@google-cloud/cloud-run-mcp 1.9.0 → 1.11.0

package/lib/cloud-api/run.js

@@ -23,6 +23,9 @@ import {
 import { callWithRetry, ensureApisEnabled } from './helpers.js';
 import { logAndProgress } from '../util/helpers.js';
 
+const INVOKER_ROLE = 'roles/run.invoker';
+const PUBLIC_MEMBER = 'allUsers';
+
 async function listCloudRunLocations(projectId, accessToken) {
   const listLocationsRequest = {
     name: `projects/${projectId}`,
@@ -255,3 +258,62 @@ export async function checkCloudRunServiceExists(
     throw error;
   }
 }
+
+/**
+ * Sets public access (allUsers) for a Cloud Run service by assigning the 'roles/run.invoker' role.
+ *
+ * @async
+ * @param {string} projectId - The Google Cloud project ID.
+ * @param {string} location - The Google Cloud region.
+ * @param {string} serviceId - The ID of the Cloud Run service.
+ * @param {string} accessToken - Access token for authentication.
+ * @param {function(object): void} [progressCallback] - Optional callback for progress updates.
+ * @returns {Promise<void>} A promise that resolves when the IAM policy is successfully set.
+ * @throws {Error} If there's an error setting the IAM policy.
+ */
+export async function setServicePublicAccess(
+  projectId,
+  location,
+  serviceId,
+  accessToken,
+  progressCallback
+) {
+  const runClient = await getRunClient(projectId, accessToken);
+  const resource = runClient.servicePath(projectId, location, serviceId);
+
+  try {
+    await logAndProgress(
+      `Setting public access for service ${serviceId}...`,
+      progressCallback
+    );
+    // For Cloud Run v2, we should use getIamPolicy then merge or just set.
+    // Given this is usually for fresh deployments or simple public services,
+    // we set it directly.
+    await callWithRetry(async () => {
+      const [policy] = await runClient.getIamPolicy({ resource });
+
+      // Find existing invoker binding or create a new one
+      let invokerBinding = policy.bindings.find((b) => b.role === INVOKER_ROLE);
+      if (!invokerBinding) {
+        invokerBinding = { role: INVOKER_ROLE, members: [] };
+        policy.bindings.push(invokerBinding);
+      }
+
+      // Add public member if not present
+      if (!invokerBinding.members.includes(PUBLIC_MEMBER)) {
+        invokerBinding.members.push(PUBLIC_MEMBER);
+      }
+
+      // Set the updated policy
+      await runClient.setIamPolicy({ resource, policy });
+    }, 'run.setIamPolicy');
+
+    await logAndProgress(
+      `Public access set successfully for service ${serviceId}.`,
+      progressCallback
+    );
+  } catch (error) {
+    console.error(`Error setting public access for ${serviceId}:`, error);
+    throw error;
+  }
+}

