Struct Credentials

pub struct Credentials {
    pub project_id: String,
    pub private_key_id: String,
    pub private_key: String,
    pub client_email: String,
    pub client_id: String,
    pub api_key: String,
    /* private fields */
}

Service account credentials

Especially the service account email is required to retrieve the public json web key set (jwks) for verifying Google Firestore tokens.

The api_key is necessary for interacting with the Firestore REST API.

Internals:

The private key is used for signing JWTs (javascript web token). A signed jwt, encoded as a base64 string, can be exchanged into a refresh and access token.

Fields

project_id: String

private_key_id: String

private_key: String

client_email: String

client_id: String

api_key: String

Implementations

impl Credentials

pub async fn new( credentials_file_content: &str, ) -> Result<Credentials, FirebaseError>

Create a Credentials object by parsing a google-service-account json string

Example:

Assuming that your firebase service account credentials file is called “service-account-test.json” and a downloaded jwk-set file is called “service-account-test.jwks” this example embeds the file content during compile time. This avoids and http or io calls.

use firestore_db_and_auth::{Credentials};
use firestore_db_and_auth::jwt::JWKSet;

let c: Credentials = Credentials::new(include_str!("../tests/service-account-test.json")).await.unwrap()
    .with_jwkset(&JWKSet::new(include_str!("../tests/service-account-test.jwks")).unwrap()).await.unwrap();

You need two JWKS files for this crate to work:

• https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com
• https://www.googleapis.com/service_accounts/v1/jwk/{your-service-account-email}

pub async fn from_file(credential_file: &str) -> Result<Self, FirebaseError>

Create a Credentials object by reading and parsing a google-service-account json file.

This is a convenience method, that reads in the given credentials file and acts otherwise the same as the Credentials::new method.

pub async fn with_jwkset( self, jwks: &JWKSet, ) -> Result<Credentials, FirebaseError>

Adds public-key JWKs to a credentials instance and returns it.

This method will also verify that the given JWKs files allow verification of Google access tokens. This is a convenience method, you may also just use Credentials::add_jwks_public_keys.

pub async fn download_jwkset(self) -> Result<Credentials, FirebaseError>

The public keys to verify generated tokens will be downloaded, for the given service account as well as for “securetoken@system.gserviceaccount.com”. Do not use this option if additional downloads are not desired, for example in cloud functions that require fast cold boot start times.

You can use Credentials::add_jwks_public_keys to manually add/replace public keys later on.

Example:

Assuming that your firebase service account credentials file is called “service-account-test.json”.

use firestore_db_and_auth::{Credentials};

let c: Credentials = Credentials::new(include_str!("../tests/service-account-test.json")).await.unwrap()
    .download_jwkset().await.unwrap();

pub async fn verify(&self) -> Result<(), FirebaseError>

Verifies that creating access tokens is possible with the given credentials and public keys. Returns an empty result type on success.

pub async fn verify_token( &self, token: &str, ) -> Result<TokenValidationResult, FirebaseError>

pub async fn decode_secret( &self, kid: &str, ) -> Result<Option<Arc<Secret>>, FirebaseError>

Find the secret in the jwt set that matches the given key id, if any. Used for jws validation

pub async fn add_jwks_public_keys(&self, jwkset: &JWKSet)

Add a JSON Web Key Set (JWKS) to allow verification of Google access tokens.

Example:

use firestore_db_and_auth::credentials::Credentials;
use firestore_db_and_auth::JWKSet;

let mut c : Credentials = serde_json::from_str(include_str!("../tests/service-account-test.json")).unwrap();
c.add_jwks_public_keys(&JWKSet::new(include_str!("../tests/service-account-test.jwks")).unwrap()).await;
c.compute_secret().await.unwrap();
c.verify().await.unwrap();

pub async fn download_google_jwks(&self) -> Result<(), FirebaseError>

If you haven’t called Credentials::add_jwks_public_keys to manually add public keys, this method will download one for your google service account and one for the oauth related securetoken@system.gserviceaccount.com service account.

pub async fn compute_secret(&mut self) -> Result<(), FirebaseError>

Compute the Rsa keypair by using the private_key of the credentials file. You must call this if you have manually created a credentials object.

This is automatically invoked if you use Credentials::new or Credentials::from_file.

Trait Implementations

impl Clone for Credentials

fn clone(&self) -> Credentials

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Credentials

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Credentials

fn default() -> Credentials

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Credentials

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Credentials

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.