firebase-tools 9.18.0 → 9.22.0

package/lib/config.js

@@ -144,10 +144,10 @@ class Config {
         fs.ensureFileSync(this.path(p));
         fs.writeFileSync(this.path(p), content, "utf8");
     }
-    askWriteProjectFile(p, content) {
+    askWriteProjectFile(p, content, force) {
         const writeTo = this.path(p);
         let next;
-        if (fsutils.fileExistsSync(writeTo)) {
+        if (fsutils.fileExistsSync(writeTo) && !force) {
             next = prompt_1.promptOnce({
                 type: "confirm",
                 message: "File " + clc.underline(p) + " already exists. Overwrite?",
@@ -203,6 +203,7 @@ Config.FILENAME = "firebase.json";
 Config.MATERIALIZE_TARGETS = [
     "database",
     "emulators",
+    "extensions",
     "firestore",
     "functions",
     "hosting",

package/lib/deploy/extensions/args.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/deploy/extensions/deploy.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deploy = void 0;
+const tasks = require("./tasks");
+const queue_1 = require("../../throttler/queue");
+const error_1 = require("../../error");
+const errors_1 = require("./errors");
+const projectUtils_1 = require("../../projectUtils");
+const provisioningHelper_1 = require("../../extensions/provisioningHelper");
+const secrets_1 = require("./secrets");
+const validate_1 = require("./validate");
+async function deploy(context, options, payload) {
+    var _a, _b, _c, _d, _e, _f;
+    const projectId = projectUtils_1.needProjectId(options);
+    await validate_1.checkBilling(projectId, options.nonInteractive);
+    await provisioningHelper_1.bulkCheckProductsProvisioned(projectId, [
+        ...((_a = payload.instancesToCreate) !== null && _a !== void 0 ? _a : []),
+        ...((_b = payload.instancesToUpdate) !== null && _b !== void 0 ? _b : []),
+        ...((_c = payload.instancesToConfigure) !== null && _c !== void 0 ? _c : []),
+    ]);
+    await secrets_1.handleSecretParams(payload, context.have, options.nonInteractive);
+    const errorHandler = new errors_1.ErrorHandler();
+    const validationQueue = new queue_1.default({
+        retries: 5,
+        concurrency: 5,
+        handler: tasks.extensionsDeploymentHandler(errorHandler),
+    });
+    for (const create of (_d = payload.instancesToCreate) !== null && _d !== void 0 ? _d : []) {
+        const task = tasks.createExtensionInstanceTask(projectId, create, true);
+        void validationQueue.run(task);
+    }
+    for (const update of (_e = payload.instancesToUpdate) !== null && _e !== void 0 ? _e : []) {
+        const task = tasks.updateExtensionInstanceTask(projectId, update, true);
+        void validationQueue.run(task);
+    }
+    for (const configure of (_f = payload.instancesToConfigure) !== null && _f !== void 0 ? _f : []) {
+        const task = tasks.configureExtensionInstanceTask(projectId, configure, true);
+        void validationQueue.run(task);
+    }
+    const validationPromise = validationQueue.wait();
+    validationQueue.process();
+    validationQueue.close();
+    await validationPromise;
+    if (errorHandler.hasErrors()) {
+        errorHandler.print();
+        throw new error_1.FirebaseError(`Extensions deployment failed validation. No changes have been made to the Extension instances on ${projectId}`);
+    }
+}
+exports.deploy = deploy;

package/lib/deploy/extensions/deploymentSummary.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deletesSummary = exports.configuresSummary = exports.updatesSummary = exports.createsSummary = exports.humanReadable = void 0;
+const clc = require("cli-color");
+const refs = require("../../extensions/refs");
+exports.humanReadable = (dep) => `${clc.bold(dep.instanceId)} (${dep.ref ? `${refs.toExtensionVersionRef(dep.ref)}` : `Installed from local source`})`;
+const humanReadableUpdate = (from, to) => {
