firebase-tools 13.7.2 → 13.7.4

package/lib/api.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.githubOrigin = exports.apphostingOrigin = exports.serviceUsageOrigin = exports.cloudRunApiOrigin = exports.hostingApiOrigin = exports.firebaseStorageOrigin = exports.storageOrigin = exports.runtimeconfigOrigin = exports.rulesOrigin = exports.resourceManagerOrigin = exports.remoteConfigApiOrigin = exports.rtdbMetadataOrigin = exports.rtdbManagementOrigin = exports.realtimeOrigin = exports.extensionsTOSOrigin = exports.extensionsPublisherOrigin = exports.extensionsOrigin = exports.iamOrigin = exports.identityOrigin = exports.hostingOrigin = exports.googleOrigin = exports.pubsubOrigin = exports.cloudTasksOrigin = exports.cloudschedulerOrigin = exports.developerConnectP4SAOrigin = exports.developerConnectOrigin = exports.cloudbuildOrigin = exports.functionsDefaultRegion = exports.runOrigin = exports.functionsV2Origin = exports.functionsOrigin = exports.firestoreOrigin = exports.firestoreOriginOrEmulator = exports.firedataOrigin = exports.firebaseExtensionsRegistryOrigin = exports.firebaseApiOrigin = exports.eventarcOrigin = exports.dynamicLinksKey = exports.dynamicLinksOrigin = exports.consoleOrigin = exports.authOrigin = exports.appDistributionOrigin = exports.artifactRegistryDomain = exports.containerRegistryDomain = exports.cloudMonitoringOrigin = exports.cloudloggingOrigin = exports.cloudbillingOrigin = exports.clientSecret = exports.clientId = exports.authProxyOrigin = void 0;
-exports.setScopes = exports.getScopes = exports.githubClientSecret = exports.githubClientId = exports.computeOrigin = exports.secretManagerOrigin = exports.githubApiOrigin = void 0;
+exports.serviceUsageOrigin = exports.cloudRunApiOrigin = exports.hostingApiOrigin = exports.firebaseStorageOrigin = exports.storageOrigin = exports.runtimeconfigOrigin = exports.rulesOrigin = exports.resourceManagerOrigin = exports.remoteConfigApiOrigin = exports.rtdbMetadataOrigin = exports.rtdbManagementOrigin = exports.realtimeOrigin = exports.extensionsTOSOrigin = exports.extensionsPublisherOrigin = exports.extensionsOrigin = exports.iamOrigin = exports.identityOrigin = exports.hostingOrigin = exports.googleOrigin = exports.pubsubOrigin = exports.cloudTasksOrigin = exports.cloudschedulerOrigin = exports.cloudbuildOrigin = exports.functionsDefaultRegion = exports.runOrigin = exports.functionsV2Origin = exports.functionsOrigin = exports.firestoreOrigin = exports.firestoreOriginOrEmulator = exports.firedataOrigin = exports.firebaseExtensionsRegistryOrigin = exports.firebaseApiOrigin = exports.eventarcOrigin = exports.dynamicLinksKey = exports.dynamicLinksOrigin = exports.consoleOrigin = exports.authOrigin = exports.apphostingP4SADomain = exports.apphostingOrigin = exports.appDistributionOrigin = exports.artifactRegistryDomain = exports.developerConnectP4SADomain = exports.developerConnectOrigin = exports.containerRegistryDomain = exports.cloudMonitoringOrigin = exports.cloudloggingOrigin = exports.cloudbillingOrigin = exports.clientSecret = exports.clientId = exports.authProxyOrigin = void 0;
+exports.setScopes = exports.getScopes = exports.githubClientSecret = exports.githubClientId = exports.computeOrigin = exports.secretManagerOrigin = exports.githubApiOrigin = exports.githubOrigin = void 0;
 const constants_1 = require("./emulator/constants");
 const logger_1 = require("./logger");
