Accidentally expanded the required permissions for firebase use

CHANGELOG.md

@@ -1 +1,2 @@
 - Fixed issue where `firebase init firestore` would raise an error due to rules/indexes file path being undefined. (#8518)
+- Fixed an issue where `firebase use` required `serviceusage.viewer` permissions. (#8519)

src/ensureApiEnabled.ts

@@ -5,6 +5,7 @@
 import { Client } from "./apiv2";
 import * as utils from "./utils";
 import { FirebaseError, isBillingError } from "./error";
+import { logger } from "./logger";
 
 export const POLL_SETTINGS = {
   pollInterval: 10000,
@@ -49,7 +50,7 @@
  * Attempt to enable an API on the specified project (just once).
  *
  * If enabling an API for a customer, prefer `ensure` which will check for the
  * API first, which is a seperate permission than enabling.
  *
  * @param projectId The project in which to enable the API.
  * @param apiName The name of the API e.g. `someapi.googleapis.com`.
@@ -64,8 +65,8 @@
         skipLog: { resBody: true },
       },
     );
   } catch (err: any) {
     if (isBillingError(err)) {
       throw new FirebaseError(`Your project ${bold(
         projectId,
       )} must be on the Blaze (pay-as-you-go) plan to complete this command. Required API ${bold(
@@ -73,7 +74,7 @@
       )} can't be enabled until the upgrade is complete. To upgrade, visit the following URL:
 
 https://console.firebase.google.com/project/${projectId}/usage/details`);
     } else if (isPermissionError(err)) {
       const apiPermissionDeniedRegex = new RegExp(
         /Permission denied to enable service \[([.a-zA-Z]+)\]/,
       );
@@ -146,7 +147,7 @@
 }
 
 /**
  * Check if an API is enabled on a project, try to enable it if not with polling and retries.
  *
  * @param projectId The project on which to check enablement.
  * @param apiUri The name of the API e.g. `someapi.googleapis.com`.
@@ -173,9 +174,24 @@
   return enableApiWithRetries(projectId, hostname, prefix, silent);
 }
 
+export async function bestEffortEnsure(
+  projectId: string,
+  apiUri: string,
+  prefix: string,
+  silent = false,
+): Promise<void> {
+  try {
+    await ensure(projectId, apiUri, prefix, silent);
+  } catch (err: any) {
+    logger.debug(
+      `Unable to check that ${apiUri} is enabled on ${projectId}. Calls to it will fail if it is not enabled`,
+    );
+  }
+}
+
 /**
  * Returns a link to enable an API on a project in Cloud console. This can be used instead of ensure
  * in contexts where automatically enabling APIs is not desirable (ie emulator commands).
  *
  * @param projectId The project to generate an API enablement link for
  * @param apiName  The name of the API e.g. `someapi.googleapis.com`.

src/management/projects.ts

@@ -9,7 +9,7 @@
 import { logger } from "../logger";
 import * as utils from "../utils";
 import { FirebaseProjectMetadata, CloudProjectInfo, ProjectPage } from "../types/project";
-import { ensure } from "../ensureApiEnabled";
+import { bestEffortEnsure } from "../ensureApiEnabled";
 
 const TIMEOUT_MILLIS = 30000;
 const MAXIMUM_PROMPT_LIST = 100;
@@ -26,7 +26,7 @@
   type: ProjectParentResourceType;
 }
 
 export async function promptProjectCreation(): Promise<{ projectId: string; displayName: string }> {
   const projectId = await prompt.input({
     message:
       "Please specify a unique project id " +
@@ -70,7 +70,7 @@
   apiVersion: "v1",
 });
 
 export async function createFirebaseProjectAndLog(
   projectId: string,
   options: { displayName?: string; parentResource?: ProjectParentResource },
 ): Promise<FirebaseProjectMetadata> {
@@ -469,7 +469,7 @@
  * @param projectId
  */
 export async function getProject(projectId: string): Promise<ProjectInfo> {
-  await ensure(projectId, api.resourceManagerOrigin(), "firebase", true);
+  await bestEffortEnsure(projectId, api.resourceManagerOrigin(), "firebase", true);
   const response = await resourceManagerClient.get<ProjectInfo>(`/projects/${projectId}`);
   return response.body;
 }