fix(functions): add app check verification

Author: AmitMY

functions/.gitignore

@@ -17,3 +17,6 @@ firestore-debug.log
 coverage/
 .env
 .runtimeconfig.json
+
+package-lock.json
+bun.lockb

functions/package.json

@@ -20,7 +20,7 @@
   "main": "lib/index.js",
   "dependencies": {
     "@firebase/database-types": "1.0.0",
-    "@google-cloud/storage": "7.3.1",
+    "@google-cloud/storage": "7.4.0",
     "@sign-mt/browsermt": "0.2.1",
     "cors": "2.8.5",
     "express": "4.18.2",
@@ -29,16 +29,16 @@
     "firebase-functions": "4.4.1",
     "http-errors": "2.0.0",
     "node-fetch": "2.6.7",
-    "openai": "4.12.4"
+    "openai": "4.14.0"
   },
   "devDependencies": {
     "@firebase/firestore-types": "3.0.0",
     "@firebase/rules-unit-testing": "3.0.1",
     "@types/http-errors": "2.0.3",
     "@types/jest": "29.5.6",
     "@types/node-fetch": "2.6.7",
-    "@typescript-eslint/eslint-plugin": "6.8.0",
-    "@typescript-eslint/parser": "6.8.0",
+    "@typescript-eslint/eslint-plugin": "6.9.0",
+    "@typescript-eslint/parser": "6.9.0",
     "eslint": "8.52.0",
     "firebase-functions-test": "3.1.0",
     "firebase-tools": "12.7.0",

functions/src/middlewares/appcheck.middleware.ts

@@ -0,0 +1,19 @@
+import {RequestHandler} from 'express';
+
+import {getAppCheck} from 'firebase-admin/app-check';
+import * as httpErrors from 'http-errors';
+
+export const appCheckVerification: RequestHandler = async (req, res, next) => {
+  const appCheckToken = req.header('X-Firebase-AppCheck');
+
+  if (!appCheckToken) {
+    throw new httpErrors.Unauthorized('Missing App Check token');
+  }
+
+  try {
+    await getAppCheck().verifyToken(appCheckToken);
+    return next();
+  } catch (err) {
+    throw new httpErrors.Unauthorized('Invalid App Check token');
+  }
+};

functions/src/text-normalization/controller.ts

@@ -7,6 +7,7 @@ import {FirebaseDatabase, Reference} from '@firebase/database-types';
 import {TextNormalizationModel} from './model';
 import {onRequest} from 'firebase-functions/v2/https';
 import {defineString} from 'firebase-functions/params';
+import {appCheckVerification} from '../middlewares/appcheck.middleware';
 import type {StringParam} from 'firebase-functions/lib/params/types';
 
 export class TextNormalizationEndpoint {
@@ -104,9 +105,19 @@ export const textNormalizationFunctions = (database: FirebaseDatabase) => {
 
   const app = express();
   app.use(cors());
+  app.use(appCheckVerification);
   app.options('*', (req, res) => res.status(200).end());
   app.get('/', request);
   app.get('/api/text-normalization', request); // Hosting redirect
   app.use(errorMiddleware);
-  return onRequest({enforceAppCheck: true}, app);
+
+  return onRequest(
+    {
+      invoker: 'public',
+      cpu: 'gcf_gen1',
+      concurrency: 1,
+      timeoutSeconds: 30,
+    },
+    app
+  );
 };