@causa/workspace-google 0.3.0 → 0.4.0

package/README.md

@@ -1 +1,124 @@
 # `@causa/workspace-google` module
+
+This repository contains the source code for the `@causa/workspace-google` Causa module. It provides many GCP-related utilities and implementations for `cs` commands. For more information about the Causa CLI `cs`, checkout [its repository](https://github.com/causa-io/cli).
+
+## ➕ Requirements
+
+The Google module requires [Docker](https://www.docker.com/) in order to run local emulators of GCP services.
+
+Although not required, the [`gcloud`](https://cloud.google.com/sdk/gcloud) CLI might be useful, e.g. to set up credentials that will be used by the Causa Google module.
+
+## 🎉 Installation
+
+Add `@causa/workspace-google` to your Causa configuration in `causa.modules`.
+
+## 🔧 Configuration
+
+For all the Google-related configuration in your Causa files, look at [the schema for the `GoogleConfiguration`](./src/configurations/google.ts).
+
+## ✨ Supported project types and commands
+
+### Project types
+
+The following Causa `project.type`s are supported:
+
+- `serviceContainer`, with `google.cloudRun` as the `serviceContainer.platform`. This will ensure the built Docker images are pushed to the repository set in `google.cloudRun.dockerRepository`.
+- `serverlessFunctions`, with `google.cloudFunctions` as the `serverlessFunctions.platform`. This will push functions archives to the Cloud Storage bucket set in `google.cloudFunctions.archivesStorageLocation`.
+
+### Emulators
+
+The following emulators are implemented:
+
+- `google.firebaseStorage`: The Firebase Storage emulator from the Firebase tools. It supports setting the corresponding security rules. See the `cs google firebaseStorage mergeRules` documentation for more details.
+- `google.firestore`: The Firestore emulator from the `gcloud` tools. If supports setting the corresponding security rules. See the `cs google firestore mergeRules` documentation for more details.
+- `google.identityPlatform`: The Identity Platform (Firebase Auth) emulator from the Firebase tools.
+- `google.pubSub`: The Pub/Sub emulator from the `gcloud` tools. It automatically creates the topics for all event topics found in the Causa workspace. `events.broker` must be set to `google.pubSub` for this.
+- `google.spanner`: The Spanner emulator. It automatically creates all the Spanner databases defined in the Causa workspace, and sets up their DDLs. See the `google.spanner` [configuration](./src/configurations/google.ts) for more details.
+
+### Secrets backend
+
+This module implements the `google.secretManager` secret backend, allowing fetching secrets from the Google Secret Manager service. Here are some example of how secrets with the `google.secretManager` backend should be defined:
+
+```yaml
+secrets:
+  simpleSecret:
+    id: simple-secret
+  secretWithProject:
+    id: projects/gcp-project/secrets/my-secret
+  secretWithVersion:
+    id: projects/gcp-project/secrets/my-secret/versions/12
+```
+
+When the GCP project is not specified in the secret ID, it is inferred from `google.secretManager.project`, or `google.project` (in this order). This allows defining the GCP project a single time if needed.
+
+## 🔨 Custom `google` commands
+
+This modules adds a new command to the CLI: `cs google`. Here is the list of subcommands that are exposed.
+
+### App Check
+
+The `cs google appCheck genToken` command generates an App Check token, which can be used to authenticate calls to APIs that are protected by Firebase App Check.
+
+A token is generated for a specific Firebase application. This can be set using the `-a, --app <app>` argument. If it is not set, any Firebase application will be selected automatically using the Firebase API.
+
+An App Check token must be signed using an admin service account in the same project as the app. Firebase automatically creates such an account when it is initialized from a GCP project. This command can take care of automatically finding this account. However, if you want to save on API calls, the email for any service account with Firebase admin permissions can be set in `google.firebase.adminServiceAccount`.
+
+### Enable services
+
+The `cs google enableServices` command will enable all the GCP services defined in `google.services`. This command is also exposed as an infrastructure processors, under the name `GoogleServicesEnable`.
+
+### Firebase Storage
+
+The `cs google firebaseStorage mergeRules` command merges several Firebase security rules files together into a single file that can be used as configuration for both the Firebase Storage emulator, and the Firebase Storage production service.
+
+Input files are found using the glob patterns defined in `google.firebaseStorage.securityRuleFiles`. Input files should not include the header, i.e. they should defined what is **inside**:
+
+```
+rules_version = '2';
+
+service firebase.storage {
+  match /b/{bucket}/o {
+    // Only include what is inside those brackets.
+  }
+}
+```
+
+The output Firebase security rules file can be set in `google.firebaseStorage.securityRuleFile`.
+
+### Firestore
+
+The `cs google firestore mergeRules` command merges several Firebase security rules files together into a single file that can be used as configuration for both the Firestore emulator, and the Firestore production service.
+
+This command is extremely similar to `cs google firebaseStorage mergeRules`. Input files are defined in `google.firestore.securityRuleFiles`, and the output file is defined in `google.firestore.securityRuleFile`.
+
+### Identity Platform
+
+The `cs google identityPlatform genToken` command generates an Identity Platform (formerly Firebase Auth) ID token, which can be used to authenticate calls to API protected by Identity Platform.
+
+This command is similar to `cs google appCheck genToken` in that it requires a service account with Firebase admin permissions to sign the token. See the corresponding command for more information.
+
+## 🧱 Infrastructure processors
+
+The Google module provides several infrastructure processors, which can be used to set up the Causa workspace before running infrastructure-related operations.
+
+### `GoogleFirebaseStorageMergeRules`
+
+[GoogleFirebaseStorageMergeRules](./src/functions/google-firebase-storage-merge-rules.ts) is the same underlying function as the `cs google firebaseStorage mergeRules` command. It allows preparing the Firebase Storage security rules before possibly deploying them along with the infrastructure. See the corresponding command for more details.
+
+### `GoogleFirestoreMergeRules`
+
+[GoogleFirestoreMergeRules](./src/functions/google-firestore-merge-rules.ts) is the same underlying function as the `cs google firestore mergeRules` command. It allows preparing the Firestore security rules before possibly deploying them along with the infrastructure. See the corresponding command for more details.
+
+### `GoogleServicesEnable`
+
+[GoogleServicesEnable](./src/functions/google-services-enable.ts) is the same underlying function as the `cs google enableServices` command. It enables GCP services before preparing or deploying the infrastructure.
+
+Although infrastructure as code tools usually expose this feature as well (e.g. the [`google_project_service`](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_service) Terraform resource), it might be more convenient to enable all the required services before running those tools. It avoids having to define dependencies between the services and all the actual resources being deployed.
+
+### `GoogleSpannerWriteDatabases`
+
+[GoogleSpannerWriteDatabases](./src/functions/google-spanner-write-databases.ts) writes a configuration file for each Spanner database, such that it can be picked up by the Causa Spanner Terraform module. This allows automatic setup of Spanner databases and their DDLs.
+
+### `GooglePubSubWriteTopics`
+
+[GooglePubSubWriteTopics](./src/functions/google-pubsub-write-topics.ts) writes a configuration file for each event topic, such that it can be picked up by the Causa Pub/Sub Terraform module. This allows automatic setup of Pub/Sub topics, and optionally of the corresponding BigQuery tables.

