Discovering project ID from the local metadata service (#755)

hiranya911 · web-flow · commit 2cfa51add9af · 2020-01-10T14:19:45.000-08:00
* Discovering project ID from the local metadata service

* Minor refactoring for variable names and comments
diff --git a/src/auth/credential.ts b/src/auth/credential.ts
@@ -198,6 +198,7 @@ export class ComputeEngineCredential implements Credential {
 
   private readonly httpClient = new HttpClient();
   private readonly httpAgent?: Agent;
+  private projectId?: string;
 
   constructor(httpAgent?: Agent) {
     this.httpAgent = httpAgent;
@@ -209,10 +210,21 @@ export class ComputeEngineCredential implements Credential {
   }
 
   public getProjectId(): Promise<string> {
+    if (this.projectId) {
+      return Promise.resolve(this.projectId);
+    }
+
     const request = this.buildRequest(GOOGLE_METADATA_SERVICE_PROJECT_ID_PATH);
     return this.httpClient.send(request)
       .then((resp) => {
-        return resp.text!;
+        this.projectId = resp.text!;
+        return this.projectId;
+      })
+      .catch((err) => {
+        const detail: string = (err instanceof HttpError) ? getDetailFromResponse(err.response) : err.message;
+        throw new FirebaseAppError(
+          AppErrorCodes.INVALID_CREDENTIAL,
+          `Failed to determine project ID: ${detail}`);
       });
   }
 
diff --git a/src/firestore/firestore.ts b/src/firestore/firestore.ts
@@ -71,7 +71,7 @@ export function getFirestoreOptions(app: FirebaseApp): Settings {
     });
   }
 
-  const projectId: string | null = utils.getProjectId(app);
+  const projectId: string | null = utils.getExplicitProjectId(app);
   const credential = app.options.credential;
   const { version: firebaseVersion } = require('../../package.json');
   if (credential instanceof ServiceAccountCredential) {
@@ -80,8 +80,8 @@ export function getFirestoreOptions(app: FirebaseApp): Settings {
         private_key: credential.privateKey,
         client_email: credential.clientEmail,
       },
-      // When the SDK is initialized with ServiceAccountCredentials projectId is guaranteed to
-      // be available.
+      // When the SDK is initialized with ServiceAccountCredentials an explicit projectId is
+      // guaranteed to be available.
       projectId: projectId!,
       firebaseVersion,
     };
diff --git a/src/storage/storage.ts b/src/storage/storage.ts
@@ -71,12 +71,12 @@ export class Storage implements FirebaseServiceInterface {
       });
     }
 
-    const projectId: string | null = utils.getProjectId(app);
+    const projectId: string | null = utils.getExplicitProjectId(app);
     const credential = app.options.credential;
     if (credential instanceof ServiceAccountCredential) {
       this.storageClient = new storage({
-        // When the SDK is initialized with ServiceAccountCredentials projectId is guaranteed to
-        // be available.
+        // When the SDK is initialized with ServiceAccountCredentials an explicit projectId is
+        // guaranteed to be available.
         projectId: projectId!,
         credentials: {
           private_key: credential.privateKey,
diff --git a/src/utils/index.ts b/src/utils/index.ts
@@ -15,7 +15,7 @@
  */
 
 import {FirebaseApp, FirebaseAppOptions} from '../firebase-app';
-import {ServiceAccountCredential} from '../auth/credential';
+import {ServiceAccountCredential, ComputeEngineCredential} from '../auth/credential';
 
 import * as validator from './validator';
 
@@ -56,14 +56,15 @@ export function addReadonlyGetter(obj: object, prop: string, value: any): void {
 }
 
 /**
- * Determines the Google Cloud project ID associated with a Firebase app by examining
- * the Firebase app options, credentials and the local environment in that order.
+ * Returns the Google Cloud project ID associated with a Firebase app, if it's explicitly
+ * specified in either the Firebase app options, credentials or the local environment.
+ * Otherwise returns null.
  *
  * @param {FirebaseApp} app A Firebase app to get the project ID from.
  *
  * @return {string} A project ID string or null.
  */
-export function getProjectId(app: FirebaseApp): string | null {
+export function getExplicitProjectId(app: FirebaseApp): string | null {
   const options: FirebaseAppOptions = app.options;
   if (validator.isNonEmptyString(options.projectId)) {
     return options.projectId;
@@ -82,17 +83,28 @@ export function getProjectId(app: FirebaseApp): string | null {
 }
 
