feat: separate admin service into auth and firebase auth

[frodi-karlsson]

Introduces replacements for the base admin service via two modules that are more generically useful and composable:

• FirebaseAuthService - verifies Firebase ID tokens: reads the token from a configured cookie/header and resolves it to an email. Also serves the Firebase login page and login handler.
• AuthService - the provider-agnostic auth flow. The app supplies authenticate (who is this) and getPermissions (what may they do). The service then handles resolving the caller's status based on these, requiring various things, and constructing auth middlewares

const firebaseAuthService = new FirebaseAuthService(() => firebaseService.auth(), {
  tokenCookie: 'my_token',
  tokenHeader: 'x-my-token',
})

const authService = new AuthService<{ req: BackendRequest }>({
  authenticate: req => firebaseAuthService.getEmailByToken(firebaseAuthService.getToken(req)),
  getPermissions: email => getPermissionsFromDb(email),
  onCheck: (check, ctx) => auditLog(check, ctx), // optional
  authEnabled: env.authEnabled,
})

// Use as middleware
const requireAuth = authService.getLoginRedirectMiddleware({ loginHtmlPath: '/login.html' })
router.get('/users', requireAuth(['READ_USERS']), handler)

// Or resolve first, then check synchronously
const resolved = await authService.resolve(req)
authService.require(resolved, ['WRITE_USERS'], { ctx: { req, recordId } }) // 401 / 403

I expect it will hold well for any auth solution similar to firebase

Note

I really like the commit sha: fabdbbb

[kirillgroshkov]

LGTM.

Sorry it took me long to get to it.

I chose to not go into deep research of the perfect API, and to agree with your proposal instead 👍

[frodi-karlsson]

oh sorry i didn't see you request David

[kirillgroshkov]

oh sorry i didn't see you request David

Not important, as I already reviewed