"""Returns an _AuthService instance for an App.

"""Builds and signs a Firebase custom auth token.

token_generator = _get_auth_service(app).token_generator

"""Verifies the signature and data for the provided JWT.

if not isinstance(check_revoked, bool):

# guard against accidental wrong assignment.

raise ValueError('Illegal check_revoked argument. Argument must be of type '

' bool, but given "{0}".'.format(type(app)))

token_generator = _get_auth_service(app).token_generator

verified_claims = token_generator.verify_id_token(id_token)

if check_revoked:

user = get_user(verified_claims.get('uid'), app)

if verified_claims.get('iat') * 1000 < user.tokens_valid_after_timestamp:

raise AuthError(_ID_TOKEN_REVOKED, 'The Firebase ID token has been revoked.')

"""Revokes all refresh tokens for an existing user.

user_manager = _get_auth_service(app).user_manager

"""Gets the user data corresponding to the specified user ID.

user_manager = _get_auth_service(app).user_manager

try:

response = user_manager.get_user(uid=uid)

return UserRecord(response)

except _user_mgt.ApiCallError as error:

"""Gets the user data corresponding to the specified user email.

user_manager = _get_auth_service(app).user_manager

try:

response = user_manager.get_user(email=email)

return UserRecord(response)

except _user_mgt.ApiCallError as error:

"""Gets the user data corresponding to the specified phone number.

user_manager = _get_auth_service(app).user_manager

try:

response = user_manager.get_user(phone_number=phone_number)

return UserRecord(response)

except _user_mgt.ApiCallError as error:

"""Retrieves a page of user accounts from a Firebase project.

user_manager = _get_auth_service(app).user_manager

def download(page_token, max_results):

try:

return user_manager.list_users(page_token, max_results)

except _user_mgt.ApiCallError as error:

raise AuthError(error.code, str(error), error.detail)

"""Creates a new user account with the specified properties.

app = kwargs.pop('app', None)

user_manager = _get_auth_service(app).user_manager

try:

uid = user_manager.create_user(**kwargs)

return UserRecord(user_manager.get_user(uid=uid))

except _user_mgt.ApiCallError as error:

"""Updates an existing user account with the specified properties.

app = kwargs.pop('app', None)

user_manager = _get_auth_service(app).user_manager

try:

user_manager.update_user(uid, **kwargs)

return UserRecord(user_manager.get_user(uid=uid))

except _user_mgt.ApiCallError as error:

"""Sets additional claims on an existing user account.

user_manager = _get_auth_service(app).user_manager

try:

user_manager.update_user(uid, custom_claims=custom_claims)

except _user_mgt.ApiCallError as error:

"""Deletes the user identified by the specified user ID.

user_manager = _get_auth_service(app).user_manager

try:

user_manager.delete_user(uid)

except _user_mgt.ApiCallError as error:

"""A collection of standard profile information for a user.

@property

def uid(self):

"""Returns the user ID of this user."""

raise NotImplementedError

@property

def display_name(self):

"""Returns the display name of this user."""

raise NotImplementedError

@property

def email(self):

"""Returns the email address associated with this user."""

raise NotImplementedError

@property

def phone_number(self):

"""Returns the phone number associated with this user."""

raise NotImplementedError

@property

def photo_url(self):

"""Returns the photo URL of this user."""

raise NotImplementedError

@property

def provider_id(self):

"""Returns the ID of the identity provider.

"""Contains metadata associated with a Firebase user account."""

def __init__(self, data):

super(UserRecord, self).__init__()

if not isinstance(data, dict):

raise ValueError('Invalid data argument: {0}. Must be a dictionary.'.format(data))

if not data.get('localId'):

raise ValueError('User ID must not be None or empty.')

self._data = data

@property

def uid(self):

"""Returns the user ID of this user.

return self._data.get('localId')

@property

def display_name(self):

"""Returns the display name of this user.

return self._data.get('displayName')

@property

def email(self):

"""Returns the email address associated with this user.

return self._data.get('email')

@property

def phone_number(self):

"""Returns the phone number associated with this user.

return self._data.get('phoneNumber')

@property

def photo_url(self):

"""Returns the photo URL of this user.

return self._data.get('photoUrl')

@property

def provider_id(self):

"""Returns the provider ID of this user.

return 'firebase'

@property

def email_verified(self):

"""Returns whether the email address of this user has been verified.

return bool(self._data.get('emailVerified'))

@property

def disabled(self):

"""Returns whether this user account is disabled.

return bool(self._data.get('disabled'))

