Function checkAuthenticationAndAccess

apps/functions/code-of-conduct/shared.ts:59–102

(
  context: functions.https.CallableRequest,
)

/** Verify that the incoming request is authenticated and authorized for access. */
export async function checkAuthenticationAndAccess(
  context: functions.https.CallableRequest,
): Promise<AuthenticatedCallableContext> {
  // Authentication is managed by firebase as this occurs within the Firebase functions context.
  // If the user is unauthenticted, the authorization object will be undefined.
  if (context.auth == undefined) {
    // Throwing an HttpsError so that the client gets the error details.
    throw new functions.https.HttpsError('unauthenticated', 'This action requires authentication');
  }

  const user = await admin.auth().getUser(context.auth.uid);
  const githubProvider = user.providerData.find((data) => data.providerId === 'github.com');

  if (!githubProvider) {
    throw new functions.https.HttpsError(
      'permission-denied',
      'You must link your Github account to use this application.',
    );
  }

  const github = await getAuthenticatedGithubClient();

  try {
    // Resolve the github username from the connected UID
    const {data: githubUser} = await github.request('GET /user/{user_id}', {
      user_id: githubProvider.uid,
    });

    await github.orgs.checkMembershipForUser({
      org: 'angular',
      username: githubUser.login,
    });
  } catch (err: any) {
    if (err.status === 404) {
      throw new functions.https.HttpsError(
        'permission-denied',
        'You must be a member of the Angular Github organization.',
      );
    }
    throw err;
  }

  return context as AuthenticatedCallableContext;
}

/** Retrieves a Github client instance authenticated as the Angular Robot Github App. */
export async function getAuthenticatedGithubClient(): Promise<Octokit> {