firebase-tools 15.22.3 → 15.23.0

package/lib/deploy/apphosting/prepare.js

@@ -4,6 +4,7 @@ exports.default = default_1;
 exports.injectEnvVarsFromApphostingConfig = injectEnvVarsFromApphostingConfig;
 exports.injectAutoInitEnvVars = injectAutoInitEnvVars;
 exports.getBackendConfigs = getBackendConfigs;
+exports.injectAngularEnvVars = injectAngularEnvVars;
 const crypto = require("crypto");
 const fs = require("fs");
 const os = require("os");
@@ -134,10 +135,29 @@ async function default_1(context, options) {
             continue;
         }
         experiments.assertEnabled("apphostinglocalbuilds", "locally build App Hosting backends");
+        let backend = backends.find((b) => (0, apphosting_1.parseBackendName)(b.name).id === cfg.backendId);
+        if (!backend) {
+            const location = context.backendLocations[cfg.backendId];
+            if (location) {
+                const apphosting = await Promise.resolve().then(() => require("../../gcp/apphosting"));
+                try {
+                    backend = await apphosting.getBackend(projectId, location, cfg.backendId);
+                }
+                catch {
+                }
+            }
+        }
+        if (!backend) {
+            throw new error_1.FirebaseError(`Backend ${cfg.backendId} not found.`);
+        }
+        const rootDir = path.resolve(options.projectRoot || process.cwd());
+        const appDir = path.join(rootDir, cfg.rootDir || "");
+        (0, localbuilds_1.validateLocalBuildNodeVersion)(backend, appDir);
         (0, utils_1.logLabeledBullet)("apphosting", `Starting local build for backend ${cfg.backendId}`);
         await injectEnvVarsFromApphostingConfig(configs.filter((c) => c.backendId === cfg.backendId), options, buildEnv, runtimeEnv);
         await injectAutoInitEnvVars(cfg, backends, buildEnv, runtimeEnv);
-        const rootDir = path.resolve(options.projectRoot || process.cwd());
+        const location = context.backendLocations[cfg.backendId];
+        await injectAngularEnvVars(cfg, rootDir, projectId, location, buildEnv, runtimeEnv);
         const pathHash = crypto.createHash("md5").update(rootDir).digest("hex").substring(0, 8);
         const localBuildScratchDir = path.join(os.tmpdir(), `apphosting-local-build-${cfg.backendId}-${pathHash}`);
         try {
@@ -266,3 +286,82 @@ async function prepareLocalBuildScratchDirectory(rootDir, localBuildScratchDir,
         fs.copyFileSync(file.name, destPath);
     }
 }
+function isAngularApplication(appDir) {
+    const packageJsonPath = path.join(appDir, "package.json");
+    if (fs.existsSync(packageJsonPath)) {
+        try {
+            const parsed = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+            if (parsed && typeof parsed === "object") {
+                const pkg = parsed;
+                const angularDeps = ["@angular/core", "@angular/ssr", "@angular/platform-server"];
+                if (angularDeps.some((d) => pkg.dependencies?.[d] || pkg.devDependencies?.[d])) {
+                    return true;
+                }
+            }
+        }
+        catch (e) {
+            (0, utils_1.logLabeledError)("apphosting", `error when checking if application is angular: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    const angularJsonPath = path.join(appDir, "angular.json");
+    if (fs.existsSync(angularJsonPath)) {
+        return true;
+    }
+    return false;
+}
+async function injectAngularEnvVars(cfg, projectRoot, projectId, location, buildEnv, runtimeEnv) {
+    const appDir = path.join(projectRoot, cfg.rootDir || "");
+    if (!isAngularApplication(appDir)) {
+        return;
+    }
+    if (!location) {
+        throw new error_1.FirebaseError(`Failed to find location for backend ${cfg.backendId}.`);
+    }
+    const backendId = cfg.backendId;
+    runtimeEnv[backendId] ?? (runtimeEnv[backendId] = {});
+    buildEnv[backendId] ?? (buildEnv[backendId] = {});
+    const allowedProxyHeaders = [
