firebase-tools 13.33.0 → 13.35.0

package/lib/apphosting/config.js

@@ -139,20 +139,22 @@ async function exportConfig(cwd, projectRoot, backendRoot, projectId, userGivenC
         localAppHostingConfig = await yaml_1.AppHostingYamlConfig.loadFromFile(localAppHostingConfigPath);
     }
     const configToExport = await loadConfigToExportSecrets(cwd, userGivenConfigFile);
-    const secretsToExport = configToExport.secrets;
+    const secretsToExport = Object.entries(configToExport.env)
+        .filter(([, env]) => env.secret)
+        .map(([variable, env]) => {
+        return Object.assign({ variable }, env);
+    });
     if (!secretsToExport) {
         logger_1.logger.info("No secrets found to export in the chosen App Hosting config files");
         return;
     }
     const secretMaterial = await (0, secrets_1.fetchSecrets)(projectId, secretsToExport);
     for (const [key, value] of secretMaterial) {
-        localAppHostingConfig.addEnvironmentVariable({
-            variable: key,
-            value: value,
+        localAppHostingConfig.env[key] = {
+            value,
             availability: ["RUNTIME"],
-        });
+        };
     }
-    localAppHostingConfig.clearSecrets();
     localAppHostingConfig.upsertFile(localAppHostingConfigPath);
     logger_1.logger.info(`Wrote secrets as environment variables to ${exports.APPHOSTING_LOCAL_YAML_FILE}.`);
     (0, utils_2.updateOrCreateGitignore)(projectRoot, [exports.APPHOSTING_LOCAL_YAML_FILE]);

package/lib/apphosting/yaml.js

@@ -6,53 +6,40 @@ const utils_1 = require("../utils");
 const config_1 = require("./config");
 const yaml = require("yaml");
 const jsYaml = require("js-yaml");
+const path = require("path");
 const fsutils_1 = require("../fsutils");
 const error_1 = require("../error");
 class AppHostingYamlConfig {
+    constructor() {
+        this.env = {};
+    }
     static async loadFromFile(filePath) {
         var _a;
-        const config = new AppHostingYamlConfig();
         if (!(0, fsutils_1.fileExistsSync)(filePath)) {
-            throw new error_1.FirebaseError("Cannot load AppHostingYamlConfig from given path, it doesn't exist");
+            throw new error_1.FirebaseError(`Cannot load ${filePath} from given path, it doesn't exist`);
         }
+        const config = new AppHostingYamlConfig();
         const file = await (0, utils_1.readFileFromDirectory)((0, path_1.dirname)(filePath), (0, path_1.basename)(filePath));
+        config.filename = path.basename(filePath);
         const loadedAppHostingYaml = (_a = (await (0, utils_1.wrappedSafeLoad)(file.source))) !== null && _a !== void 0 ? _a : {};
         if (loadedAppHostingYaml.env) {
-            const parsedEnvs = parseEnv(loadedAppHostingYaml.env);
-            config._environmentVariables = parsedEnvs.environmentVariables;
-            config._secrets = parsedEnvs.secrets;
+            config.env = parseEnv(loadedAppHostingYaml.env);
         }
         return config;
     }
     static empty() {
         return new AppHostingYamlConfig();
     }
-    constructor() {
-        this._environmentVariables = new Map();
-        this._secrets = new Map();
-    }
-    get environmentVariables() {
-        return mapToArray(this._environmentVariables);
-    }
-    get secrets() {
-        return mapToArray(this._secrets);
-    }
-    addEnvironmentVariable(env) {
-        this._environmentVariables.set(env.variable, env);
-    }
-    addSecret(secret) {
-        this._secrets.set(secret.variable, secret);
-    }
-    clearSecrets() {
-        this._secrets.clear();
-    }
-    merge(other) {
-        for (const [key, value] of other._environmentVariables) {
-            this._environmentVariables.set(key, value);
-        }
-        for (const [key, value] of other._secrets) {
-            this._secrets.set(key, value);
+    merge(other, allowSecretsToBecomePlaintext = true) {
+        if (!allowSecretsToBecomePlaintext) {
+            const wereSecrets = Object.entries(this.env)
+                .filter(([, env]) => env.secret)
+                .map(([key]) => key);
+            if (wereSecrets.some((key) => { var _a; return (_a = other.env[key]) === null || _a === void 0 ? void 0 : _a.value; })) {
+                throw new error_1.FirebaseError(`Cannot convert secret to plaintext in ${other.filename ? other.filename : "apphosting yaml"}`);
+            }
         }
+        this.env = Object.assign(Object.assign({}, this.env), other.env);
     }
     async upsertFile(filePath) {
         let yamlConfigToWrite = {};
@@ -60,27 +47,13 @@ class AppHostingYamlConfig {
             const file = await (0, utils_1.readFileFromDirectory)((0, path_1.dirname)(filePath), (0, path_1.basename)(filePath));
             yamlConfigToWrite = await (0, utils_1.wrappedSafeLoad)(file.source);
         }
-        yamlConfigToWrite.env = [...this.environmentVariables, ...this.secrets];
+        yamlConfigToWrite.env = Object.entries(this.env).map(([variable, env]) => {
+            return Object.assign({ variable }, env);
+        });
         (0, config_1.store)(filePath, yaml.parseDocument(jsYaml.dump(yamlConfigToWrite)));
     }
 }
 exports.AppHostingYamlConfig = AppHostingYamlConfig;
 function parseEnv(envs) {
-    const environmentVariables = new Map();
-    const secrets = new Map();
-    for (const env of envs) {
-        if (env.value) {
-            environmentVariables.set(env.variable, env);
-        }
-        if (env.secret) {
-            secrets.set(env.variable, env);
-        }
-    }
-    return {
-        environmentVariables,
-        secrets,
-    };
-}
-function mapToArray(map) {
-    return Array.from(map.values());
+    return Object.fromEntries(envs.map((env) => [env.variable, env]));
 }

