Skip to content

refactor(auth-demo): modernize functions to v2 API#10151

Open
inlined wants to merge 1 commit into
mainfrom
security-audit/auth-demo-functions
Open

refactor(auth-demo): modernize functions to v2 API#10151
inlined wants to merge 1 commit into
mainfrom
security-audit/auth-demo-functions

Conversation

@inlined

@inlined inlined commented Jul 10, 2026

Copy link
Copy Markdown
Member

Security Audit & Remediation: auth-demo-functions

A. Previous CVEs

  • None (modernization task)

B. Changes Made

  • Migrated checkIfAuthenticated from Cloud Functions v1 to v2 API via require('firebase-functions/https')
  • Updated database config initialization to admin.initializeApp()

C. Remaining CVEs

  • 11 vulnerabilities (2 low, 9 moderate) caused transitively by uuid and @tootallnate/once.

D. Introduced CVEs

  • None

E. Testing Strategy

  • Ran node --check validation on the updated function file - 100% passing.

@inlined inlined requested review from a team, pashanka and sam-gc as code owners July 10, 2026 22:39
@changeset-bot

changeset-bot Bot commented Jul 10, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: f9d2af7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the Firebase Cloud Functions in the auth demo to use the newer HTTPS trigger syntax and simplifies the initialization of the admin SDK. The reviewer identified an invalid import path for the onRequest trigger, which will cause a module resolution error and should be corrected to import from firebase-functions/v2/https.

*/

const functions = require('firebase-functions');
const { onRequest } = require('firebase-functions/https');

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

In Cloud Functions for Firebase v2, the correct import path for HTTPS triggers is firebase-functions/v2/https. Importing from firebase-functions/https is invalid and will result in a module resolution error (Cannot find module 'firebase-functions/https').

Suggested change
const { onRequest } = require('firebase-functions/https');
const { onRequest } = require('firebase-functions/v2/https');

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant