firebase-tools 10.1.3 → 10.2.1

package/lib/extensions/listExtensions.js

@@ -8,6 +8,7 @@ const extensionsApi_1 = require("./extensionsApi");
 const extensionsHelper_1 = require("./extensionsHelper");
 const utils = require("../utils");
 const extensionsUtils = require("./utils");
+const logger_1 = require("../logger");
 async function listExtensions(projectId) {
     const instances = await (0, extensionsApi_1.listInstances)(projectId);
     if (instances.length < 1) {
@@ -47,6 +48,7 @@ async function listExtensions(projectId) {
         });
     });
     utils.logLabeledBullet(extensionsHelper_1.logPrefix, `list of extensions installed in ${clc.bold(projectId)}:`);
+    logger_1.logger.info(table.toString());
     return formatted;
 }
 exports.listExtensions = listExtensions;

package/lib/extensions/resolveSource.js

@@ -1,63 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getTrustedPublishers = exports.getExtensionRegistry = exports.getMinRequiredVersion = exports.getTargetVersion = exports.resolveRegistryEntry = exports.isOfficialSource = exports.resolveSourceUrl = exports.confirmUpdateWarning = void 0;
+exports.getTrustedPublishers = exports.getExtensionRegistry = void 0;
 const _ = require("lodash");
-const clc = require("cli-color");
-const { marked } = require("marked");
-const error_1 = require("../error");
 const logger_1 = require("../logger");
-const prompt_1 = require("../prompt");
 const apiv2_1 = require("../apiv2");
 const api_1 = require("../api");
 const EXTENSIONS_REGISTRY_ENDPOINT = "/extensions.json";
-async function confirmUpdateWarning(updateWarning) {
-    logger_1.logger.info(marked(updateWarning.description));
-    if (updateWarning.action) {
-        logger_1.logger.info(marked(updateWarning.action));
-    }
-    const continueUpdate = await (0, prompt_1.promptOnce)({
-        type: "confirm",
-        message: "Do you wish to continue with this update?",
-        default: false,
-    });
-    if (!continueUpdate) {
-        throw new error_1.FirebaseError(`Update cancelled.`, { exit: 2 });
-    }
-}
-exports.confirmUpdateWarning = confirmUpdateWarning;
-function resolveSourceUrl(registryEntry, name, version) {
-    const targetVersion = getTargetVersion(registryEntry, version);
-    const sourceUrl = _.get(registryEntry, ["versions", targetVersion]);
-    if (!sourceUrl) {
-        throw new error_1.FirebaseError(`Could not find version ${clc.bold(version)} of extension ${clc.bold(name)}.`);
-    }
-    return sourceUrl;
-}
-exports.resolveSourceUrl = resolveSourceUrl;
-function isOfficialSource(registryEntry, sourceUrl) {
-    const versions = _.get(registryEntry, "versions");
-    return _.includes(versions, sourceUrl);
-}
-exports.isOfficialSource = isOfficialSource;
-async function resolveRegistryEntry(name) {
-    const extensionsRegistry = await getExtensionRegistry();
-    const registryEntry = _.get(extensionsRegistry, name);
-    if (!registryEntry) {
-        throw new error_1.FirebaseError(`Unable to find extension source named ${clc.bold(name)}.`);
-    }
-    return registryEntry;
-}
-exports.resolveRegistryEntry = resolveRegistryEntry;
-function getTargetVersion(registryEntry, versionOrLabel) {
-    const seekVersion = versionOrLabel || "latest";
-    const versionFromLabel = _.get(registryEntry, ["labels", seekVersion]);
-    return versionFromLabel || seekVersion;
-}
-exports.getTargetVersion = getTargetVersion;
-function getMinRequiredVersion(registryEntry) {
-    return _.get(registryEntry, ["labels", "minRequired"]);
-}
-exports.getMinRequiredVersion = getMinRequiredVersion;
 async function getExtensionRegistry(onlyFeatured) {
     const client = new apiv2_1.Client({ urlPrefix: api_1.firebaseExtensionsRegistryOrigin });
     const res = await client.get(EXTENSIONS_REGISTRY_ENDPOINT);

