firebase-tools 15.22.4 → 15.23.0

package/lib/downloadUtils.js

@@ -10,6 +10,7 @@ const ProgressBar = require("progress");
 const tmp = require("tmp");
 const apiv2_1 = require("./apiv2");
 const error_1 = require("./error");
+const streamUtils_1 = require("./streamUtils");
 async function downloadToTmp(remoteUrl, auth = false) {
     const u = new url_1.URL(remoteUrl);
     const c = new apiv2_1.Client({ urlPrefix: u.origin, auth });
@@ -24,7 +25,8 @@ async function downloadToTmp(remoteUrl, auth = false) {
         resolveOnHTTPError: true,
     });
     if (res.status !== 200) {
-        throw new error_1.FirebaseError(`download failed, status ${res.status}: ${await res.response.text()}`, {
+        const errorText = await (0, streamUtils_1.streamToString)(res.body);
+        throw new error_1.FirebaseError(`download failed, status ${res.status}: ${errorText}`, {
             status: res.status,
         });
     }

package/lib/emulator/auth/operations.js

@@ -6,8 +6,6 @@ exports.setAccountInfoImpl = setAccountInfoImpl;
 exports.parseBlockingFunctionJwt = parseBlockingFunctionJwt;
 const url_1 = require("url");
 const jsonwebtoken_1 = require("jsonwebtoken");
-const node_fetch_1 = require("node-fetch");
-const abort_controller_1 = require("abort-controller");
 const utils_1 = require("./utils");
 const errors_1 = require("./errors");
 const types_1 = require("../types");
@@ -2183,7 +2181,7 @@ async function fetchBlockingFunction(state, event, user, options = {}, oauthToke
             jwt,
         },
     };
-    const controller = new abort_controller_1.default();
+    const controller = new AbortController();
     const timeout = setTimeout(() => {
         controller.abort();
     }, timeoutMs);
@@ -2193,11 +2191,23 @@ async function fetchBlockingFunction(state, event, user, options = {}, oauthToke
     let text;
     try {
         const signal = controller.signal;
-        signal.reason = "";
-        signal.throwIfAborted = () => {
-            throw new error_1.FirebaseError("Aborted");
-        };
-        const res = await (0, node_fetch_1.default)(url, {
+        try {
+            if (!("reason" in signal)) {
+                signal.reason = "";
+            }
+        }
+        catch (e) {
+        }
+        try {
+            if (!("throwIfAborted" in signal)) {
+                signal.throwIfAborted = () => {
+                    throw new error_1.FirebaseError("Aborted");
+                };
+            }
+        }
+        catch (e) {
+        }
+        const res = await fetch(url, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             body: JSON.stringify(reqBody),