 const scopes = require("./scopes");
@@ -21,10 +21,18 @@ const cloudMonitoringOrigin = () => utils.envOverride("CLOUD_MONITORING_URL", "h
 exports.cloudMonitoringOrigin = cloudMonitoringOrigin;
 const containerRegistryDomain = () => utils.envOverride("CONTAINER_REGISTRY_DOMAIN", "gcr.io");
 exports.containerRegistryDomain = containerRegistryDomain;
+const developerConnectOrigin = () => utils.envOverride("DEVELOPERCONNECT_URL", "https://developerconnect.googleapis.com");
+exports.developerConnectOrigin = developerConnectOrigin;
+const developerConnectP4SADomain = () => utils.envOverride("DEVELOPERCONNECT_P4SA_DOMAIN", "gcp-sa-devconnect.iam.gserviceaccount.com");
+exports.developerConnectP4SADomain = developerConnectP4SADomain;
 const artifactRegistryDomain = () => utils.envOverride("ARTIFACT_REGISTRY_DOMAIN", "https://artifactregistry.googleapis.com");
 exports.artifactRegistryDomain = artifactRegistryDomain;
 const appDistributionOrigin = () => utils.envOverride("FIREBASE_APP_DISTRIBUTION_URL", "https://firebaseappdistribution.googleapis.com");
 exports.appDistributionOrigin = appDistributionOrigin;
+const apphostingOrigin = () => utils.envOverride("FIREBASE_APPHOSTING_URL", "https://firebaseapphosting.googleapis.com");
+exports.apphostingOrigin = apphostingOrigin;
+const apphostingP4SADomain = () => utils.envOverride("FIREBASE_APPHOSTING_P4SA_DOMAIN", "gcp-sa-firebaseapphosting.iam.gserviceaccount.com");
+exports.apphostingP4SADomain = apphostingP4SADomain;
 const authOrigin = () => utils.envOverride("FIREBASE_AUTH_URL", "https://accounts.google.com");
 exports.authOrigin = authOrigin;
 const consoleOrigin = () => utils.envOverride("FIREBASE_CONSOLE_URL", "https://console.firebase.google.com");
@@ -60,10 +68,6 @@ const functionsDefaultRegion = () => utils.envOverride("FIREBASE_FUNCTIONS_DEFAU
 exports.functionsDefaultRegion = functionsDefaultRegion;
 const cloudbuildOrigin = () => utils.envOverride("FIREBASE_CLOUDBUILD_URL", "https://cloudbuild.googleapis.com");
 exports.cloudbuildOrigin = cloudbuildOrigin;
-const developerConnectOrigin = () => utils.envOverride("FIREBASE_DEVELOPERCONNECT_URL", "https://developerconnect.googleapis.com");
-exports.developerConnectOrigin = developerConnectOrigin;
-const developerConnectP4SAOrigin = () => utils.envOverride("FIREBASE_DEVELOPERCONNECT_P4SA_URL", "gcp-sa-devconnect.iam.gserviceaccount.com");
-exports.developerConnectP4SAOrigin = developerConnectP4SAOrigin;
 const cloudschedulerOrigin = () => utils.envOverride("FIREBASE_CLOUDSCHEDULER_URL", "https://cloudscheduler.googleapis.com");
 exports.cloudschedulerOrigin = cloudschedulerOrigin;
 const cloudTasksOrigin = () => utils.envOverride("FIREBASE_CLOUD_TAKS_URL", "https://cloudtasks.googleapis.com");
@@ -108,8 +112,6 @@ const cloudRunApiOrigin = () => utils.envOverride("CLOUD_RUN_API_URL", "https://
 exports.cloudRunApiOrigin = cloudRunApiOrigin;
 const serviceUsageOrigin = () => utils.envOverride("FIREBASE_SERVICE_USAGE_URL", "https://serviceusage.googleapis.com");
 exports.serviceUsageOrigin = serviceUsageOrigin;
-const apphostingOrigin = () => utils.envOverride("APPHOSTING_URL", "https://firebaseapphosting.googleapis.com");
-exports.apphostingOrigin = apphostingOrigin;
 const githubOrigin = () => utils.envOverride("GITHUB_URL", "https://github.com");
 exports.githubOrigin = githubOrigin;
 const githubApiOrigin = () => utils.envOverride("GITHUB_API_URL", "https://api.github.com");

