firebase-tools 13.16.0 → 13.18.0

package/lib/api.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.cloudRunApiOrigin = exports.hostingApiOrigin = exports.firebaseStorageOrigin = exports.storageOrigin = exports.runtimeconfigOrigin = exports.rulesOrigin = exports.resourceManagerOrigin = exports.remoteConfigApiOrigin = exports.rtdbMetadataOrigin = exports.rtdbManagementOrigin = exports.realtimeOrigin = exports.extensionsTOSOrigin = exports.extensionsPublisherOrigin = exports.extensionsOrigin = exports.iamOrigin = exports.identityOrigin = exports.hostingOrigin = exports.googleOrigin = exports.pubsubOrigin = exports.cloudTasksOrigin = exports.cloudschedulerOrigin = exports.cloudbuildOrigin = exports.functionsDefaultRegion = exports.runOrigin = exports.functionsV2Origin = exports.functionsOrigin = exports.firestoreOrigin = exports.firestoreOriginOrEmulator = exports.firedataOrigin = exports.firebaseExtensionsRegistryOrigin = exports.firebaseApiOrigin = exports.eventarcOrigin = exports.dynamicLinksKey = exports.dynamicLinksOrigin = exports.consoleOrigin = exports.authOrigin = exports.apphostingGitHubAppInstallationURL = exports.apphostingP4SADomain = exports.apphostingOrigin = exports.appDistributionOrigin = exports.artifactRegistryDomain = exports.developerConnectP4SADomain = exports.developerConnectOrigin = exports.containerRegistryDomain = exports.cloudMonitoringOrigin = exports.cloudloggingOrigin = exports.cloudbillingOrigin = exports.clientSecret = exports.clientId = exports.authProxyOrigin = void 0;
-exports.setScopes = exports.getScopes = exports.vertexAIOrigin = exports.cloudSQLAdminOrigin = exports.dataConnectLocalConnString = exports.dataconnectOrigin = exports.githubClientSecret = exports.githubClientId = exports.computeOrigin = exports.secretManagerOrigin = exports.githubApiOrigin = exports.githubOrigin = exports.serviceUsageOrigin = void 0;
+exports.setScopes = exports.getScopes = exports.vertexAIOrigin = exports.cloudSQLAdminOrigin = exports.dataConnectLocalConnString = exports.dataconnectP4SADomain = exports.dataconnectOrigin = exports.githubClientSecret = exports.githubClientId = exports.computeOrigin = exports.secretManagerOrigin = exports.githubApiOrigin = exports.githubOrigin = exports.serviceUsageOrigin = void 0;
 const constants_1 = require("./emulator/constants");
 const logger_1 = require("./logger");
 const scopes = require("./scopes");
@@ -128,6 +128,8 @@ const githubClientSecret = () => utils.envOverride("GITHUB_CLIENT_SECRET", "3330
 exports.githubClientSecret = githubClientSecret;
 const dataconnectOrigin = () => utils.envOverride("FIREBASE_DATACONNECT_URL", "https://firebasedataconnect.googleapis.com");
 exports.dataconnectOrigin = dataconnectOrigin;
+const dataconnectP4SADomain = () => utils.envOverride("FIREBASE_DATACONNECT_P4SA_DOMAIN", "gcp-sa-firebasedataconnect.iam.gserviceaccount.com");
+exports.dataconnectP4SADomain = dataconnectP4SADomain;
 const dataConnectLocalConnString = () => utils.envOverride("FIREBASE_DATACONNECT_POSTGRESQL_STRING", "");
 exports.dataConnectLocalConnString = dataConnectLocalConnString;
 const cloudSQLAdminOrigin = () => utils.envOverride("CLOUD_SQL_URL", "https://sqladmin.googleapis.com");