package/lib/cloud-api/secrets.js

@@ -0,0 +1,196 @@
+/*
+Copyright 2025 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { getSecretManagerClient } from '../clients.js';
+import { logAndProgress } from '../util/helpers.js';
+
+const SECRET_ACCESSOR_ROLE = 'roles/secretmanager.secretAccessor';
+
+/**
+ * Retrieves secret metadata.
+ * @param {string} projectId - GCP project ID.
+ * @param {string} secretName - Name of the secret.
+ * @param {string} accessToken - OAuth2 access token.
+ * @returns {Promise<Object|null>} Secret data or null if not found.
+ */
+export async function getSecret(projectId, secretName, accessToken) {
+  const secretManager = await getSecretManagerClient(projectId, accessToken);
+  try {
+    const [res] = await secretManager.getSecret({
+      name: `projects/${projectId}/secrets/${secretName}`,
+    });
+    return res;
+  } catch (err) {
+    if (err.code === 5) {
+      // NOT_FOUND in gRPC
+      return null;
+    }
+    throw err;
+  }
+}
+
+/**
+ * Creates a new secret in Secret Manager.
+ * @param {string} projectId - GCP project ID.
+ * @param {string} secretName - Name of the secret to create.
+ * @param {string} accessToken - OAuth2 access token.
+ * @param {Object.<string, string>} [labels] - Optional labels to apply to the secret.
+ * @param {Function} progressCallback - Progress reporting callback.
+ * @returns {Promise<Object>} The created secret.
+ */
+export async function createSecret(
+  projectId,
+  secretName,
+  accessToken,
+  labels,
+  progressCallback
+) {
+  const secretManager = await getSecretManagerClient(projectId, accessToken);
+  await logAndProgress(`Creating secret '${secretName}'...`, progressCallback);
+  const secret = {
+    replication: {
+      automatic: {},
+    },
+  };
+  if (labels) {
+    secret.labels = labels;
+  }
+  const [res] = await secretManager.createSecret({
+    parent: `projects/${projectId}`,
+    secretId: secretName,
+    secret: secret,
+  });
+  return res;
+}
+
+/**
+ * Adds a new version to an existing secret.
+ * @param {string} projectId - GCP project ID.
+ * @param {string} secretName - Name of the secret.
+ * @param {Buffer|string} content - Secret content.
+ * @param {string} accessToken - OAuth2 access token.
+ * @param {Function} progressCallback - Progress reporting callback.
+ * @returns {Promise<Object>} Information about the created version.
+ */
+export async function addSecretVersion(
+  projectId,
+  secretName,
+  content,
+  accessToken,
+  progressCallback
+) {
+  const secretManager = await getSecretManagerClient(projectId, accessToken);
+  await logAndProgress(
+    `Adding new version to secret '${secretName}'...`,
+    progressCallback
+  );
+
+  const payload = typeof content === 'string' ? Buffer.from(content) : content;
+
+  const [res] = await secretManager.addSecretVersion({
+    parent: `projects/${projectId}/secrets/${secretName}`,
+    payload: {
+      data: payload,
+    },
+  });
+  return res;
+}
+
+/**
+ * Gets the IAM policy for a secret.
+ * @param {string} projectId - GCP project ID.
+ * @param {string} secretName - Name of the secret.
+ * @param {string} accessToken - OAuth2 access token.
+ * @returns {Promise<Object>} The IAM policy.
+ */
+export async function getSecretIamPolicy(projectId, secretName, accessToken) {
+  const secretManager = await getSecretManagerClient(projectId, accessToken);
+  const [res] = await secretManager.getIamPolicy({
+    resource: `projects/${projectId}/secrets/${secretName}`,
+  });
+  return res;
+}
+
+/**
+ * Sets the IAM policy for a secret.
+ * @param {string} projectId - GCP project ID.
+ * @param {string} secretName - Name of the secret.
+ * @param {Object} policy - The IAM policy to set.
+ * @param {string} accessToken - OAuth2 access token.
+ * @param {Function} progressCallback - Progress reporting callback.
+ * @returns {Promise<Object>} Result of the policy update.
+ */
+export async function setSecretIamPolicy(
+  projectId,
+  secretName,
+  policy,
+  accessToken,
+  progressCallback
+) {
+  const secretManager = await getSecretManagerClient(projectId, accessToken);
+  await logAndProgress(
+    `Updating IAM policy for secret '${secretName}'...`,
+    progressCallback
+  );
+  const [res] = await secretManager.setIamPolicy({
+    resource: `projects/${projectId}/secrets/${secretName}`,
+    policy: policy,
+  });
+  return res;
+}
+
+/**
+ * Adds a role binding to a secret's IAM policy.
+ * @param {string} projectId - GCP project ID.
+ * @param {string} secretName - Name of the secret.
+ * @param {string} member - Member to add (e.g. 'serviceAccount:...').
+ * @param {string} accessToken - OAuth2 access token.
+ * @param {Function} progressCallback - Progress reporting callback.
+ * @returns {Promise<Object>} Final IAM policy.
+ */
+export async function addSecretAccessorBinding(
+  projectId,
+  secretName,
+  member,
+  accessToken,
+  progressCallback
+) {
+  const policy = await getSecretIamPolicy(projectId, secretName, accessToken);
+  const role = SECRET_ACCESSOR_ROLE;
+
+  policy.bindings = policy.bindings || [];
+  const binding = policy.bindings.find((b) => b.role === role);
+
+  if (binding) {
+    if (binding.members.includes(member)) {
+      return policy;
+    }
+    binding.members.push(member);
+  } else {
+    policy.bindings.push({
+      role: role,
+      members: [member],
+    });
+  }
+
+  return setSecretIamPolicy(
+    projectId,
+    secretName,
+    policy,
+    accessToken,
+    progressCallback
+  );
+}

package/lib/cloud-api/storage.js

@@ -14,9 +14,10 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+import crypto from 'node:crypto';
 import { getStorageClient } from '../clients.js';
 import { callWithRetry } from './helpers.js';
-import { logAndProgress } from '../util/helpers.js';
+import { logAndProgress, getProjectNumber } from '../util/helpers.js';
 