package/lib/apphosting/app.js

@@ -0,0 +1,92 @@
+"use strict";
+const fuzzy = require("fuzzy");
+const inquirer = require("inquirer");
+const apps_1 = require("../management/apps");
+const prompt_1 = require("../prompt");
+const error_1 = require("../error");
+const CREATE_NEW_FIREBASE_WEB_APP = "CREATE_NEW_WEB_APP";
+const CONTINUE_WITHOUT_SELECTING_FIREBASE_WEB_APP = "CONTINUE_WITHOUT_SELECTING_FIREBASE_WEB_APP";
+const webApps = {
+    CREATE_NEW_FIREBASE_WEB_APP,
+    CONTINUE_WITHOUT_SELECTING_FIREBASE_WEB_APP,
+    getOrCreateWebApp,
+    promptFirebaseWebApp,
+};
+async function getOrCreateWebApp(projectId, firebaseWebAppName, backendId) {
+    const webAppsInProject = await (0, apps_1.listFirebaseApps)(projectId, apps_1.AppPlatform.WEB);
+    if (webAppsInProject.length === 0) {
+        const { displayName, appId } = await createFirebaseWebApp(projectId, {
+            displayName: backendId,
+        });
+        return { name: displayName, id: appId };
+    }
+    const existingUserProjectWebApps = new Map(webAppsInProject.map((obj) => {
+        var _a;
+        return [
+            (_a = obj.displayName) !== null && _a !== void 0 ? _a : obj.appId,
+            obj.appId,
+        ];
+    }));
+    if (firebaseWebAppName) {
+        if (existingUserProjectWebApps.get(firebaseWebAppName) === undefined) {
+            throw new error_1.FirebaseError(`The web app '${firebaseWebAppName}' does not exist in project ${projectId}`);
+        }
+        return { name: firebaseWebAppName, id: existingUserProjectWebApps.get(firebaseWebAppName) };
+    }
+    return await webApps.promptFirebaseWebApp(projectId, backendId, existingUserProjectWebApps);
+}
+async function promptFirebaseWebApp(projectId, backendId, existingUserProjectWebApps) {
+    const existingWebAppKeys = Array.from(existingUserProjectWebApps.keys());
+    const firebaseWebAppName = await (0, prompt_1.promptOnce)({
+        type: "autocomplete",
+        name: "app",
+        message: "Which of the following Firebase web apps would you like to associate your backend with?",
+        source: (_, input = "") => {
+            return new Promise((resolve) => resolve([
+                new inquirer.Separator(),
+                {
+                    name: "Create a new Firebase web app.",
+                    value: CREATE_NEW_FIREBASE_WEB_APP,
+                },
+                {
+                    name: "Continue without a Firebase web app.",
+                    value: CONTINUE_WITHOUT_SELECTING_FIREBASE_WEB_APP,
+                },
+                new inquirer.Separator(),
+                ...fuzzy.filter(input, existingWebAppKeys).map((result) => {
+                    return result.original;
+                }),
+            ]));
+        },
+    });
+    if (firebaseWebAppName === CREATE_NEW_FIREBASE_WEB_APP) {
+        const newFirebaseWebApp = await createFirebaseWebApp(projectId, { displayName: backendId });
+        return { name: newFirebaseWebApp.displayName, id: newFirebaseWebApp.appId };
+    }
+    else if (firebaseWebAppName === CONTINUE_WITHOUT_SELECTING_FIREBASE_WEB_APP) {
+        return;
+    }
+    return { name: firebaseWebAppName, id: existingUserProjectWebApps.get(firebaseWebAppName) };
+}
+async function createFirebaseWebApp(projectId, options) {
+    try {
+        return await (0, apps_1.createWebApp)(projectId, options);
+    }
+    catch (e) {
+        if (isQuotaError(e)) {
+            throw new error_1.FirebaseError("Unable to create a new web app, the project has reached the quota for Firebase apps. Navigate to your Firebase console to manage or delete a Firebase app to continue. ", { original: e instanceof Error ? e : undefined });
+        }
+        throw new error_1.FirebaseError("Unable to create a Firebase web app", {
+            original: e instanceof Error ? e : undefined,
+        });
+    }
+}
+function isQuotaError(error) {
+    var _a, _b, _c, _d, _e;
+    const original = error.original;
+    const code = (original === null || original === void 0 ? void 0 : original.status) ||
+        ((_b = (_a = original === null || original === void 0 ? void 0 : original.context) === null || _a === void 0 ? void 0 : _a.response) === null || _b === void 0 ? void 0 : _b.statusCode) ||
+        ((_e = (_d = (_c = original === null || original === void 0 ? void 0 : original.context) === null || _c === void 0 ? void 0 : _c.body) === null || _d === void 0 ? void 0 : _d.error) === null || _e === void 0 ? void 0 : _e.code);
+    return code === 429;
+}
+module.exports = webApps;

package/lib/apphosting/config.js

@@ -1,31 +1,97 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.store = exports.load = exports.yamlPath = void 0;
-const path = require("path");
+exports.maybeAddSecretToYaml = exports.upsertEnv = exports.findEnv = exports.store = exports.load = exports.yamlPath = void 0;
+const path_1 = require("path");
 const fs_1 = require("fs");
-const yaml = require("js-yaml");
+const yaml = require("yaml");
 const fs = require("../fsutils");
+const prompt = require("../prompt");
+const dialogs = require("./secrets/dialogs");
 function yamlPath(cwd) {
     let dir = cwd;
-    while (!fs.fileExistsSync(path.resolve(dir, "apphosting.yaml"))) {
-        if (fs.fileExistsSync(path.resolve(dir, "firebase.json"))) {
+    while (!fs.fileExistsSync((0, path_1.resolve)(dir, "apphosting.yaml"))) {
+        if (fs.fileExistsSync((0, path_1.resolve)(dir, "firebase.json"))) {
             return null;
         }
-        const parent = path.dirname(dir);
+        const parent = (0, path_1.dirname)(dir);
         if (parent === dir) {
             return null;
         }
         dir = parent;
     }
-    return path.resolve(dir, "apphosting.yaml");
+    return (0, path_1.resolve)(dir, "apphosting.yaml");
 }
 exports.yamlPath = yamlPath;
 function load(yamlPath) {
     const raw = fs.readFile(yamlPath);
-    return yaml.load(raw, yaml.DEFAULT_FULL_SCHEMA);
+    return yaml.parseDocument(raw);
 }
 exports.load = load;
-function store(yamlPath, config) {
-    (0, fs_1.writeFileSync)(yamlPath, yaml.dump(config));
+function store(yamlPath, document) {
+    (0, fs_1.writeFileSync)(yamlPath, document.toString());
 }
 exports.store = store;
+function findEnv(document, variable) {
+    if (!document.has("env")) {
+        return undefined;
+    }
+    const envs = document.get("env");
+    for (const env of envs.items) {
+        if (env.get("variable") === variable) {
+            return env.toJSON();
+        }
+    }
+    return undefined;
+}
+exports.findEnv = findEnv;
+function upsertEnv(document, env) {
+    if (!document.has("env")) {
+        document.set("env", document.createNode([env]));
+        return;
+    }
+    const envs = document.get("env");
+    const envYaml = document.createNode(env);
+    for (let i = 0; i < envs.items.length; i++) {
+        if (envs.items[i].get("variable") === env.variable) {
+            envs.set(i, envYaml);
+            return;
+        }
+    }
+    envs.add(envYaml);
+}
+exports.upsertEnv = upsertEnv;
+async function maybeAddSecretToYaml(secretName) {
+    const dynamicDispatch = exports;
+    let path = dynamicDispatch.yamlPath(process.cwd());
+    let projectYaml;
+    if (path) {
+        projectYaml = dynamicDispatch.load(path);
+    }
+    else {
+        projectYaml = new yaml.Document();
+    }
+    if (dynamicDispatch.findEnv(projectYaml, secretName)) {
+        return;
+    }
+    const addToYaml = await prompt.confirm({
+        message: "Would you like to add this secret to apphosting.yaml?",
+        default: true,
+    });
+    if (!addToYaml) {
+        return;
+    }
+    if (!path) {
+        path = await prompt.promptOnce({
+            message: "It looks like you don't have an apphosting.yaml yet. Where would you like to store it?",
+            default: process.cwd(),
+        });
+        path = (0, path_1.join)(path, "apphosting.yaml");
+    }
+    const envName = await dialogs.envVarForSecret(secretName);
+    dynamicDispatch.upsertEnv(projectYaml, {
+        variable: envName,
+        secret: secretName,
+    });
+    dynamicDispatch.store(path, projectYaml);
+}
+exports.maybeAddSecretToYaml = maybeAddSecretToYaml;

package/lib/apphosting/constants.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ALLOWED_DEPLOY_METHODS = exports.DEFAULT_DEPLOY_METHOD = exports.DEFAULT_REGION = void 0;
-exports.DEFAULT_REGION = "us-central1";
+exports.ALLOWED_DEPLOY_METHODS = exports.DEFAULT_DEPLOY_METHOD = exports.DEFAULT_LOCATION = void 0;
+exports.DEFAULT_LOCATION = "us-central1";
 exports.DEFAULT_DEPLOY_METHOD = "github";
 exports.ALLOWED_DEPLOY_METHODS = [{ name: "Deploy using github", value: "github" }];

package/lib/apphosting/githubConnections.js

@@ -89,7 +89,7 @@ async function createFullyInstalledConnection(projectId, location, connectionId,
     });
     while (conn.installationState.stage !== "COMPLETE") {
         utils.logBullet("Install the Firebase GitHub app to enable access to GitHub repositories");
-        const targetUri = conn.installationState.actionUri.replace("install_v2", "direct_install_v2");
+        const targetUri = conn.installationState.actionUri;
         utils.logBullet(targetUri);
         await utils.openInBrowser(targetUri);
         await (0, prompt_1.promptOnce)({
@@ -135,7 +135,7 @@ async function promptCloneUri(projectId, connections) {
     const cloneUri = await (0, prompt_1.promptOnce)({
         type: "autocomplete",
         name: "cloneUri",
-        message: "Which of the following repositories would you like to deploy?",
+        message: "Which repository would you like to deploy?",
         source: (_, input = "") => {
             return new Promise((resolve) => resolve([
                 new inquirer.Separator(),