+    var _a, _b, _c, _d, _e;
+    if (((_a = from.ref) === null || _a === void 0 ? void 0 : _a.publisherId) == ((_b = to.ref) === null || _b === void 0 ? void 0 : _b.publisherId) &&
+        ((_c = from.ref) === null || _c === void 0 ? void 0 : _c.extensionId) == ((_d = to.ref) === null || _d === void 0 ? void 0 : _d.extensionId)) {
+        return `\t${clc.bold(from.instanceId)} (${refs.toExtensionVersionRef(from.ref)} => ${(_e = to.ref) === null || _e === void 0 ? void 0 : _e.version})`;
+    }
+    else {
+        const fromRef = from.ref
+            ? `${refs.toExtensionVersionRef(from.ref)}`
+            : `Installed from local source`;
+        return `\t${clc.bold(from.instanceId)} (${fromRef} => ${refs.toExtensionVersionRef(to.ref)})`;
+    }
+};
+function createsSummary(toCreate) {
+    const instancesToCreate = toCreate.map((s) => `\t${exports.humanReadable(s)}`).join("\n");
+    return toCreate.length
+        ? `The following extension instances will be created:\n${instancesToCreate}\n`
+        : "";
+}
+exports.createsSummary = createsSummary;
+function updatesSummary(toUpdate, have) {
+    const instancesToUpdate = toUpdate
+        .map((to) => {
+        const from = have.find((exists) => exists.instanceId == to.instanceId);
+        return humanReadableUpdate(from, to);
+    })
+        .join("\n");
+    return toUpdate.length
+        ? `The following extension instances will be updated:\n${instancesToUpdate}\n`
+        : "";
+}
+exports.updatesSummary = updatesSummary;
+function configuresSummary(toConfigure) {
+    const instancesToConfigure = toConfigure.map((s) => `\t${exports.humanReadable(s)}`).join("\n");
+    return toConfigure.length
+        ? `The following extension instances will be configured:\n${instancesToConfigure}\n`
+        : "";
+}
+exports.configuresSummary = configuresSummary;
+function deletesSummary(toDelete) {
+    const instancesToDelete = toDelete.map((s) => `\t${exports.humanReadable(s)}`).join("\n");
+    return toDelete.length
+        ? `The following extension instances are not listed in 'firebase.json':\n${instancesToDelete}\n`
+        : "";
+}
+exports.deletesSummary = deletesSummary;

package/lib/deploy/extensions/errors.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ErrorHandler = void 0;
+const clc = require("cli-color");
+const logger_1 = require("../../logger");
+class ErrorHandler {
+    constructor() {
+        this.errors = [];
+    }
+    record(instanceId, type, message) {
+        this.errors.push({
+            instanceId,
+            type,
+            message: message,
+        });
+    }
+    print() {
+        logger_1.logger.info("");
+        logger_1.logger.info("Extensions deploy had errors:");
+        logger_1.logger.info("");
+        for (const err of this.errors) {
+            logger_1.logger.info(`- ${err.type} ${clc.bold(err.instanceId)}`);
+            logger_1.logger.info(err.message);
+            logger_1.logger.info("");
+        }
+    }
+    hasErrors() {
+        return this.errors.length > 0;
+    }
+}
+exports.ErrorHandler = ErrorHandler;

package/lib/deploy/extensions/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+var prepare_1 = require("./prepare");
+Object.defineProperty(exports, "prepare", { enumerable: true, get: function () { return prepare_1.prepare; } });
+var deploy_1 = require("./deploy");
+Object.defineProperty(exports, "deploy", { enumerable: true, get: function () { return deploy_1.deploy; } });
+var release_1 = require("./release");
+Object.defineProperty(exports, "release", { enumerable: true, get: function () { return release_1.release; } });

package/lib/deploy/extensions/planner.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveVersion = exports.want = exports.have = exports.getExtension = exports.getExtensionVersion = void 0;
+const path = require("path");
+const semver = require("semver");