package/lib/commands/dataconnect-sdk-generate.js

@@ -8,6 +8,7 @@ const projectUtils_1 = require("../projectUtils");
 const load_1 = require("../dataconnect/load");
 const fileUtils_1 = require("../dataconnect/fileUtils");
 const logger_1 = require("../logger");
+const auth_1 = require("../auth");
 exports.command = new command_1.Command("dataconnect:sdk:generate")
     .description("generates typed SDKs for your Data Connect connectors")
     .option("--watch", "watch for changes to your connector GQL files and regenerate your SDKs when updates occur")
@@ -27,14 +28,16 @@ exports.command = new command_1.Command("dataconnect:sdk:generate")
         if (!hasGeneratables) {
             logger_1.logger.warn("No generated SDKs have been declared in connector.yaml files.");
             logger_1.logger.warn(`Run ${clc.bold("firebase init dataconnect:sdk")} to configure a generated SDK.`);
-            logger_1.logger.warn(`See https://firebase.google.com/docs/data-connect/gp/web-sdk for more details of how to configure generated SDKs.`);
+            logger_1.logger.warn(`See https://firebase.google.com/docs/data-connect/web-sdk for more details of how to configure generated SDKs.`);
             return;
         }
         for (const conn of serviceInfo.connectorInfo) {
+            const account = (0, auth_1.getProjectDefaultAccount)(options.projectRoot);
             const output = await dataconnectEmulator_1.DataConnectEmulator.generate({
                 configDir,
                 connectorId: conn.connectorYaml.connectorId,
                 watch: options.watch,
+                account,
             });
             logger_1.logger.info(output);
             logger_1.logger.info(`Generated SDKs for ${conn.connectorYaml.connectorId}`);

package/lib/commands/dataconnect-sql-diff.js

@@ -21,6 +21,6 @@ exports.command = new command_1.Command("dataconnect:sql:diff [serviceId]")
     const projectId = (0, projectUtils_1.needProjectId)(options);
     await (0, ensureApis_1.ensureApis)(projectId);
     const serviceInfo = await (0, fileUtils_1.pickService)(projectId, options.config, serviceId);
-    const diffs = await (0, schemaMigration_1.diffSchema)(serviceInfo.schema, (_a = serviceInfo.dataConnectYaml.schema.datasource.postgresql) === null || _a === void 0 ? void 0 : _a.schemaValidation);
+    const diffs = await (0, schemaMigration_1.diffSchema)(options, serviceInfo.schema, (_a = serviceInfo.dataConnectYaml.schema.datasource.postgresql) === null || _a === void 0 ? void 0 : _a.schemaValidation);
     return { projectId, serviceId, diffs };
 });

package/lib/commands/dataconnect-sql-grant.js

@@ -9,8 +9,8 @@ const fileUtils_1 = require("../dataconnect/fileUtils");
 const schemaMigration_1 = require("../dataconnect/schemaMigration");
 const requireAuth_1 = require("../requireAuth");
 const error_1 = require("../error");
-const permissions_1 = require("../gcp/cloudsql/permissions");
-const allowedRoles = Object.keys(permissions_1.fdcSqlRoleMap);
+const permissions_setup_1 = require("../gcp/cloudsql/permissions_setup");
+const allowedRoles = Object.keys(permissions_setup_1.fdcSqlRoleMap);
 exports.command = new command_1.Command("dataconnect:sql:grant [serviceId]")
     .description("Grants the SQL role <role> to the provided user or service account <email>.")
     .option("-R, --role <role>", "The SQL role to grant. One of: owner, writer, or reader.")