package/dist/configurations/google.d.ts

@@ -5,35 +5,35 @@ export type GoogleConfiguration = {
     /**
      * Configuration for everything Google / GCP-related.
      */
-    google?: {
+    readonly google?: {
         /**
          * The ID of the default GCP project used when performing operations.
          */
-        project?: string;
+        readonly project?: string;
         /**
          * The ID of a local GCP project (which does not exist on GCP).
          * This is for example used by emulators. It should usually start with `demo-` to be compatible with some emulators.
          */
-        localProject?: string;
+        readonly localProject?: string;
         /**
          * The list of GCP services on which the project depends.
          * This is useful to automatically enable those services in the GCP project.
          */
-        services?: string[];
+        readonly services?: string[];
         /**
          * Configuration for the `gcloud` command.
          * This applies to Dockerized calls to `gcloud` using the official `gcloud` Docker image.
          */
-        gcloud?: {
+        readonly gcloud?: {
             /**
              * The version of the `gcloud` command.
              */
-            version?: string;
+            readonly version?: string;
         };
         /**
          * Configuration for the Firebase project.
          */
-        firebase?: {
+        readonly firebase?: {
             /**
              * An existing service account that can be used to sign Identity Platform custom token.
              * Generating custom tokens by signing them using end-user credentials does not work with Identity Platform.
@@ -42,156 +42,246 @@ export type GoogleConfiguration = {
              * If this is not set and is needed by an operation, an attempt will be made to find this service account in the
              * current `google.project`.
              */
-            adminServiceAccount?: string;
+            readonly adminServiceAccount?: string;
             /**
              * The Firebase API key used by clients. Used to perform requests to Firebase as an end user.
              * This can be found in the GCP or Firebase Console.
              * If this is not set and is needed by an operation, an attempt will be made to find the key automatically using
              * the API.
              */
-            apiKey?: string;
+            readonly apiKey?: string;
             /**
              * The Firebase app ID used by clients.
              * This can be found in the Firebase Console. Each platform (Android, iOS, Web) has its own app ID.
              * If this is not set and is needed by an operation, an attempt will be made to find the first eligible app ID
              * using the Firebase API.
              */
-            appId?: string;
+            readonly appId?: string;
             /**
              * The domain name for the project.
              * If not set, this default to `<GCP project>.firebaseapp.com`.
              */
-            authDomain?: string;
+            readonly authDomain?: string;
             /**
              * Configuration for Firebase tools (the CLI).
              * This applies to Dockerized calls to the `firebase` CLI.
              */
-            tools?: {
+            readonly tools?: {
                 /**
                  * The version of the CLI to use.
                  */
-                version?: string;
+                readonly version?: string;
             };
         };
         /**
          * Configuration for the Secret Manager service.
          */
-        secretManager?: {
+        readonly secretManager?: {
             /**
              * The ID of the default GCP project referenced when fetching secrets.
              */
-            project?: string;
+            readonly project?: string;
         };
         /**
          * Configuration for the Firebase Storage service.
          */
-        firebaseStorage?: {
+        readonly firebaseStorage?: {
             /**
              * Configuration for the emulator.
              */
-            emulator?: {
+            readonly emulator?: {
                 /**
                  * The name of the local Docker container running the emulator.
                  */
-                containerName?: string;
+                readonly containerName?: string;
             };
             /**
              * A list of glob patterns to find files in the workspace defining Firebase Storage security rules.
              */
-            securityRuleFiles?: string[];
+            readonly securityRuleFiles?: string[];
             /**
              * The file path, relative to the workspace root, where the merged security rules file is written.
              */
-            securityRuleFile?: string;
+            readonly securityRuleFile?: string;
         };
         /**
          * Configuration for the Identity Platform (formerly Firebase Auth) service.
          */
-        identityPlatform?: {
+        readonly identityPlatform?: {
             /**
              * Configuration for the emulator.
              */
-            emulator?: {
+            readonly emulator?: {
                 /**
                  * The name of the local Docker container running the emulator.
                  */
-                containerName?: string;
+                readonly containerName?: string;
             };
         };
         /**
          * Configuration for the Firestore service.
          */
-        firestore?: {
+        readonly firestore?: {
             /**
              * Configuration for the emulator.
              */
-            emulator?: {
+            readonly emulator?: {
                 /**
                  * The name of the local Docker container running the emulator.
                  */
-                containerName?: string;
+                readonly containerName?: string;
             };
             /**
              * A list of glob patterns to find files in the workspace defining Firestore security rules.
              */
-            securityRuleFiles?: string[];
+            readonly securityRuleFiles?: string[];
             /**
              * The file path, relative to the workspace root, where the merged security rules file is written.
              */
-            securityRuleFile?: string;