package/lib/apphosting/index.js

@@ -33,7 +33,8 @@ async function tlsReady(url) {
     }
     catch (err) {
         const maybeNodeError = err;
-        if (/HANDSHAKE_FAILURE/.test((_a = maybeNodeError === null || maybeNodeError === void 0 ? void 0 : maybeNodeError.cause) === null || _a === void 0 ? void 0 : _a.code)) {
+        if (/HANDSHAKE_FAILURE/.test((_a = maybeNodeError === null || maybeNodeError === void 0 ? void 0 : maybeNodeError.cause) === null || _a === void 0 ? void 0 : _a.code) ||
+            "EPROTO" === (maybeNodeError === null || maybeNodeError === void 0 ? void 0 : maybeNodeError.code)) {
             return false;
         }
         return true;

package/lib/commands/dataconnect-services-list.js

@@ -36,14 +36,15 @@ exports.command = new command_1.Command("dataconnect:services:list")
     for (const service of services) {
         const schema = (_a = (await client.getSchema(service.name))) !== null && _a !== void 0 ? _a : {
             name: "",
-            primaryDatasource: {},
+            datasources: [{}],
             source: { files: [] },
         };
         const connectors = await client.listConnectors(service.name);
         const serviceName = names.parseServiceName(service.name);
-        const instanceName = (_c = (_b = schema === null || schema === void 0 ? void 0 : schema.primaryDatasource.postgresql) === null || _b === void 0 ? void 0 : _b.cloudSql.instance) !== null && _c !== void 0 ? _c : "";
+        const postgresDatasource = schema === null || schema === void 0 ? void 0 : schema.datasources.find((d) => d.postgresql);
+        const instanceName = (_c = (_b = postgresDatasource === null || postgresDatasource === void 0 ? void 0 : postgresDatasource.postgresql) === null || _b === void 0 ? void 0 : _b.cloudSql.instance) !== null && _c !== void 0 ? _c : "";
         const instanceId = instanceName.split("/").pop();
-        const dbId = (_e = (_d = schema === null || schema === void 0 ? void 0 : schema.primaryDatasource.postgresql) === null || _d === void 0 ? void 0 : _d.database) !== null && _e !== void 0 ? _e : "";
+        const dbId = (_e = (_d = postgresDatasource === null || postgresDatasource === void 0 ? void 0 : postgresDatasource.postgresql) === null || _d === void 0 ? void 0 : _d.database) !== null && _e !== void 0 ? _e : "";
         const dbName = `CloudSQL Instance: ${instanceId}\nDatabase: ${dbId}`;
         table.push([
             serviceName.serviceId,

package/lib/commands/dataconnect-sql-diff.js

@@ -17,9 +17,10 @@ exports.command = new command_1.Command("dataconnect:sql:diff [serviceId]")
 ])
     .before(requireAuth_1.requireAuth)
     .action(async (serviceId, options) => {
+    var _a;
     const projectId = (0, projectUtils_1.needProjectId)(options);
     await (0, ensureApis_1.ensureApis)(projectId);
     const serviceInfo = await (0, fileUtils_1.pickService)(projectId, options.config, serviceId);
-    const diffs = await (0, schemaMigration_1.diffSchema)(serviceInfo.schema);
+    const diffs = await (0, schemaMigration_1.diffSchema)(serviceInfo.schema, (_a = serviceInfo.dataConnectYaml.schema.datasource.postgresql) === null || _a === void 0 ? void 0 : _a.schemaValidation);
     return { projectId, serviceId, diffs };
 });

