如何拒绝管理员调用Firebase功能？

Question

I have two firebase function triggers:

1. user onUpdate
2. owner onUpdate

When the owner onUpdate is triggered it makes an operation and update the user document.

User onUpdate is called by the last operation, not from client.

Is there a way to deny the admin or the server from calling a function?

I search on Firebase documentation and i discover that if I use :

console.log(context.auth.uid);

it will show up the user ID that makes the change, but I got this error :

Cannot read property 'uid' of undefined

So I tried to print the context Object and this is the result :

context : { eventId: '7eac4df1-85bd-47dd-b83a-827b63597e10-0',
 eventType: 'google.firestore.document.update',
 notSupported: {},
 params: 
  { serviceId: 'bY0RjOSgygnXuojmDyng',
    userId: 'Poz0UKIShnSUJNPCrug3zvfiyKn1' },
  resource: 
   { service: 'firestore.googleapis.com',
    name: 'projects/*Project name*/databases/(default)/documents/users/Poz0UKIShnSUJNPCrug3zvfiyKn1/services/bY0RjOSgygnXuojmDyng' },
 timestamp: '2019-06-14T06:33:48.525983Z' }

So, my answer is : is there a function that returns true/false if a call is made from the server or client app?

I use a google Auth and when I call the function I'm authenticated

EDIT

UserCode Android

User delete an order. (For GDPR policy I can't delete it but I need to make it invisible with the attribute canceled)

FirebaseFirestore db = FirebaseFirestore.getInstance();
    db.collection("users").document(User.getUserId())
            .collection("orders").document(orderId)
                .update("canceled", true);

UserCode Firebase Function

exports.updateLocalOrder = functions.firestore
    .document('users/{userId}/orders/{orderId}')
    .onUpdate((change, context) => {

      const order = change.after.data();
      const orderId = ontext.params.orderId;
      const ownerId = order.ownerId;

      if (order.canceled){

          admin.firestore().collection("owners")
              .doc(ownerId).collection("orders")
                  .doc(orderId).update("canceled", true);

      }

      ...
});

OwnerCode Android

Owner delete an order. (For GDPR policy I can't delete it but I need to make it invisible with the attribute canceled)

FirebaseFirestore db = FirebaseFirestore.getInstance();
    db.collection("owners").document(Owner.getOwnerId())
            .collection("orders").document(orderId)
                .update("canceled", true);

OwnerCode Firebase Function

exports.updateUserOrder = functions.firestore
    .document('owners/{ownerId}/orders/{orderId}')
    .onUpdate((change, context) => {

      const order = change.after.data();
      const orderId = ontext.params.orderId;
      const userId = order.userId;

      if (order.canceled){

          admin.firestore().collection("users")
              .doc(userId).collection("orders")
                  .doc(orderId).update("canceled", true);

      }

      ...
}); 

So every time I delete an order there will be a call to Functions from the client (Android app) and after that there will be an infinite call from server.

IMPORTANT!!!

I don't want to make another collection called "orders". So the problem is not how I can manage my apps or how can I manage orders between user and owner because I only need to know how can I distinguish calls.

Answer 1

There isn't a real answer to this problem, but I had solved it.

When I update a document, if task is successful, I make an HTTP call to Firebase Function and update also the owner document. I converted all Firestore triggers into OnCall functions so there is no recursion.