Migrating from Firebase Auth

// export-firebase-users.ts
import admin from 'firebase-admin'
import fs from 'fs'
 
admin.initializeApp({
  credential: admin.credential.cert('./service-account-key.json'),
})
 
interface ExportedUser {
  uid: string
  email: string
  emailVerified: boolean
  displayName: string
  phoneNumber?: string
  disabled: boolean
  customClaims?: Record<string, unknown>
  passwordHash?: string
  passwordSalt?: string
  providerData: Array<{ providerId: string; uid: string }>
  createdAt: string
}
 
async function exportAllUsers(): Promise<ExportedUser[]> {
  const users: ExportedUser[] = []
  let nextPageToken: string | undefined
 
  do {
    const result = await admin.auth().listUsers(1000, nextPageToken)
 
    for (const user of result.users) {
      users.push({
        uid: user.uid,
        email: user.email || '',
        emailVerified: user.emailVerified,
        displayName: user.displayName || '',
        phoneNumber: user.phoneNumber,
        disabled: user.disabled,
        customClaims: user.customClaims,
        passwordHash: user.passwordHash,
        passwordSalt: user.passwordSalt,
        providerData: user.providerData.map((p) => ({
          providerId: p.providerId,
          uid: p.uid,
        })),
        createdAt: user.metadata.creationTime,
      })
    }
 
    nextPageToken = result.pageToken
    console.log(`Exported ${users.length} users...`)
  } while (nextPageToken)
 
  return users
}
 
exportAllUsers().then((users) => {
  fs.writeFileSync('firebase-users-export.json', JSON.stringify(users, null, 2))
  console.log(`Total: ${users.length} users exported`)
})

// Middleware for lazy password migration
// This runs in your backend, not in Auris
 
import admin from 'firebase-admin'
 
async function lazyMigratePassword(
  email: string,
  password: string,
  aurisManagementToken: string
): Promise<boolean> {
  try {
    // Step 1: Try to sign in with Firebase
    // Note: Firebase Admin SDK doesn't have signInWithPassword
    // Use the Firebase Auth REST API instead
    const firebaseResponse = await fetch(
      `https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=${process.env.FIREBASE_API_KEY}`,
      {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({
          email,
          password,
          returnSecureToken: false,
        }),
      }
    )
 
    if (!firebaseResponse.ok) {
      return false // Invalid credentials in Firebase too
    }
 
    // Step 2: Firebase verified the password — set it in Auris
    // Find the user in Auris by email
    const userResponse = await fetch(
      `https://auth.yourcompany.com/api/users?email=${encodeURIComponent(email)}`,
      {
        headers: {
          Authorization: `Bearer ${aurisManagementToken}`,
          'x-tenant': 'your-tenant-id',
        },
      }
    )
    const userData = await userResponse.json()
    const userId = userData.data?.[0]?.id
 
    if (!userId) return false
 
    // Step 3: Trigger a password reset for the user in Auris
    // Note: this triggers a password-reset email rather than directly setting a password.
    await fetch(
      `https://auth.yourcompany.com/api/users/${userId}/reset-password`,
      {
        method: 'POST',
        headers: {
          Authorization: `Bearer ${aurisManagementToken}`,
          'x-tenant': 'your-tenant-id',
          'Content-Type': 'application/json',
        },
        body: JSON.stringify({ password }),
      }
    )
 
    console.log(`Migrated password for user: ${email}`)
    return true
  } catch (error) {
    console.error(`Password migration failed for ${email}:`, error)
    return false
  }
}

