Authentication Emulator Supports MFA for Simple Read/Write User Operations (Fixes #3170) #3173

wokkaflokka · 2021-02-24T07:09:06Z

Description

This PR proposes an initial resolution for #3170 by implementing rudimentary support for "mutli-factor" information during admin SDK operations (e.g., admin.auth().createUser(...)).

Note, deletes, client operations, and advanced scenarios are intentionally excluded from this change at this time. It seems like there is large potential scope of support for MFA in general, and possibly some changes going on under the hood, and I wanted to keep this as focused as possible to start.

Scenarios Tested

This change is focused on supporting read/write operations from the admin SDK while using the Authentication Emulator. It has been tested using the test case provided on #3170 as well as a modified variant of the test case from #3170, provided here.

import firebaseAdmin from 'firebase-admin';

let app: firebaseAdmin.app.App;

beforeAll(() => {
    app = firebaseAdmin.initializeApp({
        projectId: 'run-me-in-an-emulator',
    });
});

afterAll(async () => {
    await app.delete();
});

test('Firebase Authentication Emulator Returns MultiFactorSettings Data', async () => {
    expect(!!process.env.FIREBASE_AUTH_EMULATOR_HOST).toEqual(true);

    const user = await app.auth().createUser({
        email: '[email protected]',
        emailVerified: true,
        password: undefined,
        multiFactor: {
            enrolledFactors: [
                {
                    phoneNumber: '+12813308004',
                    factorId: 'phone',
                    displayName: 'Mobile',
                } as firebaseAdmin.auth.CreatePhoneMultiFactorInfoRequest,
            ],
        },
    });

    expect(user.multiFactor).toEqual({
        enrolledFactors: [{
            phoneNumber: '+12813308004',
            factorId: 'phone',
            displayName: 'Mobile',
            enrollmentTime: null,
            uid: expect.stringMatching(/^.+$/),
        }],
    });
});

Sample Commands

To run the test case above, configure a minimal typescript project with the implied dependencies and execute something like:

firebase emulators:exec --debug 'npm run test firebaseRepro.test.ts'

Fixes #3170.

…Operations (firebase#3170)

samtstern · 2021-02-24T10:38:25Z

@wokkaflokka thanks for the super clear issue and the PR! Assigning to @yuchenshi who does most of the Auth emulator things around here.

(also 👋 we met back in the Firestore alpha days)

yuchenshi

Thanks for the PR. Unfortunately, this creates a confusing situation where a user with mfaInfo can still sign in without MFA. I understand that you won't need to full implementation for you use case, but would you mind making it so that users with mfaInfo cannot sign in at all with a NotImplementedError?

src/emulator/auth/state.ts

src/test/emulators/auth/signUp.spec.ts

wokkaflokka · 2021-03-11T19:23:40Z

@yuchenshi thanks for the review. I'll get to work on those changes.

…Authentication Emulator

… to the `updateUser` path + add test cases for validation of `signUp` MFA flows

wokkaflokka · 2021-03-15T17:14:09Z

@yuchenshi appreciate all of your help to date. I've completed a second pass, addressing your initial review comments and extending support to the update case. My personal schedule should be less chaotic for the foreseeable future, so I should also be able to respond to any and all feedback on a quicker cycle at this time.

Summary of Changes

Throw NotImplementedError for all "sign in" methods whenever a user with mfaInfo attempts to sign-in (9e6da88).
Additional test-cases added around validation and formatting for "sign-up" related MFA flows (a41f116).
Validation brought into operations.ts for MFA-related operations (a41f116).
Extended MFA support to update flows and added additional test cases for the update case (a41f116).

src/emulator/auth/state.ts

src/test/emulators/auth/helpers.ts

src/test/emulators/auth/customToken.spec.ts

src/test/emulators/auth/setAccountInfo.spec.ts

src/test/emulators/auth/signUp.spec.ts

src/emulator/auth/operations.ts

src/emulator/auth/state.ts

yuchenshi

This is looking great and I've left a few comments inline. The big blockers are the uniqueness checks and consistency for the maps in state.