+            readonly securityRuleFile?: string;
         };
         /**
          * Configuration for the Pub/Sub service.
          */
-        pubSub?: {
+        readonly pubSub?: {
             /**
              * Configuration for the emulator.
              */
-            emulator?: {
+            readonly emulator?: {
                 /**
                  * The name of the local Docker container running the emulator.
                  */
-                containerName?: string;
+                readonly containerName?: string;
+            };
+            /**
+             * The directory where the topic configuration files are written by the `GooglePubSubWriteTopics` processor.
+             */
+            readonly topicConfigurationsDirectory?: string;
+            /**
+             * Configuration for the storage of Pub/Sub events in BigQuery.
+             */
+            readonly bigQueryStorage?: {
+                /**
+                 * The ID of the BigQuery dataset where raw Pub/Sub events should be stored.
+                 */
+                readonly rawEventsDatasetId?: string;
             };
         };
         /**
          * Configuration for the Spanner service.
          */
-        spanner?: {
+        readonly spanner?: {
             /**
              * Configuration for the emulator.
              */
-            emulator?: {
+            readonly emulator?: {
                 /**
                  * The name of the local Docker container running the emulator.
                  */
-                containerName?: string;
+                readonly containerName?: string;
                 /**
                  * The version of the Spanner emulator Docker image to use.
                  */
-                version?: string;
+                readonly version?: string;
                 /**
                  * The name of the Spanner instance that will automatically be created in the emulator.
                  */
-                instanceName?: string;
+                readonly instanceName?: string;
+            };
+            /**
+             * Configuration for the Spanner instance.
+             */
+            readonly instance?: {
+                /**
+                 * The name of the Spanner instance.
+                 */
+                readonly name?: string;
+                /**
+                 * The instance geographic configuration.
+                 * See https://cloud.google.com/spanner/docs/instance-configurations for more details.
+                 */
+                readonly configuration?: string;
+                /**
+                 * The compute capacity of the instance.
+                 * See https://cloud.google.com/spanner/docs/compute-capacity for more details.
+                 */
+                readonly processingUnits?: number;
             };
             /**
              * Defines how DDLs are found for the Spanner databases in the workspace.
              */
-            ddls?: {
+            readonly ddls?: {
                 /**
                  * The format string using groups from the regular expression used to make the database names.
                  */
-                format?: string;
+                readonly format?: string;
                 /**
                  * A list of glob patterns used to find SQL files containing DDL statements for the Spanner databases.
                  */
-                globs?: string[];
+                readonly globs?: string[];
                 /**
                  * The regular expression used to extract groups from the SQL file paths.
                  */
-                regularExpression?: string;
+                readonly regularExpression?: string;
             };
+            /**
+             * The directory where the database configuration files are written by the `GoogleSpannerWriteDatabases`
+             * processor.
+             */
+            readonly databaseConfigurationsDirectory?: string;
+        };
+        /**
+         * Configuration for Cloud Functions.
+         */
+        readonly cloudFunctions?: {
+            /**
+             * The Cloud Storage URI where Cloud Functions archives should be uploaded.
+             */
+            readonly archivesStorageLocation?: string;
+        };
+        /**
+         * Configuration for Cloud Run containers.
+         */
+        readonly cloudRun?: {
+            /**
+             * The Docker repository where Cloud Run containers should be uploaded.
+             */
+            readonly dockerRepository?: string;
+            /**
+             * The location where Cloud Run services should be deployed.
+             */
+            readonly location?: string;
+            /**
+             * A map where keys are the name of environment variables, and values are secret versions IDs (e.g.
+             * `projects/my-project/secrets/my-secret/versions/1`).
+             */
+            readonly secretEnvironmentVariables?: Record<string, string>;
+            /**
+             * Whether the container is running between requests and can perform background operations.
+             */
+            readonly cpuAlwaysAllocated?: boolean;
+            /**
+             * The max duration the instance is allowed for responding to a request, in seconds.
+             */
+            readonly timeout?: number;
+            /**
+             * The maximum allowed in-flight (concurrent) requests per container.
+             */
+            readonly requestConcurrency?: number;
+            /**
+             * The type of allowed ingress that can reach the container.
+             * See https://cloud.google.com/run/docs/securing/ingress#settings for more details.
+             */
+            readonly ingress?: 'all' | 'internal' | 'internal-and-cloud-load-balancing';
+            /**
+             * The name of the VPC access connector through which egress traffic should be routed.
+             */
+            readonly vpcAccessConnector?: string;
+            /**
+             * The setting for egress traffic that goes through the VPC access connector.
+             * See https://cloud.google.com/run/docs/configuring/connecting-vpc#manage for more details.
+             */
+            readonly vpcAccessConnectorEgressSettings?: 'all-traffic' | 'private-ranges-only';
         };
     };
 };

