firebase-tools 10.7.0 → 10.8.0

package/lib/deploy/functions/checkIam.js

@@ -1,10 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ensureServiceAgentRoles = exports.mergeBindings = exports.obtainEventarcServiceAgentBindings = exports.obtainDefaultComputeServiceAgentBindings = exports.obtainPubSubServiceAgentBindings = exports.obtainBinding = exports.checkHttpIam = exports.checkServiceAccountIam = exports.EVENTARC_SERVICE_AGENT_ROLE = exports.EVENTARC_EVENT_RECEIVER_ROLE = exports.RUN_INVOKER_ROLE = exports.SERVICE_ACCOUNT_TOKEN_CREATOR_ROLE = void 0;
+exports.ensureServiceAgentRoles = exports.mergeBindings = exports.obtainDefaultComputeServiceAgentBindings = exports.obtainPubSubServiceAgentBindings = exports.checkHttpIam = exports.checkServiceAccountIam = exports.EVENTARC_EVENT_RECEIVER_ROLE = exports.RUN_INVOKER_ROLE = exports.SERVICE_ACCOUNT_TOKEN_CREATOR_ROLE = void 0;
 const cli_color_1 = require("cli-color");
 const logger_1 = require("../../logger");
 const functionsDeployHelper_1 = require("./functionsDeployHelper");
 const error_1 = require("../../error");
+const functional_1 = require("../../functional");
 const iam = require("../../gcp/iam");
 const backend = require("./backend");
 const track_1 = require("../../track");
@@ -15,7 +16,6 @@ const PERMISSION = "cloudfunctions.functions.setIamPolicy";
 exports.SERVICE_ACCOUNT_TOKEN_CREATOR_ROLE = "roles/iam.serviceAccountTokenCreator";
 exports.RUN_INVOKER_ROLE = "roles/run.invoker";
 exports.EVENTARC_EVENT_RECEIVER_ROLE = "roles/eventarc.eventReceiver";
-exports.EVENTARC_SERVICE_AGENT_ROLE = "roles/eventarc.serviceAgent";
 async function checkServiceAccountIam(projectId) {
     const saEmail = `${projectId}@appspot.gserviceaccount.com`;
     let passed = false;
@@ -35,10 +35,12 @@ async function checkServiceAccountIam(projectId) {
 }
 exports.checkServiceAccountIam = checkServiceAccountIam;
 async function checkHttpIam(context, options, payload) {
+    if (!payload.functions) {
+        return;
+    }
     const filters = context.filters || (0, functionsDeployHelper_1.getEndpointFilters)(options);
-    const wantBackend = payload.functions.wantBackend;
-    const httpEndpoints = backend
-        .allEndpoints(wantBackend)
+    const wantBackends = Object.values(payload.functions).map(({ wantBackend }) => wantBackend);
+    const httpEndpoints = [...(0, functional_1.flattenArray)(wantBackends.map((b) => backend.allEndpoints(b)))]
         .filter(backend.isHttpsTriggered)
         .filter((f) => (0, functionsDeployHelper_1.endpointMatchesAnyFilter)(f, filters));
     const existing = await backend.existingBackend(context);
@@ -65,6 +67,12 @@ async function checkHttpIam(context, options, payload) {
     logger_1.logger.debug("[functions] found setIamPolicy permission, proceeding with deploy");
 }
 exports.checkHttpIam = checkHttpIam;
+function getPubsubServiceAgent(projectNumber) {
+    return `serviceAccount:service-${projectNumber}@gcp-sa-pubsub.iam.gserviceaccount.com`;
+}
+function getDefaultComputeServiceAgent(projectNumber) {
+    return `serviceAccount:${projectNumber}-compute@developer.gserviceaccount.com`;
+}
 function reduceEventsToServices(services, endpoint) {
     const service = (0, services_1.serviceForEndpoint)(endpoint);
     if (service.requiredProjectBindings && !services.find((s) => s.name === service.name)) {
@@ -72,90 +80,97 @@ function reduceEventsToServices(services, endpoint) {
     }
     return services;
 }
-function obtainBinding(existingPolicy, serviceAccount, role) {
-    let binding = existingPolicy.bindings.find((b) => b.role === role);
-    if (!binding) {
-        binding = {
-            role,
-            members: [],
-        };
-    }
-    if (!binding.members.find((m) => m === serviceAccount)) {
-        binding.members.push(serviceAccount);
-    }
-    return binding;
-}
-exports.obtainBinding = obtainBinding;
-function obtainPubSubServiceAgentBindings(projectNumber, existingPolicy) {
-    const pubsubServiceAgent = `serviceAccount:service-${projectNumber}@gcp-sa-pubsub.iam.gserviceaccount.com`;