+const error_1 = require("../../error");
+const extensionsApi = require("../../extensions/extensionsApi");
+const extensionsHelper_1 = require("../../extensions/extensionsHelper");
+const refs = require("../../extensions/refs");
+const paramHelper_1 = require("../../extensions/paramHelper");
+const logger_1 = require("../../logger");
+async function getExtensionVersion(i) {
+    if (!i.extensionVersion) {
+        if (!i.ref) {
+            throw new error_1.FirebaseError(`Can't get ExtensionVersion for ${i.instanceId} because it has no ref`);
+        }
+        i.extensionVersion = await extensionsApi.getExtensionVersion(refs.toExtensionVersionRef(i.ref));
+    }
+    return i.extensionVersion;
+}
+exports.getExtensionVersion = getExtensionVersion;
+async function getExtension(i) {
+    if (!i.ref) {
+        throw new error_1.FirebaseError(`Can't get Extensionfor ${i.instanceId} because it has no ref`);
+    }
+    if (!i.extension) {
+        i.extension = await extensionsApi.getExtension(refs.toExtensionRef(i.ref));
+    }
+    return i.extension;
+}
+exports.getExtension = getExtension;
+const ENV_DIRECTORY = "extensions";
+async function have(projectId) {
+    const instances = await extensionsApi.listInstances(projectId);
+    return instances.map((i) => {
+        const dep = {
+            instanceId: i.name.split("/").pop(),
+            params: i.config.params,
+        };
+        if (i.config.extensionRef) {
+            const ref = refs.parse(i.config.extensionRef);
+            dep.ref = ref;
+            dep.ref.version = i.config.extensionVersion;
+        }
+        return dep;
+    });
+}
+exports.have = have;
+async function want(projectId, projectDir, extensions) {
+    const instanceSpecs = [];
+    const errors = [];
+    for (const e of Object.entries(extensions)) {
+        try {
+            const instanceId = e[0];
+            const ref = refs.parse(e[1]);
+            ref.version = await resolveVersion(ref);
+            const params = readParams(projectDir, instanceId);
+            const autoPopulatedParams = await extensionsHelper_1.getFirebaseProjectParams(projectId);
+            const subbedParams = extensionsHelper_1.substituteParams(params, autoPopulatedParams);
+            instanceSpecs.push({
+                instanceId,
+                ref,
+                params: subbedParams,
+            });
+        }
+        catch (err) {
+            logger_1.logger.debug(`Got error reading extensions entry ${e}: ${err}`);
+            errors.push(err);
+        }
+    }
+    if (errors.length) {
+        const messages = errors.map((err) => `- ${err.message}`).join("\n");
+        throw new error_1.FirebaseError(`Errors while reading 'extensions' in 'firebase.json'\n${messages}`);
+    }
+    return instanceSpecs;
+}
+exports.want = want;
+async function resolveVersion(ref) {
+    if (!ref.version || ref.version == "latest") {
+        return "latest";
+    }
+    const extensionRef = refs.toExtensionRef(ref);
+    const versions = await extensionsApi.listExtensionVersions(extensionRef);
+    const maxSatisfying = semver.maxSatisfying(versions.map((ev) => ev.spec.version), ref.version);
+    if (!maxSatisfying) {
+        throw new error_1.FirebaseError(`No version of ${extensionRef} matches requested version ${ref.version}`);
+    }
+    return maxSatisfying;
+}
+exports.resolveVersion = resolveVersion;
+function readParams(projectDir, instanceId) {
+    const paramPath = path.join(projectDir, ENV_DIRECTORY, `${instanceId}.env`);
+    const params = paramHelper_1.readEnvFile(paramPath);
+    return params;
+}

package/lib/deploy/extensions/prepare.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prepare = void 0;
+const planner = require("./planner");
+const deploymentSummary = require("./deploymentSummary");
+const prompt = require("../../prompt");