package/lib/commands/dataconnect-sql-setup.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.command = void 0;
+const command_1 = require("../command");
+const projectUtils_1 = require("../projectUtils");
+const fileUtils_1 = require("../dataconnect/fileUtils");
+const error_1 = require("../error");
+const requireAuth_1 = require("../requireAuth");
+const requirePermissions_1 = require("../requirePermissions");
+const ensureApis_1 = require("../dataconnect/ensureApis");
+const permissions_setup_1 = require("../gcp/cloudsql/permissions_setup");
+const permissions_1 = require("../gcp/cloudsql/permissions");
+const schemaMigration_1 = require("../dataconnect/schemaMigration");
+const connect_1 = require("../gcp/cloudsql/connect");
+const cloudSqlAdminClient = require("../gcp/cloudsql/cloudsqladmin");
+exports.command = new command_1.Command("dataconnect:sql:setup [serviceId]")
+    .description("Setup your CloudSQL database")
+    .before(requirePermissions_1.requirePermissions, [
+    "firebasedataconnect.services.list",
+    "firebasedataconnect.schemas.list",
+    "firebasedataconnect.schemas.update",
+    "cloudsql.instances.connect",
+])
+    .before(requireAuth_1.requireAuth)
+    .action(async (serviceId, options) => {
+    var _a;
+    const projectId = (0, projectUtils_1.needProjectId)(options);
+    await (0, ensureApis_1.ensureApis)(projectId);
+    const serviceInfo = await (0, fileUtils_1.pickService)(projectId, options.config, serviceId);
+    const instanceId = (_a = serviceInfo.dataConnectYaml.schema.datasource.postgresql) === null || _a === void 0 ? void 0 : _a.cloudSql.instanceId;
+    if (!instanceId) {
+        throw new error_1.FirebaseError("dataconnect.yaml is missing field schema.datasource.postgresql.cloudsql.instanceId");
+    }
+    const { serviceName, instanceName, databaseId } = (0, schemaMigration_1.getIdentifiers)(serviceInfo.schema);
+    await (0, schemaMigration_1.ensureServiceIsConnectedToCloudSql)(serviceName, instanceName, databaseId, true);
+    const { user, mode } = await (0, connect_1.getIAMUser)(options);
+    await cloudSqlAdminClient.createUser(projectId, instanceId, mode, user);
+    const schemaInfo = await (0, permissions_setup_1.getSchemaMetadata)(instanceId, databaseId, permissions_1.DEFAULT_SCHEMA, options);
+    await (0, permissions_setup_1.setupSQLPermissions)(instanceId, databaseId, schemaInfo, options);
+});