And as of this PR, mfaInfo will be lost when you export and re-import users. The scope of the PR is already quite big and I think we should leave a TODO and address it in a follow-up PR.

wokkaflokka · 2021-03-15T19:09:17Z

@yuchenshi once again, thanks for the thorough review. I'll have another pass this evening or tomorrow morning addressing the points you raise. To summarize what I gleaned from review/what I intend to change in my follow-up:

Fix the uniqueness behavior to require uniqueness per-user rather than across all users (match the behavior of the actual SDK).
General updates to validation / internal procedures (as directed by comments).
Improvements to style and implementation of some test code (as directed by comments).
Add a TODO for mfa behavior related import/export flows. I may file a github issue for the behavior, as well.

2. match SDK behavior with respect to MFA ID uniqueness constraints 3. stylistic updates to test code 4. add TODOs regarding import/export MFA support

…A Enrollment IDs on create and update

wokkaflokka · 2021-03-17T22:40:49Z

@yuchenshi -- well, overpromised and underdelivered, but I've completed another pass of this PR. Changes are in two commits. I believe all existing comments should be addressed; the changes ended up being larger than expected, but I think it was a net positive. One of the benefits of this change is that I think we achieved a simplified state management for MFA data.

In the first commit, I implemented the points 1-4 I mentioned I would previously fix.

In a final testing pass, I spent a little bit of time testing against my real project to see how create/update work when duplicate enrollment ID's and duplicate phone numbers are specified. Based on the behaviors I observed, I implemented some changes in a second commit. These behaviors match the SDK for the following:

If duplicate phone numbers are specified on create, only a single factor is created per duplicated phone number.
If duplicate phone numbers are specified on update, only a single factor is created per duplicated phone number.
MFA Enrollment ID is completely ignored on create (previously implemented).
On update, a duplicate MFA Enrollment ID is (a) ignored if it is provided on a duplicated phone number (ignored because the duplicated phone number is ignored), and (b) raises an error if two different phone numbers specify the same MFA enrollment ID.

yuchenshi

I think we're pretty close here. The only real blocker is using some constants for phone numbers instead of real phone numbers.

yuchenshi · 2021-03-18T00:13:14Z

src/test/emulators/auth/setAccountInfo.spec.ts

    const secondMfaFactor = {
      displayName: "Second MFA Factor",
-      phoneInfo: TEST_PHONE_NUMBER,
+      phoneInfo: "+12813308004",


I appreciate the reference, but let's not put Mike's number in the source code. If you need a different phone number, please create a constant like TEST_PHONE_NUMBER_2 and stick to the fictional blocks (e.g. the next number after TEST_PHONE_NUMBER). I think we'd need three or four of these.

yuchenshi · 2021-03-18T00:15:03Z

src/emulator/auth/operations.ts

+function getMfaEnrollmentsFromRequest(
+  state: ProjectState,
+  request: MfaEnrollments,
+  getEnrollmentId: (enrollment: MfaEnrollment, enrollmentIds: Set<string>) => string


nit: I'd actually suggest just options: {generateEnrollmentIds: boolean} instead. Less code, less abstractions and more readable.

yuchenshi · 2021-03-18T00:17:17Z

src/test/emulators/auth/setAccountInfo.spec.ts

+    const savedMfaInfo = savedUserInfo.mfaInfo![0];
+    expect(savedMfaInfo?.mfaEnrollmentId).to.be.a("string").and.not.empty;
+    savedMfaInfo.displayName = "New Display Name";
+    savedMfaInfo.phoneInfo = "+15555550101";


Similarly this could use a constant like TEST_PHONE_NUMBER_2

yuchenshi · 2021-03-18T00:18:11Z

src/test/emulators/auth/setAccountInfo.spec.ts

    const user = {
      email: "[email protected]",
      password: "notasecret",
-      mfaInfo: [mfaInfo, mfaInfo, mfaInfo],
+      mfaInfo: [TEST_MFA_INFO, { ...TEST_MFA_INFO, phoneInfo: "+12813308004" }],


yuchenshi · 2021-03-18T00:18:23Z

src/test/emulators/auth/setAccountInfo.spec.ts


    const newMfaInfo = {
      displayName: "New New",
-      phoneInfo: "+12813308004",
+      phoneInfo: "+12813308005",


use a test phone number please

yuchenshi · 2021-03-18T00:25:36Z

src/test/emulators/auth/signUp.spec.ts

    const user = {
      email: "[email protected]",
      password: "notasecret",
-      mfaInfo: [mfaInfo, mfaInfo, mfaInfo],
+      mfaInfo: [TEST_MFA_INFO, { ...TEST_MFA_INFO, phoneInfo: "+12813308004" }],


I wish we had more test phone numbers Back Then.

