firebase-tools 13.16.0 → 13.17.0

package/lib/api.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.cloudRunApiOrigin = exports.hostingApiOrigin = exports.firebaseStorageOrigin = exports.storageOrigin = exports.runtimeconfigOrigin = exports.rulesOrigin = exports.resourceManagerOrigin = exports.remoteConfigApiOrigin = exports.rtdbMetadataOrigin = exports.rtdbManagementOrigin = exports.realtimeOrigin = exports.extensionsTOSOrigin = exports.extensionsPublisherOrigin = exports.extensionsOrigin = exports.iamOrigin = exports.identityOrigin = exports.hostingOrigin = exports.googleOrigin = exports.pubsubOrigin = exports.cloudTasksOrigin = exports.cloudschedulerOrigin = exports.cloudbuildOrigin = exports.functionsDefaultRegion = exports.runOrigin = exports.functionsV2Origin = exports.functionsOrigin = exports.firestoreOrigin = exports.firestoreOriginOrEmulator = exports.firedataOrigin = exports.firebaseExtensionsRegistryOrigin = exports.firebaseApiOrigin = exports.eventarcOrigin = exports.dynamicLinksKey = exports.dynamicLinksOrigin = exports.consoleOrigin = exports.authOrigin = exports.apphostingGitHubAppInstallationURL = exports.apphostingP4SADomain = exports.apphostingOrigin = exports.appDistributionOrigin = exports.artifactRegistryDomain = exports.developerConnectP4SADomain = exports.developerConnectOrigin = exports.containerRegistryDomain = exports.cloudMonitoringOrigin = exports.cloudloggingOrigin = exports.cloudbillingOrigin = exports.clientSecret = exports.clientId = exports.authProxyOrigin = void 0;
-exports.setScopes = exports.getScopes = exports.vertexAIOrigin = exports.cloudSQLAdminOrigin = exports.dataConnectLocalConnString = exports.dataconnectOrigin = exports.githubClientSecret = exports.githubClientId = exports.computeOrigin = exports.secretManagerOrigin = exports.githubApiOrigin = exports.githubOrigin = exports.serviceUsageOrigin = void 0;
+exports.setScopes = exports.getScopes = exports.vertexAIOrigin = exports.cloudSQLAdminOrigin = exports.dataConnectLocalConnString = exports.dataconnectP4SADomain = exports.dataconnectOrigin = exports.githubClientSecret = exports.githubClientId = exports.computeOrigin = exports.secretManagerOrigin = exports.githubApiOrigin = exports.githubOrigin = exports.serviceUsageOrigin = void 0;
 const constants_1 = require("./emulator/constants");
 const logger_1 = require("./logger");
 const scopes = require("./scopes");
@@ -128,6 +128,8 @@ const githubClientSecret = () => utils.envOverride("GITHUB_CLIENT_SECRET", "3330
 exports.githubClientSecret = githubClientSecret;
 const dataconnectOrigin = () => utils.envOverride("FIREBASE_DATACONNECT_URL", "https://firebasedataconnect.googleapis.com");
 exports.dataconnectOrigin = dataconnectOrigin;
+const dataconnectP4SADomain = () => utils.envOverride("FIREBASE_DATACONNECT_P4SA_DOMAIN", "gcp-sa-firebasedataconnect.iam.gserviceaccount.com");
+exports.dataconnectP4SADomain = dataconnectP4SADomain;
 const dataConnectLocalConnString = () => utils.envOverride("FIREBASE_DATACONNECT_POSTGRESQL_STRING", "");
 exports.dataConnectLocalConnString = dataConnectLocalConnString;
 const cloudSQLAdminOrigin = () => utils.envOverride("CLOUD_SQL_URL", "https://sqladmin.googleapis.com");

package/lib/apphosting/index.js

@@ -33,7 +33,8 @@ async function tlsReady(url) {
     }
     catch (err) {
         const maybeNodeError = err;
-        if (/HANDSHAKE_FAILURE/.test((_a = maybeNodeError === null || maybeNodeError === void 0 ? void 0 : maybeNodeError.cause) === null || _a === void 0 ? void 0 : _a.code)) {
+        if (/HANDSHAKE_FAILURE/.test((_a = maybeNodeError === null || maybeNodeError === void 0 ? void 0 : maybeNodeError.cause) === null || _a === void 0 ? void 0 : _a.code) ||
+            "EPROTO" === (maybeNodeError === null || maybeNodeError === void 0 ? void 0 : maybeNodeError.code)) {
             return false;
         }
         return true;

package/lib/commands/dataconnect-sql-diff.js

@@ -17,9 +17,10 @@ exports.command = new command_1.Command("dataconnect:sql:diff [serviceId]")
 ])
     .before(requireAuth_1.requireAuth)
     .action(async (serviceId, options) => {
+    var _a;
     const projectId = (0, projectUtils_1.needProjectId)(options);
     await (0, ensureApis_1.ensureApis)(projectId);
     const serviceInfo = await (0, fileUtils_1.pickService)(projectId, options.config, serviceId);
-    const diffs = await (0, schemaMigration_1.diffSchema)(serviceInfo.schema);
+    const diffs = await (0, schemaMigration_1.diffSchema)(serviceInfo.schema, (_a = serviceInfo.dataConnectYaml.schema.datasource.postgresql) === null || _a === void 0 ? void 0 : _a.schemaValidation);
     return { projectId, serviceId, diffs };
 });

package/lib/commands/dataconnect-sql-migrate.js

@@ -17,7 +17,6 @@ exports.command = new command_1.Command("dataconnect:sql:migrate [serviceId]")
     "firebasedataconnect.schemas.list",
     "firebasedataconnect.schemas.update",
     "cloudsql.instances.connect",
-    "cloudsql.users.create",
 ])
     .before(requireAuth_1.requireAuth)
     .withForce("Execute any required database changes without prompting")

