@intuitionrobotics/firebase 2.4.5 → 2.4.7

package/dist/app-backend/FirebaseModule.d.ts

@@ -15,6 +15,16 @@ export type JWTInput = {
 type ConfigType = {
     [s: string]: string | JWTInput | Firebase_UserCredential;
 };
+/**
+ * Config value meaning "no service-account key for this project — authenticate with
+ * Application Default Credentials instead". Set it in place of the key JSON to drop a
+ * long-lived secret from config; the runtime service account then needs the relevant
+ * roles on the target project.
+ *
+ * Deliberately opt-in: a project with NO entry at all still throws, so a typo'd project
+ * name fails loudly instead of silently opening a session against the wrong credentials.
+ */
+export declare const ADC_CREDENTIALS = "adc";
 export declare class FirebaseModule_Class extends Module<ConfigType> {
     private readonly adminSessions;
     static localAdminConfigId: string;

package/dist/app-backend/FirebaseModule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"FirebaseModule.d.ts","sourceRoot":"","sources":["../../src/main/app-backend/FirebaseModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,MAAM,EAET,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAC,qBAAqB,EAAC,MAAM,iCAAiC,CAAC;AAEtE,OAAO,EAAC,KAAK,uBAAuB,EAAC,MAAM,4BAA4B,CAAC;AAExE,MAAM,MAAM,QAAQ,GAAG;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAA;AACD,KAAK,UAAU,GAAG;IACd,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,uBAAuB,CAAC;CAC5D,CAAC;AAEF,qBAAa,oBACT,SAAQ,MAAM,CAAC,UAAU,CAAC;IAG1B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+C;IAC7E,OAAc,kBAAkB,EAAE,MAAM,CAAC;IAEzC,OAAO,CAAC,eAAe,CAAC,CAAS;;IAMjC,iBAAiB,IAAI,MAAM;IAI3B,OAAO,CAAC,qBAAqB;IAQ7B,OAAO,CAAC,oBAAoB;IAoB5B,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAMlC,SAAS,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAM9B,kBAAkB,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM;IA6BpE,cAAc,CAAC,SAAS,EAAE,MAAM;CAGnC;AAED,eAAO,MAAM,cAAc,sBAA6B,CAAC"}
+{"version":3,"file":"FirebaseModule.d.ts","sourceRoot":"","sources":["../../src/main/app-backend/FirebaseModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,MAAM,EAET,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAC,qBAAqB,EAAC,MAAM,iCAAiC,CAAC;AAEtE,OAAO,EAAC,KAAK,uBAAuB,EAAC,MAAM,4BAA4B,CAAC;AAExE,MAAM,MAAM,QAAQ,GAAG;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAA;AACD,KAAK,UAAU,GAAG;IACd,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,uBAAuB,CAAC;CAC5D,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,QAAQ,CAAC;AAErC,qBAAa,oBACT,SAAQ,MAAM,CAAC,UAAU,CAAC;IAG1B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+C;IAC7E,OAAc,kBAAkB,EAAE,MAAM,CAAC;IAEzC,OAAO,CAAC,eAAe,CAAC,CAAS;;IAMjC,iBAAiB,IAAI,MAAM;IAI3B,OAAO,CAAC,qBAAqB;IAQ7B,OAAO,CAAC,oBAAoB;IAoB5B,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAMlC,SAAS,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAM9B,kBAAkB,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM;IAqCpE,cAAc,CAAC,SAAS,EAAE,MAAM;CAGnC;AAED,eAAO,MAAM,cAAc,sBAA6B,CAAC"}

