenExchangeServiceClient',
71+
'AppAttestConfig',
72+
'BatchGetAppAttestConfigsRequest',
73+
'BatchGetAppAttestConfigsResponse',
74+
'BatchGetDeviceCheckConfigsRequest',
75+
'BatchGetDeviceCheckConfigsResponse',
76+
'BatchGetRecaptchaConfigsRequest',
77+
'BatchGetRecaptchaConfigsResponse',
78+
'BatchGetSafetyNetConfigsRequest',
79+
'BatchGetSafetyNetConfigsResponse',
80+
'BatchUpdateServicesRequest',
81+
'BatchUpdateServicesResponse',
82+
'CreateDebugTokenRequest',
83+
'DebugToken',
84+
'DeleteDebugTokenRequest',
85+
'DeviceCheckConfig',
86+
'GetAppAttestConfigRequest',
87+
'GetDebugTokenRequest',
88+
'GetDeviceCheckConfigRequest',
89+
'GetRecaptchaConfigRequest',
90+
'GetSafetyNetConfigRequest',
91+
'GetServiceRequest',
92+
'ListDebugTokensRequest',
93+
'ListDebugTokensResponse',
94+
'ListServicesRequest',
95+
'ListServicesResponse',
96+
'RecaptchaConfig',
97+
'SafetyNetConfig',
98+
'Service',
99+
'UpdateAppAttestConfigRequest',
100+
'UpdateDebugTokenRequest',
101+
'UpdateDeviceCheckConfigRequest',
102+
'UpdateRecaptchaConfigRequest',
103+
'UpdateSafetyNetConfigRequest',
104+
'UpdateServiceRequest',
105+
'AppAttestChallengeResponse',
106+
'AttestationTokenResponse',
107+
'ExchangeAppAttestAssertionRequest',
108+
'ExchangeAppAttestAttestationRequest',
109+
'ExchangeAppAttestAttestationResponse',
110+
'ExchangeCustomTokenRequest',
111+
'ExchangeDebugTokenRequest',
112+
'ExchangeDeviceCheckTokenRequest',
113+
'ExchangeRecaptchaTokenRequest',
114+
'ExchangeSafetyNetTokenRequest',
115+
'GenerateAppAttestChallengeRequest',
116+
'GetPublicJwkSetRequest',
117+
'PublicJwk',
118+
'PublicJwkSet',
119+
)

‎google/firebase/appcheck/py.typed

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Marker file for PEP 561.
2+
# The google-firebase-appcheck package uses inline types.