package/lib/commands/firestore-databases-restore.js

@@ -8,12 +8,17 @@ const logger_1 = require("../logger");
 const requirePermissions_1 = require("../requirePermissions");
 const types_1 = require("../emulator/types");
 const commandUtils_1 = require("../emulator/commandUtils");
+const options_1 = require("../firestore/options");
 const pretty_print_1 = require("../firestore/pretty-print");
 const error_1 = require("../error");
 exports.command = new command_1.Command("firestore:databases:restore")
     .description("Restore a Firestore database in your Firebase project.")
     .option("-d, --database <databaseID>", "ID of the database to restore into")
     .option("-b, --backup <backup>", "Backup from which to restore")
+    .option("-e, --encryption-type <encryptionType>", `Encryption method of the restored database; one of ${options_1.EncryptionType.USE_SOURCE_ENCRYPTION} (default), ` +
+    `${options_1.EncryptionType.CUSTOMER_MANAGED_ENCRYPTION}, ${options_1.EncryptionType.GOOGLE_DEFAULT_ENCRYPTION}`)
+    .option("-k, --kms-key-name <kmsKeyName>", "Resource ID of the Cloud KMS key to encrypt the restored database. This " +
+    "feature is allowlist only in initial launch.")
     .before(requirePermissions_1.requirePermissions, ["datastore.backups.restoreDatabase"])
     .before(commandUtils_1.warnEmulatorNotSupported, types_1.Emulators.FIRESTORE)
     .action(async (options) => {
@@ -28,7 +33,28 @@ exports.command = new command_1.Command("firestore:databases:restore")
         throw new error_1.FirebaseError(`Missing required flag --backup. ${helpCommandText}`);
     }
     const backupName = options.backup;
-    const databaseResp = await api.restoreDatabase(options.project, databaseId, backupName);
+    let encryptionConfig = undefined;
+    switch (options.encryptionType) {
+        case options_1.EncryptionType.GOOGLE_DEFAULT_ENCRYPTION:
+            throwIfKmsKeyNameIsSet(options.kmsKeyName);
+            encryptionConfig = { googleDefaultEncryption: {} };
+            break;
+        case options_1.EncryptionType.USE_SOURCE_ENCRYPTION:
+            throwIfKmsKeyNameIsSet(options.kmsKeyName);
+            encryptionConfig = { useSourceEncryption: {} };
+            break;
+        case options_1.EncryptionType.CUSTOMER_MANAGED_ENCRYPTION:
+            encryptionConfig = {
+                customerManagedEncryption: { kmsKeyName: getKmsKeyOrThrow(options.kmsKeyName) },
+            };
+            break;
+        case undefined:
+            throwIfKmsKeyNameIsSet(options.kmsKeyName);
+            break;
+        default:
+            throw new error_1.FirebaseError(`Invalid value for flag --encryption-type. ${helpCommandText}`);
+    }
+    const databaseResp = await api.restoreDatabase(options.project, databaseId, backupName, encryptionConfig);
     if (options.json) {
         logger_1.logger.info(JSON.stringify(databaseResp, undefined, 2));
     }
@@ -40,4 +66,16 @@ exports.command = new command_1.Command("firestore:databases:restore")
         logger_1.logger.info(`Once the restore is complete, your database may be viewed at ${printer.firebaseConsoleDatabaseUrl(options.project, databaseId)}`);
     }
     return databaseResp;
+    function throwIfKmsKeyNameIsSet(kmsKeyName) {
+        if (kmsKeyName) {
+            throw new error_1.FirebaseError("--kms-key-name can only be set when specifying an --encryption-type " +
+                `of ${options_1.EncryptionType.CUSTOMER_MANAGED_ENCRYPTION}.`);
+        }
+    }
+    function getKmsKeyOrThrow(kmsKeyName) {
+        if (kmsKeyName)
+            return kmsKeyName;
+        throw new error_1.FirebaseError("--kms-key-name must be provided when specifying an --encryption-type " +
+            `of ${options_1.EncryptionType.CUSTOMER_MANAGED_ENCRYPTION}.`);
+    }
 });

