firebase-tools 10.1.5 → 10.2.0

package/lib/functions/secrets.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pruneSecrets = exports.of = exports.ensureSecret = exports.ensureValidKey = exports.labels = exports.isFirebaseManaged = void 0;
+const secretManager_1 = require("../gcp/secretManager");
+const error_1 = require("../error");
+const utils_1 = require("../utils");
+const prompt_1 = require("../prompt");
+const env_1 = require("./env");
+const FIREBASE_MANGED = "firebase-managed";
+function isFirebaseManaged(secret) {
+    return Object.keys(secret.labels || []).includes(FIREBASE_MANGED);
+}
+exports.isFirebaseManaged = isFirebaseManaged;
+function labels() {
+    return { [FIREBASE_MANGED]: "true" };
+}
+exports.labels = labels;
+function toUpperSnakeCase(key) {
+    return key
+        .replace("-", "_")
+        .replace(".", "_")
+        .replace(/([a-z])([A-Z])/g, "$1_$2")
+        .toUpperCase();
+}
+async function ensureValidKey(key, options) {
+    const transformedKey = toUpperSnakeCase(key);
+    if (transformedKey !== key) {
+        if (options.force) {
+            throw new error_1.FirebaseError("Secret key must be in UPPER_SNAKE_CASE.");
+        }
+        (0, utils_1.logWarning)(`By convention, secret key must be in UPPER_SNAKE_CASE.`);
+        const confirm = await (0, prompt_1.promptOnce)({
+            name: "updateKey",
+            type: "confirm",
+            default: true,
+            message: `Would you like to use ${transformedKey} as key instead?`,
+        }, options);
+        if (!confirm) {
+            throw new error_1.FirebaseError("Secret key must be in UPPER_SNAKE_CASE.");
+        }
+    }
+    try {
+        (0, env_1.validateKey)(transformedKey);
+    }
+    catch (err) {
+        throw new error_1.FirebaseError(`Invalid secret key ${transformedKey}`, { children: [err] });
+    }
+    return transformedKey;
+}
+exports.ensureValidKey = ensureValidKey;
+async function ensureSecret(projectId, name, options) {
+    try {
+        const secret = await (0, secretManager_1.getSecret)(projectId, name);
+        if (!isFirebaseManaged(secret)) {
+            if (!options.force) {
+                (0, utils_1.logWarning)("Your secret is not managed by Firebase. " +
+                    "Firebase managed secrets are automatically pruned to reduce your monthly cost for using Secret Manager. ");
+                const confirm = await (0, prompt_1.promptOnce)({
+                    name: "updateLabels",
+                    type: "confirm",
+                    default: true,
+                    message: `Would you like to have your secret ${secret.name} managed by Firebase?`,
+                }, options);
+                if (confirm) {
+                    return (0, secretManager_1.patchSecret)(projectId, secret.name, Object.assign(Object.assign({}, secret.labels), labels()));
+                }
+            }
+        }
+        return secret;
+    }
+    catch (err) {
+        if (err.status !== 404) {
+            throw err;
+        }
+    }
+    return await (0, secretManager_1.createSecret)(projectId, name, labels());
+}
+exports.ensureSecret = ensureSecret;
+function of(endpoints) {
+    return endpoints.reduce((envs, endpoint) => [...envs, ...(endpoint.secretEnvironmentVariables || [])], []);
+}
+exports.of = of;
+async function pruneSecrets(projectInfo, endpoints) {
+    const { projectId, projectNumber } = projectInfo;
+    const pruneKey = (name, version) => `${name}@${version}`;
+    const prunedSecrets = new Set();
+    const haveSecrets = await (0, secretManager_1.listSecrets)(projectId, `labels.${FIREBASE_MANGED}=true`);
+    for (const secret of haveSecrets) {
+        const versions = await (0, secretManager_1.listSecretVersions)(projectId, secret.name, `state: ENABLED`);
