Credentials still required when connecting to emulators

KevinShiCA commented 2 years ago

[READ] Step 1: Are you in the right place?

I think so!

[REQUIRED] Step 2: Describe your environment

Operating System version: macOS Big Sur 11.6
Firebase SDK version: N/A, but my firebase-tools is on 9.20.0
Library version: firebase.google.com/go/v4 v4.6.0
Firebase Product: auth/firestore + emulators

[REQUIRED] Step 3: Describe the problem

I am using firebase for auth + firestore + functions. I recently started migrating from a live development project to a local emulator suite with a fake demo project. My emulators are started using firebase emulators:start --project demo-test, such that it does not try to fall back on a real life project when emulators fail.

I use the Admin SDK in two different areas on the backend - the first is NodeJS, the second is in Go using firebase.google.com/go/v4 v4.6.0. I was successful in getting both backends to target the emulators by setting the FIREBASE_AUTH_EMULATOR_HOST and FIRESTORE_EMULATOR_HOST environment variables.

In NodeJS, I'm able to initialize the SDK using something like:

admin.initializeApp({
  // This project id has to equal the demo ID that the emulators are started with,
  // otherwise data will get written to a random location invisible to the emulator UI...
  // https://github.com/firebase/firebase-admin-node/issues/575#issuecomment-649160545
  projectId: 'demo-test',
});

I'm not specifying any credentials here, and the GOOGLE_APPLICATION_CREDENTIALS environment variable is unset. This works perfectly.

In Go, I tried to do the same (in production GOOGLE_APPLICATION_CREDENTIALS is set, but not in development):

    var config *firebase.Config

    if os.Getenv("ENVIRONMENT") == "development" {
        config = &firebase.Config{
            ProjectID: "demo-test",
        }
    }

    fb, err := firebase.NewApp(context.Background(), config)

However accessing any of the clients results in an error - the following copy paste is from fb.Auth() but fb.Firestore() does the same:

google: could not find default credentials. See https://developers.google.com/accounts/docs/application-default-credentials for more information.

If I set GOOGLE_APPLICATION_CREDENTIALS to point to a random service account json file that I had laying around, everything works properly on the Go side, but the emulator starts vomiting out the following warning:

⚠  Received service account token ya29.c.<redacted>.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... Assuming that it owns project "demo-test".

I assume this is because the Go SDK has read my random service account file and is sending it in requests to the emulators, which are getting ignored since the emulators are not secure.

Steps to reproduce:

Install firebase emulators for auth/firestore/functions (firestore and functions probably not even necessary, but that's my setup)
Start the emulators with --project demo-test (project ID is irrelevant, as long as it starts with demo-)
Write some minimal go code to connect to the admin sdk, specifying ProjectID: "demo-test" in the config
Run go code with environment variables FIREBASE_AUTH_EMULATOR_HOST and FIRESTORE_EMULATOR_HOST set, the default as localhost:9099 and localhost:8080 for auth and firestore respectively. Do NOT include http:// in these, since the Go library seems to prefix with it automatically.
SDK throws an error without making any requests to emulators
Download any service account from any firebase project (using garbage values may also work, haven't tested).
Set GOOGLE_APPLICATION_CREDENTIALS to point to the service account file
SDK now properly sends requests through to the emulator
Emulator responds properly to requests, but emits warnings in the logs that a service account token was received and ignored

IMO credentials should not be required when we're targeting emulators, especially since they show warnings when included.

Relevant Code:

Sample go code to run with and without the credentials env var set. The emulator host env vars must be set in all cases.

func bug() {
    fb, err := firebase.NewApp(context.Background(), &firebase.Config{ProjectId: "demo-test"})
    if err != nil {
        panic(err) // we don't get here
    }

    authClient, err := fb.Auth(context.Background())
    if err != nil {
        panic(err) // it breaks here
    }

    // use the auth client to do anything here and it will work when the credentials env var is set, but the emulator will show warnings
}

MaxWaterfall commented 2 years ago

I just came across the same problem. Looks like this has already been reported: https://github.com/firebase/firebase-admin-go/issues/458#issue-976355243 and fixed, but not yet released

KevinShiCA commented 2 years ago

@MaxWaterfall Awesome, nice find! Closing this issue then.

firebase / firebase-admin-go