package/lib/emulator/downloadableEmulatorInfo.json

@@ -54,36 +54,36 @@
     },
     "dataconnect": {
         "darwin": {
-            "version": "3.4.14",
-            "expectedSize": 32468976,
-            "expectedChecksum": "d62fc079187a1adc2ceef7dc0e1a1e44",
-            "expectedChecksumSHA256": "4bbf0ae04ca83dcc765804549d30f94d02c7a8b6baeef5f3c52104e771627e43",
-            "remoteUrl": "https://storage.googleapis.com/firemat-preview-drop/emulator/dataconnect-emulator-macos-amd64-v3.4.14",
-            "downloadPathRelativeToCacheDir": "dataconnect-emulator-3.4.14"
+            "version": "3.4.15",
+            "expectedSize": 32502016,
+            "expectedChecksum": "00f4b06ef1a6a70fbba7b2b8c1cd8eac",
+            "expectedChecksumSHA256": "8ea50a699023e5464b3306689e464716b8df7c51cadfe4a3db5d346981e1a916",
+            "remoteUrl": "https://storage.googleapis.com/firemat-preview-drop/emulator/dataconnect-emulator-macos-amd64-v3.4.15",
+            "downloadPathRelativeToCacheDir": "dataconnect-emulator-3.4.15"
         },
         "darwin_arm64": {
-            "version": "3.4.14",
-            "expectedSize": 30604754,
-            "expectedChecksum": "306e88ebe314eec82ae44842aa87d20e",
-            "expectedChecksumSHA256": "3eeaf0dbfd48d3d7cf761e256e8850bc6159dccc128dd59f87bbeeaaaa6a62c6",
-            "remoteUrl": "https://storage.googleapis.com/firemat-preview-drop/emulator/dataconnect-emulator-macos-arm64-v3.4.14",
-            "downloadPathRelativeToCacheDir": "dataconnect-emulator-3.4.14"
+            "version": "3.4.15",
+            "expectedSize": 30638050,
+            "expectedChecksum": "5b824b0d725e87f4f1820f8c3d50f2ce",
+            "expectedChecksumSHA256": "563ea6788e2291b82ea1cd0744f2594f0661b79277bc13e4da190b939a99293d",
+            "remoteUrl": "https://storage.googleapis.com/firemat-preview-drop/emulator/dataconnect-emulator-macos-arm64-v3.4.15",
+            "downloadPathRelativeToCacheDir": "dataconnect-emulator-3.4.15"
         },
         "win32": {
-            "version": "3.4.14",
-            "expectedSize": 32509952,
-            "expectedChecksum": "c5cbd9482be394bf466d4328b975d88e",
-            "expectedChecksumSHA256": "b9f14587c5d5f87bccd093e1dddc9f5bb2a77be007201028d9ee8339e79219f0",
-            "remoteUrl": "https://storage.googleapis.com/firemat-preview-drop/emulator/dataconnect-emulator-windows-amd64-v3.4.14",
-            "downloadPathRelativeToCacheDir": "dataconnect-emulator-3.4.14.exe"
+            "version": "3.4.15",
+            "expectedSize": 32543232,
+            "expectedChecksum": "dbdbdca5482d386a142cd602177e811d",
+            "expectedChecksumSHA256": "01b1408750b2f1612d3a99e89702a600803f9d8f77669e5ad2502651ed560796",
+            "remoteUrl": "https://storage.googleapis.com/firemat-preview-drop/emulator/dataconnect-emulator-windows-amd64-v3.4.15",
+            "downloadPathRelativeToCacheDir": "dataconnect-emulator-3.4.15.exe"
         },
         "linux": {
-            "version": "3.4.14",
-            "expectedSize": 31625400,
-            "expectedChecksum": "506a09ca12b61df98f705728047219dd",
-            "expectedChecksumSHA256": "257d7aa4f4dd1e4de9c9d3db9f7b7834323f0d53e658e6814a933b1ec73ca27d",
-            "remoteUrl": "https://storage.googleapis.com/firemat-preview-drop/emulator/dataconnect-emulator-linux-amd64-v3.4.14",
-            "downloadPathRelativeToCacheDir": "dataconnect-emulator-3.4.14"
+            "version": "3.4.15",
+            "expectedSize": 31654072,
+            "expectedChecksum": "b49d21a4704ddf9420fa58d0c233821d",
+            "expectedChecksumSHA256": "b152edccdf50f3e8e3d6904d6cd1437eb88cb7a447ede3e3dd5092d12262bdc1",
+            "remoteUrl": "https://storage.googleapis.com/firemat-preview-drop/emulator/dataconnect-emulator-linux-amd64-v3.4.15",
+            "downloadPathRelativeToCacheDir": "dataconnect-emulator-3.4.15"
         }
     }
 }

package/lib/emulator/storage/apis/gcloud.js

@@ -320,6 +320,67 @@ function createCloudEndpoints(emulator) {
         }
         return (0, shared_1.sendFileBytes)(getObjectResponse.metadata, getObjectResponse.data, req, res);
     });
+    gcloudStorageAPI.post("/:bucketId", (req, res, next) => {
+        adminStorageLayer.createBucket(req.params.bucketId);
+        next();
+    }, async (req, res) => {
+        const contentTypeHeader = req.header("content-type");
+        if (!contentTypeHeader?.includes("multipart/form-data")) {
+            return res.status(400).send("Content-Type must be multipart/form-data");
+        }
+        try {
+            const bodyBuffer = await (0, request_1.reqBodyToBuffer)(req);
+            const formData = (0, multipart_1.parseFormDataMultipartRequest)(contentTypeHeader, bodyBuffer);
+            const keyPart = formData.find((p) => p.name === "key");
+            const filePart = formData.find((p) => p.type === "file");
+            if (keyPart?.type !== "field" || filePart?.type !== "file") {
+                return res.status(400).send("Missing 'key' or file.");
+            }
+            const metadata = {
+                contentType: filePart.contentType,
+                metadata: {},
+            };
+            const HEADER_MAP = {
+                "content-type": "contentType",
+                "cache-control": "cacheControl",
+                "content-disposition": "contentDisposition",
+                "content-encoding": "contentEncoding",
+                "content-language": "contentLanguage",
+            };
+            for (const part of formData) {
+                if (part.type === "file" || part.name === "key")
+                    continue;
+                const key = part.name.toLowerCase();
+                if (key.startsWith("x-goog-meta-")) {
+                    metadata.metadata[key.substring(12)] = part.value;
+                }
+                else if (HEADER_MAP[key]) {
+                    metadata[HEADER_MAP[key]] = part.value.trim();
+                }
+            }
+            const upload = uploadService.multipartUpload({
+                bucketId: req.params.bucketId,
+                objectId: keyPart.value,
+                dataRaw: filePart.data,
+                metadata: metadata,
+                authorization: req.header("authorization"),
+            });
+            await adminStorageLayer.uploadObject(upload);
+            return res.sendStatus(204);
+        }
+        catch (err) {
+            if (err instanceof errors_1.ForbiddenError) {
+                return res.sendStatus(403);
+            }
+            if (err instanceof errors_1.NotFoundError) {
+                return res.sendStatus(404);
+            }
+            if (err instanceof Error) {
+                return res.status(400).send(err.message);
+            }
+            throw err;
+        }
+    });
     gcloudStorageAPI.post("/b/:bucketId/o/:objectId/:method(rewriteTo|copyTo)/b/:destBucketId/o/:destObjectId", (req, res, next) => {
         if (req.params.method === "rewriteTo" && req.query.rewriteToken) {
             return next();

package/lib/emulator/storage/multipart.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseObjectUploadMultipartRequest = parseObjectUploadMultipartRequest;
+exports.parseFormDataMultipartRequest = parseFormDataMultipartRequest;
 const LINE_SEPARATOR = `\r\n`;
+const LINE_SEPARATOR_BUFFER = Buffer.from(LINE_SEPARATOR);
 function splitBufferByDelimiter(buffer, delimiter, maxResults = -1) {
     let offset = 0;
     let nextDelimiterIndex = buffer.indexOf(delimiter, offset);
@@ -22,14 +24,21 @@ function splitBufferByDelimiter(buffer, delimiter, maxResults = -1) {
     bufferParts.push(Buffer.from(buffer.slice(offset)));
     return bufferParts;
 }
-function parseMultipartRequestBody(boundaryId, body) {
+function splitMultipartIntoParts(boundaryId, body) {
     const cleanBoundaryId = boundaryId.replace(/^["'](.+(?=["']$))["']$/, "$1");
     const boundaryString = `--${cleanBoundaryId}`;
     const bodyParts = splitBufferByDelimiter(body, boundaryString).map((buf) => {
         return Buffer.from(buf.slice(2));
     });
+    if (bodyParts.length < 2) {
+        return [];
+    }
+    return bodyParts.slice(1, bodyParts.length - 1);
+}
+function parseMultipartRequestBody(boundaryId, body) {
+    const rawParts = splitMultipartIntoParts(boundaryId, body);
     const parsedParts = [];
-    for (const bodyPart of bodyParts.slice(1, bodyParts.length - 1)) {
+    for (const bodyPart of rawParts) {
         parsedParts.push(parseMultipartRequestBodyPart(bodyPart));
     }
     return parsedParts;
@@ -60,3 +69,74 @@ function parseObjectUploadMultipartRequest(contentTypeHeader, body) {
         dataRaw: Buffer.from(parsedBody[1].dataRaw),
     };
 }
+function parseMultipartFormDataBody(boundaryId, body) {
+    const rawParts = splitMultipartIntoParts(boundaryId, body);
+    const parsedParts = [];
+    for (const bodyPart of rawParts) {
+        parsedParts.push(parseMultipartFormDataBodyPart(bodyPart));
+    }
+    return parsedParts;
+}
+function parseMultipartFormDataBodyPart(part) {
+    const doubleCRLF = `${LINE_SEPARATOR}${LINE_SEPARATOR}`;
+    const sections = splitBufferByDelimiter(part, doubleCRLF, 2);
+    if (sections.length < 2) {
+        throw new Error("Failed to parse multipart part: Missing header-body separator.");
+    }
+    const headerBuffer = sections[0];
+    const bodyBuffer = sections[1];
+    if (bodyBuffer.byteLength < LINE_SEPARATOR_BUFFER.byteLength ||
+        !bodyBuffer
+            .slice(bodyBuffer.byteLength - LINE_SEPARATOR_BUFFER.byteLength)
+            .equals(LINE_SEPARATOR_BUFFER)) {
+        throw new Error("Failed to parse multipart part: Missing trailing line separator.");
+    }
+    const dataRaw = bodyBuffer.slice(0, bodyBuffer.byteLength - LINE_SEPARATOR_BUFFER.byteLength);
+    const headers = headerBuffer.toString().split(LINE_SEPARATOR);
+    let name = "";
+    let filename;
+    let contentType;
+    for (const h of headers) {
+        const lowerH = h.toLowerCase();
+        if (lowerH.startsWith("content-disposition:")) {
+            name = extractParam(h, "name") ?? name;
+            filename = extractParam(h, "filename") ?? filename;
+        }
+        else if (lowerH.startsWith("content-type:")) {
+            contentType = h.substring("content-type:".length).trim();
+        }
+    }
+    if (!name) {
+        throw new Error("Failed to parse multipart form-data. Missing 'name' in Content-Disposition header.");
+    }
+    if (filename) {
+        return {
+            type: "file",
+            name,
+            filename,
+            contentType: contentType || "application/octet-stream",
+            data: dataRaw,
+        };
+    }
+    else {
+        return {
+            type: "field",
+            name,
+            value: dataRaw.toString(),
+        };
+    }
+}
+function extractParam(header, param) {
+    const match = header.match(new RegExp(`\\b${param}=["']?([^"';]+)["']?`, "i"));
+    return match ? match[1] : undefined;
+}
+function parseFormDataMultipartRequest(contentTypeHeader, body) {
+    if (!contentTypeHeader.startsWith("multipart/form-data")) {
+        throw new Error(`Bad content type. ${contentTypeHeader}`);
+    }
+    const boundaryId = contentTypeHeader.split("boundary=")[1]?.split(";")[0]?.trim();
+    if (!boundaryId) {
+        throw new Error(`Bad content type. ${contentTypeHeader}`);
+    }
+    return parseMultipartFormDataBody(boundaryId, body);
+}

