72 lines
3.5 KiB
JavaScript
72 lines
3.5 KiB
JavaScript
"use strict";
|
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
exports.checkDeviceIntegrity = void 0;
|
|
const https_1 = require("firebase-functions/v2/https");
|
|
const google_auth_library_1 = require("google-auth-library");
|
|
const log_1 = require("../log");
|
|
const PACKAGE_NAME = 'app.closer';
|
|
const PLAY_INTEGRITY_URL = `https://playintegrity.googleapis.com/v1/${PACKAGE_NAME}:decodeIntegrityToken`;
|
|
// Cap the upstream call so a hung Play Integrity API can't pin the instance for the whole
|
|
// function timeout; the fail-closed catch below turns a timeout into passed:false.
|
|
const PLAY_INTEGRITY_TIMEOUT_MS = 10000;
|
|
/**
|
|
* Verifies a Play Integrity API token server-side and returns whether the
|
|
* device meets basic integrity requirements.
|
|
*
|
|
* Called by [PlayIntegrityChecker] on app startup. Requires the caller to be
|
|
* authenticated — the Firebase Auth token is verified automatically by the
|
|
* Functions runtime.
|
|
*
|
|
* Setup required before this function works in production:
|
|
* 1. Enable the Play Integrity API in your Google Cloud project.
|
|
* 2. Link the Cloud project to your Play Console app (Play Console →
|
|
* Setup → API access → Link to Cloud project).
|
|
* 3. Grant the Cloud Functions service account the "Play Integrity API User"
|
|
* role in IAM, or use a dedicated service account key via
|
|
* GOOGLE_APPLICATION_CREDENTIALS.
|
|
*
|
|
* If the Play Integrity API is not configured the function fails-closed
|
|
* (returns passed: false). Configure the API and grant the service account
|
|
* the "Play Integrity API User" IAM role before deploying to production.
|
|
*/
|
|
exports.checkDeviceIntegrity = (0, https_1.onCall)({ memory: '512MiB' }, async (request) => {
|
|
var _a;
|
|
if (!request.auth) {
|
|
throw new https_1.HttpsError('unauthenticated', 'Caller must be authenticated.');
|
|
}
|
|
if (!request.app) {
|
|
throw new https_1.HttpsError('failed-precondition', 'App Check verification required.');
|
|
}
|
|
const token = (_a = request.data) === null || _a === void 0 ? void 0 : _a.token;
|
|
if (!token || typeof token !== 'string') {
|
|
throw new https_1.HttpsError('invalid-argument', 'token is required.');
|
|
}
|
|
try {
|
|
const verdicts = await decodeIntegrityToken(token);
|
|
const passed = verdicts.includes('MEETS_DEVICE_INTEGRITY') ||
|
|
verdicts.includes('MEETS_STRONG_INTEGRITY');
|
|
return { passed, verdicts };
|
|
}
|
|
catch (err) {
|
|
log_1.logger.error('[checkDeviceIntegrity] verification failed', { error: String(err) });
|
|
// Fail-closed: an unverifiable request is treated as failed, not passed.
|
|
// Ensure the Play Integrity API is enabled and the service account has
|
|
// "Play Integrity API User" role before deploying to production.
|
|
return { passed: false, verdicts: [], error: 'verification_unavailable' };
|
|
}
|
|
});
|
|
async function decodeIntegrityToken(token) {
|
|
var _a, _b, _c;
|
|
const auth = new google_auth_library_1.GoogleAuth({
|
|
scopes: ['https://www.googleapis.com/auth/playintegrity'],
|
|
});
|
|
const client = await auth.getClient();
|
|
const response = await client.request({
|
|
url: PLAY_INTEGRITY_URL,
|
|
method: 'POST',
|
|
data: { integrity_token: token },
|
|
timeout: PLAY_INTEGRITY_TIMEOUT_MS,
|
|
});
|
|
return ((_c = (_b = (_a = response.data.tokenPayloadExternal) === null || _a === void 0 ? void 0 : _a.deviceIntegrity) === null || _b === void 0 ? void 0 : _b.deviceRecognitionVerdict) !== null && _c !== void 0 ? _c : []);
|
|
}
|
|
//# sourceMappingURL=checkDeviceIntegrity.js.map
|