firebase-tools 15.22.4 → 15.23.0

package/lib/deploy/functions/prompts.js

@@ -5,6 +5,7 @@ exports.promptForFunctionDeletion = promptForFunctionDeletion;
 exports.promptForUnsafeMigration = promptForUnsafeMigration;
 exports.promptForMinInstances = promptForMinInstances;
 exports.promptForCleanupPolicyDays = promptForCleanupPolicyDays;
+exports.promptForSecurityChanges = promptForSecurityChanges;
 const clc = require("colorette");
 const functionsDeployHelper_1 = require("./functionsDeployHelper");
 const error_1 = require("../../error");
@@ -14,6 +15,7 @@ const backend = require("./backend");
 const pricing = require("./pricing");
 const utils = require("../../utils");
 const artifacts = require("../../functions/artifacts");
+const iam = require("../../gcp/iam");
 async function promptForFailurePolicies(options, want, have) {
     const retryEndpoints = backend.allEndpoints(want).filter((e) => {
         return backend.isEventTriggered(e) && e.eventTrigger.retry;
@@ -191,3 +193,63 @@ async function promptForCleanupPolicyDays(options, locations) {
         validate: (days) => !days || isNaN(days) || days < 0 ? "Please enter a non-negative number" : true,
     });
 }
+async function promptForSecurityChanges(plan, options) {
+    if (options.force) {
+        return;
+    }
+    for (const [codebase, codebasePlan] of Object.entries(plan)) {
+        if (codebasePlan.serviceAccountToDelete) {
+            if (options.nonInteractive) {
+                throw new error_1.FirebaseError(`Cannot opt out of declarative security and delete managed service account ${codebasePlan.serviceAccountToDelete} in non-interactive mode. Please deploy with --force to confirm.`, { exit: 1 });
+            }
+            const msg = `Deploying this code will opt out of declarative security for codebase ${codebase}. All functions which do not specify a custom service account will use a default service account on next deploy. As a cleanup, the managed service account ${codebasePlan.serviceAccountToDelete} will be deleted. Continue?`;
+            const confirmed = await (0, prompt_1.confirm)({ default: false, message: msg });
+            if (!confirmed) {
+                throw new error_1.FirebaseError("Deployment canceled by user.");
+            }
+        }
+        if (codebasePlan.serviceAccountToCreate) {
+            if (options.nonInteractive) {
+                throw new error_1.FirebaseError(`Cannot enable declarative security and create managed service account ${codebasePlan.serviceAccountToCreate} in non-interactive mode. Please deploy with --force to confirm.`, { exit: 1 });
+            }
+            const roleNames = await Promise.all((codebasePlan.rolesToAdd || []).map((r) => iam.getRoleName(r)));
+            let msg = "This codebase uses declarative security. ";
+            if (roleNames.length > 0) {
+                msg += `It will use the following role(s):\n${roleNames
+                    .map((r) => `* ${r}`)
+                    .join("\n")}\nContinue?`;
+            }
+            else {
+                msg += "It will not use any additional roles. Continue?";
+            }
+            const confirmed = await (0, prompt_1.confirm)({ default: false, message: msg });
+            if (!confirmed) {
+                throw new error_1.FirebaseError("Deployment canceled by user.");
+            }
+        }
+        else if ((codebasePlan.rolesToAdd && codebasePlan.rolesToAdd.length > 0) ||
+            (codebasePlan.rolesToRemove && codebasePlan.rolesToRemove.length > 0)) {
+            if (options.nonInteractive) {
+                throw new error_1.FirebaseError(`Cannot modify declarative security roles for codebase ${codebase} in non-interactive mode. Please deploy with --force to confirm.`, { exit: 1 });
+            }
+            let msg = `Deploying this code will modify the managed service account for codebase ${codebase}.\n`;
+            if (codebasePlan.rolesToAdd && codebasePlan.rolesToAdd.length > 0) {
+                const addedNames = await Promise.all(codebasePlan.rolesToAdd.map((r) => iam.getRoleName(r)));
+                msg += `All functions in this codebase will be granted the following new role(s):\n${addedNames
+                    .map((r) => `* ${r}`)
+                    .join("\n")}\n`;
+            }
+            if (codebasePlan.rolesToRemove && codebasePlan.rolesToRemove.length > 0) {
+                const removedNames = await Promise.all(codebasePlan.rolesToRemove.map((r) => iam.getRoleName(r)));
+                msg += `All functions in this codebase will lose access to the following role(s):\n${removedNames
+                    .map((r) => `* ${r}`)
+                    .join("\n")}\n`;
+            }
+            msg += "Continue?";
+            const confirmed = await (0, prompt_1.confirm)({ default: false, message: msg });
+            if (!confirmed) {
+                throw new error_1.FirebaseError("Deployment canceled by user.");
+            }
+        }
+    }
+}