+        "x-forwarded-host",
+        "x-forwarded-port",
+        "x-forwarded-proto",
+        "x-forwarded-for",
+    ];
+    const allowedProxyHeadersValue = allowedProxyHeaders.join(",");
+    let shouldInjectProxyHeaders = true;
+    if (runtimeEnv[backendId]["NG_TRUST_PROXY_HEADERS"]) {
+        const userProxyHeadersStr = runtimeEnv[backendId]["NG_TRUST_PROXY_HEADERS"].value;
+        const userProxyHeaders = userProxyHeadersStr
+            ? userProxyHeadersStr
+                .split(",")
+                .map((h) => h.trim().toLowerCase())
+                .filter(Boolean)
+            : [];
+        const isSubset = userProxyHeaders.length > 0 && userProxyHeaders.every((h) => allowedProxyHeaders.includes(h));
+        if (isSubset) {
+            shouldInjectProxyHeaders = false;
+        }
+        else {
+            throw new error_1.FirebaseError(`User-defined RUNTIME environment variable NG_TRUST_PROXY_HEADERS contains invalid headers. Allowed values: ${allowedProxyHeadersValue}`);
+        }
+    }
+    if (shouldInjectProxyHeaders) {
+        runtimeEnv[backendId]["NG_TRUST_PROXY_HEADERS"] = {
+            value: allowedProxyHeadersValue,
+            availability: ["RUNTIME"],
+        };
+    }
+    if (!runtimeEnv[backendId]["NG_ALLOWED_HOSTS"]) {
+        const projectNumber = await (0, getProjectNumber_1.getProjectNumber)({ project: projectId });
+        const sharedDomain = "hosted.app";
+        const defaultHosts = [
+            `${backendId}-${projectNumber}.${location}.run.app`,
+            `${backendId}--${projectId}.${location}.${sharedDomain}`,
+            `${backendId}--${projectId}.web.app`,
+            `${backendId}--${projectId}.firebaseapp.com`,
+        ];
+        runtimeEnv[backendId]["NG_ALLOWED_HOSTS"] = {
+            value: defaultHosts.join(","),
+            availability: ["RUNTIME"],
+        };
+    }
+}

package/lib/deploy/functions/backend.js

@@ -165,6 +165,7 @@ function of(...endpoints) {
 function merge(...backends) {
     const merged = of(...(0, functional_1.flattenArray)(backends.map((b) => allEndpoints(b))));
     const apiToReasons = {};
+    const requiredRoles = new Set();
     for (const b of backends) {
         for (const { api, reason } of b.requiredAPIs) {
             const reasons = apiToReasons[api] || new Set();
@@ -174,14 +175,27 @@ function merge(...backends) {
             apiToReasons[api] = reasons;
         }
         merged.environmentVariables = { ...merged.environmentVariables, ...b.environmentVariables };
+        if (b.requiredRoles) {
+            for (const role of b.requiredRoles) {
+                requiredRoles.add(role);
+            }
+        }
+        if (b.lifecycleHooks) {
+            merged.lifecycleHooks = { ...(merged.lifecycleHooks || {}), ...b.lifecycleHooks };
+        }
     }
     for (const [api, reasons] of Object.entries(apiToReasons)) {
         merged.requiredAPIs.push({ api, reason: Array.from(reasons).join(" ") });
     }
+    if (requiredRoles.size > 0) {
+        merged.requiredRoles = Array.from(requiredRoles);
+    }
     return merged;
 }
 function isEmptyBackend(backend) {
-    return (Object.keys(backend.requiredAPIs).length === 0 && Object.keys(backend.endpoints).length === 0);
+    return (Object.keys(backend.requiredAPIs).length === 0 &&
+        Object.keys(backend.endpoints).length === 0 &&
+        Object.keys(backend.lifecycleHooks || {}).length === 0);
 }
 function functionName(cloudFunction) {
     return `projects/${cloudFunction.project}/locations/${cloudFunction.region}/functions/${cloudFunction.id}`;

package/lib/deploy/functions/build.js

@@ -263,6 +263,12 @@ function toBackend(build, paramValues) {
     }
     const bkend = backend.of(...bkEndpoints);
     bkend.requiredAPIs = build.requiredAPIs;
+    if (build.requiredRoles) {
+        bkend.requiredRoles = build.requiredRoles;
+    }
+    if (build.lifecycleHooks) {
+        bkend.lifecycleHooks = build.lifecycleHooks;