package/dist/app-backend/FirebaseModule.js

@@ -2,6 +2,16 @@ import { BadImplementationException, ImplementationMissingException, Module, Thi
 import { FirebaseSession_Admin } from "./auth/FirebaseSession_Admin.js";
 import { readFileSync } from "fs";
 import {} from "./auth/firebase-session.js";
+/**
+ * Config value meaning "no service-account key for this project — authenticate with
+ * Application Default Credentials instead". Set it in place of the key JSON to drop a
+ * long-lived secret from config; the runtime service account then needs the relevant
+ * roles on the target project.
+ *
+ * Deliberately opt-in: a project with NO entry at all still throws, so a typo'd project
+ * name fails loudly instead of silently opening a session against the wrong credentials.
+ */
+export const ADC_CREDENTIALS = "adc";
 export class FirebaseModule_Class extends Module {
     // private readonly tokenSessions: { [s: string]: FirebaseSession_UserPassword; } = {};
     adminSessions = {};
@@ -58,13 +68,19 @@ export class FirebaseModule_Class extends Module {
         this.logInfo(`Creating Firebase session for project id: ${projectId}`);
         let config = this.getProjectAuth(projectId);
         const localProjectId = this.getLocalProjectIdSafe();
-        if (!config && _projectId && localProjectId && localProjectId !== _projectId)
+        // Explicit opt-out of a hardcoded key: authenticate with ADC against `projectId`.
+        const useADC = config === ADC_CREDENTIALS;
+        if (useADC)
+            config = undefined;
+        if (!config && !useADC && _projectId && localProjectId && localProjectId !== _projectId)
             throw new BadImplementationException(`Config for key ${_projectId} is not defined`);
         if (typeof config === "string")
             config = JSON.parse(readFileSync(config, "utf8"));
         if (config && (!config.client_email || !config.private_key))
             throw new BadImplementationException(`Config for key ${projectId} is not an Admin credentials pattern`);
-        session = new FirebaseSession_Admin(sessionName, config);
+        // Pass the resolved project id through so a keyless session can target a specific
+        // project rather than only the ambient one.
+        session = new FirebaseSession_Admin(sessionName, config, projectId);
         this.adminSessions[sessionName] = session;
         session.connect();
         return session;