package/lib/deploy/functions/release/fabricator.js

@@ -49,6 +49,8 @@ const eventarcPollerOptions = {
     maxBackoff: 10000,
 };
 const CLOUD_RUN_RESOURCE_EXHAUSTED_CODE = 8;
+const iam = require("../../../gcp/iam");
+const resourcemanager = require("../../../gcp/resourceManager");
 const rethrowAs = (endpoint, op) => (err) => {
     logger_1.logger.error(err.message);
     throw new reporter.DeploymentError(endpoint, op, err);
@@ -61,6 +63,70 @@ class Fabricator {
         this.sources = args.sources;
         this.appEngineLocation = args.appEngineLocation;
         this.projectNumber = args.projectNumber;
+        this.projectId = args.projectId;
+    }
+    async grantNewRoles(plan, codebase) {
+        if (plan.serviceAccountToCreate) {
+            utils.logLabeledBullet("functions", `Creating managed service account ${plan.serviceAccountToCreate}...`);
+            const saName = plan.serviceAccountToCreate.split("@")[0];
+            try {
+                await iam.createServiceAccount(this.projectId, saName, `Managed by Firebase CLI for codebase ${codebase}`, `Firebase Functions ${codebase}`);
+            }
+            catch (e) {
+                throw new error_1.FirebaseError("Cannot enable declarative security because you do not have permissions necessary to create the service account. Please ask an IAM administrator to perform the next deploy.", { original: e });
+            }
+        }
+        if (plan.rolesToAdd?.length) {
+            if (!plan.managedServiceAccount) {
+                throw new error_1.FirebaseError("Failed to grant IAM roles: managed service account is missing.", {
+                    exit: 1,
+                });
+            }
+            utils.logLabeledBullet("functions", `Granting IAM roles to ${plan.managedServiceAccount}...`);
+            try {
+                await resourcemanager.addServiceAccountRoles(this.projectId, plan.managedServiceAccount, plan.rolesToAdd, true);
+            }
+            catch (e) {
+                throw new error_1.FirebaseError("The declarative security roles for this codebase have changed, but you do not have access to see what has changed. Please ask an IAM administrator to perform the next deploy.", { original: e });
+            }
+        }
+        else if (plan.rolesToRemove?.length) {
+            const iamResult = await iam.testIamPermissions(this.projectId, [
+                "resourcemanager.projects.setIamPolicy",
+            ]);
+            if (!iamResult.passed) {
+                throw new error_1.FirebaseError("The declarative security roles for this codebase have changed, but you do not have access to see what has changed. Please ask an IAM administrator to perform the next deploy.");
+            }
+        }
+    }
+    async removeOldRoles(plan, codebase) {
+        if (plan.serviceAccountToDelete) {
+            utils.logLabeledBullet("functions", `Deleting managed service account ${plan.serviceAccountToDelete}...`);
+            try {
+                await iam.deleteServiceAccount(this.projectId, plan.serviceAccountToDelete);
+            }
+            catch (e) {
+                throw new error_1.FirebaseError("Failed to delete managed service account " +
+                    plan.serviceAccountToDelete +
+                    ". Please ask an IAM administrator to delete it manually.", { original: e });
+            }
+            return;
+        }
+        if (!plan.rolesToRemove?.length) {
+            return;
+        }
+        if (!plan.managedServiceAccount) {
+            throw new error_1.FirebaseError("Failed to revoke IAM roles: managed service account is missing.", {
+                exit: 1,
+            });
+        }
+        utils.logLabeledBullet("functions", `Revoking unneeded IAM roles from ${plan.managedServiceAccount} for codebase ${codebase}...`);
+        try {
+            await resourcemanager.removeServiceAccountRoles(this.projectId, plan.managedServiceAccount, plan.rolesToRemove);
+        }
+        catch (e) {
+            throw new error_1.FirebaseError("The declarative security roles for this codebase have changed, but you do not have access to see what has changed. Please ask an IAM administrator to perform the next deploy.", { original: e });
+        }
     }
     async applyPlan(plan) {
         const timer = new timer_1.Timer();
@@ -68,8 +134,14 @@ class Fabricator {
             totalTime: 0,
             results: [],
         };
-        const changesets = Object.values(plan);
-        const createAndUpdatePromises = changesets.map((changes) => {
+        for (const [codebase, codebasePlan] of Object.entries(plan)) {
+            await this.grantNewRoles(codebasePlan, codebase);
+        }
+        const allChangesets = [];
+        for (const codebasePlan of Object.values(plan)) {
+            allChangesets.push(...Object.values(codebasePlan.regionalChangesets));
+        }
+        const createAndUpdatePromises = allChangesets.map((changes) => {
             const scraperV1 = new sourceTokenScraper_1.SourceTokenScraper();
             const scraperV2 = new sourceTokenScraper_1.SourceTokenScraper();
             return this.applyUpserts(changes, scraperV1, scraperV2);
@@ -85,7 +157,7 @@ class Fabricator {
         const hasFailures = summary.results.some((r) => r.error);
         if (hasFailures) {
             utils.logLabeledWarning("functions", "Deploys failed. Skipping deletes.");
-            summary.results = changesets.reduce((accum, changes) => {
+            summary.results = allChangesets.reduce((accum, changes) => {
                 const currentAborts = changes.endpointsToDelete.map((endpoint) => ({
                     endpoint,
                     durationMs: 0,
@@ -96,7 +168,7 @@ class Fabricator {
             summary.totalTime = timer.stop();
             return summary;
         }
-        const deleteResultsArray = await Promise.allSettled(changesets.map((changes) => this.applyDeletes(changes)));
+        const deleteResultsArray = await Promise.allSettled(allChangesets.map((changes) => this.applyDeletes(changes)));
         const deleteResults = deleteResultsArray.reduce((acc, r) => {
             if (r.status === "fulfilled") {
                 return [...acc, ...r.value];
@@ -105,6 +177,9 @@ class Fabricator {
             return acc;
         }, []);
         summary.results.push(...deleteResults);
+        for (const [codebase, codebasePlan] of Object.entries(plan)) {
+            await this.removeOldRoles(codebasePlan, codebase);
+        }
         summary.totalTime = timer.stop();
         return summary;
     }

package/lib/deploy/functions/release/index.js

@@ -18,6 +18,7 @@ const error_1 = require("../../../error");
 const getProjectNumber_1 = require("../../../getProjectNumber");
 const extensions_1 = require("../../extensions");
 const artifacts = require("../../../functions/artifacts");
+const supported_1 = require("../runtimes/supported");
 const lifecycle_1 = require("./lifecycle");
 async function release(context, options, payload) {
     if (context.extensions && payload.extensions) {
@@ -32,38 +33,39 @@ async function release(context, options, payload) {
     if (!context.sources) {
         return;
     }
-    let plan = {};
-    for (const [codebase, { wantBackend, haveBackend }] of Object.entries(payload.functions)) {
-        plan = {
-            ...plan,
-            ...planner.createDeploymentPlan({
-                codebase,
-                wantBackend,
-                haveBackend,
-                filters: context.filters,
-            }),
-        };
+    const plan = {};
+    for (const [codebase, { wantBackend, haveBackend, haveRoles, existingManagedSA, managedSA },] of Object.entries(payload.functions)) {
+        plan[codebase] = await planner.createDeploymentPlan({
+            codebase,
+            wantBackend,
+            haveBackend,
+            projectId: context.projectId,
+            filters: context.filters,
+            haveRoles,
+            existingManagedSA,
+            managedSA,
+        });
     }
-    const fnsToDelete = Object.values(plan)
+    await prompts.promptForSecurityChanges(plan, options);
+    const allRegionalChanges = Object.values(plan)
+        .map((codebasePlan) => Object.values(codebasePlan.regionalChangesets))
+        .reduce(functional_1.reduceFlat, []);
+    const fnsToDelete = allRegionalChanges
         .map((regionalChanges) => regionalChanges.endpointsToDelete)
         .reduce(functional_1.reduceFlat, []);
     const shouldDelete = await prompts.promptForFunctionDeletion(fnsToDelete, options);
     if (!shouldDelete) {
-        for (const change of Object.values(plan)) {
-            change.endpointsToDelete = [];
+        for (const changes of allRegionalChanges) {
+            changes.endpointsToDelete = [];
         }
     }
-    const fnsToUpdate = Object.values(plan)
+    const fnsToUpdate = allRegionalChanges
         .map((regionalChanges) => regionalChanges.endpointsToUpdate)
         .reduce(functional_1.reduceFlat, []);
     const fnsToUpdateSafe = await prompts.promptForUnsafeMigration(fnsToUpdate, options);
-    for (const key of Object.keys(plan)) {
-        plan[key].endpointsToUpdate = [];
-    }
-    for (const eu of fnsToUpdateSafe) {
-        const e = eu.endpoint;
-        const key = `${e.codebase || ""}-${e.region}-${e.availableMemoryMb || "default"}`;
-        plan[key].endpointsToUpdate.push(eu);
+    const safeEndpoints = new Set(fnsToUpdateSafe.map((eu) => eu.endpoint));
+    for (const changes of allRegionalChanges) {
+        changes.endpointsToUpdate = changes.endpointsToUpdate.filter((eu) => safeEndpoints.has(eu.endpoint));
     }
     const throttlerOptions = {
         retries: 30,
@@ -83,18 +85,31 @@ async function release(context, options, payload) {
         sources: context.sources,
         appEngineLocation: (0, functionsConfig_1.getAppEngineLocation)(context.firebaseConfig),
         projectNumber: projectNumber,
+        projectId: context.projectId,
     });
     const summary = await fab.applyPlan(plan);
     await reporter.logAndTrackDeployStats(summary, context);
     reporter.printErrors(summary);
     const wantBackend = backend.merge(...Object.values(payload.functions).map((p) => p.wantBackend));
     printTriggerUrls(wantBackend, projectNumber);
-    for (const [codebase, { wantBackend: w, haveBackend: h }] of Object.entries(payload.functions)) {
-        await (0, lifecycle_1.executeLifecycleHooks)(w, h, plan, codebase);
+    if (backend.someEndpoint(wantBackend, (endpoint) => (0, supported_1.runtimeIsLanguage)(endpoint.runtime, "dart"))) {
+        utils.logLabeledBullet("functions", "Dart functions may not yet be visible in the Firebase Console. " +
+            `View them in the Cloud Console at https://console.cloud.google.com/run/services?project=${context.projectId}`);
     }
-    await setupArtifactCleanupPolicies(options, options.projectId, Object.keys(wantBackend.endpoints));
     const allErrors = summary.results.filter((r) => r.error).map((r) => r.error);
+    if (allErrors.length === 0) {
+        for (const [codebase, { wantBackend: w, haveBackend: h }] of Object.entries(payload.functions)) {
+            await (0, lifecycle_1.executeLifecycleHooks)(w, h, plan, codebase);
+        }
+    }
+    await setupArtifactCleanupPolicies(options, options.projectId, Object.keys(wantBackend.endpoints));
     if (allErrors.length) {
+        for (const [codebase, { wantBackend: w, haveBackend: h }] of Object.entries(payload.functions)) {
+            const event = (0, lifecycle_1.determineDeploymentEvent)(h);
+            if (w.lifecycleHooks?.[event]) {
+                utils.logLabeledWarning("functions", `Lifecycle hook "${event}" for codebase "${codebase}" was configured but not executed because one or more function deployments failed.`);
+            }
+        }
         const opts = allErrors.length === 1 ? { original: allErrors[0] } : { children: allErrors };
         logger_1.logger.debug("Functions deploy failed.");
         for (const error of allErrors) {

package/lib/deploy/functions/release/lifecycle.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.determineDeploymentDelta = determineDeploymentDelta;
+exports.determineDeploymentEvent = determineDeploymentEvent;
 exports.executeLifecycleHooks = executeLifecycleHooks;
+exports.executeHook = executeHook;
 const backend = require("../backend");
 const error_1 = require("../../../error");
 const logger_1 = require("../../../logger");
@@ -10,58 +11,44 @@ const cloudtasks = require("../../../gcp/cloudtasks");
 const computeEngine = require("../../../gcp/computeEngine");
 const projects_1 = require("../../../management/projects");
 const functional_1 = require("../../../functional");
-function determineDeploymentDelta(haveBackend) {
+function determineDeploymentEvent(haveBackend) {
     const hasExistingEndpoints = backend.someEndpoint(haveBackend, () => true);
     if (!hasExistingEndpoints) {
-        return "afterInstall";
+        return "afterFirstDeploy";
     }
-    return "afterUpdate";
+    return "afterRedeploy";
 }
 async function executeLifecycleHooks(wantBackend, haveBackend, plan, codebase) {
-    const delta = determineDeploymentDelta(haveBackend);
+    const event = determineDeploymentEvent(haveBackend);
     const hooks = wantBackend.lifecycleHooks || {};
-    const hook = hooks[delta];
+    const hook = hooks[event];
     if (!hook) {
-        logger_1.logger.debug(`No lifecycle hook configured for event: ${delta}`);
+        logger_1.logger.debug(`No lifecycle hook configured for event: ${event}`);
         return false;
     }
-    if (delta === "afterUpdate" && plan) {
-        const relevantChangesets = Object.entries(plan)
-            .filter(([key]) => {
-            if (!codebase)
-                return true;
-            if (key.startsWith(`${codebase}-`))
-                return true;
-            if (codebase === "default" && key.startsWith("-"))
-                return true;
-            return false;
-        })
-            .map(([, c]) => c);
-        const hasResourceModifications = relevantChangesets.some((changeset) => changeset.endpointsToCreate.length > 0 ||
+    if (event === "afterRedeploy" && plan) {
+        const codebasePlans = codebase ? [plan[codebase]].filter(Boolean) : Object.values(plan);
+        const hasResourceModifications = codebasePlans.some((codebasePlan) => Object.values(codebasePlan.regionalChangesets).some((changeset) => changeset.endpointsToCreate.length > 0 ||
             changeset.endpointsToUpdate.length > 0 ||
-            changeset.endpointsToDelete.length > 0);
+            changeset.endpointsToDelete.length > 0));
         if (!hasResourceModifications) {
-            (0, utils_1.logLabeledBullet)("functions", "No resources modified in codebase. Skipping afterUpdate lifecycle hook.");
+            (0, utils_1.logLabeledBullet)("functions", `No resources modified for codebase: ${codebase ?? "default"}. Skipping afterRedeploy lifecycle hook.`);
             return false;
         }
     }
-    if ("task" in hook) {
-        (0, utils_1.logLabeledBullet)("functions", `Executing ${delta} lifecycle hook targeting: ${hook.task.function}...`);
-        await executeTaskQueueHook(hook.task, wantBackend);
+    try {
+        await executeHook(event, hook, wantBackend);
         return true;
     }
-    else if ("call" in hook) {
-        throw new error_1.FirebaseError(`Lifecycle hook action type "call" is not supported.`);
-    }
-    else if ("http" in hook) {
-        throw new error_1.FirebaseError(`Lifecycle hook action type "http" is not supported.`);
-    }
-    else {
-        (0, functional_1.assertExhaustive)(hook);
+    catch (err) {
+        const errorMsg = err instanceof Error ? err.message : String(err);
+        (0, utils_1.logLabeledWarning)("functions", `Failed to execute ${event} lifecycle hook: ${errorMsg}`);
+        (0, utils_1.logLabeledBullet)("functions", `You can retry the lifecycle hook in isolation by running: firebase functions:lifecycle:run ${event} ${codebase ?? "default"}`);
+        return false;
     }
 }
 async function executeTaskQueueHook(taskHook, wantBackend) {
-    const targetEndpoint = findTargetEndpoint(wantBackend, taskHook.function);
+    const targetEndpoint = backend.findEndpoint(wantBackend, (ep) => ep.id === taskHook.function);
     if (!targetEndpoint) {
         throw new error_1.FirebaseError(`Target endpoint "${taskHook.function}" not found in backend for lifecycle hook.`);
     }
@@ -94,23 +81,9 @@ async function executeTaskQueueHook(taskHook, wantBackend) {
     if (body) {
         task.httpRequest.body = body;
     }
-    try {
-        await cloudtasks.enqueueTask(queueName, task);
-        (0, utils_1.logLabeledSuccess)("functions", `Successfully queued task for lifecycle hook ${taskHook.function} in queue ${queueName}.`);
-        (0, utils_1.logLabeledBullet)("functions", `View logs for ${taskHook.function} at: ${getCloudConsoleLogUrl(targetEndpoint)}`);
-    }
-    catch (err) {
-        const errorMsg = err instanceof Error ? err.message : String(err);
-        (0, utils_1.logLabeledWarning)("functions", `Failed to enqueue task for lifecycle hook ${taskHook.function}: ${errorMsg}`);
-    }
-}
-function findTargetEndpoint(backendSpec, targetId) {
-    for (const endpoint of backend.allEndpoints(backendSpec)) {
-        if (endpoint.id === targetId) {
-            return endpoint;
-        }
-    }
-    return undefined;
+    await cloudtasks.enqueueTask(queueName, task);
+    (0, utils_1.logLabeledSuccess)("functions", `Successfully queued task for lifecycle hook ${taskHook.function} in queue ${queueName}.`);
+    return targetEndpoint;
 }
 function getCloudConsoleLogUrl(endpoint) {
     const { project, region, id } = endpoint;
@@ -118,3 +91,23 @@ function getCloudConsoleLogUrl(endpoint) {
     const query = `resource.type="cloud_run_revision"\nresource.labels.service_name="${serviceName}"\nresource.labels.location="${region}"`;
     return `https://console.cloud.google.com/logs/query;query=${encodeURIComponent(query)};project=${project}`;
 }
+async function executeHook(event, hook, backendSpec) {
+    let executedEndpoint;
+    if ("task" in hook) {
+        (0, utils_1.logLabeledBullet)("functions", `Executing ${event} lifecycle hook targeting: ${hook.task.function}...`);
+        executedEndpoint = await executeTaskQueueHook(hook.task, backendSpec);
+    }
+    else if ("call" in hook) {
+        throw new error_1.FirebaseError(`Lifecycle hook action type "call" is not supported.`);
+    }
+    else if ("http" in hook) {
+        throw new error_1.FirebaseError(`Lifecycle hook action type "http" is not supported.`);
+    }
+    else {
+        (0, functional_1.assertExhaustive)(hook);
+    }
+    if (executedEndpoint) {
+        (0, utils_1.logLabeledBullet)("functions", `View logs for ${event} at: ${getCloudConsoleLogUrl(executedEndpoint)}`);
+    }
+    return executedEndpoint;
+}