package/lib/dataconnect/schemaMigration.js

@@ -6,23 +6,41 @@ const sql_formatter_1 = require("sql-formatter");
 const types_1 = require("./types");
 const client_1 = require("./client");
 const connect_1 = require("../gcp/cloudsql/connect");
+const permissions_1 = require("../gcp/cloudsql/permissions");
 const prompt_1 = require("../prompt");
 const logger_1 = require("../logger");
 const error_1 = require("../error");
-const projectUtils_1 = require("../projectUtils");
 const utils_1 = require("../utils");
 const experiments = require("../experiments");
 const errors = require("./errors");
-async function diffSchema(schema) {
+async function diffSchema(schema, schemaValidation) {
     const { serviceName, instanceName, databaseId } = getIdentifiers(schema);
     await ensureServiceIsConnectedToCloudSql(serviceName, instanceName, databaseId, false);
-    setCompatibleMode(schema, databaseId, instanceName);
+    let diffs = [];
+    let validationMode = "STRICT";
+    if (experiments.isEnabled("fdccompatiblemode")) {
+        if (!schemaValidation) {
+            validationMode = "COMPATIBLE";
+        }
+        else {
+            validationMode = schemaValidation;
+        }
+    }
+    setSchemaValidationMode(schema, validationMode);
     try {
+        if (!schemaValidation && experiments.isEnabled("fdccompatiblemode")) {
+            (0, utils_1.logLabeledBullet)("dataconnect", `generating required schema changes...`);
+        }
         await (0, client_1.upsertSchema)(schema, true);
-        (0, utils_1.logLabeledSuccess)("dataconnect", `Database schema is up to date.`);
+        if (validationMode === "STRICT") {
+            (0, utils_1.logLabeledSuccess)("dataconnect", `Database schema is up to date.`);
+        }
+        else {
+            (0, utils_1.logLabeledSuccess)("dataconnect", `Database schema is compatible.`);
+        }
     }
     catch (err) {
-        if (err.status !== 400) {
+        if ((err === null || err === void 0 ? void 0 : err.status) !== 400) {
             throw err;
         }
         const invalidConnectors = errors.getInvalidConnectors(err);
@@ -34,24 +52,56 @@ async function diffSchema(schema) {
             displayInvalidConnectors(invalidConnectors);
         }
         if (incompatible) {
-            displaySchemaChanges(incompatible);
-            return incompatible.diffs;
+            displaySchemaChanges(incompatible, validationMode, instanceName, databaseId);
+            diffs = incompatible.diffs;
         }
     }
-    return [];
+    if (experiments.isEnabled("fdccompatiblemode")) {
+        if (!schemaValidation) {
+            validationMode = "STRICT";
+            setSchemaValidationMode(schema, validationMode);
+            try {
+                (0, utils_1.logLabeledBullet)("dataconnect", `generating schema changes, including optional changes...`);
+                await (0, client_1.upsertSchema)(schema, true);
+                (0, utils_1.logLabeledSuccess)("dataconnect", `no additional optional changes`);
+            }
+            catch (err) {
+                if ((err === null || err === void 0 ? void 0 : err.status) !== 400) {
+                    throw err;
+                }
+                const incompatible = errors.getIncompatibleSchemaError(err);
+                if (incompatible) {
+                    if (!diffsEqual(diffs, incompatible.diffs)) {
+                        if (diffs.length === 0) {
+                            displaySchemaChanges(incompatible, "STRICT_AFTER_COMPATIBLE", instanceName, databaseId);
+                        }
+                        else {
+                            displaySchemaChanges(incompatible, validationMode, instanceName, databaseId);
+                        }
+                        diffs = incompatible.diffs;
+                    }
+                    else {
+                        (0, utils_1.logLabeledSuccess)("dataconnect", `no additional optional changes`);
+                    }
+                }
+            }
+        }
+    }
+    return diffs;
 }
 exports.diffSchema = diffSchema;
 async function migrateSchema(args) {
     const { options, schema, validateOnly } = args;
     const { serviceName, instanceId, instanceName, databaseId } = getIdentifiers(schema);
     await ensureServiceIsConnectedToCloudSql(serviceName, instanceName, databaseId, true);
-    setCompatibleMode(schema, databaseId, instanceName);
+    const validationMode = experiments.isEnabled("fdccompatiblemode") ? "COMPATIBLE" : "STRICT";
+    setSchemaValidationMode(schema, validationMode);
     try {
         await (0, client_1.upsertSchema)(schema, validateOnly);
         logger_1.logger.debug(`Database schema was up to date for ${instanceId}:${databaseId}`);
     }
     catch (err) {
-        if (err.status !== 400) {
+        if ((err === null || err === void 0 ? void 0 : err.status) !== 400) {
             throw err;
         }
         const incompatible = errors.getIncompatibleSchemaError(err);
@@ -59,7 +109,7 @@ async function migrateSchema(args) {
         if (!incompatible && !invalidConnectors.length) {
             throw err;
         }
-        const migrationMode = await promptForSchemaMigration(options, databaseId, incompatible, validateOnly);
+        const migrationMode = await promptForSchemaMigration(options, instanceName, databaseId, incompatible, validateOnly, validationMode);
         const shouldDeleteInvalidConnectors = await promptForInvalidConnectorError(options, serviceName, invalidConnectors, validateOnly);
         let diffs = [];
         if (incompatible) {
@@ -82,24 +132,23 @@ async function migrateSchema(args) {
     return [];
 }
 exports.migrateSchema = migrateSchema;
-function setCompatibleMode(schema, databaseId, instanceName) {
-    var _a;
-    if (experiments.isEnabled("fdccompatiblemode")) {
-        if ((_a = schema.primaryDatasource.postgresql) === null || _a === void 0 ? void 0 : _a.schemaValidation) {
-            schema.primaryDatasource.postgresql.schemaValidation = "COMPATIBLE";
-        }
-        else {
-            schema.primaryDatasource = {
-                postgresql: {
-                    database: databaseId,
-                    cloudSql: {
-                        instance: instanceName,
-                    },
-                    schemaValidation: "COMPATIBLE",
-                },
-            };
+function diffsEqual(x, y) {
+    if (x.length !== y.length) {
+        return false;
+    }
+    for (let i = 0; i < x.length; i++) {
+        if (x[i].description !== y[i].description ||
+            x[i].destructive !== y[i].destructive ||
+            x[i].sql !== y[i].sql) {
+            return false;
         }
     }
+    return true;
+}
+function setSchemaValidationMode(schema, schemaValidation) {
+    if (experiments.isEnabled("fdccompatiblemode") && schema.primaryDatasource.postgresql) {
+        schema.primaryDatasource.postgresql.schemaValidation = schemaValidation;
+    }
 }
 function getIdentifiers(schema) {
     var _a, _b;
@@ -131,8 +180,6 @@ async function handleIncompatibleSchemaError(args) {
     if (incompatibleSchemaError.destructive && choice === "safe") {
         throw new error_1.FirebaseError("This schema migration includes potentially destructive changes. If you'd like to execute it anyway, rerun this command with --force");
     }
-    const projectId = (0, projectUtils_1.needProjectId)(options);
-    const iamUser = await (0, connect_1.setupIAMUser)(instanceId, databaseId, options);
     const commandsToExecute = incompatibleSchemaError.diffs
         .filter((d) => {
         switch (choice) {
@@ -146,25 +193,36 @@ async function handleIncompatibleSchemaError(args) {
     })
         .map((d) => d.sql);
     if (commandsToExecute.length) {
-        await (0, connect_1.execute)([
-            `SET ROLE "${(0, connect_1.firebaseowner)(databaseId)}"`,
-            ...commandsToExecute,
-            `GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA "public" TO PUBLIC`,
-        ], {
-            projectId,
-            instanceId,
-            databaseId,
-            username: iamUser,
-        });
-        return incompatibleSchemaError.diffs;
+        const commandsToExecuteBySuperUser = commandsToExecute.filter((sql) => sql.startsWith("CREATE EXTENSION") || sql.startsWith("CREATE SCHEMA"));
+        const commandsToExecuteByOwner = commandsToExecute.filter((sql) => !commandsToExecuteBySuperUser.includes(sql));
+        const userIsCSQLAdmin = await (0, permissions_1.iamUserIsCSQLAdmin)(options);
+        if (!userIsCSQLAdmin && commandsToExecuteBySuperUser.length) {
+            throw new error_1.FirebaseError(`Some SQL commands required for this migration require Admin permissions.\n 
+        Please ask a user with 'roles/cloudsql.admin' to apply the following commands.\n
+        ${commandsToExecuteBySuperUser.join("\n")}`);
+        }
+        if (userIsCSQLAdmin) {
+            await (0, connect_1.setupIAMUsers)(instanceId, databaseId, options);
+        }
+        if (!(await (0, permissions_1.checkSQLRoleIsGranted)(options, instanceId, databaseId, (0, permissions_1.firebaseowner)(databaseId), (await (0, connect_1.getIAMUser)(options)).user))) {
+            throw new error_1.FirebaseError(`Command aborted. Only users granted firebaseowner SQL role can run migrations.`);
+        }
+        if (commandsToExecuteBySuperUser.length) {
+            logger_1.logger.info(`The diffs require CloudSQL superuser permissions, attempting to apply changes as superuser.`);
+            await (0, connect_1.executeSqlCmdsAsSuperUser)(options, instanceId, databaseId, commandsToExecuteBySuperUser, false);
+        }
+        if (commandsToExecuteByOwner.length) {
+            await (0, connect_1.executeSqlCmdsAsIamUser)(options, instanceId, databaseId, [`SET ROLE "${(0, permissions_1.firebaseowner)(databaseId)}"`, ...commandsToExecuteByOwner], false);
+            return incompatibleSchemaError.diffs;
+        }
     }
     return [];
 }
-async function promptForSchemaMigration(options, databaseName, err, validateOnly) {
+async function promptForSchemaMigration(options, instanceName, databaseId, err, validateOnly, schemaValidation) {
     if (!err) {
         return "none";
     }
-    displaySchemaChanges(err);
+    displaySchemaChanges(err, schemaValidation, instanceName, databaseId);
     if (!options.nonInteractive) {
         if (validateOnly && options.force) {
             return "all";
@@ -179,7 +237,7 @@ async function promptForSchemaMigration(options, databaseName, err, validateOnly
                 { name: "Abort changes", value: "none" },
             ];
         return await (0, prompt_1.promptOnce)({
-            message: `Would you like to execute these changes against ${databaseName}?`,
+            message: `Would you like to execute these changes against ${databaseId}?`,
             type: "list",
             choices,
         });
@@ -264,19 +322,47 @@ async function ensureServiceIsConnectedToCloudSql(serviceName, instanceId, datab
         await (0, client_1.upsertSchema)(currentSchema, false);
     }
     catch (err) {
-        if (err.status >= 500) {
+        if ((err === null || err === void 0 ? void 0 : err.status) >= 500) {
             throw err;
         }
         logger_1.logger.debug(err);
     }
 }
-function displaySchemaChanges(error) {
+function displaySchemaChanges(error, schemaValidation, instanceName, databaseId) {
     switch (error.violationType) {
         case "INCOMPATIBLE_SCHEMA":
             {
-                const message = "Your new schema is incompatible with the schema of your CloudSQL database. " +
-                    "The following SQL statements will migrate your database schema to match your new Data Connect schema.\n" +
-                    error.diffs.map(toString).join("\n");
+                let message;
+                if (schemaValidation === "COMPATIBLE") {
+                    message =
+                        "Your new application schema is incompatible with the schema of your PostgreSQL database " +
+                            databaseId +
+                            " in your CloudSQL instance " +
+                            instanceName +
+                            ". " +
+                            "The following SQL statements will migrate your database schema to be compatible with your new Data Connect schema.\n" +
+                            error.diffs.map(toString).join("\n");
+                }
+                else if (schemaValidation === "STRICT_AFTER_COMPATIBLE") {
+                    message =
+                        "Your new application schema is compatible with the schema of your PostgreSQL database " +
+                            databaseId +
+                            " in your CloudSQL instance " +
+                            instanceName +
+                            ", but contains unused tables or columns. " +
+                            "The following optional SQL statements will migrate your database schema to match your new Data Connect schema.\n" +
+                            error.diffs.map(toString).join("\n");
+                }
+                else {
+                    message =
+                        "Your new application schema does not match the schema of your PostgreSQL database " +
+                            databaseId +
+                            " in your CloudSQL instance " +
+                            instanceName +
+                            ". " +
+                            "The following SQL statements will migrate your database schema to match your new Data Connect schema.\n" +
+                            error.diffs.map(toString).join("\n");
+                }
                 (0, utils_1.logLabeledWarning)("dataconnect", message);
             }
             break;

