firebase-tools 13.33.0 → 13.34.0

package/lib/commands/dataconnect-sql-grant.js

@@ -9,8 +9,8 @@ const fileUtils_1 = require("../dataconnect/fileUtils");
 const schemaMigration_1 = require("../dataconnect/schemaMigration");
 const requireAuth_1 = require("../requireAuth");
 const error_1 = require("../error");
-const permissions_1 = require("../gcp/cloudsql/permissions");
-const allowedRoles = Object.keys(permissions_1.fdcSqlRoleMap);
+const permissions_setup_1 = require("../gcp/cloudsql/permissions_setup");
+const allowedRoles = Object.keys(permissions_setup_1.fdcSqlRoleMap);
 exports.command = new command_1.Command("dataconnect:sql:grant [serviceId]")
     .description("Grants the SQL role <role> to the provided user or service account <email>.")
     .option("-R, --role <role>", "The SQL role to grant. One of: owner, writer, or reader.")

package/lib/commands/dataconnect-sql-setup.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.command = void 0;
+const command_1 = require("../command");
+const projectUtils_1 = require("../projectUtils");
+const fileUtils_1 = require("../dataconnect/fileUtils");
+const error_1 = require("../error");
+const requireAuth_1 = require("../requireAuth");
+const requirePermissions_1 = require("../requirePermissions");
+const ensureApis_1 = require("../dataconnect/ensureApis");
+const permissions_setup_1 = require("../gcp/cloudsql/permissions_setup");
+const permissions_1 = require("../gcp/cloudsql/permissions");
+const schemaMigration_1 = require("../dataconnect/schemaMigration");
+exports.command = new command_1.Command("dataconnect:sql:setup [serviceId]")
+    .description("Setup your CloudSQL database")
+    .before(requirePermissions_1.requirePermissions, [
+    "firebasedataconnect.services.list",
+    "firebasedataconnect.schemas.list",
+    "firebasedataconnect.schemas.update",
+    "cloudsql.instances.connect",
+])
+    .before(requireAuth_1.requireAuth)
+    .action(async (serviceId, options) => {
+    var _a;
+    const projectId = (0, projectUtils_1.needProjectId)(options);
+    await (0, ensureApis_1.ensureApis)(projectId);
+    const serviceInfo = await (0, fileUtils_1.pickService)(projectId, options.config, serviceId);
+    const instanceId = (_a = serviceInfo.dataConnectYaml.schema.datasource.postgresql) === null || _a === void 0 ? void 0 : _a.cloudSql.instanceId;
+    if (!instanceId) {
+        throw new error_1.FirebaseError("dataconnect.yaml is missing field schema.datasource.postgresql.cloudsql.instanceId");
+    }
+    const { databaseId } = (0, schemaMigration_1.getIdentifiers)(serviceInfo.schema);
+    const schemaInfo = await (0, permissions_setup_1.getSchemaMetadata)(instanceId, databaseId, permissions_1.DEFAULT_SCHEMA, options);
+    await (0, permissions_setup_1.setupSQLPermissions)(instanceId, databaseId, schemaInfo, options);
+});

package/lib/commands/index.js

@@ -216,6 +216,7 @@ function load(client) {
     client.dataconnect.services.list = loadCommand("dataconnect-services-list");
     client.dataconnect.sql = {};
     client.dataconnect.sql.diff = loadCommand("dataconnect-sql-diff");
+    client.dataconnect.sql.setup = loadCommand("dataconnect-sql-setup");
     client.dataconnect.sql.migrate = loadCommand("dataconnect-sql-migrate");
     client.dataconnect.sql.grant = loadCommand("dataconnect-sql-grant");
     client.dataconnect.sql.shell = loadCommand("dataconnect-sql-shell");

