Migration depuis Firebase Auth

// export-firebase-users.ts
import admin from 'firebase-admin'
import fs from 'fs'
 
admin.initializeApp({
  credential: admin.credential.cert('./service-account-key.json'),
})
 
async function exportAllUsers() {
  const users = []
  let nextPageToken
 
  do {
    const result = await admin.auth().listUsers(1000, nextPageToken)
 
    for (const user of result.users) {
      users.push({
        uid: user.uid,
        email: user.email || '',
        emailVerified: user.emailVerified,
        displayName: user.displayName || '',
        phoneNumber: user.phoneNumber,
        disabled: user.disabled,
        customClaims: user.customClaims,
        passwordHash: user.passwordHash,
        passwordSalt: user.passwordSalt,
        providerData: user.providerData.map((p) => ({
          providerId: p.providerId,
          uid: p.uid,
        })),
        createdAt: user.metadata.creationTime,
      })
    }
 
    nextPageToken = result.pageToken
    console.log(`${users.length} utilisateurs exportés...`)
  } while (nextPageToken)
 
  return users
}
 
exportAllUsers().then((users) => {
  fs.writeFileSync('firebase-users-export.json', JSON.stringify(users, null, 2))
  console.log(`Total : ${users.length} utilisateurs exportés`)
})

// Middleware pour la migration lazy des mots de passe
async function lazyMigratePassword(
  email: string,
  password: string,
  aurisManagementToken: string
): Promise<boolean> {
  try {
    // Étape 1 : Essayer de se connecter avec Firebase
    const firebaseResponse = await fetch(
      `https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=${process.env.FIREBASE_API_KEY}`,
      {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ email, password, returnSecureToken: false }),
      }
    )
 
    if (!firebaseResponse.ok) {
      return false // Credentials invalides aussi dans Firebase
    }
 
    // Étape 2 : Firebase a vérifié le mot de passe — le définir dans Auris
    const userResponse = await fetch(
      `https://auth.votreentreprise.com/api/users?email=${encodeURIComponent(email)}`,
      {
        headers: {
          Authorization: `Bearer ${aurisManagementToken}`,
          'x-tenant': 'votre-tenant-id',
        },
      }
    )
    const userData = await userResponse.json()
    const userId = userData.data?.[0]?.id
 
    if (!userId) return false
 
    // Étape 3 : Définir le mot de passe dans Auris
    await fetch(
      `https://auth.votreentreprise.com/api/users/${userId}/set-password`,
      {
        method: 'POST',
        headers: {
          Authorization: `Bearer ${aurisManagementToken}`,
          'x-tenant': 'votre-tenant-id',
          'Content-Type': 'application/json',
        },
        body: JSON.stringify({ password }),
      }
    )
 
    console.log(`Mot de passe migré pour l'utilisateur : ${email}`)
    return true
  } catch (error) {
    console.error(`Migration du mot de passe échouée pour ${email} :`, error)
    return false
  }
}

// transform-firebase-users.ts
import fs from 'fs'
 
const firebaseUsers = JSON.parse(
  fs.readFileSync('firebase-users-export.json', 'utf-8')
)
 
const aurisUsers = firebaseUsers
  .filter((u) => u.email && !u.disabled)
  .map((user) => {
    const nameParts = (user.displayName || '').split(' ')
    return {
      email: user.email,
      firstName: nameParts[0] || '',
      lastName: nameParts.slice(1).join(' ') || '',
      emailVerified: user.emailVerified,
    }
  })
 
fs.writeFileSync('auris-import.json', JSON.stringify(aurisUsers, null, 2))
console.log(`${aurisUsers.length} utilisateurs transformés pour l'import`)

curl -X POST https://auth.votreentreprise.com/api/users/import \
  -H "Authorization: Bearer $AURIS_ACCESS_TOKEN" \
  -H "x-tenant: votre-tenant-id" \
  -F "[email protected]" \
  -F "format=json"

