Create Firebase users and sign in with Schema Extensions and Graphcool Functions
Note: Schema Extensions are currently only available in the Beta Program.
This example uses Amazon Web Services Lambda and API Gateway. The function's handler is specific to Lambda events but could be easily changed for use with another provider.
- Create a new Permanent Access Token (PAT) in project settings.
- Remove all Create permissions for the
User
type. The function created below uses a PAT to create users via the API so the permissions are not needed.
Create a Firebase project:
Copy your Firebase project's web sdk api keys:
Create a Firebase Service Account :
- https://console.cloud.google.com/projectselector/iam-admin/serviceaccounts
- Download the provided private key
Configure Sign-In Methods for your Firebase project
- https://console.firebase.google.com
- Follow instructions or each social authentication provider you enable
- The example app uses Google and Github for demonstration
Sign up for Amazon Web Services
Create a user for your Lambda function
- http://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html
- NOTE Assign limited permissions to this user for a production environment
Generate AWS Access Credentials for that user
Install the serverless CLI
yarn global add serverless
Configure your AWS Access Credentials
Edit the env-stage.yml file
- (remove .EXAMPLE)
- Insert the Graphcool PAT and ProjectId
- Insert the Firebase Service Account private key file's contents
Edit the package.json file
- Change the "deploy-dev" script to your correct AWS region
Install dependencies
yarn
Run the function locally, using serverless-offline:
yarn run debug
Deploy to AWS:
yarn run build
yarn run deploy-dev
- Make note of the endpoint created
Create a new Schema Extension Function
- Paste the schema from
schema-extension.graphql
- Enter your AWS Lambda endpoint for the Webhook url
Edit examples/one-page/index.js
- Insert your Firebase web sdk apiKey and authDomain
- Insert your AWS Lambda endpoint
- Insert your Graphcool project endpoint
Install dependencies
cd examples/one-page
yarn
Start local server
yarn run start
Point your browser to http://localhost:8080
- Click the
Authenticate with ( Google | Github )
button - The selected provider requests login and access permissions
- A Firebase user is registered
- Click the "Get Firebase IdToken" button
- A Firebase Id Token is provided
- Click the "Get Graphcool IdToken = Local POST"
- A Graphcool Id Token in provided using a local mock serverless debug instance
- Click the "Get Graphcool IdToken - AWS graphQL" button
- Your app calls the Graphcool mutation
authenticateFirebaseUser(firebaseIdToken: String!)
- Your app calls the Graphcool mutation
- Click the "Get Graphcool IdToken = Local POST"
- Note that using another provider while already authenticated will link each subsequent social account
- If no user exists yet that corresponds to the passed
firebaseIdToken
, a newUser
node will be created - The Graphcool Id token can be used to authenticate further requests to Graphcool by inserting it in each http request's
authorization
header
- The tokens displayed by the example app can be decoded online at jwt.io.
- The tokens can be edited, invalidating them, to simulate a bad token.
This mutation will authenticate a user:
mutation {
# replace __FIREBASE_TOKEN__!
authenticateFirebaseUser(firebaseIdToken: "__FIREBASE_TOKEN__") {
wrappedToken
}
}
You should see that a new user has been created. The returned object (wrappedToken) contains a token (token) which can be used to authenticate requests to your Graphcool API as that user. The expiration date (exp), and user Ids (firebaseUserId, graphcoolUserId) are also included. These are included for convenience; your authentication process should not rely on the accuracy of these values. Meaning: it's safe to fail authentication if these values are not as expected, but not safe to consider a successful authentication; only the token can do that.
Note that running the mutation again for the same Firebase user will simply return a new token for the existing Graphcool user.
The Firebase web sdk keeps a user signed in indefinitely by default. But only signed in to Firebase. Firebase will provide a valid Id Token any time an app calls auth().currentUser.getIdToken()
.
The Graphcool token must be managed by a production application, especially regarding expiration. At the time this was written, Graphcool Id Tokens are valid for one month.