@cloudcommerce/cli 0.0.50 → 0.0.53

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
-@cloudcommerce/cli:build: cache hit, replaying output 03aaa3a4a2c72327
-@cloudcommerce/cli:build: 
-@cloudcommerce/cli:build: > @cloudcommerce/cli@0.0.49 build /home/leo/code/ecomplus/cloud-commerce/packages/cli
-@cloudcommerce/cli:build: > sh ../../scripts/build-lib.sh
-@cloudcommerce/cli:build: 
+@cloudcommerce/cli:build: cache hit, replaying output cc4c7d1f235b43da
+@cloudcommerce/cli:build: 
+@cloudcommerce/cli:build: > @cloudcommerce/cli@0.0.52 build /home/leo/code/ecomplus/cloud-commerce/packages/cli
+@cloudcommerce/cli:build: > sh ../../scripts/build-lib.sh
+@cloudcommerce/cli:build: 

package/config/firebase.json

@@ -36,7 +36,22 @@
       "firebase.json",
       "**/.*",
       "**/node_modules/**"
-    ]
+    ],
+    "rewrites": [
+      {
+        "source": "/api/modules/**",
+        "function": "modules"
+      },
+      {
+        "source": "/api/passport/**",
+        "function": "passport"
+      },
+      {
+        "source": "**/!(*(*.)js|*(*.)css|*(*.)ico|*(*.)png|*(*.)gif|*(*.)jpg|*(*.)jpeg|*(*.)webp|*(*.)avif|*(*.)svg|*(*.)woff|*(*.)woff2|*(*.)otf|*(*.)ttf|*(*.)eot)",
+        "function": "ssr"
+      }
+    ],
+    "cleanUrls": true
   },
   "storage": {
     "rules": "storage.rules"

package/lib/config-gcloud.js

@@ -0,0 +1,94 @@
+import path from 'path';
+import { $, fs } from 'zx';
+
+const serviceAccountId = 'cloud-commerce-gh-actions';
+const getAccountEmail = (projectId) => {
+  return `${serviceAccountId}@${projectId}.iam.gserviceaccount.com`;
+};
+const checkServiceAccountExists = async (projectId) => {
+  let hasServiceAccount;
+  try {
+    const { stderr } = await $`gcloud iam service-accounts describe ${getAccountEmail(projectId)}`;
+    hasServiceAccount = !/not_?found/i.test(stderr);
+  } catch (e) {
+    return null;
+  }
+  return hasServiceAccount;
+};
+const siginGcloudAndSetIAM = async (projectId, pwd) => {
+  if (/no credential/i.test((await $`gcloud auth list`).stderr)) {
+    await $`gcloud auth login`;
+  }
+  await $`gcloud config set project ${projectId}`;
+  const roles = [
+    'roles/firebase.admin',
+    'roles/appengine.appAdmin',
+    'roles/appengine.appCreator',
+    'roles/artifactregistry.admin',
+    'roles/cloudfunctions.admin',
+    'roles/cloudscheduler.admin',
+    'roles/iam.serviceAccountUser',
+    'roles/run.viewer',
+    'roles/serviceusage.apiKeysViewer',
+    'roles/serviceusage.serviceUsageAdmin',
+  ];
+  const serviceAccount = await checkServiceAccountExists(projectId);
+  if (!serviceAccount) {
+    await $`gcloud iam service-accounts create ${serviceAccountId} \
+      --description="A service account with permission to deploy Cloud Commerce from the GitHub repository to Firebase" \
+      --display-name="Cloud Commerce GH Actions"`;
+  }
+  await fs.ensureDir(path.join(pwd, '.cloudcommerce'));
+  const pathPolicyIAM = path.join(pwd, '.cloudcommerce', 'policyIAM.json');
+  await $`gcloud projects get-iam-policy ${projectId} --format json > ${pathPolicyIAM}`;
+  const policyIAM = fs.readJSONSync(pathPolicyIAM);
+  const { bindings } = policyIAM;
+  let mustUpdatePolicy = false;
+  roles.forEach((role) => {
+    const roleFound = bindings.find((binding) => binding.role === role);
+    const memberServiceAccount = `serviceAccount:${getAccountEmail(projectId)}`;
+    if (!roleFound) {
+      const newBinding = {
+        members: [
+          memberServiceAccount,
+        ],
+        role,
+      };
+      if (role === 'roles/serviceusage.serviceUsageAdmin') {
+        const roleExpiration = Date.now() + 1000 * 60 * 60 * 12;
+        newBinding.condition = {
+          expression: `request.time < timestamp("${new Date(roleExpiration).toISOString()}")`,
+          title: 'Enable APIs on first deploy',
+          description: null,
+        };
+      }
+      bindings.push(newBinding);
+      mustUpdatePolicy = true;
+    } else {
+      const serviceAccountHavePermission = roleFound.members.find((account) => account === memberServiceAccount);
+      if (!serviceAccountHavePermission) {
+        roleFound.members.push(memberServiceAccount);
+        mustUpdatePolicy = true;
+      }
+    }
+  });
+  if (mustUpdatePolicy) {
+    fs.writeJSONSync(pathPolicyIAM, policyIAM);
+    return $`gcloud projects set-iam-policy ${projectId} ${pathPolicyIAM}`;
+  }
+  return null;
+};
+const createKeyServiceAccount = async (projectId, pwd) => {
+  try {
+    const pathFileKey = path.join(pwd, '.cloudcommerce', 'serviceAccountKey.json');
+    await $`gcloud iam service-accounts keys create ${pathFileKey} \
+      --iam-account=${getAccountEmail(projectId)}`;
+    return JSON.stringify(fs.readJSONSync(pathFileKey));
+  } catch (e) {
+    return null;
+  }
+};
+
+export default siginGcloudAndSetIAM;
+
+export { siginGcloudAndSetIAM, createKeyServiceAccount };

