refactor(identity): match blocking token audiences on host suffix only

iss already binds the token to the project, so aud only needs to tell
blocking tokens apart from regular ID tokens. Drops the region regex.

Author: IzaakGough

src/firebase_functions/private/token_verifier.py

@@ -15,7 +15,6 @@
 Module for internal token verification.
 """
 
-import re
 from urllib.parse import urlsplit
 
 import google.auth.exceptions
@@ -32,41 +31,25 @@
 )
 from google.auth import jwt
 
-_CLOUD_RUN_HOST_SUFFIX = ".run.app"
+_BLOCKING_HOST_SUFFIXES = (".run.app", ".cloudfunctions.net")
 
 
-def _blocking_audience_matcher(project_id):
-    """Builds the `audience_matcher` for auth blocking tokens.
+def _blocking_audience_matcher(audience):
+    """The `audience_matcher` for auth blocking tokens.
 
     A blocking token's `aud` is the function's own URL. firebase-tools registers the
     cloudfunctions.net URL when it creates a blocking function and the run.app URL
     when it updates one, so either host has to be accepted.
 
-    The gen-1 host is matched as `<region>-<project-id>.cloudfunctions.net` with the
-    region pinned to its naming shape, so a project id that merely ends with this one
-    (`other-my-project` against `my-project`) is not accepted as a suffix. Matching
-    the parsed host rather than a substring of the URL also keeps the expected text
-    from being smuggled in via a path, query or fragment.
-
-    Deliberately stricter than firebase-admin-node, which substring-matches `aud`.
-
-    The run.app host is not project-scoped: any Cloud Run URL satisfies it, as in the
-    Node SDK. The `iss` check is what ties the token to this project.
+    Neither host is project-scoped: `iss` ties the token to this project. The `aud`
+    check only has to separate blocking tokens from regular ID tokens, whose `aud` is
+    the bare project id.
     """
-    cloudfunctions_host = re.compile(
-        rf"[a-z]+(?:-[a-z]+)*\d+-{re.escape(project_id)}\.cloudfunctions\.net"
-    )
-
-    def matches(audience):
-        if not isinstance(audience, str):
-            return False
-        parts = urlsplit(audience)
-        if parts.scheme != "https":
-            return False
-        host = parts.hostname or ""
-        return host.endswith(_CLOUD_RUN_HOST_SUFFIX) or bool(cloudfunctions_host.fullmatch(host))
-
-    return matches
+    if not isinstance(audience, str):
+        return False
+    parts = urlsplit(audience)
+    host = parts.hostname or ""
+    return parts.scheme == "https" and host.endswith(_BLOCKING_HOST_SUFFIXES)
 
 
 # pylint: disable=consider-using-f-string
@@ -229,11 +212,8 @@ def __init__(self, app):
             issuer=_token_gen.ID_TOKEN_ISSUER_PREFIX,
             invalid_token_error=InvalidAuthBlockingTokenError,
             expired_token_error=ExpiredAuthBlockingTokenError,
-            audience_matcher=_blocking_audience_matcher(app.project_id),
-            expected_audience_msg=(
-                "a https://*.run.app or "
-                f"https://<region>-{app.project_id}.cloudfunctions.net/ function URL"
-            ),
+            audience_matcher=_blocking_audience_matcher,
+            expected_audience_msg="a https://*.run.app or https://*.cloudfunctions.net function URL",
         )
 
     def verify_auth_blocking_token(self, auth_blocking_token):

tests/test_token_verifier.py

@@ -101,11 +101,7 @@ def _verify(app, token: str):
         # hash, and a revision tag prefixes the service with `tag---`.
         "https://beforecreate-123456789.us-central1.run.app",
         "https://tag---beforecreate-123456789.us-central1.run.app",
-        # Regions the SupportedRegion enum predates, and a hypothetical shape with
-        # more than one hyphen, since the region is matched by shape.
         f"https://northamerica-northeast1-{PROJECT_ID}.cloudfunctions.net/before_create",
-        f"https://me-west1-{PROJECT_ID}.cloudfunctions.net/before_create",
-        f"https://us-far-west1-{PROJECT_ID}.cloudfunctions.net/before_create",
     ],
 )
 def test_accepts_function_url_audiences(app, signing_key, audience):
@@ -115,12 +111,9 @@ def test_accepts_function_url_audiences(app, signing_key, audience):
 @pytest.mark.parametrize(
     "audience",
     [
-        "https://us-east1-other-project.cloudfunctions.net/before_create",
+        # A regular Firebase ID token for the same project.
+        PROJECT_ID,
         "https://example.com/before_create",
-        # A project id ending with this one must not be accepted as a suffix.
-        f"https://us-east1-other-{PROJECT_ID}.cloudfunctions.net/before_create",
-        f"https://us-east1-x1-{PROJECT_ID}.cloudfunctions.net/before_create",
-        f"https://us-east1-a-{PROJECT_ID}.cloudfunctions.net/before_create",
         # The expected host must be the host, not text anywhere in the URL.
         f"https://us-east1-{PROJECT_ID}.cloudfunctions.net.example.com/before_create",
         f"https://example.com/{PROJECT_ID}.cloudfunctions.net/before_create",
@@ -135,15 +128,16 @@ def test_rejects_foreign_audience(app, signing_key, audience):
         _verify(app, _token(signing_key, audience))
 
 
-def test_accepts_any_run_host(app, signing_key):
-    """The run.app form is not project-scoped; `iss` is what pins the project."""
-    assert _verify(app, _token(signing_key, "https://svc-999.us-central1.run.app"))["uid"] == (
-        "uid123"
+@pytest.mark.parametrize(
+    "other_project",
+    ["other-project", f"other-{PROJECT_ID}", f"x1-{PROJECT_ID}", f"a-{PROJECT_ID}"],
+)
+def test_rejects_function_url_from_another_project(app, signing_key, other_project):
+    token = _token(
+        signing_key,
+        f"https://us-east1-{other_project}.cloudfunctions.net/before_create",
+        issuer=f"https://securetoken.google.com/{other_project}",
     )
-
-
-def test_rejects_wrong_issuer(app, signing_key):
-    token = _token(signing_key, RUN_APP_AUDIENCE, issuer="https://securetoken.google.com/other")
     with pytest.raises(token_verifier.InvalidAuthBlockingTokenError, match='"iss"'):
         _verify(app, token)