Database Rules Deploy ignores instance

samtstern commented 3 years ago

[REQUIRED] Environment info

firebase-tools: 9.2.0

Platform: macOs

[REQUIRED] Test case

I have a project, fir-dumpster with three databases:

https://fir-dumpster.firebaseio.com/ (default)
https://fir-dumpster-europe.europe-west1.firebasedatabase.app/
https://fir-dumpster-secondary.firebaseio.com/ firebase.json
```
{
"database": {
"rules": "database.rules.json"
}
}
```

[REQUIRED] Steps to reproduce

Try to deploy rules to the second instance using this command:

firebase --debug deploy --only database:fir-dumpster-europe

[REQUIRED] Expected behavior

Update the rules of fir-dumpster-europe.europe-west1.firebasedatabase.app

[REQUIRED] Actual behavior

Deploys to the default instance, see logs below:

``` $ firebase --debug deploy --only database:fir-dumpster-europe [2021-01-29T11:55:08.788Z] > command requires scopes: ["email","openid","https://www.googleapis.com/auth/cloudplatformprojects.readonly","https://www.googleapis.com/auth/firebase","https://www.googleapis.com/auth/cloud-platform"] [2021-01-29T11:55:08.790Z] > authorizing via signed-in user [2021-01-29T11:55:08.790Z] [iam] checking project fir-dumpster for permissions ["firebase.projects.get","firebasedatabase.instances.update"] [2021-01-29T11:55:08.793Z] >>> HTTP REQUEST POST https://cloudresourcemanager.googleapis.com/v1/projects/fir-dumpster:testIamPermissions {"permissions":["firebase.projects.get","firebasedatabase.instances.update"]} [2021-01-29T11:55:18.361Z] [iam] error while checking permissions, command may fail: FirebaseError: Server Error. Client network socket disconnected before secure TLS connection was established [2021-01-29T11:55:18.363Z] > refreshing access token with scopes: [] [2021-01-29T11:55:18.363Z] >>> HTTP REQUEST POST https://www.googleapis.com/oauth2/v3/token [2021-01-29T11:55:18.635Z] <<< HTTP RESPONSE 200 {"date":"Fri, 29 Jan 2021 11:55:18 GMT","cache-control":"no-cache, no-store, max-age=0, must-revalidate","expires":"Mon, 01 Jan 1990 00:00:00 GMT","pragma":"no-cache","content-type":"application/json; charset=utf-8","vary":"X-Origin, Referer, Origin,Accept-Encoding","server":"scaffolding on HTTPServer2","x-xss-protection":"0","x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","alt-svc":"h3-29=\":443\"; ma=2592000,h3-T051=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\"","accept-ranges":"none","transfer-encoding":"chunked"} [2021-01-29T11:55:18.680Z] >>> [apiv2][query] GET https://firebase.googleapis.com/v1beta1/projects/fir-dumpster [none] [2021-01-29T11:55:19.029Z] <<< [apiv2][status] GET https://firebase.googleapis.com/v1beta1/projects/fir-dumpster 200 [2021-01-29T11:55:19.029Z] <<< [apiv2][body] GET https://firebase.googleapis.com/v1beta1/projects/fir-dumpster {"projectId":"fir-dumpster","projectNumber":"733471010301","displayName":"FirebaseDumpster","name":"projects/fir-dumpster","resources":{"hostingSite":"fir-dumpster","realtimeDatabaseInstance":"fir-dumpster","storageBucket":"fir-dumpster.appspot.com","locationId":"us-central"},"state":"ACTIVE"} === Deploying to 'fir-dumpster'... i deploying database i database: checking rules syntax... [2021-01-29T11:55:19.033Z] > refreshing access token with scopes: ["email","https://www.googleapis.com/auth/cloud-platform","https://www.googleapis.com/auth/cloudplatformprojects.readonly","https://www.googleapis.com/auth/firebase","openid"] [2021-01-29T11:55:19.033Z] >>> HTTP REQUEST POST https://www.googleapis.com/oauth2/v3/token [2021-01-29T11:55:19.307Z] <<< HTTP RESPONSE 200 {"cache-control":"no-cache, no-store, max-age=0, must-revalidate","date":"Fri, 29 Jan 2021 11:55:19 GMT","pragma":"no-cache","expires":"Mon, 01 Jan 1990 00:00:00 GMT","content-type":"application/json; charset=utf-8","vary":"X-Origin, Referer, Origin,Accept-Encoding","server":"scaffolding on HTTPServer2","x-xss-protection":"0","x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","alt-svc":"h3-29=\":443\"; ma=2592000,h3-T051=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\"","accept-ranges":"none","transfer-encoding":"chunked"} [2021-01-29T11:55:19.342Z] >>> HTTP