feat(auth): add custom claims - #741 - @joerex

Manual cherry-pick of commit by @joerex - 7f8f693

Author: Scott Prue

docs/auth.md

@@ -49,6 +49,14 @@ class SomeComponent extends Component {
 export default firebaseConnect()(SomeComponent) // or withFirebase(SomeComponent)
 ```
 
+#### Custom Claims
+
+ Firebase has a secure way of identifying and making claims about users with [custom claims](https://firebase.google.com/docs/auth/admin/custom-claims). This is a good way to provide roles for users.
+
+ If `enableClaims` config option is used along with `userProfile` you will find custom claims in `state.firebase.profile.token.claims`. 
+
+ **Note**: If a claim is added to a user who is already logged in those changes will not necessarily be propagated to the client. In order to assure the change is observed, use a `refreshToken` property in your `userProfile` collection and update it's value after the custom claim has been added. Because `react-redux-firebase` watches for profile changes, the custom claim will be fetched along with the `refreshToken` update.
+
 For examples of how to use this API, checkout the [auth recipes section](/docs/recipes/auth.html).
 
 ## login(credentials)

docs/getting_started.md

@@ -45,6 +45,7 @@ const fbConfig = {}
 const rrfConfig = {
   userProfile: 'users',
   // useFirestoreForProfile: true // Firestore for Profile instead of Realtime DB
+  // enableClaims: true // Get custom claims along with the profile
 }
 
 // Initialize firebase instance

src/actions/auth.js

@@ -71,7 +71,8 @@ function getProfileFromSnap(snap) {
 export function handleProfileWatchResponse(
   dispatch,
   firebase,
-  userProfileSnap
+  userProfileSnap,
+  token
 ) {
   const {
     profileParamsToPopulate,
@@ -88,7 +89,10 @@ export function handleProfileWatchResponse(
     if (useFirestoreForProfile && profileParamsToPopulate) {
       console.warn('Profile population is not yet supported for Firestore') // eslint-disable-line no-console
     }
-    dispatch({ type: actionTypes.SET_PROFILE, profile })
+    dispatch({
+      type: actionTypes.SET_PROFILE,
+      profile: token ? { ...profile, token } : profile
+    })
   } else {
     // Convert array of populate config into an array of once query promises
     promisesForPopulate(
@@ -111,14 +115,21 @@ export function handleProfileWatchResponse(
         })
         if (!autoPopulateProfile) {
           // Dispatch action with profile combined with populated parameters
-          dispatch({ type: actionTypes.SET_PROFILE, profile })
+          dispatch({
+            type: actionTypes.SET_PROFILE,
+            profile: token ? { ...profile, token } : profile
+          })
         } else {
           // Auto Populate profile
           const populates = getPopulateObjs(profileParamsToPopulate)
           const profile = userProfileSnap.val()
           dispatch({
             type: actionTypes.SET_PROFILE,
-            profile: populate({ profile, data }, 'profile', populates)
+            profile: populate(
+              { profile: token ? { ...profile, token } : profile, data },
+              'profile',
+              populates
+            )
           })
         }
       })
@@ -177,7 +188,7 @@ function createProfileWatchErrorHandler(dispatch, firebase) {
 export const watchUserProfile = (dispatch, firebase) => {
   const {
     authUid,
-    config: { userProfile, useFirestoreForProfile }
+    config: { userProfile, useFirestoreForProfile, enableClaims }
   } = firebase._
   unWatchUserProfile(firebase)
 
@@ -187,20 +198,53 @@ export const watchUserProfile = (dispatch, firebase) => {
         .firestore()
         .collection(userProfile)
         .doc(authUid)
-        .onSnapshot(
-          userProfileSnap =>
-            handleProfileWatchResponse(dispatch, firebase, userProfileSnap),
-          createProfileWatchErrorHandler(dispatch, firebase)
-        )
+        .onSnapshot(userProfileSnap => {
+          return enableClaims
+            ? firebase
+                .auth()
+                .currentUser.getIdTokenResult(true)
+                .then(token =>
+                  handleProfileWatchResponse(
+                    dispatch,
+                    firebase,
+                    userProfileSnap,
+                    token
+                  )
+                )
+            : handleProfileWatchResponse(
+                dispatch,
+                firebase,
+                userProfileSnap,
+                null
+              )
+        }, createProfileWatchErrorHandler(dispatch, firebase))
     } else if (firebase.database) {
       firebase._.profileWatch = firebase // eslint-disable-line no-param-reassign
         .database()
         .ref()
         .child(`${userProfile}/${authUid}`)
         .on(
           'value',
-          userProfileSnap =>
-            handleProfileWatchResponse(dispatch, firebase, userProfileSnap),
+          userProfileSnap => {
+            enableClaims
+              ? firebase
+                  .auth()
+                  .currentUser.getIdTokenResult(true)
+                  .then(token =>
+                    handleProfileWatchResponse(
+                      dispatch,
+                      firebase,
+                      userProfileSnap,
+                      token
+                    )
+                  )
+              : handleProfileWatchResponse(
+                  dispatch,
+                  firebase,
+                  userProfileSnap,
+                  null
+                )
+          },
           createProfileWatchErrorHandler(dispatch, firebase)
         )
     } else {