package/dist/app-backend/FirebaseModule.js.map

@@ -1 +1 @@
-{"version":3,"file":"FirebaseModule.js","sourceRoot":"","sources":["../../src/main/app-backend/FirebaseModule.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,0BAA0B,EAC1B,8BAA8B,EAC9B,MAAM,EACN,4BAA4B,EAC/B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAC,qBAAqB,EAAC,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAC,YAAY,EAAC,MAAM,IAAI,CAAC;AAChC,OAAO,EAA8B,MAAM,4BAA4B,CAAC;AAiBxE,MAAM,OAAO,oBACT,SAAQ,MAAkB;IAE1B,uFAAuF;IACtE,aAAa,GAA4C,EAAE,CAAC;IACtE,MAAM,CAAC,kBAAkB,CAAS;IACzC,2DAA2D;IACnD,eAAe,CAAU;IAEjC;QACI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC5B,CAAC;IAED,iBAAiB;QACb,OAAO,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAC;IAChE,CAAC;IAEO,qBAAqB;QACzB,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,EAAE,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAEO,oBAAoB;QACxB,IAAI,SAAS,CAAC;QACd,IAAI,oBAAoB,CAAC,kBAAkB;YACvC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,kBAAkB,CAAC;gBACrD,MAAM,IAAI,8BAA8B,CAAC,sDAAsD,oBAAoB,CAAC,kBAAkB,EAAE,CAAC,CAAC;;gBAE1I,SAAS,GAAG,oBAAoB,CAAC,kBAAkB,CAAC;QAE5D,IAAI,CAAC,SAAS;YACV,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAExC,IAAI,CAAC,SAAS;YACV,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAE3C,IAAI,CAAC,SAAS;YACV,MAAM,IAAI,4BAA4B,CAAC,iCAAiC,CAAC,CAAC;QAE9E,OAAO,SAAS,CAAC;IACrB,CAAC;IAES,OAAO;QACb,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACjC,OAAO,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC;IAES,UAAU;QAChB,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACjC,OAAO,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC;IAEM,kBAAkB,CAAC,UAAmB,EAAE,YAAqB;QAChE,IAAI,SAAS,GAAG,UAAU,CAAC;QAC3B,IAAI,CAAC,SAAS;YACV,SAAS,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzC,MAAM,WAAW,GAAG,YAAY,IAAI,SAAS,IAAI,aAAa,CAAC;QAC/D,IAAI,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,OAAO;YACP,OAAO,OAAO,CAAC;QAEnB,IAAI,CAAC,OAAO,CAAC,6CAA6C,SAAS,EAAE,CAAC,CAAC;QACvE,IAAI,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,CAAkC,CAAC;QAC7E,MAAM,cAAc,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACpD,IAAI,CAAC,MAAM,IAAI,UAAU,IAAI,cAAc,IAAI,cAAc,KAAK,UAAU;YACxE,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,UAAU,iBAAiB,CAAC,CAAC;QAExF,IAAI,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAa,CAAC;QAElE,IAAI,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YACvD,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,SAAS,sCAAsC,CAAC,CAAC;QAE5G,OAAO,GAAG,IAAI,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC;QAE1C,OAAO,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,cAAc,CAAC,SAAiB;QAC5B,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;CACJ;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,oBAAoB,EAAE,CAAC"}
+{"version":3,"file":"FirebaseModule.js","sourceRoot":"","sources":["../../src/main/app-backend/FirebaseModule.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,0BAA0B,EAC1B,8BAA8B,EAC9B,MAAM,EACN,4BAA4B,EAC/B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAC,qBAAqB,EAAC,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAC,YAAY,EAAC,MAAM,IAAI,CAAC;AAChC,OAAO,EAA8B,MAAM,4BAA4B,CAAC;AAiBxE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AAErC,MAAM,OAAO,oBACT,SAAQ,MAAkB;IAE1B,uFAAuF;IACtE,aAAa,GAA4C,EAAE,CAAC;IACtE,MAAM,CAAC,kBAAkB,CAAS;IACzC,2DAA2D;IACnD,eAAe,CAAU;IAEjC;QACI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC5B,CAAC;IAED,iBAAiB;QACb,OAAO,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAC;IAChE,CAAC;IAEO,qBAAqB;QACzB,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,EAAE,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAEO,oBAAoB;QACxB,IAAI,SAAS,CAAC;QACd,IAAI,oBAAoB,CAAC,kBAAkB;YACvC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,kBAAkB,CAAC;gBACrD,MAAM,IAAI,8BAA8B,CAAC,sDAAsD,oBAAoB,CAAC,kBAAkB,EAAE,CAAC,CAAC;;gBAE1I,SAAS,GAAG,oBAAoB,CAAC,kBAAkB,CAAC;QAE5D,IAAI,CAAC,SAAS;YACV,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAExC,IAAI,CAAC,SAAS;YACV,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAE3C,IAAI,CAAC,SAAS;YACV,MAAM,IAAI,4BAA4B,CAAC,iCAAiC,CAAC,CAAC;QAE9E,OAAO,SAAS,CAAC;IACrB,CAAC;IAES,OAAO;QACb,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACjC,OAAO,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC;IAES,UAAU;QAChB,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACjC,OAAO,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC;IAEM,kBAAkB,CAAC,UAAmB,EAAE,YAAqB;QAChE,IAAI,SAAS,GAAG,UAAU,CAAC;QAC3B,IAAI,CAAC,SAAS;YACV,SAAS,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzC,MAAM,WAAW,GAAG,YAAY,IAAI,SAAS,IAAI,aAAa,CAAC;QAC/D,IAAI,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,OAAO;YACP,OAAO,OAAO,CAAC;QAEnB,IAAI,CAAC,OAAO,CAAC,6CAA6C,SAAS,EAAE,CAAC,CAAC;QACvE,IAAI,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,CAAkC,CAAC;QAC7E,MAAM,cAAc,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAEpD,kFAAkF;QAClF,MAAM,MAAM,GAAG,MAAM,KAAK,eAAe,CAAC;QAC1C,IAAI,MAAM;YACN,MAAM,GAAG,SAAS,CAAC;QAEvB,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,UAAU,IAAI,cAAc,IAAI,cAAc,KAAK,UAAU;YACnF,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,UAAU,iBAAiB,CAAC,CAAC;QAExF,IAAI,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAa,CAAC;QAElE,IAAI,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YACvD,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,SAAS,sCAAsC,CAAC,CAAC;QAE5G,kFAAkF;QAClF,4CAA4C;QAC5C,OAAO,GAAG,IAAI,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC;QAE1C,OAAO,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,cAAc,CAAC,SAAiB;QAC5B,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;CACJ;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,oBAAoB,EAAE,CAAC"}

package/dist/app-backend/auth/FirebaseSession_Admin.d.ts

@@ -5,10 +5,31 @@ import { type JWTInput } from "../FirebaseModule.js";
 export declare class FirebaseSession_Admin extends FirebaseSession<JWTInput & {
     databaseURL?: string;
 } | undefined, App> {
-    constructor(sessionName: string, config?: JWTInput);
+    private readonly projectId?;
+    /**
+     * @param projectId target project for a keyless (ADC) session. Ignored when `config`
+     *                  carries a service-account key, since the key already names its project.
+     */
+    constructor(sessionName: string, config?: JWTInput, projectId?: string | undefined);
     connect(): void;
     getProjectId(): string;
     private createApp;
+    /**
+     * An embedded service-account key that has been retired fails at token acquisition,
+     * so the error surfaces from whichever SDK call happened to run first — as an opaque
+     * `invalid_grant` from deep inside @google-cloud/storage or firestore, naming neither
+     * the project nor the account. That has cost real outage time: the same retired key
+     * lived in several configs at once, and nothing said which.
+     *
+     * Wrapping the credential puts one greppable line at the point of failure instead:
+     *
+     *   SA_KEY_UNUSABLE reason=key_revoked project=<id> sa=<email> session=<name> detail=<...>
+     *
+     * Alert on `SA_KEY_UNUSABLE` to catch a retired key the moment anything touches it,
+     * rather than when someone reports a 500. The original error is always rethrown, so
+     * behaviour is unchanged.
+     */
+    private reportUnusableKey;
     getAuth(): Auth;
 }
 //# sourceMappingURL=FirebaseSession_Admin.d.ts.map