# Supprimer Firebase
npm uninstall firebase firebase-admin
 
# Installer Auris
npm install @auris/js @auris/react
# Pour Next.js :
npm install @auris/nextjs

// AVANT (Firebase)
import { initializeApp } from 'firebase/app'
import { getAuth } from 'firebase/auth'
 
const app = initializeApp({ apiKey: 'AIza...', authDomain: 'myapp.firebaseapp.com' })
const auth = getAuth(app)
 
// APRÈS (Auris)
import { AurisClient } from '@auris/js'
 
const auris = new AurisClient({
  domain: 'auth.votreentreprise.com',
  clientId: 'votre-client-id',
  redirectUri: 'http://localhost:3000/callback',
  autoRefresh: true,
})

// AVANT (Firebase)
import { useAuthState } from 'react-firebase-hooks/auth'
const [user, loading] = useAuthState(auth)
 
// APRÈS (Auris)
import { useAuris } from '@auris/react'
const { user, isLoading, isAuthenticated, loginWithRedirect, logout } = useAuris()

// AVANT (Firebase)
const token = await auth.currentUser?.getIdToken()
 
// APRÈS (Auris)
const token = await auris.getAccessToken()
 
// Le reste du code reste inchangé
const response = await fetch('/api/protected', {
  headers: { Authorization: `Bearer ${token}` },
})

// AVANT (Firebase Admin SDK)
import admin from 'firebase-admin'
 
async function verifyToken(token: string) {
  const decoded = await admin.auth().verifyIdToken(token)
  return decoded
}
 
// APRÈS (Auris — en utilisant JWKS)
import { verifyJwt } from '@auris/js/jwt-verify'
 
async function verifyToken(token: string) {
  const decoded = await verifyJwt(token, {
    jwksUrl: 'https://auth.votreentreprise.com/.well-known/jwks.json',
  })
  return decoded
}
 
// Ou en utilisant le helper Next.js :
import { getSession } from '@auris/nextjs/server'
 
export async function GET(req: Request) {
  const session = await getSession()
  if (!session) {
    return Response.json({ error: 'Non autorisé' }, { status: 401 })
  }
  return Response.json({ userId: session.user.id })
}

// AVANT (Firebase)
import { signInWithPopup, GoogleAuthProvider } from 'firebase/auth'
const provider = new GoogleAuthProvider()
const result = await signInWithPopup(auth, provider)
 
// APRÈS (Auris)
// Le social login est géré par la Hosted Login page — aucune modification de code.
// Configure Google comme fournisseur social dans Console → Authentification → Social Login.
// Les utilisateurs voient automatiquement le bouton Google sur la page de connexion hébergée.
 
// Pour aller directement à Google :
await auris.loginWithRedirect({ connection: 'google' })

// AVANT (Firebase)
await admin.auth().setCustomUserClaims(uid, {
  role: 'admin',
  plan: 'enterprise',
  orgId: 'org_123',
})

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /documents/{docId} {
      allow read: if request.auth != null &&
        (resource.data.ownerId == request.auth.uid ||
         request.auth.uid in resource.data.viewers);
      allow write: if request.auth != null &&
        resource.data.ownerId == request.auth.uid;
    }
  }
}

model
  schema 1.1

type user

type document
  relations
    define owner: [user]
    define viewer: [user] or owner
    define editor: [user] or owner
    define can_read: viewer
    define can_write: editor

# Accorder la propriété
curl -X POST https://auth.votredomaine.com/api/fga/tuples \
  -H "Authorization: Bearer $AURIS_ACCESS_TOKEN" \
  -H "x-tenant: votre-tenant-id" \
  -H "Content-Type: application/json" \
  -d '{
    "objectType": "document",
    "objectId": "doc_123",
    "relation": "owner",
    "subjectType": "user",
    "subjectId": "usr_abc"
  }'

import { AurisClient } from '@auris/js'
 
const result = await auris.fga.check({
  objectType: 'document',
  objectId: 'doc_123',
  relation: 'can_read',
  subjectType: 'user',
  subjectId: 'usr_abc',
})
 
if (result.allowed) {
  // L'utilisateur peut lire le document
}