+    }
     return bkend;
 }
 function discoverTrigger(endpoint, region, r) {
@@ -375,4 +381,26 @@ function applyPrefix(build, prefix) {
         }
     }
     build.endpoints = newEndpoints;
+    if (build.lifecycleHooks) {
+        for (const hook of Object.values(build.lifecycleHooks)) {
+            if ("task" in hook) {
+                if (hook.task?.function) {
+                    hook.task.function = `${prefix}-${hook.task.function}`;
+                }
+            }
+            else if ("call" in hook) {
+                if (hook.call?.function) {
+                    hook.call.function = `${prefix}-${hook.call.function}`;
+                }
+            }
+            else if ("http" in hook) {
+                if (hook.http?.function) {
+                    hook.http.function = `${prefix}-${hook.http.function}`;
+                }
+            }
+            else {
+                (0, functional_1.assertExhaustive)(hook);
+            }
+        }
+    }
 }

package/lib/deploy/functions/prepare.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EVENTARC_SOURCE_ENV = void 0;
+exports.discoverSecurityDetails = discoverSecurityDetails;
 exports.prepare = prepare;
 exports.resolveDefaultRegionsForBuild = resolveDefaultRegionsForBuild;
 exports.inferDetailsFromExisting = inferDetailsFromExisting;
@@ -43,7 +44,94 @@ const backend_1 = require("./backend");
 const functional_1 = require("../../functional");
 const prepare_1 = require("../extensions/prepare");
 const prompt = require("../../prompt");
+const iam = require("../../gcp/iam");
+const resourcemanager = require("../../gcp/resourceManager");
 exports.EVENTARC_SOURCE_ENV = "EVENTARC_CLOUD_EVENT_SOURCE";
+async function discoverSecurityDetails(codebase, want, have, projectId) {
+    const requiredRoles = want.requiredRoles;
+    const firstHave = backend.allEndpoints(have)[0];
+    let existingManagedSA;
+    let haveRolesEtag;
+    if (firstHave) {
+        haveRolesEtag = firstHave.labels?.["firebase-declarative-security-etag"];
+        existingManagedSA = firstHave.serviceAccount?.startsWith("firebase-fn-")
+            ? firstHave.serviceAccount
+            : undefined;
+    }
+    if (!requiredRoles && (!existingManagedSA || !haveRolesEtag)) {
+        return {};
+    }
+    if (requiredRoles &&
+        backend.someEndpoint(want, (e) => typeof e.serviceAccount === "string" &&
+            e.serviceAccount !== "default" &&
+            !e.serviceAccount.startsWith("firebase-fn-"))) {
+        throw new error_1.FirebaseError(`Cannot use explicit custom service accounts on functions while using declarative security in codebase ${codebase}.`);
+    }
+    if (!requiredRoles && existingManagedSA && haveRolesEtag) {
+        for (const endpoint of backend.allEndpoints(want)) {
+            if (!endpoint.serviceAccount || endpoint.serviceAccount === existingManagedSA) {
+                endpoint.serviceAccount = "default";
+            }
+            if (endpoint.labels) {
+                delete endpoint.labels["firebase-declarative-security-etag"];
+            }
+        }
+        return {
+            haveRolesEtag,
+            existingManagedSA,
+        };
+    }
+    let managedSA = existingManagedSA;
+    if (!managedSA) {
+        const saToCreate = await iam.generateManagedServiceAccountName(projectId, "firebase-fn");
+        managedSA = `${saToCreate}@${projectId}.iam.gserviceaccount.com`;
+    }
+    const existingSalt = haveRolesEtag ? haveRolesEtag.split("-")[0] : undefined;
+    const newEtag = iam.computeRolesEtag(requiredRoles, existingSalt);
+    for (const endpoint of backend.allEndpoints(want)) {
+        endpoint.serviceAccount = managedSA;
+        endpoint.labels = endpoint.labels || {};
+        endpoint.labels["firebase-declarative-security-etag"] = newEtag;
+    }
+    if (haveRolesEtag && haveRolesEtag === newEtag) {
+        return {
+            haveRoles: requiredRoles,
+            haveRolesEtag,