+const refs = require("../../extensions/refs");
+const projectUtils_1 = require("../../projectUtils");
+const logger_1 = require("../../logger");
+const error_1 = require("../../error");
+const requirePermissions_1 = require("../../requirePermissions");
+const extensionsHelper_1 = require("../../extensions/extensionsHelper");
+const secretsUtils_1 = require("../../extensions/secretsUtils");
+const secrets_1 = require("./secrets");
+const warnings_1 = require("../../extensions/warnings");
+async function prepare(context, options, payload) {
+    var _a;
+    const projectId = projectUtils_1.needProjectId(options);
+    await extensionsHelper_1.ensureExtensionsApiEnabled(options);
+    await requirePermissions_1.requirePermissions(options, ["firebaseextensions.instances.list"]);
+    context.have = await planner.have(projectId);
+    context.want = await planner.want(projectId, options.config.projectDir, options.config.get("extensions"));
+    const usingSecrets = await Promise.all((_a = context.have) === null || _a === void 0 ? void 0 : _a.map(secrets_1.checkSpecForSecrets));
+    if (usingSecrets.some((i) => i)) {
+        await secretsUtils_1.ensureSecretManagerApiEnabled(options);
+    }
+    payload.instancesToCreate = context.want.filter((i) => { var _a; return !((_a = context.have) === null || _a === void 0 ? void 0 : _a.some(matchesInstanceId(i))); });
+    payload.instancesToConfigure = context.want.filter((i) => { var _a; return (_a = context.have) === null || _a === void 0 ? void 0 : _a.some(isConfigure(i)); });
+    payload.instancesToUpdate = context.want.filter((i) => { var _a; return (_a = context.have) === null || _a === void 0 ? void 0 : _a.some(isUpdate(i)); });
+    payload.instancesToDelete = context.have.filter((i) => { var _a; return !((_a = context.want) === null || _a === void 0 ? void 0 : _a.some(matchesInstanceId(i))); });
+    if (await warnings_1.displayWarningsForDeploy(payload.instancesToCreate)) {
+        if (!options.force && options.nonInteractive) {
+            throw new error_1.FirebaseError("Pass the --force flag to acknowledge these terms in non-interactive mode");
+        }
+        else if (!options.force &&
+            !options.nonInteractive &&
+            !(await prompt.promptOnce({
+                type: "confirm",
+                message: `Do you wish to continue deploying these extensions?`,
+                default: true,
+            }))) {
+            throw new error_1.FirebaseError("Deployment cancelled");
+        }
+    }
+    if (await warnings_1.displayWarningsForDeploy(payload.instancesToCreate)) {
+        if (!options.force && options.nonInteractive) {
+            throw new error_1.FirebaseError("Pass the --force flag to acknowledge these terms in non-interactive mode");
+        }
+        else if (!options.force &&
+            !options.nonInteractive &&
+            !(await prompt.promptOnce({
+                type: "confirm",
+                message: `Do you wish to continue deploying these extensions?`,
+                default: true,
+            }))) {
+            throw new error_1.FirebaseError("Deployment cancelled");
+        }
+    }
+    const permissionsNeeded = [];
+    if (payload.instancesToCreate.length) {
+        permissionsNeeded.push("firebaseextensions.instances.create");
+        logger_1.logger.info(deploymentSummary.createsSummary(payload.instancesToCreate));
+    }
+    if (payload.instancesToUpdate.length) {
+        permissionsNeeded.push("firebaseextensions.instances.update");
+        logger_1.logger.info(deploymentSummary.updatesSummary(payload.instancesToUpdate, context.have));
+    }
+    if (payload.instancesToConfigure.length) {
+        permissionsNeeded.push("firebaseextensions.instances.update");
+        logger_1.logger.info(deploymentSummary.configuresSummary(payload.instancesToConfigure));
+    }