-    return [obtainBinding(existingPolicy, pubsubServiceAgent, exports.SERVICE_ACCOUNT_TOKEN_CREATOR_ROLE)];
+function obtainPubSubServiceAgentBindings(projectNumber) {
+    const serviceAccountTokenCreatorBinding = {
+        role: exports.SERVICE_ACCOUNT_TOKEN_CREATOR_ROLE,
+        members: [getPubsubServiceAgent(projectNumber)],
+    };
+    return [serviceAccountTokenCreatorBinding];
 }
 exports.obtainPubSubServiceAgentBindings = obtainPubSubServiceAgentBindings;
-function obtainDefaultComputeServiceAgentBindings(projectNumber, existingPolicy) {
-    const defaultComputeServiceAgent = `serviceAccount:${projectNumber}-compute@developer.gserviceaccount.com`;
-    const invokerBinding = obtainBinding(existingPolicy, defaultComputeServiceAgent, exports.RUN_INVOKER_ROLE);
-    const eventReceiverBinding = obtainBinding(existingPolicy, defaultComputeServiceAgent, exports.EVENTARC_EVENT_RECEIVER_ROLE);
-    return [invokerBinding, eventReceiverBinding];
+function obtainDefaultComputeServiceAgentBindings(projectNumber) {
+    const defaultComputeServiceAgent = getDefaultComputeServiceAgent(projectNumber);
+    const runInvokerBinding = {
+        role: exports.RUN_INVOKER_ROLE,
+        members: [defaultComputeServiceAgent],
+    };
+    const eventarcEventReceiverBinding = {
+        role: exports.EVENTARC_EVENT_RECEIVER_ROLE,
+        members: [defaultComputeServiceAgent],
+    };
+    return [runInvokerBinding, eventarcEventReceiverBinding];
 }
 exports.obtainDefaultComputeServiceAgentBindings = obtainDefaultComputeServiceAgentBindings;
-function obtainEventarcServiceAgentBindings(projectNumber, existingPolicy) {
-    const eventarcServiceAgent = `serviceAccount:service-${projectNumber}@gcp-sa-eventarc.iam.gserviceaccount.com`;
-    return [obtainBinding(existingPolicy, eventarcServiceAgent, exports.EVENTARC_SERVICE_AGENT_ROLE)];
-}
-exports.obtainEventarcServiceAgentBindings = obtainEventarcServiceAgentBindings;
-function mergeBindings(policy, allRequiredBindings) {
-    for (const requiredBindings of allRequiredBindings) {
-        if (requiredBindings.length === 0) {
+function mergeBindings(policy, requiredBindings) {
+    let updated = false;
+    for (const requiredBinding of requiredBindings) {
+        const match = policy.bindings.find((b) => b.role === requiredBinding.role);
+        if (!match) {
+            updated = true;
+            policy.bindings.push(requiredBinding);
             continue;
         }
-        for (const requiredBinding of requiredBindings) {
-            const ndx = policy.bindings.findIndex((policyBinding) => policyBinding.role === requiredBinding.role);
-            if (ndx === -1) {
-                policy.bindings.push(requiredBinding);
-                continue;
+        for (const requiredMember of requiredBinding.members) {
+            if (!match.members.find((m) => m === requiredMember)) {
+                updated = true;
+                match.members.push(requiredMember);
             }
-            requiredBinding.members.forEach((updatedMember) => {
-                if (!policy.bindings[ndx].members.find((member) => member === updatedMember)) {
-                    policy.bindings[ndx].members.push(updatedMember);
-                }
-            });
         }
     }
+    return updated;
 }
 exports.mergeBindings = mergeBindings;
-async function ensureServiceAgentRoles(projectNumber, want, have) {
+function printManualIamConfig(requiredBindings, projectId) {
+    utils.logLabeledBullet("functions", "Failed to verify the project has the correct IAM bindings for a successful deployment.", "warn");
+    utils.logLabeledBullet("functions", "You can either re-run `firebase deploy` as a project owner or manually run the following set of `gcloud` commands:", "warn");
+    for (const binding of requiredBindings) {
+        for (const member of binding.members) {
+            utils.logLabeledBullet("functions", `\`gcloud projects add-iam-policy-binding ${projectId} ` +