package/lib/dataconnect/schemaMigration.js

@@ -6,13 +6,15 @@ const sql_formatter_1 = require("sql-formatter");
 const types_1 = require("./types");
 const client_1 = require("./client");
 const connect_1 = require("../gcp/cloudsql/connect");
-const permissions_1 = require("../gcp/cloudsql/permissions");
-const cloudSqlAdminClient = require("../gcp/cloudsql/cloudsqladmin");
 const projectUtils_1 = require("../projectUtils");
+const permissions_setup_1 = require("../gcp/cloudsql/permissions_setup");
+const permissions_1 = require("../gcp/cloudsql/permissions");
 const prompt_1 = require("../prompt");
 const logger_1 = require("../logger");
 const error_1 = require("../error");
 const utils_1 = require("../utils");
+const cloudsqladmin_1 = require("../gcp/cloudsql/cloudsqladmin");
+const cloudSqlAdminClient = require("../gcp/cloudsql/cloudsqladmin");
 const errors = require("./errors");
 async function diffSchema(schema, schemaValidation) {
     const { serviceName, instanceName, databaseId } = getIdentifiers(schema);
@@ -156,12 +158,29 @@ async function grantRoleToUserInSchema(options, schema) {
     const { instanceId, databaseId } = getIdentifiers(schema);
     const projectId = (0, projectUtils_1.needProjectId)(options);
     const { user, mode } = (0, connect_1.toDatabaseUser)(email);
-    const fdcSqlRole = permissions_1.fdcSqlRoleMap[role](databaseId);
-    const userIsCSQLAdmin = await (0, permissions_1.iamUserIsCSQLAdmin)(options);
+    const fdcSqlRole = permissions_setup_1.fdcSqlRoleMap[role](databaseId);
+    const userIsCSQLAdmin = await (0, cloudsqladmin_1.iamUserIsCSQLAdmin)(options);
     if (!userIsCSQLAdmin) {
         throw new error_1.FirebaseError(`Only users with 'roles/cloudsql.admin' can grant SQL roles. If you do not have this role, ask your database administrator to run this command or manually grant ${fdcSqlRole} to ${user}`);
     }
-    await (0, connect_1.setupIAMUsers)(instanceId, databaseId, options);
+    const schemaInfo = await (0, permissions_setup_1.getSchemaMetadata)(instanceId, databaseId, permissions_1.DEFAULT_SCHEMA, options);
+    let isGreenfieldSetup = schemaInfo.setupStatus === permissions_setup_1.SchemaSetupStatus.GreenField;
+    switch (schemaInfo.setupStatus) {
+        case permissions_setup_1.SchemaSetupStatus.NotSetup:
+        case permissions_setup_1.SchemaSetupStatus.NotFound:
+            const newSetupStatus = await (0, permissions_setup_1.setupSQLPermissions)(instanceId, databaseId, schemaInfo, options);
+            isGreenfieldSetup = newSetupStatus === permissions_setup_1.SchemaSetupStatus.GreenField;
+            break;
+        default:
+            logger_1.logger.info(`Detected schema "${schemaInfo.name}" is setup in ${schemaInfo.setupStatus} mode. Skipping Setup.`);
+            break;
+    }
+    if (!isGreenfieldSetup && fdcSqlRole === (0, permissions_1.firebaseowner)(databaseId, permissions_1.DEFAULT_SCHEMA)) {
+        const newSetupStatus = await (0, permissions_setup_1.setupSQLPermissions)(instanceId, databaseId, schemaInfo, options);
+        if (newSetupStatus !== permissions_setup_1.SchemaSetupStatus.GreenField) {
+            throw new error_1.FirebaseError(`Can't grant owner rule for brownfield databases. Consider fully migrating your database to FDC using 'firebase dataconnect:sql:setup'`);
+        }
+    }
     await cloudSqlAdminClient.createUser(projectId, instanceId, mode, user);
     await (0, connect_1.executeSqlCmdsAsSuperUser)(options, instanceId, databaseId, [`GRANT "${fdcSqlRole}" TO "${user}"`], false);
 }
@@ -232,16 +251,20 @@ async function handleIncompatibleSchemaError(args) {
     if (commandsToExecute.length) {
         const commandsToExecuteBySuperUser = commandsToExecute.filter((sql) => sql.startsWith("CREATE EXTENSION") || sql.startsWith("CREATE SCHEMA"));
         const commandsToExecuteByOwner = commandsToExecute.filter((sql) => !commandsToExecuteBySuperUser.includes(sql));
-        const userIsCSQLAdmin = await (0, permissions_1.iamUserIsCSQLAdmin)(options);
+        const userIsCSQLAdmin = await (0, cloudsqladmin_1.iamUserIsCSQLAdmin)(options);
         if (!userIsCSQLAdmin && commandsToExecuteBySuperUser.length) {
             throw new error_1.FirebaseError(`Some SQL commands required for this migration require Admin permissions.\n 
         Please ask a user with 'roles/cloudsql.admin' to apply the following commands.\n
         ${commandsToExecuteBySuperUser.join("\n")}`);
         }
-        if (userIsCSQLAdmin) {
-            await (0, connect_1.setupIAMUsers)(instanceId, databaseId, options);
+        const schemaInfo = await (0, permissions_setup_1.getSchemaMetadata)(instanceId, databaseId, permissions_1.DEFAULT_SCHEMA, options);
+        if (schemaInfo.setupStatus !== permissions_setup_1.SchemaSetupStatus.GreenField) {
+            const newSetupStatus = await (0, permissions_setup_1.setupSQLPermissions)(instanceId, databaseId, schemaInfo, options, true);
+            if (newSetupStatus !== permissions_setup_1.SchemaSetupStatus.GreenField) {
+                throw new error_1.FirebaseError(`Can't migrate brownfield databases. Consider fully migrating your database to FDC using 'firebase dataconnect:sql:setup'`);
+            }
         }
-        if (!(await (0, permissions_1.checkSQLRoleIsGranted)(options, instanceId, databaseId, (0, permissions_1.firebaseowner)(databaseId), (await (0, connect_1.getIAMUser)(options)).user))) {
+        if (!(await (0, permissions_setup_1.checkSQLRoleIsGranted)(options, instanceId, databaseId, (0, permissions_1.firebaseowner)(databaseId), (await (0, connect_1.getIAMUser)(options)).user))) {
             throw new error_1.FirebaseError(`Command aborted. Only users granted firebaseowner SQL role can run migrations.`);
         }
         if (commandsToExecuteBySuperUser.length) {