+    if (payload.instancesToDelete.length) {
+        logger_1.logger.info(deploymentSummary.deletesSummary(payload.instancesToDelete));
+        if (!options.force && options.nonInteractive) {
+            throw new error_1.FirebaseError("Pass the --force flag to use this command in non-interactive mode");
+        }
+        else if (!options.force &&
+            !options.nonInteractive &&
+            !(await prompt.promptOnce({
+                type: "confirm",
+                message: `Would you like to delete ${payload.instancesToDelete
+                    .map((i) => i.instanceId)
+                    .join(", ")}?`,
+                default: false,
+            }))) {
+            payload.instancesToDelete = [];
+        }
+        else {
+            permissionsNeeded.push("firebaseextensions.instances.delete");
+        }
+    }
+    await requirePermissions_1.requirePermissions(options, permissionsNeeded);
+}
+exports.prepare = prepare;
+const matchesInstanceId = (dep) => (test) => {
+    return dep.instanceId === test.instanceId;
+};
+const isUpdate = (dep) => (test) => {
+    return dep.instanceId === test.instanceId && !refs.equal(dep.ref, test.ref);
+};
+const isConfigure = (dep) => (test) => {
+    return dep.instanceId === test.instanceId && refs.equal(dep.ref, test.ref);
+};

package/lib/deploy/extensions/release.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.release = void 0;
+const queue_1 = require("../../throttler/queue");
+const tasks = require("./tasks");
+const error_1 = require("../../error");
+const errors_1 = require("./errors");
+const projectUtils_1 = require("../../projectUtils");
+async function release(context, options, payload) {
+    var _a, _b, _c, _d;
+    const projectId = projectUtils_1.needProjectId(options);
+    const errorHandler = new errors_1.ErrorHandler();
+    const deploymentQueue = new queue_1.default({
+        retries: 5,
+        concurrency: 5,
+        handler: tasks.extensionsDeploymentHandler(errorHandler),
+    });
+    for (const creation of (_a = payload.instancesToCreate) !== null && _a !== void 0 ? _a : []) {
+        const task = tasks.createExtensionInstanceTask(projectId, creation);
+        void deploymentQueue.run(task);
+    }
+    for (const update of (_b = payload.instancesToUpdate) !== null && _b !== void 0 ? _b : []) {
+        const task = tasks.updateExtensionInstanceTask(projectId, update);
+        void deploymentQueue.run(task);
+    }
+    for (const update of (_c = payload.instancesToConfigure) !== null && _c !== void 0 ? _c : []) {
+        const task = tasks.configureExtensionInstanceTask(projectId, update);
+        void deploymentQueue.run(task);
+    }
+    for (const deletion of (_d = payload.instancesToDelete) !== null && _d !== void 0 ? _d : []) {
+        const task = tasks.deleteExtensionInstanceTask(projectId, deletion);
+        void deploymentQueue.run(task);
+    }
+    const deploymentPromise = deploymentQueue.wait();
+    deploymentQueue.process();
+    deploymentQueue.close();
+    await deploymentPromise;
+    if (errorHandler.hasErrors()) {
+        errorHandler.print();
+        throw new error_1.FirebaseError(`Extensions deployment failed.`);
+    }
+}
+exports.release = release;

package/lib/deploy/extensions/secrets.js

@@ -0,0 +1,150 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkSpecForSecrets = exports.handleSecretParams = void 0;
+const clc = require("cli-color");
+const secretUtils = require("../../extensions/secretsUtils");
+const secretManager = require("../../gcp/secretManager");
+const planner_1 = require("./planner");
+const askUserForParam_1 = require("../../extensions/askUserForParam");
+const extensionsApi_1 = require("../../extensions/extensionsApi");
+const error_1 = require("../../error");
+const logger_1 = require("../../logger");
+const utils_1 = require("../../utils");