package/dist/functions/emulator-start-spanner.js

@@ -1,6 +1,6 @@
 import { DockerEmulatorService, EmulatorStart, } from '@causa/workspace-core';
 import { Spanner } from '@google-cloud/spanner';
-import { grpc } from 'google-gax';
+import { credentials } from '@grpc/grpc-js';
 import { getLocalGcpProject, } from '../configurations/index.js';
 import { SPANNER_EMULATOR_NAME, SPANNER_GRPC_PORT, SPANNER_HTTP_PORT, SPANNER_IMAGE, getSpannerContainerName, } from '../emulators/index.js';
 import { GoogleSpannerListDatabases } from './google-spanner-list-databases.js';
@@ -75,7 +75,7 @@ export class EmulatorStartForSpanner extends EmulatorStart {
             servicePath: '127.0.0.1',
             port: SPANNER_GRPC_PORT,
             projectId: getLocalGcpProject(context),
-            sslCreds: grpc.credentials.createInsecure(),
+            sslCreds: credentials.createInsecure(),
         });
         const [instance, operation] = await spanner.createInstance(instanceName, {
             config: 'emulator-config',
@@ -98,9 +98,7 @@ export class EmulatorStartForSpanner extends EmulatorStart {
             context.logger.info(`🗃️ Creating Spanner emulator database '${database.id}'.`);
             // Discarding `DROP TABLE` statements as the emulator does not seem to handle them properly.
             const ddls = database.ddls.filter((statement) => !statement.toUpperCase().startsWith('DROP TABLE'));
-            const [_, operation] = await instance.createDatabase(database.id, {
-                schema: ddls,
-            });
+            const operation = (await instance.createDatabase(database.id, { schema: ddls }))[1];
             await operation.promise();
         }));
         return databases.length === 0