package/lib/extensions/secretsUtils.js

@@ -22,7 +22,7 @@ async function grantFirexServiceAgentSecretAdminRole(secret) {
     const projectNumber = await (0, getProjectNumber_1.getProjectNumber)({ projectId: secret.projectId });
     const firexSaProjectId = utils.envOverride("FIREBASE_EXTENSIONS_SA_PROJECT_ID", "gcp-sa-firebasemods");
     const saEmail = `service-${projectNumber}@${firexSaProjectId}.iam.gserviceaccount.com`;
-    return secretManagerApi.grantServiceAgentRole(secret, saEmail, "roles/secretmanager.admin");
+    return secretManagerApi.ensureServiceAgentRole(secret, [saEmail], "roles/secretmanager.admin");
 }
 exports.grantFirexServiceAgentSecretAdminRole = grantFirexServiceAgentSecretAdminRole;
 async function getManagedSecrets(instance) {

package/lib/extensions/updateHelper.js

@@ -6,7 +6,6 @@ const semver = require("semver");
 const { marked } = require("marked");
 const error_1 = require("../error");
 const logger_1 = require("../logger");
-const resolveSource = require("./resolveSource");
 const extensionsApi = require("./extensionsApi");
 const refs = require("./refs");
 const extensionsHelper_1 = require("./extensionsHelper");
@@ -123,19 +122,6 @@ async function updateToVersionFromPublisherSource(projectId, instanceId, extVers
     catch (err) {
         throw new error_1.FirebaseError(`Could not find source '${clc.bold(extVersionRef)}' because (${clc.bold(version)}) is not a published version. To update, use the latest version of this extension (${clc.bold(extension.latestVersion)}).`);
     }
-    let registryEntry;
-    try {
-        registryEntry = await resolveSource.resolveRegistryEntry(existingSpec.name);
-    }
-    catch (err) {
-        logger_1.logger.debug(`Unable to fetch registry.json entry for ${existingSpec.name}`);
-    }
-    if (registryEntry) {
-        const minVer = resolveSource.getMinRequiredVersion(registryEntry);
-        if (minVer && semver.gt(minVer, source.spec.version)) {
-            throw new error_1.FirebaseError(`The version you are trying to update to (${clc.bold(source.spec.version)}) is less than the minimum version required (${clc.bold(minVer)}) to use this extension.`);
-        }
-    }
     showUpdateVersionInfo(instanceId, existingSpec.version, source.spec.version, extVersionRef);
     warningUpdateToOtherSource(extensionsHelper_1.SourceOrigin.PUBLISHED_EXTENSION);
     const releaseNotes = await changelog.getReleaseNotesForUpdate({

package/lib/extensions/utils.js

@@ -22,12 +22,14 @@ function convertExtensionOptionToLabeledList(options) {
 }
 exports.convertExtensionOptionToLabeledList = convertExtensionOptionToLabeledList;
 function convertOfficialExtensionsToList(officialExts) {
-    return _.map(officialExts, (entry, key) => {
+    const l = _.map(officialExts, (entry, key) => {
         return {
             checked: false,
-            value: key,
+            value: `${entry.publisher}/${key}`,
         };
     });
+    l.sort((a, b) => a.value.localeCompare(b.value));
+    return l;
 }
 exports.convertOfficialExtensionsToList = convertOfficialExtensionsToList;
 function getRandomString(length) {

