@hot-updater/android-helper 1.2.0-rc.5 → 1.2.0-rc.6

package/dist/index.cjs

@@ -1208,8 +1208,10 @@ const RESOURCE_MANAGER_API = "https://cloudresourcemanager.googleapis.com";
 const SERVICE_USAGE_API = "https://serviceusage.googleapis.com";
 const IAM_API = "https://iam.googleapis.com/v1";
 const GCLOUD_INSTALL_URL = "https://cloud.google.com/sdk/docs/install";
+/** The Google Play Android Developer API, which the service account calls. */
+const PLAY_API = "androidpublisher.googleapis.com";
 /** IAM creates the service account; the Play Developer API is what it calls. */
-const SERVICES = ["iam.googleapis.com", "androidpublisher.googleapis.com"];
+const SERVICES = ["iam.googleapis.com", PLAY_API];
 const KEY_CREATION_CONSTRAINT = "constraints/iam.disableServiceAccountKeyCreation";
 /** Retries while Google enables an API or creates a service account. */
 const PROPAGATION_ATTEMPTS = 12;
@@ -1238,11 +1240,8 @@ const activeAccount = async (run) => (await run("gcloud", [
 	"--filter=status:ACTIVE",
 	"--format=value(account)"
 ])).trim().split("\n")[0]?.trim() || void 0;
-/**
-* gcloud's access token, after `gcloud auth login` when no account is
-* active. Stops before any change when gcloud is not installed.
-*/
-const signInWithGcloud = async ({ run, onStep }) => {
+/** Stops before anything else, a prompt included, when gcloud is not installed. */
+const requireGcloud = async (run) => {
 	try {
 		await run("gcloud", ["--version"]);
 	} catch (error) {
@@ -1252,6 +1251,9 @@ const signInWithGcloud = async ({ run, onStep }) => {
 			GCLOUD_INSTALL_URL
 		].join("\n"), { cause: error });
 	}
+};
+/** gcloud's access token, after `gcloud auth login` when no account is active. */
+const signInWithGcloud = async ({ run, onStep }) => {
 	let account = await activeAccount(run);
 	if (account === void 0) {
 		await run("gcloud", ["auth", "login"], { interactive: true }).catch(() => {});
@@ -1267,11 +1269,12 @@ const signInWithGcloud = async ({ run, onStep }) => {
 * `IssuePlayServiceAccount` with the gcloud CLI's sign-in and Google's own
 * APIs:
 *
-* 1. gcloud's Google Account, signed in with `gcloud auth login` when none
-*    is active, names the access token the Google Cloud steps use;
-* 2. the Google Cloud project "Hot Updater Play" an earlier run created, or
-*    a new one, gets the IAM and Play Developer APIs enabled, and the
-*    service account `hot-updater-play` its JSON key;
+* 1. once gcloud is found, `askPackageName` names the app, and gcloud's
+*    Google Account, signed in with `gcloud auth login` when none is
+*    active, the access token the Google Cloud steps use;
+* 2. the account's only project with the Play Developer API, else the one
+*    `chooseProject` picks, else a new one, gets the IAM and Play Developer
+*    APIs enabled, and the service account `hot-updater-play` its JSON key;
 * 3. the developer invites the service account in Play Console, which
 *    `onInvite` opens: gcloud's token may not manage Google Play users;
 * 4. the key itself opens an edit of the app until Google Play lets it,
@@ -1281,7 +1284,9 @@ const signInWithGcloud = async ({ run, onStep }) => {
 * service account.
 */
 const createGoogleKeyIssuer = ({ fetch = globalThis.fetch, sleep = sleepFor, run = runWithExeca } = {}) => async (request) => {
-	const { packageName, onStep = () => {} } = request;
+	const { onStep = () => {} } = request;
+	await requireGcloud(run);
+	const packageName = await request.askPackageName();
 	const accessToken = await signInWithGcloud({
 		run,
 		onStep
@@ -1297,7 +1302,7 @@ const createGoogleKeyIssuer = ({ fetch = globalThis.fetch, sleep = sleepFor, run
 		onStep
 	});
 	const { projectId } = project;
-	onStep(`Enabling the Google Play Developer API in ${projectId}`);
+	onStep(`Enabling the APIs in ${projectId}`);
 	await enableServices({
 		google,
 		projectId,
@@ -1408,32 +1413,53 @@ const listProjects = async (google) => {
 	} while (pageToken);
 	return projects;
 };
-/** The display name of the project Hot Updater creates, which later runs reuse. */
+/** Service Usage reads of the projects' Play Developer API, at most this many at once. */
+const API_CHECK_CONCURRENCY = 8;
+/**
+* Whether each project has the Google Play Developer API enabled, by one
+* Service Usage read each; a project this account may not read counts as
+* without it.
+*/
+const withPlayApiState = async (google, projects) => {
+	const states = [];
+	for (let start = 0; start < projects.length; start += API_CHECK_CONCURRENCY) states.push(...await Promise.all(projects.slice(start, start + API_CHECK_CONCURRENCY).map(({ projectId }) => google("Reading the project's APIs", "GET", `${SERVICE_USAGE_API}/v1/projects/${encodeURIComponent(projectId)}/services/${PLAY_API}`).then(({ state }) => state === "ENABLED", () => false))));
+	return projects.map((project, index) => ({
+		...project,
+		playApiEnabled: states[index]
+	}));
+};
+/** The display name of the project Hot Updater creates. */
 const PROJECT_DISPLAY_NAME = "Hot Updater Play";
 /**
-* The project the service account goes in, without asking: the one an
-* earlier run created, else a new one. Only when Google refuses to create
-* one does the developer pick among the account's projects.
+* The project the service account goes in: a new one for an account
+* without projects; the only project with the Play Developer API, without
+* asking; else the one the developer picks, or a new one.
 */
 const chooseProject = async ({ google, request, sleep, onStep }) => {
-	const projects = await listProjects(google);
-	const reused = projects.find((project) => project.displayName === PROJECT_DISPLAY_NAME);
-	if (reused) return reused;
-	try {
-		return await createProject({
-			google,
-			sleep,
-			onStep
-		});
-	} catch (error) {
-		if (!(error instanceof PlayServiceAccountError) || error.code !== "project-quota" && error.code !== "project-create-denied" || projects.length === 0) throw error;
-		const chosen = await request.chooseProject(projects.map(({ projectId, displayName }) => ({
-			projectId,
-			...displayName ? { displayName } : {}
-		})));
-		if (chosen === void 0) throw error;
-		return projects.find((project) => project.projectId === chosen) ?? { projectId: chosen };
+	const listed = await listProjects(google);
+	if (listed.length === 0) return createProject({
+		google,
+		sleep,
+		onStep
+	});
+	const projects = await withPlayApiState(google, listed);
+	const enabled = projects.filter(({ playApiEnabled }) => playApiEnabled);
+	if (enabled.length === 1) {
+		const [only] = enabled;
+		onStep(`Using ${only.projectId}, the project with the Play Developer API`);
+		return only;
 	}
+	const chosen = await request.chooseProject(projects.map(({ projectId, displayName, playApiEnabled }) => ({
+		projectId,
+		...displayName ? { displayName } : {},
+		playApiEnabled
+	})));
+	if (chosen === null) return createProject({
+		google,
+		sleep,
+		onStep
+	});
+	return projects.find((project) => project.projectId === chosen) ?? { projectId: chosen };
 };
 /** A new project, `hot-updater-play-<random>`, once Google has created it. */
 const createProject = async ({ google, sleep, onStep }) => {