@property

def tokens_valid_after_timestamp(self):

"""Returns the time, in milliseconds since the epoch, before which tokens are invalid.

valid_since = self._data.get('validSince')

if valid_since is not None:

return 1000 * int(valid_since)

return None

@property

def user_metadata(self):

"""Returns additional metadata associated with this user.

return UserMetadata(self._data)

@property

def provider_data(self):

"""Returns a list of UserInfo instances.

providers = self._data.get('providerUserInfo', [])

return [_ProviderUserInfo(entry) for entry in providers]

@property

def custom_claims(self):

"""Returns any custom claims set on this user account.

claims = self._data.get('customAttributes')

if claims:

parsed = json.loads(claims)

if parsed != {}:

return parsed

"""Contains additional metadata associated with a user account."""

def __init__(self, data):

if not isinstance(data, dict):

raise ValueError('Invalid data argument: {0}. Must be a dictionary.'.format(data))

self._data = data

@property

def creation_timestamp(self):

""" Creation timestamp in milliseconds since the epoch.

if 'createdAt' in self._data:

return int(self._data['createdAt'])

return None

@property

def last_sign_in_timestamp(self):

""" Last sign in timestamp in milliseconds since the epoch.

if 'lastLoginAt' in self._data:

return int(self._data['lastLoginAt'])

"""Contains metadata associated with a user including password hash and salt."""

def __init__(self, data):

super(ExportedUserRecord, self).__init__(data)

@property

def password_hash(self):

"""The user's password hash as a base64-encoded string.

return self._data.get('passwordHash')

@property

def password_salt(self):

"""The user's password salt as a base64-encoded string.

"""Represents a page of user records exported from a Firebase project.

def __init__(self, download, page_token, max_results):

self._download = download

self._max_results = max_results

self._current = download(page_token, max_results)

@property

def users(self):

"""A list of ``ExportedUserRecord`` instances available in this page."""

return [ExportedUserRecord(user) for user in self._current.get('users', [])]

@property

def next_page_token(self):

"""Page token string for the next page (empty string indicates no more pages)."""

return self._current.get('nextPageToken', '')

@property

def has_next_page(self):

"""A boolean indicating whether more pages are available."""

return bool(self.next_page_token)

def get_next_page(self):

"""Retrieves the next page of user accounts, if available.

if self.has_next_page:

return ListUsersPage(self._download, self.next_page_token, self._max_results)

return None

def iterate_all(self):

"""Retrieves an iterator for user accounts.

"""Contains metadata regarding how a user is known by a particular identity provider."""

def __init__(self, data):

super(_ProviderUserInfo, self).__init__()

if not isinstance(data, dict):

raise ValueError('Invalid data argument: {0}. Must be a dictionary.'.format(data))

if not data.get('rawId'):

raise ValueError('User ID must not be None or empty.')

self._data = data

@property

def uid(self):

return self._data.get('rawId')

@property

def display_name(self):

return self._data.get('displayName')

@property

def email(self):

return self._data.get('email')

@property

def phone_number(self):

return self._data.get('phoneNumber')

@property

def photo_url(self):

return self._data.get('photoUrl')

@property

def provider_id(self):

"""Represents an Exception encountered while invoking the Firebase auth API."""

def __init__(self, code, message, error=None):

Exception.__init__(self, message)

self.code = code

"""Generates custom tokens, and validates ID tokens."""

FIREBASE_CERT_URI = ('https://www.googleapis.com/robot/v1/metadata/x509/'

'securetoken@system.gserviceaccount.com')

ISSUER_PREFIX = 'https://securetoken.google.com/'

MAX_TOKEN_LIFETIME_SECONDS = 3600 # One Hour, in Seconds

FIREBASE_AUDIENCE = ('https://identitytoolkit.googleapis.com/google.'

'identity.identitytoolkit.v1.IdentityToolkit')

# Key names we don't allow to appear in the developer_claims.

_RESERVED_CLAIMS_ = set([

'acr', 'amr', 'at_hash', 'aud', 'auth_time', 'azp', 'cnf', 'c_hash',

'exp', 'firebase', 'iat', 'iss', 'jti', 'nbf', 'nonce', 'sub'

])

def __init__(self, app):

"""Initializes FirebaseAuth from a FirebaseApp instance.

self._app = app

def create_custom_token(self, uid, developer_claims=None):

"""Builds and signs a FirebaseCustomAuthToken.

if not isinstance(self._app.credential, credentials.Certificate):

raise ValueError(

'Must initialize Firebase App with a certificate credential '

'to call create_custom_token().')