+            existingManagedSA,
+            managedSA,
+            newEtag,
+        };
+    }
+    const permissionsToTest = ["resourcemanager.projects.setIamPolicy"];
+    if (!existingManagedSA) {
+        permissionsToTest.push("iam.serviceAccounts.create");
+    }
+    const iamResult = await iam.testIamPermissions(projectId, permissionsToTest);
+    if (!iamResult.passed) {
+        if (!existingManagedSA) {
+            throw new error_1.FirebaseError(`Cannot enable declarative security because you do not have permissions necessary to create the service account. Please ask an IAM administrator to perform the next deploy.`);
+        }
+        else {
+            throw new error_1.FirebaseError(`You do not have access to make the policy changes required in codebase ${codebase} deploy. Please ask an IAM administrator to perform the next deploy.`);
+        }
+    }
+    let haveRoles = [];
+    if (existingManagedSA) {
+        try {
+            haveRoles = await resourcemanager.getServiceAccountRoles(projectId, managedSA);
+        }
+        catch (err) {
+            throw new error_1.FirebaseError(`The declarative security roles for codebase ${codebase} have changed, but you do not have access to see what has changed. Please ask an IAM administrator to perform the next deploy.`, { original: err });
+        }
+    }
+    return {
+        haveRoles,
+        haveRolesEtag,
+        existingManagedSA,
+        managedSA,
+        newEtag,
+    };
+}
 async function prepare(context, options, payload) {
     const projectId = (0, projectUtils_1.needProjectId)(options);
     const projectNumber = await (0, projectUtils_1.needProjectNumber)(options);
@@ -196,14 +284,15 @@ async function prepare(context, options, payload) {
     const haveBackends = (0, functionsDeployHelper_1.groupEndpointsByCodebase)(wantBackends, backend.allEndpoints(existingBackend));
     for (const [codebase, wantBackend] of Object.entries(wantBackends)) {
         const haveBackend = haveBackends[codebase] || backend.empty();
-        payload.functions[codebase] = { wantBackend, haveBackend };
+        const security = await discoverSecurityDetails(codebase, wantBackend, haveBackend, projectId);
+        payload.functions[codebase] = { wantBackend, haveBackend, ...security };
     }
     for (const [codebase, { wantBackend, haveBackend }] of Object.entries(payload.functions)) {
         inferDetailsFromExisting(wantBackend, haveBackend, codebaseUsesEnvs.includes(codebase));
         await (0, triggerRegionHelper_1.ensureTriggerRegions)(wantBackend);
         resolveCpuAndConcurrency(wantBackend);
         resolveDefaultTimeout(wantBackend);
-        validate.endpointsAreValid(wantBackend);
+        validate.endpointsAreValid(wantBackend, existingBackend);
         inferBlockingDetails(wantBackend);
     }
     const wantBackend = backend.merge(...Object.values(wantBackends));

package/lib/deploy/functions/prompts.js

@@ -5,6 +5,7 @@ exports.promptForFunctionDeletion = promptForFunctionDeletion;
 exports.promptForUnsafeMigration = promptForUnsafeMigration;
 exports.promptForMinInstances = promptForMinInstances;
 exports.promptForCleanupPolicyDays = promptForCleanupPolicyDays;
+exports.promptForSecurityChanges = promptForSecurityChanges;
 const clc = require("colorette");
 const functionsDeployHelper_1 = require("./functionsDeployHelper");
 const error_1 = require("../../error");
@@ -14,6 +15,7 @@ const backend = require("./backend");
 const pricing = require("./pricing");
 const utils = require("../../utils");
 const artifacts = require("../../functions/artifacts");
+const iam = require("../../gcp/iam");
 async function promptForFailurePolicies(options, want, have) {
     const retryEndpoints = backend.allEndpoints(want).filter((e) => {
         return backend.isEventTriggered(e) && e.eventTrigger.retry;
@@ -191,3 +193,63 @@ async function promptForCleanupPolicyDays(options, locations) {