package/dist/index.d.cts

@@ -187,21 +187,28 @@ declare const PLAY_SERVICE_ACCOUNT_ID = "hot-updater-play";
 interface GoogleCloudProject {
   readonly projectId: string;
   readonly displayName?: string;
+  /** Whether the Google Play Android Developer API is enabled in it. */
+  readonly playApiEnabled: boolean;
 }
 interface IssuePlayServiceAccountRequest {
-  /** The app's package name in Google Play, which the service account may release. */
-  readonly packageName: string;
+  /**
+   * Asks for the app's package name in Google Play, which the service
+   * account may release: after the sign-in's own tool is found, before
+   * anything else.
+   */
+  readonly askPackageName: () => Promise<string>;
   /**
    * Sees Play Console's page that invites the service account `email`, to
    * print it and open it in a browser; the issuer then waits for the invite.
    */
   readonly onInvite: (url: string, email: string) => Promise<void> | void;
   /**
-   * Sees the account's projects when Google refuses to create one for it,
-   * and returns the one to create the service account in, or undefined to
-   * stop with Google's refusal.
+   * Sees the account's projects when no one of them is the obvious home of
+   * the service account, the only one with the Google Play Developer API,
+   * and returns the project ID to create it in, or null for a new project.
+   * Never called for an account without projects: a new one is created.
    */
-  readonly chooseProject: (projects: readonly GoogleCloudProject[]) => Promise<string | undefined>;
+  readonly chooseProject: (projects: readonly GoogleCloudProject[]) => Promise<string | null>;
   /** Reports each step, such as "Creating the service account". */
   readonly onStep?: (message: string) => void;
 }