package/lib/dataconnect/types.js

@@ -22,6 +22,7 @@ function toDatasource(projectId, locationId, ds) {
                 cloudSql: {
                     instance: `projects/${projectId}/locations/${locationId}/instances/${ds.postgresql.cloudSql.instanceId}`,
                 },
+                schemaValidation: ds.postgresql.schemaValidation,
             },
         };
     }

package/lib/deploy/functions/release/planner.js

@@ -207,7 +207,8 @@ function checkForIllegalUpdate(want, have) {
 exports.checkForIllegalUpdate = checkForIllegalUpdate;
 function checkForV2Upgrade(want, have) {
     if (want.platform === "gcfv2" && have.platform === "gcfv1") {
-        throw new error_1.FirebaseError(`[${(0, functionsDeployHelper_1.getFunctionLabel)(have)}] Upgrading from GCFv1 to GCFv2 is not yet supported. Please delete your old function or wait for this feature to be ready.`);
+        throw new error_1.FirebaseError(`[${(0, functionsDeployHelper_1.getFunctionLabel)(have)}] Upgrading from 1st Gen to 2nd Gen is not yet supported. ` +
+            "See https://firebase.google.com/docs/functions/2nd-gen-upgrade before migrating to 2nd Gen.");
     }
 }
 exports.checkForV2Upgrade = checkForV2Upgrade;

package/lib/emulator/apphosting/index.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppHostingEmulator = void 0;
+const emulatorLogger_1 = require("../emulatorLogger");
+const types_1 = require("../types");
+const serve_1 = require("./serve");
+class AppHostingEmulator {
+    constructor(args) {
+        this.args = args;
+        this.logger = emulatorLogger_1.EmulatorLogger.forEmulator(types_1.Emulators.APPHOSTING);
+    }
+    async start() {
+        this.args.options.host = this.args.host;
+        this.args.options.port = this.args.port;
+        this.logger.logLabeled("INFO", types_1.Emulators.APPHOSTING, "starting apphosting emulator");
+        const { port } = await (0, serve_1.start)(this.args.options);
+        this.logger.logLabeled("INFO", types_1.Emulators.APPHOSTING, `serving on port ${port}`);
+    }
+    connect() {
+        this.logger.logLabeled("INFO", types_1.Emulators.APPHOSTING, "connecting apphosting emulator");
+        return Promise.resolve();
+    }
+    stop() {
+        this.logger.logLabeled("INFO", types_1.Emulators.APPHOSTING, "stopping apphosting emulator");
+        return Promise.resolve();
+    }
+    getInfo() {
+        return {
+            name: types_1.Emulators.APPHOSTING,
+            host: this.args.host,
+            port: this.args.port,
+        };
+    }
+    getName() {
+        return types_1.Emulators.APPHOSTING;
+    }
+}
+exports.AppHostingEmulator = AppHostingEmulator;

package/lib/emulator/apphosting/serve.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.serve = exports.start = void 0;
+const net_1 = require("net");
+const portUtils_1 = require("../portUtils");
+const spawn_1 = require("../../init/spawn");
+async function start(options) {
+    let port = options.port;
+    while (!(await availablePort(options.host, port))) {
+        port += 1;
+    }
+    serve(options, port);
+    return { port };
+}
+exports.start = start;
+function availablePort(host, port) {
+    return (0, portUtils_1.checkListenable)({
+        address: host,
+        port,
+        family: (0, net_1.isIPv4)(host) ? "IPv4" : "IPv6",
+    });
+}
+async function serve(options, port) {
+    await (0, spawn_1.wrapSpawn)("npm", ["run", "dev", "--", "-H", options.host, "-p", port], process.cwd());
+}
+exports.serve = serve;

package/lib/emulator/auth/handlers.js

@@ -131,6 +131,33 @@ function registerHandlers(app, getProjectStateByApiKey) {
                     }
                 }
             }
+            case "verifyAndChangeEmail": {
+                try {
+                    const { newEmail } = (0, operations_1.setAccountInfoImpl)(state, { oobCode });
+                    if (continueUrl) {
+                        return res.redirect(303, continueUrl);
+                    }
+                    else {
+                        return res.status(200).json({
+                            authEmulator: { success: `The email has been successfully changed.`, newEmail },
+                        });
+                    }
+                }
+                catch (e) {
+                    if (e instanceof errors_1.NotImplementedError ||
+                        (e instanceof errors_1.BadRequestError && e.message === "INVALID_OOB_CODE")) {
+                        return res.status(400).json({
+                            authEmulator: {
+                                error: `Your request to change your email has expired or the link has already been used.`,
+                                instructions: `Try changing your email again.`,
+                            },
+                        });
+                    }
+                    else {
+                        throw e;
+                    }
+                }
+            }
             case "signIn": {
                 if (!continueUrl) {
                     return res.status(400).json({

