How to Allow Only Specific Email Domains in Firebase

1import { beforeUserCreated } from 'firebase-functions/v2/identity';
2import { HttpsError } from 'firebase-functions/v2/https';
3import { logger } from 'firebase-functions/v2';
4
5const ALLOWED_DOMAINS = ['yourcompany.com', 'partner-company.com'];
6
7export const checkEmailDomain = beforeUserCreated(async (event) => {
8  const email = event.data.email;
9
10  if (!email) {
11    logger.warn('Registration blocked: no email provided');
12    throw new HttpsError(
13      'invalid-argument',
14      'An email address is required to register.'
15    );
16  }
17
18  const domain = email.split('@')[1]?.toLowerCase();
19
20  if (!domain || !ALLOWED_DOMAINS.includes(domain)) {
21    logger.warn('Registration blocked: unauthorized domain', {
22      email,
23      domain
24    });
25    throw new HttpsError(
26      'invalid-argument',
27      'Registration is restricted to approved email domains.'
28    );
29  }
30
31  logger.info('Registration allowed', { email, domain });
32});

1import { beforeUserCreated } from 'firebase-functions/v2/identity';
2import { HttpsError } from 'firebase-functions/v2/https';
3import { getFirestore } from 'firebase-admin/firestore';
4import { initializeApp } from 'firebase-admin/app';
5import { logger } from 'firebase-functions/v2';
6
7initializeApp();
8const db = getFirestore();
9
10let cachedDomains: string[] = [];
11let cacheTimestamp = 0;
12const CACHE_TTL = 5 * 60 * 1000; // 5 minutes
13
14async function getAllowedDomains(): Promise<string[]> {
15  const now = Date.now();
16  if (cachedDomains.length > 0 && now - cacheTimestamp < CACHE_TTL) {
17    return cachedDomains;
18  }
19
20  const doc = await db.collection('config').doc('auth').get();
21  cachedDomains = doc.data()?.allowedDomains || [];
22  cacheTimestamp = now;
23  return cachedDomains;
24}
25
26export const checkEmailDomain = beforeUserCreated(async (event) => {
27  const email = event.data.email;
28  if (!email) {
29    throw new HttpsError('invalid-argument', 'Email is required.');
30  }
31
32  const domain = email.split('@')[1]?.toLowerCase();
33  const allowedDomains = await getAllowedDomains();
34
35  if (!domain || !allowedDomains.includes(domain)) {
36    logger.warn('Blocked registration', { email, domain });
37    throw new HttpsError(
38      'invalid-argument',
39      'Registration is restricted to approved email domains.'
40    );
41  }
42});

1import { getAuth, createUserWithEmailAndPassword } from 'firebase/auth';
2
3const auth = getAuth();
4
5async function register(email: string, password: string) {
6  try {
7    const userCredential = await createUserWithEmailAndPassword(
8      auth, email, password
9    );
10    console.log('Registration successful:', userCredential.user.uid);
11  } catch (error: any) {
12    if (error.code === 'auth/blocking-function-error-response') {
13      // The Blocking Function rejected the registration
14      console.error('Domain not allowed:', error.message);
15      // Show user-friendly message
16    } else if (error.code === 'auth/email-already-in-use') {
17      console.error('An account with this email already exists');
18    } else {
19      console.error('Registration failed:', error.message);
20    }
21  }
22}

1rules_version = '2';
2service cloud.firestore {
3  match /databases/{database}/documents {
4    // Helper function to check email domain
5    function isApprovedDomain() {
6      let email = request.auth.token.email;
7      return email.matches('.*@yourcompany\\.com$')
8          || email.matches('.*@partner-company\\.com$');
9    }
10
11    match /internal/{docId} {
12      allow read, write: if request.auth != null && isApprovedDomain();
13    }
14
15    match /public/{docId} {
16      allow read: if request.auth != null;
17      allow write: if request.auth != null && isApprovedDomain();
18    }
19  }
20}