+        for (const version of versions) {
+            prunedSecrets.add(pruneKey(secret.name, version.versionId));
+        }
+    }
+    const sevs = of(endpoints).filter((sev) => sev.projectId === projectId || sev.projectId === projectNumber);
+    for (const sev of sevs) {
+        let name = sev.secret;
+        if (name.includes("/")) {
+            const secret = (0, secretManager_1.parseSecretResourceName)(name);
+            name = secret.name;
+        }
+        let version = sev.version;
+        if (version === "latest") {
+            const resolved = await (0, secretManager_1.getSecretVersion)(projectId, name, version);
+            version = resolved.versionId;
+        }
+        prunedSecrets.delete(pruneKey(name, version));
+    }
+    return Array.from(prunedSecrets)
+        .map((key) => key.split("@"))
+        .map(([secret, version]) => ({ projectId, version, secret, key: secret }));
+}
+exports.pruneSecrets = pruneSecrets;

package/lib/gcp/cloudfunctions.js

@@ -240,7 +240,7 @@ function endpointFromFunction(gcfFunction) {
     if (uri) {
         endpoint.uri = uri;
     }
-    proto.copyIfPresent(endpoint, gcfFunction, "serviceAccountEmail", "availableMemoryMb", "timeout", "minInstances", "maxInstances", "vpcConnector", "vpcConnectorEgressSettings", "ingressSettings", "labels", "environmentVariables", "sourceUploadUrl");
+    proto.copyIfPresent(endpoint, gcfFunction, "serviceAccountEmail", "availableMemoryMb", "timeout", "minInstances", "maxInstances", "vpcConnector", "vpcConnectorEgressSettings", "ingressSettings", "labels", "environmentVariables", "secretEnvironmentVariables", "sourceUploadUrl");
     return endpoint;
 }
 exports.endpointFromFunction = endpointFromFunction;
@@ -283,7 +283,7 @@ function functionFromEndpoint(endpoint, sourceUploadUrl) {
     else {
         gcfFunction.httpsTrigger = {};
     }
-    proto.copyIfPresent(gcfFunction, endpoint, "serviceAccountEmail", "timeout", "availableMemoryMb", "minInstances", "maxInstances", "vpcConnector", "vpcConnectorEgressSettings", "ingressSettings", "environmentVariables");
+    proto.copyIfPresent(gcfFunction, endpoint, "serviceAccountEmail", "timeout", "availableMemoryMb", "minInstances", "maxInstances", "vpcConnector", "vpcConnectorEgressSettings", "ingressSettings", "environmentVariables", "secretEnvironmentVariables");
     return gcfFunction;
 }
 exports.functionFromEndpoint = functionFromEndpoint;

package/lib/gcp/secretManager.js

@@ -1,30 +1,88 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.grantServiceAgentRole = exports.addVersion = exports.createSecret = exports.toSecretVersionResourceName = exports.parseSecretVersionResourceName = exports.parseSecretResourceName = exports.secretExists = exports.getSecretVersion = exports.getSecret = exports.listSecrets = exports.secretManagerConsoleUri = void 0;
+exports.ensureServiceAgentRole = exports.setIamPolicy = exports.getIamPolicy = exports.addVersion = exports.deleteSecret = exports.patchSecret = exports.createSecret = exports.toSecretVersionResourceName = exports.parseSecretVersionResourceName = exports.parseSecretResourceName = exports.secretExists = exports.destroySecretVersion = exports.accessSecretVersion = exports.getSecretVersion = exports.listSecretVersions = exports.listSecrets = exports.getSecret = exports.secretManagerConsoleUri = void 0;
 const utils_1 = require("../utils");
-const api_1 = require("../api");
+const error_1 = require("../error");
 const apiv2_1 = require("../apiv2");
+const api_1 = require("../api");
+const SECRET_NAME_REGEX = new RegExp("projects\\/" +
+    "(?<project>(?:\\d+)|(?:[A-Za-z]+[A-Za-z\\d-]*[A-Za-z\\d]?))\\/" +
+    "secrets\\/" +
+    "(?<secret>[A-Za-z\\d\\-_]+)");