 /**
- * Determines the Google Cloud project ID associated with a Firebase app by examining
- * the Firebase app options, credentials and the local environment in that order. This
- * is an async wrapper of the getProjectId method. This enables us to migrate the rest
- * of the SDK into asynchronously determining the current project ID. See b/143090254.
+ * Determines the Google Cloud project ID associated with a Firebase app. This method
+ * first checks if a project ID is explicitly specified in either the Firebase app options,
+ * credentials or the local environment in that order. If no explicit project ID is
+ * configured, but the SDK has been initialized with ComputeEngineCredentials, this
+ * method attempts to discover the project ID from the local metadata service.
  *
  * @param {FirebaseApp} app A Firebase app to get the project ID from.
  *
  * @return {Promise<string | null>} A project ID string or null.
  */
 export function findProjectId(app: FirebaseApp): Promise<string | null> {
-  return Promise.resolve(getProjectId(app));
+  const projectId = getExplicitProjectId(app);
+  if (projectId) {
+    return Promise.resolve(projectId);
+  }
+
+  const credential = app.options.credential;
+  if (credential instanceof ComputeEngineCredential) {
+    return credential.getProjectId();
+  }
+
+  return Promise.resolve(null);
 }
 
 /**
diff --git a/test/unit/auth/credential.spec.ts b/test/unit/auth/credential.spec.ts
@@ -36,6 +36,7 @@ import {
 } from '../../../src/auth/credential';
 import { HttpClient } from '../../../src/utils/api-request';
 import {Agent} from 'https';
+import { FirebaseAppError } from '../../../src/utils/error';
 
 chai.should();
 chai.use(sinonChai);
@@ -313,13 +314,13 @@ describe('Credential', () => {
     });
 
     it('should discover project id', () => {
-      const expected = 'test-project-id';
-      const response = utils.responseFrom(expected);
+      const expectedProjectId = 'test-project-id';
+      const response = utils.responseFrom(expectedProjectId);
       httpStub.resolves(response);
 
       const c = new ComputeEngineCredential();
       return c.getProjectId().then((projectId) => {
-        expect(projectId).to.equal(expected);
+        expect(projectId).to.equal(expectedProjectId);
         expect(httpStub).to.have.been.calledOnce.and.calledWith({
           method: 'GET',
           url: 'http://metadata.google.internal/computeMetadata/v1/project/project-id',
@@ -328,6 +329,47 @@ describe('Credential', () => {
         });
       });
     });
+
+    it('should cache discovered project id', () => {
+      const expectedProjectId = 'test-project-id';
+      const response = utils.responseFrom(expectedProjectId);
+      httpStub.resolves(response);
+
+      const c = new ComputeEngineCredential();
+      return c.getProjectId()
+        .then((projectId) => {
+          expect(projectId).to.equal(expectedProjectId);
+          return c.getProjectId();
+        })
+        .then((projectId) => {
+          expect(projectId).to.equal(expectedProjectId);
+          expect(httpStub).to.have.been.calledOnce.and.calledWith({
+            method: 'GET',
+            url: 'http://metadata.google.internal/computeMetadata/v1/project/project-id',
+            headers: {'Metadata-Flavor': 'Google'},
+            httpAgent: undefined,
+          });
+        });
+    });
+
+    it('should reject when the metadata service is not available', () => {
+      httpStub.rejects(new FirebaseAppError('network-error', 'Failed to connect'));
+
+      const c = new ComputeEngineCredential();
+      return c.getProjectId().should.eventually
+        .rejectedWith('Failed to determine project ID: Failed to connect')
+        .and.have.property('code', 'app/invalid-credential');
+    });
+
+    it('should reject when the metadata service responds with an error', () => {
+      const response = utils.errorFrom('Unexpected error');
+      httpStub.rejects(response);
+
+      const c = new ComputeEngineCredential();
+      return c.getProjectId().should.eventually
+        .rejectedWith('Failed to determine project ID: Unexpected error')
+        .and.have.property('code', 'app/invalid-credential');
+    });
   });
 
   describe('getApplicationDefault()', () => {
diff --git a/test/unit/utils/index.spec.ts b/test/unit/utils/index.spec.ts
@@ -16,13 +16,19 @@
 
 import * as _ from 'lodash';
 import {expect} from 'chai';
+import * as sinon from 'sinon';
 
 import * as mocks from '../../resources/mocks';
 import {
-  addReadonlyGetter, getProjectId, findProjectId, toWebSafeBase64, formatString, generateUpdateMask,
+  addReadonlyGetter, getExplicitProjectId, findProjectId,
+  toWebSafeBase64, formatString, generateUpdateMask,
 } from '../../../src/utils/index';
 import {isNonEmptyString} from '../../../src/utils/validator';
 import {FirebaseApp, FirebaseAppOptions} from '../../../src/firebase-app';
+import { ComputeEngineCredential } from '../../../src/auth/credential';
+import { HttpClient } from '../../../src/utils/api-request';
+import * as utils from '../utils';
+import { FirebaseAppError } from '../../../src/utils/error';
 
 interface Obj {
   [key: string]: any;
@@ -66,7 +72,7 @@ describe('toWebSafeBase64()', () => {
   });
 });
 