package/dist/app-backend/auth/FirebaseSession_Admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"FirebaseSession_Admin.d.ts","sourceRoot":"","sources":["../../../src/main/app-backend/auth/FirebaseSession_Admin.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EACN,IAAI,EAEJ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,KAAK,GAAG,EAER,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAC,KAAK,QAAQ,EAAC,MAAM,sBAAsB,CAAC;AAEnD,qBAAa,qBACZ,SAAQ,eAAe,CAAC,QAAQ,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EAAE,GAAG,CAAC;gBAEjE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ;IAI3C,OAAO,IAAI,IAAI;IAItB,YAAY,IAAI,MAAM;IActB,OAAO,CAAC,SAAS;IAWV,OAAO,IAAI,IAAI;CAGtB"}
+{"version":3,"file":"FirebaseSession_Admin.d.ts","sourceRoot":"","sources":["../../../src/main/app-backend/auth/FirebaseSession_Admin.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EACN,IAAI,EAEJ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,KAAK,GAAG,EAGR,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAC,KAAK,QAAQ,EAAC,MAAM,sBAAsB,CAAC;AAwBnD,qBAAa,qBACZ,SAAQ,eAAe,CAAC,QAAQ,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EAAE,GAAG,CAAC;IAMzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAJ/E;;;OAGG;gBACS,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAmB,SAAS,CAAC,EAAE,MAAM,YAAA;IAIhF,OAAO,IAAI,IAAI;IAItB,YAAY,IAAI,MAAM;IAmBtB,OAAO,CAAC,SAAS;IAsBjB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,iBAAiB;IA8BlB,OAAO,IAAI,IAAI;CAGtB"}