package/dist/index.d.mts

@@ -188,21 +188,28 @@ declare const PLAY_SERVICE_ACCOUNT_ID = "hot-updater-play";
 interface GoogleCloudProject {
   readonly projectId: string;
   readonly displayName?: string;
+  /** Whether the Google Play Android Developer API is enabled in it. */
+  readonly playApiEnabled: boolean;
 }
 interface IssuePlayServiceAccountRequest {
-  /** The app's package name in Google Play, which the service account may release. */
-  readonly packageName: string;
+  /**
+   * Asks for the app's package name in Google Play, which the service
+   * account may release: after the sign-in's own tool is found, before
+   * anything else.
+   */
+  readonly askPackageName: () => Promise<string>;
   /**
    * Sees Play Console's page that invites the service account `email`, to
    * print it and open it in a browser; the issuer then waits for the invite.
    */
   readonly onInvite: (url: string, email: string) => Promise<void> | void;
   /**
-   * Sees the account's projects when Google refuses to create one for it,
-   * and returns the one to create the service account in, or undefined to
-   * stop with Google's refusal.
+   * Sees the account's projects when no one of them is the obvious home of
+   * the service account, the only one with the Google Play Developer API,
+   * and returns the project ID to create it in, or null for a new project.
+   * Never called for an account without projects: a new one is created.
    */
-  readonly chooseProject: (projects: readonly GoogleCloudProject[]) => Promise<string | undefined>;
+  readonly chooseProject: (projects: readonly GoogleCloudProject[]) => Promise<string | null>;
   /** Reports each step, such as "Creating the service account". */
   readonly onStep?: (message: string) => void;
 }

