verifyServiceAccount function

Middleware verifyServiceAccount(List<String> allowedEmails, { bool verifyAudience = true, String? issuer, })

A Dart Frog middleware that verifies that the current route is invoked by an authorized service account.

The allowedEmails parameter is a list of service account emails that are allowed to invoke this route. The optional verifyAudience parameter specifies whether the token's audience (aud field) should be verified. This parameter defaults to true. The audience must be set to the route's URL. The optional issuer parameter represents the aauthorized OIDC issuer. Use issuerGoogle to verify Google Cloud IAM service accounts.

If the correct service account cannot be verified, this middleware will return either an HTTP 401 (Unauthorized) or 403 (Forbidden) response code.

Implementation

Middleware verifyServiceAccount(
  List<String> allowedEmails, {
  bool verifyAudience = true,
  String? issuer,
}) {
  return (handler) {
    return handler
        .use(verifyContextUser(allowedEmails))
        .use(validateToken(verifyAudience: verifyAudience, issuer: issuer))
        .use(gCloudPublicKeysProvider);
  };
}