-describe('getProjectId()', () => {
+describe('getExplicitProjectId()', () => {
   let googleCloudProject: string | undefined;
   let gcloudProject: string | undefined;
 
@@ -95,37 +101,38 @@ describe('getProjectId()', () => {
       projectId: 'explicit-project-id',
     };
     const app: FirebaseApp = mocks.appWithOptions(options);
-    expect(getProjectId(app)).to.equal(options.projectId);
+    expect(getExplicitProjectId(app)).to.equal(options.projectId);
   });
 
   it('should return the project ID from service account', () => {
     const app: FirebaseApp = mocks.app();
-    expect(getProjectId(app)).to.equal('project_id');
+    expect(getExplicitProjectId(app)).to.equal('project_id');
   });
 
   it('should return the project ID set in GOOGLE_CLOUD_PROJECT environment variable', () => {
     process.env.GOOGLE_CLOUD_PROJECT = 'env-var-project-id';
     const app: FirebaseApp = mocks.mockCredentialApp();
-    expect(getProjectId(app)).to.equal('env-var-project-id');
+    expect(getExplicitProjectId(app)).to.equal('env-var-project-id');
   });
 
   it('should return the project ID set in GCLOUD_PROJECT environment variable', () => {
     process.env.GCLOUD_PROJECT = 'env-var-project-id';
     const app: FirebaseApp = mocks.mockCredentialApp();
-    expect(getProjectId(app)).to.equal('env-var-project-id');
+    expect(getExplicitProjectId(app)).to.equal('env-var-project-id');
   });
 
   it('should return null when project ID is not set', () => {
     delete process.env.GOOGLE_CLOUD_PROJECT;
     delete process.env.GCLOUD_PROJECT;
     const app: FirebaseApp = mocks.mockCredentialApp();
-    expect(getProjectId(app)).to.be.null;
+    expect(getExplicitProjectId(app)).to.be.null;
   });
 });
 
 describe('findProjectId()', () => {
   let googleCloudProject: string | undefined;
   let gcloudProject: string | undefined;
+  let httpStub: sinon.SinonStub;
 
   before(() => {
     googleCloudProject = process.env.GOOGLE_CLOUD_PROJECT;
@@ -146,6 +153,16 @@ describe('findProjectId()', () => {
     }
   });
 
+  beforeEach(() => {
+    delete process.env.GOOGLE_CLOUD_PROJECT;
+    delete process.env.GCLOUD_PROJECT;
+    httpStub = sinon.stub(HttpClient.prototype, 'send');
+  });
+
+  afterEach(() => {
+    httpStub.restore();
+  });
+
   it('should return the explicitly specified project ID from app options', () => {
     const options: FirebaseAppOptions = {
       credential: new mocks.MockCredential(),
@@ -172,9 +189,26 @@ describe('findProjectId()', () => {
     return findProjectId(app).should.eventually.equal('env-var-project-id');
   });
 
-  it('should return null when project ID is not set', () => {
-    delete process.env.GOOGLE_CLOUD_PROJECT;
-    delete process.env.GCLOUD_PROJECT;
+  it('should return the project ID discovered from the metadata service', () => {
+    const expectedProjectId = 'test-project-id';
+    const response = utils.responseFrom(expectedProjectId);
+    httpStub.resolves(response);
+    const app: FirebaseApp = mocks.appWithOptions({
+      credential: new ComputeEngineCredential(),
+    });
+    return findProjectId(app).should.eventually.equal(expectedProjectId);
+  });
+
+  it('should reject when the metadata service is not available', () => {
+    httpStub.rejects(new FirebaseAppError('network-error', 'Failed to connect'));
+    const app: FirebaseApp = mocks.appWithOptions({
+      credential: new ComputeEngineCredential(),
+    });
+    return findProjectId(app).should.eventually
+      .rejectedWith('Failed to determine project ID: Failed to connect');
+  });
+
+  it('should return null when project ID is not set and discoverable', () => {
     const app: FirebaseApp = mocks.mockCredentialApp();
     return findProjectId(app).should.eventually.be.null;
   });
