feat: Add service mapping and defensive global region check for v2 Auth Eventarc triggers

src/deploy/functions/services/authEventarc.spec.ts

@@ -0,0 +1,47 @@
+import { expect } from "chai";
+import { Endpoint } from "../backend";
+import * as authEventarc from "./authEventarc";
+
+const projectNumber = "123456789";
+
+const endpoint: Endpoint = {
+  id: "endpoint",
+  region: "us-central1",
+  project: projectNumber,
+  eventTrigger: {
+    retry: false,
+    eventType: "google.firebase.auth.user.v2.created",
+    eventFilters: {},
+  },
+  entryPoint: "endpoint",
+  platform: "gcfv2",
+  runtime: "nodejs16",
+};
+
+describe("ensureAuthEventarcTriggerRegion", () => {
+  it("should set the trigger location to global", async () => {
+    const ep = { ...endpoint, eventTrigger: { ...endpoint.eventTrigger } };
+
+    await authEventarc.ensureAuthEventarcTriggerRegion(ep);
+
+    expect(ep.eventTrigger.region).to.eq("global");
+  });
+
+  it("should not error if the trigger location is global", async () => {
+    const ep = { ...endpoint, eventTrigger: { ...endpoint.eventTrigger } };
+    ep.eventTrigger.region = "global";
+
+    await authEventarc.ensureAuthEventarcTriggerRegion(ep);
+
+    expect(ep.eventTrigger.region).to.eq("global");
+  });
+
+  it("should error if the trigger location is not global", () => {
+    const ep = { ...endpoint, eventTrigger: { ...endpoint.eventTrigger } };
+    ep.eventTrigger.region = "us-west1";
+
+    expect(() => authEventarc.ensureAuthEventarcTriggerRegion(ep)).to.throw(
+      "A Firebase Auth Eventarc trigger must specify 'global' trigger location",
+    );
+  });
+});

src/deploy/functions/services/authEventarc.ts

@@ -0,0 +1,20 @@
+import * as backend from "../backend";
+import { FirebaseError } from "../../../error";
+
+/**
+ * Sets a Firebase Auth Eventarc event trigger's region to 'global' since the service is global.
+ * @param endpoint the auth eventarc endpoint
+ */
+export function ensureAuthEventarcTriggerRegion(
+  endpoint: backend.Endpoint & backend.EventTriggered,
+): Promise<void> {
+  if (!endpoint.eventTrigger.region) {
+    endpoint.eventTrigger.region = "global";
+  }
+  if (endpoint.eventTrigger.region !== "global") {
+    throw new FirebaseError(
+      "A Firebase Auth Eventarc trigger must specify 'global' trigger location",
+    );
+  }
+  return Promise.resolve();
+}

src/deploy/functions/services/index.ts

@@ -24,6 +24,7 @@
   getDefaultRegion as ensureDataConnectDefaultRegion,
 } from "./dataconnect";
 import { AILogicService } from "./ailogic";
+import { ensureAuthEventarcTriggerRegion } from "./authEventarc";
 
 /** A standard void No Op */
 export const noop = (): Promise<void> => Promise.resolve();
@@ -49,7 +50,8 @@
   | "testlab"
   | "firestore"
   | "dataconnect"
-  | "ailogic";
+  | "ailogic"
+  | "autheventarc";
 