package/lib/deploy/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deploy = exports.prepareFrameworksIfNeeded = exports.matchesHostingTarget = void 0;
+exports.deploy = exports.isDeployingWebFramework = void 0;
 const clc = require("colorette");
 const logger_1 = require("../logger");
 const api_1 = require("../api");
@@ -40,25 +40,20 @@ const chain = async function (fns, context, options, payload) {
         await latest(context, options, payload);
     }
 };
-const matchesHostingTarget = (only, target) => {
-    if (!only)
-        return true;
-    if (!only.includes("hosting:"))
-        return true;
-    const targetStr = `hosting:${target !== null && target !== void 0 ? target : ""}`;
-    return only.split(",").some((t) => t === targetStr);
-};
-exports.matchesHostingTarget = matchesHostingTarget;
-const prepareFrameworksIfNeeded = async function (targetNames, options, context) {
+const isDeployingWebFramework = (options) => {
     const config = options.config.get("hosting");
-    if (Array.isArray(config)
-        ? config.some((it) => it.source && (0, exports.matchesHostingTarget)(options.only, it.target))
-        : config.source) {
-        experiments.assertEnabled("webframeworks", "deploy a web framework from source");
-        await (0, frameworks_1.prepareFrameworks)("deploy", targetNames, context, options);
-    }
+    const webFrameworkInConfig = (Array.isArray(config) ? config : [config]).find((it) => it.source);
+    if (!webFrameworkInConfig)
+        return false;
+    if (!options.only)
+        return true;
+    return options.only.split(",").some((it) => {
+        const [target, site] = it.split(":");
+        return (target === "hosting" &&
+            [webFrameworkInConfig.site, webFrameworkInConfig.target].includes(site));
+    });
 };
-exports.prepareFrameworksIfNeeded = prepareFrameworksIfNeeded;
+exports.isDeployingWebFramework = isDeployingWebFramework;
 const deploy = async function (targetNames, options, customContext = {}) {
     var _a, _b, _c;
     const projectId = (0, projectUtils_1.needProjectId)(options);
@@ -70,8 +65,9 @@ const deploy = async function (targetNames, options, customContext = {}) {
     const releases = [];
     const postdeploys = [];
     const startTime = Date.now();
-    if (targetNames.includes("hosting")) {
-        await (0, exports.prepareFrameworksIfNeeded)(targetNames, options, context);
+    if (targetNames.includes("hosting") && (0, exports.isDeployingWebFramework)(options)) {
+        experiments.assertEnabled("webframeworks", "deploy a web framework from source");
+        await (0, frameworks_1.prepareFrameworks)("deploy", targetNames, context, options);
     }
     if (targetNames.includes("hosting") && (0, prepare_1.hasPinnedFunctions)(options)) {
         experiments.assertEnabled("pintags", "deploy a tagged function as a hosting rewrite");

package/lib/emulator/downloadableEmulators.js

@@ -48,20 +48,20 @@ const EMULATOR_UPDATE_DETAILS = {
     },
     dataconnect: process.platform === "darwin"
         ? {
-            version: "1.8.4",
-            expectedSize: 25588480,
-            expectedChecksum: "421f6226a0433b824642c03eb0b6862d",
+            version: "1.8.5",
+            expectedSize: 25600768,
+            expectedChecksum: "7e2a935f972ce30e075cca1f36e24663",
         }
         : process.platform === "win32"
             ? {
-                version: "1.8.4",
-                expectedSize: 26020352,
-                expectedChecksum: "b78c95a7f071f127acda3a76cdcc8c48",
+                version: "1.8.5",
+                expectedSize: 26031616,
+                expectedChecksum: "da063f9893b0ff4c99f280653c717977",
             }
             : {
-                version: "1.8.4",
-                expectedSize: 25501848,
-                expectedChecksum: "0aabd622b1a99b2a0d9c9dec4c7404fc",
+                version: "1.8.5",
+                expectedSize: 25514136,
+                expectedChecksum: "6564f779f7f5a467e587d7093ed7c3e3",
             },
 };
 exports.DownloadDetails = {

package/lib/gcp/cloudsql/cloudsqladmin.js

@@ -1,9 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.listUsers = exports.deleteUser = exports.getUser = exports.createUser = exports.deleteDatabase = exports.createDatabase = exports.getDatabase = exports.listDatabases = exports.updateInstanceForDataConnect = exports.createInstance = exports.instanceConsoleLink = exports.getInstance = exports.listInstances = void 0;
+exports.listUsers = exports.deleteUser = exports.getUser = exports.createUser = exports.deleteDatabase = exports.createDatabase = exports.getDatabase = exports.listDatabases = exports.updateInstanceForDataConnect = exports.createInstance = exports.instanceConsoleLink = exports.getInstance = exports.listInstances = exports.iamUserIsCSQLAdmin = void 0;
 const apiv2_1 = require("../../apiv2");
 const api_1 = require("../../api");
 const operationPoller = require("../../operation-poller");
+const projectUtils_1 = require("../../projectUtils");
+const logger_1 = require("../../logger");
+const iam_1 = require("../iam");
 const error_1 = require("../../error");
 const API_VERSION = "v1";
 const client = new apiv2_1.Client({
@@ -11,6 +14,24 @@ const client = new apiv2_1.Client({
     auth: true,
     apiVersion: API_VERSION,
 });
+async function iamUserIsCSQLAdmin(options) {
+    const projectId = (0, projectUtils_1.needProjectId)(options);
+    const requiredPermissions = [
+        "cloudsql.instances.connect",
+        "cloudsql.instances.get",
+        "cloudsql.users.create",
+        "cloudsql.users.update",
+    ];
+    try {
+        const iamResult = await (0, iam_1.testIamPermissions)(projectId, requiredPermissions);
+        return iamResult.passed;
+    }
+    catch (err) {
+        logger_1.logger.debug(`[iam] error while checking permissions, command may fail: ${err}`);
+        return false;
+    }
+}
+exports.iamUserIsCSQLAdmin = iamUserIsCSQLAdmin;
 async function listInstances(projectId) {
     var _a;
     const res = await client.get(`projects/${projectId}/instances`);