package/lib/commands/dataconnect-sql-grant.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.command = void 0;
+const command_1 = require("../command");
+const projectUtils_1 = require("../projectUtils");
+const ensureApis_1 = require("../dataconnect/ensureApis");
+const requirePermissions_1 = require("../requirePermissions");
+const fileUtils_1 = require("../dataconnect/fileUtils");
+const schemaMigration_1 = require("../dataconnect/schemaMigration");
+const requireAuth_1 = require("../requireAuth");
+const error_1 = require("../error");
+const permissions_1 = require("../gcp/cloudsql/permissions");
+const allowedRoles = Object.keys(permissions_1.fdcSqlRoleMap);
+exports.command = new command_1.Command("dataconnect:sql:grant [serviceId]")
+    .description("Grants the SQL role <role> to the provided user or service account <email>.")
+    .option("-R, --role <role>", "The SQL role to grant. One of: owner, writer, or reader.")
+    .option("-E, --email <email>", "The email of the user or service account we would like to grant the role to.")
+    .before(requirePermissions_1.requirePermissions, ["firebasedataconnect.services.list"])
+    .before(requireAuth_1.requireAuth)
+    .action(async (serviceId, options) => {
+    const role = options.role;
+    const email = options.email;
+    if (!role) {
+        throw new error_1.FirebaseError("-R, --role <role> is required. Run the command with -h for more info.");
+    }
+    if (!email) {
+        throw new error_1.FirebaseError("-E, --email <email> is required. Run the command with -h for more info.");
+    }
+    if (!allowedRoles.includes(role.toLowerCase())) {
+        throw new error_1.FirebaseError(`Role should be one of ${allowedRoles.join(" | ")}.`);
+    }
+    const projectId = (0, projectUtils_1.needProjectId)(options);
+    await (0, ensureApis_1.ensureApis)(projectId);
+    const serviceInfo = await (0, fileUtils_1.pickService)(projectId, options.config, serviceId);
+    await (0, schemaMigration_1.grantRoleToUserInSchema)(options, serviceInfo.schema);
+    return { projectId, serviceId };
+});

package/lib/commands/dataconnect-sql-migrate.js

@@ -17,12 +17,11 @@ exports.command = new command_1.Command("dataconnect:sql:migrate [serviceId]")
     "firebasedataconnect.schemas.list",
     "firebasedataconnect.schemas.update",
     "cloudsql.instances.connect",
-    "cloudsql.users.create",
 ])
     .before(requireAuth_1.requireAuth)
     .withForce("Execute any required database changes without prompting")
     .action(async (serviceId, options) => {
-    var _a;
+    var _a, _b;
     const projectId = (0, projectUtils_1.needProjectId)(options);
     await (0, ensureApis_1.ensureApis)(projectId);
     const serviceInfo = await (0, fileUtils_1.pickService)(projectId, options.config, serviceId);
@@ -34,6 +33,7 @@ exports.command = new command_1.Command("dataconnect:sql:migrate [serviceId]")
         options,
         schema: serviceInfo.schema,
         validateOnly: true,
+        schemaValidation: (_b = serviceInfo.dataConnectYaml.schema.datasource.postgresql) === null || _b === void 0 ? void 0 : _b.schemaValidation,
     });
     if (diffs.length) {
         (0, utils_1.logLabeledSuccess)("dataconnect", `Database schema sucessfully migrated! Run 'firebase deploy' to deploy your new schema to your Data Connect service.`);

package/lib/commands/deploy.js

@@ -86,6 +86,8 @@ exports.command = new command_1.Command("deploy")
     "For data connect, can specify filters with colons to deploy only a service, connector, or schema" +
     '(e.g. "--only dataconnect:serviceId,dataconnect:serviceId:connectorId,dataconnect:serviceId:schema"). ')
     .option("--except <targets>", 'deploy to all targets except specified (e.g. "database")')
+    .option("--dry-run", "Perform a dry run of your deployment. Validates your changes and builds your code without deploying any changes to your project. " +
+    "In order to provide better validation, this may still enable APIs on the target project.")
     .before(requireConfig_1.requireConfig)
     .before((options) => {
     options.filteredTargets = (0, filterTargets_1.filterTargets)(options, exports.VALID_DEPLOY_TARGETS);

