diff --git a/etc/firebase-admin.auth.api.md b/etc/firebase-admin.auth.api.md index 7a1df820d6..c6c3f01c1b 100644 --- a/etc/firebase-admin.auth.api.md +++ b/etc/firebase-admin.auth.api.md @@ -344,7 +344,6 @@ export class PhoneMultiFactorInfo extends MultiFactorInfo { // @public export class ProjectConfig { get multiFactorConfig(): MultiFactorConfig | undefined; - get recaptchaConfig(): RecaptchaConfig | undefined; readonly smsRegionConfig?: SmsRegionConfig; toJSON(): object; } @@ -363,35 +362,6 @@ export interface ProviderIdentifier { providerUid: string; } -// @public -export type RecaptchaAction = 'BLOCK'; - -// @public -export interface RecaptchaConfig { - emailPasswordEnforcementState?: RecaptchaProviderEnforcementState; - managedRules?: RecaptchaManagedRule[]; - recaptchaKeys?: RecaptchaKey[]; - useAccountDefender?: boolean; -} - -// @public -export interface RecaptchaKey { - key: string; - type?: RecaptchaKeyClientType; -} - -// @public -export type RecaptchaKeyClientType = 'WEB' | 'IOS' | 'ANDROID'; - -// @public -export interface RecaptchaManagedRule { - action?: RecaptchaAction; - endScore: number; -} - -// @public -export type RecaptchaProviderEnforcementState = 'OFF' | 'AUDIT' | 'ENFORCE'; - // @public export interface SAMLAuthProviderConfig extends BaseAuthProviderConfig { callbackURL?: string; @@ -427,7 +397,6 @@ export class Tenant { readonly displayName?: string; get emailSignInConfig(): EmailSignInProviderConfig | undefined; get multiFactorConfig(): MultiFactorConfig | undefined; - get recaptchaConfig(): RecaptchaConfig | undefined; readonly smsRegionConfig?: SmsRegionConfig; readonly tenantId: string; readonly testPhoneNumbers?: { @@ -479,7 +448,6 @@ export interface UpdatePhoneMultiFactorInfoRequest extends BaseUpdateMultiFactor // @public export interface UpdateProjectConfigRequest { multiFactorConfig?: MultiFactorConfig; - recaptchaConfig?: RecaptchaConfig; smsRegionConfig?: SmsRegionConfig; } @@ -503,7 +471,6 @@ export interface UpdateTenantRequest { displayName?: string; emailSignInConfig?: EmailSignInProviderConfig; multiFactorConfig?: MultiFactorConfig; - recaptchaConfig?: RecaptchaConfig; smsRegionConfig?: SmsRegionConfig; testPhoneNumbers?: { [phoneNumber: string]: string; diff --git a/src/auth/auth-config.ts b/src/auth/auth-config.ts index 5ca4ed0b96..3f8f387f84 100644 --- a/src/auth/auth-config.ts +++ b/src/auth/auth-config.ts @@ -1722,227 +1722,3 @@ export class SmsRegionsAuthConfig { } } } -/** -* Enforcement state of reCAPTCHA protection. -* - 'OFF': Unenforced. -* - 'AUDIT': Create assessment but don't enforce the result. -* - 'ENFORCE': Create assessment and enforce the result. -*/ -export type RecaptchaProviderEnforcementState = 'OFF' | 'AUDIT' | 'ENFORCE'; - -/** -* The actions to take for reCAPTCHA-protected requests. -* - 'BLOCK': The reCAPTCHA-protected request will be blocked. -*/ -export type RecaptchaAction = 'BLOCK'; - -/** - * The config for a reCAPTCHA action rule. - */ -export interface RecaptchaManagedRule { - /** - * The action will be enforced if the reCAPTCHA score of a request is larger than endScore. - */ - endScore: number; - /** - * The action for reCAPTCHA-protected requests. - */ - action?: RecaptchaAction; -} - -/** - * The key's platform type. - */ -export type RecaptchaKeyClientType = 'WEB' | 'IOS' | 'ANDROID'; - -/** - * The reCAPTCHA key config. - */ -export interface RecaptchaKey { - /** - * The key's client platform type. - */ - type?: RecaptchaKeyClientType; - - /** - * The reCAPTCHA site key. - */ - key: string; -} - -/** - * The request interface for updating a reCAPTCHA Config. - * By enabling reCAPTCHA Enterprise Integration you are - * agreeing to reCAPTCHA Enterprise - * {@link https://cloud.google.com/terms/service-terms | Term of Service}. - */ -export interface RecaptchaConfig { - /** - * The enforcement state of the email password provider. - */ - emailPasswordEnforcementState?: RecaptchaProviderEnforcementState; - /** - * The reCAPTCHA managed rules. - */ - managedRules?: RecaptchaManagedRule[]; - - /** - * The reCAPTCHA keys. - */ - recaptchaKeys?: RecaptchaKey[]; - - /** - * Whether to use account defender for reCAPTCHA assessment. - * The default value is false. - */ - useAccountDefender?: boolean; -} - -export class RecaptchaAuthConfig implements RecaptchaConfig { - public readonly emailPasswordEnforcementState?: RecaptchaProviderEnforcementState; - public readonly managedRules?: RecaptchaManagedRule[]; - public readonly recaptchaKeys?: RecaptchaKey[]; - public readonly useAccountDefender?: boolean; - - constructor(recaptchaConfig: RecaptchaConfig) { - this.emailPasswordEnforcementState = recaptchaConfig.emailPasswordEnforcementState; - this.managedRules = recaptchaConfig.managedRules; - this.recaptchaKeys = recaptchaConfig.recaptchaKeys; - this.useAccountDefender = recaptchaConfig.useAccountDefender; - } - - /** - * Validates the RecaptchaConfig options object. Throws an error on failure. - * @param options - The options object to validate. - */ - public static validate(options: RecaptchaConfig): void { - const validKeys = { - emailPasswordEnforcementState: true, - managedRules: true, - recaptchaKeys: true, - useAccountDefender: true, - }; - - if (!validator.isNonNullObject(options)) { - throw new FirebaseAuthError( - AuthClientErrorCode.INVALID_CONFIG, - '"RecaptchaConfig" must be a non-null object.', - ); - } - - for (const key in options) { - if (!