Set public read during CDPStack creation about cdp-backend HOT 10 CLOSED

Seems like we can use the Firebase CLI to do this. So either a post-script thing or writing our own ComponentResource to do subprocess it out to the CLI

from cdp-backend.

This is now possible with the Pulumi 3.0 Google Native Provider:

https://www.pulumi.com/docs/reference/pkg/google-native/firebaserules/v1/ruleset/

I attempted it but it is finicky and tricky to get right / I may have been doing something incorrectly. Going to hold off until needed for research queries.

from cdp-backend.

Firestore public read rules:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read: if request.auth == null;
    }
  }
}

Firebase storage public read rules:

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read;
    }
  }
}

from cdp-backend.

Looks like the process for this will be:

1. create the rulesets with: https://www.pulumi.com/docs/reference/pkg/google-native/firebaserules/v1/ruleset/
2. use the rulesets in https://www.pulumi.com/docs/reference/pkg/google-native/firebaserules/v1/release/

It seems they may have updated the docs but it seems a bit more doable considering we can dump the text contents to a File object.

from cdp-backend.

Got it working! 🎉

I ditched trying to get Pulumi ruleset working and went with a simple node script

from cdp-backend.

Alright. I thought I had it working but when doing thorough testing, I saw that was failing to initialize the Firestore Security Rules.

Everything runs through just fine, all resources are technically created but Firestore Security Rules aren't being applied. They will only apply after visiting the Firestore Security Rules Web UI and then rerunning the set-public-read script. In some cases, I get an "entity does not exist" error.

I opened a ticket with Firebase Support so hopefully I will hear back soon.

from cdp-backend.

Was attempting to pull transcript files from bucket but ran into permissions error, apparently true public read isn't set on the bucket unless you have a bucket iam policy set:

# Set full public read on bucket
self.storage_public_read = storage.BucketIamPolicy(
    f"{self.gcp_project_id}-storage-public-read",
    bucket=self.firestore_app.default_bucket,
    bindings=[
        storage.BucketIamPolicyBindingsItemArgs(
            role="roles/storage.objectViewer",
            members=["allUsers"],
        ),
    ],
    opts=pulumi.ResourceOptions(parent=self.firestore_app),
)

from cdp-backend.

Tracking with Firebase support and pulumi/pulumi-google-native#196

from cdp-backend.

Also needs a CORS rule: https://firebase.google.com/docs/storage/web/download-files#download_data_via_url

from cdp-backend.

Parts of this (specifically the CORS) may be able to be completed with a Dynamic Provider: https://www.pulumi.com/blog/dynamic-providers/

from cdp-backend.