         validate: (days) => !days || isNaN(days) || days < 0 ? "Please enter a non-negative number" : true,
     });
 }
+async function promptForSecurityChanges(plan, options) {
+    if (options.force) {
+        return;
+    }
+    for (const [codebase, codebasePlan] of Object.entries(plan)) {
+        if (codebasePlan.serviceAccountToDelete) {
+            if (options.nonInteractive) {
+                throw new error_1.FirebaseError(`Cannot opt out of declarative security and delete managed service account ${codebasePlan.serviceAccountToDelete} in non-interactive mode. Please deploy with --force to confirm.`, { exit: 1 });
+            }
+            const msg = `Deploying this code will opt out of declarative security for codebase ${codebase}. All functions which do not specify a custom service account will use a default service account on next deploy. As a cleanup, the managed service account ${codebasePlan.serviceAccountToDelete} will be deleted. Continue?`;
+            const confirmed = await (0, prompt_1.confirm)({ default: false, message: msg });
+            if (!confirmed) {
+                throw new error_1.FirebaseError("Deployment canceled by user.");
+            }
+        }
+        if (codebasePlan.serviceAccountToCreate) {
+            if (options.nonInteractive) {
+                throw new error_1.FirebaseError(`Cannot enable declarative security and create managed service account ${codebasePlan.serviceAccountToCreate} in non-interactive mode. Please deploy with --force to confirm.`, { exit: 1 });
+            }
+            const roleNames = await Promise.all((codebasePlan.rolesToAdd || []).map((r) => iam.getRoleName(r)));
+            let msg = "This codebase uses declarative security. ";
+            if (roleNames.length > 0) {
+                msg += `It will use the following role(s):\n${roleNames
+                    .map((r) => `* ${r}`)
+                    .join("\n")}\nContinue?`;
+            }
+            else {
+                msg += "It will not use any additional roles. Continue?";
+            }
+            const confirmed = await (0, prompt_1.confirm)({ default: false, message: msg });
+            if (!confirmed) {
+                throw new error_1.FirebaseError("Deployment canceled by user.");
+            }
+        }
+        else if ((codebasePlan.rolesToAdd && codebasePlan.rolesToAdd.length > 0) ||
+            (codebasePlan.rolesToRemove && codebasePlan.rolesToRemove.length > 0)) {
+            if (options.nonInteractive) {
+                throw new error_1.FirebaseError(`Cannot modify declarative security roles for codebase ${codebase} in non-interactive mode. Please deploy with --force to confirm.`, { exit: 1 });
+            }
+            let msg = `Deploying this code will modify the managed service account for codebase ${codebase}.\n`;
+            if (codebasePlan.rolesToAdd && codebasePlan.rolesToAdd.length > 0) {
+                const addedNames = await Promise.all(codebasePlan.rolesToAdd.map((r) => iam.getRoleName(r)));
+                msg += `All functions in this codebase will be granted the following new role(s):\n${addedNames
+                    .map((r) => `* ${r}`)
+                    .join("\n")}\n`;
+            }
+            if (codebasePlan.rolesToRemove && codebasePlan.rolesToRemove.length > 0) {
+                const removedNames = await Promise.all(codebasePlan.rolesToRemove.map((r) => iam.getRoleName(r)));
+                msg += `All functions in this codebase will lose access to the following role(s):\n${removedNames
+                    .map((r) => `* ${r}`)
+                    .join("\n")}\n`;
+            }
+            msg += "Continue?";
+            const confirmed = await (0, prompt_1.confirm)({ default: false, message: msg });
+            if (!confirmed) {
+                throw new error_1.FirebaseError("Deployment canceled by user.");
+            }
+        }
+    }
+}

package/lib/deploy/functions/release/fabricator.js

@@ -49,6 +49,8 @@ const eventarcPollerOptions = {