package/lib/commands/functions-artifacts-setpolicy.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.command = void 0;
+const clc = require("colorette");
+const command_1 = require("../command");
+const error_1 = require("../error");
+const projectUtils_1 = require("../projectUtils");
+const prompt_1 = require("../prompt");
+const requirePermissions_1 = require("../requirePermissions");
+const requireAuth_1 = require("../requireAuth");
+const utils_1 = require("../utils");
+const artifactregistry = require("../gcp/artifactregistry");
+const artifacts = require("../functions/artifacts");
+exports.command = new command_1.Command("functions:artifacts:setpolicy")
+    .description("Set up a cleanup policy for Cloud Run functions container images in Artifact Registry. " +
+    "This policy will automatically delete old container images created during functions deployment.")
+    .option("--location <location>", "Specify location to set up the cleanup policy. " +
+    "If omitted, uses the default functions location.", "us-central1")
+    .option("--days <days>", "Number of days to keep container images before deletion. Default is 3 days.", "3")
+    .option("--none", "Opt-out from cleanup policy. This will prevent suggestions to set up a cleanup policy during initialization and deployment.")
+    .before((options) => {
+    if (options.days && options.none) {
+        throw new error_1.FirebaseError("Cannot specify both --days and --none options.");
+    }
+})
+    .withForce("Automatically create or modify cleanup policy")
+    .before(requireAuth_1.requireAuth)
+    .before(async (options) => {
+    const projectId = (0, projectUtils_1.needProjectId)(options);
+    await artifactregistry.ensureApiEnabled(projectId);
+})
+    .before(requirePermissions_1.requirePermissions, [
+    "artifactregistry.repositories.update",
+    "artifactregistry.versions.delete",
+])
+    .action(async (options) => {
+    var _a;
+    const projectId = (0, projectUtils_1.needProjectId)(options);
+    const location = options.location || "us-central1";
+    let daysToKeep = parseInt(options.days || "3", 10);
+    const repoPath = artifacts.makeRepoPath(projectId, location);
+    let repository;
+    try {
+        repository = await artifactregistry.getRepository(repoPath);
+    }
+    catch (err) {
+        if (err.status === 404) {
+            (0, utils_1.logBullet)(`Repository '${repoPath}' does not exist in Artifact Registry.`);
+            (0, utils_1.logBullet)(`Please deploy your functions first using: ` +
+                `${clc.bold(`firebase deploy --only functions`)}`);
+            return;
+        }
+        throw err;
+    }
+    if (options.none) {
+        const existingPolicy = artifacts.findExistingPolicy(repository);
+        if (artifacts.hasCleanupOptOut(repository) && !existingPolicy) {
+            (0, utils_1.logBullet)(`Repository '${repoPath}' is already opted out from cleanup policies.`);
+            (0, utils_1.logBullet)(`No changes needed.`);
+            return;
+        }
+        (0, utils_1.logBullet)(`You are about to opt-out from cleanup policy for repository '${repoPath}'.`);
+        (0, utils_1.logBullet)(`This will prevent suggestions to set up cleanup policy during initialization and deployment.`);
+        if (existingPolicy) {
+            (0, utils_1.logBullet)(`Note: This will remove the existing cleanup policy from the repository.`);
+        }
+        const confirmOptOut = await (0, prompt_1.confirm)(Object.assign(Object.assign({}, options), { default: true, message: "Do you want to continue?" }));
+        if (!confirmOptOut) {
+            throw new error_1.FirebaseError("Command aborted.", { exit: 1 });
+        }
+        try {
+            await artifacts.optOutRepository(repository);
+            (0, utils_1.logSuccess)(`Successfully opted out from cleanup policy for ${clc.bold(repoPath)}`);
+            return;
+        }
+        catch (err) {
+            throw new error_1.FirebaseError("Failed to opt-out from artifact registry cleanup policy", {
+                original: err,
+            });
+        }
+    }
+    if (isNaN(daysToKeep) || daysToKeep < 0) {
+        throw new error_1.FirebaseError("Days must be a non-negative number");
+    }
+    if (daysToKeep === 0) {
+        daysToKeep = 0.003472;
+    }
+    if (artifacts.hasSameCleanupPolicy(repository, daysToKeep)) {
+        (0, utils_1.logBullet)(`A cleanup policy already exists that deletes images older than ${clc.bold(daysToKeep)} days.`);
+        (0, utils_1.logBullet)(`No changes needed.`);
+        return;
+    }
+    (0, utils_1.logBullet)(`You are about to set up a cleanup policy for Cloud Run functions container images in location ${clc.bold(location)}`);
+    (0, utils_1.logBullet)(`This policy will automatically delete container images that are older than ${clc.bold(daysToKeep)} days`);
+    (0, utils_1.logBullet)("This helps reduce storage costs by removing old container images that are no longer needed");
+    const existingPolicy = artifacts.findExistingPolicy(repository);
+    let isUpdate = false;
+    if (existingPolicy && ((_a = existingPolicy.condition) === null || _a === void 0 ? void 0 : _a.olderThan)) {
+        const existingDays = artifacts.parseDaysFromPolicy(existingPolicy.condition.olderThan);
+        if (existingDays) {
+            isUpdate = true;
+            (0, utils_1.logBullet)(`Note: This will update an existing policy that currently deletes images older than ${clc.bold(existingDays)} days`);
+        }
+    }
+    if (artifacts.hasCleanupOptOut(repository)) {
+        (0, utils_1.logBullet)(`Note: This repository was previously opted out from cleanup policy. This action will remove the opt-out status.`);
+    }
+    const confirmSetup = await (0, prompt_1.confirm)(Object.assign(Object.assign({}, options), { default: true, message: "Do you want to continue?" }));
+    if (!confirmSetup) {
+        throw new error_1.FirebaseError("Command aborted.", { exit: 1 });
+    }
+    try {
+        await artifacts.setCleanupPolicy(repository, daysToKeep);
+        const successMessage = isUpdate
+            ? `Successfully updated cleanup policy to delete images older than ${clc.bold(daysToKeep)} days`
+            : `Successfully set up cleanup policy that deletes images older than ${clc.bold(daysToKeep)} days`;
+        (0, utils_1.logSuccess)(successMessage);
+        (0, utils_1.logBullet)(`Cleanup policy has been set for ${clc.bold(repoPath)}`);
+    }
+    catch (err) {
+        throw new error_1.FirebaseError("Failed to set up artifact registry cleanup policy", {
+            original: err,
+        });
+    }
+});