package/lib/apphosting/index.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.orchestrateRollout = exports.setDefaultTrafficPolicy = exports.createBackend = exports.doSetup = void 0;
-const clc = require("colorette");
+exports.promptLocation = exports.deleteBackendAndPoll = exports.orchestrateRollout = exports.setDefaultTrafficPolicy = exports.createBackend = exports.doSetup = void 0;
 const repo = require("./repo");
 const poller = require("../operation-poller");
 const apphosting = require("../gcp/apphosting");
@@ -16,6 +15,7 @@ const prompt_1 = require("../prompt");
 const constants_1 = require("./constants");
 const ensureApiEnabled_1 = require("../ensureApiEnabled");
 const deploymentTool = require("../deploymentTool");
+const apps = require("./app");
 const DEFAULT_COMPUTE_SERVICE_ACCOUNT_NAME = "firebase-app-hosting-compute";
 const apphostingPollerOptions = {
     apiOrigin: (0, api_1.apphostingOrigin)(),
@@ -23,7 +23,7 @@ const apphostingPollerOptions = {
     masterTimeout: 25 * 60 * 1000,
     maxBackoff: 10000,
 };
-async function doSetup(projectId, location, serviceAccount, withDevConnect) {
+async function doSetup(projectId, webAppName, location, serviceAccount, withDevConnect) {
     await Promise.all([
         ...(withDevConnect ? [(0, ensureApiEnabled_1.ensure)(projectId, (0, api_1.developerConnectOrigin)(), "apphosting", true)] : []),
         (0, ensureApiEnabled_1.ensure)(projectId, (0, api_1.cloudbuildOrigin)(), "apphosting", true),
@@ -37,24 +37,23 @@ async function doSetup(projectId, location, serviceAccount, withDevConnect) {
             throw new error_1.FirebaseError(`Invalid location ${location}. Valid choices are ${allowedLocations.join(", ")}`);
         }
     }
-    (0, utils_1.logBullet)("First we need a few details to create your backend.");
+    (0, utils_1.logBullet)("First we need a few details to create your backend.\n");
     location =
-        location ||
-            (await (0, prompt_1.promptOnce)({
-                name: "region",
-                type: "list",
-                default: constants_1.DEFAULT_REGION,
-                message: "Please select a region " +
-                    `(${clc.yellow("info")}: Your region determines where your backend is located):\n`,
-                choices: allowedLocations.map((loc) => ({ value: loc })),
-            }));
-    (0, utils_1.logSuccess)(`Region set to ${location}.\n`);
+        location || (await promptLocation(projectId, "Select a location to host your backend:\n"));
+    (0, utils_1.logSuccess)(`Location set to ${location}.\n`);
     const backendId = await promptNewBackendId(projectId, location, {
         name: "backendId",
         type: "input",
         default: "my-web-app",
         message: "Create a name for your backend [1-30 characters]",
     });
+    const webApp = await apps.getOrCreateWebApp(projectId, webAppName, backendId);
+    if (webApp) {
+        (0, utils_1.logSuccess)(`Firebase web app set to ${webApp.name}.\n`);
+    }
+    else {
+        (0, utils_1.logWarning)(`Firebase web app not set`);
+    }
     const gitRepositoryConnection = withDevConnect
         ? await githubConnections.linkGitHubRepository(projectId, location)
         : await repo.linkGitHubRepository(projectId, location);
@@ -62,9 +61,9 @@ async function doSetup(projectId, location, serviceAccount, withDevConnect) {
         name: "rootDir",
         type: "input",
         default: "/",
-        message: "Specify the path to the root of the app you would like to deploy (relative to the repo root)",
+        message: "Specify your app's root directory relative to your repository",
     });
-    const backend = await createBackend(projectId, location, backendId, gitRepositoryConnection, serviceAccount, rootDir);
+    const backend = await createBackend(projectId, location, backendId, gitRepositoryConnection, serviceAccount, webApp === null || webApp === void 0 ? void 0 : webApp.id, rootDir);
     const branch = await (0, prompt_1.promptOnce)({
         name: "branch",
         type: "input",