package/lib/gcp/cloudsql/connect.js

@@ -11,7 +11,6 @@ const utils = require("../../utils");
 const logger_1 = require("../../logger");
 const error_1 = require("../../error");
 const fbToolsAuthClient_1 = require("./fbToolsAuthClient");
-const permissions_1 = require("./permissions");
 async function execute(sqlStatements, opts) {
     const logFn = opts.silent ? logger_1.logger.debug : logger_1.logger.info;
     const instance = await cloudSqlAdminClient.getInstance(opts.projectId, opts.instanceId);
@@ -61,11 +60,12 @@ async function execute(sqlStatements, opts) {
         }
     }
     const conn = await pool.connect();
+    const results = [];
     logFn(`Logged in as ${opts.username}`);
     for (const s of sqlStatements) {
         logFn(`Executing: '${s}'`);
         try {
-            await conn.query(s);
+            results.push(await conn.query(s));
         }
         catch (err) {
             throw new error_1.FirebaseError(`Error executing ${err}`);
@@ -74,6 +74,7 @@ async function execute(sqlStatements, opts) {
     conn.release();
     await pool.end();
     connector.close();
+    return results;
 }
 exports.execute = execute;
 async function executeSqlCmdsAsIamUser(options, instanceId, databaseId, cmds, silent = false) {
@@ -93,7 +94,7 @@ async function executeSqlCmdsAsSuperUser(options, instanceId, databaseId, cmds,
     const superuser = "firebasesuperuser";
     const temporaryPassword = utils.generateId(20);
     await cloudSqlAdminClient.createUser(projectId, instanceId, "BUILT_IN", superuser, temporaryPassword);
-    return await execute([`SET ROLE = cloudsqlsuperuser`, ...cmds], {
+    return await execute([`SET ROLE = '${superuser}'`, ...cmds], {
         projectId,
         instanceId,
         databaseId,
@@ -122,12 +123,6 @@ async function setupIAMUsers(instanceId, databaseId, options) {
     const projectNumber = await (0, projectUtils_1.needProjectNumber)(options);
     const { user: fdcP4SAUser, mode: fdcP4SAmode } = toDatabaseUser(getDataConnectP4SA(projectNumber));
     await cloudSqlAdminClient.createUser(projectId, instanceId, fdcP4SAmode, fdcP4SAUser);
-    await (0, permissions_1.setupSQLPermissions)(instanceId, databaseId, options, true);
-    const grants = [
-        `GRANT "${(0, permissions_1.firebaseowner)(databaseId)}" TO "${user}"`,
-        `GRANT "${(0, permissions_1.firebasewriter)(databaseId)}" TO "${fdcP4SAUser}"`,
-    ];
-    await executeSqlCmdsAsSuperUser(options, instanceId, databaseId, grants, true);
     return user;
 }
 exports.setupIAMUsers = setupIAMUsers;

