firebase-tools 15.20.0 → 15.22.0

package/lib/frameworks/angular/utils.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BuilderType = void 0;
+exports.ANGULAR_22_DEFAULT_SERVER_ENTRY = exports.ANGULAR_22_RECOMMENDED_ALLOWED_HOSTS = exports.BuilderType = void 0;
 exports.getAllTargets = getAllTargets;
 exports.getContext = getContext;
 exports.getBrowserConfig = getBrowserConfig;
@@ -9,12 +9,19 @@ exports.getBuildConfig = getBuildConfig;
 exports.getAngularVersion = getAngularVersion;
 exports.tryToGetOptionsForTarget = tryToGetOptionsForTarget;
 exports.getBuilderType = getBuilderType;
+exports.getAngular22SsrSecurityWarning = getAngular22SsrSecurityWarning;
+exports.formatAngular22SsrSecurityWarning = formatAngular22SsrSecurityWarning;
+exports.maybeWarnAngular22SsrSecurity = maybeWarnAngular22SsrSecurity;
+exports.extractAngular22AllowedHostsFromBuildOptions = extractAngular22AllowedHostsFromBuildOptions;
+exports.getAngular22ServerEntryPath = getAngular22ServerEntryPath;
 const utils_1 = require("../utils");
 const error_1 = require("../../error");
 const path_1 = require("path");
+const promises_1 = require("fs/promises");
 const assert_1 = require("assert");
 const utils_2 = require("../../utils");
 const semver_1 = require("semver");
+const clc = require("colorette");
 async function localesForTarget(dir, architectHost, target, workspaceProject) {
     const { targetStringFromTarget } = await (0, utils_1.relativeRequire)(dir, "@angular-devkit/architect");
     const targetOptions = await architectHost.getOptionsForTarget(target);
@@ -373,6 +380,7 @@ async function getContext(dir, targetOrConfiguration) {
         workspaceProject,
         serveOptimizedImages,
         ssr,
+        buildTargetOptions: buildTargetOptions || undefined,
     };
 }
 async function getBrowserConfig(sourceDir, configuration) {
@@ -460,7 +468,7 @@ async function getServerConfig(sourceDir, configuration) {
 }
 async function getBuildConfig(sourceDir, configuration) {
     const { targetStringFromTarget } = await (0, utils_1.relativeRequire)(sourceDir, "@angular-devkit/architect");
-    const { buildTarget, browserTarget, baseHref, prerenderTarget, serverTarget, architectHost, workspaceProject, serveOptimizedImages, ssr, } = await getContext(sourceDir, configuration);
+    const { buildTarget, browserTarget, baseHref, prerenderTarget, serverTarget, architectHost, workspaceProject, serveOptimizedImages, ssr, buildTargetOptions, } = await getContext(sourceDir, configuration);
     const targets = (buildTarget
         ? [buildTarget]
         : prerenderTarget
@@ -477,6 +485,7 @@ async function getBuildConfig(sourceDir, configuration) {
         locales,
         serveOptimizedImages,
         ssr,
+        buildTargetOptions,
     };
 }
 function getAngularVersion(cwd) {
@@ -502,3 +511,92 @@ function getBuilderType(builder) {
     }
     return builderType;
 }
+const ANGULAR_22_PUBLIC_HOST_PATTERNS = ["*.web.app", "*.firebaseapp.com"];
+const ANGULAR_22_CLOUD_RUN_HOST_PATTERNS = ["*.a.run.app"];
+exports.ANGULAR_22_RECOMMENDED_ALLOWED_HOSTS = [
+    ...ANGULAR_22_PUBLIC_HOST_PATTERNS,
+    ...ANGULAR_22_CLOUD_RUN_HOST_PATTERNS,
+];
+function getAngular22SsrSecurityWarning(opts) {
+    if (!opts.ssr)
+        return undefined;
+    const declared = opts.buildOptionsAllowedHosts ?? [];
+    const serverHasAllowedHosts = !!opts.serverEntrySource && /\ballowedHosts\s*[:=]/.test(opts.serverEntrySource);
+    if (declared.includes("*") || (serverHasAllowedHosts && declared.length === 0)) {
