Firebase: Re-authenticate the current user inside a Cloud Function

Question

I am implementing a cloud function for updating the current user's password.

Basically, the logic I want to follow is:

(Client side)
 0. Complete form and submit the data (current password and new password).

(Backend) 
 1. Get the current user email from the callable function context.
 2. Re-authenticate the current user using the provided current password.
   2.1. If success, change the password and send a notification email.
   2.2. Else, throw an error.

Here is my current code:

const { auth, functions } = require("../../services/firebase");
...

exports.updatePassword = functions
  .region("us-central1")
  .runWith({ memory: "1GB", timeoutSeconds: 120 })
  .https.onCall(async (data, context) => {
    const { currentPassowrd, newPassword } = data;

    const { email, uid: userId } = context.auth.token;

    if (!userId) {
      // throw ...
    }

    try {
      // 
      // Problem: `firebase-admin` authentication doesn't include
      // the `signInWithEmailAndPassword()` method...
      //
      await auth.signInWithEmailAndPassword(email, currentPassowrd);

      await auth.updateUser(userId, {
        password: newPassword,
      });

      sendPasswordUpdateEmail(email);
    } catch (err) {
      // ...
      throw AuthErrors.cannotUpdatePassword();
    }
  });

My problem is that the firebase-admin package doesn't include the signInWithEmailAndPassword, and I need a way to handle this, to check that "currentPassword" is correct, inside my function.

My other option, if the one I have described is not possible, is to update the password using the firebase sdk in the client side, and then to call a firebase function to send the notification email.

Answer 1

Strictly speaking you don't need to re-authenticate the user in the Cloud Function: If you get a value for context.auth.uid in your Callable Cloud Function, it means that the user is authenticated in the front-end and you can therefore safely call the updateUser() method.

If you want to deal with the case when the user left his device opened, and someone updates his password, as explained in the comments under your question, I would suggest you use the reauthenticateWithCredential() method in the front-end, which re-authenticates a user using a fresh credential.

Do as follows:

import {
    EmailAuthProvider,
    getAuth,
    reauthenticateWithCredential,
} from 'firebase/auth'

const email = auth.currentUser.email;
// Capture the password value
// e.g. via a pop-up window
const password = ...;

const auth = getAuth();
const credential = EmailAuthProvider.credential(
    email,
    password
);
await reauthenticateWithCredential(
    auth.currentUser, 
    credential
);

// If no error is thrown, you can call the Callable Cloud Function, knowing the user has just re-signed-in.