React应用使用Firebase Auth邮箱/密码认证的两类问题及解决方案咨询

问题1：定时清理未验证的新注册账号 #

可以通过Firebase云函数实现定时检查并删除未验证的过期账号，步骤如下：

1. 同步账号元数据到Firestore：利用Auth触发器，在用户创建时自动将账号信息同步到Firestore，方便后续查询过滤：

// 云函数：用户创建时同步元数据
exports.onUserCreated = functions.auth.user().onCreate(async (user) => {
  await admin.firestore().collection('user_metadata').doc(user.uid).set({
    createdAt: user.metadata.creationTime,
    isEmailVerified: user.emailVerified,
    email: user.email
  });
});

2. 定时清理任务：创建每日执行的定时云函数，筛选出未验证且创建时间超过指定时长（如24小时）的账号并批量删除：

// 云函数：定时清理未验证过期账号
exports.cleanUnverifiedUsers = functions.pubsub.schedule('every 24 hours').onRun(async (context) => {
  const cutoffTime = new Date(Date.now() - 24 * 60 * 60 * 1000); // 24小时前的时间戳
  const usersSnapshot = await admin.firestore().collection('user_metadata')
    .where('isEmailVerified', '==', false)
    .where('createdAt', '<=', cutoffTime)
    .get();

  const deletePromises = [];
  usersSnapshot.forEach(doc => {
    const uid = doc.id;
    deletePromises.push(admin.auth().deleteUser(uid));
    deletePromises.push(doc.ref.delete());
  });

  await Promise.all(deletePromises);
  console.log(`Deleted ${deletePromises.length/2} unverified expired users`);
});

注：如果账号量不大，也可直接调用admin.auth().listUsers()遍历所有账号，过滤未验证且过期的账号，但效率低于结合Firestore的方式。

问题2：修改邮箱时的账号防丢失方案 #

核心逻辑是先验证新邮箱，再执行账号邮箱更新，避免直接修改后无法验证的风险，具体实现：

前端流程 #

1. 用户发起修改请求时，先验证当前账号密码（确认身份）：

import { getAuth, reauthenticateWithCredential, EmailAuthProvider } from "firebase/auth";

const auth = getAuth();
const user = auth.currentUser;

// 验证当前密码
const credential = EmailAuthProvider.credential(user.email, currentPassword);
await reauthenticateWithCredential(user, credential);

2. 调用云函数创建邮箱修改请求，传入新邮箱：

const createUpdateRequest = httpsCallable(functions, 'createEmailUpdateRequest');
await createUpdateRequest({ newEmail: newEmail });

云函数处理 #

1. 创建修改请求记录并发送验证邮件到新邮箱：

exports.createEmailUpdateRequest = functions.https.onCall(async (data, context) => {
  if (!context.auth) throw new functions.https.HttpsError('unauthenticated', '需要登录');
  
  const uid = context.auth.uid;
  const newEmail = data.newEmail;
  const requestId = admin.firestore().collection('email_update_requests').doc().id;

  // 生成带请求ID的验证链接
  const actionCodeSettings = {
    url: `${process.env.FRONTEND_URL}/verify-email-update?requestId=${requestId}`,
    handleCodeInApp: true
  };

  // 生成验证链接并发送邮件（可使用Firebase邮件扩展或自定义邮件服务）
  const verificationLink = await admin.auth().generateEmailVerificationLink(newEmail, actionCodeSettings);
  sendVerificationEmail(newEmail, verificationLink);

  // 保存修改请求到Firestore
  await admin.firestore().collection('email_update_requests').doc(requestId).set({
    uid,
    newEmail,
    createdAt: new Date(),
    status: 'pending'
  });

  return { success: true, message: '验证邮件已发送到新邮箱' };
});

2. 用户验证新邮箱后，触发云函数完成邮箱更新：

exports.verifyEmailUpdate = functions.https.onCall(async (data, context) => {
  const requestId = data.requestId;
  const requestDoc = await admin.firestore().collection('email_update_requests').doc(requestId).get();
  
  if (!requestDoc.exists) throw new functions.https.HttpsError('not-found', '请求不存在');
  const requestData = requestDoc.data();

  // 检查请求是否过期（24小时有效期）
  if (Date.now() - requestData.createdAt.getTime() > 24 * 60 * 60 * 1000) {
    await requestDoc.ref.update({ status: 'expired' });
    throw new functions.https.HttpsError('deadline-exceeded', '请求已过期');
  }

  // 更新用户邮箱及元数据
  await admin.auth().updateUser(requestData.uid, { email: requestData.newEmail });
  await admin.firestore().collection('user_metadata').doc(requestData.uid).update({ email: requestData.newEmail });
  await requestDoc.ref.update({ status: 'completed' });

  return { success: true, message: '邮箱已更新' };
});

3. 定时清理过期的修改请求：

exports.cleanExpiredUpdateRequests = functions.pubsub.schedule('every 24 hours').onRun(async (context) => {
  const cutoffTime = new Date(Date.now() - 24 * 60 * 60 * 1000);
  const requestsSnapshot = await admin.firestore().collection('email_update_requests')
    .where('status', '==', 'pending')
    .where('createdAt', '<=', cutoffTime)
    .get();

  const deletePromises = [];
  requestsSnapshot.forEach(doc => deletePromises.push(doc.ref.delete()));
  await Promise.all(deletePromises);
  console.log(`Cleaned ${deletePromises.length} expired email update requests`);
});

补充：若用户误发起修改请求，可在账号设置页面添加“取消修改”按钮，调用云函数删除对应的待验证请求记录即可。

内容的提问来源于stack exchange，提问作者mattematics9