package/lib/functions/env.js

@@ -1,14 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.loadFirebaseEnvs = exports.loadUserEnvs = exports.hasUserEnvs = exports.validateKey = exports.KeyValidationError = exports.parse = void 0;
+exports.loadFirebaseEnvs = exports.loadUserEnvs = exports.hasUserEnvs = exports.parseStrict = exports.validateKey = exports.KeyValidationError = exports.parse = void 0;
 const clc = require("cli-color");
 const fs = require("fs");
 const path = require("path");
 const error_1 = require("../error");
 const logger_1 = require("../logger");
-const previews_1 = require("../previews");
 const utils_1 = require("../utils");
 const FUNCTIONS_EMULATOR_DOTENV = ".env.local";
+const RESERVED_PREFIXES = ["X_GOOGLE_", "FIREBASE_", "EXT_"];
 const RESERVED_KEYS = [
     "FIREBASE_CONFIG",
     "CLOUD_RUNTIME_CONFIG",
@@ -87,8 +87,8 @@ function validateKey(key) {
         throw new KeyValidationError(key, `Key ${key} must start with an uppercase ASCII letter or underscore` +
             ", and then consist of uppercase ASCII letters, digits, and underscores.");
     }
-    if (key.startsWith("X_GOOGLE_") || key.startsWith("FIREBASE_")) {
-        throw new KeyValidationError(key, `Key ${key} starts with a reserved prefix (X_GOOGLE_ or FIREBASE_)`);
+    if (RESERVED_PREFIXES.some((prefix) => key.startsWith(prefix))) {
+        throw new KeyValidationError(key, `Key ${key} starts with a reserved prefix (${RESERVED_PREFIXES.join(" ")})`);
     }
 }
 exports.validateKey = validateKey;
@@ -117,6 +117,7 @@ function parseStrict(data) {
     }
     return envs;
 }
+exports.parseStrict = parseStrict;
 function findEnvfiles(functionsSource, projectId, projectAlias, isEmulator) {
     const files = [".env"];
     if (isEmulator) {
@@ -139,9 +140,6 @@ function hasUserEnvs({ functionsSource, projectId, projectAlias, isEmulator, })
 exports.hasUserEnvs = hasUserEnvs;
 function loadUserEnvs({ functionsSource, projectId, projectAlias, isEmulator, }) {
     var _a;
-    if (!previews_1.previews.dotenv) {
-        return {};
-    }
     const envFiles = findEnvfiles(functionsSource, projectId, projectAlias, isEmulator);
     if (envFiles.length == 0) {
         return {};

package/lib/functions/secrets.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pruneSecrets = exports.of = exports.ensureSecret = exports.ensureValidKey = exports.labels = exports.isFirebaseManaged = void 0;
+const secretManager_1 = require("../gcp/secretManager");
+const error_1 = require("../error");
+const utils_1 = require("../utils");
+const prompt_1 = require("../prompt");
+const env_1 = require("./env");
+const FIREBASE_MANGED = "firebase-managed";
+function isFirebaseManaged(secret) {
+    return Object.keys(secret.labels || []).includes(FIREBASE_MANGED);
+}
+exports.isFirebaseManaged = isFirebaseManaged;
+function labels() {
+    return { [FIREBASE_MANGED]: "true" };
+}
+exports.labels = labels;
+function toUpperSnakeCase(key) {
+    return key
+        .replace("-", "_")
+        .replace(".", "_")
+        .replace(/([a-z])([A-Z])/g, "$1_$2")
+        .toUpperCase();
+}
+async function ensureValidKey(key, options) {
+    const transformedKey = toUpperSnakeCase(key);
+    if (transformedKey !== key) {
+        if (options.force) {
+            throw new error_1.FirebaseError("Secret key must be in UPPER_SNAKE_CASE.");
+        }
+        (0, utils_1.logWarning)(`By convention, secret key must be in UPPER_SNAKE_CASE.`);
+        const confirm = await (0, prompt_1.promptOnce)({
+            name: "updateKey",
+            type: "confirm",
+            default: true,
+            message: `Would you like to use ${transformedKey} as key instead?`,
+        }, options);
+        if (!confirm) {
+            throw new error_1.FirebaseError("Secret key must be in UPPER_SNAKE_CASE.");
+        }
+    }
+    try {
+        (0, env_1.validateKey)(transformedKey);
+    }
+    catch (err) {
+        throw new error_1.FirebaseError(`Invalid secret key ${transformedKey}`, { children: [err] });
+    }
+    return transformedKey;
+}
+exports.ensureValidKey = ensureValidKey;
+async function ensureSecret(projectId, name, options) {
+    try {
+        const secret = await (0, secretManager_1.getSecret)(projectId, name);
+        if (!isFirebaseManaged(secret)) {
+            if (!options.force) {
+                (0, utils_1.logWarning)("Your secret is not managed by Firebase. " +
+                    "Firebase managed secrets are automatically pruned to reduce your monthly cost for using Secret Manager. ");
+                const confirm = await (0, prompt_1.promptOnce)({
+                    name: "updateLabels",
+                    type: "confirm",
+                    default: true,
+                    message: `Would you like to have your secret ${secret.name} managed by Firebase?`,
+                }, options);
+                if (confirm) {
+                    return (0, secretManager_1.patchSecret)(projectId, secret.name, Object.assign(Object.assign({}, secret.labels), labels()));
+                }
+            }
+        }
+        return secret;
+    }
+    catch (err) {
+        if (err.status !== 404) {
+            throw err;
+        }
+    }
+    return await (0, secretManager_1.createSecret)(projectId, name, labels());
+}
+exports.ensureSecret = ensureSecret;
+function of(endpoints) {
+    return endpoints.reduce((envs, endpoint) => [...envs, ...(endpoint.secretEnvironmentVariables || [])], []);
+}
+exports.of = of;
+async function pruneSecrets(projectInfo, endpoints) {
+    const { projectId, projectNumber } = projectInfo;
+    const pruneKey = (name, version) => `${name}@${version}`;
+    const prunedSecrets = new Set();
+    const haveSecrets = await (0, secretManager_1.listSecrets)(projectId, `labels.${FIREBASE_MANGED}=true`);
+    for (const secret of haveSecrets) {
+        const versions = await (0, secretManager_1.listSecretVersions)(projectId, secret.name, `state: ENABLED`);
+        for (const version of versions) {
+            prunedSecrets.add(pruneKey(secret.name, version.versionId));
+        }
+    }
+    const sevs = of(endpoints).filter((sev) => sev.projectId === projectId || sev.projectId === projectNumber);
+    for (const sev of sevs) {
+        let name = sev.secret;
+        if (name.includes("/")) {
+            const secret = (0, secretManager_1.parseSecretResourceName)(name);
+            name = secret.name;
+        }
+        let version = sev.version;
+        if (version === "latest") {
+            const resolved = await (0, secretManager_1.getSecretVersion)(projectId, name, version);
+            version = resolved.versionId;
+        }
+        prunedSecrets.delete(pruneKey(name, version));
+    }
+    return Array.from(prunedSecrets)
+        .map((key) => key.split("@"))
+        .map(([secret, version]) => ({ projectId, version, secret, key: secret }));
+}
+exports.pruneSecrets = pruneSecrets;