package/lib/commands/index.js

@@ -138,6 +138,8 @@ function load(client) {
     client.functions.secrets.describe = loadCommand("functions-secrets-describe");
     client.functions.secrets.prune = loadCommand("functions-secrets-prune");
     client.functions.secrets.set = loadCommand("functions-secrets-set");
+    client.functions.artifacts = {};
+    client.functions.artifacts.setpolicy = loadCommand("functions-artifacts-setpolicy");
     client.help = loadCommand("help");
     client.hosting = {};
     client.hosting.channel = {};
@@ -216,6 +218,7 @@ function load(client) {
     client.dataconnect.services.list = loadCommand("dataconnect-services-list");
     client.dataconnect.sql = {};
     client.dataconnect.sql.diff = loadCommand("dataconnect-sql-diff");
+    client.dataconnect.sql.setup = loadCommand("dataconnect-sql-setup");
     client.dataconnect.sql.migrate = loadCommand("dataconnect-sql-migrate");
     client.dataconnect.sql.grant = loadCommand("dataconnect-sql-grant");
     client.dataconnect.sql.shell = loadCommand("dataconnect-sql-shell");

package/lib/commands/open.js

@@ -14,13 +14,16 @@ const utils = require("../utils");
 const requireHostingSite_1 = require("../requireHostingSite");
 const LINKS = [
     { name: "Analytics", arg: "analytics", consolePath: "/analytics" },
+    { name: "App Hosting", arg: "apphosting", consolePath: "/apphosting" },
     { name: "Authentication: Providers", arg: "auth", consolePath: "/authentication/providers" },
     { name: "Authentication: Users", arg: "auth:users", consolePath: "/authentication/users" },
     { name: "Crash Reporting", arg: "crash", consolePath: "/crashlytics" },
     { name: "Database: Data", arg: "database", consolePath: "/database/data" },
     { name: "Database: Rules", arg: "database:rules", consolePath: "/database/rules" },
+    { name: "Data Connect", arg: "dataconnect", consolePath: "/dataconnect" },
     { name: "Docs", arg: "docs", url: "https://firebase.google.com/docs" },
     { name: "Dynamic Links", arg: "links", consolePath: "/durablelinks" },
+    { name: "Extensions", arg: "extensions", consolePath: "/extensions" },
     { name: "Firestore: Data", arg: "firestore", consolePath: "/firestore/data" },
     { name: "Firestore: Rules", arg: "firestore:rules", consolePath: "/firestore/rules" },
     { name: "Firestore: Indexes", arg: "firestore:indexes", consolePath: "/firestore/indexes" },

package/lib/dataconnect/build.js

@@ -7,9 +7,11 @@ const experiments = require("../experiments");
 const prompt_1 = require("../prompt");
 const utils = require("../utils");
 const graphqlError_1 = require("./graphqlError");
+const auth_1 = require("../auth");
 async function build(options, configDir, dryRun) {
     var _a, _b;
-    const args = { configDir };
+    const account = (0, auth_1.getProjectDefaultAccount)(options.projectRoot);
+    const args = { configDir, account };
     if (experiments.isEnabled("fdcconnectorevolution") && options.projectId) {
         const flags = process.env["DATA_CONNECT_PREVIEW"];
         if (flags) {