package/lib/emulator/auth/operations.js

@@ -616,6 +616,7 @@ function resetPassword(state, reqBody) {
         kind: "identitytoolkit#ResetPasswordResponse",
         requestType: oob.requestType,
         email: oob.requestType === "EMAIL_SIGNIN" ? undefined : oob.email,
+        newEmail: oob.newEmail,
     };
 }
 exports.resetPassword = resetPassword;
@@ -630,6 +631,7 @@ function sendOobCode(state, reqBody, ctx) {
         (0, errors_1.assert)((0, utils_1.parseAbsoluteUri)(reqBody.continueUrl), "INVALID_CONTINUE_URI : ((expected an absolute URI with valid scheme and host))");
     }
     let email;
+    let newEmail;
     let mode;
     switch (reqBody.requestType) {
         case "EMAIL_SIGNIN":
@@ -665,6 +667,24 @@ function sendOobCode(state, reqBody, ctx) {
                 email = user.email;
             }
             break;
+        case "VERIFY_AND_CHANGE_EMAIL":
+            mode = "verifyAndChangeEmail";
+            (0, errors_1.assert)(reqBody.newEmail, "MISSING_NEW_EMAIL");
+            newEmail = (0, utils_1.canonicalizeEmailAddress)(reqBody.newEmail);
+            if (reqBody.returnOobLink && !reqBody.idToken) {
+                (0, errors_1.assert)(reqBody.email, "MISSING_EMAIL");
+                email = (0, utils_1.canonicalizeEmailAddress)(reqBody.email);
+                const maybeUser = state.getUserByEmail(email);
+                (0, errors_1.assert)(maybeUser, "USER_NOT_FOUND");
+            }
+            else {
+                (0, errors_1.assert)(reqBody.idToken, "MISSING_ID_TOKEN");
+                const user = parseIdToken(state, reqBody.idToken).user;
+                (0, errors_1.assert)(user.email, "MISSING_EMAIL");
+                email = user.email;
+            }
+            (0, errors_1.assert)(!state.getUserByEmail(newEmail), "EMAIL_EXISTS");
+            break;
         default:
             throw new errors_1.NotImplementedError(reqBody.requestType);
     }
@@ -676,6 +696,7 @@ function sendOobCode(state, reqBody, ctx) {
         requestType: reqBody.requestType,
         mode,
         continueUrl: reqBody.continueUrl,
+        newEmail,
     });
     if (reqBody.returnOobLink) {
         return {
@@ -747,6 +768,7 @@ function setAccountInfoImpl(state, reqBody, { privileged = false, emulatorUrl =
     let user;
     let signInProvider;
     let isEmailUpdate = false;
+    let newEmail;
     if (reqBody.oobCode) {
         const oob = state.validateOobCode(reqBody.oobCode);
         (0, errors_1.assert)(oob, "INVALID_OOB_CODE");
@@ -763,6 +785,19 @@ function setAccountInfoImpl(state, reqBody, { privileged = false, emulatorUrl =
                 }
                 break;
             }
+            case "VERIFY_AND_CHANGE_EMAIL":
+                state.deleteOobCode(reqBody.oobCode);
+                const maybeUser = state.getUserByEmail(oob.email);
+                (0, errors_1.assert)(maybeUser, "INVALID_OOB_CODE");
+                (0, errors_1.assert)(oob.newEmail, "INVALID_OOB_CODE");
+                (0, errors_1.assert)(!state.getUserByEmail(oob.newEmail), "EMAIL_EXISTS");
+                user = maybeUser;
+                if (oob.newEmail !== user.email) {
+                    updates.email = oob.newEmail;
+                    updates.emailVerified = true;
+                    newEmail = oob.newEmail;
+                }
+                break;
             case "RECOVER_EMAIL": {
                 state.deleteOobCode(reqBody.oobCode);
                 const maybeUser = state.getUserByInitialEmail(oob.email);
@@ -792,7 +827,7 @@ function setAccountInfoImpl(state, reqBody, { privileged = false, emulatorUrl =
         }
         if (reqBody.email) {
             (0, errors_1.assert)((0, utils_1.isValidEmailAddress)(reqBody.email), "INVALID_EMAIL");
-            const newEmail = (0, utils_1.canonicalizeEmailAddress)(reqBody.email);
+            newEmail = (0, utils_1.canonicalizeEmailAddress)(reqBody.email);
             if (newEmail !== user.email) {
                 (0, errors_1.assert)(!state.getUserByEmail(newEmail), "EMAIL_EXISTS");
                 updates.email = newEmail;
@@ -882,7 +917,7 @@ function setAccountInfoImpl(state, reqBody, { privileged = false, emulatorUrl =
         }
         sendOobForEmailReset(state, user.initialEmail, emulatorUrl);
     }
-    return redactPasswordHash(Object.assign({ kind: "identitytoolkit#SetAccountInfoResponse", localId: user.localId, emailVerified: user.emailVerified, providerUserInfo: user.providerUserInfo, email: user.email, displayName: user.displayName, photoUrl: user.photoUrl, passwordHash: user.passwordHash }, (updates.validSince && signInProvider ? issueTokens(state, user, signInProvider) : {})));
+    return redactPasswordHash(Object.assign({ kind: "identitytoolkit#SetAccountInfoResponse", localId: user.localId, emailVerified: user.emailVerified, providerUserInfo: user.providerUserInfo, email: user.email, displayName: user.displayName, photoUrl: user.photoUrl, newEmail, passwordHash: user.passwordHash }, (updates.validSince && signInProvider ? issueTokens(state, user, signInProvider) : {})));
 }
 exports.setAccountInfoImpl = setAccountInfoImpl;
 function sendOobForEmailReset(state, initialEmail, url) {
@@ -893,7 +928,7 @@ function sendOobForEmailReset(state, initialEmail, url) {
     logOobMessage(oobRecord);
 }
 function createOobRecord(state, email, url, params) {
-    const oobRecord = state.createOob(email, params.requestType, (oobCode) => {
+    const oobRecord = state.createOob(email, params.newEmail, params.requestType, (oobCode) => {
         url.pathname = "/emulator/action";
         url.searchParams.set("mode", params.mode);
         url.searchParams.set("lang", "en");
@@ -923,6 +958,9 @@ function logOobMessage(oobRecord) {
         case "VERIFY_EMAIL":
             maybeMessage = `To verify the email address ${email}, follow this link: ${oobLink}`;
             break;
+        case "VERIFY_AND_CHANGE_EMAIL":
+            maybeMessage = `To verify and change the email address from ${email} to ${oobRecord.newEmail}, follow this link: ${oobLink}`;
+            break;
         case "RECOVER_EMAIL":
             maybeMessage = `To reset your email address to ${email}, follow this link: ${oobLink}`;
             break;

package/lib/emulator/auth/state.js

@@ -299,11 +299,12 @@ class ProjectState {
             secondFactor: record.secondFactor,
         };
     }
-    createOob(email, requestType, generateLink) {
+    createOob(email, newEmail, requestType, generateLink) {
         const oobCode = (0, utils_1.randomBase64UrlStr)(54);
         const oobLink = generateLink(oobCode);
         const oob = {
             email,
+            newEmail,
             requestType,
             oobCode,
             oobLink,

package/lib/emulator/constants.js

@@ -8,6 +8,7 @@ exports.DEFAULT_PORTS = {
     hosting: 5000,
     functions: 5001,
     extensions: 5001,
+    apphosting: 5002,
     firestore: 8080,
     pubsub: 8085,
     database: 9000,
@@ -22,6 +23,7 @@ exports.FIND_AVAILBLE_PORT_BY_DEFAULT = {
     hub: true,
     logging: true,
     hosting: true,
+    apphosting: true,
     functions: false,
     firestore: false,
     database: false,
@@ -38,6 +40,7 @@ exports.EMULATOR_DESCRIPTION = {
     hub: "emulator hub",
     logging: "Logging Emulator",
     hosting: "Hosting Emulator",
+    apphosting: "App Hosting Emulator",
     functions: "Functions Emulator",
     firestore: "Firestore Emulator",
     database: "Database Emulator",