+                `--member=${member} ` +
+                `--role=${binding.role}\``, "warn");
+        }
+    }
+}
+async function ensureServiceAgentRoles(projectId, projectNumber, want, have) {
     const wantServices = backend.allEndpoints(want).reduce(reduceEventsToServices, []);
     const haveServices = backend.allEndpoints(have).reduce(reduceEventsToServices, []);
     const newServices = wantServices.filter((wantS) => !haveServices.find((haveS) => wantS.name === haveS.name));
     if (newServices.length === 0) {
         return;
     }
+    const requiredBindingsPromises = [];
+    for (const service of newServices) {
+        requiredBindingsPromises.push(service.requiredProjectBindings(projectNumber));
+    }
+    const nestedRequiredBindings = await Promise.all(requiredBindingsPromises);
+    const requiredBindings = [...(0, functional_1.flattenArray)(nestedRequiredBindings)];
+    if (haveServices.length === 0) {
+        requiredBindings.push(...obtainPubSubServiceAgentBindings(projectNumber));
+        requiredBindings.push(...obtainDefaultComputeServiceAgentBindings(projectNumber));
+    }
+    if (requiredBindings.length === 0) {
+        return;
+    }
     let policy;
     try {
         policy = await (0, resourceManager_1.getIamPolicy)(projectNumber);
     }
     catch (err) {
+        printManualIamConfig(requiredBindings, projectId);
         utils.logLabeledBullet("functions", "Could not verify the necessary IAM configuration for the following newly-integrated services: " +
             `${newServices.map((service) => service.api).join(", ")}` +
             ". Deployment may fail.", "warn");
         return;
     }
-    const findRequiredBindings = [];
-    newServices.forEach((service) => findRequiredBindings.push(service.requiredProjectBindings(projectNumber, policy)));
-    const allRequiredBindings = await Promise.all(findRequiredBindings);
-    if (haveServices.length === 0) {
-        allRequiredBindings.push(obtainPubSubServiceAgentBindings(projectNumber, policy));
-        allRequiredBindings.push(obtainDefaultComputeServiceAgentBindings(projectNumber, policy));
-        allRequiredBindings.push(obtainEventarcServiceAgentBindings(projectNumber, policy));
-    }
-    if (!allRequiredBindings.find((bindings) => bindings.length > 0)) {
+    const hasUpdatedBindings = mergeBindings(policy, requiredBindings);
+    if (!hasUpdatedBindings) {
         return;
     }
-    mergeBindings(policy, allRequiredBindings);
     try {
         await (0, resourceManager_1.setIamPolicy)(projectNumber, policy, "bindings");
     }
     catch (err) {
+        printManualIamConfig(requiredBindings, projectId);
         throw new error_1.FirebaseError("We failed to modify the IAM policy for the project. The functions " +
             "deployment requires specific roles to be granted to service agents," +
             " otherwise the deployment will fail.", { original: err });

package/lib/deploy/functions/containerCleaner.js

@@ -251,13 +251,14 @@ class DockerHelper {
         this.client = new docker.Client(origin);
     }
     async ls(path) {
-        if (!this.cache[path]) {
-            const raw = await retry(() => this.client.listTags(path));
-            this.cache[path] = {
-                tags: raw.tags,
-                digests: Object.keys(raw.manifest),
-                children: raw.child,
-            };
+        if (!(path in this.cache)) {
+            this.cache[path] = retry(() => this.client.listTags(path)).then((res) => {
+                return {
+                    tags: res.tags,
+                    digests: Object.keys(res.manifest),
+                    children: res.child,
+                };
+            });
         }
         return this.cache[path];
     }

package/lib/deploy/functions/deploy.js

@@ -6,54 +6,62 @@ const clc = require("cli-color");
 const fs = require("fs");
 const checkIam_1 = require("./checkIam");
 const utils_1 = require("../../utils");