package/lib/emulator/taskQueue.js

@@ -1,11 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TaskQueue = exports.TaskStatus = exports.Queue = void 0;
-const abort_controller_1 = require("abort-controller");
 const emulatorLogger_1 = require("./emulatorLogger");
 const types_1 = require("./types");
-const error_1 = require("../error");
-const node_fetch_1 = require("node-fetch");
 class Node {
     constructor(data) {
         this.data = data;
@@ -204,17 +201,12 @@ class TaskQueue {
             if (emulatedTask.metadata.previousResponse) {
                 headers["X-CloudTasks-TaskPreviousResponse"] = `${emulatedTask.metadata.previousResponse}`;
             }
-            const controller = new abort_controller_1.default();
-            const signal = controller.signal;
-            signal.reason = "";
-            signal.throwIfAborted = () => {
-                throw new error_1.FirebaseError("Aborted");
-            };
-            const request = (0, node_fetch_1.default)(emulatedTask.task.httpRequest.url, {
+            const controller = new AbortController();
+            const request = fetch(emulatedTask.task.httpRequest.url, {
                 method: "POST",
                 headers: headers,
                 body: JSON.stringify(emulatedTask.task.httpRequest.body),
-                signal: signal,
+                signal: controller.signal,
             });
             const dispatchDeadline = emulatedTask.task.dispatchDeadline;
             const dispatchDeadlineSeconds = dispatchDeadline

package/lib/extensions/extensionsHelper.js

@@ -34,8 +34,8 @@ const ora = require("ora");
 const semver = require("semver");
 const tmp = require("tmp");
 const fs = require("fs-extra");
-const node_fetch_1 = require("node-fetch");
 const path = require("path");
+const stream_1 = require("stream");
 const marked_1 = require("marked");
 const marked_terminal_1 = require("marked-terminal");
 const unzip_1 = require("./../unzip");
@@ -514,9 +514,11 @@ async function fetchExtensionSource(repoUri, sourceRef, extensionRoot) {
     const tempDirectory = tmp.dirSync({ unsafeCleanup: true });
     const archiveErrorMessage = `Failed to extract archive from ${clc.bold(archiveUri)}. Please check that the repo is public and that the source ref is valid.`;
     try {
-        const response = await (0, node_fetch_1.default)(archiveUri);
-        if (response.ok) {
-            await response.body.pipe((0, unzip_1.createUnzipTransform)(tempDirectory.name)).promise();
+        const response = await fetch(archiveUri);
+        if (response.ok && response.body) {
+            await stream_1.Readable.fromWeb(response.body)
+                .pipe((0, unzip_1.createUnzipTransform)(tempDirectory.name))
+                .promise();
         }
     }
     catch (err) {

