Firebase Cloud Function only callable from "Back end"

Question

I want to create a Firebase Cloud Function that is not triggered by anything automatic, and is callable only for administrative purposes. I know I can generate some random key and store it in the config:

exports.someFunction = functions.https.onRequest((req, res) => {
  if (req.query.key !== functions.config().access.key) {
    res.status('401').send('Unauthorized');
    return;
  }
  // actual body here
});

But this seems brittle not least because I have to maintain all the keys myself. I'd rather not expose the function over HTTPS at all and let it only be called through the Admin Console or the Firebase CLI or something of that sort.

Is there a way to do that?

JeremyW · Accepted Answer · 2019-09-27T18:30:05.293

Short answer: No

Longer discussion:

You can't have private functions - per Firebase employee Doug Stevenson Firebase cloud functions are only for exported functions with specifically defined triggers. You can't deploy a regular JavaScript function, and then somehow magically call that from the Firebase console or CLI.

Your functions have to be callable from your website, or be called from one of these triggering events. As of right now, there is no implementated feature for calling a cloud function from the Firebase console or CLI.

While not a direct answer to your question, Doug provides this walk-through with code samples, of how your admin account can act on behalf of a user and be limited to that user's permission set. Using this approach (when combined with proper database/storage security rules) should satisfy most use-cases.

score 0 · Answer 2 · answered Mar 30 '23 at 11:28

The accepted answer doesn't seem to be entirely correct now. You can create a Google Cloud function and if you use the pubsub.schedule option then the function will be listed in your 'Cloud Scheduler' (https://console.cloud.google.com/cloudscheduler?authuser=0) within the Google Cloud console. Just click 'Force Run' to run it. Here is a JS code example, you can pause it from the Cloud Scheduler to ensure it doesn't actually run on the schedule, but just be careful because updating the function from JS will override the 'Paused' state. If anyone comes up with a better way to use a schedule that doesn't actually run it would be appreciated!

exports.myFunction = functions
        .region('australia-southeast1')
        .pubsub.schedule('1 11 * * 1') // Every Monday at 11:01AM
        .timeZone('Australia/Brisbane')
        .onRun(async (context) => {
                 // Do stuff
        }

Firebase Cloud Function only callable from "Back end"

2 Answers2