Pulumi CORS

firebaseSignIn.ts

	const getHeaders = async () => {
		const token = await getToken()

		return {
			Authorization: `Bearer ${token}`,
			'x-api-key': process.env.REACT_APP_FIREBASE_AUTH_API_KEY,
		}
	}

	const headers = await getHeaders()
	const firebaseUrl = process.env.REACT_APP_FIREBASE_AUTH_URL

	if (firebaseUrl) {
		const axiosInstance = axios.create({
			headers,
			baseURL: firebaseUrl,
		})

		const {
			data: { token },
		} = await axiosInstance.post('/')

		const firebaseToken = await firebase.auth().signInWithCustomToken(token)
		return firebaseToken
	} else {
		console.error('Could not authenticate with firebase.  Missing URL.')
	}

index.ts

import * as pulumi from '@pulumi/pulumi'
import * as aws from '@pulumi/aws'
import * as awsx from '@pulumi/awsx'
import admin from 'firebase-admin'
import jwtDecode from 'jwt-decode'
const config = new pulumi.Config()
const stack = pulumi.getStack()

const getCustomToken = async sub => {
	const secret = process.env.firebaseAdminSecret && JSON.parse(process.env.firebaseAdminSecret)

	if (!admin.apps.length) {
		admin.initializeApp({
			credential: admin.credential.cert(secret || ''),
		})
	}

	const firebaseToken = await admin.auth().createCustomToken(sub)
	return firebaseToken
}

const handler = async (event, _, cb) => {
	const {
		headers: { Authorization },
	} = event

	const jwtToken = Authorization.split('Bearer')[1]
	const jwtDecoded = jwtDecode(jwtToken)
	const token = await getCustomToken(jwtDecoded.sub)

	cb(null, {
		statusCode: 200,
		headers: {
			'Access-Control-Allow-Origin': '*',
			'Access-Control-Allow-Methods': 'GET, POST, PATCH, PUT, DELETE, OPTIONS',
			'Access-Control-Allow-Headers': 'Origin, Content-Type, X-Auth-Token',
		},
		body: token,
	})
}

const firebaseAuthApiGatewayEndpoint = new awsx.apigateway.API(`firebaseAuth-${stack}`, {
	routes: [
		{
			path: '/',
			method: 'OPTIONS',
			apiKeyRequired: true,
			eventHandler: async () => {
				return {
					statusCode: 200,
					headers: {
						'Access-Control-Allow-Origin': '*',
						'Access-Control-Allow-Methods': 'GET, POST, PATCH, PUT, DELETE, OPTIONS',
						'Access-Control-Allow-Headers': 'Origin, Content-Type, X-Auth-Token',
					},
					body: '',
				}
			},
		},
		{
			path: '/',
			method: 'POST',
			apiKeyRequired: true,
			eventHandler: new aws.lambda.CallbackFunction(`firebaseAuth-${stack}`, {
				environment: {
					variables: {
						firebaseAdminSecret: config.requireSecret('firebaseAdminSecret'),
					},
				},
				callback: handler,
			}),
		},
	],
})

const firebaseAuthApiKeys = awsx.apigateway.createAssociatedAPIKeys(`firebaseAuth-${stack}`, {
	apis: [firebaseAuthApiGatewayEndpoint],
	apiKeys: [
		{
			name: 'main',
		},
	],
})

export const url = firebaseAuthApiGatewayEndpoint.url
export const apiKey = firebaseAuthApiKeys.keys[0].apikey.value