firebase-tools 15.22.4 → 15.23.0

package/lib/apiv2.js

@@ -7,10 +7,8 @@ exports.getAccessToken = getAccessToken;
 exports.noKeepAliveAgent = noKeepAliveAgent;
 const url_1 = require("url");
 const stream_1 = require("stream");
-const proxy_agent_1 = require("proxy-agent");
+const undici_1 = require("undici");
 const retry = require("retry");
-const abort_controller_1 = require("abort-controller");
-const node_fetch_1 = require("node-fetch");
 const http = require("http");
 const https = require("https");
 const util_1 = require("util");
@@ -19,6 +17,7 @@ const error_1 = require("./error");
 const env_1 = require("./env");
 const logger_1 = require("./logger");
 const responseToError_1 = require("./responseToError");
+const streamUtils_1 = require("./streamUtils");
 const FormData = require("form-data");
 const pkg = require("../package.json");
 const CLI_VERSION = pkg.version;
@@ -36,7 +35,6 @@ const standardHeaders = () => {
 exports.standardHeaders = standardHeaders;
 const GOOG_QUOTA_USER_HEADER = "x-goog-quota-user";
 exports.GOOG_USER_PROJECT_HEADER = "x-goog-user-project";
-const GOOGLE_CLOUD_QUOTA_PROJECT = process.env.GOOGLE_CLOUD_QUOTA_PROJECT;
 exports.CLI_OAUTH_PROJECT_NUMBER = "563584335869";
 let accessToken = "";
 let refreshToken = "";
@@ -56,11 +54,15 @@ async function getAccessToken() {
     return data.access_token;
 }
 function proxyURIFromEnv() {
-    return (process.env.HTTPS_PROXY ||
+    const uri = process.env.HTTPS_PROXY ||
         process.env.https_proxy ||
         process.env.HTTP_PROXY ||
         process.env.http_proxy ||
-        undefined);
+        undefined;
+    if (uri === "undefined" || uri === "null") {
+        return undefined;
+    }
+    return uri;
 }
 const httpAgentNoKeepAlive = new http.Agent({ keepAlive: false });
 const httpsAgentNoKeepAlive = new https.Agent({ keepAlive: false });
@@ -147,7 +149,7 @@ class Client {
             throw new error_1.FirebaseError("apiv2 will not handle HTTP errors while streaming and you must set `resolveOnHTTPError` and check for res.status >= 400 on your own", { exit: 2 });
         }
         let internalReqOptions = Object.assign(reqOptions, {
-            headers: new node_fetch_1.Headers(reqOptions.headers),
+            headers: new Headers(reqOptions.headers),
         });
         internalReqOptions = this.addRequestHeaders(internalReqOptions);
         if (this.opts.auth) {
@@ -176,7 +178,7 @@ class Client {
     }
     addRequestHeaders(reqOptions) {
         if (!reqOptions.headers) {
-            reqOptions.headers = new node_fetch_1.Headers();
+            reqOptions.headers = new Headers();
         }
         for (const [h, v] of Object.entries((0, exports.standardHeaders)())) {
             if (!reqOptions.headers.has(h)) {
@@ -189,15 +191,15 @@ class Client {
             }
         }
         if (!reqOptions.ignoreQuotaProject &&
-            GOOGLE_CLOUD_QUOTA_PROJECT &&
-            GOOGLE_CLOUD_QUOTA_PROJECT !== "") {
-            reqOptions.headers.set(exports.GOOG_USER_PROJECT_HEADER, GOOGLE_CLOUD_QUOTA_PROJECT);
+            process.env.GOOGLE_CLOUD_QUOTA_PROJECT &&
+            process.env.GOOGLE_CLOUD_QUOTA_PROJECT !== "") {
+            reqOptions.headers.set(exports.GOOG_USER_PROJECT_HEADER, process.env.GOOGLE_CLOUD_QUOTA_PROJECT);
         }
         return reqOptions;
     }
     async addAuthHeader(reqOptions) {
         if (!reqOptions.headers) {
-            reqOptions.headers = new node_fetch_1.Headers();
+            reqOptions.headers = new Headers();
         }
         let token;
         if (isLocalInsecureRequest(this.opts.urlPrefix)) {
@@ -236,31 +238,21 @@ class Client {
             headers: options.headers,
             method: options.method,
             redirect: options.redirect,
-            compress: options.compress,
         };
-        if (proxyURIFromEnv()) {
-            fetchOptions.agent = new proxy_agent_1.ProxyAgent();
+        const proxyURI = proxyURIFromEnv();
+        if (proxyURI) {
+            fetchOptions.dispatcher = new undici_1.ProxyAgent({ uri: proxyURI });
         }
         if (options.signal) {
-            const signal = options.signal;
-            signal.reason = "";
-            signal.throwIfAborted = () => {
-                throw new error_1.FirebaseError("Aborted");
-            };
-            fetchOptions.signal = signal;
+            fetchOptions.signal = options.signal;
         }
         let reqTimeout;
         if (options.timeout) {
-            const controller = new abort_controller_1.default();
+            const controller = new AbortController();
             reqTimeout = setTimeout(() => {
                 controller.abort();
             }, options.timeout);
-            const signal = controller.signal;
-            signal.reason = "";
-            signal.throwIfAborted = () => {
-                throw new error_1.FirebaseError("Aborted");
-            };
-            fetchOptions.signal = signal;
+            fetchOptions.signal = controller.signal;
         }
         let bodyReplayable = true;
         if (typeof options.body === "string" || Buffer.isBuffer(options.body)) {
@@ -271,6 +263,7 @@ class Client {
         }
         else if (isStream(options.body)) {
