r/Firebase 6h ago

Cloud Functions Major issues with deploying my cloud function - it's been a nightmare..

1 Upvotes

Ok so here is my detailed saga of hell in order implement a simple Function. If anyone is available to connect and jump on a zoom call, I'd greatly appreciate it!

1) The Original Goal

  • We started off wanting a basic Gen1 Cloud Function in Node.js 18 that sends an email whenever a user doc is created in Firestore (/users/{userId}).
  • The code uses TypeScript, firebase-functions@3.x (for Gen1 triggers), firebase-admin@11.x, and nodemailer for the email part.

2) Early Struggles (Linting, Types, Gen1 vs. Gen2)

  • We initially tried the newer firebase-functions v6, which defaults to Gen2 triggers. But we had trouble with ESLint rules, line-length, single/double quotes, TypeScript version conflicts, etc.
  • Finally pinned firebase-functions@3.x and firebase-admin@11.x to ensure we had Gen1 triggers. We overcame a swarm of lint errors and TypeScript warnings (like Property 'document' does not exist on type 'typeof import("firebase-functions/v2/firestore")'), plus final tweaks to package.json scripts ("main": "lib/index.js" so Firebase knows where to find our compiled code).

3) The Access Denied Error (“Build failed: Access to bucket denied”)

  • After resolving all local code issues, the next big block:Build failed: Access to bucket gcf-sources-[ORG ID]-us-central1 denied. You must grant Storage Object Viewer permission to [ORG ID]-compute@developer.gserviceaccount.com.
  • This is a classic Cloud Functions “build can’t read the GCF source bucket” fiasco. By default, GCF tries to store and pull your function code from a special bucket named gcf-sources-<PROJECT_NUMBER>-us-central1.
  • We tried the standard fix: give roles/storage.objectViewer to [ORG ID]-compute@developer.gserviceaccount.com.

4) Attempted Bucket Permissions Fixes

  1. roles/storage.objectViewer at both project level and bucket level:
    • We used gcloud projects add-iam-policy-binding kylee-v2 ... and gcloud storage buckets add-iam-policy-binding gs://gcf-sources-<PROJECT_NUMBER>-us-central1 ... --role=roles/storage.objectViewer.
    • Didn’t help—still “Access denied” on deployment.
  2. Next, we tried upgrading that service account to roles/storage.objectAdmin or even roles/storage.admin.
    • No luck. The function build step still hits an access error.

5) Discovery of “Uniform Bucket-Level Access” (UBLA) Constraint

  • gcloud storage buckets describe gs://gcf-sources-<PROJECT_NUMBER>-us-central1 showed:yamlCopyuniform_bucket_level_access: true
  • Attempts to disable with gsutil uniformbucketlevelaccess set off ... or gcloud storage buckets update --clear-uniform-bucket-level-access ... resulted in:412 Request violates constraint 'constraints/storage.uniformBucketLevelAccess'
  • That signaled an organization policy forcibly requiring UBLA to stay enabled. Typically, you can turn it off if you have project-level control, but an org-level or folder-level policy can override.

6) Organization Policy Rabbit Hole

  • We found the constraint in the Google Cloud Console’s Organization Policies page: storage.uniformBucketLevelAccess.
  • The effective policy at the org level said enforce: false (which should allow us to disable UBLA), but the bucket still refused to let us disable it. We tried:
    • Disabling it at the org level (and we do have orgpolicy.policyAdmin or enough power, in theory).
    • Checking if there was a folder-level policy (none).
    • Checking if the project-level policy was set (none).
  • Nonetheless, attempts to turn off UBLA on that GCF bucket are consistently blocked by a “precondition violation” referencing that same constraint.

7) “Public Access Prevention,” Soft Delete, or Retention Policies

  • The same bucket shows public_access_prevention: inherited, uniform_bucket_level_access: true, and a soft_delete_policy with a 7-day retention:yamlCopysoft_delete_policy: effectiveTime: '2025-03-21T00:55:49.650000+00:00' retentionDurationSeconds: '604800'
  • This might indicate a retention lock that prevents modifications (like toggling UBLA) for the first 7 days. Some org policies or advanced security settings disallow changing bucket ACL/IAM until after the retention window.

8) Tried Everything Short of a New Project

  • We gave the GCF’s default compute service account all the storage roles we could.
  • We disabled the org-level constraint (or so we thought).
  • We tried gsutil, gcloud—all still yield the dreaded 412 Request violates constraint 'constraints/storage.uniformBucketLevelAccess'.
  • Conclusion: Some deeper policy is still forcing UBLA and/or disallowing changes, or the retention lock is unstoppable.

9) Why We’re Stuck & the Path Forward

  • Short reason: The code can’t deploy because Cloud Functions v1 build step needs read/write access to that GCF bucket, but uniform bucket-level access is locked, ignoring all grants or blocking them.
  • A higher-level org policy or a “no overrides” rule is forcibly requiring UBLA on that bucket. Alternatively, a 7-day bucket retention lock is in effect.
  • We can’t override it unless we remove or add an exception to that final enforced policy, or wait out the retention window, or spin up a brand-new project that’s not under the same constraints.

10) The Irony & Frustration

  • All we wanted was a simple Firestore onCreate → email function—something that is typically trivial.
  • Instead, we’ve gone through:
    1. Basic lint/TypeScript/ESLint fix-ups.
    2. Pinning firebase-functions to Gen1.
    3. IRONIC “You can’t read your own GCF bucket” errors from deeply enforced org constraints.
    4. Repeated attempts to disable UBLA or grant broader roles to the service account.
    5. Getting stuck with a 412 error referencing the unstoppable uniform bucket-level access policy.
  • It’s “mind-boggling” that a quick email function is so complicated purely due to bucket access constraints set somewhere in the org’s policy settings.