if developer_claims is not None:

if not isinstance(developer_claims, dict):

raise ValueError('developer_claims must be a dictionary')

disallowed_keys = set(developer_claims.keys()

) & self._RESERVED_CLAIMS_

if disallowed_keys:

if len(disallowed_keys) > 1:

error_message = ('Developer claims {0} are reserved and '

'cannot be specified.'.format(

', '.join(disallowed_keys)))

else:

error_message = ('Developer claim {0} is reserved and '

'cannot be specified.'.format(

', '.join(disallowed_keys)))

raise ValueError(error_message)

if not uid or not isinstance(uid, six.string_types) or len(uid) > 128:

raise ValueError('uid must be a string between 1 and 128 characters.')

now = int(time.time())

payload = {

'iss': self._app.credential.service_account_email,

'sub': self._app.credential.service_account_email,

'aud': self.FIREBASE_AUDIENCE,

'uid': uid,

'iat': now,

'exp': now + self.MAX_TOKEN_LIFETIME_SECONDS,

}

if developer_claims is not None:

payload['claims'] = developer_claims

return jwt.encode(self._app.credential.signer, payload)

def verify_id_token(self, id_token):

"""Verifies the signature and data for the provided JWT.

if not id_token:

raise ValueError('Illegal ID token provided: {0}. ID token must be a non-empty '

'string.'.format(id_token))

if isinstance(id_token, six.text_type):

id_token = id_token.encode('ascii')

if not isinstance(id_token, six.binary_type):

raise ValueError('Illegal ID token provided: {0}. ID token must be a non-empty '

'string.'.format(id_token))

project_id = self._app.project_id

if not project_id:

raise ValueError('Failed to ascertain project ID from the credential or the '

'environment. Project ID is required to call verify_id_token(). '

'Initialize the app with a credentials.Certificate or set '

'your Firebase project ID as an app option. Alternatively '

'set the GCLOUD_PROJECT environment variable.')

header = jwt.decode_header(id_token)

payload = jwt.decode(id_token, verify=False)

issuer = payload.get('iss')

audience = payload.get('aud')

subject = payload.get('sub')

expected_issuer = self.ISSUER_PREFIX + project_id

project_id_match_msg = ('Make sure the ID token comes from the same'

' Firebase project as the service account used'

' to authenticate this SDK.')

verify_id_token_msg = (

'See https://firebase.google.com/docs/auth/admin/verify-id-tokens'

' for details on how to retrieve an ID token.')

error_message = None

if not header.get('kid'):

if audience == self.FIREBASE_AUDIENCE:

error_message = ('verify_id_token() expects an ID token, but '

'was given a custom token.')

elif header.get('alg') == 'HS256' and payload.get(

'v') is 0 and 'uid' in payload.get('d', {}):

error_message = ('verify_id_token() expects an ID token, but '

'was given a legacy custom token.')

else:

error_message = 'Firebase ID token has no "kid" claim.'

elif header.get('alg') != 'RS256':

error_message = ('Firebase ID token has incorrect algorithm. '

'Expected "RS256" but got "{0}". {1}'.format(

header.get('alg'), verify_id_token_msg))

elif audience != project_id:

error_message = (

'Firebase ID token has incorrect "aud" (audience) claim. '

'Expected "{0}" but got "{1}". {2} {3}'.format(

project_id, audience, project_id_match_msg,

verify_id_token_msg))

elif issuer != expected_issuer:

error_message = ('Firebase ID token has incorrect "iss" (issuer) '

'claim. Expected "{0}" but got "{1}". {2} {3}'

.format(expected_issuer, issuer,

project_id_match_msg,

verify_id_token_msg))

elif subject is None or not isinstance(subject, six.string_types):

error_message = ('Firebase ID token has no "sub" (subject) '

'claim. ') + verify_id_token_msg

elif not subject:

error_message = ('Firebase ID token has an empty string "sub" '

'(subject) claim. ') + verify_id_token_msg

elif len(subject) > 128:

error_message = ('Firebase ID token has a "sub" (subject) '

'claim longer than 128 '

'characters. ') + verify_id_token_msg

if error_message:

raise ValueError(error_message)

verified_claims = google.oauth2.id_token.verify_firebase_token(

id_token,

request=_request,

audience=project_id)

verified_claims['uid'] = verified_claims['sub']

def __init__(self, app):

self._token_generator = _TokenGenerator(app)

self._user_manager = _user_mgt.UserManager(app)

@property

def token_generator(self):

return self._token_generator

@property

def user_manager(self):