firebase / firebase/firebase-js-sdk
No ability to unit test cloud functions as a simulated authenticated user
- Dominant language
- TypeScript
- Stars
- 5.1k
- Forks
- 1k
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 37
Description
### Operating System
Any
### Browser Version
Any
### Firebase SDK Version
9.14.0
### Firebase SDK Product:
Firestore, Functions
### Describe your project's tooling
VS Code set up as a generic project
### Describe the problem
firebase/rules-unit-testing is a great way to test security rules, it allows easy switching between simulated users to check security from various users perspectives.
However, when your test involves calling a cloud function as such a simulated user, there is no way to do this. An example workflow:
* Use authenticatedContext to switch to "Alice"
* Call secured cloud function, which Alice is allowed to call
* Unit test can expect "success"
* Use authenticatedContext to switch to "Bob"
* Call same secured cloud function, but Bob isn't on the list of allowed callees
* Unit test can expect "failure"
I have searched around looking for a way to do this, but there is no mention out there on the internet.
So if it is possible, I would suggest that the documentation is updated.
If it is not possible, I would suggest adding this to firebase/rules-unit-testing which has a nice environment in place already.
I am not sure how major deployments of firebase are out there without automated testing for their security, and I feel that this is something that should not be overlooked.
### Steps and code to reproduce issue
Make a new project with a cloud function that returns the authentication data.
Make a unit test that creates a simulated user with rules-unit-testing.
Hack the rules-unit-testing library to return a function object, and injected the authentication parameters into it.
Call the cloud function.
Expect to see authentication in the returned data.
It wasn't there.
Contributor guide
Research direction
Start with firebase/rules-unit-testing and its authenticatedContext API, then compare that test setup with the cloud function invocation described in the issue. Done means a documented or implemented path that preserves the simulated user's authentication data and verifies the Alice/Bob success and failure cases.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, backend, cloud, testing
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100