Update functions CLI to support deploying onGraphRequest functions.

src/deploy/functions/prepare.ts

@@ -97,7 +97,7 @@
   let runtimeConfig: Record<string, unknown> = { firebase: firebaseConfig };
   const allowFunctionsConfig = experiments.isEnabled("legacyRuntimeConfigCommands");
 
   const targetedCodebaseConfigs = context.config!.filter((cfg) => codebases.includes(cfg.codebase));
 
   // Load runtime config if API is enabled and at least one targeted codebase uses it
   if (
@@ -112,6 +112,7 @@
   // This drives GA4 metric `has_runtime_config` in the functions deploy reporter.
   context.hasRuntimeConfig = Object.keys(runtimeConfig).some((k) => k !== "firebase");
 
+  // TODO: Modify to also load dataconnect schema if `onGraphRequest` is used with `schemaFilePath`?
   const wantBuilds = await loadCodebases(
     context.config,
     options,
@@ -395,7 +396,7 @@
     .filter(
       (ep) =>
         backend.isBlockingTriggered(ep) &&
         AUTH_BLOCKING_EVENTS.includes(ep.blockingTrigger.eventType as any),
     ) as (backend.Endpoint & backend.BlockingTriggered)[];
 
   if (authBlockingEndpoints.length === 0) {
@@ -516,7 +517,7 @@
 // Genkit almost always requires an API key, so warn if the customer is about to deploy
 // a function and doesn't have one. To avoid repetitive nagging, only warn on the first
 // deploy of the function.
 export async function warnIfNewGenkitFunctionIsMissingSecrets(
   have: backend.Backend,
   want: backend.Backend,
   options: DeployOptions,
@@ -550,7 +551,7 @@
 
 // Enable required APIs. This may come implicitly from triggers (e.g. scheduled triggers
 // require cloudscheduler and, in v1, require pub/sub), use of features (secrets), or explicit dependencies.
 export async function ensureAllRequiredAPIsEnabled(
   projectNumber: string,
   wantBackend: backend.Backend,
 ): Promise<void> {

src/deploy/functions/services/dataconnect.ts

@@ -1,5 +1,9 @@
 import * as backend from "../backend";
+import { dataconnectOrigin } from "../../../api";
 import { FirebaseError } from "../../../error";
+import { iam } from "../../../gcp";
+
+const CLOUD_RUN_INVOKER_ROLE = "roles/cloudrun.invoker";
 
 /**
  * Sets a Firebase Data Connect event trigger's region to the function region.
@@ -18,3 +22,28 @@ export function ensureDataConnectTriggerRegion(
   }
   return Promise.resolve();
 }
+
+function getServiceAccount(projectNumber: string): string {
+  if (dataconnectOrigin().includes("autopush")) {
+    return `service-${projectNumber}@gcp-sa-autopush-dataconnect.iam.gserviceaccount.com`;
+  }
+  if (dataconnectOrigin().includes("staging")) {
+    return `service-${projectNumber}@gcp-sa-staging-dataconnect.iam.gserviceaccount.com`;
+  }
+  return `service-${projectNumber}@gcp-sa-firebasedataconnect.iam.gserviceaccount.com`;
+}
+
+/**
+ * Finds the required project level IAM bindings for the Firebase Data Connect service agent
+ * @param projectNumber project identifier
+ */
+export async function obtainDataConnectBindings(
+  projectNumber: string,
+): Promise<Array<iam.Binding>> {
+  const dataConnectServiceAgent = `serviceAccount:${getServiceAccount(projectNumber)}`;
+  const cloudRunInvokerBinding = {
+    role: CLOUD_RUN_INVOKER_ROLE,
+    members: [dataConnectServiceAgent],
+  };
+  return [cloudRunInvokerBinding];
+}

src/deploy/functions/services/index.ts

@@ -8,7 +8,7 @@
 import { ensureRemoteConfigTriggerRegion } from "./remoteConfig";
 import { ensureTestLabTriggerRegion } from "./testLab";
 import { ensureFirestoreTriggerRegion } from "./firestore";
-import { ensureDataConnectTriggerRegion } from "./dataconnect";
+import { ensureDataConnectTriggerRegion, obtainDataConnectBindings } from "./dataconnect";
 
 /** A standard void No Op */
 export const noop = (): Promise<void> => Promise.resolve();
@@ -47,7 +47,7 @@
   name: "noop",
   api: "",
   ensureTriggerRegion: noop,
   validateTrigger: noop,
   registerTrigger: noop,
   unregisterTrigger: noop,
 };
@@ -58,7 +58,7 @@
   api: "pubsub.googleapis.com",
   requiredProjectBindings: noopProjectBindings,
   ensureTriggerRegion: noop,
   validateTrigger: noop,
   registerTrigger: noop,
   unregisterTrigger: noop,
 };
@@ -69,7 +69,7 @@
   api: "storage.googleapis.com",
   requiredProjectBindings: obtainStorageBindings,
   ensureTriggerRegion: ensureStorageTriggerRegion,
   validateTrigger: noop,
   registerTrigger: noop,
   unregisterTrigger: noop,
 };
@@ -136,7 +136,7 @@
 const dataconnectService: Service = {
   name: "dataconnect",
   api: "firebasedataconnect.googleapis.com",
-  requiredProjectBindings: noopProjectBindings,
+  requiredProjectBindings: obtainDataConnectBindings,
   ensureTriggerRegion: ensureDataConnectTriggerRegion,
   validateTrigger: noop,
   registerTrigger: noop,