(key in validKeys)) { - throw new FirebaseAuthError( - AuthClientErrorCode.INVALID_CONFIG, - `"${key}" is not a valid RecaptchaConfig parameter.`, - ); - } - } - - // Validation - if (typeof options.emailPasswordEnforcementState !== undefined) { - if (!validator.isNonEmptyString(options.emailPasswordEnforcementState)) { - throw new FirebaseAuthError( - AuthClientErrorCode.INVALID_ARGUMENT, - '"RecaptchaConfig.emailPasswordEnforcementState" must be a valid non-empty string.', - ); - } - - if (options.emailPasswordEnforcementState !== 'OFF' && - options.emailPasswordEnforcementState !== 'AUDIT' && - options.emailPasswordEnforcementState !== 'ENFORCE') { - throw new FirebaseAuthError( - AuthClientErrorCode.INVALID_CONFIG, - '"RecaptchaConfig.emailPasswordEnforcementState" must be either "OFF", "AUDIT" or "ENFORCE".', - ); - } - } - - if (typeof options.managedRules !== 'undefined') { - // Validate array - if (!validator.isArray(options.managedRules)) { - throw new FirebaseAuthError( - AuthClientErrorCode.INVALID_CONFIG, - '"RecaptchaConfig.managedRules" must be an array of valid "RecaptchaManagedRule".', - ); - } - // Validate each rule of the array - options.managedRules.forEach((managedRule) => { - RecaptchaAuthConfig.validateManagedRule(managedRule); - }); - } - - if (typeof options.useAccountDefender != 'undefined') { - if (!validator.isBoolean(options.useAccountDefender)) { - throw new FirebaseAuthError( - AuthClientErrorCode.INVALID_CONFIG, - '"RecaptchaConfig.useAccountDefender" must be a boolean value".', - ); - } - } - } - - /** - * Validate each element in ManagedRule array - * @param options - The options object to validate. - */ - private static validateManagedRule(options: RecaptchaManagedRule): void { - const validKeys = { - endScore: true, - action: true, - } - if (!validator.isNonNullObject(options)) { - throw new FirebaseAuthError( - AuthClientErrorCode.INVALID_CONFIG, - '"RecaptchaManagedRule" must be a non-null object.', - ); - } - // Check for unsupported top level attributes. - for (const key in options) { - if (!(key in validKeys)) { - throw new FirebaseAuthError( - AuthClientErrorCode.INVALID_CONFIG, - `"${key}" is not a valid RecaptchaManagedRule parameter.`, - ); - } - } - - // Validate content. - if (typeof options.action !== 'undefined' && - options.action !== 'BLOCK') { - throw new FirebaseAuthError( - AuthClientErrorCode.INVALID_CONFIG, - '"RecaptchaManagedRule.action" must be "BLOCK".', - ); - } - } - - /** - * Returns a JSON-serializable representation of this object. - * @returns The JSON-serializable object representation of the ReCaptcha config instance - */ - public toJSON(): object { - const json: any = { - emailPasswordEnforcementState: this.emailPasswordEnforcementState, - managedRules: deepCopy(this.managedRules), - recaptchaKeys: deepCopy(this.recaptchaKeys), - useAccountDefender: this.useAccountDefender, - } - - if (typeof json.emailPasswordEnforcementState === 'undefined') { - delete json.emailPasswordEnforcementState; - } - if (typeof json.managedRules === 'undefined') { - delete json.managedRules; - } - if (typeof json.recaptchaKeys === 'undefined') { - delete json.recaptchaKeys; - } - - if (typeof json.useAccountDefender === 'undefined') { - delete json.useAccountDefender; - } - - return json; - } -} diff --git a/src/auth/index.ts b/src/auth/index.ts index 8af9c7e246..d91c46f083 100644 --- a/src/auth/index.ts +++ b/src/auth/index.ts @@ -84,12 +84,6 @@ export { OAuthResponseType, OIDCAuthProviderConfig, OIDCUpdateAuthProviderRequest, - RecaptchaAction, - RecaptchaConfig, - RecaptchaKey, - RecaptchaKeyClientType, - RecaptchaManagedRule, - RecaptchaProviderEnforcementState, SAMLAuthProviderConfig, SAMLUpdateAuthProviderRequest, SmsRegionConfig, diff --git a/src/auth/project-config-manager.ts b/src/auth/project-config-manager.ts index 847aa7d982..030b64a779 100644 --- a/src/auth/project-config-manager.ts +++ b/src/auth/project-config-manager.ts @@ -20,10 +20,14 @@ import { } from './auth-api-request'; /** - * Manages (gets and updates) the current project config. + * Defines the project config manager used to help manage project config related operations. + * This includes: + *