+        return undefined;
+    }
+    const trustProxyHeadersEnabled = !!opts.serverEntrySource && /\btrustProxyHeaders\s*[:=]/.test(opts.serverEntrySource);
+    const requiredHostPatterns = trustProxyHeadersEnabled
+        ? ANGULAR_22_PUBLIC_HOST_PATTERNS
+        : ANGULAR_22_CLOUD_RUN_HOST_PATTERNS;
+    if (requiredHostPatterns.every((pattern) => declared.includes(pattern)))
+        return undefined;
+    const allowedHostsMissing = exports.ANGULAR_22_RECOMMENDED_ALLOWED_HOSTS.filter((pattern) => !declared.includes(pattern));
+    return { allowedHostsMissing, trustProxyHeadersEnabled };
+}
+function formatAngular22SsrSecurityWarning(warning) {
+    const sections = [
+        "Angular 22 enabled strict SSRF protection on its SSR engine. Without the matching security.allowedHosts entries, the SSR function will reject requests and return errors after deploy.",
+        [
+            "Add these hostnames to security.allowedHosts in angular.json:",
+            `  ${JSON.stringify(warning.allowedHostsMissing)}`,
+            `${clc.bold("Documentation")}: https://angular.dev/best-practices/security#configuring-allowed-hosts`,
+        ].join("\n"),
+    ];
+    if (!warning.trustProxyHeadersEnabled) {
+        sections.push([
+            "Alternatively, enable trustProxyHeaders so the engine validates the forwarded Hosting domain instead of the SSR function host. If you do, also add any custom domains you serve from to security.allowedHosts.",
+            `${clc.bold("Documentation")}: https://angular.dev/best-practices/security#configuring-trusted-proxy-headers`,
+        ].join("\n"));
+    }
+    const message = sections.join("\n\n");
+    return message
+        .split("\n")
+        .map((line, i) => (i === 0 ? line : "  " + line))
+        .join("\n")
+        .concat("\n");
+}
+async function maybeWarnAngular22SsrSecurity(dir, opts) {
+    try {
+        const version = getAngularVersion(dir);
+        if (!version)
+            return;
+        const semver = (0, semver_1.coerce)(version);
+        if (!semver || semver.major < 22)
+            return;
+        if (!opts.ssr)
+            return;
+        const buildOptionsAllowedHosts = extractAngular22AllowedHostsFromBuildOptions(opts.buildTargetOptions);
+        const entryPath = getAngular22ServerEntryPath(opts.buildTargetOptions);
+        let serverEntrySource;
+        try {
+            serverEntrySource = await (0, promises_1.readFile)((0, path_1.join)(dir, entryPath), "utf8");
+        }
+        catch {
+        }
+        const warning = getAngular22SsrSecurityWarning({
+            ssr: opts.ssr,
+            buildOptionsAllowedHosts,
+            serverEntrySource,
+        });
+        if (!warning)
+            return;
+        (0, utils_2.logLabeledWarning)("Angular 22", formatAngular22SsrSecurityWarning(warning));
+    }
+    catch {
+    }
+}
+function extractAngular22AllowedHostsFromBuildOptions(options) {
+    const security = options?.security;
+    if (!security || !Array.isArray(security.allowedHosts))
+        return undefined;
+    return security.allowedHosts.filter((h) => typeof h === "string");
+}
+exports.ANGULAR_22_DEFAULT_SERVER_ENTRY = "src/server.ts";
+function getAngular22ServerEntryPath(options) {
+    const ssr = options?.ssr;
+    if (ssr && typeof ssr !== "boolean" && typeof ssr.entry === "string") {
+        return ssr.entry;
+    }
+    return exports.ANGULAR_22_DEFAULT_SERVER_ENTRY;
+}