// transform-firebase-users.ts
import fs from 'fs'
 
interface FirebaseUser {
  uid: string
  email: string
  emailVerified: boolean
  displayName: string
  phoneNumber?: string
  disabled: boolean
  customClaims?: Record<string, unknown>
}
 
interface AurisImportUser {
  email: string
  firstName: string
  lastName: string
  emailVerified: boolean
}
 
const firebaseUsers: FirebaseUser[] = JSON.parse(
  fs.readFileSync('firebase-users-export.json', 'utf-8')
)
 
const aurisUsers: AurisImportUser[] = firebaseUsers
  .filter((u) => u.email && !u.disabled) // Skip disabled and email-less users
  .map((user) => {
    const nameParts = (user.displayName || '').split(' ')
    return {
      email: user.email,
      firstName: nameParts[0] || '',
      lastName: nameParts.slice(1).join(' ') || '',
      emailVerified: user.emailVerified,
    }
  })
 
fs.writeFileSync('auris-import.json', JSON.stringify(aurisUsers, null, 2))
console.log(`Transformed ${aurisUsers.length} users for import`)

curl -X POST https://auth.yourcompany.com/api/users/import \
  -H "Authorization: Bearer $AURIS_ACCESS_TOKEN" \
  -H "x-tenant: your-tenant-id" \
  -F "[email protected]" \
  -F "format=json"

# Remove Firebase
npm uninstall firebase firebase-admin
 
# Install Auris
npm install @auris/js @auris/react
# For Next.js:
npm install @auris/nextjs

// BEFORE (Firebase)
import { initializeApp } from 'firebase/app'
import { getAuth, signInWithEmailAndPassword, signOut, onAuthStateChanged } from 'firebase/auth'
 
const app = initializeApp({
  apiKey: 'AIza...',
  authDomain: 'myapp.firebaseapp.com',
  projectId: 'myapp',
})
const auth = getAuth(app)
 
// AFTER (Auris)
import { AurisClient } from '@auris/js'
 
const auris = new AurisClient({
  domain: 'auth.yourcompany.com',
  clientId: 'your-client-id',
  redirectUri: 'http://localhost:3000/callback',
  autoRefresh: true,
})

// BEFORE (Firebase)
import { getAuth, signInWithEmailAndPassword, signOut } from 'firebase/auth'
import { useAuthState } from 'react-firebase-hooks/auth'
 
function Login() {
  const auth = getAuth()
  const [user, loading] = useAuthState(auth)
 
  const handleLogin = () => {
    signInWithEmailAndPassword(auth, email, password)
  }
 
  const handleLogout = () => {
    signOut(auth)
  }
 
  if (loading) return <p>Loading...</p>
  if (user) return <button onClick={handleLogout}>Sign out</button>
  return <button onClick={handleLogin}>Sign in</button>
}
 
// AFTER (Auris)
import { AurisProvider, useAuris } from '@auris/react'
 
function App() {
  return (
    <AurisProvider
      domain="auth.yourcompany.com"
      clientId="your-client-id"
      redirectUri={window.location.origin + '/callback'}
    >
      <Login />
    </AurisProvider>
  )
}
 
function Login() {
  const { loginWithRedirect, logout, user, isAuthenticated, isLoading } = useAuris()
 
  if (isLoading) return <p>Loading...</p>
  if (isAuthenticated) {
    return (
      <button onClick={() => logout({ returnTo: window.location.origin })}>
        Sign out
      </button>
    )
  }
  return <button onClick={loginWithRedirect}>Sign in</button>
}

// BEFORE (Firebase)
import { getAuth, onAuthStateChanged } from 'firebase/auth'
 
const auth = getAuth()
onAuthStateChanged(auth, (user) => {
  if (user) {
    console.log('User:', user.uid, user.email)
  }
})
 
// AFTER (Auris)
const user = await auris.getUser()
if (user) {
  console.log('User:', user.id, user.email)
}
 
// Or with the auth state change listener:
auris.onAuthStateChange((user) => {
  if (user) {
    console.log('User:', user.id, user.email)
  }
})

// BEFORE (Firebase)
import { getAuth } from 'firebase/auth'
 
const auth = getAuth()
const token = await auth.currentUser?.getIdToken()
 
const response = await fetch('/api/protected', {
  headers: { Authorization: `Bearer ${token}` },
})
 
