authenticateFirebaseUser top-level property

Middleware get authenticateFirebaseUser

A Dart Frog middleware that verifies that the current route is invoked by a signed-in Firebase user.

The extracted user information is placed in a User instance in the context. If no user is properly authenticated, this middleware will return an HTTP 401 (Unauthorized) response code. This middleware only verifies that requests are authenticated with a Firebase user, it doesn't verify the identity of that user. If you need to restrict the route to a specific set of users or if you need to provide custom logic for different users, you'll need to do it either in the request handler or in a downstream middleware.

For example, authorizing the user in the request handler would look like this:

const allowedEmails = [...];

Response onRequest(RequestContext context) {
  final user = context.read<User>();
  if (!user.emailVerified || !allowedEmails.contains(user.email)) {
    return Response(statusCode: HttpStatus.forbidden);
  }
  return Response(body: 'Welcome ${user.email}');
}

In order to authorize the user in a downstream middleware, you can either implement your own middleware that would get the User object from the RequestContext, or insert verifyContextUser directly in the middleware chain, which would look like this:

const allowedEmails = [...];

Handler middleware(Handler handler) {
  return handler
      .use(
        verifyContextUser(allowedEmails),
      )
      .use(
        authenticateFirebaseUser,
      );
}

Implementation

Middleware get authenticateFirebaseUser {
  return (Handler handler) {
    return handler
        .use(validateFirebaseToken())
        .use(projectProvider)
        .use(firebasePublicKeysProvider);
  };
}