‎google/firebase/appcheck_v1beta/__init__.py

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
# -*- coding: utf-8 -*-
2+
# Copyright 2020 Google LLC
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
#
16+
17+
from .services.config_service import ConfigServiceClient
18+
from .services.token_exchange_service import TokenExchangeServiceClient
19+
20+
from .types.configuration import AppAttestConfig
21+
from .types.configuration import BatchGetAppAttestConfigsRequest
22+
from .types.configuration import BatchGetAppAttestConfigsResponse
23+
from .types.configuration import BatchGetDeviceCheckConfigsRequest
24+
from .types.configuration import BatchGetDeviceCheckConfigsResponse
25+
from .types.configuration import BatchGetRecaptchaConfigsRequest
26+
from .types.configuration import BatchGetRecaptchaConfigsResponse
27+
from .types.configuration import BatchGetSafetyNetConfigsRequest
28+
from .types.configuration import BatchGetSafetyNetConfigsResponse
29+
from .types.configuration import BatchUpdateServicesRequest
30+
from .types.configuration import BatchUpdateServicesResponse
31+
from .types.configuration import CreateDebugTokenRequest
32+
from .types.configuration import DebugToken
33+
from .types.configuration import DeleteDebugTokenRequest
34+
from .types.configuration import DeviceCheckConfig
35+
from .types.configuration import GetAppAttestConfigRequest
36+
from .types.configuration import GetDebugTokenRequest
37+
from .types.configuration import GetDeviceCheckConfigRequest
38+
from .types.configuration import GetRecaptchaConfigRequest
39+
from .types.configuration import GetSafetyNetConfigRequest
40+
from .types.configuration import GetServiceRequest
41+
from .types.configuration import ListDebugTokensRequest
42+
from .types.configuration import ListDebugTokensResponse
43+
from .types.configuration import ListServicesRequest
44+
from .types.configuration import ListServicesResponse
45+
from .types.configuration import RecaptchaConfig
46+
from .types.configuration import SafetyNetConfig
47+
from .types.configuration import Service
48+
from .types.configuration import UpdateAppAttestConfigRequest
49+
from .types.configuration import UpdateDebugTokenRequest
50+
from .types.configuration import UpdateDeviceCheckConfigRequest
51+
from .types.configuration import UpdateRecaptchaConfigRequest
52+
from .types.configuration import UpdateSafetyNetConfigRequest
53+
from .types.configuration import UpdateServiceRequest
54+
from .types.token_exchange_service import AppAttestChallengeResponse
55+
from .types.token_exchange_service import AttestationTokenResponse
56+
from .types.token_exchange_service import ExchangeAppAttestAssertionRequest
57+
from .types.token_exchange_service import ExchangeAppAttestAttestationRequest
58+
from .types.token_exchange_service import ExchangeAppAttestAttestationResponse
59+
from .types.token_exchange_service import ExchangeCustomTokenRequest
60+
from .types.token_exchange_service import ExchangeDebugTokenRequest
61+
from .types.token_exchange_service import ExchangeDeviceCheckTokenRequest
62+
from .types.token_exchange_service import ExchangeRecaptchaTokenRequest
63+
from .types.token_exchange_service import ExchangeSafetyNetTokenRequest
64+
from .types.token_exchange_service import GenerateAppAttestChallengeRequest
65+
from .types.token_exchange_service import GetPublicJwkSetRequest
66+
from .types.token_exchange_service import PublicJwk
67+
from .types.token_exchange_service import PublicJwkSet
68+
69+
__all__ = (
70+
'AppAttestChallengeResponse',
71+
'AppAttestConfig',
72+
'AttestationTokenResponse',
73+
'BatchGetAppAttestConfigsRequest',
74+
'BatchGetAppAttestConfigsResponse',
75+
'BatchGetDeviceCheckConfigsRequest',
76+
'BatchGetDeviceCheckConfigsResponse',
77+
'BatchGetRecaptchaConfigsRequest',
78+
'BatchGetRecaptchaConfigsResponse',
79+
'BatchGetSafetyNetConfigsRequest',
80+
'BatchGetSafetyNetConfigsResponse',
81+
'BatchUpdateServicesRequest',
82+
'BatchUpdateServicesResponse',
83+
'ConfigServiceClient',
84+
'CreateDebugTokenRequest',
85+
'DebugToken',
86+
'DeleteDebugTokenRequest',
87+
'DeviceCheckConfig',
88+
'ExchangeAppAttestAssertionRequest',
89+
'ExchangeAppAttestAttestationRequest',
90+
'ExchangeAppAttestAttestationResponse',
91+
'ExchangeCustomTokenRequest',
92+
'ExchangeDebugTokenRequest',
93+
'ExchangeDeviceCheckTokenRequest',
94+
'ExchangeRecaptchaTokenRequest',
95+
'ExchangeSafetyNetTokenRequest',
96+
'GenerateAppAttestChallengeRequest',
97+
'GetAppAttestConfigRequest',
98+
'GetDebugTokenRequest',
99+
'GetDeviceCheckConfigRequest',
100+
'GetPublicJwkSetRequest',
101+
'GetRecaptchaConfigRequest',
102+
'GetSafetyNetConfigRequest',
103+
'GetServiceRequest',
104+
'ListDebugTokensRequest',
105+
'ListDebugTokensResponse',
106+
'ListServicesRequest',
107+
'ListServicesResponse',
108+
'PublicJwk',
109+
'PublicJwkSet',
110+
'RecaptchaConfig',
111+
'SafetyNetConfig',
112+
'Service',
113+
'TokenExchangeServiceClient',
114+
'UpdateAppAttestConfigRequest',
115+
'UpdateDebugTokenRequest',
116+
'UpdateDeviceCheckConfigRequest',
117+
'UpdateRecaptchaConfigRequest',
118+
'UpdateSafetyNetConfigRequest',
119+
'UpdateServiceRequest',
120+
)

0 commit comments

Comments
 (0)
0