package/dist/app-backend/auth/FirebaseSession_Admin.js

@@ -25,15 +25,42 @@ import { ThisShouldNotHappenException } from "@intuitionrobotics/ts-common";
 import { Auth, getAuth } from "firebase-admin/auth";
 import { initializeApp } from "firebase-admin/app";
 import {} from "../FirebaseModule.js";
+/**
+ * Distinguish the ways an embedded service-account key stops working, so a log search
+ * can tell "someone deleted the key" from "someone deleted the whole account" from
+ * "the stored PEM is corrupt" without reading stack traces.
+ */
+const classifyKeyFailure = (message) => {
+    if (/DECODER routines|unsupported|Failed to parse private key|PEM/i.test(message))
+        return "malformed_key";
+    if (/invalid_grant/i.test(message)) {
+        if (/Invalid JWT Signature/i.test(message))
+            return "key_revoked"; // key material no longer matches the account
+        if (/account not found|Invalid grant: account/i.test(message))
+            return "account_deleted"; // the service account itself is gone
+        return "invalid_grant";
+    }
+    return "unknown";
+};
 export class FirebaseSession_Admin extends FirebaseSession {
-    constructor(sessionName, config) {
+    projectId;
+    /**
+     * @param projectId target project for a keyless (ADC) session. Ignored when `config`
+     *                  carries a service-account key, since the key already names its project.
+     */
+    constructor(sessionName, config, projectId) {
         super(config, sessionName);
+        this.projectId = projectId;
     }
     connect() {
         this.app = this.createApp();
     }
     getProjectId() {
         if (!this.config) {
+            // Keyless session: prefer the project it was explicitly created for, and only
+            // fall back to the ambient project of the running function.
+            if (this.projectId)
+                return this.projectId;
             if (!process.env.GCLOUD_PROJECT)
                 throw new ThisShouldNotHappenException("Could not deduce project id from function const!!");
             return process.env.GCLOUD_PROJECT;
@@ -43,14 +70,67 @@ export class FirebaseSession_Admin extends FirebaseSession {
         return this.config.project_id;
     }
     createApp() {
-        if (!this.config)
-            return initializeApp(undefined, this.sessionName);
+        // No key: authenticate with Application Default Credentials.
+        if (!this.config) {
+            // Passing options makes firebase-admin ignore FIREBASE_CONFIG, which is where
+            // Cloud Functions supplies databaseURL (and RTDB instances are not uniformly
+            // `<project>.firebaseio.com` — newer ones are `<project>-default-rtdb`). So for
+            // the ambient project keep passing undefined and let the SDK self-configure;
+            // name the project only when it genuinely differs.
+            const ambient = process.env.GCLOUD_PROJECT || process.env.GCP_PROJECT;
+            if (!this.projectId || this.projectId === ambient)
+                return initializeApp(undefined, this.sessionName);
+            return initializeApp({ projectId: this.projectId }, this.sessionName);
+        }
         const databaseURL = this.config.databaseURL || `https://${this.config.project_id}.firebaseio.com`;
         return initializeApp({
-            credential: credential.cert(this.config),
+            credential: this.reportUnusableKey(credential.cert(this.config)),
             databaseURL: databaseURL
         }, this.sessionName);
     }
+    /**
+     * An embedded service-account key that has been retired fails at token acquisition,
+     * so the error surfaces from whichever SDK call happened to run first — as an opaque
+     * `invalid_grant` from deep inside @google-cloud/storage or firestore, naming neither
+     * the project nor the account. That has cost real outage time: the same retired key
+     * lived in several configs at once, and nothing said which.
+     *
+     * Wrapping the credential puts one greppable line at the point of failure instead:
+     *
+     *   SA_KEY_UNUSABLE reason=key_revoked project=<id> sa=<email> session=<name> detail=<...>
+     *
+     * Alert on `SA_KEY_UNUSABLE` to catch a retired key the moment anything touches it,
+     * rather than when someone reports a 500. The original error is always rethrown, so
+     * behaviour is unchanged.
+     */
+    reportUnusableKey(cred) {
+        const describe = `project=${this.config?.project_id} sa=${this.config?.client_email} session=${this.sessionName}`;
+        const getAccessToken = cred.getAccessToken.bind(cred);
+        // Patch the existing credential IN PLACE rather than returning a wrapper object.
+        // firebase-admin picks its custom-token signer by prototype, not by shape:
+        //
+        //   if (credential instanceof ServiceAccountCredential)
+        //       return new ServiceAccountSigner(credential);
+        //   return new IAMSigner(...);              // utils/crypto-signer
+        //
+        // A plain `{getAccessToken}` satisfies the Credential *type* but fails that
+        // instanceof, which silently downgrades createCustomToken from signing locally
+        // with the embedded key to an iamcredentials signBlob call the runtime service
+        // account is usually not permitted to make -- breaking token minting for every
+        // key-backed project. Mutating the real credential keeps its prototype intact.
+        cred.getAccessToken = async () => {
+            try {
+                return await getAccessToken();
+            }
+            catch (e) {
+                const message = (e instanceof Error ? e.message : String(e)) || "";
+                const firstLine = message.split("\n")[0];
+                this.logError(`SA_KEY_UNUSABLE reason=${classifyKeyFailure(message)} ${describe} detail=${firstLine}`);
+                throw e;
+            }
+        };
+        return cred;
+    }
     getAuth() {
         return getAuth(this.app);
     }