+const SECRET_VERSION_NAME_REGEX = new RegExp(SECRET_NAME_REGEX.source + "\\/versions\\/" + "(?<version>latest|[0-9]+)");
 const secretManagerConsoleUri = (projectId) => `https://console.cloud.google.com/security/secret-manager?project=${projectId}`;
 exports.secretManagerConsoleUri = secretManagerConsoleUri;
-const apiClient = new apiv2_1.Client({ urlPrefix: api_1.secretManagerOrigin, apiVersion: "v1beta1" });
-async function listSecrets(projectId) {
-    const listRes = await apiClient.get(`/projects/${projectId}/secrets`);
-    return listRes.body.secrets.map((s) => parseSecretResourceName(s.name));
-}
-exports.listSecrets = listSecrets;
+const API_VERSION = "v1";
+const client = new apiv2_1.Client({ urlPrefix: api_1.secretManagerOrigin, apiVersion: API_VERSION });
 async function getSecret(projectId, name) {
     var _a;
-    const getRes = await apiClient.get(`/projects/${projectId}/secrets/${name}`);
+    const getRes = await client.get(`projects/${projectId}/secrets/${name}`);
     const secret = parseSecretResourceName(getRes.body.name);
     secret.labels = (_a = getRes.body.labels) !== null && _a !== void 0 ? _a : {};
     return secret;
 }
 exports.getSecret = getSecret;
+async function listSecrets(projectId, filter) {
+    var _a;
+    const secrets = [];
+    const path = `projects/${projectId}/secrets`;
+    const baseOpts = filter ? { queryParams: { filter } } : {};
+    let pageToken = "";
+    while (true) {
+        const opts = pageToken === ""
+            ? baseOpts
+            : Object.assign(Object.assign({}, baseOpts), { queryParams: Object.assign(Object.assign({}, baseOpts === null || baseOpts === void 0 ? void 0 : baseOpts.queryParams), { pageToken }) });
+        const res = await client.get(path, opts);
+        for (const s of res.body.secrets) {
+            secrets.push(Object.assign(Object.assign({}, parseSecretResourceName(s.name)), { labels: (_a = s.labels) !== null && _a !== void 0 ? _a : {} }));
+        }
+        if (!res.body.nextPageToken) {
+            break;
+        }
+        pageToken = res.body.nextPageToken;
+    }
+    return secrets;
+}
+exports.listSecrets = listSecrets;
+async function listSecretVersions(projectId, name, filter) {
+    const secrets = [];
+    const path = `projects/${projectId}/secrets/${name}/versions`;
+    const baseOpts = filter ? { queryParams: { filter } } : {};
+    let pageToken = "";
+    while (true) {
+        const opts = pageToken === ""
+            ? baseOpts
+            : Object.assign(Object.assign({}, baseOpts), { queryParams: Object.assign(Object.assign({}, baseOpts === null || baseOpts === void 0 ? void 0 : baseOpts.queryParams), { pageToken }) });
+        const res = await client.get(path, opts);
+        for (const s of res.body.versions || []) {
+            secrets.push(Object.assign(Object.assign({}, parseSecretVersionResourceName(s.name)), { state: s.state }));
+        }
+        if (!res.body.nextPageToken) {
+            break;
+        }
+        pageToken = res.body.nextPageToken;
+    }
+    return secrets;
+}
+exports.listSecretVersions = listSecretVersions;
 async function getSecretVersion(projectId, name, version) {
-    const getRes = await apiClient.get(`/projects/${projectId}/secrets/${name}/versions/${version}`);
-    return parseSecretVersionResourceName(getRes.body.name);
+    const getRes = await client.get(`projects/${projectId}/secrets/${name}/versions/${version}`);
+    return Object.assign(Object.assign({}, parseSecretVersionResourceName(getRes.body.name)), { state: getRes.body.state });
 }
 exports.getSecretVersion = getSecretVersion;
+async function accessSecretVersion(projectId, name, version) {
+    const res = await client.get(`projects/${projectId}/secrets/${name}/versions/${version}:access`);
+    return Buffer.from(res.body.payload.data, "base64").toString();