package/lib/gcp/cloudfunctions.js

@@ -240,7 +240,7 @@ function endpointFromFunction(gcfFunction) {
     if (uri) {
         endpoint.uri = uri;
     }
-    proto.copyIfPresent(endpoint, gcfFunction, "serviceAccountEmail", "availableMemoryMb", "timeout", "minInstances", "maxInstances", "vpcConnector", "vpcConnectorEgressSettings", "ingressSettings", "labels", "environmentVariables", "sourceUploadUrl");
+    proto.copyIfPresent(endpoint, gcfFunction, "serviceAccountEmail", "availableMemoryMb", "timeout", "minInstances", "maxInstances", "vpcConnector", "vpcConnectorEgressSettings", "ingressSettings", "labels", "environmentVariables", "secretEnvironmentVariables", "sourceUploadUrl");
     return endpoint;
 }
 exports.endpointFromFunction = endpointFromFunction;
@@ -283,7 +283,7 @@ function functionFromEndpoint(endpoint, sourceUploadUrl) {
     else {
         gcfFunction.httpsTrigger = {};
     }
-    proto.copyIfPresent(gcfFunction, endpoint, "serviceAccountEmail", "timeout", "availableMemoryMb", "minInstances", "maxInstances", "vpcConnector", "vpcConnectorEgressSettings", "ingressSettings", "environmentVariables");
+    proto.copyIfPresent(gcfFunction, endpoint, "serviceAccountEmail", "timeout", "availableMemoryMb", "minInstances", "maxInstances", "vpcConnector", "vpcConnectorEgressSettings", "ingressSettings", "environmentVariables", "secretEnvironmentVariables");
     return gcfFunction;
 }
 exports.functionFromEndpoint = functionFromEndpoint;