REQUEST GET https://firebasedatabase.googleapis.com/v1beta/projects/fir-dumpster/locations/-/instances/fir-dumpster [2021-01-29T11:55:19.808Z] <<< HTTP RESPONSE 200 {"content-type":"application/json; charset=UTF-8","vary":"X-Origin, Referer, Origin,Accept-Encoding","date":"Fri, 29 Jan 2021 11:55:19 GMT","server":"ESF","cache-control":"private","x-xss-protection":"0","x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","alt-svc":"h3-29=\":443\"; ma=2592000,h3-T051=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\"","accept-ranges":"none","transfer-encoding":"chunked"} [2021-01-29T11:55:19.811Z] >>> HTTP REQUEST PUT https://fir-dumpster.firebaseio.com/.settings/rules.json?dryRun=true { "rules": { ".read": "true", ".write": "false", "sub": { ".read": "true", ".write": "false" } } } [2021-01-29T11:55:21.666Z] <<< HTTP RESPONSE 200 {"server":"nginx","date":"Fri, 29 Jan 2021 11:55:21 GMT","content-type":"application/json; charset=utf-8","content-length":"15","connection":"keep-alive","access-control-allow-origin":"*","cache-control":"no-cache","strict-transport-security":"max-age=31556926; includeSubDomains; preload"} ✔ database: rules syntax for database fir-dumpster is valid i database: releasing rules... [2021-01-29T11:55:21.668Z] >>> HTTP REQUEST GET https://firebasedatabase.googleapis.com/v1beta/projects/fir-dumpster/locations/-/instances/fir-dumpster [2021-01-29T11:55:22.119Z] <<< HTTP RESPONSE 200 {"content-type":"application/json; charset=UTF-8","vary":"X-Origin, Referer, Origin,Accept-Encoding","date":"Fri, 29 Jan 2021 11:55:22 GMT","server":"ESF","cache-control":"private","x-xss-protection":"0","x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","alt-svc":"h3-29=\":443\"; ma=2592000,h3-T051=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\"","accept-ranges":"none","transfer-encoding":"chunked"} [2021-01-29T11:55:22.121Z] >>> HTTP REQUEST PUT https://fir-dumpster.firebaseio.com/.settings/rules.json { "rules": { ".read": "true", ".write": "false", "sub": { ".read": "true", ".write": "false" } } } [2021-01-29T11:55:22.688Z] <<< HTTP RESPONSE 200 {"server":"nginx","date":"Fri, 29 Jan 2021 11:55:22 GMT","content-type":"application/json; charset=utf-8","content-length":"15","connection":"keep-alive","access-control-allow-origin":"*","cache-control":"no-cache","strict-transport-security":"max-age=31556926; includeSubDomains; preload"} ✔ database: rules for database fir-dumpster released successfully ✔ Deploy complete! Project Console: https://console.firebase.google.com/project/fir-dumpster/overview ```

samtstern commented 3 years ago

It seems like changing my firebase.json to the following makes the deploy do what I want:

{
  "database": [
    {
      "instance": "fir-dumpster-europe",
      "rules": "database.rules.json"
    }
  ]
}

So it's possible this is not a bug but more of a question: should I be able to deploy the default database.rules to a particular RTDB instance by specifying it with the database:instanceName syntax at the command line?

jungalwala commented 3 years ago

Some more details on why it seems like this is unexpected behavior. Consider the following firebase.json file:

{
  "database": [
    {
      "instance": "fir-dumpster-europe",
      "rules": "database.rules.json"
    }, 
    {
      "instance": "fir-dumpster-asia",
      "rules": "database.rules.json"
    }
  ]
}

If I run the command: firebase --debug deploy --only database:fir-dumpster-europe

It will update fir-dumster-asia also, even though I specify --only database:fir-dumpster-europe

FabriceBazzaro commented 11 months ago

For the next users who end up on this page like me, after a dig in documentation and a lot of tests, the name after database: is a target name, not an instance name.

You need to create targets (group of instances per example) and you can after deploy rules only for one of these targets using the command you specified. https://firebase.google.com/docs/cli/targets

firebase / firebase-tools