+}
+exports.accessSecretVersion = accessSecretVersion;
+async function destroySecretVersion(projectId, name, version) {
+    if (version === "latest") {
+        const sv = await getSecretVersion(projectId, name, "latest");
+        version = sv.versionId;
+    }
+    await client.post(`projects/${projectId}/secrets/${name}/versions/${version}:destroy`);
+}
+exports.destroySecretVersion = destroySecretVersion;
 async function secretExists(projectId, name) {
     try {
         await getSecret(projectId, name);
@@ -39,21 +97,27 @@ async function secretExists(projectId, name) {
 }
 exports.secretExists = secretExists;
 function parseSecretResourceName(resourceName) {
-    const nameTokens = resourceName.split("/");
+    const match = SECRET_NAME_REGEX.exec(resourceName);
+    if (!(match === null || match === void 0 ? void 0 : match.groups)) {
+        throw new error_1.FirebaseError(`Invalid secret resource name [${resourceName}].`);
+    }
     return {
-        projectId: nameTokens[1],
-        name: nameTokens[3],
+        projectId: match.groups.project,
+        name: match.groups.secret,
     };
 }
 exports.parseSecretResourceName = parseSecretResourceName;
 function parseSecretVersionResourceName(resourceName) {
-    const nameTokens = resourceName.split("/");
+    const match = resourceName.match(SECRET_VERSION_NAME_REGEX);
+    if (!(match === null || match === void 0 ? void 0 : match.groups)) {
+        throw new error_1.FirebaseError(`Invalid secret version resource name [${resourceName}].`);
+    }
     return {
         secret: {
-            projectId: nameTokens[1],
-            name: nameTokens[3],
+            projectId: match.groups.project,
+            name: match.groups.secret,
         },
-        versionId: nameTokens[5],
+        versionId: match.groups.version,
     };
 }
 exports.parseSecretVersionResourceName = parseSecretVersionResourceName;
@@ -62,7 +126,8 @@ function toSecretVersionResourceName(secretVersion) {
 }
 exports.toSecretVersionResourceName = toSecretVersionResourceName;
 async function createSecret(projectId, name, labels) {
-    const createRes = await apiClient.post(`/projects/${projectId}/secrets`, {
+    const createRes = await client.post(`projects/${projectId}/secrets`, {
+        name,
         replication: {
             automatic: {},
         },
@@ -71,41 +136,58 @@ async function createSecret(projectId, name, labels) {
     return parseSecretResourceName(createRes.body.name);
 }
 exports.createSecret = createSecret;
-async function addVersion(secret, payloadData) {
-    const res = await apiClient.post(`/projects/${secret.projectId}/secrets/${secret.name}:addVersion`, {
+async function patchSecret(projectId, name, labels) {
+    const fullName = `projects/${projectId}/secrets/${name}`;
+    const res = await client.patch(fullName, { name: fullName, labels }, { queryParams: { updateMask: "labels" } });
+    return parseSecretResourceName(res.body.name);
+}
+exports.patchSecret = patchSecret;
+async function deleteSecret(projectId, name) {
+    const path = `projects/${projectId}/secrets/${name}`;
+    await client.delete(path);
+}
+exports.deleteSecret = deleteSecret;
+async function addVersion(projectId, name, payloadData) {
+    const res = await client.post(`projects/${projectId}/secrets/${name}:addVersion`, {
         payload: {
             data: Buffer.from(payloadData).toString("base64"),
         },
     });
-    const nameTokens = res.body.name.split("/");
-    return {
-        secret: {
-            projectId: nameTokens[1],
-            name: nameTokens[3],
-        },
-        versionId: nameTokens[5],
-    };
+    return Object.assign(Object.assign({}, parseSecretVersionResourceName(res.body.name)), { state: res.body.state });
 }