package/lib/gcp/secretManager.js

@@ -1,30 +1,88 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.grantServiceAgentRole = exports.addVersion = exports.createSecret = exports.toSecretVersionResourceName = exports.parseSecretVersionResourceName = exports.parseSecretResourceName = exports.secretExists = exports.getSecretVersion = exports.getSecret = exports.listSecrets = exports.secretManagerConsoleUri = void 0;
+exports.ensureServiceAgentRole = exports.setIamPolicy = exports.getIamPolicy = exports.addVersion = exports.deleteSecret = exports.patchSecret = exports.createSecret = exports.toSecretVersionResourceName = exports.parseSecretVersionResourceName = exports.parseSecretResourceName = exports.secretExists = exports.destroySecretVersion = exports.accessSecretVersion = exports.getSecretVersion = exports.listSecretVersions = exports.listSecrets = exports.getSecret = exports.secretManagerConsoleUri = void 0;
 const utils_1 = require("../utils");
-const api_1 = require("../api");
+const error_1 = require("../error");
 const apiv2_1 = require("../apiv2");
+const api_1 = require("../api");
+const SECRET_NAME_REGEX = new RegExp("projects\\/" +
+    "(?<project>(?:\\d+)|(?:[A-Za-z]+[A-Za-z\\d-]*[A-Za-z\\d]?))\\/" +
+    "secrets\\/" +
+    "(?<secret>[A-Za-z\\d\\-_]+)");
+const SECRET_VERSION_NAME_REGEX = new RegExp(SECRET_NAME_REGEX.source + "\\/versions\\/" + "(?<version>latest|[0-9]+)");
 const secretManagerConsoleUri = (projectId) => `https://console.cloud.google.com/security/secret-manager?project=${projectId}`;
 exports.secretManagerConsoleUri = secretManagerConsoleUri;
-const apiClient = new apiv2_1.Client({ urlPrefix: api_1.secretManagerOrigin, apiVersion: "v1beta1" });
-async function listSecrets(projectId) {
-    const listRes = await apiClient.get(`/projects/${projectId}/secrets`);
-    return listRes.body.secrets.map((s) => parseSecretResourceName(s.name));
-}
-exports.listSecrets = listSecrets;
+const API_VERSION = "v1";
+const client = new apiv2_1.Client({ urlPrefix: api_1.secretManagerOrigin, apiVersion: API_VERSION });
 async function getSecret(projectId, name) {
     var _a;
-    const getRes = await apiClient.get(`/projects/${projectId}/secrets/${name}`);
+    const getRes = await client.get(`projects/${projectId}/secrets/${name}`);
     const secret = parseSecretResourceName(getRes.body.name);
     secret.labels = (_a = getRes.body.labels) !== null && _a !== void 0 ? _a : {};
     return secret;
 }
 exports.getSecret = getSecret;
+async function listSecrets(projectId, filter) {
+    var _a;
+    const secrets = [];
+    const path = `projects/${projectId}/secrets`;
+    const baseOpts = filter ? { queryParams: { filter } } : {};
+    let pageToken = "";
+    while (true) {
+        const opts = pageToken === ""
+            ? baseOpts
+            : Object.assign(Object.assign({}, baseOpts), { queryParams: Object.assign(Object.assign({}, baseOpts === null || baseOpts === void 0 ? void 0 : baseOpts.queryParams), { pageToken }) });
+        const res = await client.get(path, opts);
+        for (const s of res.body.secrets) {
+            secrets.push(Object.assign(Object.assign({}, parseSecretResourceName(s.name)), { labels: (_a = s.labels) !== null && _a !== void 0 ? _a : {} }));
+        }
+        if (!res.body.nextPageToken) {
+            break;
+        }
+        pageToken = res.body.nextPageToken;
+    }
+    return secrets;
+}
+exports.listSecrets = listSecrets;
+async function listSecretVersions(projectId, name, filter) {
+    const secrets = [];
+    const path = `projects/${projectId}/secrets/${name}/versions`;
+    const baseOpts = filter ? { queryParams: { filter } } : {};
+    let pageToken = "";
+    while (true) {
+        const opts = pageToken === ""
+            ? baseOpts
