如何将Firebase的登录注册Auth方法封装为云函数以降低AWS迁移成本？

前置准备 #

• 云函数项目中提前安装firebase-admin和firebase-functions依赖
• 完成firebase-admin的服务账号初始化，开通用户管理权限
• 所有接口返回的错误码和原生Firebase Auth方法完全对齐，前端原有错误处理逻辑无需修改

1. 注册接口实现（对应createUserWithEmailAndPassword） #

const functions = require("firebase-functions");
const admin = require("firebase-admin");
admin.initializeApp();

exports.registerWithEmailPassword = functions.https.onCall(async (data, context) => {
  const { email, password } = data;
  try {
    // 完全对齐原生创建用户的逻辑
    const userRecord = await admin.auth().createUser({
      email: email,
      password: password,
    });
    // 生成自定义登录token供前端完成登录态写入
    const customToken = await admin.auth().createCustomToken(userRecord.uid);
    return {
      success: true,
      uid: userRecord.uid,
      email: userRecord.email,
      customToken: customToken
    };
  } catch (error) {
    // 透传原生错误码
    throw new functions.https.HttpsError(error.code, error.message);
  }
});

2. 登录接口实现（对应signInWithEmailAndPassword） #

注：admin SDK无直接校验密码的能力，此处调用Firebase官方Auth REST接口实现，返回逻辑和原生方法完全对齐

exports.loginWithEmailPassword = functions.https.onCall(async (data, context) => {
  // 项目Web API Key存入云函数环境变量，不要硬编码
  const API_KEY = functions.config().firebase.api_key;
  const { email, password } = data;
  try {
    const response = await fetch(`https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=${API_KEY}`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({
        email: email,
        password: password,
        returnSecureToken: true
      })
    });
    const result = await response.json();
    if (!response.ok) throw new Error(result.error.message);

    return {
      success: true,
      uid: result.localId,
      email: result.email,
      idToken: result.idToken,
      refreshToken: result.refreshToken,
      expiresIn: result.expiresIn
    };
  } catch (error) {
    // 对齐原生错误码
    let errorCode = "internal-error";
    if (error.message.includes("EMAIL_NOT_FOUND")) errorCode = "auth/user-not-found";
    else if (error.message.includes("INVALID_PASSWORD")) errorCode = "auth/wrong-password";
    else if (error.message.includes("USER_DISABLED")) errorCode = "auth/user-disabled";
    else if (error.message.includes("INVALID_EMAIL")) errorCode = "auth/invalid-email";
    throw new functions.https.HttpsError(errorCode, error.message);
  }
});

3. 前端调用方式 #

前端无需引入完整Firebase Auth SDK，仅依赖Functions SDK调用接口即可，后续迁移AWS时仅需替换接口调用入口，业务逻辑无需修改：

import { getFunctions, httpsCallable } from "firebase/functions";
const functions = getFunctions();

// 注册调用
const register = async (email, password) => {
  const registerFunc = httpsCallable(functions, 'registerWithEmailPassword');
  try {
    const result = await registerFunc({ email, password });
    // 拿到customToken后可调用signInWithCustomToken写入登录态
    return result.data;
  } catch (error) {
    // 错误处理逻辑和调用原生方法完全一致
    throw error;
  }
};

// 登录调用
const login = async (email, password) => {
  const loginFunc = httpsCallable(functions, 'loginWithEmailPassword');
  try {
    const result = await loginFunc({ email, password });
    // 拿到idToken后可自行管理登录态或写入Firebase Auth状态
    return result.data;
  } catch (error) {
    throw error;
  }
};

迁移适配说明 #

• 前端完全和Firebase Auth原生方法解耦，所有认证逻辑封装在后端接口层
• 后续迁移到AWS时，仅需将云函数实现替换为AWS Cognito对应逻辑，前端业务层代码无需调整

内容的提问来源于stack exchange，提问作者Ahmet Yazıcı