// AFTER (Auris)
const token = await auris.getAccessToken()
 
const response = await fetch('/api/protected', {
  headers: { Authorization: `Bearer ${token}` },
})

// BEFORE (Firebase Admin SDK)
import admin from 'firebase-admin'
 
async function verifyToken(token: string) {
  const decoded = await admin.auth().verifyIdToken(token)
  return decoded // { uid, email, ... }
}
 
// AFTER (Auris — using JWKS)
import { verifyJwt } from '@auris/js/jwt-verify'
 
async function verifyToken(token: string) {
  const decoded = await verifyJwt(token, {
    jwksUrl: 'https://auth.yourcompany.com/.well-known/jwks.json',
  })
  return decoded // { sub, email, roles, ... }
}
 
// Or using the Next.js helper:
import { getSession } from '@auris/nextjs/server'
 
export async function GET(req: Request) {
  const session = await getSession()
  if (!session) {
    return Response.json({ error: 'Unauthorized' }, { status: 401 })
  }
  return Response.json({ userId: session.user.id })
}

// BEFORE (Firebase)
import { getAuth, signInWithPopup, GoogleAuthProvider } from 'firebase/auth'
 
const auth = getAuth()
const provider = new GoogleAuthProvider()
const result = await signInWithPopup(auth, provider)
 
// AFTER (Auris)
// Social login is handled by the Hosted Login page — no code change needed.
// Configure Google as a social provider in Console → Authentication → Social Login.
// Users see the Google button on the hosted login page automatically.
 
// If you want to go directly to Google:
await auris.loginWithRedirect({ connection: 'google' })

// BEFORE (Firebase)
await admin.auth().setCustomUserClaims(uid, {
  role: 'admin',
  plan: 'enterprise',
  orgId: 'org_123',
})

curl -X POST https://auth.yourcompany.com/api/applications/APP_ID/custom-claims \
  -H "Authorization: Bearer $AURIS_ACCESS_TOKEN" \
  -H "x-tenant: your-tenant-id" \
  -H "Content-Type: application/json" \
  -d '{
    "claimKey": "role",
    "valueType": "USER_ATTRIBUTE",
    "userAttribute": "roles",
    "isActive": true
  }'

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /documents/{docId} {
      allow read: if request.auth != null &&
        (resource.data.ownerId == request.auth.uid ||
         request.auth.uid in resource.data.viewers);
      allow write: if request.auth != null &&
        resource.data.ownerId == request.auth.uid;
    }
  }
}

model
  schema 1.1

type user

type document
  relations
    define owner: [user]
    define viewer: [user] or owner
    define editor: [user] or owner
    define can_read: viewer
    define can_write: editor

# Grant ownership
curl -X POST https://auth.yourcompany.com/api/fga/tuples \
  -H "Authorization: Bearer $AURIS_ACCESS_TOKEN" \
  -H "x-tenant: your-tenant-id" \
  -H "Content-Type: application/json" \
  -d '{
    "objectType": "document",
    "objectId": "doc_123",
    "relation": "owner",
    "subjectType": "user",
    "subjectId": "usr_abc"
  }'
 
# Grant viewer access
curl -X POST https://auth.yourcompany.com/api/fga/tuples \
  -H "Authorization: Bearer $AURIS_ACCESS_TOKEN" \
  -H "x-tenant: your-tenant-id" \
  -H "Content-Type: application/json" \
  -d '{
    "objectType": "document",
    "objectId": "doc_123",
    "relation": "viewer",
    "subjectType": "user",
    "subjectId": "usr_xyz"
  }'

// Using the Auris SDK
import { AurisClient } from '@auris/js'
 
const auris = new AurisClient({
  domain: 'auth.yourcompany.com',
  clientId: 'your-client-id',
})
 
const result = await auris.fga.check({
  objectType: 'document',
  objectId: 'doc_123',
  relation: 'can_read',
  subjectType: 'user',
  subjectId: 'usr_abc',
})
 
if (result.allowed) {
  // User can read the document
}