 exports.addVersion = addVersion;
-async function grantServiceAgentRole(secret, serviceAccountEmail, role) {
-    const getPolicyRes = await apiClient.get(`/projects/${secret.projectId}/secrets/${secret.name}:getIamPolicy`);
-    const bindings = getPolicyRes.body.bindings || [];
-    if (bindings.find((b) => b.role == role &&
-        b.members.find((m) => m == `serviceAccount:${serviceAccountEmail}`))) {
-        return;
-    }
-    bindings.push({
-        role: role,
-        members: [`serviceAccount:${serviceAccountEmail}`],
-    });
-    await apiClient.post(`/projects/${secret.projectId}/secrets/${secret.name}:setIamPolicy`, {
+async function getIamPolicy(secret) {
+    const res = await client.get(`projects/${secret.projectId}/secrets/${secret.name}:getIamPolicy`);
+    return res.body;
+}
+exports.getIamPolicy = getIamPolicy;
+async function setIamPolicy(secret, bindings) {
+    await client.post(`projects/${secret.projectId}/secrets/${secret.name}:setIamPolicy`, {
         policy: {
             bindings,
         },
-        updateMask: {
-            paths: "bindings",
-        },
+        updateMask: "bindings",
     });
-    (0, utils_1.logLabeledSuccess)("SecretManager", `Granted ${role} on projects/${secret.projectId}/secrets/${secret.name} to ${serviceAccountEmail}`);
 }
-exports.grantServiceAgentRole = grantServiceAgentRole;
+exports.setIamPolicy = setIamPolicy;
+async function ensureServiceAgentRole(secret, serviceAccountEmails, role) {
+    const policy = await module.exports.getIamPolicy(secret);
+    const bindings = policy.bindings || [];
+    let binding = bindings.find((b) => b.role === role);
+    if (!binding) {
+        binding = { role, members: [] };
+        bindings.push(binding);
+    }
+    let shouldShortCircuit = true;
+    for (const serviceAccount of serviceAccountEmails) {
+        if (!binding.members.find((m) => m === `serviceAccount:${serviceAccount}`)) {
+            binding.members.push(`serviceAccount:${serviceAccount}`);
+            shouldShortCircuit = false;
+        }
+    }
+    if (shouldShortCircuit)
+        return;
+    await module.exports.setIamPolicy(secret, bindings);
+    (0, utils_1.logLabeledSuccess)("secretmanager", `Granted ${role} on projects/${secret.projectId}/secrets/${secret.name} to ${serviceAccountEmails.join(", ")}`);
+}
+exports.ensureServiceAgentRole = ensureServiceAgentRole;

package/lib/previews.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.previews = void 0;
 const lodash_1 = require("lodash");
 const configstore_1 = require("./configstore");
-exports.previews = Object.assign({ rtdbrules: false, ext: false, extdev: false, rtdbmanagement: false, functionsv2: false, golang: false, deletegcfartifacts: false, dotenv: false, artifactregistry: false }, configstore_1.configstore.get("previews"));
+exports.previews = Object.assign({ rtdbrules: false, ext: false, extdev: false, rtdbmanagement: false, functionsv2: false, golang: false, deletegcfartifacts: false, artifactregistry: false }, configstore_1.configstore.get("previews"));
 if (process.env.FIREBASE_CLI_PREVIEWS) {
     process.env.FIREBASE_CLI_PREVIEWS.split(",").forEach((feature) => {
         if ((0, lodash_1.has)(exports.previews, feature)) {

package/lib/serve/functions.js

@@ -27,10 +27,10 @@ class FunctionsServer {
         const nodeMajorVersion = (0, functionsEmulatorUtils_1.parseRuntimeVersion)(options.config.get("functions.runtime"));
         this.backend = {
             functionsDir,
-            env: {},
             nodeMajorVersion,
+            env: {},
         };
-        const args = Object.assign({ projectId, emulatableBackends: [this.backend], account }, partialArgs);
+        const args = Object.assign({ projectId, projectDir: options.config.projectDir, emulatableBackends: [this.backend], account }, partialArgs);