package/lib/gcp/cloudsql/permissions.js

@@ -1,89 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.setupSQLPermissions = exports.iamUserIsCSQLAdmin = exports.checkSQLRoleIsGranted = exports.fdcSqlRoleMap = exports.firebasewriter = exports.firebasereader = exports.firebaseowner = void 0;
-const projectUtils_1 = require("../../projectUtils");
-const connect_1 = require("./connect");
-const iam_1 = require("../iam");
-const logger_1 = require("../../logger");
-const lodash_1 = require("lodash");
-const error_1 = require("../../error");
-function firebaseowner(databaseId) {
-    return `firebaseowner_${databaseId}_public`;
+exports.defaultPermissions = exports.readerRolePermissions = exports.writerRolePermissions = exports.ownerRolePermissions = exports.firebasewriter = exports.firebasereader = exports.firebaseowner = exports.FIREBASE_SUPER_USER = exports.DEFAULT_SCHEMA = void 0;
+exports.DEFAULT_SCHEMA = "public";
+exports.FIREBASE_SUPER_USER = "firebasesuperuser";
+function firebaseowner(databaseId, schema = exports.DEFAULT_SCHEMA) {
+    return `firebaseowner_${databaseId}_${schema}`;
 }
 exports.firebaseowner = firebaseowner;
-function firebasereader(databaseId) {
-    return `firebasereader_${databaseId}_public`;
+function firebasereader(databaseId, schema = exports.DEFAULT_SCHEMA) {
+    return `firebasereader_${databaseId}_${schema}`;
 }
 exports.firebasereader = firebasereader;
-function firebasewriter(databaseId) {
-    return `firebasewriter_${databaseId}_public`;
+function firebasewriter(databaseId, schema = exports.DEFAULT_SCHEMA) {
+    return `firebasewriter_${databaseId}_${schema}`;
 }
 exports.firebasewriter = firebasewriter;
-exports.fdcSqlRoleMap = {
-    owner: firebaseowner,
-    writer: firebasewriter,
-    reader: firebasereader,
-};
-async function checkSQLRoleIsGranted(options, instanceId, databaseId, grantedRole, granteeRole) {
-    const checkCmd = `
-    DO $$
-    DECLARE
-        role_count INTEGER;
-    BEGIN
-        -- Count the number of rows matching the criteria
-        SELECT COUNT(*)
-        INTO role_count
-        FROM
-          pg_auth_members m
-        JOIN
-          pg_roles grantee ON grantee.oid = m.member
-        JOIN
-          pg_roles granted ON granted.oid = m.roleid
-        JOIN
-          pg_roles grantor ON grantor.oid = m.grantor
-        WHERE
-          granted.rolname = '${grantedRole}'
-          AND grantee.rolname = '${granteeRole}';
-
-        -- If no rows were found, raise an exception
-        IF role_count = 0 THEN
-            RAISE EXCEPTION 'Role "%", is not granted to role "%".', '${grantedRole}', '${granteeRole}';
-        END IF;
-    END $$;
-`;
-    try {
-        await (0, connect_1.executeSqlCmdsAsIamUser)(options, instanceId, databaseId, [checkCmd], true);
-        return true;
-    }
-    catch (e) {
-        if (e instanceof error_1.FirebaseError && e.message.includes("not granted to role")) {
-            return false;
-        }
-        logger_1.logger.error(`Role Check Failed: ${e}`);
-        throw e;
-    }
-}
-exports.checkSQLRoleIsGranted = checkSQLRoleIsGranted;
-async function iamUserIsCSQLAdmin(options) {
-    const projectId = (0, projectUtils_1.needProjectId)(options);
-    const requiredPermissions = [
-        "cloudsql.instances.connect",
-        "cloudsql.instances.get",
-        "cloudsql.users.create",
-        "cloudsql.users.update",
-    ];
-    try {
-        const iamResult = await (0, iam_1.testIamPermissions)(projectId, requiredPermissions);
-        return iamResult.passed;
-    }
-    catch (err) {
-        logger_1.logger.debug(`[iam] error while checking permissions, command may fail: ${err}`);
-        return false;
-    }
-}
-exports.iamUserIsCSQLAdmin = iamUserIsCSQLAdmin;
 function ownerRolePermissions(databaseId, superuser, schema) {
-    const firebaseOwnerRole = firebaseowner(databaseId);
+    const firebaseOwnerRole = firebaseowner(databaseId, schema);
     return [
         `do
       $$
@@ -102,8 +35,9 @@ function ownerRolePermissions(databaseId, superuser, schema) {
         `GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA "${schema}" TO "${firebaseOwnerRole}"`,
     ];
 }
+exports.ownerRolePermissions = ownerRolePermissions;
 function writerRolePermissions(databaseId, superuser, schema) {
-    const firebaseWriterRole = firebasewriter(databaseId);