package/dist/index.mjs

@@ -1179,8 +1179,10 @@ const RESOURCE_MANAGER_API = "https://cloudresourcemanager.googleapis.com";
 const SERVICE_USAGE_API = "https://serviceusage.googleapis.com";
 const IAM_API = "https://iam.googleapis.com/v1";
 const GCLOUD_INSTALL_URL = "https://cloud.google.com/sdk/docs/install";
+/** The Google Play Android Developer API, which the service account calls. */
+const PLAY_API = "androidpublisher.googleapis.com";
 /** IAM creates the service account; the Play Developer API is what it calls. */
-const SERVICES = ["iam.googleapis.com", "androidpublisher.googleapis.com"];
+const SERVICES = ["iam.googleapis.com", PLAY_API];
 const KEY_CREATION_CONSTRAINT = "constraints/iam.disableServiceAccountKeyCreation";
 /** Retries while Google enables an API or creates a service account. */
 const PROPAGATION_ATTEMPTS = 12;
@@ -1209,11 +1211,8 @@ const activeAccount = async (run) => (await run("gcloud", [
 	"--filter=status:ACTIVE",
 	"--format=value(account)"
 ])).trim().split("\n")[0]?.trim() || void 0;
-/**
-* gcloud's access token, after `gcloud auth login` when no account is
-* active. Stops before any change when gcloud is not installed.
-*/
-const signInWithGcloud = async ({ run, onStep }) => {
+/** Stops before anything else, a prompt included, when gcloud is not installed. */
+const requireGcloud = async (run) => {
 	try {
 		await run("gcloud", ["--version"]);
 	} catch (error) {
@@ -1223,6 +1222,9 @@ const signInWithGcloud = async ({ run, onStep }) => {
 			GCLOUD_INSTALL_URL
 		].join("\n"), { cause: error });
 	}
+};
+/** gcloud's access token, after `gcloud auth login` when no account is active. */
+const signInWithGcloud = async ({ run, onStep }) => {
 	let account = await activeAccount(run);
 	if (account === void 0) {
 		await run("gcloud", ["auth", "login"], { interactive: true }).catch(() => {});
@@ -1238,11 +1240,12 @@ const signInWithGcloud = async ({ run, onStep }) => {
 * `IssuePlayServiceAccount` with the gcloud CLI's sign-in and Google's own
 * APIs:
 *
-* 1. gcloud's Google Account, signed in with `gcloud auth login` when none
-*    is active, names the access token the Google Cloud steps use;
-* 2. the Google Cloud project "Hot Updater Play" an earlier run created, or
-*    a new one, gets the IAM and Play Developer APIs enabled, and the
-*    service account `hot-updater-play` its JSON key;
+* 1. once gcloud is found, `askPackageName` names the app, and gcloud's
+*    Google Account, signed in with `gcloud auth login` when none is
+*    active, the access token the Google Cloud steps use;
+* 2. the account's only project with the Play Developer API, else the one
+*    `chooseProject` picks, else a new one, gets the IAM and Play Developer
+*    APIs enabled, and the service account `hot-updater-play` its JSON key;
 * 3. the developer invites the service account in Play Console, which
 *    `onInvite` opens: gcloud's token may not manage Google Play users;
 * 4. the key itself opens an edit of the app until Google Play lets it,
@@ -1252,7 +1255,9 @@ const signInWithGcloud = async ({ run, onStep }) => {
 * service account.
 */
 const createGoogleKeyIssuer = ({ fetch = globalThis.fetch, sleep = sleepFor, run = runWithExeca } = {}) => async (request) => {
-	const { packageName, onStep = () => {} } = request;
+	const { onStep = () => {} } = request;
+	await requireGcloud(run);
+	const packageName = await request.askPackageName();
 	const accessToken = await signInWithGcloud({
 		run,
 		onStep
@@ -1268,7 +1273,7 @@ const createGoogleKeyIssuer = ({ fetch = globalThis.fetch, sleep = sleepFor, run
 		onStep
 	});
 	const { projectId } = project;
-	onStep(`Enabling the Google Play Developer API in ${projectId}`);
+	onStep(`Enabling the APIs in ${projectId}`);
 	await enableServices({
 		google,
 		projectId,
@@ -1379,32 +1384,53 @@ const listProjects = async (google) => {
 	} while (pageToken);
 	return projects;
 };
-/** The display name of the project Hot Updater creates, which later runs reuse. */
+/** Service Usage reads of the projects' Play Developer API, at most this many at once. */
+const API_CHECK_CONCURRENCY = 8;
+/**
+* Whether each project has the Google Play Developer API enabled, by one
+* Service Usage read each; a project this account may not read counts as
+* without it.
+*/
+const withPlayApiState = async (google, projects) => {
+	const states = [];
+	for (let start = 0; start < projects.length; start += API_CHECK_CONCURRENCY) states.push(...await Promise.all(projects.slice(start, start + API_CHECK_CONCURRENCY).map(({ projectId }) => google("Reading the project's APIs", "GET", `${SERVICE_USAGE_API}/v1/projects/${encodeURIComponent(projectId)}/services/${PLAY_API}`).then(({ state }) => state === "ENABLED", () => false))));
+	return projects.map((project, index) => ({
+		...project,
+		playApiEnabled: states[index]
+	}));
+};
+/** The display name of the project Hot Updater creates. */
 const PROJECT_DISPLAY_NAME = "Hot Updater Play";
 /**
-* The project the service account goes in, without asking: the one an
-* earlier run created, else a new one. Only when Google refuses to create
-* one does the developer pick among the account's projects.
+* The project the service account goes in: a new one for an account
+* without projects; the only project with the Play Developer API, without
+* asking; else the one the developer picks, or a new one.
 */
 const chooseProject = async ({ google, request, sleep, onStep }) => {
-	const projects = await listProjects(google);
-	const reused = projects.find((project) => project.displayName === PROJECT_DISPLAY_NAME);
-	if (reused) return reused;
-	try {
-		return await createProject({
-			google,
-			sleep,
-			onStep
-		});
-	} catch (error) {
-		if (!(error instanceof PlayServiceAccountError) || error.code !== "project-quota" && error.code !== "project-create-denied" || projects.length === 0) throw error;
-		const chosen = await request.chooseProject(projects.map(({ projectId, displayName }) => ({
-			projectId,
-			...displayName ? { displayName } : {}
-		})));
-		if (chosen === void 0) throw error;
-		return projects.find((project) => project.projectId === chosen) ?? { projectId: chosen };
+	const listed = await listProjects(google);
+	if (listed.length === 0) return createProject({
+		google,
+		sleep,
+		onStep
+	});
+	const projects = await withPlayApiState(google, listed);
+	const enabled = projects.filter(({ playApiEnabled }) => playApiEnabled);
+	if (enabled.length === 1) {
+		const [only] = enabled;
+		onStep(`Using ${only.projectId}, the project with the Play Developer API`);
+		return only;
 	}
+	const chosen = await request.chooseProject(projects.map(({ projectId, displayName, playApiEnabled }) => ({
+		projectId,
+		...displayName ? { displayName } : {},
+		playApiEnabled
+	})));
+	if (chosen === null) return createProject({
+		google,
+		sleep,
+		onStep
+	});
+	return projects.find((project) => project.projectId === chosen) ?? { projectId: chosen };
 };
 /** A new project, `hot-updater-play-<random>`, once Google has created it. */
 const createProject = async ({ google, sleep, onStep }) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hot-updater/android-helper",
-  "version": "1.2.0-rc.5",
+  "version": "1.2.0-rc.6",
   "type": "module",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -29,9 +29,9 @@
   "dependencies": {
     "execa": "9.5.2",
     "jszip": "^3.10.1",
-    "@hot-updater/cli-tools": "1.2.0-rc.5",
-    "@hot-updater/plugin-core": "1.2.0-rc.5",
-    "@hot-updater/protocol": "1.2.0-rc.5"
+    "@hot-updater/cli-tools": "1.2.0-rc.6",
+    "@hot-updater/plugin-core": "1.2.0-rc.6",
+    "@hot-updater/protocol": "1.2.0-rc.6"
   },
   "devDependencies": {
     "@types/node": "^20"