@causa/workspace-google 0.3.1 → 0.5.0

package/dist/services/iam.js

@@ -0,0 +1,65 @@
+import { GoogleApisService } from './google-apis.js';
+/**
+ * A service for interacting with the IAM API.
+ */
+export class IamService {
+    /**
+     * The underlying {@link GoogleApisService} used to get the IAM client.
+     */
+    googleApisService;
+    /**
+     * A promise that resolves to the singleton IAM client.
+     */
+    iam;
+    constructor(context) {
+        this.googleApisService = context.service(GoogleApisService);
+    }
+    /**
+     * Gets or creates the singleton IAM client.
+     *
+     * @returns The singleton IAM client.
+     */
+    async getIam() {
+        if (!this.iam) {
+            this.iam = this.googleApisService.getClient('iam', 'v1', {});
+        }
+        return await this.iam;
+    }
+    /**
+     * Creates a service account, optionally setting the IAM policy bindings for it.
+     *
+     * @param projectId The ID of the project in which to create the service account.
+     * @param accountId The ID of the service account to create.
+     * @param options Additional options when creating the account.
+     * @returns The created service account.
+     */
+    async createServiceAccount(projectId, accountId, options = {}) {
+        const iam = await this.getIam();
+        const { data: serviceAccount } = await iam.projects.serviceAccounts.create({
+            name: `projects/${projectId}`,
+            requestBody: { accountId },
+        });
+        if (options.bindings) {
+            const resource = serviceAccount.name ?? '';
+            const { data: policy } = await iam.projects.serviceAccounts.getIamPolicy({
+                resource,
+            });
+            policy.bindings = [...(policy.bindings ?? []), ...options.bindings];
+            await iam.projects.serviceAccounts.setIamPolicy({
+                resource,
+                requestBody: { policy },
+            });
+        }
+        return serviceAccount;
+    }
+    /**
+     * Deletes a service account.
+     *
+     * @param name The full resource name of the service account to delete, in the format
+     *   `projects/<projectId>/serviceAccounts/<accountId>`.
+     */
+    async deleteServiceAccount(name) {
+        const iam = await this.getIam();
+        await iam.projects.serviceAccounts.delete({ name });
+    }
+}

package/dist/services/index.d.ts

@@ -1,8 +1,14 @@
+export { BigQueryService } from './bigquery.js';
+export { CloudRunPubSubTriggerService } from './cloud-run-pubsub-trigger.js';
+export { CloudRunService } from './cloud-run.js';
 export * from './firebase-app.errors.js';
 export { FirebaseAppService, FirebaseAppType } from './firebase-app.js';
 export { FirebaseEmulatorService } from './firebase-emulator.js';
 export { GcloudEmulatorService } from './gcloud-emulator.js';
 export { GoogleApisService } from './google-apis.js';
+export { IamService } from './iam.js';
+export { PubSubService } from './pubsub.js';
+export { ResourceManagerService } from './resource-manager.js';
 export { GoogleSecretManagerService } from './secret-manager.js';
 export * from './storage.errors.js';
 export { CloudStorageService } from './storage.js';

package/dist/services/index.js

@@ -1,8 +1,14 @@
+export { BigQueryService } from './bigquery.js';
+export { CloudRunPubSubTriggerService } from './cloud-run-pubsub-trigger.js';
+export { CloudRunService } from './cloud-run.js';
 export * from './firebase-app.errors.js';
 export { FirebaseAppService } from './firebase-app.js';
 export { FirebaseEmulatorService } from './firebase-emulator.js';
 export { GcloudEmulatorService } from './gcloud-emulator.js';
 export { GoogleApisService } from './google-apis.js';
+export { IamService } from './iam.js';
+export { PubSubService } from './pubsub.js';
+export { ResourceManagerService } from './resource-manager.js';
 export { GoogleSecretManagerService } from './secret-manager.js';
 export * from './storage.errors.js';
 export { CloudStorageService } from './storage.js';

