nestjs-firebase-passport

Passport - Firebase Auth Module for NestJS

Installation

Install the following peer dependencies:

npm install passport @nestjs/passport passport-jwt jwks-rsa
npm install --save-dev @types/passport-jwt

Install the package

npm install @whitecloak/nestjs-passport-firebase

Usage

Setup FirebaseAuthModule

Import the FirebaseAuthModule into the root module (the AppModule, defined in the app.module.ts file).

import { Module } from '@nestjs/common';
import { FirebaseAuthModule } from '@whitecloak/nestjs-passport-firebase';

@Module({
  imports: [
     FirebaseAuthModule.register({
        audience: '<PROJECT_ID>',
        issuer: 'https://securetoken.google.com/<PROJECT_ID>',
     }),
  ],
})
export class AppModule {}

The value of audience is a string equal to your Firebase project ID, the unique identifier for your Firebase project. For the issuer it should be set to https://securetoken.google.com/<PROJECT_ID>. You can also store this config to the environment variable.

FirebaseAuthModule.register({
    audience: process.env.FIREBASE_AUDIENCE, 
    issuer: proccess.env.FIREBASE_ISSUER,
})

Protect your APIs

Use FirebaseAuthGuard to protect your routes.

import { Controller, Get, UseGuards } from '@nestjs/common';
import { AppService } from './app.service';
import { FirebaseAuthGuard } from '@whitecloak/nestjs-passport-firebase';

@Controller()
export class AppController {
    constructor(private readonly appService: AppService) {}

    @Get()
    @UseGuards(FirebaseAuthGuard)
    getHello(): string {
        return this.appService.getHello();
    }
}

If you are using GraphQL, you need to extend the FirebaseAuthGuard and override the getRequest() method. Read more here.

import { ExecutionContext, Injectable } from '@nestjs/common';
import { GqlExecutionContext } from '@nestjs/graphql';
import { FirebaseAuthGuard } from '@whitecloak/nestjs-passport-firebase';

@Injectable()
export class GqlAuthGuard extends FirebaseAuthGuard {
    getRequest(context: ExecutionContext) {
        const ctx = GqlExecutionContext.create(context);
        return ctx.getContext().req;
    }
}

You can now protect your queries and mutations by using the GqlAuthGuard.

import { Query, Resolver } from '@nestjs/graphql';
import { UseGuards } from '@nestjs/common';
import { GqlAuthGuard } from './guards/gql-auth.guard';

@Resolver()
export class VersionsResolver {
    constructor(private readonly appService: AppService) {}

    @Query(() => String)
    @UseGuards(GqlAuthGuard)
    getHello(): string {
        return this.appService.getHello();
    }
}

Customizing Firebase Strategy validate Method

Sometimes you need to tweak the behavior of the validate method to fit into your project requirements. You can do it by creating a custom strategy and extending the FirebaseStrategy to override the validate method.

import { DecodedIdToken, FirebaseStrategy } from '@whitecloak/nestjs-passport-firebase';
import { Repository } from 'typeorm';
import { Injectable } from '@nestjs/common';
import { InjectRepository } from '@nestjs/typeorm';
import { User } from '@entities/user.entity';

@Injectable()
export class FirebaseCustomStrategy extends FirebaseStrategy {
  constructor(
    @InjectRepository(User) private userRepository: Repository<User>,
  ) {
    super({
      audience: process.env.FIREBASE_AUDIENCE,
      issuer: proccess.env.FIREBASE_ISSUER,
    });
  }

  async validate(payload: DecodedIdToken): Promise<User> {
    // Do the custom behavior here.
    
    return this.userRepository.findOne({ email: payload.email });
  }
}

Then add the FirebaseCustomStrategy to the providers list of the module and don't forget to import its dependencies

import { Module } from '@nestjs/common';
import { User } from '@entities/user.entity';
import { TypeOrmModule } from '@nestjs/typeorm';
import { FirebaseAuthModule } from '@whitecloak/nestjs-passport-firebase';
import { FirebaseCustomStrategt } from '@modules/auth/strategy/firebase-custom.strategy';

@Module({
  imports: [
     TypeormModule.forFeature([User]),
     FirebaseAuthModule.register({
        audience: '<PROJECT_ID>',
        issuer: 'https://securetoken.google.com/<PROJECT_ID>',
     }),
  ],
  providers: [FirebaseCustomStrategy]
})
export class AppModule {}

Change Log

See Changelog for more information.

Contributing

Contributions welcome! See Contributing.

Author

Jimuel Palaca

License

Licensed under the MIT License - see the LICENSE file for details.