     maxBackoff: 10000,
 };
 const CLOUD_RUN_RESOURCE_EXHAUSTED_CODE = 8;
+const iam = require("../../../gcp/iam");
+const resourcemanager = require("../../../gcp/resourceManager");
 const rethrowAs = (endpoint, op) => (err) => {
     logger_1.logger.error(err.message);
     throw new reporter.DeploymentError(endpoint, op, err);
@@ -61,6 +63,70 @@ class Fabricator {
         this.sources = args.sources;
         this.appEngineLocation = args.appEngineLocation;
         this.projectNumber = args.projectNumber;
+        this.projectId = args.projectId;
+    }
+    async grantNewRoles(plan, codebase) {
+        if (plan.serviceAccountToCreate) {
+            utils.logLabeledBullet("functions", `Creating managed service account ${plan.serviceAccountToCreate}...`);
+            const saName = plan.serviceAccountToCreate.split("@")[0];
+            try {
+                await iam.createServiceAccount(this.projectId, saName, `Managed by Firebase CLI for codebase ${codebase}`, `Firebase Functions ${codebase}`);
+            }
+            catch (e) {
+                throw new error_1.FirebaseError("Cannot enable declarative security because you do not have permissions necessary to create the service account. Please ask an IAM administrator to perform the next deploy.", { original: e });
+            }
+        }
+        if (plan.rolesToAdd?.length) {
+            if (!plan.managedServiceAccount) {
+                throw new error_1.FirebaseError("Failed to grant IAM roles: managed service account is missing.", {
+                    exit: 1,
+                });
+            }
+            utils.logLabeledBullet("functions", `Granting IAM roles to ${plan.managedServiceAccount}...`);
+            try {
+                await resourcemanager.addServiceAccountRoles(this.projectId, plan.managedServiceAccount, plan.rolesToAdd, true);
+            }
+            catch (e) {
+                throw new error_1.FirebaseError("The declarative security roles for this codebase have changed, but you do not have access to see what has changed. Please ask an IAM administrator to perform the next deploy.", { original: e });
+            }
+        }
+        else if (plan.rolesToRemove?.length) {
+            const iamResult = await iam.testIamPermissions(this.projectId, [
+                "resourcemanager.projects.setIamPolicy",
+            ]);
+            if (!iamResult.passed) {
+                throw new error_1.FirebaseError("The declarative security roles for this codebase have changed, but you do not have access to see what has changed. Please ask an IAM administrator to perform the next deploy.");
+            }
+        }
+    }
+    async removeOldRoles(plan, codebase) {
+        if (plan.serviceAccountToDelete) {
+            utils.logLabeledBullet("functions", `Deleting managed service account ${plan.serviceAccountToDelete}...`);
+            try {
+                await iam.deleteServiceAccount(this.projectId, plan.serviceAccountToDelete);
+            }
+            catch (e) {
+                throw new error_1.FirebaseError("Failed to delete managed service account " +
+                    plan.serviceAccountToDelete +
+                    ". Please ask an IAM administrator to delete it manually.", { original: e });
+            }
+            return;
+        }
+        if (!plan.rolesToRemove?.length) {
+            return;
+        }
+        if (!plan.managedServiceAccount) {
+            throw new error_1.FirebaseError("Failed to revoke IAM roles: managed service account is missing.", {
+                exit: 1,
+            });
+        }
+        utils.logLabeledBullet("functions", `Revoking unneeded IAM roles from ${plan.managedServiceAccount} for codebase ${codebase}...`);
+        try {
+            await resourcemanager.removeServiceAccountRoles(this.projectId, plan.managedServiceAccount, plan.rolesToRemove);
+        }
+        catch (e) {