package/lib/deploy/functions/release/planner.js

@@ -75,9 +75,25 @@ function calculateUpdate(want, have) {
     }
     return update;
 }
-function createDeploymentPlan(args) {
-    let { wantBackend, haveBackend, codebase, filters, deleteAll } = args;
-    let deployment = {};
+async function createDeploymentPlan(args) {
+    let { wantBackend, haveBackend, codebase, filters, deleteAll, haveRoles, existingManagedSA, managedSA, } = args;
+    const requiredRoles = wantBackend.requiredRoles;
+    const roles = haveRoles || [];
+    let rolesToAdd;
+    let rolesToRemove;
+    let serviceAccountToCreate;
+    let serviceAccountToDelete;
+    const isFiltered = !!(filters && filters.length > 0 && !deleteAll);
+    if (requiredRoles) {
+        rolesToAdd = requiredRoles.filter((r) => !roles.includes(r));
+        rolesToRemove = roles.filter((r) => !requiredRoles.includes(r));
+        if (!existingManagedSA && managedSA) {
+            serviceAccountToCreate = managedSA;
+        }
+    }
+    else if (existingManagedSA && !isFiltered) {
+        serviceAccountToDelete = existingManagedSA;
+    }
     wantBackend = backend.matchingBackend(wantBackend, (endpoint) => {
         return (0, functionsDeployHelper_1.endpointMatchesAnyFilter)(endpoint, filters);
     });
@@ -85,13 +101,14 @@ function createDeploymentPlan(args) {
     haveBackend = backend.matchingBackend(haveBackend, (endpoint) => {
         return wantedEndpoint(endpoint) || (0, functionsDeployHelper_1.endpointMatchesAnyFilter)(endpoint, filters);
     });
+    const regionalChangesets = {};
     const regions = new Set([
         ...Object.keys(wantBackend.endpoints),
         ...Object.keys(haveBackend.endpoints),
     ]);
     for (const region of regions) {
         const changesets = calculateChangesets(wantBackend.endpoints[region] || {}, haveBackend.endpoints[region] || {}, (e) => `${codebase}-${e.region}-${e.availableMemoryMb || "default"}`, deleteAll);
-        deployment = { ...deployment, ...changesets };
+        Object.assign(regionalChangesets, changesets);
     }
     if (upgradedToGCFv2WithoutSettingConcurrency(wantBackend, haveBackend)) {
         utils.logLabeledBullet("functions", "You are updating one or more functions to Google Cloud Functions v2, " +
@@ -99,7 +116,26 @@ function createDeploymentPlan(args) {
             "default to 80 concurrent executions, but existing functions keep the " +
             "old default of 1. You can change this with the 'concurrency' option.");
     }
-    return deployment;
+    if (requiredRoles) {
+        if (!managedSA) {
+            throw new error_1.FirebaseError("managedServiceAccount is required when requiredRoles is defined.", {
+                exit: 1,
+            });
+        }
+        return {
+            regionalChangesets,
+            rolesToAdd,
+            rolesToRemove,
+            serviceAccountToCreate,
+            managedServiceAccount: managedSA,
+        };
+    }
+    else {
+        return {
+            regionalChangesets,
+            serviceAccountToDelete,
+        };
+    }
 }
 function upgradedToGCFv2WithoutSettingConcurrency(want, have) {
     return backend.someEndpoint(want, (endpoint) => {

package/lib/deploy/functions/runtimes/discovery/index.js

@@ -5,7 +5,6 @@ exports.yamlToBuild = yamlToBuild;
 exports.detectFromYaml = detectFromYaml;
 exports.detectFromPort = detectFromPort;
 exports.detectFromOutputPath = detectFromOutputPath;
-const node_fetch_1 = require("node-fetch");
 const fs = require("fs");
 const path = require("path");
 const yaml = require("yaml");
@@ -65,12 +64,14 @@ async function detectFromPort(port, project, runtime, initialDelay = 0, timeout
     const url = `http://127.0.0.1:${port}/__/functions.yaml`;
     while (true) {
         try {
-            res = await Promise.race([(0, node_fetch_1.default)(url), timedOut]);
+            res = await Promise.race([fetch(url), timedOut]);
             break;
         }
         catch (err) {
+            const realErr = err?.cause || err;
             if (err?.name === "FetchError" ||
-                ["ECONNREFUSED", "ECONNRESET", "ETIMEDOUT"].includes(err?.code)) {
+                realErr?.name === "FetchError" ||
+                ["ECONNREFUSED", "ECONNRESET", "ETIMEDOUT"].includes(realErr?.code)) {
                 continue;
             }
             throw err;

package/lib/deploy/functions/runtimes/discovery/v1alpha1.js

@@ -20,6 +20,7 @@ function buildFromV1Alpha1(yaml, project, region, runtime) {
         specVersion: "string",
         params: "array",
         requiredAPIs: "array",
+        requiredRoles: "array",
         endpoints: "object",
         extensions: "object",
         lifecycleHooks: "object",
@@ -27,6 +28,9 @@ function buildFromV1Alpha1(yaml, project, region, runtime) {
     const bd = build.empty();
     bd.params = manifest.params || [];
     bd.requiredAPIs = parseRequiredAPIs(manifest);
+    if (manifest.requiredRoles) {
+        bd.requiredRoles = parseRequiredRoles(manifest);
+    }
     for (const id of Object.keys(manifest.endpoints)) {
         const me = manifest.endpoints[id];
         assertBuildEndpoint(me, id);
@@ -45,7 +49,7 @@ function buildFromV1Alpha1(yaml, project, region, runtime) {
     if (manifest.lifecycleHooks) {
         bd.lifecycleHooks = {};
         for (const id of Object.keys(manifest.lifecycleHooks)) {
-            if (id !== "afterInstall" && id !== "afterUpdate") {
+            if (id !== "afterFirstDeploy" && id !== "afterRedeploy") {
                 throw new error_1.FirebaseError(`Invalid eventType "${id}" for lifecycle hook.`);
             }
             const hook = manifest.lifecycleHooks[id];
@@ -76,6 +80,19 @@ function buildFromV1Alpha1(yaml, project, region, runtime) {
     }
     return bd;
 }
+const ROLE_REGEX = /^(roles\/[a-zA-Z0-9_\.\-]+|projects\/[a-zA-Z0-9\-]+\/roles\/[a-zA-Z0-9_\.\-]+|organizations\/[0-9]+\/roles\/[a-zA-Z0-9_\.\-]+)$/;
+function parseRequiredRoles(manifest) {
+    const roles = manifest.requiredRoles || [];
+    for (const role of roles) {
+        if (typeof role !== "string") {
+            throw new error_1.FirebaseError(`Invalid role "${JSON.stringify(role)}". Expected string`);
+        }
+        if (!ROLE_REGEX.test(role)) {
+            throw new error_1.FirebaseError(`Invalid IAM role format "${role}".`);
+        }
+    }
+    return Array.from(new Set(roles));
+}
 function parseRequiredAPIs(manifest) {
     const requiredAPIs = manifest.requiredAPIs || [];
     for (const { api, reason } of requiredAPIs) {