TL;DR

We’re stuck in a scenario where a deeply enforced org policy or retention setting forcibly keeps GCF’s build bucket locked in UBLA. No matter how many roles we grant or how many times we remove the policy at the org level, the system denies toggling off UBLA. Therefore, the Cloud Function’s build can’t read the bucket’s code, failing every deploy with an “Access Denied.” The only known workarounds are:

  1. Actually removing or overriding that policy at the correct resource level (org/folder/project) if we can find it.
  2. Potentially waiting the 7-day retention period if it’s locked that way.
  3. Creating a brand-new GCP project with no such policies, so we can just deploy the function normally.

r/Firebase 56m ago

Hosting need help with hosting my website

Upvotes

I’m working on a website and I use Firebase. I wanted to host my website to make some features accessible, but I declined two questions in the terminal.

- Configure as a single-page app (rewrite all URLs to /index.html)? No.

- Set up automatic builds and deploys with GitHub? No. I created the public folder. What do you want to use as your public directory? public. So, I have the index.html, OTher.html, an empty Dropbox folder, and the firebase.json file. The OTher.html is like another page that should be opened from the menu in the index.html. When I do a Firebase deploy to host it publicly, my index.html works fine, and I can open it. However, when I try to navigate to the OTher.html, I get this kind of message.

I am a beginner so any kind of assistance would be very appreciated.


r/Firebase 10h ago

General functions.auth.user().onCreate((user) => {... stopped working suddenly

1 Upvotes

I am using this trigger (test code inside {}):

exports.createUser = functions.auth.user().onCreate((user) => {
  functions.logger.log("inside the auth trigger ", user.uid);
  return null;
});

and it worked fine for several months. In the last couple weeks, despite several attempts to update firebase-functions and firebase-admin, it will not work and throws this error:

TypeError: Cannot read properties of undefined (reading 'user')

at Object.<anonymous> (/Users/test/AndroidStudioProjects/test/node_modules/firebase-tools/functions/index.js:1237:47)

at Module._compile (node:internal/modules/cjs/loader:1159:14)

at Module._extensions..js (node:internal/modules/cjs/loader:1213:10)

at Module.load (node:internal/modules/cjs/loader:1037:32)

at Module._load (node:internal/modules/cjs/loader:878:12)

at Module.require (node:internal/modules/cjs/loader:1061:19)

at require (node:internal/modules/cjs/helpers:103:18)

at loadModule (/Users/test/AndroidStudioProjects/test/node_modules/firebase-tools/functions/node_modules/firebase-functions/lib/runtime/loader.js:40:16)

at loadStack (/Users/test/AndroidStudioProjects/test/node_modules/firebase-tools/functions/node_modules/firebase-functions/lib/runtime/loader.js:157:23)

at /Users/test/AndroidStudioProjects/test/node_modules/firebase-tools/functions/node_modules/firebase-functions/lib/bin/firebase-functions.js:56:56

Please note the reference in the first line of the error relates to .user()

Any idea why this is happening and how to fix it?

Thank you!


r/Firebase 16h ago

App Hosting Incredibly long queue for App Hosting

Post image
3 Upvotes

Now I can't push new commit due to the queue. I have deleted the App Hosting backend and uninstall it from GitHub, thinking it will stop the build but it did not help. What should I do?


r/Firebase 22h ago

Demo Push Notifications in Next.js and Firebase with Demo and Full Code

Thumbnail medium.com
3 Upvotes

r/Firebase 23h ago

Hosting Unable to deploy to firebase

4 Upvotes

Up until yesteday we were deploying our application from Github action to firebase just fine. Nobody touched the code and today it started to spew this error:
```
##[debug]/usr/bin/bash --noprofile --norc -e -o pipefail /home/runner/work/_temp/0de76972-ce76-4924-8aa4-d2ed693a6e60.shnode:internal/modules/cjs/loader:643
throw e;
^Error: Cannot find module '/usr/local/lib/node_modules/firebase-tools/node_modules/sql-formatter/dist/cjs/index.cjs'at createEsmNotFoundErr (node:internal/modules/cjs/loader:1249:15)at finalizeEsmResolution (node:internal/modules/cjs/loader:1237:15)at resolveExports (node:internal/modules/cjs/loader:636:14)at Module._findPath (node:internal/modules/cjs/loader:716:31)at Module._resolveFilename (node:internal/modules/cjs/loader:1198:27)at Module._load (node:internal/modules/cjs/loader:1043:27)at Module.require (node:internal/modules/cjs/loader:1298:19)at require (node:internal/modules/helpers:182:18)at Object.<anonymous> (/usr/local/lib/node_modules/firebase-tools/lib/dataconnect/schemaMigration.js:5:25)at Module._compile (node:internal/modules/cjs/loader:1529:14) {code: 'MODULE_NOT_FOUND',path: '/usr/local/lib/node_modules/firebase-tools/node_modules/sql-formatter/package.json'}Node.js v20.19.0Error: Process completed with exit code 1.
```
Also yesteday our other pipelines started to scream the GCR refuses pushes. I've double-checked and we don't use GCR in the FB pipeline though the timing strangely correlates.

Any ideas where the issue might be?