 /**
  * Ensures that a Google Cloud Storage bucket exists.
@@ -25,7 +26,10 @@ import { logAndProgress } from '../util/helpers.js';
  * @async
  * @param {string} projectId - The Google Cloud project ID.
  * @param {string} bucketName - The name of the storage bucket.
- * @param {string} [location='us'] - The location to create the bucket in if it doesn't exist. Defaults to 'us'.
+ * @param {string} [location] - The location to create the bucket in if it doesn't exist.
+ * @param {string} [accessToken] - Optional access token.
+ * @param {Object.<string, string>} [labels] - Optional labels to apply to the bucket.
+ * @param {boolean} [isFallback=false] - Whether this is a fallback attempt (avoids infinite recursion).
  * @param {function(object): void} [progressCallback] - Optional callback for progress updates.
  * @returns {Promise<import('@google-cloud/storage').Bucket>} A promise that resolves with the GCS Bucket object.
  * @throws {Error} If there's an error checking or creating the bucket.
@@ -33,18 +37,73 @@ import { logAndProgress } from '../util/helpers.js';
 export async function ensureStorageBucketExists(
   projectId,
   bucketName,
-  location = 'us',
+  location,
   accessToken,
+  labels,
+  isFallback = false,
   progressCallback
 ) {
   const storage = await getStorageClient(projectId, accessToken);
   const bucket = storage.bucket(bucketName);
   try {
-    const [exists] = await callWithRetry(
-      () => bucket.exists(),
-      `storage.bucket.exists ${bucketName}`
-    );
+    let exists = false;
+    try {
+      const [bucketExists] = await callWithRetry(
+        () => bucket.exists(),
+        `storage.bucket.exists ${bucketName}`
+      );
+      exists = bucketExists;
+    } catch (err) {
+      if (err.code === 403 || err.status === 403 || err.statusCode === 403) {
+        exists = true;
+      } else {
+        throw err;
+      }
+    }
+
     if (exists) {
+      const expectedProjectNumber = await getProjectNumber(
+        projectId,
+        accessToken
+      );
+      let metadata;
+      try {
+        [metadata] = await callWithRetry(
+          () => bucket.getMetadata(),
+          `storage.bucket.getMetadata ${bucketName}`
+        );
+      } catch (metaErr) {
+        metadata = {};
+      }
+
+      if (
+        !expectedProjectNumber ||
+        !metadata.projectNumber ||
+        String(metadata.projectNumber) !== String(expectedProjectNumber)
+      ) {
+        if (!isFallback) {
+          const randomSuffix = crypto.randomBytes(4).toString('hex');
+          const fallbackBucketName = `${bucketName}-${randomSuffix}`;
+          await logAndProgress(
+            `Bucket ${bucketName} belongs to project number ${metadata.projectNumber || 'unknown'}, not expected project number ${expectedProjectNumber}. Falling back to randomized bucket ${fallbackBucketName}...`,
+            progressCallback,
+            'warn'
+          );
+          return await ensureStorageBucketExists(
+            projectId,
+            fallbackBucketName,
+            location,
+            accessToken,
+            labels,
+            true,
+            progressCallback
+          );
+        } else {
+          const errorMsg = `Security Error: Fallback bucket ${bucketName} belongs to project number ${metadata.projectNumber || 'unknown'}, not expected project number ${expectedProjectNumber}.`;
+          await logAndProgress(errorMsg, progressCallback, 'error');
+          throw new Error(errorMsg);
+        }
+      }
       await logAndProgress(
         `Bucket ${bucketName} already exists.`,
         progressCallback
@@ -56,8 +115,12 @@ export async function ensureStorageBucketExists(
         progressCallback
       );
       try {
+        const options = { location: location };
+        if (labels) {
+          options.metadata = { labels: labels };
+        }
         const [createdBucket] = await callWithRetry(
-          () => storage.createBucket(bucketName, { location: location }),
+          () => storage.createBucket(bucketName, options),
           `storage.createBucket ${bucketName}`
         );
         await logAndProgress(
@@ -66,6 +129,30 @@ export async function ensureStorageBucketExists(
         );
         return createdBucket;
       } catch (createError) {
+        if (
+          !isFallback &&
+          (createError.code === 409 ||
+            createError.status === 409 ||
+            createError.statusCode === 409 ||
+            createError.message?.includes('already exists'))
+        ) {
+          const randomSuffix = crypto.randomBytes(4).toString('hex');
+          const fallbackBucketName = `${bucketName}-${randomSuffix}`;
+          await logAndProgress(
+            `Failed to create storage bucket ${bucketName} (${createError.message}). Falling back to randomized bucket ${fallbackBucketName}...`,
+            progressCallback,
+            'warn'
+          );
+          return await ensureStorageBucketExists(
+            projectId,
+            fallbackBucketName,
+            location,
+            accessToken,
+            labels,
+            true,
+            progressCallback
+          );
+        }
         const errorMessage = `Failed to create storage bucket ${bucketName}. Error details: ${createError.message}`;
         console.error(
           `Failed to create storage bucket ${bucketName}. Error details:`,
@@ -84,15 +171,14 @@ export async function ensureStorageBucketExists(
 }
 