package/dist/functions/google-pubsub-write-topics.d.ts

@@ -0,0 +1,22 @@
+import { ProcessorResult, WorkspaceContext, WorkspaceFunction } from '@causa/workspace';
+import { InfrastructureProcessor } from '@causa/workspace-core';
+/**
+ * A function that uses {@link EventTopicList} to find all the topics in the workspace, and writes their configurations
+ * to a directory.
+ * The `google.pubSub.topicConfigurationsDirectory` configuration can be used to specify the output location of the
+ * topic configurations.
+ * This function returns a partial configuration, such that it can be used as a processor.
+ */
+export declare class GooglePubSubWriteTopics extends WorkspaceFunction<Promise<ProcessorResult>> implements InfrastructureProcessor {
+    readonly tearDown?: boolean;
+    /**
+     * Returns the path to the directory where Pub/Sub topic configurations should be written.
+     * It is either fetched from the workspace configuration, or the default value is used.
+     *
+     * @param context The {@link WorkspaceContext}.
+     * @returns The path to the directory where topic configurations should be written.
+     */
+    private getConfigurationsDirectory;
+    _call(context: WorkspaceContext): Promise<ProcessorResult>;
+    _supports(): boolean;
+}

package/dist/functions/google-pubsub-write-topics.js

@@ -0,0 +1,80 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { WorkspaceFunction, } from '@causa/workspace';
+import { EventTopicList, } from '@causa/workspace-core';
+import { CAUSA_FOLDER } from '@causa/workspace/initialization';
+import { AllowMissing } from '@causa/workspace/validation';
+import { IsBoolean } from 'class-validator';
+import { mkdir, rm, writeFile } from 'fs/promises';
+import { join } from 'path';
+/**
+ * The default directory where Pub/Sub topic configurations are written, relative to the workspace root.
+ */
+const DEFAULT_TOPIC_CONFIGURATIONS_DIRECTORY = join(CAUSA_FOLDER, 'pubsub-topics');
+/**
+ * A function that uses {@link EventTopicList} to find all the topics in the workspace, and writes their configurations
+ * to a directory.
+ * The `google.pubSub.topicConfigurationsDirectory` configuration can be used to specify the output location of the
+ * topic configurations.
+ * This function returns a partial configuration, such that it can be used as a processor.
+ */
+export class GooglePubSubWriteTopics extends WorkspaceFunction {
+    tearDown;
+    /**
+     * Returns the path to the directory where Pub/Sub topic configurations should be written.
+     * It is either fetched from the workspace configuration, or the default value is used.
+     *
+     * @param context The {@link WorkspaceContext}.
+     * @returns The path to the directory where topic configurations should be written.
+     */
+    getConfigurationsDirectory(context) {
+        return (context
+            .asConfiguration()
+            .get('google.pubSub.topicConfigurationsDirectory') ??
+            DEFAULT_TOPIC_CONFIGURATIONS_DIRECTORY);
+    }
+    async _call(context) {
+        const topicConfigurationsDirectory = this.getConfigurationsDirectory(context);
+        const absoluteDir = join(context.rootPath, topicConfigurationsDirectory);
+        await rm(absoluteDir, { recursive: true, force: true });
+        if (this.tearDown) {
+            context.logger.debug(`📫 Tore down Pub/Sub topic configurations directory '${absoluteDir}'.`);
+            return { configuration: {} };
+        }
+        context.logger.info('️📫 Listing and writing Pub/Sub topic configurations.');
+        const topics = await context.call(EventTopicList, {});
+        context.logger.debug(`📫 Writing configurations for Pub/Sub topics: ${topics
+            .map((d) => `'${d.id}'`)
+            .join(', ')}.`);
+        await mkdir(absoluteDir, { recursive: true });
+        await Promise.all(topics.map(async (topic) => {
+            const topicConfiguration = {
+                ...topic,
+                bigQueryTableName: topic.id.replace(/[-\.]/g, '_'),
+            };
+            const topicFile = join(absoluteDir, `${topic.id}.json`);
+            await writeFile(topicFile, JSON.stringify(topicConfiguration));
+        }));
+        context.logger.debug(`️📫 Wrote Pub/Sub topic configurations in '${absoluteDir}'.`);
+        return {
+            configuration: {
+                google: { pubSub: { topicConfigurationsDirectory } },
+            },
+        };
+    }
+    _supports() {
+        return true;
+    }
+}
+__decorate([
+    IsBoolean(),
+    AllowMissing(),
+    __metadata("design:type", Boolean)
+], GooglePubSubWriteTopics.prototype, "tearDown", void 0);