package/dist/services/pubsub.d.ts

@@ -0,0 +1,41 @@
+import { WorkspaceContext } from '@causa/workspace';
+import { PubSub } from '@google-cloud/pubsub';
+import { iam_v1 } from 'googleapis';
+/**
+ * A service for managing Pub/Sub resources
+ */
+export declare class PubSubService {
+    /**
+     * The Pub/Sub client.
+     */
+    readonly pubSub: PubSub;
+    /**
+     * The resource manager service used to get the project number.
+     */
+    private readonly resourceManagerService;
+    /**
+     * The ID of the GCP project in which to create Pub/Sub resources.
+     */
+    readonly projectId: string;
+    constructor(context: WorkspaceContext);
+    /**
+     * The cached promise that resolves to the GCP service account used by Pub/Sub.
+     */
+    private gcpServiceAccountPromise;
+    /**
+     * Constructs the email of the GCP-owned service account used by Pub/Sub.
+     * This can be used to grant roles to the service account, e.g. for push subscriptions.
+     *
+     * @returns The email of the GCP service account used by Pub/Sub.
+     */
+    getGcpServiceAccount(): Promise<string>;
+    /**
+     * Constructs the IAM policy bindings that should be added to a service account meant to be used by push
+     * subscriptions.
+     * Those bindings allow the GCP-owned Pub/Sub service account to authenticate as the service account when pushing
+     * messages.
+     *
+     * @returns The bindings.
+     */
+    getPushServiceAccountBindings(): Promise<iam_v1.Schema$Binding[]>;
+}

package/dist/services/pubsub.js

@@ -0,0 +1,62 @@
+import { PubSub } from '@google-cloud/pubsub';
+import { ResourceManagerService } from './resource-manager.js';
+/**
+ * A service for managing Pub/Sub resources
+ */
+export class PubSubService {
+    /**
+     * The Pub/Sub client.
+     */
+    pubSub;
+    /**
+     * The resource manager service used to get the project number.
+     */
+    resourceManagerService;
+    /**
+     * The ID of the GCP project in which to create Pub/Sub resources.
+     */
+    projectId;
+    constructor(context) {
+        this.pubSub = new PubSub();
+        this.resourceManagerService = context.service(ResourceManagerService);
+        this.projectId = context
+            .asConfiguration()
+            .getOrThrow('google.project');
+    }
+    /**
+     * The cached promise that resolves to the GCP service account used by Pub/Sub.
+     */
+    gcpServiceAccountPromise;
+    /**
+     * Constructs the email of the GCP-owned service account used by Pub/Sub.
+     * This can be used to grant roles to the service account, e.g. for push subscriptions.
+     *
+     * @returns The email of the GCP service account used by Pub/Sub.
+     */
+    async getGcpServiceAccount() {
+        if (!this.gcpServiceAccountPromise) {
+            this.gcpServiceAccountPromise = (async () => {
+                const projectNumber = await this.resourceManagerService.getProjectNumber(this.projectId);
+                return `service-${projectNumber}@gcp-sa-pubsub.iam.gserviceaccount.com`;
+            })();
+        }
+        return await this.gcpServiceAccountPromise;
+    }
+    /**
+     * Constructs the IAM policy bindings that should be added to a service account meant to be used by push
+     * subscriptions.
+     * Those bindings allow the GCP-owned Pub/Sub service account to authenticate as the service account when pushing
+     * messages.
+     *
+     * @returns The bindings.
+     */
+    async getPushServiceAccountBindings() {
+        const pubSubGcpServiceAccount = await this.getGcpServiceAccount();
+        return [
+            {
+                role: 'roles/iam.serviceAccountTokenCreator',
+                members: [`serviceAccount:${pubSubGcpServiceAccount}`],
+            },
+        ];
+    }
+}

package/dist/services/resource-manager.d.ts

@@ -0,0 +1,18 @@
+import { ProjectsClient } from '@google-cloud/resource-manager';
+/**
+ * A service for interacting with the GCP Resource Manager API, handling organizations, folders, and projects.
+ */
+export declare class ResourceManagerService {
+    /**
+     * The client used to manage GCP projects.
+     */
+    readonly projectsClient: ProjectsClient;
+    constructor();
+    /**
+     * Retrieves the project number for a given GCP project ID.
+     *
+     * @param projectId The ID of the GCP project.
+     * @returns The number of the GCP project.
+     */
+    getProjectNumber(projectId: string): Promise<string>;
+}

