feat: implement Firebase ID token authentication for passenger telemetry and update related configurations

backend/src/middleware/passengerTelemetryAuth.js

@@ -0,0 +1,53 @@
+const logger = require('../config/logger');
+const { createFirebaseAuth } = require('../config/firebase');
+
+function getBearerToken(req) {
+  const authorization = typeof req.get === 'function'
+    ? req.get('Authorization')
+    : req.headers?.authorization;
+  const match = /^Bearer\s+([^\s]+)$/i.exec(authorization || '');
+  return match ? match[1] : null;
+}
+
+function createPassengerTelemetryAuthenticator({
+  getFirebaseAuth = createFirebaseAuth,
+  authLogger = logger
+} = {}) {
+  return async (req, res, next) => {
+    const token = getBearerToken(req);
+    if (!token) {
+      return res.status(401).json({ error: 'Access token required' });
+    }
+
+    let firebaseAuth;
+    try {
+      firebaseAuth = getFirebaseAuth();
+    } catch (error) {
+      authLogger.error('Passenger telemetry authentication is unavailable', {
+        firebaseCode: error.code || 'unknown'
+      });
+      return res.status(503).json({ error: 'Passenger telemetry authentication is unavailable' });
+    }
+
+    try {
+      // Verify the Firebase ID token, including revocation. The decoded token and UID are
+      // deliberately discarded: telemetry identity is the installation-scoped sessionId only.
+      await firebaseAuth.verifyIdToken(token, true);
+      req.passengerTelemetryAuthenticated = true;
+      return next();
+    } catch (error) {
+      authLogger.warn('Passenger telemetry token was rejected', {
+        firebaseCode: error.code || 'unknown'
+      });
+      return res.status(403).json({ error: 'Invalid or expired token' });
+    }
+  };
+}
+
+const authenticatePassengerTelemetry = createPassengerTelemetryAuthenticator();
+
+module.exports = {
+  createPassengerTelemetryAuthenticator,
+  authenticatePassengerTelemetry,
+  getBearerToken
+};