yuchenshi · 2021-03-18T00:26:26Z

src/test/emulators/auth/signUp.spec.ts

+    expect(info.mfaInfo).to.have.length(2);
+    for (const savedMfaInfo of info.mfaInfo!) {
+      if (savedMfaInfo.phoneInfo !== TEST_MFA_INFO.phoneInfo) {
+        expect(savedMfaInfo.phoneInfo).to.eq("+12813308004");


If I were you I'd probably do a search and replace

yuchenshi · 2021-03-18T00:28:04Z

src/test/emulators/auth/signUp.spec.ts

+        TEST_MFA_INFO,
+        TEST_MFA_INFO,
+        TEST_MFA_INFO,
+        { ...TEST_MFA_INFO, phoneInfo: "+12813308004" },


25,000 calls per day

yuchenshi · 2021-03-18T00:28:49Z

src/test/emulators/auth/signUp.spec.ts

+    expect(bobInfo.mfaInfo).to.have.length(2);
+    for (const savedMfaInfo of bobInfo.mfaInfo!) {
+      if (savedMfaInfo.phoneInfo !== TEST_MFA_INFO.phoneInfo) {
+        expect(savedMfaInfo.phoneInfo).to.eq("+12813308004");


Are we stress testing the phone carrier?

yuchenshi · 2021-03-18T00:30:30Z

src/test/emulators/auth/signUp.spec.ts

-      phoneInfo: TEST_PHONE_NUMBER,
-      mfaEnrollmentId: randomId(28),
+  it("should ignore if multi factor enrollment ID is specified on create", async () => {
+    const mfaEnrollmentId1 = randomId(28);


Let's hard code some IDs like thisShouldBeIgnored1 -- more readable, and the test won't randomly fail if we had really really bad (good?) luck with the RNG.

wokkaflokka · 2021-03-18T02:17:09Z

@yuchenshi all very reasonable. Can't blame ya!

Test numbers moved to constants and changed.
Replace function parameter with options (great recommendation).
Remove explicit test dependency on RNG (another great rec).

Thanks very much for all your time and help so far. Much appreciated.

yuchenshi · 2021-03-18T21:11:04Z

@wokkaflokka One last thing -- I meant that we should use "thisShouldBeIgnored1 for MFA IDs that are ignored (during sign up). For the other MFA enrollment IDs, let's use some other name such as enrollmentId1 etc. Once that is done and the branch is up to date, I'll do the changelogs and merge.

wokkaflokka · 2021-03-18T21:52:04Z

@yuchenshi roger that, pushed another one.

yuchenshi · 2021-03-18T22:47:14Z

@wokkaflokka Merged! Thanks a ton for the PR and I've filed #3221 to track the remaining work.

samtstern · 2021-03-19T12:17:29Z

@wokkaflokka thank you so much for this contribution and thanks @yuchenshi for the super thorough reviews!

…tions (Fixes firebase#3170) (firebase#3173) * Authentication Emulator Supports MFA Info for Simple Read/Write User Operations (firebase#3170) * throw NotImplementedError if an MFA user attempts to login using the Authentication Emulator * bring validation into operations layer and extend MFA related support to the `updateUser` path + add test cases for validation of `signUp` MFA flows * 1. simplify state handling for MFA 2. match SDK behavior with respect to MFA ID uniqueness constraints 3. stylistic updates to test code 4. add TODOs regarding import/export MFA support * match the SDK behavior for duplicated phone numbers and duplicated MFA Enrollment IDs on create and update * change import for brevity * update constants and IDs used in tests + simplify ID generation * update variables in test * Update CHANGELOG.md Co-authored-by: Yuchen Shi <[email protected]>

Authentication Emulator Supports MFA Info for Simple Read/Write User …

4f2e2bd

…Operations (firebase#3170)

google-cla bot added the cla: yes Manual indication that this has passed CLA. label Feb 24, 2021