+const projectConfig_1 = require("../../functions/projectConfig");
 const gcs = require("../../gcp/storage");
 const gcf = require("../../gcp/cloudfunctions");
 const gcfv2 = require("../../gcp/cloudfunctionsv2");
 const backend = require("./backend");
 (0, tmp_1.setGracefulCleanup)();
-async function uploadSourceV1(context, region) {
-    const uploadUrl = await gcf.generateUploadUrl(context.projectId, region);
-    context.source.sourceUrl = uploadUrl;
+async function uploadSourceV1(projectId, source, wantBackend) {
+    const v1Endpoints = backend.allEndpoints(wantBackend).filter((e) => e.platform === "gcfv1");
+    if (v1Endpoints.length === 0) {
+        return;
+    }
+    const region = v1Endpoints[0].region;
+    const uploadUrl = await gcf.generateUploadUrl(projectId, region);
     const uploadOpts = {
-        file: context.source.functionsSourceV1,
-        stream: fs.createReadStream(context.source.functionsSourceV1),
+        file: source.functionsSourceV1,
+        stream: fs.createReadStream(source.functionsSourceV1),
     };
     await gcs.upload(uploadOpts, uploadUrl, {
         "x-goog-content-length-range": "0,104857600",
     });
+    return uploadUrl;
 }
-async function uploadSourceV2(context, region) {
-    const res = await gcfv2.generateUploadUrl(context.projectId, region);
+async function uploadSourceV2(projectId, source, wantBackend) {
+    const v2Endpoints = backend.allEndpoints(wantBackend).filter((e) => e.platform === "gcfv2");
+    if (v2Endpoints.length === 0) {
+        return;
+    }
+    const region = v2Endpoints[0].region;
+    const res = await gcfv2.generateUploadUrl(projectId, region);
     const uploadOpts = {
-        file: context.source.functionsSourceV2,
-        stream: fs.createReadStream(context.source.functionsSourceV2),
+        file: source.functionsSourceV2,
+        stream: fs.createReadStream(source.functionsSourceV2),
     };
     await gcs.upload(uploadOpts, res.uploadUrl);
-    context.source.storage = res.storageSource;
+    return res.storageSource;
 }
-async function deploy(context, options, payload) {
-    var _a, _b, _c, _d;
-    if (!context.config) {
-        return;
-    }
-    if (!((_a = context.source) === null || _a === void 0 ? void 0 : _a.functionsSourceV1) && !((_b = context.source) === null || _b === void 0 ? void 0 : _b.functionsSourceV2)) {
+async function uploadCodebase(context, codebase, wantBackend) {
+    var _a;
+    const source = (_a = context.sources) === null || _a === void 0 ? void 0 : _a[codebase];
+    if (!source || (!source.functionsSourceV1 && !source.functionsSourceV2)) {
         return;
     }
-    await (0, checkIam_1.checkHttpIam)(context, options, payload);
+    const uploads = [];
     try {
-        const want = payload.functions.wantBackend;
-        const uploads = [];
-        const byPlatform = (0, utils_1.groupBy)(backend.allEndpoints(want), (e) => e.platform);
-        if (((_c = byPlatform.gcfv1) === null || _c === void 0 ? void 0 : _c.length) > 0) {
-            uploads.push(uploadSourceV1(context, byPlatform.gcfv1[0].region));
+        uploads.push(uploadSourceV1(context.projectId, source, wantBackend));
+        uploads.push(uploadSourceV2(context.projectId, source, wantBackend));
+        const [sourceUrl, storage] = await Promise.all(uploads);
+        if (sourceUrl) {
+            source.sourceUrl = sourceUrl;
         }
-        if (((_d = byPlatform.gcfv2) === null || _d === void 0 ? void 0 : _d.length) > 0) {
-            uploads.push(uploadSourceV2(context, byPlatform.gcfv2[0].region));
+        if (storage) {
+            source.storage = storage;
         }
-        await Promise.all(uploads);
-        const source = context.config.source;
+        const sourceDir = (0, projectConfig_1.configForCodebase)(context.config, codebase).source;
         if (uploads.length) {
-            (0, utils_1.logSuccess)(`${clc.green.bold("functions:")} ${clc.bold(source)} folder uploaded successfully`);
+            (0, utils_1.logSuccess)(`${clc.green.bold("functions:")} ${clc.bold(sourceDir)} folder uploaded successfully`);