+            : Object.assign(Object.assign({}, baseOpts), { queryParams: Object.assign(Object.assign({}, baseOpts === null || baseOpts === void 0 ? void 0 : baseOpts.queryParams), { pageToken }) });
+        const res = await client.get(path, opts);
+        for (const s of res.body.versions || []) {
+            secrets.push(Object.assign(Object.assign({}, parseSecretVersionResourceName(s.name)), { state: s.state }));
+        }
+        if (!res.body.nextPageToken) {
+            break;
+        }
+        pageToken = res.body.nextPageToken;
+    }
+    return secrets;
+}
+exports.listSecretVersions = listSecretVersions;
 async function getSecretVersion(projectId, name, version) {
-    const getRes = await apiClient.get(`/projects/${projectId}/secrets/${name}/versions/${version}`);
-    return parseSecretVersionResourceName(getRes.body.name);
+    const getRes = await client.get(`projects/${projectId}/secrets/${name}/versions/${version}`);
+    return Object.assign(Object.assign({}, parseSecretVersionResourceName(getRes.body.name)), { state: getRes.body.state });
 }
 exports.getSecretVersion = getSecretVersion;
+async function accessSecretVersion(projectId, name, version) {
+    const res = await client.get(`projects/${projectId}/secrets/${name}/versions/${version}:access`);
+    return Buffer.from(res.body.payload.data, "base64").toString();
+}
+exports.accessSecretVersion = accessSecretVersion;
+async function destroySecretVersion(projectId, name, version) {
+    if (version === "latest") {
+        const sv = await getSecretVersion(projectId, name, "latest");
+        version = sv.versionId;
+    }
+    await client.post(`projects/${projectId}/secrets/${name}/versions/${version}:destroy`);
+}
+exports.destroySecretVersion = destroySecretVersion;
 async function secretExists(projectId, name) {
     try {
         await getSecret(projectId, name);
@@ -39,21 +97,27 @@ async function secretExists(projectId, name) {
 }
 exports.secretExists = secretExists;
 function parseSecretResourceName(resourceName) {
-    const nameTokens = resourceName.split("/");
+    const match = SECRET_NAME_REGEX.exec(resourceName);
+    if (!(match === null || match === void 0 ? void 0 : match.groups)) {
+        throw new error_1.FirebaseError(`Invalid secret resource name [${resourceName}].`);
+    }
     return {
-        projectId: nameTokens[1],
-        name: nameTokens[3],
+        projectId: match.groups.project,
+        name: match.groups.secret,
     };
 }
 exports.parseSecretResourceName = parseSecretResourceName;
 function parseSecretVersionResourceName(resourceName) {
-    const nameTokens = resourceName.split("/");
+    const match = resourceName.match(SECRET_VERSION_NAME_REGEX);
+    if (!(match === null || match === void 0 ? void 0 : match.groups)) {
+        throw new error_1.FirebaseError(`Invalid secret version resource name [${resourceName}].`);
+    }
     return {
         secret: {
-            projectId: nameTokens[1],
-            name: nameTokens[3],
+            projectId: match.groups.project,
+            name: match.groups.secret,
         },
-        versionId: nameTokens[5],
+        versionId: match.groups.version,
     };
 }
 exports.parseSecretVersionResourceName = parseSecretVersionResourceName;
@@ -62,7 +126,8 @@ function toSecretVersionResourceName(secretVersion) {
 }
 exports.toSecretVersionResourceName = toSecretVersionResourceName;
 async function createSecret(projectId, name, labels) {
-    const createRes = await apiClient.post(`/projects/${projectId}/secrets`, {
+    const createRes = await client.post(`projects/${projectId}/secrets`, {
+        name,
         replication: {
             automatic: {},
         },
@@ -71,41 +136,58 @@ async function createSecret(projectId, name, labels) {