package/lib/deploy/functions/runtimes/node/index.js

@@ -8,7 +8,6 @@ const path = require("path");
 const portfinder = require("portfinder");
 const semver = require("semver");
 const spawn = require("cross-spawn");
-const node_fetch_1 = require("node-fetch");
 const error_1 = require("../../../../error");
 const parseRuntimeAndValidateSDK_1 = require("./parseRuntimeAndValidateSDK");
 const logger_1 = require("../../../../logger");
@@ -156,7 +155,7 @@ class Delegate {
                 childProcess.once("error", reject);
             });
             try {
-                await (0, node_fetch_1.default)(`http://localhost:${port}/__/quitquitquit`);
+                await fetch(`http://localhost:${port}/__/quitquitquit`);
             }
             catch (e) {
                 logger_1.logger.debug("Failed to call quitquitquit. This often means the server failed to start", e);

package/lib/deploy/functions/runtimes/python/index.js

@@ -5,7 +5,6 @@ exports.tryCreateDelegate = tryCreateDelegate;
 exports.getPythonBinary = getPythonBinary;
 const fs = require("fs");
 const path = require("path");
-const node_fetch_1 = require("node-fetch");
 const util_1 = require("util");
 const portfinder = require("portfinder");
 const discovery = require("../discovery");
@@ -130,7 +129,7 @@ class Delegate {
         });
         return Promise.resolve(async () => {
             try {
-                await (0, node_fetch_1.default)(`http://127.0.0.1:${port}/__/quitquitquit`);
+                await fetch(`http://127.0.0.1:${port}/__/quitquitquit`);
             }
             catch (e) {
                 logger_1.logger.debug("Failed to call quitquitquit. This often means the server failed to start", e);

package/lib/deploy/hosting/uploader.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Uploader = void 0;
 const lodash_1 = require("lodash");
-const abort_controller_1 = require("abort-controller");
 const clc = require("colorette");
 const crypto = require("crypto");
 const fs = require("fs");
@@ -172,7 +171,7 @@ class Uploader {
         if (!this.uploadClient) {
             throw new error_1.FirebaseError("No upload client available.", { exit: 2 });
         }
-        const controller = new abort_controller_1.default();
+        const controller = new AbortController();
         const timeout = setTimeout(() => {
             controller.abort();
         }, this.uploadTimeout(this.hashMap[toUpload]));
@@ -190,7 +189,7 @@ class Uploader {
         }
         if (res.status !== 200) {
             const errorMessage = await res.response.text();
-            logger_1.logger.debug(`[hosting][upload] ${this.hashMap[toUpload]} (${toUpload}) HTTP ERROR ${res.status}: headers=${JSON.stringify(res.response.headers.raw())} ${errorMessage}`);
+            logger_1.logger.debug(`[hosting][upload] ${this.hashMap[toUpload]} (${toUpload}) HTTP ERROR ${res.status}: headers=${JSON.stringify(Object.fromEntries(res.response.headers.entries()))} ${errorMessage}`);
             throw new Error(`Unexpected error while uploading file: ${errorMessage}`);
         }
     }