 /**
- * Uploads a buffer to a specified Google Cloud Storage bucket and blob name.
+ * Uploads a buffer to a Cloud Storage bucket.
  *
  * @async
- * @param {import('@google-cloud/storage').Bucket} bucket - The Google Cloud Storage bucket object.
- * @param {Buffer} buffer - The buffer containing the data to upload.
- * @param {string} destinationBlobName - The name for the blob in the bucket.
+ * @param {import('@google-cloud/storage').Bucket} bucket - The GCS Bucket object.
+ * @param {Buffer} buffer - The buffer content to upload.
+ * @param {string} destinationBlobName - The name of the file in the bucket.
  * @param {function(object): void} [progressCallback] - Optional callback for progress updates.
- * @returns {Promise<import('@google-cloud/storage').File>} A promise that resolves with the GCS File object representing the uploaded blob.
- * @throws {Error} If the upload fails.
+ * @returns {Promise<import('@google-cloud/storage').File>} A promise that resolves with the File object.
  */
 export async function uploadToStorageBucket(
   bucket,
@@ -105,15 +191,21 @@ export async function uploadToStorageBucket(
       `Uploading buffer to gs://${bucket.name}/${destinationBlobName}...`,
       progressCallback
     );
+    const file = bucket.file(destinationBlobName);
     await callWithRetry(
-      () => bucket.file(destinationBlobName).save(buffer),
+      () => file.save(buffer),
       `storage.bucket.file.save ${destinationBlobName}`
     );
+    const [metadata] = await callWithRetry(
+      () => file.getMetadata(),
+      `storage.bucket.file.getMetadata ${destinationBlobName}`
+    );
+    file.metadata = metadata;
     await logAndProgress(
       `File ${destinationBlobName} uploaded successfully to gs://${bucket.name}/${destinationBlobName}.`,
       progressCallback
     );
-    return bucket.file(destinationBlobName);
+    return file;
   } catch (error) {
     const errorMessage = `Error uploading buffer: ${error.message}`;
     console.error(`Error uploading buffer:`, error);
@@ -121,3 +213,59 @@ export async function uploadToStorageBucket(
     throw error;
   }
 }
+
+/**
+ * Grants a specific role to a member on a GCS bucket.
+ *
+ * @async
+ * @param {import('@google-cloud/storage').Bucket} bucket - The GCS Bucket object.
+ * @param {string} role - The role to grant (e.g., 'roles/storage.objectAdmin').
+ * @param {string} member - The member to grant the role to (e.g., 'serviceAccount:xyz@example.com').
+ * @param {function(object): void} [progressCallback] - Optional callback for progress updates.
+ * @returns {Promise<void>}
+ */
+export async function grantBucketAccess(
+  bucket,
+  role,
+  member,
+  progressCallback
+) {
+  try {
+    await logAndProgress(
+      `Granting ${role} to ${member} on bucket ${bucket.name}...`,
+      progressCallback
+    );
+    const [policy] = await callWithRetry(
+      () => bucket.iam.getPolicy({ requestedPolicyVersion: 3 }),
+      `storage.bucket.iam.getPolicy ${bucket.name}`
+    );
+
+    // Check if member already has the role
+    const binding = policy.bindings.find((b) => b.role === role);
+    if (binding && binding.members.includes(member)) {
+      await logAndProgress(
+        `${member} already has ${role} on bucket ${bucket.name}.`,
+        progressCallback
+      );
+      return;
+    }
+
+    if (binding) {
+      binding.members.push(member);
+    } else {
+      policy.bindings.push({ role: role, members: [member] });
+    }
+
+    await callWithRetry(
+      () => bucket.iam.setPolicy(policy),
+      `storage.bucket.iam.setPolicy ${bucket.name}`
+    );
+    await logAndProgress(
+      `Successfully granted ${role} to ${member} on bucket ${bucket.name}.`,
+      progressCallback
+    );
+  } catch (error) {
+    const errorMessage = `Error granting access to bucket ${bucket.name}: ${error.message}`;
+    await logAndProgress(errorMessage, progressCallback, 'warn');
+  }
+}