             fetchOptions.body = options.body;
+            fetchOptions.duplex = "half";
             bodyReplayable = false;
         }
         else if (options.body !== undefined) {
@@ -302,10 +295,39 @@ class Client {
                     }
                     this.logRequest(options);
                     try {
-                        res = await (0, node_fetch_1.default)(fetchURL, fetchOptions);
+                        if (options.compress === false) {
+                            const undiciOptions = {
+                                method: fetchOptions.method,
+                                headers: {},
+                                decompress: false,
+                            };
+                            if (fetchOptions.dispatcher) {
+                                undiciOptions.dispatcher = fetchOptions.dispatcher;
+                            }
+                            if (fetchOptions.signal) {
+                                undiciOptions.signal = fetchOptions.signal;
+                            }
+                            if (fetchOptions.body) {
+                                undiciOptions.body = fetchOptions.body;
+                            }
+                            if (fetchOptions.headers) {
+                                for (const [key, value] of fetchOptions.headers.entries()) {
+                                    undiciOptions.headers[key] = value;
+                                }
+                            }
+                            const undiciRes = await (0, undici_1.request)(fetchURL, undiciOptions);
+                            res = new UndiciResponseCompat(undiciRes);
+                        }
+                        else {
+                            res = await fetch(fetchURL, fetchOptions);
+                        }
                     }
                     catch (thrown) {
-                        const err = thrown instanceof Error ? thrown : new Error(thrown);
+                        const err = thrown && typeof thrown === "object" && thrown.cause instanceof Error
+                            ? thrown.cause
+                            : thrown instanceof Error
+                                ? thrown
+                                : new Error(thrown);
                         logger_1.logger.debug(`*** [apiv2] error from fetch(${fetchURL}, ${JSON.stringify(fetchOptions)}): ${err}`);
                         const isAbortError = err.name.includes("AbortError");
                         if (isAbortError) {
@@ -339,7 +361,19 @@ class Client {
                         body = (await res.text());
                     }
                     else if (options.responseType === "stream") {
-                        body = res.body;
+                        if (res.body) {
+                            if (typeof res.body.getReader === "function") {
+                                body = stream_1.Readable.fromWeb(res.body);
+                            }
+                            else {
+                                body = res.body;
+                            }
+                        }
+                        else {
+                            const emptyStream = new stream_1.Readable();
+                            emptyStream.push(null);
+                            body = emptyStream;
+                        }
                     }
                     else {
                         throw new error_1.FirebaseError(`Unable to interpret response. Please set responseType.`, {
@@ -354,7 +388,7 @@ class Client {
                         isPrematureCloseError(err)) {
                         disabledKeepAlive = true;
                         fetchOptions.agent = noKeepAliveAgent;
-                        const closeHeaders = new node_fetch_1.Headers(fetchOptions.headers);
+                        const closeHeaders = new Headers(fetchOptions.headers);
                         closeHeaders.set("Connection", "close");
                         fetchOptions.headers = closeHeaders;
                         logger_1.logger.debug(`*** [apiv2] retrying ${fetchURL} without keep-alive after a premature close error`);
@@ -435,6 +469,31 @@ function isLocalInsecureRequest(urlPrefix) {
     const u = new url_1.URL(urlPrefix);
     return u.protocol === "http:";
 }
+class UndiciResponseCompat {
+    constructor(undiciRes) {
+        this.undiciRes = undiciRes;
+        this.status = undiciRes.statusCode;
+        this.ok = undiciRes.statusCode >= 200 && undiciRes.statusCode < 300;
+        this.headers = new Headers();
+        for (const [key, value] of Object.entries(undiciRes.headers)) {
+            if (Array.isArray(value)) {
+                for (const v of value) {
+                    this.headers.append(key, v);
+                }
+            }
+            else if (value !== undefined) {
+                this.headers.set(key, String(value));
+            }
+        }
+        this.body = undiciRes.body;
+    }
+    async text() {
+        if (!this.body) {
+            return "";
+        }
+        return (0, streamUtils_1.streamToString)(this.body);
+    }
+}
 function bodyToString(body) {
     if (isStream(body)) {
         return "[stream]";

package/lib/apphosting/backend.js

@@ -31,7 +31,6 @@ const ensureApiEnabled_1 = require("../ensureApiEnabled");
 const deploymentTool = require("../deploymentTool");
 const app_1 = require("./app");
 const ora = require("ora");
-const node_fetch_1 = require("node-fetch");
 const rollout_1 = require("./rollout");
 const fuzzy = require("fuzzy");
 const experiments_1 = require("../experiments");
@@ -45,7 +44,7 @@ const apphostingPollerOptions = {
 };
 async function tlsReady(url) {
     try {
-        await (0, node_fetch_1.default)(url);
+        await fetch(url);
         return true;
     }
     catch (err) {
@@ -213,8 +212,16 @@ async function promptNewBackendId(projectId, location) {
     while (true) {
         const backendId = await (0, prompt_1.input)({
             default: "my-web-app",
-            message: "Provide a name for your backend [1-30 characters]",
-            validate: (s) => s.length >= 1 && s.length <= 30,
+            message: "Provide a name for your backend [3-30 characters]",
+            validate: (s) => {
+                if (!/^[a-z](?:[a-z0-9-]*[a-z0-9])?$/.test(s)) {
+                    return "Must begin with a letter, can contain only lowercase, digits, hyphens, and cannot end with hyphen";
+                }
+                else if (s.length < 3 || s.length > 30) {
+                    return "Must be between 3 and 30 characters";
+                }
+                return true;
+            },
         });
         try {
             await apphosting.getBackend(projectId, location, backendId);

package/lib/commands/functions-delete.js

@@ -40,14 +40,15 @@ exports.command = new command_1.Command("functions:delete [filters...]")
     if (options.region) {
         existingBackend.endpoints = { [options.region]: existingBackend.endpoints[options.region] };
     }
-    const plan = planner.createDeploymentPlan({
+    const plan = await planner.createDeploymentPlan({
         wantBackend: backend.empty(),
         haveBackend: existingBackend,
         codebase: "",
+        projectId: context.projectId,
         filters: context.filters,
         deleteAll: true,
     });
-    const allEpToDelete = Object.values(plan)
+    const allEpToDelete = Object.values(plan.regionalChangesets)
         .map((changes) => changes.endpointsToDelete)
         .reduce(functional_1.reduceFlat, [])
         .sort(backend.compareFunctions);
@@ -80,8 +81,9 @@ exports.command = new command_1.Command("functions:delete [filters...]")
             executor: new executor.QueueExecutor({}),
             sources: {},
             projectNumber: options.projectNumber || (await (0, getProjectNumber_1.getProjectNumber)({ projectId: context.projectId })),
+            projectId: context.projectId,
         });
-        const summary = await fab.applyPlan(plan);
+        const summary = await fab.applyPlan({ default: plan });
         await reporter.logAndTrackDeployStats(summary);
         reporter.printErrors(summary);
     }

package/lib/commands/functions-lifecycle-list.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.command = void 0;
+exports.loadCodebaseBuild = loadCodebaseBuild;
+const command_1 = require("../command");
+const logger_1 = require("../logger");
+const prepare_1 = require("../deploy/functions/prepare");
+const projectConfig_1 = require("../functions/projectConfig");
+const adminSdkConfig_1 = require("../emulator/adminSdkConfig");
+const projectUtils_1 = require("../projectUtils");
+const error_1 = require("../error");
+const ensureApiEnabled = require("../ensureApiEnabled");
+const api_1 = require("../api");
+const prepareFunctionsUpload_1 = require("../deploy/functions/prepareFunctionsUpload");
+const self = require("./functions-lifecycle-list");
+async function loadCodebaseBuild(codebase, options) {
+    const projectId = (0, projectUtils_1.needProjectId)(options);
+    if (!options.config) {
+        throw new error_1.FirebaseError("Not in a Firebase project directory (firebase.json not found).");
+    }
+    const fnConfig = (0, projectConfig_1.normalizeAndValidate)(options.config.src.functions);
+    const hasCodebase = fnConfig.some((c) => c.codebase === codebase);
+    if (!hasCodebase) {
+        throw new error_1.FirebaseError(`Codebase "${codebase}" is not defined in firebase.json.`);
+    }
+    const firebaseConfig = await (0, adminSdkConfig_1.getProjectAdminSdkConfigOrCached)(projectId);
+    if (!firebaseConfig) {
+        throw new error_1.FirebaseError("Admin SDK config unexpectedly undefined - have you run firebase init?");
+    }
+    let runtimeConfig = { firebase: firebaseConfig };
+    if (fnConfig.some(projectConfig_1.shouldUseRuntimeConfig)) {
+        try {
+            const runtimeConfigApiEnabled = await ensureApiEnabled.check(projectId, (0, api_1.runtimeconfigOrigin)(), "runtimeconfig", true);
+            if (runtimeConfigApiEnabled) {
+                runtimeConfig = { ...runtimeConfig, ...(await (0, prepareFunctionsUpload_1.getFunctionsConfig)(projectId)) };
+            }
+        }
+        catch (err) {
+            logger_1.logger.debug("Could not check Runtime Config API status, assuming disabled:", err);
+        }
+    }
+    const wantBuilds = await (0, prepare_1.loadCodebases)(fnConfig, options, firebaseConfig, runtimeConfig, undefined);
+    const codebaseBuild = wantBuilds[codebase];
+    if (!codebaseBuild) {
+        throw new error_1.FirebaseError(`Failed to load build for codebase "${codebase}".`);
+    }
+    return codebaseBuild;
+}
+exports.command = new command_1.Command("functions:lifecycle:list <codebase>")
+    .description("list all the lifecycle hooks defined in a codebase")
+    .action(async (codebase, options) => {
+    const codebaseBuild = await self.loadCodebaseBuild(codebase, options);
+    const hooks = codebaseBuild.lifecycleHooks || {};
+    if (Object.keys(hooks).length === 0) {
+        logger_1.logger.info(`No lifecycle hooks configured for codebase "${codebase}".`);
+        return hooks;
+    }
+    for (const [event, hook] of Object.entries(hooks)) {
+        logger_1.logger.info(`\nEvent: ${event}`);
+        if ("task" in hook) {
+            logger_1.logger.info(`  Action: Task`);
+            logger_1.logger.info(`  Target Function: ${hook.task.function}`);
+            if (hook.task.body) {
+                logger_1.logger.info(`  Body: ${JSON.stringify(hook.task.body, null, 2).replace(/\n/g, "\n  ")}`);
+            }
+        }
+        else if ("call" in hook) {
+            logger_1.logger.info(`  Action: Call`);
+            logger_1.logger.info(`  Target Function: ${hook.call.function}`);
+            if (hook.call.params) {
+                logger_1.logger.info(`  Params: ${JSON.stringify(hook.call.params, null, 2).replace(/\n/g, "\n  ")}`);
+            }
+        }
+        else if ("http" in hook) {
+            logger_1.logger.info(`  Action: HTTP`);
+            if (hook.http.function) {
+                logger_1.logger.info(`  Target Function: ${hook.http.function}`);
+            }
+            if (hook.http.url) {
+                logger_1.logger.info(`  URL: ${hook.http.url}`);
+            }
+            if (hook.http.method) {
+                logger_1.logger.info(`  Method: ${hook.http.method}`);
+            }
+            if (hook.http.headers) {
+                logger_1.logger.info(`  Headers: ${JSON.stringify(hook.http.headers, null, 2).replace(/\n/g, "\n  ")}`);
+            }
+            if (hook.http.body) {
+                logger_1.logger.info(`  Body: ${JSON.stringify(hook.http.body, null, 2).replace(/\n/g, "\n  ")}`);
+            }
+        }
+    }
+    return hooks;
+});

package/lib/commands/functions-lifecycle-run.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.command = void 0;
+const command_1 = require("../command");
+const projectUtils_1 = require("../projectUtils");
+const requirePermissions_1 = require("../requirePermissions");
+const error_1 = require("../error");
+const functions_lifecycle_list_1 = require("./functions-lifecycle-list");
+const backend = require("../deploy/functions/backend");
+const lifecycle_1 = require("../deploy/functions/release/lifecycle");
+exports.command = new command_1.Command("functions:lifecycle:run <hookName> <codebase>")
+    .description("run a specific lifecycle hook in isolation")
+    .before(requirePermissions_1.requirePermissions, ["cloudfunctions.functions.list", "run.services.list"])
+    .action(async (hookName, codebase, options) => {
+    if (hookName !== "afterFirstDeploy" && hookName !== "afterRedeploy") {
+        throw new error_1.FirebaseError(`Invalid hook name "${hookName}". Supported hooks are "afterFirstDeploy" and "afterRedeploy".`);
+    }
+    const projectId = (0, projectUtils_1.needProjectId)(options);
+    const codebaseBuild = await (0, functions_lifecycle_list_1.loadCodebaseBuild)(codebase, options);
+    const hook = codebaseBuild.lifecycleHooks?.[hookName];
+    if (!hook) {
+        throw new error_1.FirebaseError(`No lifecycle hook "${hookName}" configured for codebase "${codebase}".`);
+    }
+    const context = {
+        projectId,
+    };
+    const existingBackend = await backend.existingBackend(context);
+    await (0, lifecycle_1.executeHook)(hookName, hook, existingBackend);
+});

package/lib/commands/index.js

@@ -151,6 +151,9 @@ function load(client) {
     client.functions.log = loadCommand("functions-log");
     client.functions.shell = loadCommand("functions-shell");
     client.functions.list = loadCommand("functions-list");
+    client.functions.lifecycle = {};
+    client.functions.lifecycle.list = loadCommand("functions-lifecycle-list");
+    client.functions.lifecycle.run = loadCommand("functions-lifecycle-run");
     if (experiments.isEnabled("deletegcfartifacts")) {
         client.functions.deletegcfartifacts = loadCommand("functions-deletegcfartifacts");
     }

package/lib/database/import.js

@@ -6,7 +6,6 @@ const Filter = require("stream-json/filters/Filter");
 const stream = require("stream");
 const StreamObject = require("stream-json/streamers/StreamObject");
 const apiv2_1 = require("../apiv2");
-const node_fetch_1 = require("node-fetch");
 const error_1 = require("../error");
 const utils_1 = require("../utils");
 class BatchChunks extends stream.Transform {
@@ -169,8 +168,9 @@ class DatabaseImporter {
             }
             catch (err) {
                 const isTimeoutErr = err instanceof error_1.FirebaseError &&
-                    err.original instanceof node_fetch_1.FetchError &&
-                    err.original.code === "ETIMEDOUT";
+                    (err.original?.name === "AbortError" ||
+                        err.original?.code === "ETIMEDOUT" ||
+                        err.original?.cause?.code === "ETIMEDOUT");
                 if (isTimeoutErr) {
                     await new Promise((res) => setTimeout(res, this.nonFatalRetryTimeout));
                     return await doRequest();

package/lib/dataconnect/webhook.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.port = exports.DEFAULT_PORT = exports.VSCODE_MESSAGE = void 0;
 exports.sendVSCodeMessage = sendVSCodeMessage;
-const node_fetch_1 = require("node-fetch");
 const logger_1 = require("../logger");
 var VSCODE_MESSAGE;
 (function (VSCODE_MESSAGE) {
@@ -15,7 +14,7 @@ exports.port = process.env.VSCODE_WEBHOOK_PORT || exports.DEFAULT_PORT;
 async function sendVSCodeMessage(body) {
     const jsonBody = JSON.stringify(body);
     try {
-        return await (0, node_fetch_1.default)(`http://localhost:${exports.port}/vscode/notify`, {
+        return await fetch(`http://localhost:${exports.port}/vscode/notify`, {
             method: "POST",
             headers: {
                 Accept: "application/json",

package/lib/deploy/functions/backend.js

@@ -165,6 +165,7 @@ function of(...endpoints) {
 function merge(...backends) {
     const merged = of(...(0, functional_1.flattenArray)(backends.map((b) => allEndpoints(b))));
     const apiToReasons = {};
+    const requiredRoles = new Set();
     for (const b of backends) {
         for (const { api, reason } of b.requiredAPIs) {
             const reasons = apiToReasons[api] || new Set();
@@ -174,6 +175,11 @@ function merge(...backends) {
             apiToReasons[api] = reasons;
         }
         merged.environmentVariables = { ...merged.environmentVariables, ...b.environmentVariables };
+        if (b.requiredRoles) {
+            for (const role of b.requiredRoles) {
+                requiredRoles.add(role);
+            }
+        }
         if (b.lifecycleHooks) {
             merged.lifecycleHooks = { ...(merged.lifecycleHooks || {}), ...b.lifecycleHooks };
         }
@@ -181,6 +187,9 @@ function merge(...backends) {
     for (const [api, reasons] of Object.entries(apiToReasons)) {
         merged.requiredAPIs.push({ api, reason: Array.from(reasons).join(" ") });
     }
+    if (requiredRoles.size > 0) {
+        merged.requiredRoles = Array.from(requiredRoles);
+    }
     return merged;
 }
 function isEmptyBackend(backend) {

package/lib/deploy/functions/build.js

@@ -263,6 +263,9 @@ function toBackend(build, paramValues) {
     }
     const bkend = backend.of(...bkEndpoints);
     bkend.requiredAPIs = build.requiredAPIs;
+    if (build.requiredRoles) {
+        bkend.requiredRoles = build.requiredRoles;
+    }
     if (build.lifecycleHooks) {
         bkend.lifecycleHooks = build.lifecycleHooks;
     }

