403 调用者没有 Firebase Management API addFirebase 的权限

Question

我想通过 Firebase Management Api 添加 Firebase 项目。所以为此。我在 Google Cloud Platform 控制台上做了项目。并以所有者的身份创建了具有权限的服务帐户。

我尝试为addFirebase阅读和创建项目 throw google api explorer并且它有效。但是当我尝试通过我的代码做同样的事情时，它成功读取了availableProject并给出了输出

{ "projectInfo": [ { "project": "projects/firebase-api-238012", "displayName": "Firebase-Api" } ] }

但是当我尝试添加项目时，它给了我这个错误

{ "error": { "code": 403, "message": "调用方没有权限", "status": "PERMISSION_DENIED" } }

我不知道为什么它没有创建项目。它需要什么其他权限。以及为什么它允许我首先阅读可用的项目。

这是我如何尝试添加我的项目。

jwt.js

const { google } = require('googleapis');
var serviceAccountJwt = require('./Firebase-Api-b0e41b85ad44.json');

exports.connect = async () => {
return new Promise((resolve, reject) => {

    // scope is based on what is needed in our api
    const scope = ['https://www.googleapis.com/auth/firebase', 'https://www.googleapis.com/auth/cloud-platform'];

    // create our client with the service account JWT
    const { client_email, private_key } = serviceAccountJwt;
    const client = new google.auth.JWT(client_email, null, private_key, scope, null);

    // perform authorization and resolve with the client

    return client.authorize((err) => {
        if (err) { reject(err) }
        else {
            resolve(client)
        };
    });
});

}

index.js 文件

const { google } = require('googleapis');
const request = require('request');
const { connect } = require('./jwt');
const availableProjects = 'https://firebase.googleapis.com/v1beta1/availableProjects';


async function getAccessToken() {
let client = await connect();
let accessToken = await client.getAccessToken();
let res = await getProjects(accessToken.token)
}

getAccessToken().catch(err => {
console.log(JSON.stringify(err))
})

const bodys = {
"timeZone": "America/Los_Angeles",
"locationId": "asia-south1",
"regionCode": "US"
}

async function getProjects(accesstoken) {

let options = {
url: availableProjects,
headers: {
  'Authorization': 'Bearer ' + accesstoken,
  'Accept': 'application/json',
  'Content-Type': 'application/json'
}
}

return request(options, async function (err, res) {
if (err) {
  console.error(err + " error");
 } else {
  //here it gives successful output
  console.log("response")
  console.log(res.body);
  let bodyJson = JSON.parse(res.body);
  let projectName = bodyJson.projectInfo[0].project;
  console.log(projectName)
  await addProject(accesstoken, projectName)
  return res.body;
 }
 });
 }

async function addProject(accesstoken, projecctID) {

 fbUrl = getAddFBUrl(projecctID);
 let options = {
 url: fbUrl,
  headers: {
  'Authorization': 'Bearer ' + accesstoken,
  'Accept': 'application/json',
  'Content-Type': 'application/json'
  },
  body:JSON.stringify(bodys)
 }

return request.post(options, function (err, res) {
 if (err) {
  console.error(err + " error");
 } else {
//here in response out put as permission denied 403
  console.log("response")
  console.log(res.body);
  console.log(JSON.stringify(res));
  return res.body;
 }

 });
}


function getAddFBUrl(projectId) {
return 'https://firebase.googleapis.com/v1beta1/' + projectId + 
':addFirebase';
}

我发现了一个类似的问题。但这并没有帮助我解决这里的问题

AskFirebase

Answer 1

来自 Firebase REST 参考：方法：projects.addFirebase

要调用 projects.addFirebase，成员必须是现有 GCP 项目的编辑者或所有者。服务帐号不能调用 projects.addFirebase。

更新：

要调用 projects.addFirebase，项目成员或服务帐号必须具有以下权限（Editor 和 Owner 的 IAM 角色包含这些权限）：firebase.projects.update、resourcemanager.projects.get、serviceusage.services.enable 和 serviceusage .services.get。

https://firebase.google.com/docs/projects/api/reference/rest/v1beta1/projects/addFirebase