package/lib/create-auth.js

@@ -26,15 +26,15 @@ export default async (storeId, accessToken) => {
       username: `cloudcomm${Date.now()}`,
       permissions: {
         applications: ['all'],
-        brands: ['GET'],
-        carts: ['all'],
-        categories: ['GET'],
-        collections: ['GET'],
+        brands: ['all'],
+        categories: ['all'],
+        collections: ['all'],
+        grids: ['all'],
+        products: ['all'],
         customers: ['all'],
-        grids: ['GET'],
+        carts: ['all'],
         orders: ['GET', 'POST', 'PATCH'],
-        products: ['GET', 'PATCH'],
-        stores: ['GET'],
+        stores: ['GET', 'PATCH'],
       },
     }, apiConfig);
     authenticationId = _id;

package/lib/index.js

@@ -5,6 +5,7 @@ import {
 } from 'zx';
 import login from './login.js';
 import build from './build.js';
+import { siginGcloudAndSetIAM, createKeyServiceAccount } from './config-gcloud.js';
 
 const { FIREBASE_PROJECT_ID, GOOGLE_APPLICATION_CREDENTIALS } = process.env;
 const __dirname = url.fileURLToPath(new URL('.', import.meta.url));
@@ -28,7 +29,7 @@ if (projectId) {
       const firebaserc = fs.readJSONSync(path.join(pwd, '.firebaserc'));
       projectId = firebaserc.projects.default;
     } catch (e) {
-      projectId = 'ecom2-hello';
+      projectId = 'ecom2-001';
     }
   }
 }
@@ -36,13 +37,16 @@ if (projectId) {
 export default async () => {
   await fs.copy(path.join(__dirname, '..', 'config'), pwd);
   const options = Object.keys(argv).reduce((opts, key) => {
-    if (key !== '_' && key !== 'deploy' && key !== 'commit') {
+    if (key !== '_' && argv[key] !== false) {
       // eslint-disable-next-line no-param-reassign
       opts += ` --${key} ${argv[key]}`;
     }
     return opts;
   }, '');
   const $firebase = (cmd) => {
+    if (cmd === 'deploy') {
+      return $`firebase --project=${projectId} ${cmd}${options} --force`;
+    }
     return $`firebase --project=${projectId} ${cmd}${options}`;
   };
   if (argv._.includes('serve')) {
@@ -94,6 +98,15 @@ ECOM_STORE_ID=${storeId}
         //
       }
     }
+    let serviceAccountJSON = null;
+    if (argv.gcloud !== false) {
+      try {
+        await siginGcloudAndSetIAM(projectId, pwd);
+        serviceAccountJSON = await createKeyServiceAccount(projectId, pwd);
+      } catch (e) {
+        //
+      }
+    }
     return echo`
     ****
 
@@ -103,7 +116,7 @@ Finish by saving the following secrets to your GitHub repository:
 