@@ -80,7 +79,7 @@ async function doSetup(projectId, location, serviceAccount, withDevConnect) {
     });
     if (!confirmRollout) {
         (0, utils_1.logSuccess)(`Successfully created backend:\n\t${backend.name}`);
-        (0, utils_1.logSuccess)(`Your site will be deployed at:\n\thttps://${backend.uri}`);
+        (0, utils_1.logSuccess)(`Your backend will be deployed at:\n\thttps://${backend.uri}`);
         return;
     }
     await orchestrateRollout(projectId, location, backendId, {
@@ -91,7 +90,7 @@ async function doSetup(projectId, location, serviceAccount, withDevConnect) {
         },
     });
     (0, utils_1.logSuccess)(`Successfully created backend:\n\t${backend.name}`);
-    (0, utils_1.logSuccess)(`Your site is now deployed at:\n\thttps://${backend.uri}`);
+    (0, utils_1.logSuccess)(`Your backend is now deployed at:\n\thttps://${backend.uri}`);
 }
 exports.doSetup = doSetup;
 async function promptNewBackendId(projectId, location, prompt) {
@@ -112,7 +111,7 @@ async function promptNewBackendId(projectId, location, prompt) {
 function defaultComputeServiceAccountEmail(projectId) {
     return `${DEFAULT_COMPUTE_SERVICE_ACCOUNT_NAME}@${projectId}.iam.gserviceaccount.com`;
 }
-async function createBackend(projectId, location, backendId, repository, serviceAccount, rootDir = "/") {
+async function createBackend(projectId, location, backendId, repository, serviceAccount, webAppId, rootDir = "/") {
     const defaultServiceAccount = defaultComputeServiceAccountEmail(projectId);
     const backendReqBody = {
         servingLocality: "GLOBAL_ACCESS",
@@ -122,8 +121,8 @@ async function createBackend(projectId, location, backendId, repository, service
         },
         labels: deploymentTool.labels(),
         serviceAccount: serviceAccount || defaultServiceAccount,
+        appId: webAppId,
     };
-    delete backendReqBody.serviceAccount;
     async function createBackendAndPoll() {
         const op = await apphosting.createBackend(projectId, location, backendReqBody, backendId);
         return await poller.pollOperation(Object.assign(Object.assign({}, apphostingPollerOptions), { pollerName: `create-${projectId}-${location}-${backendId}`, operationResourceName: op.name }));
@@ -154,13 +153,7 @@ async function provisionDefaultComputeServiceAccount(projectId) {
             throw err;
         }
     }
-    await (0, resourceManager_1.addServiceAccountToRoles)(projectId, defaultComputeServiceAccountEmail(projectId), [
-        "roles/firebaseapphosting.viewer",
-        "roles/artifactregistry.createOnPushWriter",
-        "roles/logging.logWriter",
-        "roles/storage.objectAdmin",
-        "roles/firebase.sdkAdminServiceAgent",
-    ], true);
+    await (0, resourceManager_1.addServiceAccountToRoles)(projectId, defaultComputeServiceAccountEmail(projectId), ["roles/firebaseapphosting.computeRunner", "roles/firebase.sdkAdminServiceAgent"], true);
 }
 async function setDefaultTrafficPolicy(projectId, location, backendId, codebaseBranch) {
     const traffic = {
@@ -221,3 +214,19 @@ async function orchestrateRollout(projectId, location, backendId, buildInput) {
     return { rollout, build };
 }
 exports.orchestrateRollout = orchestrateRollout;
+async function deleteBackendAndPoll(projectId, location, backendId) {
+    const op = await apphosting.deleteBackend(projectId, location, backendId);
+    await poller.pollOperation(Object.assign(Object.assign({}, apphostingPollerOptions), { pollerName: `delete-${projectId}-${location}-${backendId}`, operationResourceName: op.name }));
+}
+exports.deleteBackendAndPoll = deleteBackendAndPoll;
+async function promptLocation(projectId, prompt = "Please select a location:") {
+    const allowedLocations = (await apphosting.listLocations(projectId)).map((loc) => loc.locationId);
+    return (await (0, prompt_1.promptOnce)({
+        name: "location",
+        type: "list",
+        default: constants_1.DEFAULT_LOCATION,
+        message: prompt,
+        choices: allowedLocations,
+    }));
+}
+exports.promptLocation = promptLocation;