+async function handleSecretParams(payload, have, nonInteractive) {
+    var _a, _b, _c;
+    for (const i of (_a = payload.instancesToCreate) !== null && _a !== void 0 ? _a : []) {
+        if (await checkSpecForSecrets(i)) {
+            utils_1.logLabeledBullet("extensions", `Verifying secret params for ${clc.bold(i.instanceId)}`);
+            await handleSecretsCreateInstance(i, nonInteractive);
+        }
+    }
+    const updates = [...((_b = payload.instancesToUpdate) !== null && _b !== void 0 ? _b : []), ...((_c = payload.instancesToConfigure) !== null && _c !== void 0 ? _c : [])];
+    for (const i of updates) {
+        if (await checkSpecForSecrets(i)) {
+            utils_1.logLabeledBullet("extensions", `Verifying secret params for ${clc.bold(i.instanceId)}`);
+            const previousSpec = have.find((h) => h.instanceId === i.instanceId);
+            await handleSecretsUpdateInstance(i, previousSpec, nonInteractive);
+        }
+    }
+}
+exports.handleSecretParams = handleSecretParams;
+async function checkSpecForSecrets(i) {
+    const extensionVersion = await planner_1.getExtensionVersion(i);
+    return secretUtils.usesSecrets(extensionVersion.spec);
+}
+exports.checkSpecForSecrets = checkSpecForSecrets;
+const secretsInSpec = (spec) => {
+    return spec.params.filter((p) => p.type === extensionsApi_1.ParamType.SECRET);
+};
+async function handleSecretsCreateInstance(i, nonInteractive) {
+    const extensionVersion = await planner_1.getExtensionVersion(i);
+    const secretParams = secretsInSpec(extensionVersion.spec);
+    for (const s of secretParams) {
+        await handleSecretParamForCreate(s, i, nonInteractive);
+    }
+}
+async function handleSecretsUpdateInstance(i, prevSpec, nonInteractive) {
+    const extensionVersion = await planner_1.getExtensionVersion(i);
+    const prevExtensionVersion = await planner_1.getExtensionVersion(prevSpec);
+    const secretParams = secretsInSpec(extensionVersion.spec);
+    for (const s of secretParams) {
+        const prevParam = prevExtensionVersion.spec.params.find((p) => p.param === s.param);
+        if ((prevParam === null || prevParam === void 0 ? void 0 : prevParam.type) === extensionsApi_1.ParamType.SECRET && prevSpec.params[prevParam === null || prevParam === void 0 ? void 0 : prevParam.param]) {
+            await handleSecretParamForUpdate(s, i, prevSpec.params[prevParam === null || prevParam === void 0 ? void 0 : prevParam.param], nonInteractive);
+        }
+        else {
+            await handleSecretParamForCreate(s, i, nonInteractive);
+        }
+    }
+}
+async function handleSecretParamForCreate(secretParam, i, nonInteractive) {
+    var _a;
+    const providedValue = i.params[secretParam.param];
+    if (!providedValue) {
+        return;
+    }
+    const [, projectId, , secretName, , version] = providedValue.split("/");
+    if (!projectId || !secretName || !version) {
+        throw new error_1.FirebaseError(`${clc.bold(i.instanceId)}: Found '${providedValue}' for secret param ${secretParam.param}, but expected a secret version.`);
+    }
+    const secretInfo = await getSecretInfo(projectId, secretName, version);
+    if (!secretInfo.secret) {
+        await promptForCreateSecret({
+            projectId,
+            secretName,
+            instanceId: i.instanceId,
+            secretParam,
+            nonInteractive,
+        });
+        return;
+    }
+    else if (!secretInfo.secretVersion) {
+        throw new error_1.FirebaseError(`${clc.bold(i.instanceId)}: Found '${providedValue}' for secret param ${secretParam.param}. ` +
+            `projects/${projectId}/secrets/${secretName} exists, but version ${version} does not. ` +
+            `See more information about this secret at ${secretManager.secretManagerConsoleUri(projectId)}`);
+    }