package/dist/functions/google-spanner-write-databases.d.ts

@@ -0,0 +1,22 @@
+import { ProcessorResult, WorkspaceContext, WorkspaceFunction } from '@causa/workspace';
+import { InfrastructureProcessor } from '@causa/workspace-core';
+/**
+ * A function that uses {@link GoogleSpannerListDatabases} to find all the Spanner databases in the workspace, and
+ * writes their configurations to a directory.
+ * The `google.spanner.databaseConfigurationsDirectory` configuration can be used to specify the output location of the
+ * database configurations.
+ * This function returns a partial configuration, such that it can be used as a processor.
+ */
+export declare class GoogleSpannerWriteDatabases extends WorkspaceFunction<Promise<ProcessorResult>> implements InfrastructureProcessor {
+    readonly tearDown?: boolean;
+    /**
+     * Returns the path to the directory where Spanner databases configurations should be written.
+     * It is either fetched from the workspace configuration, or the default value is used.
+     *
+     * @param context The {@link WorkspaceContext}.
+     * @returns The path to the directory where database configurations should be written.
+     */
+    private getConfigurationsDirectory;
+    _call(context: WorkspaceContext): Promise<ProcessorResult>;
+    _supports(): boolean;
+}

package/dist/functions/google-spanner-write-databases.js

@@ -0,0 +1,73 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { WorkspaceFunction, } from '@causa/workspace';
+import { CAUSA_FOLDER } from '@causa/workspace/initialization';
+import { AllowMissing } from '@causa/workspace/validation';
+import { IsBoolean } from 'class-validator';
+import { mkdir, rm, writeFile } from 'fs/promises';
+import { join } from 'path';
+import { GoogleSpannerListDatabases } from './google-spanner-list-databases.js';
+/**
+ * The default directory where Spanner database configurations are written, relative to the workspace root.
+ */
+const DEFAULT_DATABASE_CONFIGURATIONS_DIRECTORY = join(CAUSA_FOLDER, 'spanner-databases');
+/**
+ * A function that uses {@link GoogleSpannerListDatabases} to find all the Spanner databases in the workspace, and
+ * writes their configurations to a directory.
+ * The `google.spanner.databaseConfigurationsDirectory` configuration can be used to specify the output location of the
+ * database configurations.
+ * This function returns a partial configuration, such that it can be used as a processor.
+ */
+export class GoogleSpannerWriteDatabases extends WorkspaceFunction {
+    tearDown;
+    /**
+     * Returns the path to the directory where Spanner databases configurations should be written.
+     * It is either fetched from the workspace configuration, or the default value is used.
+     *
+     * @param context The {@link WorkspaceContext}.
+     * @returns The path to the directory where database configurations should be written.
+     */
+    getConfigurationsDirectory(context) {
+        return (context
+            .asConfiguration()
+            .get('google.spanner.databaseConfigurationsDirectory') ??
+            DEFAULT_DATABASE_CONFIGURATIONS_DIRECTORY);
+    }
+    async _call(context) {
+        const databaseConfigurationsDirectory = this.getConfigurationsDirectory(context);
+        const absoluteDir = join(context.rootPath, databaseConfigurationsDirectory);
+        await rm(absoluteDir, { recursive: true, force: true });
+        if (this.tearDown) {
+            context.logger.debug(`️🗃️ Tore down Spanner database configurations directory '${absoluteDir}'.`);
+            return { configuration: {} };
+        }
+        context.logger.info('🗃️ Listing and writing Spanner database configurations.');
+        const databases = await context.call(GoogleSpannerListDatabases, {});
+        await mkdir(absoluteDir, { recursive: true });
+        context.logger.debug(`🗃️ Writing configurations for Spanner databases: ${databases
+            .map((d) => `'${d.id}'`)
+            .join(', ')}.`);
+        await Promise.all(databases.map((database) => writeFile(join(absoluteDir, `${database.id}.json`), JSON.stringify(database))));
+        context.logger.debug(`🗃️ Wrote Spanner database configurations in '${absoluteDir}'.`);
+        return {
+            configuration: {
+                google: { spanner: { databaseConfigurationsDirectory } },
+            },
+        };
+    }
+    _supports() {
+        return true;
+    }
+}
+__decorate([
+    IsBoolean(),
+    AllowMissing(),
+    __metadata("design:type", Boolean)
+], GoogleSpannerWriteDatabases.prototype, "tearDown", void 0);

