@google-cloud/cloud-run-mcp 1.10.0 → 1.12.0

package/lib/cloud-api/storage.js

@@ -14,9 +14,10 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+import crypto from 'node:crypto';
 import { getStorageClient } from '../clients.js';
 import { callWithRetry } from './helpers.js';
-import { logAndProgress } from '../util/helpers.js';
+import { logAndProgress, getProjectNumber } from '../util/helpers.js';
 
 /**
  * Ensures that a Google Cloud Storage bucket exists.
@@ -25,7 +26,10 @@ import { logAndProgress } from '../util/helpers.js';
  * @async
  * @param {string} projectId - The Google Cloud project ID.
  * @param {string} bucketName - The name of the storage bucket.
- * @param {string} [location='us'] - The location to create the bucket in if it doesn't exist. Defaults to 'us'.
+ * @param {string} [location] - The location to create the bucket in if it doesn't exist.
+ * @param {string} [accessToken] - Optional access token.
+ * @param {Object.<string, string>} [labels] - Optional labels to apply to the bucket.
+ * @param {boolean} [isFallback=false] - Whether this is a fallback attempt (avoids infinite recursion).
  * @param {function(object): void} [progressCallback] - Optional callback for progress updates.
  * @returns {Promise<import('@google-cloud/storage').Bucket>} A promise that resolves with the GCS Bucket object.
  * @throws {Error} If there's an error checking or creating the bucket.
@@ -33,18 +37,73 @@ import { logAndProgress } from '../util/helpers.js';
 export async function ensureStorageBucketExists(
   projectId,
   bucketName,
-  location = 'us',
+  location,
   accessToken,
+  labels,
+  isFallback = false,
   progressCallback
 ) {
   const storage = await getStorageClient(projectId, accessToken);
   const bucket = storage.bucket(bucketName);
   try {
-    const [exists] = await callWithRetry(
-      () => bucket.exists(),
-      `storage.bucket.exists ${bucketName}`
-    );
+    let exists = false;
+    try {
+      const [bucketExists] = await callWithRetry(
+        () => bucket.exists(),
+        `storage.bucket.exists ${bucketName}`
+      );
+      exists = bucketExists;
+    } catch (err) {
+      if (err.code === 403 || err.status === 403 || err.statusCode === 403) {
+        exists = true;
+      } else {
+        throw err;
+      }
+    }
+
     if (exists) {
+      const expectedProjectNumber = await getProjectNumber(
+        projectId,
+        accessToken
+      );
+      let metadata;
+      try {
+        [metadata] = await callWithRetry(
+          () => bucket.getMetadata(),
+          `storage.bucket.getMetadata ${bucketName}`
+        );
+      } catch (metaErr) {
+        metadata = {};
+      }
+
+      if (
+        !expectedProjectNumber ||
+        !metadata.projectNumber ||
+        String(metadata.projectNumber) !== String(expectedProjectNumber)
+      ) {
+        if (!isFallback) {
+          const randomSuffix = crypto.randomBytes(4).toString('hex');
+          const fallbackBucketName = `${bucketName}-${randomSuffix}`;
+          await logAndProgress(
+            `Bucket ${bucketName} belongs to project number ${metadata.projectNumber || 'unknown'}, not expected project number ${expectedProjectNumber}. Falling back to randomized bucket ${fallbackBucketName}...`,
+            progressCallback,
+            'warn'
+          );
+          return await ensureStorageBucketExists(
+            projectId,
+            fallbackBucketName,
+            location,
+            accessToken,
+            labels,
+            true,
+            progressCallback
+          );
+        } else {
+          const errorMsg = `Security Error: Fallback bucket ${bucketName} belongs to project number ${metadata.projectNumber || 'unknown'}, not expected project number ${expectedProjectNumber}.`;
+          await logAndProgress(errorMsg, progressCallback, 'error');
+          throw new Error(errorMsg);
+        }
+      }
       await logAndProgress(
         `Bucket ${bucketName} already exists.`,
         progressCallback
@@ -56,8 +115,12 @@ export async function ensureStorageBucketExists(
         progressCallback
       );
       try {
+        const options = { location: location };
+        if (labels) {
+          options.metadata = { labels: labels };
+        }
         const [createdBucket] = await callWithRetry(
-          () => storage.createBucket(bucketName, { location: location }),
+          () => storage.createBucket(bucketName, options),
           `storage.createBucket ${bucketName}`
         );
         await logAndProgress(
@@ -66,6 +129,30 @@ export async function ensureStorageBucketExists(
         );
         return createdBucket;
       } catch (createError) {
+        if (
+          !isFallback &&
+          (createError.code === 409 ||
+            createError.status === 409 ||
+            createError.statusCode === 409 ||
+            createError.message?.includes('already exists'))
+        ) {
+          const randomSuffix = crypto.randomBytes(4).toString('hex');
+          const fallbackBucketName = `${bucketName}-${randomSuffix}`;
+          await logAndProgress(
+            `Failed to create storage bucket ${bucketName} (${createError.message}). Falling back to randomized bucket ${fallbackBucketName}...`,
+            progressCallback,
+            'warn'
+          );
+          return await ensureStorageBucketExists(
+            projectId,
+            fallbackBucketName,
+            location,
+            accessToken,
+            labels,
+            true,
+            progressCallback
+          );
+        }
         const errorMessage = `Failed to create storage bucket ${bucketName}. Error details: ${createError.message}`;
         console.error(
           `Failed to create storage bucket ${bucketName}. Error details:`,
@@ -84,15 +171,14 @@ export async function ensureStorageBucketExists(
 }
 