package/lib/dataconnect/fileUtils.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getFrameworksFromPackageJson = exports.SUPPORTED_FRAMEWORKS = exports.resolvePackageJson = exports.getPlatformFromFolder = exports.pickService = exports.readGQLFiles = exports.readConnectorYaml = exports.readDataConnectYaml = exports.readFirebaseJson = void 0;
+exports.getFrameworksFromPackageJson = exports.frameworksMap = exports.SUPPORTED_FRAMEWORKS = exports.resolvePackageJson = exports.getPlatformFromFolder = exports.pickService = exports.readGQLFiles = exports.readConnectorYaml = exports.readDataConnectYaml = exports.readFirebaseJson = void 0;
 const fs = require("fs-extra");
 const path = require("path");
 const error_1 = require("../error");
@@ -147,12 +147,16 @@ async function resolvePackageJson(packageJsonPath) {
     }
 }
 exports.resolvePackageJson = resolvePackageJson;
-exports.SUPPORTED_FRAMEWORKS = ["react"];
+exports.SUPPORTED_FRAMEWORKS = ["react", "angular"];
+exports.frameworksMap = {
+    react: ["react", "next"],
+    angular: ["@angular/core"],
+};
 function getFrameworksFromPackageJson(packageJson) {
     var _a, _b;
     const devDependencies = Object.keys((_a = packageJson.devDependencies) !== null && _a !== void 0 ? _a : {});
     const dependencies = Object.keys((_b = packageJson.dependencies) !== null && _b !== void 0 ? _b : {});
-    const matched = new Set([...devDependencies, ...dependencies].filter((dep) => exports.SUPPORTED_FRAMEWORKS.includes(dep)));
-    return Array.from(matched);
+    const allDeps = Array.from(new Set([...devDependencies, ...dependencies]));
+    return exports.SUPPORTED_FRAMEWORKS.filter((framework) => exports.frameworksMap[framework].find((dep) => allDeps.includes(dep)));
 }
 exports.getFrameworksFromPackageJson = getFrameworksFromPackageJson;

