From 81e1485c9d3700bf4e068113e76e9248e408c482 Mon Sep 17 00:00:00 2001 From: Jacob Cable Date: Thu, 2 Jul 2026 09:35:09 +0100 Subject: [PATCH] docs(firestore-semantic-search): correct App Check and Auth claims The query Callable Function docs stated the endpoint was protected by App Check and required a signed-in Firebase Auth user. Neither is enforced: the function is registered as a plain onCall handler with no App Check enforcement and the handler never inspects the auth context. Update PREINSTALL, README, and POSTINSTALL to describe the actual behaviour - the function is callable by any client, only ever returns document IDs (so Firestore Security Rules still protect document contents), and developers who need to restrict access should enable App Check enforcement and/or add their own auth checks. Fixes #686 --- firestore-semantic-search/CHANGELOG.md | 4 ++++ firestore-semantic-search/POSTINSTALL.md | 2 +- firestore-semantic-search/PREINSTALL.md | 2 +- firestore-semantic-search/README.md | 2 +- firestore-semantic-search/extension.yaml | 2 +- 5 files changed, 8 insertions(+), 4 deletions(-) diff --git a/firestore-semantic-search/CHANGELOG.md b/firestore-semantic-search/CHANGELOG.md index d877176f9..c71f75c8d 100644 --- a/firestore-semantic-search/CHANGELOG.md +++ b/firestore-semantic-search/CHANGELOG.md @@ -1,3 +1,7 @@ +## Version 0.1.11 + +docs: correct the query function App Check and Firebase Auth claims (the Callable Function does not enforce either by default) + ## Version 0.1.10 chore: bump runtime to Node.js 22 diff --git a/firestore-semantic-search/POSTINSTALL.md b/firestore-semantic-search/POSTINSTALL.md index 4517ab108..0f5bd294c 100644 --- a/firestore-semantic-search/POSTINSTALL.md +++ b/firestore-semantic-search/POSTINSTALL.md @@ -64,7 +64,7 @@ The response contains** only document IDs**, not the full data, since the extens ## Example client integration -Now that you have an index with data in it, you can run text similarity search queries directly from your client application. Note that this Callable Function is protected by App Check and requires that you are signed in with a [Firebase Auth](https://firebase.google.com/docs/auth) call the Function from your client application. +Now that you have an index with data in it, you can run text similarity search queries directly from your client application. Note that this Callable Function does not enforce [App Check](https://firebase.google.com/docs/app-check) or [Firebase Auth](https://firebase.google.com/docs/auth) by default, so any client with your Firebase project configuration is able to call it. The function only ever returns document IDs (never document contents), so your Firestore Security Rules continue to govern access to the underlying documents. If you need to restrict access to the query function itself, enable App Check enforcement and/or add your own authentication checks. ```js import firebase from "firebase"; diff --git a/firestore-semantic-search/PREINSTALL.md b/firestore-semantic-search/PREINSTALL.md index 0903f87ee..c6e6010a9 100644 --- a/firestore-semantic-search/PREINSTALL.md +++ b/firestore-semantic-search/PREINSTALL.md @@ -8,7 +8,7 @@ Once installed, the extension does the following: 2. Provides a secure API endpoint to query similar documents (given an input document) that can be used by client applications 3. (Optional) Backfills existing data from target collection(s) -The query API endpoint is deployed as a Firebase Callable Function, and requires that you are signed in with a Firebase Auth user to successfully call the Function from your client application. +The query API endpoint is deployed as a Firebase Callable Function. Note that this function does not enforce Firebase Authentication or [App Check](https://firebase.google.com/docs/app-check) by default, so any client with your Firebase project configuration is able to call it. The function only ever returns document IDs (never document contents), so your Firestore Security Rules continue to govern access to the underlying documents. If you want to restrict who can call the query function itself, enable App Check enforcement and/or add your own authentication checks after installing the extension. ### Embeddings models diff --git a/firestore-semantic-search/README.md b/firestore-semantic-search/README.md index be26ebafb..4d638ce9d 100644 --- a/firestore-semantic-search/README.md +++ b/firestore-semantic-search/README.md @@ -16,7 +16,7 @@ Once installed, the extension does the following: 2. Provides a secure API endpoint to query similar documents (given an input document) that can be used by client applications 3. (Optional) Backfills existing data from target collection(s) -The query API endpoint is deployed as a Firebase Callable Function, and requires that you are signed in with a Firebase Auth user to successfully call the Function from your client application. +The query API endpoint is deployed as a Firebase Callable Function. Note that this function does not enforce Firebase Authentication or [App Check](https://firebase.google.com/docs/app-check) by default, so any client with your Firebase project configuration is able to call it. The function only ever returns document IDs (never document contents), so your Firestore Security Rules continue to govern access to the underlying documents. If you want to restrict who can call the query function itself, enable App Check enforcement and/or add your own authentication checks after installing the extension. ### Embeddings models diff --git a/firestore-semantic-search/extension.yaml b/firestore-semantic-search/extension.yaml index 9dd7c4b1d..82578e704 100644 --- a/firestore-semantic-search/extension.yaml +++ b/firestore-semantic-search/extension.yaml @@ -1,5 +1,5 @@ name: firestore-semantic-search -version: 0.1.10 +version: 0.1.11 specVersion: v1beta icon: icon.png