package/dist/app-backend/auth/FirebaseSession_Admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"FirebaseSession_Admin.js","sourceRoot":"","sources":["../../../src/main/app-backend/auth/FirebaseSession_Admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,oEAAoE;AACpE,mEAAmE;AACnE,OAAO,KAAK,MAAM,gBAAgB,CAAC;AACnC,OAAO,EAAqB,MAAM,gBAAgB,CAAC;AACnD,MAAM,EAAC,UAAU,EAAC,GAAG,KAAK,CAAC;AAC3B,OAAO,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAC,4BAA4B,EAAC,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EACN,IAAI,EACJ,OAAO,EACP,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEN,aAAa,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAe,MAAM,sBAAsB,CAAC;AAEnD,MAAM,OAAO,qBACZ,SAAQ,eAAqE;IAE7E,YAAY,WAAmB,EAAE,MAAiB;QACjD,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC5B,CAAC;IAEM,OAAO;QACb,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,YAAY;QACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc;gBAC9B,MAAM,IAAI,4BAA4B,CAAC,mDAAmD,CAAC,CAAA;YAE5F,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACnC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU;YAC1B,MAAM,IAAI,4BAA4B,CAAC,0GAA0G,CAAC,CAAA;QAEnJ,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;IAC/B,CAAC;IAEO,SAAS;QAChB,IAAI,CAAC,IAAI,CAAC,MAAM;YACf,OAAO,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAEnD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,WAAW,IAAI,CAAC,MAAM,CAAC,UAAU,iBAAiB,CAAC;QAClG,OAAO,aAAa,CAAC;YACC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAwB,CAAC;YAC1D,WAAW,EAAE,WAAW;SACxB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;IAEM,OAAO;QACb,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;CACD"}
+{"version":3,"file":"FirebaseSession_Admin.js","sourceRoot":"","sources":["../../../src/main/app-backend/auth/FirebaseSession_Admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,oEAAoE;AACpE,mEAAmE;AACnE,OAAO,KAAK,MAAM,gBAAgB,CAAC;AACnC,OAAO,EAAqB,MAAM,gBAAgB,CAAC;AACnD,MAAM,EAAC,UAAU,EAAC,GAAG,KAAK,CAAC;AAC3B,OAAO,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAC,4BAA4B,EAAC,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EACN,IAAI,EACJ,OAAO,EACP,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGN,aAAa,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAe,MAAM,sBAAsB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAU,EAAE;IACtD,IAAI,+DAA+D,CAAC,IAAI,CAAC,OAAO,CAAC;QAChF,OAAO,eAAe,CAAC;IAExB,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC;YACzC,OAAO,aAAa,CAAC,CAAQ,6CAA6C;QAE3E,IAAI,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC;YAC5D,OAAO,iBAAiB,CAAC,CAAI,qCAAqC;QAEnE,OAAO,eAAe,CAAC;IACxB,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,OAAO,qBACZ,SAAQ,eAAqE;IAMR;IAJrE;;;OAGG;IACH,YAAY,WAAmB,EAAE,MAAiB,EAAmB,SAAkB;QACtF,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QADyC,cAAS,GAAT,SAAS,CAAS;IAEvF,CAAC;IAEM,OAAO;QACb,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,YAAY;QACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClB,8EAA8E;YAC9E,4DAA4D;YAC5D,IAAI,IAAI,CAAC,SAAS;gBACjB,OAAO,IAAI,CAAC,SAAS,CAAC;YAEvB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc;gBAC9B,MAAM,IAAI,4BAA4B,CAAC,mDAAmD,CAAC,CAAA;YAE5F,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACnC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU;YAC1B,MAAM,IAAI,4BAA4B,CAAC,0GAA0G,CAAC,CAAA;QAEnJ,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;IAC/B,CAAC;IAEO,SAAS;QAChB,6DAA6D;QAC7D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClB,8EAA8E;YAC9E,6EAA6E;YAC7E,gFAAgF;YAChF,6EAA6E;YAC7E,mDAAmD;YACnD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YACtE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO;gBAChD,OAAO,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YAEnD,OAAO,aAAa,CAAC,EAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,WAAW,IAAI,CAAC,MAAM,CAAC,UAAU,iBAAiB,CAAC;QAClG,OAAO,aAAa,CAAC;YACC,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAwB,CAAC,CAAC;YAClF,WAAW,EAAE,WAAW;SACxB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,iBAAiB,CAAC,IAAgB;QACzC,MAAM,QAAQ,GAAG,WAAW,IAAI,CAAC,MAAM,EAAE,UAAU,OAAO,IAAI,CAAC,MAAM,EAAE,YAAY,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;QAClH,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtD,iFAAiF;QACjF,2EAA2E;QAC3E,EAAE;QACF,wDAAwD;QACxD,qDAAqD;QACrD,mEAAmE;QACnE,EAAE;QACF,4EAA4E;QAC5E,+EAA+E;QAC/E,+EAA+E;QAC/E,+EAA+E;QAC/E,+EAA+E;QAC/E,IAAI,CAAC,cAAc,GAAG,KAAK,IAAI,EAAE;YAChC,IAAI,CAAC;gBACJ,OAAO,MAAM,cAAc,EAAE,CAAC;YAC/B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACZ,MAAM,OAAO,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACnE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,kBAAkB,CAAC,OAAO,CAAC,IAAI,QAAQ,WAAW,SAAS,EAAE,CAAC,CAAC;gBACvG,MAAM,CAAC,CAAC;YACT,CAAC;QACF,CAAC,CAAC;QAEF,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,OAAO;QACb,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;CACD"}