package/lib/dataconnect/schemaMigration.js

@@ -1,23 +1,38 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getIdentifiers = exports.grantRoleToUserInSchema = exports.migrateSchema = exports.diffSchema = void 0;
+exports.ensureServiceIsConnectedToCloudSql = exports.getIdentifiers = exports.grantRoleToUserInSchema = exports.migrateSchema = exports.diffSchema = void 0;
 const clc = require("colorette");
 const sql_formatter_1 = require("sql-formatter");
 const types_1 = require("./types");
 const client_1 = require("./client");
 const connect_1 = require("../gcp/cloudsql/connect");
-const permissions_1 = require("../gcp/cloudsql/permissions");
-const cloudSqlAdminClient = require("../gcp/cloudsql/cloudsqladmin");
 const projectUtils_1 = require("../projectUtils");
+const permissions_setup_1 = require("../gcp/cloudsql/permissions_setup");
+const permissions_1 = require("../gcp/cloudsql/permissions");
 const prompt_1 = require("../prompt");
 const logger_1 = require("../logger");
 const error_1 = require("../error");
 const utils_1 = require("../utils");
+const cloudsqladmin_1 = require("../gcp/cloudsql/cloudsqladmin");
+const cloudSqlAdminClient = require("../gcp/cloudsql/cloudsqladmin");
 const errors = require("./errors");
-async function diffSchema(schema, schemaValidation) {
-    const { serviceName, instanceName, databaseId } = getIdentifiers(schema);
+async function setupSchemaIfNecessary(instanceId, databaseId, options) {
+    await (0, connect_1.setupIAMUsers)(instanceId, databaseId, options);
+    const schemaInfo = await (0, permissions_setup_1.getSchemaMetadata)(instanceId, databaseId, permissions_1.DEFAULT_SCHEMA, options);
+    if (schemaInfo.setupStatus !== permissions_setup_1.SchemaSetupStatus.BrownField &&
+        schemaInfo.setupStatus !== permissions_setup_1.SchemaSetupStatus.GreenField) {
+        return await (0, permissions_setup_1.setupSQLPermissions)(instanceId, databaseId, schemaInfo, options, true);
+    }
+    else {
+        logger_1.logger.info(`Detected schema "${schemaInfo.name}" is setup in ${schemaInfo.setupStatus} mode. Skipping Setup.`);
+    }
+    return schemaInfo.setupStatus;
+}
+async function diffSchema(options, schema, schemaValidation) {
+    const { serviceName, instanceName, databaseId, instanceId } = getIdentifiers(schema);
     await ensureServiceIsConnectedToCloudSql(serviceName, instanceName, databaseId, false);
     let diffs = [];
+    await setupSchemaIfNecessary(instanceId, databaseId, options);
     let validationMode = schemaValidation !== null && schemaValidation !== void 0 ? schemaValidation : "COMPATIBLE";
     setSchemaValidationMode(schema, validationMode);
     try {
@@ -85,7 +100,9 @@ async function migrateSchema(args) {
     const { options, schema, validateOnly, schemaValidation } = args;
     const { serviceName, instanceId, instanceName, databaseId } = getIdentifiers(schema);
     await ensureServiceIsConnectedToCloudSql(serviceName, instanceName, databaseId, true);
+    await (0, connect_1.setupIAMUsers)(instanceId, databaseId, options);
     let diffs = [];
+    await setupSchemaIfNecessary(instanceId, databaseId, options);
     let validationMode = schemaValidation !== null && schemaValidation !== void 0 ? schemaValidation : "COMPATIBLE";
     setSchemaValidationMode(schema, validationMode);
     try {
@@ -156,12 +173,17 @@ async function grantRoleToUserInSchema(options, schema) {
     const { instanceId, databaseId } = getIdentifiers(schema);
     const projectId = (0, projectUtils_1.needProjectId)(options);
     const { user, mode } = (0, connect_1.toDatabaseUser)(email);
-    const fdcSqlRole = permissions_1.fdcSqlRoleMap[role](databaseId);
-    const userIsCSQLAdmin = await (0, permissions_1.iamUserIsCSQLAdmin)(options);
+    const fdcSqlRole = permissions_setup_1.fdcSqlRoleMap[role](databaseId);
+    await (0, connect_1.setupIAMUsers)(instanceId, databaseId, options);
+    const userIsCSQLAdmin = await (0, cloudsqladmin_1.iamUserIsCSQLAdmin)(options);
     if (!userIsCSQLAdmin) {
         throw new error_1.FirebaseError(`Only users with 'roles/cloudsql.admin' can grant SQL roles. If you do not have this role, ask your database administrator to run this command or manually grant ${fdcSqlRole} to ${user}`);
     }
-    await (0, connect_1.setupIAMUsers)(instanceId, databaseId, options);
+    const schemaSetupStatus = await setupSchemaIfNecessary(instanceId, databaseId, options);
+    if (schemaSetupStatus !== permissions_setup_1.SchemaSetupStatus.GreenField &&
+        fdcSqlRole === (0, permissions_1.firebaseowner)(databaseId, permissions_1.DEFAULT_SCHEMA)) {
+        throw new error_1.FirebaseError(`Owner rule isn't available in brownfield databases. If you would like Data Connect to manage and own your database schema, run 'firebase dataconnect:sql:setup'`);
+    }
     await cloudSqlAdminClient.createUser(projectId, instanceId, mode, user);
     await (0, connect_1.executeSqlCmdsAsSuperUser)(options, instanceId, databaseId, [`GRANT "${fdcSqlRole}" TO "${user}"`], false);
 }
@@ -232,16 +254,19 @@ async function handleIncompatibleSchemaError(args) {
     if (commandsToExecute.length) {
         const commandsToExecuteBySuperUser = commandsToExecute.filter((sql) => sql.startsWith("CREATE EXTENSION") || sql.startsWith("CREATE SCHEMA"));
         const commandsToExecuteByOwner = commandsToExecute.filter((sql) => !commandsToExecuteBySuperUser.includes(sql));
-        const userIsCSQLAdmin = await (0, permissions_1.iamUserIsCSQLAdmin)(options);
+        const userIsCSQLAdmin = await (0, cloudsqladmin_1.iamUserIsCSQLAdmin)(options);
         if (!userIsCSQLAdmin && commandsToExecuteBySuperUser.length) {
             throw new error_1.FirebaseError(`Some SQL commands required for this migration require Admin permissions.\n 
         Please ask a user with 'roles/cloudsql.admin' to apply the following commands.\n
         ${commandsToExecuteBySuperUser.join("\n")}`);
         }
-        if (userIsCSQLAdmin) {
-            await (0, connect_1.setupIAMUsers)(instanceId, databaseId, options);
+        const schemaInfo = await (0, permissions_setup_1.getSchemaMetadata)(instanceId, databaseId, permissions_1.DEFAULT_SCHEMA, options);
+        if (schemaInfo.setupStatus !== permissions_setup_1.SchemaSetupStatus.GreenField) {
+            throw new error_1.FirebaseError(`Brownfield database are protected from SQL changes by Data Connect.\n` +
+                `You can use the SQL diff generated by 'firebase dataconnect:sql:diff' to assist you in applying the required changes to your CloudSQL database. Connector deployment will succeed when there is no required diff changes.\n` +
+                `If you would like Data Connect to manage your database schema, run 'firebase dataconnect:sql:setup'`);
         }
-        if (!(await (0, permissions_1.checkSQLRoleIsGranted)(options, instanceId, databaseId, (0, permissions_1.firebaseowner)(databaseId), (await (0, connect_1.getIAMUser)(options)).user))) {
+        if (!(await (0, permissions_setup_1.checkSQLRoleIsGranted)(options, instanceId, databaseId, (0, permissions_1.firebaseowner)(databaseId), (await (0, connect_1.getIAMUser)(options)).user))) {
             throw new error_1.FirebaseError(`Command aborted. Only users granted firebaseowner SQL role can run migrations.`);
         }
         if (commandsToExecuteBySuperUser.length) {
@@ -376,6 +401,7 @@ async function ensureServiceIsConnectedToCloudSql(serviceName, instanceId, datab
         logger_1.logger.debug(err);
     }
 }
+exports.ensureServiceIsConnectedToCloudSql = ensureServiceIsConnectedToCloudSql;
 function displaySchemaChanges(error, validationMode, instanceName, databaseId) {
     switch (error.violationType) {
         case "INCOMPATIBLE_SCHEMA":

