firebase-hs
Firebase Auth, Firestore, and Servant integration for Haskell
https://github.com/Gondola-Bros-Entertainment/firebase-hs
| Stackage Nightly 2026-07-30: | 0.3.0.0 |
| Latest on Hackage: | 0.3.0.0 |
firebase-hs-0.3.0.0@sha256:3f5bd69b0270362bb1d0b85ff0be957278d18e9e2c9f7eb1c32fb1e2898ec447,3408Module documentation for 0.3.0.0
firebase-hs
Firebase for Haskell:
- Auth: Firebase ID token (JWT) verification against Google’s public keys, with RS256 via crypton and automatic key caching
- Firestore: CRUD, structured queries, and atomic transactions over the REST API
- WAI / Servant: auth middleware and an auth combinator, each behind an optional cabal flag
Full API documentation lives on Hackage.
Install
build-depends: firebase-hs
The web integrations are off by default; enable the ones you use:
cabal build -f wai # Firebase.Auth.WAI
cabal build -f servant # Firebase.Servant
Auth
import Firebase.Auth
main :: IO ()
main = do
cache <- newTlsKeyCache
let cfg = defaultFirebaseConfig "my-project-id"
result <- verifyIdTokenCached cache cfg tokenBytes
case result of
Left err -> putStrLn ("Auth failed: " ++ show err)
Right user -> putStrLn ("UID: " ++ show (fuUid user))
Build one KeyCache at startup and share it across threads; keys refresh
automatically per Google’s Cache-Control header.
A token is accepted only if every one of these holds:
| Check | Rule |
|---|---|
| Algorithm | RS256 only |
| Signature | Must match a Google public key |
| Issuer | https://securetoken.google.com/<projectId> |
| Audience | Must equal your Firebase project ID |
| Expiry / issued-at | exp in the future, iat in the past, within clock skew |
| Subject | sub non-empty (becomes the Firebase UID) |
Roles live in custom claims, set by the Admin SDK’s setCustomUserClaims:
if hasClaim "admin" user then handleAdmin user else refuse
Firestore
import qualified Data.Map.Strict as Map
import Firebase.Firestore
main :: IO ()
main = do
fs <- newFirestore (ProjectId "my-project") (AccessToken "ya29...")
let path = DocumentPath (CollectionPath "users") (DocumentId "alice")
_ <- createDocument fs (CollectionPath "users") (DocumentId "alice")
(Map.fromList [("name", StringValue "Alice"), ("age", IntegerValue 30)])
_ <- updateDocument fs path ["age"] (Map.fromList [("age", IntegerValue 31)])
doc <- getDocument fs path
print doc
Build one Firestore handle and share it; it holds a pooled connection
manager. Access tokens expire, so swap in a fresh one with withToken
rather than rebuilding the handle.
Queries compose with (&); subcollections are addressed by path:
import Data.Function ((&))
result <- runQuery fs $
query (CollectionPath "users")
& where_ (fieldFilter "age" OpGreaterThan (IntegerValue 18))
& orderBy "age" Ascending
& limit 10
Transactions read with the transaction ID and return the writes to commit.
On any failure the transaction is rolled back, and losing a contention race
surfaces as TransactionAborted:
result <- runTransaction fs ReadWrite $ \txnId -> runExceptT $ do
doc <- ExceptT (getDocumentInTransaction fs txnId path)
pure [mkUpdateWrite (fsProject fs) path (applyDebit 100 (docFields doc))]
WAI
import Firebase.Auth (newTlsKeyCache, defaultFirebaseConfig)
import Firebase.Auth.WAI (requireAuth)
import Network.Wai.Handler.Warp (run)
main :: IO ()
main = do
cache <- newTlsKeyCache
let cfg = defaultFirebaseConfig "my-project-id"
run 3000 (requireAuth cache cfg myApp)
firebaseAuth additionally stores the verified FirebaseUser in the
request vault for lookupFirebaseUser to read downstream.
Servant
import Firebase.Auth (newTlsKeyCache, defaultFirebaseConfig)
import Firebase.Servant (firebaseAuthHandler)
import Servant.Server (Context (..))
main :: IO ()
main = do
cache <- newTlsKeyCache
let cfg = defaultFirebaseConfig "my-project-id"
ctx = firebaseAuthHandler cache cfg :. EmptyContext
runSettings defaultSettings (serveWithContext api ctx server)
Build and Test
cabal build all -f wai -f servant --enable-tests --ghc-options="-Werror"
cabal test
BSD-3-Clause. Maintained by Gondola Bros Entertainment.