package/lib/frameworks/astro/index.js

@@ -50,7 +50,7 @@ async function ɵcodegenPublicDirectory(root, dest) {
 async function ɵcodegenFunctionsDirectory(sourceDir, destDir) {
     const { outDir } = await (0, utils_2.getConfig)(sourceDir);
     const packageJson = await (0, utils_1.readJSON)((0, path_1.join)(sourceDir, "package.json"));
-    await (0, fs_extra_1.copy)((0, path_1.join)(sourceDir, outDir, "server"), (0, path_1.join)(destDir));
+    await (0, fs_extra_1.copy)((0, path_1.join)(sourceDir, outDir, "server"), (0, path_1.join)(destDir, "server"));
     return {
         packageJson,
         bootstrapScript: (0, utils_2.getBootstrapScript)(),

package/lib/frameworks/astro/utils.js

@@ -9,7 +9,7 @@ const semver_1 = require("semver");
 const url_1 = require("url");
 const { dynamicImport } = require(true && "../../dynamicImport");
 function getBootstrapScript() {
-    return `const entry = import('./entry.mjs');\nexport const handle = async (req, res) => (await entry).handler(req, res)`;
+    return `const entry = import('./server/entry.mjs');\nexport const handle = async (req, res) => (await entry).handler(req, res)`;
 }
 async function getConfig(cwd) {
     const astroDirectory = (0, path_1.dirname)(require.resolve("astro/package.json", { paths: [cwd] }));

package/lib/functions/python.js

@@ -4,7 +4,7 @@ exports.DEFAULT_VENV_DIR = void 0;
 exports.virtualEnvCmd = virtualEnvCmd;
 exports.runWithVirtualEnv = runWithVirtualEnv;
 const path = require("path");
-const spawn = require("cross-spawn");
+const cross_spawn_1 = require("cross-spawn");
 const logger_1 = require("../logger");
 const utils_1 = require("../utils");
 exports.DEFAULT_VENV_DIR = "venv";
@@ -13,17 +13,17 @@ function virtualEnvCmd(cwd, venvDir) {
     const venvActivate = `"${path.join(cwd, venvDir, ...activateScriptPath)}"`;
     return {
         command: utils_1.IS_WINDOWS ? venvActivate : ".",
-        args: [utils_1.IS_WINDOWS ? "" : venvActivate],
+        args: utils_1.IS_WINDOWS ? [] : [venvActivate],
     };
 }
 function runWithVirtualEnv(commandAndArgs, cwd, envs, spawnOpts = {}, venvDir = exports.DEFAULT_VENV_DIR) {
     const { command, args } = virtualEnvCmd(cwd, venvDir);
     args.push("&&", ...commandAndArgs);
     logger_1.logger.debug(`Running command with virtualenv: command=${command}, args=${JSON.stringify(args)}`);
-    return spawn(command, args, {
+    return (0, cross_spawn_1.spawn)(command, args, {
         shell: true,
         cwd,
-        stdio: ["pipe", "pipe", "pipe", "pipe"],
+        stdio: "pipe",
         ...spawnOpts,
         env: envs,
     });

package/lib/hosting/cloudRunProxy.js

@@ -7,6 +7,9 @@ const proxy_1 = require("./proxy");
 const error_1 = require("../error");
 const logger_1 = require("../logger");
 const projectUtils_1 = require("../projectUtils");
+const registry_1 = require("../emulator/registry");
+const types_1 = require("../emulator/types");
+const functionsEmulator_1 = require("../emulator/functionsEmulator");
 const cloudRunCache = {};
 const apiClient = new apiv2_1.Client({ urlPrefix: (0, api_1.cloudRunApiOrigin)(), apiVersion: "v1" });
 async function getCloudRunUrl(rewrite, projectId) {
@@ -44,6 +47,11 @@ function default_1(options) {
         }
         logger_1.logger.info(`[hosting] Cloud Run rewrite ${JSON.stringify(rewrite)} triggered`);
         const textIdentifier = `Cloud Run service "${rewrite.run.serviceId}" for region "${rewrite.run.region}"`;
+        if (options.targets?.includes("functions") && registry_1.EmulatorRegistry.isRunning(types_1.Emulators.FUNCTIONS)) {
+            const projectId = (0, projectUtils_1.needProjectId)(options);
+            const url = functionsEmulator_1.FunctionsEmulator.getHttpFunctionUrl(projectId, rewrite.run.serviceId, rewrite.run.region);
+            return (0, proxy_1.proxyRequestHandler)(url, `local ${textIdentifier}`);
+        }
         return getCloudRunUrl(rewrite, (0, projectUtils_1.needProjectId)(options))
             .then((url) => (0, proxy_1.proxyRequestHandler)(url, textIdentifier))
             .catch(proxy_1.errorRequestHandler);