package/lib/apphosting/repo.js

@@ -86,7 +86,7 @@ async function createFullyInstalledConnection(projectId, location, connectionId,
     });
     while (conn.installationState.stage !== "COMPLETE") {
         utils.logBullet("Install the Cloud Build GitHub app to enable access to GitHub repositories");
-        const targetUri = conn.installationState.actionUri.replace("install_v2", "direct_install_v2");
+        const targetUri = conn.installationState.actionUri;
         utils.logBullet(targetUri);
         await utils.openInBrowser(targetUri);
         await (0, prompt_1.promptOnce)({
@@ -132,7 +132,7 @@ async function promptRepositoryUri(projectId, connections) {
     const remoteUri = await (0, prompt_1.promptOnce)({
         type: "autocomplete",
         name: "remoteUri",
-        message: "Which of the following repositories would you like to deploy?",
+        message: "Which repository would you like to deploy?",
         source: (_, input = "") => {
             return new Promise((resolve) => resolve([
                 new inquirer.Separator(),

package/lib/apphosting/secrets/dialogs.js

@@ -65,42 +65,43 @@ function selectFromMetadata(input, selected) {
     };
 }
 exports.selectFromMetadata = selectFromMetadata;
-exports.WARN_NO_BACKENDS = "To use this secret, your backend's service account must have secret accessor permission. " +
+exports.WARN_NO_BACKENDS = "To use this secret, your backend's service account must be granted access." +
     "It does not look like you have a backend yet. After creating a backend, grant access with " +
-    clc.bold("firebase apphosting:secrets:grantAccess");
+    clc.bold("firebase apphosting:secrets:grantaccess");
 exports.GRANT_ACCESS_IN_FUTURE = `To grant access in the future, run ${clc.bold("firebase apphosting:secrets:grantaccess")}`;
 async function selectBackendServiceAccounts(projectNumber, projectId, options) {
     const listBackends = await apphosting.listBackends(projectId, "-");
     if (listBackends.unreachable.length) {
-        utils.logLabeledWarning("apphosting", `Could not reach location(s) ${listBackends.unreachable.join(", ")}. You may need to run ` +
-            `${clc.bold("firebase apphosting:secrets:grantAccess")} at a later time if you have backends in these locations`);
+        utils.logWarning(`Could not reach location(s) ${listBackends.unreachable.join(", ")}. You may need to run ` +
+            `${clc.bold("firebase apphosting:secrets:grantaccess")} at a later time if you have backends in these locations`);
     }
     if (!listBackends.backends.length) {
-        utils.logLabeledWarning("apphosting", exports.WARN_NO_BACKENDS);
+        utils.logWarning(exports.WARN_NO_BACKENDS);
         return { buildServiceAccounts: [], runServiceAccounts: [] };
     }
     if (listBackends.backends.length === 1) {
         const grant = await prompt.confirm({
             nonInteractive: options.nonInteractive,
             default: true,
-            message: "To use this secret, your backend's service account must have secret accessor permission. Would you like to grant it now?",
+            message: "To use this secret, your backend's service account must be granted access. Would you like to grant access now?",
         });
         if (grant) {
             return (0, _1.toMulti)((0, _1.serviceAccountsForBackend)(projectNumber, listBackends.backends[0]));
         }
-        utils.logLabeledBullet("apphosting", exports.GRANT_ACCESS_IN_FUTURE);
+        utils.logBullet(exports.GRANT_ACCESS_IN_FUTURE);
         return { buildServiceAccounts: [], runServiceAccounts: [] };
     }
     const metadata = toMetadata(projectNumber, listBackends.backends);
     if (metadata.every(matchesServiceAccounts(metadata[0]))) {
-        utils.logLabeledBullet("apphosting", "To use this secret, your backend's service account must have secret accessor permission. All of your backends use " +
-            (sameServiceAccount(metadata[0]) ? "service account " : "service accounts ") +
+        utils.logBullet("To use this secret, your backend's service account must be granted access.");
+        utils.logBullet("All of your backends share the following " +
+            (sameServiceAccount(metadata[0]) ? "service account: " : "service accounts: ") +
             serviceAccountDisplay(metadata[0]) +
-            ". Granting access to one backend will grant access to all backends.");
+            ".\nGranting access to one backend will grant access to all backends.");
         const grant = await prompt.confirm({
             nonInteractive: options.nonInteractive,
             default: true,
-            message: "Would you like to grant it now?",
+            message: "Would you like to grant access to all backends now?",
         });
         if (grant) {
             return selectFromMetadata(metadata, [
@@ -108,10 +109,10 @@ async function selectBackendServiceAccounts(projectNumber, projectId, options) {
                 metadata[0].runServiceAccount,
             ]);
         }
-        utils.logLabeledBullet("apphosting", exports.GRANT_ACCESS_IN_FUTURE);
+        utils.logBullet(exports.GRANT_ACCESS_IN_FUTURE);
         return { buildServiceAccounts: [], runServiceAccounts: [] };
     }
-    utils.logLabeledBullet("apphosting", "To use this secret, your backend's service account must have secret accessor permission. Your backends use the following service accounts:");
+    utils.logBullet("To use this secret, your backend's service account must be granted access. Your backends use the following service accounts:");
     const tableData = tableForBackends(metadata);
     const table = new Table({
         head: tableData[0],
@@ -131,7 +132,7 @@ async function selectBackendServiceAccounts(projectNumber, projectId, options) {
         choices: [...allAccounts.values()].sort(),
     });
     if (!chosen.length) {
-        utils.logLabeledBullet("apphosting", exports.GRANT_ACCESS_IN_FUTURE);
+        utils.logBullet(exports.GRANT_ACCESS_IN_FUTURE);
     }
     return selectFromMetadata(metadata, chosen);
 }

