(credentials env-var)Decode the service account credentials held in the named environment variable. fire.admin needs the private key and client email out of these to mint custom tokens, which is signing rather than an api call.
nil when the variable is unset or empty. A variable that is set but does not hold json is reported as {:error true :error-data "INVALID_CREDENTIALS"} rather than thrown, so every caller sees the same shape of failure.
Decode the service account credentials held in the named environment
variable. fire.admin needs the private key and client email out of these
to mint custom tokens, which is signing rather than an api call.
nil when the variable is unset or empty. A variable that is set but does
not hold json is reported as {:error true :error-data "INVALID_CREDENTIALS"}
rather than thrown, so every caller sees the same shape of failure.(decode-credentials raw)The service account json as a map; nil for nothing at all, and {:error true :error-data "INVALID_CREDENTIALS"} for something that is not the json of a service account.
The service account json as a map; nil for nothing at all, and
{:error true :error-data "INVALID_CREDENTIALS"} for something that is
not the json of a service account.(exchange-token creds private-key)Trade a service account's signed assertion for an OAuth2 access token:
{:token ... :expiry ... :project-id ... :type ...}, or an error map saying
why not. creds is the decoded service account json; private-key its
key, already derived. The network half of get-token, on its own so it can
be driven through fire.utils/http-fn.
Trade a service account's signed assertion for an OAuth2 access token:
{:token ... :expiry ... :project-id ... :type ...}, or an error map saying
why not. `creds` is the decoded service account json; `private-key` its
key, already derived. The network half of get-token, on its own so it can
be driven through fire.utils/*http-fn*.(get-token env-var)Exchange the service account in env-var for an OAuth2 access token:
{:token ... :expiry ... :project-id ... :type ...}.
nil when the env var holds no credentials. When it does and the exchange still fails — Google refused the assertion, or could not be reached — an error map says so, because those two are different problems from having no credentials and used to look identical.
Exchange the service account in `env-var` for an OAuth2 access token:
{:token ... :expiry ... :project-id ... :type ...}.
nil when the env var holds no credentials. When it does and the exchange
still fails — Google refused the assertion, or could not be reached — an
error map says so, because those two are different problems from having no
credentials and used to look identical.(sign claims' priv-key)(sign claims' priv-key header')Sign claims into an RS256 JWT. The header defaults to the bare {:alg "RS256"} this has always emitted; firebase custom tokens want :typ in there too, so it can be passed in.
Sign claims into an RS256 JWT. The header defaults to the bare {:alg "RS256"}
this has always emitted; firebase custom tokens want :typ in there too, so it
can be passed in.(signing-key env-var)The service account behind env-var, ready to sign with:
{:client-email ... :private-key java.security.PrivateKey}. Cached per env
var. nil when there are no credentials to derive it from, or an error map
when what is there cannot be read.
The service account behind `env-var`, ready to sign with:
{:client-email ... :private-key java.security.PrivateKey}. Cached per env
var. nil when there are no credentials to derive it from, or an error map
when what is there cannot be read.(str->private-key keystr')cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |