Firebase Custom Claims doesn't propagate

2
votes

I'm working in an Angular6 app with angularfire2. I'm setting the roles as custom claims in user creation, but it doesn't seem to propagate.

When I'm creating the user I send the userid, businessid and role to a cloud function:

bid > businessid

urole > role

req.body.uid > userid

  const customClaims = {
    roles: { [bid]: urole }
  }
  admin.auth().setCustomUserClaims(req.body.uid, customClaims)
    .then(result => {
      res
        .status(200)
        .send()
    })

The problem is when the call to cloud function finishes and I want to redirect the user to a route which requires the user to have the custom claim set, but it fails. After some debugging, I've found out that if run:

this.angularFireAuth.auth.currentUser.getIdTokenResult(true).then(result => {
      return result.claims.roles
    })

immediately after the call to the cloud function "result.claims.roles" is undefined, but if I refresh the page, "result.claims.roles" have the data I set before.

I've already tried the reload method, and getIdToken(true) but I'm getting the same problem.

Is there a way to avoid refreshing the page and get the custom claims?

Thank you!

2
javascriptfirebasefirebase-authenticationangularfire2
Can you add the code where you make the call to HTTP trigger endpoint and then get the result? I just want to verify that the code waits for the result before calling getIDTokenResult(true). Also be sure to update your SDKs to the latest version, as rules for Cloud Firestore, Cloud Storage, and RTDB used to only updated when the uid changed, not when the token changed. - Jen Person
Jen, this is the call I've made setting up the role: return this.http.post(${this.environment.backendHostUrl}/api/user/role, { uid: userId, role: role, business: business }).pipe( catchError(error => of(console.log(error))) ).subscribe(response => { debugger <--- I get: response = "null" }) - EzeTeja

2 Answers

6
votes

When the user is signed in, they get an ID token that is valid for about an hour. If you set a custom claim, their profile is updated immediately, but their ID token is not auto-updated. So you'll need to refresh their ID token to get the new custom claims.

As far as I know this ID token is only refreshed by calling getIdTokenResult if it has expired. If that's the cause, calling user.reload() and then getting the ID token should give you the updated claims.

1
votes

For me it simply worked taking the advice from one of the comments:

// --------
// Frontend
// --------

// Triggering the cloud function
const url: string = 'url-to-your-cloud-function'
await this.http.post<unknown>(url, {}).toPromise();


// After cloud function was run and custom claim was set -> refresh the id token
// The 'currentUser' is a reference to the firebase user
await this.authService.currentUser.getIdToken(true);

// --------
// Cloud Function - createSubscription
// --------

const createSubscription = () => {  
  await admin.auth().setCustomUserClaims(userId, {
    subscriber: true
  })
}