Firebase Cloud Functions V2调用授权失败问题排查求助

错误日志 #

{
  "httpRequest": {},
  "insertId": "647865c20002422d2d32b259",
  "labels": {},
  "logName": "projects/faker-app-flutter-firebase-dev/logs/run.googleapis.com%2Frequests",
  "receiveTimestamp": "2023-06-01T09:32:50.154902339Z",
  "resource": {},
  "severity": "WARNING",
  "spanId": "11982344486849947204",
  "textPayload": "The request was not authorized to invoke this service. Read more at https://cloud.google.com/run/docs/securing/authenticating Additional troubleshooting documentation can be found at: https://cloud.google.com/run/docs/troubleshooting#401",
  "timestamp": "2023-06-01T09:32:50.138090Z",
  "trace": "projects/faker-app-flutter-firebase-dev/traces/ddcb5a4df500af085b7a7f6f89a72ace",
  "traceSampled": true
}

问题背景 #

• 函数在Firebase本地模拟器运行正常，仅部署后调用出现授权错误
• 已通过firebase deploy --only functions完成部署
• 客户端调用时用户已完成授权
• 使用Firebase Functions v2编写的可调用函数，代码如下：

import * as admin from "firebase-admin"
import * as functions from "firebase-functions/v2"
import * as logger from "firebase-functions/logger";

if (admin.apps.length === 0) {
  admin.initializeApp()
}

export const deleteAllUserJobs = functions.https.onCall(async (context: functions.https.CallableRequest) => {
  const uid = context.auth?.uid
  if (uid === undefined) {
    throw new functions.https.HttpsError("unauthenticated", "You need to be authenticated to perform this action")
  }
  const firestore = admin.firestore()
  const collectionRef = firestore.collection(`/users/${uid}/jobs`)
  const collection = await collectionRef.get()
  logger.debug(`Deleting ${collection.docs.length} docs at "/users/${uid}/jobs"`)
  
  await firestore.runTransaction(async (transaction) => {
      for (const doc of collection.docs) {
          transaction.delete(firestore.doc(`/users/${uid}/jobs/${doc.id}`))
      }
  })

  logger.debug(`Deleted ${collection.docs.length} docs at "/users/${uid}/jobs"`)
  return {"success": true}
})

需求：解决调用时的授权错误，确保已认证用户能正常调用该函数。

Firebase Functions v2部署后托管在Cloud Run上，默认IAM权限限制了未授权访问，需配置对应权限：

方法1：CLI快速配置（适合测试环境） #

重新部署函数时添加--allow-unauthenticated参数，允许所有用户调用（注：函数内部已做登录校验，未认证用户会被函数本身拒绝）：

firebase deploy --only functions --allow-unauthenticated

方法2：GCP控制台精细配置（推荐生产环境） #

1. 进入GCP控制台的Cloud Run服务页面
2. 找到对应函数的Cloud Run服务（名称格式通常为us-central1-<函数名>-<随机后缀>）
3. 切换到权限标签，点击添加主账号
4. 输入allAuthenticatedUsers（代表所有已认证的Firebase/GCP用户）
5. 为该账号分配Cloud Run 调用者角色
6. 保存配置

额外说明 #

• 若需更严格的权限控制，可在GCP控制台添加特定用户邮箱或服务账号，同样分配Cloud Run 调用者角色
• 函数代码中的context.auth?.uid校验会在权限校验后再次拦截未登录用户，确保逻辑安全

内容的提问来源于stack exchange，提问作者bizz84