+    const firebaseWriterRole = firebasewriter(databaseId, schema);
     return [
         `do
       $$
@@ -120,15 +54,11 @@ function writerRolePermissions(databaseId, superuser, schema) {
         `GRANT SELECT, INSERT, UPDATE, DELETE, TRUNCATE ON ALL TABLES IN SCHEMA "${schema}" TO "${firebaseWriterRole}"`,
         `GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA "${schema}" TO "${firebaseWriterRole}"`,
         `GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA "${schema}" TO "${firebaseWriterRole}"`,
-        `SET ROLE = '${firebaseowner(databaseId)}';`,
-        `ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT SELECT, INSERT, UPDATE, DELETE, TRUNCATE ON TABLES TO "${firebaseWriterRole}";`,
-        `ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT USAGE ON SEQUENCES TO "${firebaseWriterRole}";`,
-        `ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT EXECUTE ON FUNCTIONS TO "${firebaseWriterRole}"`,
-        `SET ROLE = cloudsqlsuperuser`,
     ];
 }
+exports.writerRolePermissions = writerRolePermissions;
 function readerRolePermissions(databaseId, superuser, schema) {
-    const firebaseReaderRole = firebasereader(databaseId);
+    const firebaseReaderRole = firebasereader(databaseId, schema);
     return [
         `do
       $$
@@ -145,21 +75,37 @@ function readerRolePermissions(databaseId, superuser, schema) {
         `GRANT SELECT ON ALL TABLES IN SCHEMA "${schema}" TO "${firebaseReaderRole}"`,
         `GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA "${schema}" TO "${firebaseReaderRole}"`,
         `GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA "${schema}" TO "${firebaseReaderRole}"`,
-        `SET ROLE = '${firebaseowner(databaseId)}';`,
-        `ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT SELECT ON TABLES TO "${firebaseReaderRole}";`,
-        `ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT SELECT, USAGE ON SEQUENCES TO "${firebaseReaderRole}";`,
-        `ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT EXECUTE ON FUNCTIONS TO "${firebaseReaderRole}"`,
-        `SET ROLE = cloudsqlsuperuser`,
     ];
 }
-async function setupSQLPermissions(instanceId, databaseId, options, silent = false) {
-    const superuser = "firebasesuperuser";
-    const revokes = [];
-    if (await checkSQLRoleIsGranted(options, instanceId, databaseId, "cloudsqlsuperuser", firebaseowner(databaseId))) {
-        logger_1.logger.warn("Detected cloudsqlsuperuser was previously given to firebase owner, revoking to improve database security.");
-        revokes.push(`REVOKE "cloudsqlsuperuser" FROM "${firebaseowner(databaseId)}"`);
-    }
-    const sqlRoleSetupCmds = (0, lodash_1.concat)(revokes, [`CREATE SCHEMA IF NOT EXISTS "public"`], ownerRolePermissions(databaseId, superuser, "public"), writerRolePermissions(databaseId, superuser, "public"), readerRolePermissions(databaseId, superuser, "public"));
-    return (0, connect_1.executeSqlCmdsAsSuperUser)(options, instanceId, databaseId, sqlRoleSetupCmds, silent);
+exports.readerRolePermissions = readerRolePermissions;
+function defaultPermissions(databaseId, schema, ownerRole) {
+    const firebaseWriterRole = firebasewriter(databaseId, schema);
+    const firebaseReaderRole = firebasereader(databaseId, schema);
+    return [
+        `ALTER DEFAULT PRIVILEGES
+      FOR ROLE "${ownerRole}"
+      IN SCHEMA "${schema}"
+      GRANT SELECT, INSERT, UPDATE, DELETE, TRUNCATE ON TABLES TO "${firebaseWriterRole}";`,
+        `ALTER DEFAULT PRIVILEGES
+      FOR ROLE "${ownerRole}"
+      IN SCHEMA "${schema}"
+      GRANT USAGE ON SEQUENCES TO "${firebaseWriterRole}";`,
+        `ALTER DEFAULT PRIVILEGES
+      FOR ROLE "${ownerRole}"
+      IN SCHEMA "${schema}"
+      GRANT EXECUTE ON FUNCTIONS TO "${firebaseWriterRole}";`,
+        `ALTER DEFAULT PRIVILEGES
+      FOR ROLE "${ownerRole}"
+      IN SCHEMA "${schema}"
+      GRANT SELECT ON TABLES TO "${firebaseReaderRole}";`,
+        `ALTER DEFAULT PRIVILEGES
+      FOR ROLE "${ownerRole}"
+      IN SCHEMA "${schema}"
+      GRANT USAGE ON SEQUENCES TO "${firebaseReaderRole}";`,
+        `ALTER DEFAULT PRIVILEGES
+      FOR ROLE "${ownerRole}"
+      IN SCHEMA "${schema}"
+      GRANT EXECUTE ON FUNCTIONS TO "${firebaseReaderRole}";`,
+    ];
 }
-exports.setupSQLPermissions = setupSQLPermissions;
+exports.defaultPermissions = defaultPermissions;

