Use Case
I am using Firebase JS SDK to access Cloud Firestore from Browser, so that I can push UI Logs and Errors into Firestore.
Issue
It was all working fine until I, accidentally, deleted most of the Service Accounts in my Google Cloud Platform inside APIs & Services → Credentials.
Below is the sample Config that we use for a Firebase Web App:
<script src="https://www.gstatic.com/firebasejs/7.13.1/firebase-app.js"></script>
<script>
// Your web app's Firebase configuration
var firebaseConfig = {
apiKey: "AIzaSyCztfcT6k6yXXXXXXXXXXXXXXXXXX",
authDomain: "<some-domain>.firebaseapp.com",
databaseURL: "https://<some-domain>.firebaseio.com",
projectId: "<some-domain>",
storageBucket: "<some-domain>.appspot.com",
messagingSenderId: "877458876543",
appId: "1:877458876543:web:9a9287dee234cd655ab7f2"
};
// Initialize Firebase
firebase.initializeApp(firebaseConfig);
</script>
I even tried reading Firebase Service Accounts Overview, but could not decide which Service Account to use for Firestore. Then, I tried adding different Service Accounts according to my Project ID and giving them Owner permissions to my Project, but it didn't work.
Full Error I am getting in Browser's Console:
Uncaught (in promise) FirebaseError: Missing or insufficient permissions.
at new Hr (https://www.gstatic.com/firebasejs/7.8.2/firebase-firestore.js:1:48219)
at https://www.gstatic.com/firebasejs/7.8.2/firebase-firestore.js:1:378673
at wr.<anonymous> (https://www.gstatic.com/firebasejs/7.8.2/firebase-firestore.js:1:377569)
at Wt (https://www.gstatic.com/firebasejs/7.8.2/firebase-firestore.js:1:15221)
at wr.S.dispatchEvent (https://www.gstatic.com/firebasejs/7.8.2/firebase-firestore.js:1:16063)
at Er.ua (https://www.gstatic.com/firebasejs/7.8.2/firebase-firestore.js:1:45322)
at nr.S.Fa (https://www.gstatic.com/firebasejs/7.8.2/firebase-firestore.js:1:43229)
at Ge (https://www.gstatic.com/firebasejs/7.8.2/firebase-firestore.js:1:21453)
at qe (https://www.gstatic.com/firebasejs/7.8.2/firebase-firestore.js:1:20854)
at Me.S.Ja (https://www.gstatic.com/firebasejs/7.8.2/firebase-firestore.js:1:23264)
Actually, I want to cleanup my Service Accounts as there were many created by myself. Please guide in telling which Service Account to use and what suitable Permissions to give.
Firestore Security Rules depend on a service account named service-PROJECT_NUMBER#firebase-rules.iam.gserviceaccount.com with the role
roles/firebaserules.system. You can use gcloud to restore this account:
gcloud projects add-iam-policy-binding PROJECT_ID --member=serviceAccount:service-PROJECT_NUMBER#firebase-rules.iam.gserviceaccount.com --role=roles/firebaserules.system
To get the project number, see Identifying projects.
Related
I have just manually key in all the data in my firebase realtime database. But when i run my application (using react native expo), i get the following warning in my terminal:
[2023-02-06T09:53:41.782Z] #firebase/database: FIREBASE WARNING: Database lives in a different region. Please change your database URL to https://******-default-rtdb.asia-southeast1.firebasedatabase.app (https://*******-default-rtdb.firebaseio.com/)
What does this means? Does it means my firebase realtime database wont work at all?
Also I did a checked on my firebase realtime database URL, the url is the same as the one they ask me to change to before the URL in the bracket. What does this means? I am confused by this.
If I have to change the URL to the bracket one, how do i do it?
My current firebase config: I copied this from the firebase when I first started developing this app
Update following your comment and question update: It appears that your Firebase config object doesn't contain the URL of your Realtime Database instance.
You didn't share your Firebase config object but it seems that it contains the URL of Realtime Database instance based in the default region, i.e. the us-central1 region.
So you need to update your Firebase config object with the correct URL, corresponding to the asia-southeast1 region.
const firebaseConfig = {
apiKey: "API_KEY",
authDomain: "PROJECT_ID.firebaseapp.com",
// The value of `databaseURL` depends on the location of the database
databaseURL: "https://******-default-rtdb.asia-southeast1.firebasedatabase.app",
projectId: "PROJECT_ID",
// ...
};
I would like to test the Google Cloud Speech-to-Text API from within Firebase Emulators. I currently have a trigger set on Firebase Storage that automatically gets fired when I upload a file via the Emulator Storage UI. This makes a request to the Speech to Text API, but I keep getting a permission denied error, as follows:
Error: 7 PERMISSION_DENIED: Cloud Speech-to-Text API has not been used in project 563584335869 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/speech.googleapis.com/overview?project=563584335869 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.
I understand that project 563584335869 is the Firebase Cli project.
I have set the following environment variables when starting the emulator:
export GCLOUD_PROJECT=my-actual-glcloud-project-id && export FIREBASE_AUTH_EMULATOR_HOST='localhost:9099' && export GOOGLE_APPLICATION_CREDENTIALS=./path/to/service-account.json &&
firebase emulators:start
The service_account.json key file is associated with a service_account that has the following roles, as demonstrated by running
gcloud projects get-iam-policy my_project_id --flatten="bindings[].members" --format='table(bindings.role)' --filter="bindings.members:serviceAccount:my_service_account#my_project_id.iam.gserviceaccount.com"
ROLE
roles/speech.admin
roles/storage.admin
roles/storage.objectAdmin
roles/storage.objectCreator
roles/storage.objectViewer
Since the credentials for the service account I am using should have admin access to the speech to text api, why do I keep getting a permission denied error when running from the emulator, and how can I fix it?
The project id 563584335869 is not yours. It is firebase-cli cloud project’s project-id. In this case, the problem is arising because you have to set your own configuration using your credentials or your key.
You can see below a code for NodeJS which I found in github[1] where it shows how to configure your authentication to use the API.
// Imports the Google Cloud client library
const textToSpeech = require('#google-cloud/text-to-speech');
// Create the auth config
const config = {
projectId: 'grape-spaceship-123',
keyFilename: '/path/to/keyfile.json'
};
// Creates a client
const client = new textToSpeech.TextToSpeechClient(config);
[1]https://github.com/googleapis/nodejs-text-to-speech/issues/26
EDIT
There are different ways to set up your authentication for speech to text. One way to resolve this problem would be to add the same auth configuration as the Text-to-Speech and it should look something like this in your code.
// Imports the Google Cloud client library
const speech = require('#google-cloud/speech');
// Create the auth config
const authconfig = {
projectId: 'grape-spaceship-123',
keyFilename: '/path/to/keyfile.json'
};
// Creates a client
const client = new speech.SpeechClient(authconfig);
Another way to solve this problem according to this Google Cloud Documentation[2] is to setup your authentication.
[2]https://cloud.google.com/speech-to-text/docs/libraries#setting_up_authentication
I just started implementing push notifications in Expo - following the guides on expo.io. Hence, I created an Android app in my Firebase console and my app.json contains now a reference to the Google service file:
"android": {
"package": "------------",
"googleServicesFile": "./google-services.json",
"useNextNotificationsApi": true,
}
If I test this on a real android device (standalone app) I do not receive a valid token via this function:
token = (await Notifications.getExpoPushTokenAsync()).data;
Instead I get the following error:
Error: Encountered an exception while calling native method: Exception
occured while executing exported method getDevicePushTokenAsync on
module ExpoPushTokenManager: Please set your project ID. A valid
Firebase project ID is required to communicate with Firebase server
APIs: It identifies your project with Google."
I guess it has something to do with the way of my project setup. I also followed the Expo guides to setup firebase (e.g. for phone authentication) and hence created a web app in the Firebase console. In my application I initialize the Firebase web app with my web app configuration like this:
const FIREBASE_CONFIG: IFirebaseOptions = {
apiKey: '--------',
authDomain: --------.firebaseapp.com',
databaseURL: 'https://--------.firebaseio.com',
projectId: '--------',
storageBucket: '--------.appspot.com',
messagingSenderId: '--------',
appId: '--------',
measurementId: '',
trackingId: '',
};
firebase.initializeApp(FIREBASE_CONFIG);
The FIREBASE_CONFIG (for my Firebase Web App) as well as the google-services.json (for my Firebase Android App) have the correct project ID. Do I need to initialize the Firebase Android App somehow?
I am using Expo SDK 40.0.1.
What helped me: I deleted the old Firebase Android App, created a new one, downloaded the google-services.json file and built a new version of my app: It worked.
I cannot come up with an explanation why the first Firebase Android App was faulty because I did not make anything different than I did now.
Hopefully that will help some of you as well.
Hey I got this same issue with my react native project. Actually it was working fine but one day this error popped up so I checked the last working version of my files.
The actual issue was with the version of my google services in the gradle file.
Instead on 3.0.0, I have changed it to "classpath 'com.google.gms:google-services:4.3.8'".
I am trying to write a function that writes to a different database when a user writes to the default database ,
I did my research and i am a little bit confused
I saw this on firebase
var admin = require('firebase-admin');
var serviceAccount =
require('path/to/serviceAccountKey.json');
admin.initializeApp({
credential: admin.credential.cert(serviceAccount),
databaseURL:
'https://<DATABASE_NAME>.firebaseio.com'
});
And also this
const app1 = firebase.initializeApp({
databaseURL: "https://testapp-1234-1.firebaseio.com"
});
const app2 = firebase.initializeApp({
databaseURL: "https://testapp-1234-2.firebaseio.com"
}, 'app2');
// Get the default database instance for an app1
var database1 = firebase.database();
// Get a database instance for app2
var database1 = firebase.database(app2);
So my question is do we need the service.json file which holds the secret key when using cloud functions admin SDK
For almost all typical use cases, you don't need to provide a service account when working with the Firebase Admin SDK in Cloud Functions. This is because Cloud Functions provides the credentials for the default service account in the project where the function is deployed. (This account can be seen as the App Engine default service account in the Cloud console.)
It's strongly recommended to initialize the Admin SDK with no arguments and accept this default account:
const admin = require('firebase-admin');
admin.initializeApp(); // accept the default service account
As part of taking this default, the Admin SDK will also understand the URL of your default Realtime Database shard, and the URL of your default Cloud Storage bucket. You won't need to provide these values. As such, your code will be much more easy to port to other projects.
If you need to access non-default resources of your project, you can also initialize other instances of firebase-admin to point to those that you explicitly configure. This is what your second code sample is illustrating. If you don't have any non-default resources to access, then don't bother with this.
If there is something that the service account can do, you can grant that role in the Cloud console. The one notable action that this account currently can't perform by default is cryptographic signing of blobs. In practical terms, this means it can't generate signed URLs for object stored in Cloud Storage. This is a fairly common thing to do in Cloud Functions. To remedy this, you need to grant the signBlob role to the default service account.
Taking my first steps with Firebase. Just a few pointers to documents explaining what is going on will help.
I have set up a new firebase web project and connected my dev environment with the firebase sdk. Now when I drop the email-password quickstart into the project it works. (after enabling email/password sign in.)
But wait: This quickstart html file does not contain any configuration that the firebase console tells me to paste:
var config = {
apiKey: "xxx",
authDomain: "xxx.xxx.com",
databaseURL: "https://xxx.xxx.com",
projectId: "xxxx",
storageBucket: "xxx.xxx.com",
messagingSenderId: "xxx"
};
Does the local firebase server add the configuration in the background? When and where do I have to add this configuration to web pages?
If you check line 35 of that quickstart, you'll find this magic include:
<script src="/__/firebase/init.js"></script>
This is an auto-generated file by Firebase Hosting, that contains precisely the code that initializes the connection to the Firebase backend services of your project.
If you'd like to learn more about it, read:
Easier configuration for Firebase on the web
SDK imports and automatic initialization
SDK auto-configuration