     return parseSecretResourceName(createRes.body.name);
 }
 exports.createSecret = createSecret;
-async function addVersion(secret, payloadData) {
-    const res = await apiClient.post(`/projects/${secret.projectId}/secrets/${secret.name}:addVersion`, {
+async function patchSecret(projectId, name, labels) {
+    const fullName = `projects/${projectId}/secrets/${name}`;
+    const res = await client.patch(fullName, { name: fullName, labels }, { queryParams: { updateMask: "labels" } });
+    return parseSecretResourceName(res.body.name);
+}
+exports.patchSecret = patchSecret;
+async function deleteSecret(projectId, name) {
+    const path = `projects/${projectId}/secrets/${name}`;
+    await client.delete(path);
+}
+exports.deleteSecret = deleteSecret;
+async function addVersion(projectId, name, payloadData) {
+    const res = await client.post(`projects/${projectId}/secrets/${name}:addVersion`, {
         payload: {
             data: Buffer.from(payloadData).toString("base64"),
         },
     });
-    const nameTokens = res.body.name.split("/");
-    return {
-        secret: {
-            projectId: nameTokens[1],
-            name: nameTokens[3],
-        },
-        versionId: nameTokens[5],
-    };
+    return Object.assign(Object.assign({}, parseSecretVersionResourceName(res.body.name)), { state: res.body.state });
 }
 exports.addVersion = addVersion;
-async function grantServiceAgentRole(secret, serviceAccountEmail, role) {
-    const getPolicyRes = await apiClient.get(`/projects/${secret.projectId}/secrets/${secret.name}:getIamPolicy`);
-    const bindings = getPolicyRes.body.bindings || [];
-    if (bindings.find((b) => b.role == role &&
-        b.members.find((m) => m == `serviceAccount:${serviceAccountEmail}`))) {
-        return;
-    }
-    bindings.push({
-        role: role,
-        members: [`serviceAccount:${serviceAccountEmail}`],
-    });
-    await apiClient.post(`/projects/${secret.projectId}/secrets/${secret.name}:setIamPolicy`, {
+async function getIamPolicy(secret) {
+    const res = await client.get(`projects/${secret.projectId}/secrets/${secret.name}:getIamPolicy`);
+    return res.body;
+}
+exports.getIamPolicy = getIamPolicy;
+async function setIamPolicy(secret, bindings) {
+    await client.post(`projects/${secret.projectId}/secrets/${secret.name}:setIamPolicy`, {
         policy: {
             bindings,
         },
-        updateMask: {
-            paths: "bindings",
-        },
+        updateMask: "bindings",
     });
-    (0, utils_1.logLabeledSuccess)("SecretManager", `Granted ${role} on projects/${secret.projectId}/secrets/${secret.name} to ${serviceAccountEmail}`);
 }
-exports.grantServiceAgentRole = grantServiceAgentRole;
+exports.setIamPolicy = setIamPolicy;
+async function ensureServiceAgentRole(secret, serviceAccountEmails, role) {
+    const policy = await module.exports.getIamPolicy(secret);
+    const bindings = policy.bindings || [];
+    let binding = bindings.find((b) => b.role === role);
+    if (!binding) {
+        binding = { role, members: [] };
+        bindings.push(binding);
+    }
+    let shouldShortCircuit = true;
+    for (const serviceAccount of serviceAccountEmails) {
+        if (!binding.members.find((m) => m === `serviceAccount:${serviceAccount}`)) {
+            binding.members.push(`serviceAccount:${serviceAccount}`);
+            shouldShortCircuit = false;
+        }
+    }
+    if (shouldShortCircuit)
+        return;
+    await module.exports.setIamPolicy(secret, bindings);
+    (0, utils_1.logLabeledSuccess)("secretmanager", `Granted ${role} on projects/${secret.projectId}/secrets/${secret.name} to ${serviceAccountEmails.join(", ")}`);
+}
+exports.ensureServiceAgentRole = ensureServiceAgentRole;