package/lib/gcp/cloudsql/permissions_setup.js

@@ -0,0 +1,201 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.brownfieldSqlSetup = exports.setupBrownfieldAsGreenfield = exports.getSchemaMetadata = exports.greenFieldSchemaSetup = exports.setupSQLPermissions = exports.checkSQLRoleIsGranted = exports.fdcSqlRoleMap = exports.SchemaSetupStatus = void 0;
+const permissions_1 = require("./permissions");
+const cloudsqladmin_1 = require("./cloudsqladmin");
+const connect_1 = require("./connect");
+const logger_1 = require("../../logger");
+const prompt_1 = require("../../prompt");
+const clc = require("colorette");
+const error_1 = require("../../error");
+const projectUtils_1 = require("../../projectUtils");
+const connect_2 = require("./connect");
+const lodash_1 = require("lodash");
+const connect_3 = require("./connect");
+var SchemaSetupStatus;
+(function (SchemaSetupStatus) {
+    SchemaSetupStatus["NotSetup"] = "not-setup";
+    SchemaSetupStatus["GreenField"] = "greenfield";
+    SchemaSetupStatus["BrownField"] = "brownfield";
+    SchemaSetupStatus["NotFound"] = "not-found";
+})(SchemaSetupStatus = exports.SchemaSetupStatus || (exports.SchemaSetupStatus = {}));
+exports.fdcSqlRoleMap = {
+    owner: permissions_1.firebaseowner,
+    writer: permissions_1.firebasewriter,
+    reader: permissions_1.firebasereader,
+};
+async function checkSQLRoleIsGranted(options, instanceId, databaseId, grantedRole, granteeRole) {
+    const checkCmd = `
+    DO $$
+    DECLARE
+        role_count INTEGER;
+    BEGIN
+        -- Count the number of rows matching the criteria
+        SELECT COUNT(*)
+        INTO role_count
+        FROM
+          pg_auth_members m
+        JOIN
+          pg_roles grantee ON grantee.oid = m.member
+        JOIN
+          pg_roles granted ON granted.oid = m.roleid
+        JOIN
+          pg_roles grantor ON grantor.oid = m.grantor
+        WHERE
+          granted.rolname = '${grantedRole}'
+          AND grantee.rolname = '${granteeRole}';
+
+        -- If no rows were found, raise an exception
+        IF role_count = 0 THEN
+            RAISE EXCEPTION 'Role "%", is not granted to role "%".', '${grantedRole}', '${granteeRole}';
+        END IF;
+    END $$;
+`;
+    try {
+        await (0, connect_2.executeSqlCmdsAsIamUser)(options, instanceId, databaseId, [checkCmd], true);
+        return true;
+    }
+    catch (e) {
+        if (e instanceof error_1.FirebaseError && e.message.includes("not granted to role")) {
+            return false;
+        }
+        logger_1.logger.error(`Role Check Failed: ${e}`);
+        throw e;
+    }
+}
+exports.checkSQLRoleIsGranted = checkSQLRoleIsGranted;
+async function setupSQLPermissions(instanceId, databaseId, schemaInfo, options, silent = false) {
+    const schema = schemaInfo.name;
+    logger_1.logger.info(`Attempting to Setup SQL schema "${schema}".`);
+    const userIsCSQLAdmin = await (0, cloudsqladmin_1.iamUserIsCSQLAdmin)(options);
+    if (!userIsCSQLAdmin) {
+        throw new error_1.FirebaseError(`Missing required IAM permission to setup SQL schemas. SQL schema setup requires 'roles/cloudsql.admin' or an equivalent role.`);
+    }
+    await (0, connect_1.setupIAMUsers)(instanceId, databaseId, options);
+    if (schemaInfo.setupStatus === SchemaSetupStatus.GreenField) {
+        logger_1.logger.info(`Database ${databaseId} has already been setup. Rerunning setup to repair any missing permissions.`);
+        await greenFieldSchemaSetup(instanceId, databaseId, schema, options, silent);
+        return SchemaSetupStatus.GreenField;
+    }
+    else {
+        logger_1.logger.info(`Detected schema "${schema}" setup status is ${schemaInfo.setupStatus}.`);
+    }
+    if (schemaInfo.tables.length === 0) {
+        logger_1.logger.info(`Found no tables in schema "${schema}", assuming greenfield project.`);
+        await greenFieldSchemaSetup(instanceId, databaseId, schema, options, silent);
+        logger_1.logger.info(clc.green("Database setup complete."));
+        return SchemaSetupStatus.GreenField;
+    }
+    if (options.nonInteractive || options.force) {
+        throw new error_1.FirebaseError(`Schema "${schema}" isn't set up and can only be set up in interactive mode.`);
+    }
+    const currentTablesOwners = [...new Set(schemaInfo.tables.map((t) => t.owner))];
+    logger_1.logger.info(`We found some existing object owners [${currentTablesOwners.join(", ")}] in your cloudsql "${schema}" schema.`);
+    const shouldSetupGreenfield = await (0, prompt_1.confirm)({
+        message: clc.yellow("Would you like FDC to handle SQL migrations for you moving forward?\n" +
+            `This means we will transfer schema and tables ownership to ${(0, permissions_1.firebaseowner)(databaseId, schema)}\n` +
+            "Note: your existing migration tools/roles may lose access."),
+        default: false,
+    });
+    if (shouldSetupGreenfield) {
+        await setupBrownfieldAsGreenfield(instanceId, databaseId, schemaInfo, options, silent);
+        return SchemaSetupStatus.GreenField;
+    }
+    else {
+        logger_1.logger.info(clc.yellow("Setting up database in brownfield mode.\n" +
+            `Note: SQL migrations can't be done through ${clc.bold("firebase dataconnect:sql:migrate")} in this mode.`));
+        await brownfieldSqlSetup(instanceId, databaseId, schemaInfo, options, silent);
+        logger_1.logger.info(clc.green("Brownfield database setup complete."));
+        return SchemaSetupStatus.BrownField;
+    }
+}
+exports.setupSQLPermissions = setupSQLPermissions;
+async function greenFieldSchemaSetup(instanceId, databaseId, schema, options, silent = false) {
+    const revokes = [];
+    if (await checkSQLRoleIsGranted(options, instanceId, databaseId, "cloudsqlsuperuser", (0, permissions_1.firebaseowner)(databaseId))) {