 /** A service interface for the underlying GCP event services */
 export interface Service {
@@ -71,7 +73,7 @@
   name: "noop",
   api: "",
   ensureTriggerRegion: noop,
   validateTrigger: noop,
   registerTrigger: noop,
   unregisterTrigger: noop,
   getDefaultRegion: () => Promise.resolve(FALLBACK_DEPLOYMENT_REGION),
@@ -83,7 +85,7 @@
   api: "pubsub.googleapis.com",
   requiredProjectBindings: noopProjectBindings,
   ensureTriggerRegion: noop,
   validateTrigger: noop,
   registerTrigger: noop,
   unregisterTrigger: noop,
   getDefaultRegion: () => Promise.resolve(DEFAULT_GLOBAL_TRIGGER_REGION),
@@ -95,7 +97,7 @@
   api: "storage.googleapis.com",
   requiredProjectBindings: obtainStorageBindings,
   ensureTriggerRegion: ensureStorageTriggerRegion,
   validateTrigger: noop,
   registerTrigger: noop,
   unregisterTrigger: noop,
   getDefaultRegion: ensureStorageDefaultRegion,
@@ -107,7 +109,7 @@
   api: "firebasealerts.googleapis.com",
   requiredProjectBindings: noopProjectBindings,
   ensureTriggerRegion: ensureFirebaseAlertsTriggerRegion,
   validateTrigger: noop,
   registerTrigger: noop,
   unregisterTrigger: noop,
   getDefaultRegion: () => Promise.resolve(DEFAULT_GLOBAL_TRIGGER_REGION),
@@ -123,7 +125,7 @@
   api: "firebasedatabase.googleapis.com",
   requiredProjectBindings: noopProjectBindings,
   ensureTriggerRegion: ensureDatabaseTriggerRegion,
   validateTrigger: noop,
   registerTrigger: noop,
   unregisterTrigger: noop,
   getDefaultRegion: ensureDatabaseDefaultRegion,
@@ -135,7 +137,7 @@
   api: "firebaseremoteconfig.googleapis.com",
   requiredProjectBindings: noopProjectBindings,
   ensureTriggerRegion: ensureRemoteConfigTriggerRegion,
   validateTrigger: noop,
   registerTrigger: noop,
   unregisterTrigger: noop,
   getDefaultRegion: () => Promise.resolve(DEFAULT_GLOBAL_TRIGGER_REGION),
@@ -147,7 +149,7 @@
   api: "testing.googleapis.com",
   requiredProjectBindings: noopProjectBindings,
   ensureTriggerRegion: ensureTestLabTriggerRegion,
   validateTrigger: noop,
   registerTrigger: noop,
   unregisterTrigger: noop,
   getDefaultRegion: () => Promise.resolve(DEFAULT_GLOBAL_TRIGGER_REGION),
@@ -159,7 +161,7 @@
   api: "firestore.googleapis.com",
   requiredProjectBindings: noopProjectBindings,
   ensureTriggerRegion: ensureFirestoreTriggerRegion,
   validateTrigger: noop,
   registerTrigger: noop,
   unregisterTrigger: noop,
   getDefaultRegion: ensureFirestoreDefaultRegion,
@@ -171,12 +173,24 @@
   api: "firebasedataconnect.googleapis.com",
   requiredProjectBindings: noopProjectBindings,
   ensureTriggerRegion: ensureDataConnectTriggerRegion,
   validateTrigger: noop,
   registerTrigger: noop,
   unregisterTrigger: noop,
   getDefaultRegion: ensureDataConnectDefaultRegion,
 };
 
+/** A Firebase Auth Eventarc service object */
+const authEventarcService: Service = {
+  name: "autheventarc",
+  api: "eventarc.googleapis.com",
+  requiredProjectBindings: noopProjectBindings,
+  ensureTriggerRegion: ensureAuthEventarcTriggerRegion,
+  validateTrigger: noop,
+  registerTrigger: noop,
+  unregisterTrigger: noop,
+  getDefaultRegion: () => Promise.resolve(DEFAULT_GLOBAL_TRIGGER_REGION),
+};
+
 /** Mapping from event type string to service object */
 // TODO: See if there's a way to deduplicate these consts while still ensuring type safety and exhaustion
 const EVENT_SERVICE_MAPPING: Record<events.Event, Service> = {
@@ -207,6 +221,8 @@
   "google.firebase.dataconnect.connector.v1.mutationExecuted": dataconnectService,
   "google.firebase.ailogic.v1.beforeGenerate": aiLogicService,
   "google.firebase.ailogic.v1.afterGenerate": aiLogicService,
+  "google.firebase.auth.user.v2.created": authEventarcService,
+  "google.firebase.auth.user.v2.deleted": authEventarcService,
 };
 
 export function serviceForEndpoint(endpoint: backend.Endpoint | build.Endpoint): Service {

src/functions/events/v2.ts

@@ -41,6 +41,11 @@ export const FIREALERTS_EVENT = "google.firebase.firebasealerts.alerts.v1.publis
 
 export const DATACONNECT_EVENT = "google.firebase.dataconnect.connector.v1.mutationExecuted";
 
+export const AUTH_EVENTS = [
+  "google.firebase.auth.user.v2.created",
+  "google.firebase.auth.user.v2.deleted",
+] as const;
+
 export type Event =
   | typeof PUBSUB_PUBLISH_EVENT
   | (typeof STORAGE_EVENTS)[number]
@@ -51,7 +56,8 @@ export type Event =
   | (typeof FIRESTORE_EVENTS)[number]
   | typeof FIREALERTS_EVENT
   | typeof DATACONNECT_EVENT
-  | (typeof AI_LOGIC_EVENTS)[number];
+  | (typeof AI_LOGIC_EVENTS)[number]
+  | (typeof AUTH_EVENTS)[number];
 
 // Why can't auth context be removed? This is map was added to correct a bug where a regex
 // allowed any non-auth type to be converted to any auth type, but we should follow up for why