package/lib/commands/firestore-databases-restore.js

@@ -8,12 +8,17 @@ const logger_1 = require("../logger");
 const requirePermissions_1 = require("../requirePermissions");
 const types_1 = require("../emulator/types");
 const commandUtils_1 = require("../emulator/commandUtils");
+const options_1 = require("../firestore/options");
 const pretty_print_1 = require("../firestore/pretty-print");
 const error_1 = require("../error");
 exports.command = new command_1.Command("firestore:databases:restore")
     .description("Restore a Firestore database in your Firebase project.")
     .option("-d, --database <databaseID>", "ID of the database to restore into")
     .option("-b, --backup <backup>", "Backup from which to restore")
+    .option("-e, --encryption-type <encryptionType>", `Encryption method of the restored database; one of ${options_1.EncryptionType.USE_SOURCE_ENCRYPTION} (default), ` +
+    `${options_1.EncryptionType.CUSTOMER_MANAGED_ENCRYPTION}, ${options_1.EncryptionType.GOOGLE_DEFAULT_ENCRYPTION}`)
+    .option("-k, --kms-key-name <kmsKeyName>", "Resource ID of the Cloud KMS key to encrypt the restored database. This " +
+    "feature is allowlist only in initial launch.")
     .before(requirePermissions_1.requirePermissions, ["datastore.backups.restoreDatabase"])
     .before(commandUtils_1.warnEmulatorNotSupported, types_1.Emulators.FIRESTORE)
     .action(async (options) => {
@@ -28,7 +33,28 @@ exports.command = new command_1.Command("firestore:databases:restore")
         throw new error_1.FirebaseError(`Missing required flag --backup. ${helpCommandText}`);
     }
     const backupName = options.backup;
-    const databaseResp = await api.restoreDatabase(options.project, databaseId, backupName);
+    let encryptionConfig = undefined;
+    switch (options.encryptionType) {
+        case options_1.EncryptionType.GOOGLE_DEFAULT_ENCRYPTION:
+            throwIfKmsKeyNameIsSet(options.kmsKeyName);
+            encryptionConfig = { googleDefaultEncryption: {} };
+            break;
+        case options_1.EncryptionType.USE_SOURCE_ENCRYPTION:
+            throwIfKmsKeyNameIsSet(options.kmsKeyName);
+            encryptionConfig = { useSourceEncryption: {} };
+            break;
+        case options_1.EncryptionType.CUSTOMER_MANAGED_ENCRYPTION:
+            encryptionConfig = {
+                customerManagedEncryption: { kmsKeyName: getKmsKeyOrThrow(options.kmsKeyName) },
+            };
+            break;
+        case undefined:
+            throwIfKmsKeyNameIsSet(options.kmsKeyName);
+            break;
+        default:
+            throw new error_1.FirebaseError(`Invalid value for flag --encryption-type. ${helpCommandText}`);
+    }
+    const databaseResp = await api.restoreDatabase(options.project, databaseId, backupName, encryptionConfig);
     if (options.json) {
         logger_1.logger.info(JSON.stringify(databaseResp, undefined, 2));
     }
@@ -40,4 +66,16 @@ exports.command = new command_1.Command("firestore:databases:restore")
         logger_1.logger.info(`Once the restore is complete, your database may be viewed at ${printer.firebaseConsoleDatabaseUrl(options.project, databaseId)}`);
     }
     return databaseResp;
+    function throwIfKmsKeyNameIsSet(kmsKeyName) {
+        if (kmsKeyName) {
+            throw new error_1.FirebaseError("--kms-key-name can only be set when specifying an --encryption-type " +
+                `of ${options_1.EncryptionType.CUSTOMER_MANAGED_ENCRYPTION}.`);
+        }
+    }
+    function getKmsKeyOrThrow(kmsKeyName) {
+        if (kmsKeyName)
+            return kmsKeyName;
+        throw new error_1.FirebaseError("--kms-key-name must be provided when specifying an --encryption-type " +
+            `of ${options_1.EncryptionType.CUSTOMER_MANAGED_ENCRYPTION}.`);
+    }
 });

package/lib/commands/index.js

@@ -207,6 +207,7 @@ function load(client) {
     client.dataconnect.sql = {};
     client.dataconnect.sql.diff = loadCommand("dataconnect-sql-diff");
     client.dataconnect.sql.migrate = loadCommand("dataconnect-sql-migrate");
+    client.dataconnect.sql.grant = loadCommand("dataconnect-sql-grant");
     client.dataconnect.sdk = {};
     client.dataconnect.sdk.generate = loadCommand("dataconnect-sdk-generate");
     client.target = loadCommand("target");

package/lib/dataconnect/client.js

@@ -5,7 +5,7 @@ const api_1 = require("../api");
 const apiv2_1 = require("../apiv2");
 const operationPoller = require("../operation-poller");
 const types = require("./types");
-const DATACONNECT_API_VERSION = "v1alpha";
+const DATACONNECT_API_VERSION = "v1beta";
 const PAGE_SIZE_MAX = 100;
 const dataconnectClient = () => new apiv2_1.Client({
     urlPrefix: (0, api_1.dataconnectOrigin)(),

package/lib/dataconnect/dataplaneClient.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.executeGraphQL = void 0;
 const api_1 = require("../api");
 const apiv2_1 = require("../apiv2");
-const DATACONNECT_API_VERSION = "v1alpha";
+const DATACONNECT_API_VERSION = "v1beta";
 const dataconnectDataplaneClient = () => new apiv2_1.Client({
     urlPrefix: (0, api_1.dataconnectOrigin)(),
     apiVersion: DATACONNECT_API_VERSION,

package/lib/dataconnect/ensureApis.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ensureApis = void 0;
+exports.ensureSparkApis = exports.ensureApis = void 0;
 const api = require("../api");
 const ensureApiEnabled_1 = require("../ensureApiEnabled");
 async function ensureApis(projectId) {
@@ -10,3 +10,9 @@ async function ensureApis(projectId) {
     await (0, ensureApiEnabled_1.ensure)(projectId, api.computeOrigin(), prefix);
 }
 exports.ensureApis = ensureApis;
+async function ensureSparkApis(projectId) {
+    const prefix = "dataconnect";
+    await (0, ensureApiEnabled_1.ensure)(projectId, api.dataconnectOrigin(), prefix);
+    await (0, ensureApiEnabled_1.ensure)(projectId, api.cloudSQLAdminOrigin(), prefix);
+}
+exports.ensureSparkApis = ensureSparkApis;

package/lib/dataconnect/load.js

@@ -30,7 +30,9 @@ async function load(projectId, config, sourceDirectory) {
         sourceDirectory: resolvedDir,
         schema: {
             name: `${serviceName}/schemas/${types_1.SCHEMA_ID}`,
-            primaryDatasource: (0, types_1.toDatasource)(projectId, dataConnectYaml.location, dataConnectYaml.schema.datasource),
+            datasources: [
+                (0, types_1.toDatasource)(projectId, dataConnectYaml.location, dataConnectYaml.schema.datasource),
+            ],
             source: {
                 files: schemaGQLs,
             },

package/lib/dataconnect/provisionCloudSql.js

@@ -11,19 +11,22 @@ const freeTrial_1 = require("./freeTrial");
 const error_1 = require("../error");
 async function provisionCloudSql(args) {
     let connectionName = "";
-    const { projectId, locationId, instanceId, databaseId, enableGoogleMlIntegration, waitForCreation, silent, } = args;
+    const { projectId, locationId, instanceId, databaseId, enableGoogleMlIntegration, waitForCreation, silent, dryRun, } = args;
     try {
         const existingInstance = await cloudSqlAdminClient.getInstance(projectId, instanceId);
         silent || utils.logLabeledBullet("dataconnect", `Found existing instance ${instanceId}.`);
         connectionName = (existingInstance === null || existingInstance === void 0 ? void 0 : existingInstance.connectionName) || "";
         const why = getUpdateReason(existingInstance, enableGoogleMlIntegration);
         if (why) {
+            const cta = dryRun
+                ? `It will be updated on your next deploy.`
+                : `Updating instance. This may take a few minutes...`;
             silent ||
-                utils.logLabeledBullet("dataconnect", `Instance ${instanceId} settings not compatible with Firebase Data Connect. ` +
-                    `Updating instance. This may take a few minutes...` +
-                    why);
-            await (0, utils_1.promiseWithSpinner)(() => cloudSqlAdminClient.updateInstanceForDataConnect(existingInstance, enableGoogleMlIntegration), "Updating your instance...");
-            silent || utils.logLabeledBullet("dataconnect", "Instance updated");
+                utils.logLabeledBullet("dataconnect", `Instance ${instanceId} settings not compatible with Firebase Data Connect. ` + cta + why);
+            if (!dryRun) {
+                await (0, utils_1.promiseWithSpinner)(() => cloudSqlAdminClient.updateInstanceForDataConnect(existingInstance, enableGoogleMlIntegration), "Updating your instance...");
+                silent || utils.logLabeledBullet("dataconnect", "Instance updated");
+            }
         }
     }
     catch (err) {
@@ -35,19 +38,23 @@ async function provisionCloudSql(args) {
             (0, freeTrial_1.printFreeTrialUnavailable)(projectId, freeTrialInstanceId);
             throw new error_1.FirebaseError("Free trial unavailable.");
         }
+        const cta = dryRun ? "It will be created on your next deploy" : "Creating it now.";
         silent ||
-            utils.logLabeledBullet("dataconnect", `CloudSQL instance '${instanceId}' not found, creating it.` +
+            utils.logLabeledBullet("dataconnect", `CloudSQL instance '${instanceId}' not found.` +
+                cta +
                 `\nThis instance is provided under the terms of the Data Connect free trial ${(0, freeTrial_1.freeTrialTermsLink)()}` +
                 `\nMonitor the progress at ${cloudSqlAdminClient.instanceConsoleLink(projectId, instanceId)}`);
-        const newInstance = await (0, utils_1.promiseWithSpinner)(() => cloudSqlAdminClient.createInstance(projectId, locationId, instanceId, enableGoogleMlIntegration, waitForCreation), "Creating your instance...");
-        if (newInstance) {
-            silent || utils.logLabeledBullet("dataconnect", "Instance created");
-            connectionName = (newInstance === null || newInstance === void 0 ? void 0 : newInstance.connectionName) || "";
-        }
-        else {
-            silent ||
-                utils.logLabeledBullet("dataconnect", "Cloud SQL instance creation started - it should be ready shortly. Database and users will be created on your next deploy.");
-            return connectionName;
+        if (!dryRun) {
+            const newInstance = await (0, utils_1.promiseWithSpinner)(() => cloudSqlAdminClient.createInstance(projectId, locationId, instanceId, enableGoogleMlIntegration, waitForCreation), "Creating your instance...");
+            if (newInstance) {
+                silent || utils.logLabeledBullet("dataconnect", "Instance created");
+                connectionName = (newInstance === null || newInstance === void 0 ? void 0 : newInstance.connectionName) || "";
+            }
+            else {
+                silent ||
+                    utils.logLabeledBullet("dataconnect", "Cloud SQL instance creation started - it should be ready shortly. Database and users will be created on your next deploy.");
+                return connectionName;
+            }
         }
     }
     try {
@@ -56,17 +63,23 @@ async function provisionCloudSql(args) {
     }
     catch (err) {
         if (err.status === 404) {
-            silent ||
-                utils.logLabeledBullet("dataconnect", `Database ${databaseId} not found, creating it now...`);
-            await cloudSqlAdminClient.createDatabase(projectId, instanceId, databaseId);
-            silent || utils.logLabeledBullet("dataconnect", `Database ${databaseId} created.`);
+            if (dryRun) {
+                silent ||
+                    utils.logLabeledBullet("dataconnect", `Database ${databaseId} not found. It will be created on your next deploy.`);
+            }
+            else {
+                silent ||
+                    utils.logLabeledBullet("dataconnect", `Database ${databaseId} not found, creating it now...`);
+                await cloudSqlAdminClient.createDatabase(projectId, instanceId, databaseId);
+                silent || utils.logLabeledBullet("dataconnect", `Database ${databaseId} created.`);
+            }
         }
         else {
             logger_1.logger.debug(`Unexpected error from CloudSQL: ${err}`);
             silent || utils.logLabeledWarning("dataconnect", `Database ${databaseId} is not accessible.`);
         }
     }
-    if (enableGoogleMlIntegration) {
+    if (enableGoogleMlIntegration && !dryRun) {
         await (0, checkIam_1.grantRolesToCloudSqlServiceAccount)(projectId, instanceId, [GOOGLE_ML_INTEGRATION_ROLE]);
     }
     return connectionName;