(cert->public-key pem)Parse a PEM-encoded X.509 certificate string (as returned by Google's public-certs endpoint) into its java.security.PublicKey. Unlike str->private-key in fire.oauth2, CertificateFactory handles the PEM BEGIN/END wrapper itself — no manual header-stripping needed.
Parse a PEM-encoded X.509 certificate string (as returned by Google's public-certs endpoint) into its java.security.PublicKey. Unlike str->private-key in fire.oauth2, CertificateFactory handles the PEM BEGIN/END wrapper itself — no manual header-stripping needed.
(create-token)(create-token env-var)Exchange the service account credentials in env-var (default
GOOGLE_APPLICATION_CREDENTIALS) for an auth map:
{:token ... :expiry ... :project-id ... :type ... :env env-var}.
When it cannot, the map carries the reason alongside :env rather than quietly lacking a token — {:error true :error-data ...} with one of MISSING_CREDENTIALS (the variable is unset or empty), INVALID_CREDENTIALS (set, but not the service account json) or TOKEN_EXCHANGE_FAILED: ... (Google refused the assertion or could not be reached). Everything in fire that takes an auth map refuses to send an unauthenticated request when it is handed one of these, so the failure surfaces where the credential was configured rather than as a 401 three calls later.
This mints a token every time it is called. For a long-lived process reach for token-for below, which caches per env var; the request paths in fire already do.
Exchange the service account credentials in `env-var` (default
GOOGLE_APPLICATION_CREDENTIALS) for an auth map:
{:token ... :expiry ... :project-id ... :type ... :env env-var}.
When it cannot, the map carries the reason alongside :env rather than
quietly lacking a token — {:error true :error-data ...} with one of
MISSING_CREDENTIALS (the variable is unset or empty), INVALID_CREDENTIALS
(set, but not the service account json) or TOKEN_EXCHANGE_FAILED: ...
(Google refused the assertion or could not be reached). Everything in fire
that takes an auth map refuses to send an unauthenticated request when it
is handed one of these, so the failure surfaces where the credential was
configured rather than as a 401 three calls later.
This mints a token every time it is called. For a long-lived process reach
for token-for below, which caches per env var; the request paths in fire
already do.(forget-token! env-var)Drop the cached token for env-var, so the next request mints a new one.
For credentials rotated while the process runs; nothing in fire needs it.
Drop the cached token for `env-var`, so the next request mints a new one. For credentials rotated while the process runs; nothing in fire needs it.
(format-result claims)Flatten the claims a consumer actually reaches for out of a verified Firebase ID token. Firebase tucks the sign-in metadata away inside the token's :firebase block; this lifts it to the top level.
:sign_in_second_factor is the whole point: it names the second factor actually presented at sign-in ("totp", "phone") and is the only server-side proof that MFA happened — a valid signature alone is not. It is nil when no second factor was used, and nil on the legacy Firebase Auth tier, which never emits it. Fire reports; it does not decide. nil means "no second factor proven", and an enforcing consumer must treat that as a deny.
:second_factor_identifier is the enrollment id of the factor used, for audit trails and support tooling. Both require Identity Platform to ever be non-nil.
Flatten the claims a consumer actually reaches for out of a verified
Firebase ID token. Firebase tucks the sign-in metadata away inside the
token's :firebase block; this lifts it to the top level.
:sign_in_second_factor is the whole point: it names the second factor
actually presented at sign-in ("totp", "phone") and is the only
server-side proof that MFA happened — a valid signature alone is not.
It is nil when no second factor was used, and nil on the legacy Firebase
Auth tier, which never emits it. Fire reports; it does not decide. nil
means "no second factor proven", and an enforcing consumer must treat
that as a deny.
:second_factor_identifier is the enrollment id of the factor used, for
audit trails and support tooling. Both require Identity Platform to ever
be non-nil.(token-for auth)A bearer token for auth that is good right now, or nil when there is no
credential to be had.
The token on the map is used while it is live. Once it has expired — or when the map never had one, as with a create-token that failed — a fresh one is minted from the map's :env and remembered, so later calls on the same stale map find it here rather than minting again. A map with a token and no :expiry is taken at its word: the caller minted it some other way.
A bearer token for `auth` that is good right now, or nil when there is no credential to be had. The token on the map is used while it is live. Once it has expired — or when the map never had one, as with a create-token that failed — a fresh one is minted from the map's :env and remembered, so later calls on the same stale map find it here rather than minting again. A map with a token and no :expiry is taken at its word: the caller minted it some other way.
(valid-signature? signing-input signature-b64url pubkey)Verify an RS256 JWT's signature against a public key. signing-input is "header.payload" (the two segments the signature actually covers).
Verify an RS256 JWT's signature against a public key. signing-input is "header.payload" (the two segments the signature actually covers).
(validate-session-cookie project-id cookie)Verify a Firebase session cookie — the long-lived, httpOnly-cookie alternative to holding an ID token, minted by fire.admin's create-session-cookie. Same RS256 verification and the same return value as validate-token, against a different key set and issuer.
Like validate-token this fails closed and returns nil on anything wrong. A revoked session is not detectable here; use fire.admin's validate-session-cookie for that.
Verify a Firebase session cookie — the long-lived, httpOnly-cookie alternative to holding an ID token, minted by fire.admin's create-session-cookie. Same RS256 verification and the same return value as validate-token, against a different key set and issuer. Like validate-token this fails closed and returns nil on anything wrong. A revoked session is not detectable here; use fire.admin's validate-session-cookie for that.
(validate-token project-id token)Verify a Firebase ID token's signature and standard claims, and that
it was issued for project-id. Returns the decoded claims map on
success, nil on any failure (bad signature, expired, wrong project,
malformed input) — deliberately fails closed and swallows exceptions,
since every failure mode here means the same thing to a caller: reject.
The claims come back with format-result's flattened keys merged over them, so the nested sign-in metadata — :sign_in_provider and, on Identity Platform, :sign_in_second_factor and :second_factor_identifier — is readable straight off the result without digging through :firebase. Nothing is dropped or renamed: the raw claims are all still there, so this stays additive for anyone already destructuring the old return value.
No service account or Admin SDK needed — this only reads Google's PUBLIC certs. For verifying a signed-in user's ID token, not for fire's own outbound calls (see create-token for that). fire.admin's validate-token adds the revocation and disabled-account checks, which do need credentials.
Verify a Firebase ID token's signature and standard claims, and that it was issued for `project-id`. Returns the decoded claims map on success, nil on any failure (bad signature, expired, wrong project, malformed input) — deliberately fails closed and swallows exceptions, since every failure mode here means the same thing to a caller: reject. The claims come back with format-result's flattened keys merged over them, so the nested sign-in metadata — :sign_in_provider and, on Identity Platform, :sign_in_second_factor and :second_factor_identifier — is readable straight off the result without digging through :firebase. Nothing is dropped or renamed: the raw claims are all still there, so this stays additive for anyone already destructuring the old return value. No service account or Admin SDK needed — this only reads Google's PUBLIC certs. For verifying a signed-in user's ID token, not for fire's own outbound calls (see create-token for that). fire.admin's validate-token adds the revocation and disabled-account checks, which do need credentials.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |