node.js - Firebase 提供 --only 功能，admin.auth() 在本地不起作用，除非我手动设置 key.json

Question

我正在尝试使用 firebaseserve --only 函数在本地运行云函数。如果我在此处通过 Firebase 控制台创建服务帐户时手动指定下载的 key.json，则它可以工作: https://console.firebase.google.com/project/project-id/settings/serviceaccounts/adminsdk 。 然后执行export GOOGLE_APPLICATION_CREDENTIALS=key.json。为什么我必须这样做？ firebase 或 gcloud 不应该正确处理这个问题吗？我认为 functions.config().firebase 中的凭据是 ApplicationDefault。 https://developers.google.com/identity/protocols/application-default-credentials 。据此，首先检查上面的 env 变量，因此如果存在它就可以工作。但#2 不应该正确验证我吗？

我有用于应用程序引擎的 gcloud，因此我已完成 gcloud init 和 gcloud auth application-default login。

我在index.js中初始化我的应用程序

const admin = require('firebase-admin');
const functions = require('firebase-functions');

admin.initializeApp(functions.config().firebase);

firebaseserve--onlyfunctions 可以很好地部署函数。但是，当我执行使用此代码 admin.auth().getUser(uid)... 的代码时，它会因以下错误而中断:

Error: An internal error has occurred. Raw server response: "{"error":{"errors":[{"domain":"usageLimits","reason":"accessNotConfigured","message":"Access Not Configured. Google Identity Toolkit API has not been used in project 7640...50 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/identitytoolkit.googleapis.com/overview?project=7640...50 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.","extendedHelp":"https://console.developers.google.com/apis/api/identitytoolkit.googleapis.com/overview?project=7640...50"}],"code":403,"message":"Access Not Configured. Google Identity Toolkit API has not been used in project 7640...50 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/identitytoolkit.googleapis.com/overview?project=7640...50 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry."}}

项目编号与我的 Firebase 项目或 console.cloud.google.com 中的项目 ID/编号不对应

如果没有 gcloud，我会收到此错误

Error: Credential implementation provided to initializeApp() via the "credential" property failed to fetch a valid Google OAuth2 access token with the following error: "Error fetching access token: invalid_grant (Token has been expired or revoked.)". There are two likely causes: (1) your server time is not properly synced or (2) your certificate key file has been revoked. To solve (1), re-sync the time on your server. To solve (2), make sure the key ID for your key file is still present at https://console.firebase.google.com/iam-admin/serviceaccounts/project. If not, generate a new key file at https://console.firebase.google.com/project/_/settings/serviceaccounts/adminsdk

类似于https://github.com/urish/firebase-server/issues/81

我已经生成了一个 key 文件。我尝试删除现有的并创建新的，唯一的解决方案是下载生成的 key 并手动导出环境变量

除此之外还有其他办法吗？

Answer 1

技术上是可以的，但您可以构建代码，以便在本地测试时使用本地 key ，并在服务器上运行时使用服务 key 。

为此，我将环境变量 FB_SERVICE_ACCOUNT_KEY 设置为 json key 的路径。当它未设置时(即部署在 Firebase 函数中)，将使用标准 init。

这是一个基本示例

if(process.env.FB_SERVICE_ACCOUNT_KEY){
    var serviceAccount = require(process.env.FB_SERVICE_ACCOUNT_KEY);
    admin.initializeApp({
      credential: admin.credential.cert(serviceAccount),
      databaseURL: `https://${process.env.GCLOUD_PROJECT}.firebaseio.com`
    });
}
else{
    admin.initializeApp(functions.config().firebase);
}