Cloudflare Workers Accept Inbound TCP, with gRPC the First Protocol on Top

I am a 17-year-old student living on a small island in Japan's Seto Inland Sea. I operate a paid membership video platform called Okugawa Lab, built with the Next.js 16 framework and deployed to Cloudflare Workers via OpenNext. This platform utilizes Firebase Authentication and Cloud Firestore.

While working on the project, I encountered a significant challenge: the firebase-admin SDK does not run on Cloudflare Workers. This issue is not due to configuration problems; rather, it is a limitation within the SDK itself. The problem arises from the protobufjs dependency, which generates code from strings at runtime, and Cloudflare Workers outright prohibit this behavior.

To overcome this obstacle, I replaced the firebase-admin SDK with alternative methods using the fetch API and WebCrypto. My primary objectives were to verify Firebase ID tokens sent by the browser, read and write Firestore data, and delete a user's Auth account when they delete their data. Each of these tasks can be achieved through separate HTTP APIs.

For verifying ID tokens, I utilized the firebase-auth-cloudflare-workers library, which employs only web-standard APIs and has no dependencies. This library requires a KeyStorer to cache Google's public keys. In my implementation, I opted for an in-memory store scoped to the isolate, as suggested by the documentation. The MemoryKeyStorer class handles caching and retrieval of public keys.

Subsequently, I used the auth.verifyIdToken() method to decode and validate the bearer token. In case of a failure to fetch Google's public keys, I differentiated between a 401 Unauthorized error (indicating an invalid token) and a 503 Service Unavailable error (signifying an issue with Google's servers).

For other tasks, such as accessing Firestore and deleting user accounts, I generated an OAuth2 access token for the service account using the WebCrypto API. The fetch function and TextEncoder were employed to construct and sign the JWT, which was then exchanged for an access token.