 /**
- * Uploads a buffer to a specified Google Cloud Storage bucket and blob name.
+ * Uploads a buffer to a Cloud Storage bucket.
  *
  * @async
- * @param {import('@google-cloud/storage').Bucket} bucket - The Google Cloud Storage bucket object.
- * @param {Buffer} buffer - The buffer containing the data to upload.
- * @param {string} destinationBlobName - The name for the blob in the bucket.
+ * @param {import('@google-cloud/storage').Bucket} bucket - The GCS Bucket object.
+ * @param {Buffer} buffer - The buffer content to upload.
+ * @param {string} destinationBlobName - The name of the file in the bucket.
  * @param {function(object): void} [progressCallback] - Optional callback for progress updates.
- * @returns {Promise<import('@google-cloud/storage').File>} A promise that resolves with the GCS File object representing the uploaded blob.
- * @throws {Error} If the upload fails.
+ * @returns {Promise<import('@google-cloud/storage').File>} A promise that resolves with the File object.
  */
 export async function uploadToStorageBucket(
   bucket,
@@ -105,15 +191,21 @@ export async function uploadToStorageBucket(
       `Uploading buffer to gs://${bucket.name}/${destinationBlobName}...`,
       progressCallback
     );
+    const file = bucket.file(destinationBlobName);
     await callWithRetry(
-      () => bucket.file(destinationBlobName).save(buffer),
+      () => file.save(buffer),
       `storage.bucket.file.save ${destinationBlobName}`
     );
+    const [metadata] = await callWithRetry(
+      () => file.getMetadata(),
+      `storage.bucket.file.getMetadata ${destinationBlobName}`
+    );
+    file.metadata = metadata;
     await logAndProgress(
       `File ${destinationBlobName} uploaded successfully to gs://${bucket.name}/${destinationBlobName}.`,
       progressCallback
     );
-    return bucket.file(destinationBlobName);
+    return file;
   } catch (error) {
     const errorMessage = `Error uploading buffer: ${error.message}`;
     console.error(`Error uploading buffer:`, error);
@@ -121,3 +213,59 @@ export async function uploadToStorageBucket(
     throw error;
   }
 }
+
+/**
+ * Grants a specific role to a member on a GCS bucket.
+ *
+ * @async
+ * @param {import('@google-cloud/storage').Bucket} bucket - The GCS Bucket object.
+ * @param {string} role - The role to grant (e.g., 'roles/storage.objectAdmin').
+ * @param {string} member - The member to grant the role to (e.g., 'serviceAccount:xyz@example.com').
+ * @param {function(object): void} [progressCallback] - Optional callback for progress updates.
+ * @returns {Promise<void>}
+ */
+export async function grantBucketAccess(
+  bucket,
+  role,
+  member,
+  progressCallback
+) {
+  try {
+    await logAndProgress(
+      `Granting ${role} to ${member} on bucket ${bucket.name}...`,
+      progressCallback
+    );
+    const [policy] = await callWithRetry(
+      () => bucket.iam.getPolicy({ requestedPolicyVersion: 3 }),
+      `storage.bucket.iam.getPolicy ${bucket.name}`
+    );
+
+    // Check if member already has the role
+    const binding = policy.bindings.find((b) => b.role === role);
+    if (binding && binding.members.includes(member)) {
+      await logAndProgress(
+        `${member} already has ${role} on bucket ${bucket.name}.`,
+        progressCallback
+      );
+      return;
+    }
+
+    if (binding) {
+      binding.members.push(member);
+    } else {
+      policy.bindings.push({ role: role, members: [member] });
+    }
+
+    await callWithRetry(
+      () => bucket.iam.setPolicy(policy),
+      `storage.bucket.iam.setPolicy ${bucket.name}`
+    );
+    await logAndProgress(
+      `Successfully granted ${role} to ${member} on bucket ${bucket.name}.`,
+      progressCallback
+    );
+  } catch (error) {
+    const errorMessage = `Error granting access to bucket ${bucket.name}: ${error.message}`;
+    await logAndProgress(errorMessage, progressCallback, 'warn');
+  }
+}