package/lib/index.js

@@ -1,7 +1,7 @@
 "use strict";
 const program = require("commander");
 const clc = require("colorette");
-const leven = require("leven");
+const utils_1 = require("./utils");
 const logger_1 = require("./logger");
 const command_1 = require("./command");
 const pkg = require("../package.json");
@@ -51,7 +51,7 @@ const client = {
 require("./commands").load(client);
 function suggestCommands(cmd, cmdList) {
     const suggestion = cmdList.find((c) => {
-        return leven(c, cmd) < c.length * 0.4;
+        return (0, utils_1.stringDistance)(c, cmd) < c.length * 0.4;
     });
     if (suggestion) {
         logger_1.logger.error();

package/lib/init/features/apphosting.js

@@ -62,11 +62,18 @@ async function doSetup(setup, config, options) {
     backendConfig.rootDir = await (0, prompt_1.input)({
         default: "/",
         message: "Specify your app's root directory relative to your firebase.json directory",
+        validate: (input) => {
+            const absPath = path.join(config.projectDir, input);
+            if (!(0, fs_1.existsSync)(absPath)) {
+                return `Directory ${absPath} does not exist. Please enter a valid directory.`;
+            }
+            return true;
+        },
     });
     upsertAppHostingConfig(backendConfig, config);
     config.writeProjectFile("firebase.json", config.src);
     utils.logBullet("Writing default settings to " + clc.bold("apphosting.yaml") + "...");
-    const absRootDir = path.join(process.cwd(), backendConfig.rootDir);
+    const absRootDir = path.join(config.projectDir, backendConfig.rootDir);
     if (!(0, fs_1.existsSync)(absRootDir)) {
         throw new error_1.FirebaseError(`Failed to write apphosting.yaml file because app root directory ${absRootDir} does not exist. Please try again with a valid directory.`);
     }