package/lib/deploy/functions/prepare.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EVENTARC_SOURCE_ENV = void 0;
+exports.discoverSecurityDetails = discoverSecurityDetails;
 exports.prepare = prepare;
 exports.resolveDefaultRegionsForBuild = resolveDefaultRegionsForBuild;
 exports.inferDetailsFromExisting = inferDetailsFromExisting;
@@ -43,7 +44,94 @@ const backend_1 = require("./backend");
 const functional_1 = require("../../functional");
 const prepare_1 = require("../extensions/prepare");
 const prompt = require("../../prompt");
+const iam = require("../../gcp/iam");
+const resourcemanager = require("../../gcp/resourceManager");
 exports.EVENTARC_SOURCE_ENV = "EVENTARC_CLOUD_EVENT_SOURCE";
+async function discoverSecurityDetails(codebase, want, have, projectId) {
+    const requiredRoles = want.requiredRoles;
+    const firstHave = backend.allEndpoints(have)[0];
+    let existingManagedSA;
+    let haveRolesEtag;
+    if (firstHave) {
+        haveRolesEtag = firstHave.labels?.["firebase-declarative-security-etag"];
+        existingManagedSA = firstHave.serviceAccount?.startsWith("firebase-fn-")
+            ? firstHave.serviceAccount
+            : undefined;
+    }
+    if (!requiredRoles && (!existingManagedSA || !haveRolesEtag)) {
+        return {};
+    }
+    if (requiredRoles &&
+        backend.someEndpoint(want, (e) => typeof e.serviceAccount === "string" &&
+            e.serviceAccount !== "default" &&
+            !e.serviceAccount.startsWith("firebase-fn-"))) {
+        throw new error_1.FirebaseError(`Cannot use explicit custom service accounts on functions while using declarative security in codebase ${codebase}.`);
+    }
+    if (!requiredRoles && existingManagedSA && haveRolesEtag) {
+        for (const endpoint of backend.allEndpoints(want)) {
+            if (!endpoint.serviceAccount || endpoint.serviceAccount === existingManagedSA) {
+                endpoint.serviceAccount = "default";
+            }
+            if (endpoint.labels) {
+                delete endpoint.labels["firebase-declarative-security-etag"];
+            }
+        }
+        return {
+            haveRolesEtag,
+            existingManagedSA,
+        };
+    }
+    let managedSA = existingManagedSA;
+    if (!managedSA) {
+        const saToCreate = await iam.generateManagedServiceAccountName(projectId, "firebase-fn");
+        managedSA = `${saToCreate}@${projectId}.iam.gserviceaccount.com`;
+    }
+    const existingSalt = haveRolesEtag ? haveRolesEtag.split("-")[0] : undefined;
+    const newEtag = iam.computeRolesEtag(requiredRoles, existingSalt);
+    for (const endpoint of backend.allEndpoints(want)) {
+        endpoint.serviceAccount = managedSA;
+        endpoint.labels = endpoint.labels || {};
+        endpoint.labels["firebase-declarative-security-etag"] = newEtag;
+    }
+    if (haveRolesEtag && haveRolesEtag === newEtag) {
+        return {
+            haveRoles: requiredRoles,
+            haveRolesEtag,
+            existingManagedSA,
+            managedSA,
+            newEtag,
+        };
+    }
+    const permissionsToTest = ["resourcemanager.projects.setIamPolicy"];
+    if (!existingManagedSA) {
+        permissionsToTest.push("iam.serviceAccounts.create");
+    }
+    const iamResult = await iam.testIamPermissions(projectId, permissionsToTest);
+    if (!iamResult.passed) {
+        if (!existingManagedSA) {
+            throw new error_1.FirebaseError(`Cannot enable declarative security because you do not have permissions necessary to create the service account. Please ask an IAM administrator to perform the next deploy.`);
+        }
+        else {
+            throw new error_1.FirebaseError(`You do not have access to make the policy changes required in codebase ${codebase} deploy. Please ask an IAM administrator to perform the next deploy.`);
+        }
+    }
+    let haveRoles = [];
+    if (existingManagedSA) {
+        try {
+            haveRoles = await resourcemanager.getServiceAccountRoles(projectId, managedSA);
+        }
+        catch (err) {
+            throw new error_1.FirebaseError(`The declarative security roles for codebase ${codebase} have changed, but you do not have access to see what has changed. Please ask an IAM administrator to perform the next deploy.`, { original: err });
+        }
+    }
+    return {
+        haveRoles,
+        haveRolesEtag,
+        existingManagedSA,
+        managedSA,
+        newEtag,
+    };
+}
 async function prepare(context, options, payload) {
     const projectId = (0, projectUtils_1.needProjectId)(options);
     const projectNumber = await (0, projectUtils_1.needProjectNumber)(options);
@@ -196,7 +284,8 @@ async function prepare(context, options, payload) {
     const haveBackends = (0, functionsDeployHelper_1.groupEndpointsByCodebase)(wantBackends, backend.allEndpoints(existingBackend));
     for (const [codebase, wantBackend] of Object.entries(wantBackends)) {
         const haveBackend = haveBackends[codebase] || backend.empty();
-        payload.functions[codebase] = { wantBackend, haveBackend };
+        const security = await discoverSecurityDetails(codebase, wantBackend, haveBackend, projectId);
+        payload.functions[codebase] = { wantBackend, haveBackend, ...security };
     }
     for (const [codebase, { wantBackend, haveBackend }] of Object.entries(payload.functions)) {
         inferDetailsFromExisting(wantBackend, haveBackend, codebaseUsesEnvs.includes(codebase));