Authentication token property "firebase" not defined on test app's instance

[REQUIRED] Environment info

firebase-tools: 8.4.1

Platform: Windows 10

[REQUIRED] Test case

Firestore rules file:

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    match /{prefix=**}/{document} {
        allow read, write: if request.auth.token.admin == true;
        // TODO Verify that this is not a bad practice
    }

    match /articles/{articleId} {
        allow read: if request.auth.uid != null;
        allow write: if "sign_in_provider" in request.auth.token.firebase
                     && request.auth.token.firebase.sign_in_provider != "anonymous";
    }
}

Test Suite:

import * as firebase from "@firebase/testing";
import * as fs from "fs";

const projectId = "firestore-emulator-example";
const data = {
  "title": "hello world"
}

const rules = fs.readFileSync("../firestore.rules", "utf8");

before(async () => {
  await firebase.loadFirestoreRules({projectId, rules});
});

beforeEach(async () => {
  await firebase.clearFirestoreData({projectId});
});

after(async () => {
  await Promise.all(firebase.apps().map(app => app.delete()));
});

describe('Articles collection', () => {
  it('should allow authenticated users to create an article', async () => {
    const db = firebase.initializeTestApp({"projectId": projectId, "auth": {
        "uid": "user-id",
        "email": "[e-mail]",
        "token": {
          "sub": "user-id",
          "aud": "test-project",
          "firebase": {
            "sign_in_provider": "password"
          }
        }
      }}).firestore();
    const articles = db.collection("articles");
    await firebase.assertSucceeds(articles.doc("article-id").set(data));
  });
});

[REQUIRED] Steps to reproduce

1. Create a firebase project with firestore
2. Use the firestore rules above
3. Run firestore emulator
4. Run test suite from above

[REQUIRED] Expected behavior

The tests runned locally fail with false negative and with the error “Property firebase is undefined on object.”. The same rules applied on the cloud rules succeed with the expected behavior.

[REQUIRED] Actual behavior

It is expected that the emulator’s instance is mirroring the correct behavior like in the actual production environment. The property firebase should, since it was provided by the authentication object auth, be defined and not null. The object structure is copied from the browser tests that can be run directly when modifying the rules.

Further Information

See https://groups.google.com/g/firebase-talk/c/g79uxsyOf3E/m/TvXnaqcjAwAJ

[samtstern]

@malliaridis (and anyone else following along here) this should be mostly addressed by this PR: https://github.com/firebase/firebase-js-sdk/pull/3876

In the next release of @firebase/rules-unit-testing the options.auth object will have strong types that help you discover and use all the available fields. I hope that helps!

[malliaridis]

Hello Scott, that solved my problem, thanks. 👍

The documentation varies a bit from the actual implementation at this point. Therefore the confusion with the auth object from https://firebase.google.com/docs/rules/rules-and-auth.

Maybe I could provide some suggestions to improve that part? Let me know. 😃