package/lib/gcp/iam.js

@@ -11,10 +11,16 @@ exports.testResourceIamPermissions = testResourceIamPermissions;
 exports.testIamPermissions = testIamPermissions;
 exports.mergeBindings = mergeBindings;
 exports.printManualIamConfig = printManualIamConfig;
+exports.getRoleName = getRoleName;
+exports.generateManagedServiceAccountName = generateManagedServiceAccountName;
+exports.computeRolesEtag = computeRolesEtag;
 const api_1 = require("../api");
 const logger_1 = require("../logger");
 const apiv2_1 = require("../apiv2");
 const utils = require("../utils");
+const error_1 = require("../error");
+const knownRoles = require("./knownRoles.json");
+const crypto = require("crypto");
 const apiClient = new apiv2_1.Client({ urlPrefix: (0, api_1.iamOrigin)(), apiVersion: "v1" });
 function getDefaultCloudBuildServiceAgent(projectNumber) {
     return `${projectNumber}@cloudbuild.gserviceaccount.com`;
@@ -30,11 +36,17 @@ async function createServiceAccount(projectId, accountId, description, displayNa
     return response.body;
 }
 async function getServiceAccount(projectId, serviceAccountName) {
-    const response = await apiClient.get(`/projects/${projectId}/serviceAccounts/${serviceAccountName}@${projectId}.iam.gserviceaccount.com`);
+    const email = serviceAccountName.includes("@")
+        ? serviceAccountName
+        : `${serviceAccountName}@${projectId}.iam.gserviceaccount.com`;
+    const response = await apiClient.get(`/projects/${projectId}/serviceAccounts/${email}`);
     return response.body;
 }
 async function createServiceAccountKey(projectId, serviceAccountName) {
-    const response = await apiClient.post(`/projects/${projectId}/serviceAccounts/${serviceAccountName}@${projectId}.iam.gserviceaccount.com/keys`, {
+    const email = serviceAccountName.includes("@")
+        ? serviceAccountName
+        : `${serviceAccountName}@${projectId}.iam.gserviceaccount.com`;
+    const response = await apiClient.post(`/projects/${projectId}/serviceAccounts/${email}/keys`, {
         keyAlgorithm: "KEY_ALG_UNSPECIFIED",
         privateKeyType: "TYPE_GOOGLE_CREDENTIALS_FILE",
     });
@@ -109,3 +121,57 @@ function printManualIamConfig(requiredBindings, projectId, prefix) {
         }
     }
 }
+async function getRoleName(role) {
+    const map = knownRoles;
+    const title = map[role];
+    if (title) {
+        return title;
+    }
+    try {
+        const roleDetails = await getRole(role);
+        return roleDetails.title || role;
+    }
+    catch (err) {
+        return role;
+    }
+}
+async function generateManagedServiceAccountName(projectId, prefix) {
+    const maxAttempts = 10;
+    for (let i = 0; i < maxAttempts; i++) {
+        const randomSuffix = Math.floor(Math.random() * 10000000000)
+            .toString()
+            .padStart(10, "0");
+        const accountId = `${prefix}-${randomSuffix}`;
+        try {
+            await getServiceAccount(projectId, accountId);
+        }
+        catch (err) {
+            if ((0, error_1.getErrStatus)(err) === 404) {
+                return accountId;
+            }
+            throw err;
+        }
+        await utils.sleep(200);
+    }
+    throw new error_1.FirebaseError("Failed to generate a unique service account name after 10 attempts.");
+}
+function computeRolesEtag(roles, existingSalt) {
+    const BASE38_CHARS = "abcdefghijklmnopqrstuvwxyz0123456789-_";
+    let salt = existingSalt;
+    if (!salt) {
+        salt = String.fromCharCode(97 + Math.floor(Math.random() * 26));
+        for (let i = 0; i < 9; i++) {
+            salt += BASE38_CHARS[Math.floor(Math.random() * 38)];
+        }
+    }
+    const sorted = Array.from(roles).sort();
+    const hashBuffer = crypto
+        .createHash("sha256")
+        .update(salt + sorted.join(","))
+        .digest();
+    let hashStr = "";
+    for (const byte of hashBuffer) {
+        hashStr += BASE38_CHARS[byte % 38];
+    }
+    return `${salt}-${hashStr.substring(0, 52)}`;
+}