package/lib/apphosting/secrets/index.js

@@ -5,6 +5,7 @@ const error_1 = require("../../error");
 const gcsm = require("../../gcp/secretManager");
 const gcb = require("../../gcp/cloudbuild");
 const gce = require("../../gcp/computeEngine");
+const apphosting = require("../../gcp/apphosting");
 const secretManager_1 = require("../../gcp/secretManager");
 const secretManager_2 = require("../../gcp/secretManager");
 const utils = require("../../utils");
@@ -33,7 +34,8 @@ function serviceAccountsForBackend(projectNumber, backend) {
     };
 }
 exports.serviceAccountsForBackend = serviceAccountsForBackend;
-async function grantSecretAccess(projectId, secretName, accounts) {
+async function grantSecretAccess(projectId, projectNumber, secretName, accounts) {
+    const p4saEmail = apphosting.serviceAgentEmail(projectNumber);
     const newBindings = [
         {
             role: "roles/secretmanager.secretAccessor",
@@ -43,6 +45,10 @@ async function grantSecretAccess(projectId, secretName, accounts) {
             role: "roles/secretmanager.viewer",
             members: accounts.buildServiceAccounts.map((sa) => `serviceAccount:${sa}`),
         },
+        {
+            role: "roles/secretmanager.secretVersionManager",
+            members: [`serviceAccount:${p4saEmail}`],
+        },
     ];
     let existingBindings;
     try {

package/lib/commands/apphosting-backends-create.js

@@ -7,16 +7,18 @@ const requireInteractive_1 = require("../requireInteractive");
 const apphosting_1 = require("../apphosting");
 const apphosting_2 = require("../gcp/apphosting");
 exports.command = new command_1.Command("apphosting:backends:create")
-    .description("create a backend in a Firebase project")
-    .option("-l, --location <location>", "specify the region of the backend", "")
+    .description("create a Firebase App Hosting backend")
+    .option("-a, --app <webApp>", "specify an existing Firebase web app to associate your App Hosting backend with")
+    .option("-l, --location <location>", "specify the location of the backend", "")
     .option("-s, --service-account <serviceAccount>", "specify the service account used to run the server", "")
     .option("-w, --with-dev-connect", "use the Developer Connect flow insetad of Cloud Build Repositories (testing)", false)
     .before(apphosting_2.ensureApiEnabled)
     .before(requireInteractive_1.default)
     .action(async (options) => {
     const projectId = (0, projectUtils_1.needProjectId)(options);
+    const webApp = options.app;
     const location = options.location;
     const serviceAccount = options.serviceAccount;
     const withDevConnect = options.withDevConnect;
-    await (0, apphosting_1.doSetup)(projectId, location, serviceAccount, withDevConnect);
+    await (0, apphosting_1.doSetup)(projectId, webApp, location, serviceAccount, withDevConnect);
 });

package/lib/commands/apphosting-backends-delete.js

@@ -5,31 +5,21 @@ const command_1 = require("../command");
 const projectUtils_1 = require("../projectUtils");
 const error_1 = require("../error");
 const prompt_1 = require("../prompt");
-const constants_1 = require("../apphosting/constants");
 const utils = require("../utils");
 const apphosting = require("../gcp/apphosting");
 const apphosting_backends_list_1 = require("./apphosting-backends-list");
+const apphosting_1 = require("../apphosting");
 exports.command = new command_1.Command("apphosting:backends:delete <backend>")
-    .description("delete a backend from a Firebase project")
-    .option("-l, --location <location>", "App Backend location", "")
+    .description("delete a Firebase App Hosting backend")
+    .option("-l, --location <location>", "specify the location of the backend", "")
     .withForce()
     .before(apphosting.ensureApiEnabled)
     .action(async (backendId, options) => {
     const projectId = (0, projectUtils_1.needProjectId)(options);
     let location = options.location;
-    if (!backendId) {
-        throw new error_1.FirebaseError("Backend id can't be empty.");
-    }
-    if (!location) {
-        const allowedLocations = (await apphosting.listLocations(projectId)).map((loc) => loc.locationId);
-        location = await (0, prompt_1.promptOnce)({
-            name: "region",
-            type: "list",
-            default: constants_1.DEFAULT_REGION,
-            message: "Please select the region of the backend you'd like to delete:",
-            choices: allowedLocations,
-        });
-    }
+    location =
+        location ||
+            (await (0, apphosting_1.promptLocation)(projectId, "Please select the location of the backend you'd like to delete:"));
     let backend;
     try {
         backend = await apphosting.getBackend(projectId, location, backendId);
@@ -52,7 +42,7 @@ exports.command = new command_1.Command("apphosting:backends:delete <backend>")
         throw new error_1.FirebaseError("Deletion Aborted");
     }
     try {
-        await apphosting.deleteBackend(projectId, location, backendId);
+        await (0, apphosting_1.deleteBackendAndPoll)(projectId, location, backendId);
         utils.logSuccess(`Successfully deleted the backend: ${backendId}`);
     }
     catch (err) {