package/dist/functions/index.js

@@ -13,12 +13,14 @@ import { GoogleFirebaseStorageMergeRules } from './google-firebase-storage-merge
 import { GoogleFirestoreMergeRules } from './google-firestore-merge-rules.js';
 import { GoogleIdentityPlatformGenerateCustomToken } from './google-identity-platform-generate-custom-token.js';
 import { GoogleIdentityPlatformGenerateToken } from './google-identity-platform-generate-token.js';
+import { GooglePubSubWriteTopics } from './google-pubsub-write-topics.js';
 import { GoogleServicesEnable } from './google-services-enable.js';
 import { GoogleSpannerListDatabases } from './google-spanner-list-databases.js';
+import { GoogleSpannerWriteDatabases } from './google-spanner-write-databases.js';
 import { ProjectGetArtefactDestinationForCloudFunctions } from './project-get-artefact-destination-cloud-functions.js';
 import { ProjectGetArtefactDestinationForCloudRun } from './project-get-artefact-destination-cloud-run.js';
 import { ProjectPushArtefactForCloudFunctions } from './project-push-artefact-cloud-functions.js';
 import { SecretFetchForGoogleSecretManager } from './secret-fetch-secret-manager.js';
 export function registerFunctions(context) {
-    context.registerFunctionImplementations(EmulatorStartForFirebaseStorage, EmulatorStartForFirestore, EmulatorStartForIdentityPlatform, EmulatorStartForPubSub, EmulatorStartForSpanner, EmulatorStopForFirebaseStorage, EmulatorStopForFirestore, EmulatorStopForIdentityPlatform, EmulatorStopForPubSub, EmulatorStopForSpanner, GoogleAppCheckGenerateToken, GoogleFirebaseStorageMergeRules, GoogleFirestoreMergeRules, GoogleIdentityPlatformGenerateCustomToken, GoogleIdentityPlatformGenerateToken, GoogleServicesEnable, GoogleSpannerListDatabases, ProjectGetArtefactDestinationForCloudFunctions, ProjectGetArtefactDestinationForCloudRun, ProjectPushArtefactForCloudFunctions, SecretFetchForGoogleSecretManager);
+    context.registerFunctionImplementations(EmulatorStartForFirebaseStorage, EmulatorStartForFirestore, EmulatorStartForIdentityPlatform, EmulatorStartForPubSub, EmulatorStartForSpanner, EmulatorStopForFirebaseStorage, EmulatorStopForFirestore, EmulatorStopForIdentityPlatform, EmulatorStopForPubSub, EmulatorStopForSpanner, GoogleAppCheckGenerateToken, GoogleFirebaseStorageMergeRules, GoogleFirestoreMergeRules, GoogleIdentityPlatformGenerateCustomToken, GoogleIdentityPlatformGenerateToken, GooglePubSubWriteTopics, GoogleServicesEnable, GoogleSpannerListDatabases, GoogleSpannerWriteDatabases, ProjectGetArtefactDestinationForCloudFunctions, ProjectGetArtefactDestinationForCloudRun, ProjectPushArtefactForCloudFunctions, SecretFetchForGoogleSecretManager);
 }

package/dist/functions/project-get-artefact-destination-cloud-functions.js

@@ -7,7 +7,9 @@ import { ProjectGetArtefactDestination, } from '@causa/workspace-core';
 export class ProjectGetArtefactDestinationForCloudFunctions extends ProjectGetArtefactDestination {
     async _call(context) {
         const projectName = context.getOrThrow('project.name');
-        const archivesStorageLocation = context.getOrThrow('google.cloudFunctions.archivesStorageLocation');
+        const archivesStorageLocation = context
+            .asConfiguration()
+            .getOrThrow('google.cloudFunctions.archivesStorageLocation');
         return `${archivesStorageLocation}/${projectName}/${this.tag}.zip`;
     }
     _supports(context) {