package/lib/emulator/controller.js

@@ -45,6 +45,7 @@ const pubsubEmulator_1 = require("./pubsubEmulator");
 const storage_1 = require("./storage");
 const fileUtils_1 = require("../dataconnect/fileUtils");
 const tasksEmulator_1 = require("./tasksEmulator");
+const apphosting_1 = require("./apphosting");
 const START_LOGGING_EMULATOR = utils.envOverride("START_LOGGING_EMULATOR", "false", (val) => val === "true");
 async function exportOnExit(options) {
     const exportOnExitDir = options.exportOnExit;
@@ -571,6 +572,17 @@ async function startAll(options, showUI = true, runningTestScript = false) {
         });
         await startEmulator(hostingEmulator);
     }
+    if (experiments.isEnabled("emulatorapphosting")) {
+        if (listenForEmulator.apphosting) {
+            const apphostingAddr = legacyGetFirstAddr(types_1.Emulators.APPHOSTING);
+            const apphostingEmulator = new apphosting_1.AppHostingEmulator({
+                host: apphostingAddr.host,
+                port: apphostingAddr.port,
+                options,
+            });
+            await startEmulator(apphostingEmulator);
+        }
+    }
     if (listenForEmulator.logging) {
         const loggingAddr = legacyGetFirstAddr(types_1.Emulators.LOGGING);
         const loggingEmulator = new loggingEmulator_1.LoggingEmulator({

package/lib/emulator/downloadableEmulators.js

@@ -46,20 +46,20 @@ const EMULATOR_UPDATE_DETAILS = {
     },
     dataconnect: process.platform === "darwin"
         ? {
-            version: "1.3.5",
-            expectedSize: 24232704,
-            expectedChecksum: "4eabf613a4a5feeaa173e1375b62bde0",
+            version: "1.3.6",
+            expectedSize: 24867584,
+            expectedChecksum: "b924d31e3620d7ed4486a95e22629fc8",
         }
         : process.platform === "win32"
             ? {
-                version: "1.3.5",
-                expectedSize: 24651264,
-                expectedChecksum: "c7b2b7168ff7226f4e5626ae7d13e0ca",
+                version: "1.3.6",
+                expectedSize: 25292288,
+                expectedChecksum: "45025491b43b55a94f4e4db8df903250",
             }
             : {
-                version: "1.3.5",
-                expectedSize: 24146072,
-                expectedChecksum: "1457937751ce25fa332cdc16b561d64b",
+                version: "1.3.6",
+                expectedSize: 24785048,
+                expectedChecksum: "6ae5820c0470c5a954540ad97838ec01",
             },
 };
 exports.DownloadDetails = {

package/lib/emulator/portUtils.js

@@ -158,6 +158,7 @@ const EMULATOR_CAN_LISTEN_ON_PRIMARY_ONLY = {
     storage: true,
     tasks: true,
     hosting: true,
+    apphosting: true,
 };
 const MAX_PORT = 65535;
 async function resolveHostAndAssignPorts(listenConfig) {

package/lib/emulator/registry.js

@@ -42,6 +42,7 @@ class EmulatorRegistry {
             extensions: 1,
             functions: 1.1,
             hosting: 2,
+            apphosting: 2.1,
             database: 3.0,
             firestore: 3.1,
             pubsub: 3.2,

package/lib/emulator/types.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Severity = exports.EmulatorLog = exports.FunctionsExecutionMode = exports.isEmulator = exports.isDownloadableEmulator = exports.ALL_EMULATORS = exports.EMULATORS_SUPPORTED_BY_USE_EMULATOR = exports.EMULATORS_SUPPORTED_BY_UI = exports.EMULATORS_SUPPORTED_BY_FUNCTIONS = exports.ALL_SERVICE_EMULATORS = exports.IMPORT_EXPORT_EMULATORS = exports.DOWNLOADABLE_EMULATORS = exports.Emulators = void 0;
+const experiments = require("../experiments");
 var Emulators;
 (function (Emulators) {
     Emulators["AUTH"] = "auth";
@@ -9,6 +10,7 @@ var Emulators;
     Emulators["FIRESTORE"] = "firestore";
     Emulators["DATABASE"] = "database";
     Emulators["HOSTING"] = "hosting";
+    Emulators["APPHOSTING"] = "apphosting";
     Emulators["PUBSUB"] = "pubsub";
     Emulators["UI"] = "ui";
     Emulators["LOGGING"] = "logging";
@@ -38,6 +40,7 @@ exports.ALL_SERVICE_EMULATORS = [
     Emulators.FIRESTORE,
     Emulators.DATABASE,
     Emulators.HOSTING,
+    ...(experiments.isEnabled("emulatorapphosting") ? [Emulators.APPHOSTING] : []),
     Emulators.PUBSUB,
     Emulators.STORAGE,
     Emulators.EVENTARC,

package/lib/experiments.js

@@ -56,6 +56,10 @@ exports.ALL_EXPERIMENTS = experiments({
     emulatoruisnapshot: {
         shortDescription: "Load pre-release versions of the emulator UI",
     },
+    emulatorapphosting: {
+        shortDescription: "App Hosting emulator",
+        public: false,
+    },
     webframeworks: {
         shortDescription: "Native support for popular web frameworks",
         fullDescription: "Adds support for popular web frameworks such as Next.js " +

package/lib/firestore/api.js

@@ -459,11 +459,12 @@ class FirestoreApi {
         }
         return database;
     }
-    async restoreDatabase(project, databaseId, backupName) {
+    async restoreDatabase(project, databaseId, backupName, encryptionConfig) {
         const url = `/projects/${project}/databases:restore`;
         const payload = {
             databaseId,
             backup: backupName,
+            encryptionConfig: encryptionConfig,
         };
         const options = { queryParams: { databaseId: databaseId } };
         const res = await this.apiClient.post(url, payload, options);

package/lib/firestore/options.js

@@ -1,2 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.EncryptionType = void 0;
+var EncryptionType;
+(function (EncryptionType) {
+    EncryptionType["CUSTOMER_MANAGED_ENCRYPTION"] = "CUSTOMER_MANAGED_ENCRYPTION";
+    EncryptionType["USE_SOURCE_ENCRYPTION"] = "USE_SOURCE_ENCRYPTION";
+    EncryptionType["GOOGLE_DEFAULT_ENCRYPTION"] = "GOOGLE_DEFAULT_ENCRYPTION";
+})(EncryptionType = exports.EncryptionType || (exports.EncryptionType = {}));

