resolveCloudflareFirestoreServiceAccount function

Future<String> resolveCloudflareFirestoreServiceAccount(ExecContext context, { required String projectId, })

Resolves the service account JSON put as GOOGLE_SERVICE_ACCOUNT to the region Worker.

A non-empty firebase.firestore.service_account in katana_secrets.yaml takes precedence. Otherwise the Cloudflare Authentication / Messaging service account or a unique JSON file under cloudflare/ / android/ for projectId is used.

region WorkerにGOOGLE_SERVICE_ACCOUNTとして登録するサービスアカウントJSONを解決します。

katana_secrets.yamlのfirebase.firestore.service_accountが空でなければ優先します。 それ以外はCloudflareのAuthentication・Messaging用、またはcloudflare/・android/にある projectId用の一意なJSONファイルを使用します。

Implementation

Future<String> resolveCloudflareFirestoreServiceAccount(
  ExecContext context, {
  required String projectId,
}) async {
  final configured = context.secrets
      .getAsMap("firebase")
      .getAsMap("firestore")
      .get<Object?>("service_account", null);
  if (configured != null && configured is! String) {
    throw StateError(
      "[firebase]->[firestore]->[service_account] in katana_secrets.yaml must be a JSON string resolved for the selected flavor.",
    );
  }
  if (configured is String && configured.trim().isNotEmpty) {
    Object? decoded;
    try {
      decoded = jsonDecode(configured);
    } on FormatException {
      decoded = null;
    }
    if (decoded is! Map ||
        decoded["type"] != "service_account" ||
        decoded["client_email"] is! String ||
        decoded["private_key"] is! String) {
      throw StateError(
        "[firebase]->[firestore]->[service_account] in katana_secrets.yaml is not a valid service account JSON.",
      );
    }
    if (decoded["project_id"] != projectId) {
      throw StateError(
        "[firebase]->[firestore]->[service_account] does not match [firebase]->[project_id] for this flavor.",
      );
    }
    return configured;
  }
  return resolveCloudflareFirebaseServiceAccount(context, projectId: projectId);
}