package/dist/services/resource-manager.js

@@ -0,0 +1,35 @@
+import { ProjectsClient } from '@google-cloud/resource-manager';
+/**
+ * A service for interacting with the GCP Resource Manager API, handling organizations, folders, and projects.
+ */
+export class ResourceManagerService {
+    /**
+     * The client used to manage GCP projects.
+     */
+    projectsClient;
+    constructor() {
+        this.projectsClient = new ProjectsClient();
+    }
+    /**
+     * Retrieves the project number for a given GCP project ID.
+     *
+     * @param projectId The ID of the GCP project.
+     * @returns The number of the GCP project.
+     */
+    async getProjectNumber(projectId) {
+        const [projects] = await this.projectsClient.searchProjects({
+            query: `projectId:${projectId}`,
+            pageSize: 1,
+        });
+        if (projects.length < 1) {
+            throw new Error(`Could not find GCP project '${projectId}'.`);
+        }
+        const [project] = projects;
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        const [projectsConst, projectNumber] = project.name?.split('/') ?? [];
+        if (!projectNumber) {
+            throw new Error(`Failed to parse invalid project name '${project.name}'.`);
+        }
+        return projectNumber;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@causa/workspace-google",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "The Causa workspace module providing many functionalities related to GCP and its services.",
   "repository": "github:causa-io/workspace-module-google",
   "license": "ISC",
@@ -30,38 +30,42 @@
   },
   "dependencies": {
     "@causa/cli": ">= 0.4.0 < 1.0.0",
-    "@causa/workspace": ">= 0.10.0 < 1.0.0",
-    "@causa/workspace-core": ">= 0.7.0 < 1.0.0",
+    "@causa/workspace": ">= 0.12.0 < 1.0.0",
+    "@causa/workspace-core": ">= 0.14.1 < 1.0.0",
     "@google-cloud/apikeys": "^0.2.2",
+    "@google-cloud/bigquery": "^7.1.1",
     "@google-cloud/iam-credentials": "^2.0.4",
-    "@google-cloud/pubsub": "^3.7.1",
+    "@google-cloud/pubsub": "^4.0.0",
+    "@google-cloud/resource-manager": "^4.3.0",
+    "@google-cloud/run": "^0.6.0",
     "@google-cloud/secret-manager": "^4.2.2",
     "@google-cloud/service-usage": "^2.2.2",
-    "@google-cloud/spanner": "^6.11.0",
-    "@google-cloud/storage": "^6.11.0",
+    "@google-cloud/spanner": "^6.15.0",
+    "@google-cloud/storage": "^7.0.0",
+    "@grpc/grpc-js": "~1.8.21",
     "class-validator": "^0.14.0",
-    "firebase": "^9.22.2",
-    "firebase-admin": "^11.9.0",
-    "globby": "^13.1.4",
-    "google-gax": "^3.6.0",
-    "googleapis": "^118.0.0",
+    "firebase": "^10.1.0",
+    "firebase-admin": "^11.10.1",
+    "globby": "^13.2.2",
+    "googleapis": "^123.0.0",
+    "pino": "^8.15.0",
     "uuid": "^9.0.0"
   },
   "devDependencies": {
-    "@tsconfig/node18": "^2.0.1",
-    "@types/jest": "^29.5.2",
-    "@types/node": "^18.16.16",
+    "@tsconfig/node18": "^18.2.0",
+    "@types/jest": "^29.5.3",
+    "@types/node": "^18.17.2",
     "@types/uuid": "^9.0.2",
-    "@typescript-eslint/eslint-plugin": "^5.59.9",
+    "@typescript-eslint/eslint-plugin": "^6.2.1",
     "copyfiles": "^2.4.1",
-    "eslint": "^8.42.0",
-    "eslint-config-prettier": "^8.8.0",
-    "eslint-plugin-prettier": "^4.2.1",
-    "jest": "^29.5.0",
-    "jest-extended": "^4.0.0",
+    "eslint": "^8.46.0",
+    "eslint-config-prettier": "^8.10.0",
+    "eslint-plugin-prettier": "^5.0.0",
+    "jest": "^29.6.2",
+    "jest-extended": "^4.0.1",
     "rimraf": "^5.0.1",
-    "ts-jest": "^29.1.0",
+    "ts-jest": "^29.1.1",
     "ts-node": "^10.9.1",
-    "typescript": "^5.1.3"
+    "typescript": "^5.1.6"
   }
 }