package/lib/gcp/cloudsql/connect.js

@@ -1,15 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.firebaseowner = exports.setupIAMUser = exports.execute = void 0;
+exports.toDatabaseUser = exports.setupIAMUsers = exports.getIAMUser = exports.getDataConnectP4SA = exports.executeSqlCmdsAsSuperUser = exports.executeSqlCmdsAsIamUser = exports.execute = void 0;
 const pg = require("pg");
 const cloud_sql_connector_1 = require("@google-cloud/cloud-sql-connector");
 const requireAuth_1 = require("../../requireAuth");
 const projectUtils_1 = require("../../projectUtils");
+const api_1 = require("../../api");
 const cloudSqlAdminClient = require("./cloudsqladmin");
 const utils = require("../../utils");
 const logger_1 = require("../../logger");
 const error_1 = require("../../error");
 const fbToolsAuthClient_1 = require("./fbToolsAuthClient");
+const permissions_1 = require("./permissions");
 async function execute(sqlStatements, opts) {
     const logFn = opts.silent ? logger_1.logger.debug : logger_1.logger.info;
     const instance = await cloudSqlAdminClient.getInstance(opts.projectId, opts.instanceId);
@@ -74,52 +76,61 @@ async function execute(sqlStatements, opts) {
     connector.close();
 }
 exports.execute = execute;
-async function setupIAMUser(instanceId, databaseId, options) {
+async function executeSqlCmdsAsIamUser(options, instanceId, databaseId, cmds, silent = false) {
     const projectId = (0, projectUtils_1.needProjectId)(options);
+    const { user: iamUser } = await getIAMUser(options);
+    return await execute(cmds, {
+        projectId,
+        instanceId,
+        databaseId,
+        username: iamUser,
+        silent: silent,
+    });
+}
+exports.executeSqlCmdsAsIamUser = executeSqlCmdsAsIamUser;
+async function executeSqlCmdsAsSuperUser(options, instanceId, databaseId, cmds, silent = false) {
+    const projectId = (0, projectUtils_1.needProjectId)(options);
+    const superuser = "firebasesuperuser";
+    const temporaryPassword = utils.generateId(20);
+    await cloudSqlAdminClient.createUser(projectId, instanceId, "BUILT_IN", superuser, temporaryPassword);
+    return await execute([`SET ROLE = cloudsqlsuperuser`, ...cmds], {
+        projectId,
+        instanceId,
+        databaseId,
+        username: superuser,
+        password: temporaryPassword,
+        silent: silent,
+    });
+}
+exports.executeSqlCmdsAsSuperUser = executeSqlCmdsAsSuperUser;
+function getDataConnectP4SA(projectNumber) {
+    return `service-${projectNumber}@${(0, api_1.dataconnectP4SADomain)()}`;
+}
+exports.getDataConnectP4SA = getDataConnectP4SA;
+async function getIAMUser(options) {
     const account = await (0, requireAuth_1.requireAuth)(options);
     if (!account) {
         throw new error_1.FirebaseError("No account to set up! Run `firebase login` or set Application Default Credentials");
     }
-    const setupUser = "firebasesuperuser";
-    const temporaryPassword = utils.generateId(20);
-    await cloudSqlAdminClient.createUser(projectId, instanceId, "BUILT_IN", setupUser, temporaryPassword);
-    const { user, mode } = toDatabaseUser(account);
+    return toDatabaseUser(account);
+}
+exports.getIAMUser = getIAMUser;
+async function setupIAMUsers(instanceId, databaseId, options) {
+    const projectId = (0, projectUtils_1.needProjectId)(options);
+    const { user, mode } = await getIAMUser(options);
     await cloudSqlAdminClient.createUser(projectId, instanceId, mode, user);
+    const projectNumber = await (0, projectUtils_1.needProjectNumber)(options);
+    const { user: fdcP4SAUser, mode: fdcP4SAmode } = toDatabaseUser(getDataConnectP4SA(projectNumber));
+    await cloudSqlAdminClient.createUser(projectId, instanceId, fdcP4SAmode, fdcP4SAUser);
+    await (0, permissions_1.setupSQLPermissions)(instanceId, databaseId, options, true);
     const grants = [
-        `do
-      $$
-      begin
-        if not exists (select FROM pg_catalog.pg_roles
-          WHERE  rolname = '${firebaseowner(databaseId)}') then
-          CREATE ROLE "${firebaseowner(databaseId)}" WITH ADMIN "${setupUser}";
-        end if;
-      end
-      $$
-      ;`,
-        `GRANT ALL PRIVILEGES ON DATABASE "${databaseId}" TO "${firebaseowner(databaseId)}"`,
-        `GRANT cloudsqlsuperuser TO "${firebaseowner(databaseId)}"`,
-        `GRANT "${firebaseowner(databaseId)}" TO "${setupUser}"`,
-        `GRANT "${firebaseowner(databaseId)}" TO "${user}"`,
-        `ALTER SCHEMA public OWNER TO "${firebaseowner(databaseId)}"`,
-        `GRANT USAGE ON SCHEMA "public" TO PUBLIC`,
-        `GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA "public" TO PUBLIC`,
-        `GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA "public" TO PUBLIC`,
+        `GRANT "${(0, permissions_1.firebaseowner)(databaseId)}" TO "${user}"`,
+        `GRANT "${(0, permissions_1.firebasewriter)(databaseId)}" TO "${fdcP4SAUser}"`,
     ];
-    await execute(grants, {
-        projectId,
-        instanceId,
-        databaseId,
-        username: setupUser,
-        password: temporaryPassword,
-        silent: true,
-    });
+    await executeSqlCmdsAsSuperUser(options, instanceId, databaseId, grants, true);
     return user;
 }
-exports.setupIAMUser = setupIAMUser;
-function firebaseowner(databaseId) {
-    return `firebaseowner_${databaseId}_public`;
-}
-exports.firebaseowner = firebaseowner;
+exports.setupIAMUsers = setupIAMUsers;
 function toDatabaseUser(account) {
     let mode = "CLOUD_IAM_USER";
     let user = account;
@@ -129,3 +140,4 @@ function toDatabaseUser(account) {
     }
     return { user, mode };
 }
+exports.toDatabaseUser = toDatabaseUser;

