javascript firebase-authentication google-cloud-functions google-cloud-iam

AUTH FAIL When calling Firebase Function with Gemini AI/Embedding/Sentiment score

This is the error im getting in console, in flutter console when testing, i get UNAUTHENTICATED. However, im able to login to the app, and make other calls like getting data from firestore, etc.

In local env everything is fine and works great.

import {
    GoogleGenAI
} from "@google/genai";
const apiKey = process.env.GEMINI_API_KEY;
const ai = apiKey ? new GoogleGenAI({
    apiKey
}) : null;

Here is my full function.

export const createAQuickPin = onCall(async (data, context) => {
    
    const { pinContent } = data.data;

    if (!pinContent) {
        throw new HttpsError('invalid-argument', 'Missing or invalid parameters.');
    }
    if (!data.auth) {
        throw new HttpsError('unauthenticated', 'The function must be called while authenticated.');
    }

    const uid = data.auth.uid;

    // Check for AI client configuration
    if (!ai) {
        throw new HttpsError('internal',
            'AI service is not configured. Check the server logs for the missing API key error.');
    }

    var systemInstruction = AI_CREATE_PIN;

    try {

        systemInstruction = systemInstruction.replace(/\$pinContent/g, pinContent);

        const geminiResponsePromise = ai.models.generateContent({
            model: modelName,
            contents: pinContent,
            config: {
                systemInstruction: systemInstruction
            }
        });
        
        const sentimentPromise = textClient.analyzeSentiment({
            document: {
                content: pinContent,
                type: "PLAIN_TEXT"
            }
        });

        const embedText = `${pinContent}`;
        const embeddingModel = "gemini-embedding-001";
        
        const embeddingPromise = ai.models.embedContent({
            model: embeddingModel,
            contents: embedText,
        });
        
        const [embeddedResponse, sentimentResponse, geminiResponse] = await Promise.all([
            embeddingPromise, 
            sentimentPromise,
            geminiResponsePromise
        ]);

        const responseText = geminiResponse.text.trim();
        const parsed = JSON.parse(responseText);

        const embedding = embeddedResponse.embeddings[0].values;
        const sentimentScore = sentimentResponse[0].sentences[0].sentiment.score;

        // --- 5. Database Write (only if valid) ---
        if (parsed.isValid) {
            const pinRef = db
                .collection("users")
                .doc(uid)
                .collection("pins")
                .doc();

            await pinRef.set({
                pinCategory: parsed.pinCategory,
                pinSubject: parsed.pinSubject,
                pinContent: pinContent,
                pinConfidence: parsed.confidence,
                seekAdvice: parsed.seekAdvice,
                embedding: embedding,
                sentimentScore: sentimentScore,
                pinAddedDate: FieldValue.serverTimestamp(),
            });
        }
        
        return {
            promptFromUser: pinContent,
            pinCategory: parsed.pinCategory,
            pinSubject: parsed.pinSubject,
            confidence: parsed.confidence,
            seekAdvice: parsed.seekAdvice,
            isValid: parsed.isValid,
            modelUsed: modelName
        };

    } catch (error) {
        console.error('Error in createAQuickPin:', error);
        throw new HttpsError('unavailable', 'The AI service is temporarily unavailable or returned an error.');
    }
});

textPayload: "The request was not authorized to invoke this service. Read more at https://cloud.google.com/run/docs/securing/authenticating Additional troubleshooting documentation can be found at: https://cloud.google.com/run/docs/troubleshooting#401"

here is my IAM

ive asked gemini and followed it and still nothing... any help would be AMAZING!

I see this in my cloud function... when I turn it off, and ran my function, it works.... how can I keep this enabled and still run my function with the proper auth?

Solution

Firebase callable functions (and Firebase Authentication) aren't compatible with IAM authentication for Cloud Functions. GCP IAM is not in any way compatible with Firebase Auth - they represent different sets of user credentials with no overlap between them.

You need to set your function to allow public access (allUsers in GCP IAM terms) if you want to be able to invoke it from your mobile app. Then, if you want to restrict access to its functionality in some way based on the user's Firebase Authentication credentials, you need to write code in your function to check and enforce those restrictions.