+    if (!!((_a = secretInfo === null || secretInfo === void 0 ? void 0 : secretInfo.secret) === null || _a === void 0 ? void 0 : _a.labels) &&
+        !!(secretInfo === null || secretInfo === void 0 ? void 0 : secretInfo.secret.labels[secretUtils.SECRET_LABEL]) &&
+        secretInfo.secret.labels[secretUtils.SECRET_LABEL] !== i.instanceId) {
+        throw new error_1.FirebaseError(`${clc.bold(i.instanceId)}: Found '${providedValue}' for secret param ${secretParam.param}. ` +
+            `projects/${projectId}/secrets/${secretName} is managed by a different extension instance (${secretInfo.secret.labels[secretUtils.SECRET_LABEL]}), so reusing it here can lead to unexpected behavior. ` +
+            "Please choose a different name for this secret, and rerun this command.");
+    }
+    await secretUtils.grantFirexServiceAgentSecretAdminRole(secretInfo.secret);
+}
+async function handleSecretParamForUpdate(secretParam, i, prevValue, nonInteractive) {
+    const providedValue = i.params[secretParam.param];
+    if (!providedValue) {
+        return;
+    }
+    const [, projectId, , secretName, , version] = providedValue.split("/");
+    if (!projectId || !secretName || !version) {
+        throw new error_1.FirebaseError(`${clc.bold(i.instanceId)}: Found '${providedValue}' for secret param ${secretParam.param}, but expected a secret version.`);
+    }
+    const [, prevProjectId, , prevSecretName] = prevValue.split("/");
+    if (prevSecretName !== secretName) {
+        throw new error_1.FirebaseError(`${clc.bold(i.instanceId)}: Found '${providedValue}' for secret param ${secretParam.param}, ` +
+            `but this instance was previously using a different secret projects/${prevProjectId}/secrets/${prevSecretName}.\n` +
+            `Changing secrets is not supported. If you want to change the value of this secret, ` +
+            `use a new version of projects/${prevProjectId}/secrets/${prevSecretName}.` +
+            `You can create a new version at ${secretManager.secretManagerConsoleUri(projectId)}`);
+    }
+    const secretInfo = await getSecretInfo(projectId, secretName, version);
+    if (!secretInfo.secret) {
+        i.params[secretParam.param] = await promptForCreateSecret({
+            projectId,
+            secretName,
+            instanceId: i.instanceId,
+            secretParam,
+            nonInteractive,
+        });
+        return;
+    }
+    else if (!secretInfo.secretVersion) {
+        throw new error_1.FirebaseError(`${clc.bold(i.instanceId)}: Found '${providedValue}' for secret param ${secretParam.param}. ` +
+            `projects/${projectId}/secrets/${secretName} exists, but version ${version} does not. ` +
+            `See more information about this secret at ${secretManager.secretManagerConsoleUri(projectId)}`);
+    }
+    i.params[secretParam.param] = secretManager.toSecretVersionResourceName(secretInfo.secretVersion);
+    await secretUtils.grantFirexServiceAgentSecretAdminRole(secretInfo.secret);
+}
+async function getSecretInfo(projectId, secretName, version) {
+    const secretInfo = {};
+    try {
+        secretInfo.secret = await secretManager.getSecret(projectId, secretName);
+        secretInfo.secretVersion = await secretManager.getSecretVersion(projectId, secretName, version);
+    }
+    catch (err) {
+        if (err.status !== 404) {
+            throw err;
+        }
+    }
+    return secretInfo;
+}
+async function promptForCreateSecret(args) {
+    logger_1.logger.info(`${clc.bold(args.instanceId)}: Secret ${args.projectId}/${args.secretName} doesn't exist yet.`);
+    if (args.nonInteractive) {
+        throw new error_1.FirebaseError(`To create this secret, run this command in interactive mode, or go to ${secretManager.secretManagerConsoleUri(args.projectId)}`);
+    }
+    return askUserForParam_1.promptCreateSecret(args.projectId, args.instanceId, args.secretParam, args.secretName);