+            throw new error_1.FirebaseError("The declarative security roles for this codebase have changed, but you do not have access to see what has changed. Please ask an IAM administrator to perform the next deploy.", { original: e });
+        }
     }
     async applyPlan(plan) {
         const timer = new timer_1.Timer();
@@ -68,8 +134,14 @@ class Fabricator {
             totalTime: 0,
             results: [],
         };
-        const changesets = Object.values(plan);
-        const createAndUpdatePromises = changesets.map((changes) => {
+        for (const [codebase, codebasePlan] of Object.entries(plan)) {
+            await this.grantNewRoles(codebasePlan, codebase);
+        }
+        const allChangesets = [];
+        for (const codebasePlan of Object.values(plan)) {
+            allChangesets.push(...Object.values(codebasePlan.regionalChangesets));
+        }
+        const createAndUpdatePromises = allChangesets.map((changes) => {
             const scraperV1 = new sourceTokenScraper_1.SourceTokenScraper();
             const scraperV2 = new sourceTokenScraper_1.SourceTokenScraper();
             return this.applyUpserts(changes, scraperV1, scraperV2);
@@ -85,7 +157,7 @@ class Fabricator {
         const hasFailures = summary.results.some((r) => r.error);
         if (hasFailures) {
             utils.logLabeledWarning("functions", "Deploys failed. Skipping deletes.");
-            summary.results = changesets.reduce((accum, changes) => {
+            summary.results = allChangesets.reduce((accum, changes) => {
                 const currentAborts = changes.endpointsToDelete.map((endpoint) => ({
                     endpoint,
                     durationMs: 0,
@@ -96,7 +168,7 @@ class Fabricator {
             summary.totalTime = timer.stop();
             return summary;
         }
-        const deleteResultsArray = await Promise.allSettled(changesets.map((changes) => this.applyDeletes(changes)));
+        const deleteResultsArray = await Promise.allSettled(allChangesets.map((changes) => this.applyDeletes(changes)));
         const deleteResults = deleteResultsArray.reduce((acc, r) => {
             if (r.status === "fulfilled") {
                 return [...acc, ...r.value];
@@ -105,6 +177,9 @@ class Fabricator {
             return acc;
         }, []);
         summary.results.push(...deleteResults);
+        for (const [codebase, codebasePlan] of Object.entries(plan)) {
+            await this.removeOldRoles(codebasePlan, codebase);
+        }
         summary.totalTime = timer.stop();
         return summary;
     }

package/lib/deploy/functions/release/index.js

@@ -18,6 +18,8 @@ const error_1 = require("../../../error");
 const getProjectNumber_1 = require("../../../getProjectNumber");
 const extensions_1 = require("../../extensions");
 const artifacts = require("../../../functions/artifacts");
+const supported_1 = require("../runtimes/supported");
+const lifecycle_1 = require("./lifecycle");
 async function release(context, options, payload) {
     if (context.extensions && payload.extensions) {
         await (0, extensions_1.release)(context.extensions, options, payload.extensions);
@@ -31,38 +33,39 @@ async function release(context, options, payload) {
     if (!context.sources) {
         return;
     }
-    let plan = {};
-    for (const [codebase, { wantBackend, haveBackend }] of Object.entries(payload.functions)) {
-        plan = {
-            ...plan,
-            ...planner.createDeploymentPlan({
-                codebase,
-                wantBackend,
-                haveBackend,
-                filters: context.filters,
-            }),
-        };
+    const plan = {};
+    for (const [codebase, { wantBackend, haveBackend, haveRoles, existingManagedSA, managedSA },] of Object.entries(payload.functions)) {
+        plan[codebase] = await planner.createDeploymentPlan({
+            codebase,
+            wantBackend,
+            haveBackend,
+            projectId: context.projectId,