   ${chalk.bold('ECOM_API_KEY')} = ${chalk.bgMagenta(apiKey)}
 
-  ${chalk.bold('FIREBASE_SERVICE_ACCOUNT')} = {YOUR_SERVICE_ACCOUNT_JSON}
+  ${chalk.bold('FIREBASE_SERVICE_ACCOUNT')} = ${chalk.bgMagenta(serviceAccountJSON || '{YOUR_SERVICE_ACCOUNT_JSON}')}
 
 -- More info at https://github.com/ecomplus/store#getting-started
 `;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cloudcommerce/cli",
   "type": "module",
-  "version": "0.0.50",
+  "version": "0.0.53",
   "description": "E-Com Plus Cloud Commerce CLI tools",
   "bin": {
     "cloudcommerce": "./bin/run.mjs"
@@ -23,9 +23,9 @@
   },
   "homepage": "https://github.com/ecomplus/cloud-commerce/tree/main/packages/cli#readme",
   "dependencies": {
-    "@cloudcommerce/api": "0.0.50",
+    "@cloudcommerce/api": "0.0.53",
     "md5": "^2.3.0",
-    "zx": "^7.0.7"
+    "zx": "^7.0.8"
   },
   "scripts": {
     "build": "sh ../../scripts/build-lib.sh"

package/src/config-gcloud.ts

@@ -0,0 +1,103 @@
+import path from 'path';
+import { $, fs } from 'zx';
+
+const serviceAccountId = 'cloud-commerce-gh-actions';
+const getAccountEmail = (projectId: string) => {
+  return `${serviceAccountId}@${projectId}.iam.gserviceaccount.com`;
+};
+
+const checkServiceAccountExists = async (projectId: string) => {
+  let hasServiceAccount: boolean;
+  try {
+    const { stderr } = await $`gcloud iam service-accounts describe ${getAccountEmail(projectId)}`;
+    hasServiceAccount = !/not_?found/i.test(stderr);
+  } catch (e) {
+    return null;
+  }
+  return hasServiceAccount;
+};
+
+const siginGcloudAndSetIAM = async (projectId: string, pwd: string) => {
+  if (/no credential/i.test((await $`gcloud auth list`).stderr)) {
+    await $`gcloud auth login`;
+  }
+  await $`gcloud config set project ${projectId}`;
+  const roles = [
+    'roles/firebase.admin',
+    'roles/appengine.appAdmin',
+    'roles/appengine.appCreator',
+    'roles/artifactregistry.admin',
+    'roles/cloudfunctions.admin',
+    'roles/cloudscheduler.admin',
+    'roles/iam.serviceAccountUser',
+    'roles/run.viewer',
+    'roles/serviceusage.apiKeysViewer',
+    'roles/serviceusage.serviceUsageAdmin',
+  ];
+  const serviceAccount = await checkServiceAccountExists(projectId);
+  if (!serviceAccount) {
+    await $`gcloud iam service-accounts create ${serviceAccountId} \
+      --description="A service account with permission to deploy Cloud Commerce from the GitHub repository to Firebase" \
+      --display-name="Cloud Commerce GH Actions"`;
+  }
+  await fs.ensureDir(path.join(pwd, '.cloudcommerce'));
+  const pathPolicyIAM = path.join(pwd, '.cloudcommerce', 'policyIAM.json');
+  await $`gcloud projects get-iam-policy ${projectId} --format json > ${pathPolicyIAM}`;
+  const policyIAM = fs.readJSONSync(pathPolicyIAM);
+  const { bindings } = policyIAM;
+
+  let mustUpdatePolicy = false;
+  roles.forEach((role) => {
+    const roleFound = bindings.find((binding) => binding.role === role);
+    const memberServiceAccount = `serviceAccount:${getAccountEmail(projectId)}`;
+    if (!roleFound) {
+      const newBinding: { [key: string]: any } = {
+        members: [
+          memberServiceAccount,
+        ],
+        role,
+      };
+      if (role === 'roles/serviceusage.serviceUsageAdmin') {
+        const roleExpiration = Date.now() + 1000 * 60 * 60 * 12;
+        newBinding.condition = {
+          expression: `request.time < timestamp("${new Date(roleExpiration).toISOString()}")`,
+          title: 'Enable APIs on first deploy',
+          description: null,
+        };
+      }
+      bindings.push(newBinding);
+      mustUpdatePolicy = true;
+    } else {
+      const serviceAccountHavePermission = roleFound.members.find(
+        (account: string) => account === memberServiceAccount,
+      );
+      if (!serviceAccountHavePermission) {
+        roleFound.members.push(memberServiceAccount);
+        mustUpdatePolicy = true;
+      }
+    }
+  });
+  if (mustUpdatePolicy) {
+    fs.writeJSONSync(pathPolicyIAM, policyIAM);
+    return $`gcloud projects set-iam-policy ${projectId} ${pathPolicyIAM}`;
+  }
+  return null;
+};
+
+const createKeyServiceAccount = async (projectId: string, pwd: string) => {
+  try {
+    const pathFileKey = path.join(pwd, '.cloudcommerce', 'serviceAccountKey.json');
+    await $`gcloud iam service-accounts keys create ${pathFileKey} \
+      --iam-account=${getAccountEmail(projectId)}`;
+    return JSON.stringify(fs.readJSONSync(pathFileKey));
+  } catch (e) {
+    return null;
+  }
+};
+
+export default siginGcloudAndSetIAM;
+
+export {
+  siginGcloudAndSetIAM,
+  createKeyServiceAccount,
+};