package/dist/functions/project-get-artefact-destination-cloud-run.js

@@ -6,7 +6,9 @@ import { ProjectGetArtefactDestination, } from '@causa/workspace-core';
 export class ProjectGetArtefactDestinationForCloudRun extends ProjectGetArtefactDestination {
     async _call(context) {
         const projectName = context.getOrThrow('project.name');
-        const dockerRepository = context.getOrThrow('google.cloudRun.dockerRepository');
+        const dockerRepository = context
+            .asConfiguration()
+            .getOrThrow('google.cloudRun.dockerRepository');
         return `${dockerRepository}/${projectName}:${this.tag}`;
     }
     _supports(context) {

package/dist/services/secret-manager.js

@@ -13,9 +13,9 @@ export class GoogleSecretManagerService {
      */
     client;
     constructor(context) {
+        const conf = context.asConfiguration();
         this.defaultProject =
-            context.get('google.secretManager.project') ??
-                context.get('google.project');
+            conf.get('google.secretManager.project') ?? conf.get('google.project');
         this.client = new SecretManagerServiceClient();
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@causa/workspace-google",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "The Causa workspace module providing many functionalities related to GCP and its services.",
   "repository": "github:causa-io/workspace-module-google",
   "license": "ISC",
@@ -29,38 +29,39 @@
     "test:cov": "npm run test -- --coverage"
   },
   "dependencies": {
-    "@causa/cli": ">= 0.3.3 < 1.0.0",
-    "@causa/workspace": ">= 0.7.0 < 1.0.0",
-    "@causa/workspace-core": ">= 0.6.0 < 1.0.0",
+    "@causa/cli": ">= 0.4.0 < 1.0.0",
+    "@causa/workspace": ">= 0.12.0 < 1.0.0",
+    "@causa/workspace-core": ">= 0.8.0 < 1.0.0",
     "@google-cloud/apikeys": "^0.2.2",
     "@google-cloud/iam-credentials": "^2.0.4",
-    "@google-cloud/pubsub": "^3.7.0",
+    "@google-cloud/pubsub": "^3.7.3",
     "@google-cloud/secret-manager": "^4.2.2",
     "@google-cloud/service-usage": "^2.2.2",
-    "@google-cloud/spanner": "^6.10.1",
-    "@google-cloud/storage": "^6.10.1",
+    "@google-cloud/spanner": "^6.14.0",
+    "@google-cloud/storage": "^6.12.0",
+    "@grpc/grpc-js": "^1.8.20",
     "class-validator": "^0.14.0",
-    "firebase": "^9.22.1",
-    "firebase-admin": "^11.9.0",
-    "globby": "^13.1.4",
-    "google-gax": "^3.6.0",
-    "googleapis": "^118.0.0",
+    "firebase": "^10.1.0",
+    "firebase-admin": "^11.10.1",
+    "globby": "^13.2.2",
+    "googleapis": "^123.0.0",
     "uuid": "^9.0.0"
   },
   "devDependencies": {
-    "@tsconfig/node18": "^2.0.1",
-    "@types/jest": "^29.5.2",
-    "@types/node": "^18.16.16",
-    "@types/uuid": "^9.0.1",
+    "@tsconfig/node18": "^18.2.0",
+    "@types/jest": "^29.5.3",
+    "@types/node": "^18.17.1",
+    "@types/uuid": "^9.0.2",
+    "@typescript-eslint/eslint-plugin": "^6.2.0",
     "copyfiles": "^2.4.1",
-    "eslint": "^8.41.0",
+    "eslint": "^8.45.0",
     "eslint-config-prettier": "^8.8.0",
-    "eslint-plugin-prettier": "^4.2.1",
-    "jest": "^29.5.0",
-    "jest-extended": "^3.2.4",
+    "eslint-plugin-prettier": "^5.0.0",
+    "jest": "^29.6.1",
+    "jest-extended": "^4.0.0",
     "rimraf": "^5.0.1",
-    "ts-jest": "^29.1.0",
+    "ts-jest": "^29.1.1",
     "ts-node": "^10.9.1",
-    "typescript": "^5.1.3"
+    "typescript": "^5.1.6"
   }
 }