package/lib/gcp/knownRoles.json

@@ -0,0 +1,99 @@
+{
+    "roles/actions.Admin": "Actions Admin",
+    "roles/actions.Viewer": "Actions Viewer",
+    "roles/bigquery.dataEditor": "BigQuery Data Editor",
+    "roles/bigquery.user": "BigQuery User",
+    "roles/cloudconfig.admin": "Firebase Remote Config Admin",
+    "roles/cloudconfig.viewer": "Firebase Remote Config Viewer",
+    "roles/clouddeploymentmanager.serviceAgent": "Cloud Deployment Manager Service Agent",
+    "roles/cloudfunctions.admin": "Cloud Functions Admin",
+    "roles/cloudfunctions.developer": "Cloud Functions Developer",
+    "roles/cloudfunctions.invoker": "Cloud Functions Invoker",
+    "roles/cloudtasks.admin": "Cloud Tasks Admin",
+    "roles/cloudtasks.enqueuer": "Cloud Tasks Enqueuer",
+    "roles/cloudtasks.viewer": "Cloud Tasks Viewer",
+    "roles/cloudtestservice.testAdmin": "Firebase Test Lab Admin",
+    "roles/cloudtestservice.testViewer": "Firebase Test Lab Viewer",
+    "roles/composer.serviceAgent": "Cloud Composer API Service Agent",
+    "roles/dataflow.serviceAgent": "Cloud Dataflow Service Agent",
+    "roles/datafusion.serviceAgent": "Cloud Data Fusion API Service Agent",
+    "roles/datapipelines.serviceAgent": "Datapipelines Service Agent",
+    "roles/dataplex.serviceAgent": "Cloud Dataplex Service Agent",
+    "roles/dataproc.serviceAgent": "Dataproc Service Agent",
+    "roles/datastore.user": "Cloud Datastore User",
+    "roles/dlp.serviceAgent": "DLP API Service Agent",
+    "roles/editor": "Editor",
+    "roles/eventarc.admin": "Eventarc Admin",
+    "roles/eventarc.eventReceiver": "Eventarc Event Receiver",
+    "roles/eventarc.viewer": "Eventarc Viewer",
+    "roles/firebase.admin": "Firebase Admin",
+    "roles/firebase.analyticsAdmin": "Firebase Analytics Admin",
+    "roles/firebase.analyticsViewer": "Firebase Analytics Viewer",
+    "roles/firebase.developAdmin": "Firebase Develop Admin",
+    "roles/firebase.developViewer": "Firebase Develop Viewer",
+    "roles/firebase.editor": "Firebase Editor",
+    "roles/firebase.growthAdmin": "Firebase Grow Admin",
+    "roles/firebase.growthViewer": "Firebase Grow Viewer",
+    "roles/firebase.managementServiceAgent": "Firebase Service Management Service Agent",
+    "roles/firebase.qualityAdmin": "Firebase Quality Admin",
+    "roles/firebase.qualityViewer": "Firebase Quality Viewer",
+    "roles/firebase.sdkAdminServiceAgent": "Firebase Admin SDK Administrator Service Agent",
+    "roles/firebase.sdkProvisioningServiceAgent": "Firebase SDK Provisioning Service Agent",
+    "roles/firebase.viewer": "Firebase Viewer",
+    "roles/firebaseabt.admin": "Firebase A/B Testing Admin",
+    "roles/firebaseabt.viewer": "Firebase A/B Testing Viewer",
+    "roles/firebaseappdistro.admin": "Firebase App Distribution Admin",
+    "roles/firebaseappdistro.viewer": "Firebase App Distribution Viewer",
+    "roles/firebaseauth.admin": "Firebase Authentication Admin",
+    "roles/firebaseauth.editor": "Firebase Authentication editor",
+    "roles/firebaseauth.viewer": "Firebase Authentication Viewer",
+    "roles/firebasecloudmessaging.viewer": "Firebase Cloud Messaging API Viewer",
+    "roles/firebasecrash.symbolMappingsAdmin": "Firebase Crash Symbol Uploader",
+    "roles/firebasecrashlytics.admin": "Firebase Crashlytics Admin",
+    "roles/firebasecrashlytics.viewer": "Firebase Crashlytics Viewer",
+    "roles/firebasedatabase.admin": "Firebase Realtime Database Admin",
+    "roles/firebasedatabase.viewer": "Firebase Realtime Database Viewer",
+    "roles/firebasedynamiclinks.admin": "Firebase Dynamic Links Admin",
+    "roles/firebasedynamiclinks.editor": "Firebasedynamiclinks Editor",
+    "roles/firebasedynamiclinks.viewer": "Firebase Dynamic Links Viewer",
+    "roles/firebaseextensions.developer": "Firebase Extensions Developer",
+    "roles/firebaseextensions.editor": "Firebaseextensions Editor",
+    "roles/firebaseextensions.viewer": "Firebase Extensions Viewer",
+    "roles/firebaseextensionspublisher.admin": "Firebaseextensionspublisher Admin",
+    "roles/firebaseextensionspublisher.extensionsAdmin": "Firebase Extensions Publisher - Extensions Admin",
+    "roles/firebaseextensionspublisher.extensionsViewer": "Firebase Extensions Publisher - Extensions Viewer",
+    "roles/firebaseextensionspublisher.viewer": "Firebaseextensionspublisher Viewer",
+    "roles/firebasehosting.admin": "Firebase Hosting Admin",
+    "roles/firebasehosting.viewer": "Firebase Hosting Viewer",
+    "roles/firebaseinappmessaging.admin": "Firebase In-App Messaging Admin",
+    "roles/firebaseinappmessaging.viewer": "Firebase In-App Messaging Viewer",
+    "roles/firebaseml.admin": "Firebase ML Kit Admin",
+    "roles/firebaseml.viewer": "Firebase ML Kit Viewer",
+    "roles/firebasenotifications.admin": "Firebase Cloud Messaging Admin",
+    "roles/firebasenotifications.viewer": "Firebase Cloud Messaging Viewer",
+    "roles/firebaseperformance.admin": "Firebase Performance Reporting Admin",
+    "roles/firebaseperformance.viewer": "Firebase Performance Reporting Viewer",
+    "roles/firebasestorage.admin": "Cloud Storage for Firebase Admin",
+    "roles/iam.databasesAdmin": "Databases Admin",
+    "roles/iam.infrastructureAdmin": "Infrastructure Administrator",
+    "roles/iam.securityAdmin": "Security Admin",
+    "roles/iam.securityAuditor": "Security Auditor",
+    "roles/iam.securityReviewer": "Security Reviewer",
+    "roles/iam.supportUser": "Support User",
+    "roles/identitytoolkit.editor": "Identity Toolkit editor",
+    "roles/ml.serviceAgent": "AI Platform Service Agent",
+    "roles/oauthconfig.editor": "OAuth Config Editor",
+    "roles/oauthconfig.viewer": "OAuth Config Viewer",
+    "roles/owner": "Owner",
+    "roles/pubsub.admin": "Pub/Sub Admin",
+    "roles/pubsub.publisher": "Pub/Sub Publisher",
+    "roles/pubsub.subscriber": "Pub/Sub Subscriber",
+    "roles/pubsub.viewer": "Pub/Sub Viewer",
+    "roles/storage.admin": "Storage Admin",
+    "roles/storage.hmacKeyAdmin": "Storage HMAC Key Admin",
+    "roles/storage.objectAdmin": "Storage Object Admin",
+    "roles/storage.objectCreator": "Storage Object Creator",
+    "roles/storage.objectViewer": "Storage Object Viewer",
+    "roles/viewer": "Viewer",
+    "roles/visualinspection.serviceAgent": "Visual Inspection AI Service Agent"
+}