+        logger_1.logger.warn("Detected cloudsqlsuperuser was previously given to firebase owner, revoking to improve database security.");
+        revokes.push(`REVOKE "cloudsqlsuperuser" FROM "${(0, permissions_1.firebaseowner)(databaseId)}"`);
+    }
+    const user = (await (0, connect_2.getIAMUser)(options)).user;
+    const projectNumber = await (0, projectUtils_1.needProjectNumber)(options);
+    const { user: fdcP4SAUser } = (0, connect_3.toDatabaseUser)((0, connect_3.getDataConnectP4SA)(projectNumber));
+    const sqlRoleSetupCmds = (0, lodash_1.concat)(revokes, [`CREATE SCHEMA IF NOT EXISTS "${schema}"`], (0, permissions_1.ownerRolePermissions)(databaseId, permissions_1.FIREBASE_SUPER_USER, schema), (0, permissions_1.writerRolePermissions)(databaseId, permissions_1.FIREBASE_SUPER_USER, schema), (0, permissions_1.readerRolePermissions)(databaseId, permissions_1.FIREBASE_SUPER_USER, schema), `GRANT "${(0, permissions_1.firebaseowner)(databaseId, schema)}" TO "${user}"`, `GRANT "${(0, permissions_1.firebasewriter)(databaseId, schema)}" TO "${fdcP4SAUser}"`, (0, permissions_1.defaultPermissions)(databaseId, schema, (0, permissions_1.firebaseowner)(databaseId, schema)));
+    await (0, connect_2.executeSqlCmdsAsSuperUser)(options, instanceId, databaseId, sqlRoleSetupCmds, silent);
+}
+exports.greenFieldSchemaSetup = greenFieldSchemaSetup;
+async function getSchemaMetadata(instanceId, databaseId, schema, options) {
+    const checkSchemaExists = await (0, connect_2.executeSqlCmdsAsIamUser)(options, instanceId, databaseId, [
+        `SELECT pg_get_userbyid(nspowner) 
+          FROM pg_namespace 
+          WHERE nspname = '${schema}';`,
+    ], true);
+    if (!checkSchemaExists[0].rows[0]) {
+        return {
+            name: schema,
+            owner: null,
+            setupStatus: SchemaSetupStatus.NotFound,
+            tables: [],
+        };
+    }
+    const schemaOwner = checkSchemaExists[0].rows[0].pg_get_userbyid;
+    const cmd = `SELECT tablename, tableowner FROM pg_tables WHERE schemaname='${schema}'`;
+    const res = await (0, connect_2.executeSqlCmdsAsIamUser)(options, instanceId, databaseId, [cmd], true);
+    const tables = res[0].rows.map((row) => {
+        return {
+            name: row.tablename,
+            owner: row.tableowner,
+        };
+    });
+    const checkRoleExists = async (role) => {
+        const cmd = [`SELECT to_regrole('"${role}"') IS NOT NULL AS exists;`];
+        const result = await (0, connect_2.executeSqlCmdsAsIamUser)(options, instanceId, databaseId, cmd, true);
+        return result[0].rows[0].exists;
+    };
+    let setupStatus;
+    if (!(await checkRoleExists((0, permissions_1.firebasewriter)(databaseId, schema)))) {
+        setupStatus = SchemaSetupStatus.NotSetup;
+    }
+    else if (tables.every((table) => table.owner === (0, permissions_1.firebaseowner)(databaseId, schema)) &&
+        schemaOwner === (0, permissions_1.firebaseowner)(databaseId, schema)) {
+        setupStatus = SchemaSetupStatus.GreenField;
+    }
+    else {
+        setupStatus = SchemaSetupStatus.BrownField;
+    }
+    return {
+        name: schema,
+        owner: schemaOwner,
+        setupStatus,
+        tables: tables,
+    };
+}
+exports.getSchemaMetadata = getSchemaMetadata;
+async function setupBrownfieldAsGreenfield(instanceId, databaseId, schemaInfo, options, silent = false) {
+    const schema = schemaInfo.name;
+    await greenFieldSchemaSetup(instanceId, databaseId, schema, options, silent);
+    const firebaseOwnerRole = (0, permissions_1.firebaseowner)(databaseId, schema);
+    const nonFirebasetablesOwners = [...new Set(schemaInfo.tables.map((t) => t.owner))].filter((owner) => owner !== firebaseOwnerRole);
+    const grantCmds = nonFirebasetablesOwners.map((owner) => `GRANT "${(0, permissions_1.firebasewriter)(databaseId, schema)}" TO "${owner}"`);
+    const alterTableCmds = schemaInfo.tables.map((table) => `ALTER TABLE "${schema}"."${table.name}" OWNER TO "${firebaseOwnerRole}";`);
+    await (0, connect_2.executeSqlCmdsAsSuperUser)(options, instanceId, databaseId, [...grantCmds, ...alterTableCmds], silent);
+}
+exports.setupBrownfieldAsGreenfield = setupBrownfieldAsGreenfield;
+async function brownfieldSqlSetup(instanceId, databaseId, schemaInfo, options, silent = false) {
+    const schema = schemaInfo.name;
+    const uniqueTablesOwners = [...new Set(schemaInfo.tables.map((t) => t.owner))];
+    const grantOwnersToFirebasesuperuser = uniqueTablesOwners.map((owner) => `GRANT ${owner} TO ${permissions_1.FIREBASE_SUPER_USER}`);
+    const iamUser = (await (0, connect_2.getIAMUser)(options)).user;
+    const projectNumber = await (0, projectUtils_1.needProjectNumber)(options);
+    const { user: fdcP4SAUser } = (0, connect_3.toDatabaseUser)((0, connect_3.getDataConnectP4SA)(projectNumber));
+    const firebaseDefaultPermissions = uniqueTablesOwners.flatMap((owner) => (0, permissions_1.defaultPermissions)(databaseId, schema, owner));
+    const brownfieldSetupCmds = [
+        ...grantOwnersToFirebasesuperuser,
+        ...(0, permissions_1.writerRolePermissions)(databaseId, permissions_1.FIREBASE_SUPER_USER, schema),
+        ...(0, permissions_1.readerRolePermissions)(databaseId, permissions_1.FIREBASE_SUPER_USER, schema),
+        `GRANT "${(0, permissions_1.firebasewriter)(databaseId, schema)}" TO "${iamUser}"`,
+        `GRANT "${(0, permissions_1.firebasewriter)(databaseId, schema)}" TO "${fdcP4SAUser}"`,
+        ...firebaseDefaultPermissions,
+    ];
+    await (0, connect_2.executeSqlCmdsAsSuperUser)(options, instanceId, databaseId, brownfieldSetupCmds, silent);
+}
+exports.brownfieldSqlSetup = brownfieldSqlSetup;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "firebase-tools",
-  "version": "13.33.0",
+  "version": "13.34.0",
   "description": "Command-Line Interface for Firebase",
   "main": "./lib/index.js",
   "bin": {