+            filters: context.filters,
+            haveRoles,
+            existingManagedSA,
+            managedSA,
+        });
     }
-    const fnsToDelete = Object.values(plan)
+    await prompts.promptForSecurityChanges(plan, options);
+    const allRegionalChanges = Object.values(plan)
+        .map((codebasePlan) => Object.values(codebasePlan.regionalChangesets))
+        .reduce(functional_1.reduceFlat, []);
+    const fnsToDelete = allRegionalChanges
         .map((regionalChanges) => regionalChanges.endpointsToDelete)
         .reduce(functional_1.reduceFlat, []);
     const shouldDelete = await prompts.promptForFunctionDeletion(fnsToDelete, options);
     if (!shouldDelete) {
-        for (const change of Object.values(plan)) {
-            change.endpointsToDelete = [];
+        for (const changes of allRegionalChanges) {
+            changes.endpointsToDelete = [];
         }
     }
-    const fnsToUpdate = Object.values(plan)
+    const fnsToUpdate = allRegionalChanges
         .map((regionalChanges) => regionalChanges.endpointsToUpdate)
         .reduce(functional_1.reduceFlat, []);
     const fnsToUpdateSafe = await prompts.promptForUnsafeMigration(fnsToUpdate, options);
-    for (const key of Object.keys(plan)) {
-        plan[key].endpointsToUpdate = [];
-    }
-    for (const eu of fnsToUpdateSafe) {
-        const e = eu.endpoint;
-        const key = `${e.codebase || ""}-${e.region}-${e.availableMemoryMb || "default"}`;
-        plan[key].endpointsToUpdate.push(eu);
+    const safeEndpoints = new Set(fnsToUpdateSafe.map((eu) => eu.endpoint));
+    for (const changes of allRegionalChanges) {
+        changes.endpointsToUpdate = changes.endpointsToUpdate.filter((eu) => safeEndpoints.has(eu.endpoint));
     }
     const throttlerOptions = {
         retries: 30,
@@ -82,15 +85,31 @@ async function release(context, options, payload) {
         sources: context.sources,
         appEngineLocation: (0, functionsConfig_1.getAppEngineLocation)(context.firebaseConfig),
         projectNumber: projectNumber,
+        projectId: context.projectId,
     });
     const summary = await fab.applyPlan(plan);
     await reporter.logAndTrackDeployStats(summary, context);
     reporter.printErrors(summary);
     const wantBackend = backend.merge(...Object.values(payload.functions).map((p) => p.wantBackend));
     printTriggerUrls(wantBackend, projectNumber);
-    await setupArtifactCleanupPolicies(options, options.projectId, Object.keys(wantBackend.endpoints));
+    if (backend.someEndpoint(wantBackend, (endpoint) => (0, supported_1.runtimeIsLanguage)(endpoint.runtime, "dart"))) {
+        utils.logLabeledBullet("functions", "Dart functions may not yet be visible in the Firebase Console. " +
+            `View them in the Cloud Console at https://console.cloud.google.com/run/services?project=${context.projectId}`);
+    }
     const allErrors = summary.results.filter((r) => r.error).map((r) => r.error);
+    if (allErrors.length === 0) {
+        for (const [codebase, { wantBackend: w, haveBackend: h }] of Object.entries(payload.functions)) {
+            await (0, lifecycle_1.executeLifecycleHooks)(w, h, plan, codebase);
+        }
+    }
+    await setupArtifactCleanupPolicies(options, options.projectId, Object.keys(wantBackend.endpoints));
     if (allErrors.length) {
+        for (const [codebase, { wantBackend: w, haveBackend: h }] of Object.entries(payload.functions)) {
+            const event = (0, lifecycle_1.determineDeploymentEvent)(h);
+            if (w.lifecycleHooks?.[event]) {
+                utils.logLabeledWarning("functions", `Lifecycle hook "${event}" for codebase "${codebase}" was configured but not executed because one or more function deployments failed.`);
+            }
+        }
         const opts = allErrors.length === 1 ? { original: allErrors[0] } : { children: allErrors };
         logger_1.logger.debug("Functions deploy failed.");
         for (const error of allErrors) {