samtstern requested a review from yuchenshi February 24, 2021 10:38

samtstern assigned yuchenshi Feb 24, 2021

yuchenshi requested changes Mar 5, 2021

View reviewed changes

src/emulator/auth/state.ts Outdated Show resolved Hide resolved

src/test/emulators/auth/signUp.spec.ts Outdated Show resolved Hide resolved

yuchenshi assigned wokkaflokka and unassigned yuchenshi Mar 5, 2021

wokkaflokka and others added 5 commits March 11, 2021 15:09

Merge branch 'master' into issue.3170

b2ce6d6

throw NotImplementedError if an MFA user attempts to login using the …

9e6da88

…Authentication Emulator

Merge branch 'master' into issue.3170

7cc3395

Merge branch 'master' into issue.3170

704982b

bring validation into operations layer and extend MFA related support…

a41f116

… to the `updateUser` path + add test cases for validation of `signUp` MFA flows

wokkaflokka requested a review from yuchenshi March 15, 2021 17:08

yuchenshi reviewed Mar 15, 2021

View reviewed changes

wokkaflokka and others added 3 commits March 17, 2021 14:17

Merge branch 'master' into issue.3170

03beba2

1. simplify state handling for MFA

0c592cf

2. match SDK behavior with respect to MFA ID uniqueness constraints 3. stylistic updates to test code 4. add TODOs regarding import/export MFA support

match the SDK behavior for duplicated phone numbers and duplicated MF…

d77f6f5

…A Enrollment IDs on create and update

change import for brevity

968864a

wokkaflokka requested a review from yuchenshi March 17, 2021 22:47

yuchenshi reviewed Mar 18, 2021

View reviewed changes

update constants and IDs used in tests + simplify ID generation

c69eb13

Merge branch 'master' into issue.3170

21190d9

update variables in test

f48005a

Update CHANGELOG.md

09c6d9f

yuchenshi approved these changes Mar 18, 2021

View reviewed changes

yuchenshi merged commit be0d2b6 into firebase:master Mar 18, 2021

yuchenshi mentioned this pull request Mar 18, 2021

Authentication Emulator should export / import mfaInfo field #3221

Open

wokkaflokka deleted the issue.3170 branch October 27, 2021 20:14

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Authentication Emulator Supports MFA for Simple Read/Write User Operations (Fixes #3170) #3173

Authentication Emulator Supports MFA for Simple Read/Write User Operations (Fixes #3170) #3173

wokkaflokka commented Feb 24, 2021 •

edited by yuchenshi

Loading

samtstern commented Feb 24, 2021 •

edited

Loading

yuchenshi left a comment

wokkaflokka commented Mar 11, 2021

wokkaflokka commented Mar 15, 2021 •

edited

Loading

yuchenshi left a comment

wokkaflokka commented Mar 15, 2021 •

edited

Loading

wokkaflokka commented Mar 17, 2021 •

edited

Loading

yuchenshi left a comment

yuchenshi Mar 18, 2021

yuchenshi Mar 18, 2021

yuchenshi Mar 18, 2021

yuchenshi Mar 18, 2021

yuchenshi Mar 18, 2021

yuchenshi Mar 18, 2021

yuchenshi Mar 18, 2021

yuchenshi Mar 18, 2021

yuchenshi Mar 18, 2021

yuchenshi Mar 18, 2021

wokkaflokka commented Mar 18, 2021

yuchenshi commented Mar 18, 2021

wokkaflokka commented Mar 18, 2021

yuchenshi commented Mar 18, 2021

samtstern commented Mar 19, 2021

Authentication Emulator Supports MFA for Simple Read/Write User Operations (Fixes #3170) #3173

Authentication Emulator Supports MFA for Simple Read/Write User Operations (Fixes #3170) #3173

Conversation

wokkaflokka commented Feb 24, 2021 • edited by yuchenshi Loading

Description

Scenarios Tested

Sample Commands

samtstern commented Feb 24, 2021 • edited Loading

yuchenshi left a comment

Choose a reason for hiding this comment

wokkaflokka commented Mar 11, 2021

wokkaflokka commented Mar 15, 2021 • edited Loading

yuchenshi left a comment

Choose a reason for hiding this comment

wokkaflokka commented Mar 15, 2021 • edited Loading

wokkaflokka commented Mar 17, 2021 • edited Loading

yuchenshi left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wokkaflokka commented Mar 18, 2021

yuchenshi commented Mar 18, 2021

wokkaflokka commented Mar 18, 2021

yuchenshi commented Mar 18, 2021

samtstern commented Mar 19, 2021

wokkaflokka commented Feb 24, 2021 •

edited by yuchenshi

Loading

samtstern commented Feb 24, 2021 •

edited

Loading

wokkaflokka commented Mar 15, 2021 •

edited

Loading

wokkaflokka commented Mar 15, 2021 •

edited

Loading

wokkaflokka commented Mar 17, 2021 •

edited

Loading