package/lib/gcp/resourceManager.js

@@ -1,10 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.firebaseRoles = void 0;
+exports.addServiceAccountRoles = exports.firebaseRoles = void 0;
 exports.getIamPolicy = getIamPolicy;
 exports.setIamPolicy = setIamPolicy;
 exports.addServiceAccountToRoles = addServiceAccountToRoles;
 exports.serviceAccountHasRoles = serviceAccountHasRoles;
+exports.removeServiceAccountRoles = removeServiceAccountRoles;
+exports.getServiceAccountRoles = getServiceAccountRoles;
 const lodash_1 = require("lodash");
 const api_1 = require("../api");
 const apiv2_1 = require("../apiv2");
@@ -37,6 +39,7 @@ async function addServiceAccountToRoles(projectId, serviceAccountName, roles, sk
             : (0, iam_1.getServiceAccount)(projectId, serviceAccountName),
         getIamPolicy(projectId),
     ]);
+    projectPolicy.bindings = projectPolicy.bindings || [];
     const newMemberName = `serviceAccount:${fullServiceAccountName.split("/").pop()}`;
     roles.forEach((roleName) => {
         let bindingIndex = (0, lodash_1.findIndex)(projectPolicy.bindings, (binding) => binding.role === roleName);
@@ -61,6 +64,7 @@ async function serviceAccountHasRoles(projectId, serviceAccountName, roles, skip
             : (0, iam_1.getServiceAccount)(projectId, serviceAccountName),
         getIamPolicy(projectId),
     ]);
+    projectPolicy.bindings = projectPolicy.bindings || [];
     const memberName = `serviceAccount:${fullServiceAccountName.split("/").pop()}`;
     for (const roleName of roles) {
         const binding = projectPolicy.bindings.find((b) => b.role === roleName);
@@ -73,3 +77,40 @@ async function serviceAccountHasRoles(projectId, serviceAccountName, roles, skip
     }
     return true;
 }
+async function removeServiceAccountRoles(projectId, serviceAccountEmail, rolesToRemove) {
+    const projectPolicy = await getIamPolicy(projectId);
+    const bindings = projectPolicy.bindings || [];
+    const memberName = `serviceAccount:${serviceAccountEmail}`;
+    let updated = false;
+    for (let i = bindings.length - 1; i >= 0; i--) {
+        const binding = bindings[i];
+        if (rolesToRemove.includes(binding.role)) {
+            const memberIndex = binding.members.indexOf(memberName);
+            if (memberIndex !== -1) {
+                binding.members.splice(memberIndex, 1);
+                updated = true;
+                if (binding.members.length === 0) {
+                    bindings.splice(i, 1);
+                }
+            }
+        }
+    }
+    if (updated) {
+        projectPolicy.bindings = bindings;
+        return await setIamPolicy(projectId, projectPolicy, "bindings");
+    }
+    return projectPolicy;
+}
+async function getServiceAccountRoles(projectId, serviceAccountEmail) {
+    const projectPolicy = await getIamPolicy(projectId);
+    const memberName = `serviceAccount:${serviceAccountEmail}`;
+    const roles = [];
+    const bindings = projectPolicy.bindings || [];
+    for (const binding of bindings) {
+        if (binding.members.includes(memberName)) {
+            roles.push(binding.role);
+        }
+    }
+    return roles;
+}
+exports.addServiceAccountRoles = addServiceAccountToRoles;

package/lib/gemini/fdcExperience.js

@@ -9,8 +9,8 @@ const api_1 = require("../api");
 const error_1 = require("../error");
 const logger_1 = require("../logger");
 const apiClient = new apiv2_1.Client({ urlPrefix: (0, api_1.dataconnectOrigin)(), auth: true });
-exports.PROMPT_GENERATE_CONNECTOR = "Create 4 operations for an app using the instance schema with proper authentication.";
-exports.PROMPT_GENERATE_SEED_DATA = "Create a mutation to populate the database with some seed data.";
+exports.PROMPT_GENERATE_CONNECTOR = 'Generate at least one create (insert/upsert), delete, update, get (read by key), and list operation for each table defined in the schema. For user-specific data, use the \'auth.uid\' server value (e.g., id_expr: "auth.uid") or correct filters to secure user-owned data and require authentication using @auth(level: USER). For publicly accessible data, use @auth(level: PUBLIC, insecureReason: "why is it OK to be public?")';
+exports.PROMPT_GENERATE_SEED_DATA = "Create a single mutation wrapped in a @transaction to populate the database with seed data. The mutation should call the insertMany action (e.g., table_insertMany) for all tables/entities defined in the schema, using fake data. Generate appropriate fake records (3 to 5 per table) conforming to the schema and including proper relationships/foreign keys.";
 function logCurl(method, path, body) {
     const url = `${(0, api_1.dataconnectOrigin)()}${path}`;
     const headers = [

package/lib/hosting/initMiddleware.js

@@ -31,7 +31,7 @@ function initMiddleware(init) {
                 if (sdkRes.status === 404) {
                     return next();
                 }
-                for (const [key, value] of Object.entries(sdkRes.response.headers.raw())) {
+                for (const [key, value] of sdkRes.response.headers.entries()) {
                     res.setHeader(key, value);
                 }
                 sdkRes.body.pipe(res);