package/src/create-auth.ts

@@ -27,15 +27,15 @@ export default async (storeId: number, accessToken: string) => {
       username: `cloudcomm${Date.now()}`,
       permissions: {
         applications: ['all'],
-        brands: ['GET'],
-        carts: ['all'],
-        categories: ['GET'],
-        collections: ['GET'],
+        brands: ['all'],
+        categories: ['all'],
+        collections: ['all'],
+        grids: ['all'],
+        products: ['all'],
         customers: ['all'],
-        grids: ['GET'],
+        carts: ['all'],
         orders: ['GET', 'POST', 'PATCH'],
-        products: ['GET', 'PATCH'],
-        stores: ['GET'],
+        stores: ['GET', 'PATCH'],
       },
     }, apiConfig);
     authenticationId = _id;

package/src/index.ts

@@ -9,6 +9,7 @@ import {
 } from 'zx';
 import login from './login';
 import build from './build';
+import { siginGcloudAndSetIAM, createKeyServiceAccount } from './config-gcloud';
 
 const {
   FIREBASE_PROJECT_ID,
@@ -40,7 +41,7 @@ if (projectId) {
       const firebaserc = fs.readJSONSync(path.join(pwd, '.firebaserc'));
       projectId = firebaserc.projects.default;
     } catch (e) {
-      projectId = 'ecom2-hello';
+      projectId = 'ecom2-001';
     }
   }
 }
@@ -49,13 +50,16 @@ export default async () => {
   await fs.copy(path.join(__dirname, '..', 'config'), pwd);
 
   const options = Object.keys(argv).reduce((opts, key) => {
-    if (key !== '_' && key !== 'deploy' && key !== 'commit') {
+    if (key !== '_' && argv[key] !== false) {
       // eslint-disable-next-line no-param-reassign
       opts += ` --${key} ${argv[key]}`;
     }
     return opts;
   }, '');
   const $firebase = (cmd: string) => {
+    if (cmd === 'deploy') {
+      return $`firebase --project=${projectId} ${cmd}${options} --force`;
+    }
     return $`firebase --project=${projectId} ${cmd}${options}`;
   };
 
@@ -116,6 +120,16 @@ ECOM_STORE_ID=${storeId}
         //
       }
     }
+    let serviceAccountJSON : string | null = null;
+    if (argv.gcloud !== false) {
+      try {
+        await siginGcloudAndSetIAM(projectId as string, pwd);
+        serviceAccountJSON = await createKeyServiceAccount(projectId as string, pwd);
+      } catch (e) {
+        //
+      }
+    }
+
     return echo`
     ****
 
@@ -125,11 +139,10 @@ Finish by saving the following secrets to your GitHub repository:
 
   ${chalk.bold('ECOM_API_KEY')} = ${chalk.bgMagenta(apiKey)}
 
-  ${chalk.bold('FIREBASE_SERVICE_ACCOUNT')} = {YOUR_SERVICE_ACCOUNT_JSON}
+  ${chalk.bold('FIREBASE_SERVICE_ACCOUNT')} = ${chalk.bgMagenta(serviceAccountJSON || '{YOUR_SERVICE_ACCOUNT_JSON}')}
 
 -- More info at https://github.com/ecomplus/store#getting-started
 `;
   }
-
   return $`echo 'Hello from @cloudcommerce/cli'`;
 };