Find better home for defaultServiceAccount fn.

firebase · taeold · Feb 3, 2022 · Dec 15, 2021 · Dec 16, 2021 · Dec 16, 2021
commit 3403bb9de7cc61910fa319866b66322f462833bc
diff --git a/src/deploy/functions/ensure.ts b/src/deploy/functions/ensure.ts
@@ -4,15 +4,32 @@ import { ensure } from "../../ensureApiEnabled";
 import { FirebaseError, isBillingError } from "../../error";
 import { logLabeledBullet, logLabeledSuccess } from "../../utils";
 import { ensureServiceAgentRole } from "../../gcp/secretManager";
-import { defaultServiceAccount } from "../../gcp/cloudfunctions";
 import { previews } from "../../previews";
+import { getFirebaseProject } from "../../management/projects";
+import { assertExhaustive } from "../../functional";
 import * as track from "../../track";
 import * as backend from "./backend";
 import * as ensureApiEnabled from "../../ensureApiEnabled";
 
 const FAQ_URL = "https://firebase.google.com/support/faq#functions-runtime";
 const CLOUD_BUILD_API = "cloudbuild.googleapis.com";
 
+/**
+ * By default:
+ * 1. GCFv1 uses App Engine default service account.
+ * 2. GCFv2 (Cloud Run) uses Compute Engine default service account.
+ */
+export async function defaultServiceAccount(e: backend.Endpoint): Promise<string> {
+ const metadata = await getFirebaseProject(e.project);
+ if (e.platform === "gcfv1") {
+ return `${metadata.projectId}@appspot.gserviceaccount.com`;
+ } else if (e.platform === "gcfv2") {
+ return `${metadata.projectNumber}[email protected]`;
+ }
+ assertExhaustive(e.platform);
+}
+
+
 function nodeBillingError(projectId: string): FirebaseError {
  track("functions_runtime_notices", "nodejs10_billing_error");
  return new FirebaseError(
@@ -88,7 +105,7 @@ export async function maybeEnableAR(projectId: string): Promise<boolean> {
 async function secretsToServiceAccounts(b: backend.Backend): Promise<Record<string, Set<string>>> {
  const secretsToSa: Record<string, Set<string>> = {};
  for (const e of backend.allEndpoints(b)) {
- const sa = e.serviceAccountEmail || (await defaultServiceAccount(e));
+ const sa = e.serviceAccountEmail || (await module.exports.defaultServiceAccount(e));
  for (const s of e.secretEnvironmentVariables! || []) {
  const serviceAccounts = secretsToSa[s.secret] || new Set();
  serviceAccounts.add(sa);

diff --git a/src/deploy/functions/prepare.ts b/src/deploy/functions/prepare.ts
@@ -184,7 +184,7 @@ export async function prepare(
  await promptForFailurePolicies(options, matchingBackend, haveBackend);
  await promptForMinInstances(options, matchingBackend, haveBackend);
  await backend.checkAvailability(context, wantBackend);
- await validate.secretsAreValid(projectId, matchingBackend, haveBackend);
+ await validate.secretsAreValid(projectId, matchingBackend);
  await ensure.secretAccess(projectId, matchingBackend, haveBackend);
 }
 

diff --git a/src/gcp/cloudfunctions.ts b/src/gcp/cloudfunctions.ts
@@ -593,18 +593,3 @@ export function functionFromEndpoint(
 
  return gcfFunction;
 }
-
-/**
- * By default:
- * 1. GCFv1 uses App Engine default service account.
- * 2. GCFv2 (Cloud Run) uses Compute Engine default service account.
- */
-export async function defaultServiceAccount(e: backend.Endpoint): Promise<string> {
- const metadata = await getFirebaseProject(e.project);
- if (e.platform === "gcfv1") {
- return `${metadata.projectId}@appspot.gserviceaccount.com`;
- } else if (e.platform === "gcfv2") {
- return `${metadata.projectNumber}[email protected]`;
- }
- assertExhaustive(e.platform);
-}
diff --git a/src/test/deploy/functions/ensure.spec.ts b/src/test/deploy/functions/ensure.spec.ts
@@ -10,7 +10,6 @@ import * as api from "../../../api";
 import * as backend from "../../../deploy/functions/backend";
 import * as ensure from "../../../deploy/functions/ensure";
 import * as secretManager from "../../../gcp/secretManager";
-import * as cloudfunctions from "../../../gcp/cloudfunctions";
 
 describe("ensureCloudBuildEnabled()", () => {
  let restoreInterval: number;
@@ -174,7 +173,7 @@ describe("ensureSecretAccess", () => {
 
  beforeEach(() => {
  defaultServiceAccountStub = sinon
- .stub(cloudfunctions, "defaultServiceAccount")
+ .stub(ensure, "defaultServiceAccount")
  .resolves(DEFAULT_SA);
  secretManagerMock = sinon.mock(secretManager);
  });