package/lib/gcp/cloudsql/permissions.js

@@ -0,0 +1,160 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setupSQLPermissions = exports.iamUserIsCSQLAdmin = exports.checkSQLRoleIsGranted = exports.firebasewriter = exports.firebasereader = exports.firebaseowner = void 0;
+const projectUtils_1 = require("../../projectUtils");
+const connect_1 = require("./connect");
+const iam_1 = require("../iam");
+const logger_1 = require("../../logger");
+const lodash_1 = require("lodash");
+const error_1 = require("../../error");
+function firebaseowner(databaseId) {
+    return `firebaseowner_${databaseId}_public`;
+}
+exports.firebaseowner = firebaseowner;
+function firebasereader(databaseId) {
+    return `firebasereader_${databaseId}_public`;
+}
+exports.firebasereader = firebasereader;
+function firebasewriter(databaseId) {
+    return `firebasewriter_${databaseId}_public`;
+}
+exports.firebasewriter = firebasewriter;
+async function checkSQLRoleIsGranted(options, instanceId, databaseId, grantedRole, granteeRole) {
+    const checkCmd = `
+    DO $$
+    DECLARE
+        role_count INTEGER;
+    BEGIN
+        -- Count the number of rows matching the criteria
+        SELECT COUNT(*)
+        INTO role_count
+        FROM
+          pg_auth_members m
+        JOIN
+          pg_roles grantee ON grantee.oid = m.member
+        JOIN
+          pg_roles granted ON granted.oid = m.roleid
+        JOIN
+          pg_roles grantor ON grantor.oid = m.grantor
+        WHERE
+          granted.rolname = '${grantedRole}'
+          AND grantee.rolname = '${granteeRole}';
+
+        -- If no rows were found, raise an exception
+        IF role_count = 0 THEN
+            RAISE EXCEPTION 'Role "%", is not granted to role "%".', '${grantedRole}', '${granteeRole}';
+        END IF;
+    END $$;
+`;
+    try {
+        await (0, connect_1.executeSqlCmdsAsIamUser)(options, instanceId, databaseId, [checkCmd], true);
+        return true;
+    }
+    catch (e) {
+        if (e instanceof error_1.FirebaseError && e.message.includes("not granted to role")) {
+            return false;
+        }
+        logger_1.logger.error(`Role Check Failed: ${e}`);
+        throw e;
+    }
+}
+exports.checkSQLRoleIsGranted = checkSQLRoleIsGranted;
+async function iamUserIsCSQLAdmin(options) {
+    const projectId = (0, projectUtils_1.needProjectId)(options);
+    const requiredPermissions = [
+        "cloudsql.instances.connect",
+        "cloudsql.instances.get",
+        "cloudsql.users.create",
+        "cloudsql.users.update",
+    ];
+    try {
+        const iamResult = await (0, iam_1.testIamPermissions)(projectId, requiredPermissions);
+        return iamResult.passed;
+    }
+    catch (err) {
+        logger_1.logger.debug(`[iam] error while checking permissions, command may fail: ${err}`);
+        return false;
+    }
+}
+exports.iamUserIsCSQLAdmin = iamUserIsCSQLAdmin;
+function ownerRolePermissions(databaseId, superuser, schema) {
+    const firebaseOwnerRole = firebaseowner(databaseId);
+    return [
+        `do
+      $$
+      begin
+        if not exists (select FROM pg_catalog.pg_roles
+          WHERE  rolname = '${firebaseOwnerRole}') then
+          CREATE ROLE "${firebaseOwnerRole}" WITH ADMIN "${superuser}";
+        end if;
+      end
+      $$
+    ;`,
+        `GRANT "${firebaseOwnerRole}" TO "cloudsqlsuperuser"`,
+        `ALTER SCHEMA "${schema}" OWNER TO "${firebaseOwnerRole}"`,
+        `GRANT USAGE ON SCHEMA "${schema}" TO "${firebaseOwnerRole}"`,
+        `GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA "${schema}" TO "${firebaseOwnerRole}"`,
+        `GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA "${schema}" TO "${firebaseOwnerRole}"`,
+    ];
+}
+function writerRolePermissions(databaseId, superuser, schema) {
+    const firebaseWriterRole = firebasewriter(databaseId);
+    return [
+        `do
+      $$
+      begin
+        if not exists (select FROM pg_catalog.pg_roles
+          WHERE  rolname = '${firebaseWriterRole}') then
+          CREATE ROLE "${firebaseWriterRole}" WITH ADMIN "${superuser}";
+        end if;
+      end
+      $$
+    ;`,
+        `GRANT "${firebaseWriterRole}" TO "cloudsqlsuperuser"`,
+        `GRANT USAGE ON SCHEMA "${schema}" TO "${firebaseWriterRole}"`,
+        `GRANT SELECT, INSERT, UPDATE, DELETE, TRUNCATE ON ALL TABLES IN SCHEMA "${schema}" TO "${firebaseWriterRole}"`,
+        `GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA "${schema}" TO "${firebaseWriterRole}"`,
+        `GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA "${schema}" TO "${firebaseWriterRole}"`,
+        `SET ROLE = '${firebaseowner(databaseId)}';`,
+        `ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT SELECT, INSERT, UPDATE, DELETE, TRUNCATE ON TABLES TO "${firebaseWriterRole}";`,
+        `ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT USAGE ON SEQUENCES TO "${firebaseWriterRole}";`,
+        `ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT EXECUTE ON FUNCTIONS TO "${firebaseWriterRole}"`,
+        `SET ROLE = cloudsqlsuperuser`,
+    ];
+}
+function readerRolePermissions(databaseId, superuser, schema) {
+    const firebaseReaderRole = firebasereader(databaseId);
+    return [
+        `do
+      $$
+      begin
+        if not exists (select FROM pg_catalog.pg_roles
+          WHERE  rolname = '${firebaseReaderRole}') then
+          CREATE ROLE "${firebaseReaderRole}" WITH ADMIN "${superuser}";
+        end if;
+      end
+      $$
+    ;`,
+        `GRANT "${firebaseReaderRole}" TO "cloudsqlsuperuser"`,
+        `GRANT USAGE ON SCHEMA "${schema}" TO "${firebaseReaderRole}"`,
+        `GRANT SELECT ON ALL TABLES IN SCHEMA "${schema}" TO "${firebaseReaderRole}"`,
+        `GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA "${schema}" TO "${firebaseReaderRole}"`,
+        `GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA "${schema}" TO "${firebaseReaderRole}"`,
+        `SET ROLE = '${firebaseowner(databaseId)}';`,
+        `ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT SELECT ON TABLES TO "${firebaseReaderRole}";`,
+        `ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT SELECT, USAGE ON SEQUENCES TO "${firebaseReaderRole}";`,
+        `ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT EXECUTE ON FUNCTIONS TO "${firebaseReaderRole}"`,
+        `SET ROLE = cloudsqlsuperuser`,
+    ];
+}
+async function setupSQLPermissions(instanceId, databaseId, options, silent = false) {
+    const superuser = "firebasesuperuser";
+    const revokes = [];
+    if (await checkSQLRoleIsGranted(options, instanceId, databaseId, "cloudsqlsuperuser", firebaseowner(databaseId))) {
+        logger_1.logger.warn("Detected cloudsqlsuperuser was previously given to firebase owner, revoking to improve database security.");
+        revokes.push(`REVOKE "cloudsqlsuperuser" FROM "${firebaseowner(databaseId)}"`);
+    }
+    const sqlRoleSetupCmds = (0, lodash_1.concat)(revokes, [`CREATE SCHEMA IF NOT EXISTS "public"`], ownerRolePermissions(databaseId, superuser, "public"), writerRolePermissions(databaseId, superuser, "public"), readerRolePermissions(databaseId, superuser, "public"));
+    return (0, connect_1.executeSqlCmdsAsSuperUser)(options, instanceId, databaseId, sqlRoleSetupCmds, silent);
+}
+exports.setupSQLPermissions = setupSQLPermissions;

package/lib/init/features/dataconnect/index.js

@@ -188,7 +188,7 @@ async function promptForService(setup, info) {
                             const id = c.name.split("/").pop();
                             return {
                                 id,
-                                path: `./${id}`,
+                                path: connectors.length === 1 ? "./connector" : `./${id}`,
                                 files: c.source.files || [],
                             };
                         });

package/lib/utils.js

@@ -589,6 +589,14 @@ function readSecretValue(prompt, dataFile) {
     if (dataFile && dataFile !== "-") {
         input = dataFile;
     }
-    return Promise.resolve(fs.readFileSync(input, "utf-8"));
+    try {
+        return Promise.resolve(fs.readFileSync(input, "utf-8"));
+    }
+    catch (e) {
+        if (e.code === "ENOENT") {
+            throw new error_1.FirebaseError(`File not found: ${input}`, { original: e });
+        }
+        throw e;
+    }
 }
 exports.readSecretValue = readSecretValue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "firebase-tools",
-  "version": "13.16.0",
+  "version": "13.17.0",
   "description": "Command-Line Interface for Firebase",
   "main": "./lib/index.js",
   "bin": {

package/schema/firebase-config.json

@@ -357,6 +357,18 @@
         "emulators": {
             "additionalProperties": false,
             "properties": {
+                "apphosting": {
+                    "additionalProperties": false,
+                    "properties": {
+                        "host": {
+                            "type": "string"
+                        },
+                        "port": {
+                            "type": "number"
+                        }
+                    },
+                    "type": "object"
+                },
                 "auth": {
                     "additionalProperties": false,
                     "properties": {