         if (options.host) {
             utils.assertIsStringOrUndefined(options.host);
             args.host = options.host;

package/lib/utils.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.assertIsStringOrUndefined = exports.assertIsNumber = exports.assertIsString = exports.assertDefined = exports.thirtyDaysFromNow = exports.isRunningInWSL = exports.isCloudEnvironment = exports.datetimeString = exports.createDestroyer = exports.promiseWithSpinner = exports.setupLoggers = exports.tryParse = exports.tryStringify = exports.promiseProps = exports.promiseWhile = exports.promiseAllSettled = exports.getFunctionsEventProvider = exports.endpoint = exports.makeActiveProject = exports.streamToString = exports.stringToStream = exports.explainStdin = exports.allSettled = exports.reject = exports.logLabeledWarning = exports.logWarning = exports.logLabeledBullet = exports.logBullet = exports.logLabeledSuccess = exports.logSuccess = exports.addSubdomain = exports.addDatabaseNamespace = exports.getDatabaseViewDataUrl = exports.getDatabaseUrl = exports.envOverride = exports.getInheritedOption = exports.consoleUrl = exports.envOverrides = void 0;
+exports.assertIsStringOrUndefined = exports.assertIsNumber = exports.assertIsString = exports.assertDefined = exports.thirtyDaysFromNow = exports.isRunningInWSL = exports.isCloudEnvironment = exports.datetimeString = exports.createDestroyer = exports.promiseWithSpinner = exports.setupLoggers = exports.tryParse = exports.tryStringify = exports.promiseProps = exports.promiseWhile = exports.promiseAllSettled = exports.getFunctionsEventProvider = exports.endpoint = exports.makeActiveProject = exports.streamToString = exports.stringToStream = exports.explainStdin = exports.allSettled = exports.reject = exports.logLabeledError = exports.logLabeledWarning = exports.logWarning = exports.logLabeledBullet = exports.logBullet = exports.logLabeledSuccess = exports.logSuccess = exports.addSubdomain = exports.addDatabaseNamespace = exports.getDatabaseViewDataUrl = exports.getDatabaseUrl = exports.envOverride = exports.getInheritedOption = exports.consoleUrl = exports.envOverrides = void 0;
 const _ = require("lodash");
 const url = require("url");
 const clc = require("cli-color");
@@ -17,6 +17,7 @@ const logger_1 = require("./logger");
 const IS_WINDOWS = process.platform === "win32";
 const SUCCESS_CHAR = IS_WINDOWS ? "+" : "✔";
 const WARNING_CHAR = IS_WINDOWS ? "!" : "⚠";
+const ERROR_CHAR = IS_WINDOWS ? "!!" : "⬢";
 const THIRTY_DAYS_IN_MILLISECONDS = 30 * 24 * 60 * 60 * 1000;
 exports.envOverrides = [];
 function consoleUrl(project, path) {
@@ -104,6 +105,10 @@ function logLabeledWarning(label, message, type = "warn", data = undefined) {
     logger_1.logger[type](clc.yellow.bold(`${WARNING_CHAR}  ${label}:`), message, data);
 }
 exports.logLabeledWarning = logLabeledWarning;
+function logLabeledError(label, message, type = "error", data = undefined) {
+    logger_1.logger[type](clc.red.bold(`${ERROR_CHAR}  ${label}:`), message, data);
+}
+exports.logLabeledError = logLabeledError;
 function reject(message, options) {
     return Promise.reject(new error_1.FirebaseError(message, options));
 }

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "firebase-tools",
-  "version": "10.1.5",
+  "version": "10.2.0",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "firebase-tools",
-      "version": "10.1.5",
+      "version": "10.2.0",
       "license": "MIT",
       "dependencies": {
         "@google-cloud/pubsub": "^2.18.4",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "firebase-tools",
-  "version": "10.1.5",
+  "version": "10.2.0",
   "description": "Command-Line Interface for Firebase",
   "main": "./lib/index.js",
   "bin": {