package/lib/gcp/storage.js

@@ -6,10 +6,10 @@ const api_1 = require("../api");
 const apiv2_1 = require("../apiv2");
 const logger_1 = require("../logger");
 const error_1 = require("../error");
-const storageAPIClient = new apiv2_1.Client({ urlPrefix: api_1.storageOrigin, apiVersion: "v1" });
 async function getDefaultBucket(projectId) {
     try {
-        const resp = await storageAPIClient.get(`/apps/${projectId}`);
+        const appengineClient = new apiv2_1.Client({ urlPrefix: api_1.appengineOrigin, apiVersion: "v1" });
+        const resp = await appengineClient.get(`/apps/${projectId}`);
         if (resp.body.defaultBucket === "undefined") {
             logger_1.logger.debug("Default storage bucket is undefined.");
             throw new error_1.FirebaseError("Your project is being set up. Please wait a minute before deploying again.");
@@ -29,6 +29,7 @@ async function upload(source, uploadUrl, extraHeaders) {
         method: "PUT",
         path: url.pathname,
         queryParams: url.searchParams,
+        responseType: "xml",
         headers: Object.assign({ "content-type": "application/zip" }, extraHeaders),
         body: source.stream,
         skipLog: { resBody: true },
@@ -42,8 +43,9 @@ async function uploadObject(source, bucketName) {
     if (path.extname(source.file) !== ".zip") {
         throw new error_1.FirebaseError(`Expected a file name ending in .zip, got ${source.file}`);
     }
+    const localAPIClient = new apiv2_1.Client({ urlPrefix: api_1.storageOrigin });
     const location = `/${bucketName}/${path.basename(source.file)}`;
-    const res = await storageAPIClient.request({
+    const res = await localAPIClient.request({
         method: "PUT",
         path: location,
         headers: {

package/lib/hosting/functionsProxy.js

@@ -1,26 +1,36 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.functionsProxy = void 0;
 const lodash_1 = require("lodash");
 const proxy_1 = require("./proxy");
 const projectUtils_1 = require("../projectUtils");
 const registry_1 = require("../emulator/registry");
 const types_1 = require("../emulator/types");
 const functionsEmulator_1 = require("../emulator/functionsEmulator");
-function default_1(options) {
+const error_1 = require("../error");
+function functionsProxy(options) {
     return (rewrite) => {
         return new Promise((resolve) => {
             const projectId = (0, projectUtils_1.needProjectId)(options);
-            let url = `https://us-central1-${projectId}.cloudfunctions.net/${rewrite.function}`;
+            if (!("function" in rewrite)) {
+                throw new error_1.FirebaseError(`A non-function rewrite cannot be used in functionsProxy`, {
+                    exit: 2,
+                });
+            }
+            if (!rewrite.region) {
+                rewrite.region = "us-central1";
+            }
+            let url = `https://${rewrite.region}-${projectId}.cloudfunctions.net/${rewrite.function}`;
             let destLabel = "live";
             if ((0, lodash_1.includes)(options.targets, "functions")) {
                 destLabel = "local";
                 const functionsEmu = registry_1.EmulatorRegistry.get(types_1.Emulators.FUNCTIONS);
                 if (functionsEmu) {
-                    url = functionsEmulator_1.FunctionsEmulator.getHttpFunctionUrl(functionsEmu.getInfo().host, functionsEmu.getInfo().port, projectId, rewrite.function, "us-central1");
+                    url = functionsEmulator_1.FunctionsEmulator.getHttpFunctionUrl(functionsEmu.getInfo().host, functionsEmu.getInfo().port, projectId, rewrite.function, rewrite.region);
                 }
             }
-            resolve((0, proxy_1.proxyRequestHandler)(url, `${destLabel} Function ${rewrite.function}`));
+            resolve((0, proxy_1.proxyRequestHandler)(url, `${destLabel} Function ${rewrite.region}/${rewrite.function}`));
         });
     };
 }
-exports.default = default_1;
+exports.functionsProxy = functionsProxy;

package/lib/previews.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.previews = void 0;
 const lodash_1 = require("lodash");
 const configstore_1 = require("./configstore");
-exports.previews = Object.assign({ rtdbrules: false, ext: false, extdev: false, rtdbmanagement: false, functionsv2: false, golang: false, deletegcfartifacts: false, dotenv: false, artifactregistry: false }, configstore_1.configstore.get("previews"));
+exports.previews = Object.assign({ rtdbrules: false, ext: false, extdev: false, rtdbmanagement: false, functionsv2: false, golang: false, deletegcfartifacts: false, artifactregistry: false, emulatoruisnapshot: false }, configstore_1.configstore.get("previews"));
 if (process.env.FIREBASE_CLI_PREVIEWS) {
     process.env.FIREBASE_CLI_PREVIEWS.split(",").forEach((feature) => {
         if ((0, lodash_1.has)(exports.previews, feature)) {