         }
     }
     catch (err) {
@@ -61,4 +69,18 @@ async function deploy(context, options, payload) {
         throw err;
     }
 }
+async function deploy(context, options, payload) {
+    if (!context.config) {
+        return;
+    }
+    if (!payload.functions) {
+        return;
+    }
+    await (0, checkIam_1.checkHttpIam)(context, options, payload);
+    const uploads = [];
+    for (const [codebase, { wantBackend }] of Object.entries(payload.functions)) {
+        uploads.push(uploadCodebase(context, codebase, wantBackend));
+    }
+    await Promise.all(uploads);
+}
 exports.deploy = deploy;

package/lib/deploy/functions/functionsDeployHelper.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getFunctionLabel = exports.getEndpointFilters = exports.parseFunctionSelector = exports.endpointMatchesFilter = exports.endpointMatchesAnyFilter = void 0;
-const projectConfig = require("../../functions/projectConfig");
+exports.groupEndpointsByCodebase = exports.targetCodebases = exports.getFunctionLabel = exports.getEndpointFilters = exports.parseFunctionSelector = exports.endpointMatchesFilter = exports.endpointMatchesAnyFilter = void 0;
+const backend = require("./backend");
+const projectConfig_1 = require("../../functions/projectConfig");
 function endpointMatchesAnyFilter(endpoint, filters) {
     if (!filters) {
         return true;
@@ -35,7 +36,7 @@ function parseFunctionSelector(selector) {
     if (fragments.length < 2) {
         return [
             { codebase: fragments[0] },
-            { codebase: projectConfig.DEFAULT_CODEBASE, idChunks: fragments[0].split(/[-.]/) },
+            { codebase: projectConfig_1.DEFAULT_CODEBASE, idChunks: fragments[0].split(/[-.]/) },
         ];
     }
     return [
@@ -67,6 +68,49 @@ function getEndpointFilters(options) {
 }
 exports.getEndpointFilters = getEndpointFilters;
 function getFunctionLabel(fn) {
-    return `${fn.id}(${fn.region})`;
+    let id = `${fn.id}(${fn.region})`;
+    if (fn.codebase && fn.codebase !== projectConfig_1.DEFAULT_CODEBASE) {
+        id = `${fn.codebase}:${id}`;
+    }
+    return id;
 }
 exports.getFunctionLabel = getFunctionLabel;
+function targetCodebases(config, filters) {
+    const codebasesFromConfig = [...new Set(Object.values(config).map((c) => c.codebase))];
+    if (!filters) {
+        return [...codebasesFromConfig];
+    }
+    const codebasesFromFilters = [
+        ...new Set(filters.map((f) => f.codebase).filter((c) => c !== undefined)),
+    ];
+    if (codebasesFromFilters.length === 0) {
+        return [...codebasesFromConfig];
+    }
+    const intersections = [];
+    for (const codebase of codebasesFromConfig) {
+        if (codebasesFromFilters.includes(codebase)) {
+            intersections.push(codebase);
+        }
+    }
+    return intersections;
+}
+exports.targetCodebases = targetCodebases;
+function groupEndpointsByCodebase(wantBackends, haveEndpoints) {
+    const grouped = {};
+    let endpointsToAssign = haveEndpoints;
+    for (const codebase of Object.keys(wantBackends)) {
+        const names = backend.allEndpoints(wantBackends[codebase]).map((e) => backend.functionName(e));
+        grouped[codebase] = backend.of(...endpointsToAssign.filter((e) => names.includes(backend.functionName(e))));
+        endpointsToAssign = endpointsToAssign.filter((e) => !names.includes(backend.functionName(e)));
+    }
+    for (const codebase of Object.keys(wantBackends)) {
+        const matchedEndpoints = endpointsToAssign.filter((e) => e.codebase === codebase);
+        grouped[codebase] = backend.merge(grouped[codebase], backend.of(...matchedEndpoints));
+        const matchedNames = matchedEndpoints.map((e) => backend.functionName(e));
+        endpointsToAssign = endpointsToAssign.filter((e) => {
+            return !matchedNames.includes(backend.functionName(e));
+        });
+    }
+    return grouped;
+}
+exports.groupEndpointsByCodebase = groupEndpointsByCodebase;