package/lib/defaultCredentials.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.clearCredentials = exports.getCredentialPathAsync = void 0;
+exports.hasDefaultCredentials = exports.clearCredentials = exports.getCredentialPathAsync = void 0;
 const fs = require("fs");
 const path = require("path");
+const google_auth_library_1 = require("google-auth-library");
 const api_1 = require("./api");
 const logger_1 = require("./logger");
 async function getCredentialPathAsync(account) {
@@ -78,3 +79,13 @@ function userEmailSlug(user) {
     const slug = email.replace("@", "_").replace(".", "_");
     return slug;
 }
+async function hasDefaultCredentials() {
+    try {
+        await google_auth_library_1.auth.getApplicationDefault();
+        return true;
+    }
+    catch (err) {
+        return false;
+    }
+}
+exports.hasDefaultCredentials = hasDefaultCredentials;

package/lib/deploy/dataconnect/prepare.js

@@ -54,7 +54,7 @@ async function default_1(context, options) {
     utils.logLabeledBullet("dataconnect", `Successfully prepared schema and connectors`);
     if (options.dryRun) {
         for (const si of serviceInfos) {
-            await (0, schemaMigration_1.diffSchema)(si.schema, (_a = si.dataConnectYaml.schema.datasource.postgresql) === null || _a === void 0 ? void 0 : _a.schemaValidation);
+            await (0, schemaMigration_1.diffSchema)(options, si.schema, (_a = si.dataConnectYaml.schema.datasource.postgresql) === null || _a === void 0 ? void 0 : _a.schemaValidation);
         }
         utils.logLabeledBullet("dataconnect", "Checking for CloudSQL resources...");
         await Promise.all(serviceInfos

package/lib/deploy/functions/containerCleaner.js

@@ -83,12 +83,27 @@ async function cleanupBuildImages(haveFunctions, deletedFunctions, cleaners = {}
 exports.cleanupBuildImages = cleanupBuildImages;
 class ArtifactRegistryCleaner {
     static packagePath(func) {
-        const encodedId = func.id
+        const encodedId = func.platform === "gcfv2"
+            ? ArtifactRegistryCleaner.encodePackageNameV2(func)
+            : ArtifactRegistryCleaner.encodePackageNameV1(func);
+        return `projects/${func.project}/locations/${func.region}/repositories/gcf-artifacts/packages/${encodedId}`;
+    }
+    static encodePart(part) {
+        return part
             .replace(/_/g, "__")
             .replace(/-/g, "--")
             .replace(/^[A-Z]/, (first) => `${first.toLowerCase()}-${first.toLowerCase()}`)
             .replace(/[A-Z]/g, (upper) => `_${upper.toLowerCase()}`);
-        return `projects/${func.project}/locations/${func.region}/repositories/gcf-artifacts/packages/${encodedId}`;
+    }
+    static encodePackageNameV1(func) {
+        return ArtifactRegistryCleaner.encodePart(func.id);
+    }
+    static encodePackageNameV2(func) {
+        return [
+            ArtifactRegistryCleaner.encodePart(func.project),
+            ArtifactRegistryCleaner.encodePart(func.region),
+            ArtifactRegistryCleaner.encodePart(func.id),
+        ].join("__");
     }
     async cleanupFunction(func) {
         let op;

package/lib/deploy/functions/runtimes/discovery/index.js

@@ -54,7 +54,9 @@ async function detectFromPort(port, project, runtime, initialDelay = 0, timeout
     let res;
     const timedOut = new Promise((resolve, reject) => {
         setTimeout(() => {
-            reject(new error_1.FirebaseError("User code failed to load. Cannot determine backend specification"));
+            const originalError = "User code failed to load. Cannot determine backend specification.";
+            const error = `${originalError} Timeout after ${timeout}. See https://firebase.google.com/docs/functions/tips#avoid_deployment_timeouts_during_initialization'`;
+            reject(new error_1.FirebaseError(error));
         }, getFunctionDiscoveryTimeout() || timeout);
     });
     if (initialDelay > 0) {