package/lib/init/features/functions/python.js

@@ -1,44 +1,56 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.setup = setup;
-const spawn = require("cross-spawn");
+const spawn_1 = require("../../spawn");
 const python_1 = require("../../../deploy/functions/runtimes/python");
 const python_2 = require("../../../functions/python");
 const prompt_1 = require("../../../prompt");
 const supported_1 = require("../../../deploy/functions/runtimes/supported");
 const templates_1 = require("../../../templates");
+const error_1 = require("../../../error");
 const MAIN_TEMPLATE = (0, templates_1.readTemplateSync)("init/functions/python/main.py");
 const REQUIREMENTS_TEMPLATE = (0, templates_1.readTemplateSync)("init/functions/python/requirements.txt");
 const GITIGNORE_TEMPLATE = (0, templates_1.readTemplateSync)("init/functions/python/_gitignore");
+function waitForProcess(p) {
+    return new Promise((resolve) => {
+        p.on("exit", resolve);
+        p.on("error", () => resolve(-1));
+    });
+}
+async function createVirtualEnv(pythonBinary, cwd) {
+    try {
+        await (0, spawn_1.wrapSpawn)(pythonBinary, ["-m", "venv", "venv"], cwd);
+    }
+    catch (err) {
+        throw new error_1.FirebaseError(`Failed to create virtual environment. Please make sure Python is installed and in your PATH.`);
+    }
+}
+async function installDependencies(pythonBinary, cwd) {
+    const upgradeProcess = (0, python_2.runWithVirtualEnv)([pythonBinary, "-m", "pip", "install", "--upgrade", "pip"], cwd, {}, { stdio: "inherit" });
+    const upgradeExitCode = await waitForProcess(upgradeProcess);
+    if (upgradeExitCode !== 0) {
+        throw new error_1.FirebaseError("Failed to upgrade pip inside virtual environment.");
+    }
+    const installProcess = (0, python_2.runWithVirtualEnv)([pythonBinary, "-m", "pip", "install", "-r", "requirements.txt"], cwd, {}, { stdio: "inherit" });
+    const installExitCode = await waitForProcess(installProcess);
+    if (installExitCode !== 0) {
+        throw new error_1.FirebaseError("Failed to install dependencies.");
+    }
+}
 async function setup(setup, config) {
+    const sourceDir = config.path(setup.functions.source);
     await config.askWriteProjectFile(`${setup.functions.source}/requirements.txt`, REQUIREMENTS_TEMPLATE);
     await config.askWriteProjectFile(`${setup.functions.source}/.gitignore`, GITIGNORE_TEMPLATE);
     await config.askWriteProjectFile(`${setup.functions.source}/main.py`, MAIN_TEMPLATE);
     config.set("functions.runtime", (0, supported_1.latest)("python"));
     config.set("functions.ignore", ["venv", "__pycache__"]);
-    const venvProcess = spawn((0, python_1.getPythonBinary)((0, supported_1.latest)("python")), ["-m", "venv", "venv"], {
-        shell: true,
-        cwd: config.path(setup.functions.source),
-        stdio: ["pipe", "pipe", "pipe", "pipe"],
-    });
-    await new Promise((resolve, reject) => {
-        venvProcess.on("exit", resolve);
-        venvProcess.on("error", reject);
-    });
+    const pythonBinary = (0, python_1.getPythonBinary)((0, supported_1.latest)("python"));
+    await createVirtualEnv(pythonBinary, sourceDir);
     const install = await (0, prompt_1.confirm)({
         message: "Do you want to install dependencies now?",
         default: true,
     });
     if (install) {
-        const upgradeProcess = (0, python_2.runWithVirtualEnv)(["pip3", "install", "--upgrade", "pip"], config.path(setup.functions.source), {}, { stdio: ["inherit", "inherit", "inherit"] });
-        await new Promise((resolve, reject) => {
-            upgradeProcess.on("exit", resolve);
-            upgradeProcess.on("error", reject);
-        });
-        const installProcess = (0, python_2.runWithVirtualEnv)([(0, python_1.getPythonBinary)((0, supported_1.latest)("python")), "-m", "pip", "install", "-r", "requirements.txt"], config.path(setup.functions.source), {}, { stdio: ["inherit", "inherit", "inherit"] });
-        await new Promise((resolve, reject) => {
-            installProcess.on("exit", resolve);
-            installProcess.on("error", reject);
-        });
+        await installDependencies(pythonBinary, sourceDir);
     }
 }

package/lib/localFunction.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HTTPS_SENTINEL = void 0;
-const uuid = require("uuid");
+const crypto_1 = require("crypto");
 const encodeFirestoreValue_1 = require("./firestore/encodeFirestoreValue");
 const utils = require("./utils");
 const apiv2_1 = require("./apiv2");
@@ -249,7 +249,9 @@ class LocalFunction {
             else if (this.isPubsubFunc(this.trigger.eventTrigger)) {
                 dataPayload = data;
                 if (this.trigger.platform === "gcfv2") {
-                    dataPayload = { message: { ...data, messageId: uuid.v4() } };
+                    dataPayload = {
+                        message: { ...data, messageId: (0, crypto_1.randomUUID)() },
+                    };
                 }
                 this.controller.call(this.trigger, dataPayload || {}, opts);
             }

package/lib/track.js

@@ -9,7 +9,7 @@ exports.emulatorSession = emulatorSession;
 exports.vscodeSession = vscodeSession;
 exports.cliSession = cliSession;
 const node_fetch_1 = require("node-fetch");
-const uuid_1 = require("uuid");
+const crypto_1 = require("crypto");
 const auth_1 = require("./auth");
 const configstore_1 = require("./configstore");
 const logger_1 = require("./logger");
@@ -177,7 +177,7 @@ function session(propertyName) {
     if (!property.currentSession) {
         let clientId = configstore_1.configstore.get(property.clientIdKey);
         if (!clientId) {
-            clientId = (0, uuid_1.v4)();
+            clientId = (0, crypto_1.randomUUID)();
             configstore_1.configstore.set(property.clientIdKey, clientId);
         }
         property.currentSession = {