+}

package/lib/deploy/extensions/tasks.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deleteExtensionInstanceTask = exports.configureExtensionInstanceTask = exports.updateExtensionInstanceTask = exports.createExtensionInstanceTask = exports.extensionsDeploymentHandler = void 0;
+const clc = require("cli-color");
+const extensionsApi = require("../../extensions/extensionsApi");
+const refs = require("../../extensions/refs");
+const utils = require("../../utils");
+const isRetryable = (err) => err.status == 429 || err.status == 409;
+function extensionsDeploymentHandler(errorHandler) {
+    return async (task) => {
+        var _a, _b, _c, _d;
+        let result;
+        try {
+            result = await task.run();
+        }
+        catch (err) {
+            if (isRetryable(err)) {
+                throw err;
+            }
+            errorHandler.record(task.spec.instanceId, task.type, (_d = (_c = (_b = (_a = err.context) === null || _a === void 0 ? void 0 : _a.body) === null || _b === void 0 ? void 0 : _b.error) === null || _c === void 0 ? void 0 : _c.message) !== null && _d !== void 0 ? _d : err);
+        }
+        return result;
+    };
+}
+exports.extensionsDeploymentHandler = extensionsDeploymentHandler;
+function createExtensionInstanceTask(projectId, instanceSpec, validateOnly = false) {
+    const run = async () => {
+        const res = await extensionsApi.createInstance({
+            projectId,
+            instanceId: instanceSpec.instanceId,
+            params: instanceSpec.params,
+            extensionVersionRef: refs.toExtensionVersionRef(instanceSpec.ref),
+            validateOnly,
+        });
+        printSuccess(instanceSpec.instanceId, "create", validateOnly);
+        return;
+    };
+    return {
+        run,
+        spec: instanceSpec,
+        type: "create",
+    };
+}
+exports.createExtensionInstanceTask = createExtensionInstanceTask;
+function updateExtensionInstanceTask(projectId, instanceSpec, validateOnly = false) {
+    const run = async () => {
+        const res = await extensionsApi.updateInstanceFromRegistry({
+            projectId,
+            instanceId: instanceSpec.instanceId,
+            extRef: refs.toExtensionVersionRef(instanceSpec.ref),
+            params: instanceSpec.params,
+            validateOnly,
+        });
+        printSuccess(instanceSpec.instanceId, "update", validateOnly);
+        return;
+    };
+    return {
+        run,
+        spec: instanceSpec,
+        type: "update",
+    };
+}
+exports.updateExtensionInstanceTask = updateExtensionInstanceTask;
+function configureExtensionInstanceTask(projectId, instanceSpec, validateOnly = false) {
+    const run = async () => {
+        const res = await extensionsApi.configureInstance({
+            projectId,
+            instanceId: instanceSpec.instanceId,
+            params: instanceSpec.params,
+            validateOnly,
+        });
+        printSuccess(instanceSpec.instanceId, "configure", validateOnly);
+        return;
+    };
+    return {
+        run,
+        spec: instanceSpec,
+        type: "configure",
+    };
+}
+exports.configureExtensionInstanceTask = configureExtensionInstanceTask;
+function deleteExtensionInstanceTask(projectId, instanceSpec) {
+    const run = async () => {
+        const res = await extensionsApi.deleteInstance(projectId, instanceSpec.instanceId);
+        printSuccess(instanceSpec.instanceId, "delete", false);
+        return;
+    };
+    return {
+        run,
+        spec: instanceSpec,
+        type: "delete",
+    };
+}
+exports.deleteExtensionInstanceTask = deleteExtensionInstanceTask;
+function printSuccess(instanceId, type, validateOnly) {
+    const action = validateOnly ? `validated ${type} for` : `${type}d`;
+    utils.logSuccess(clc.bold.green("extensions") + ` Successfully ${action} ${instanceId}`);
+}