来自环境变量而不是 Google Cloud Firestore 中的文件的私钥

Question

我需要从 Vercel 中托管的 Next.js 无服务器函数连接到 Google Cloud Firestore。我已经设置了一个服务帐户，但所有文档都依赖于作为文件的凭据，而我想使用环境变量（在 Vercel 平台中更自然）。

例子：

const Firestore = require('@google-cloud/firestore');

const firestore = new Firestore({
  projectId: 'YOUR_PROJECT_ID',
  keyFilename: '/path/to/keyfile.json',
});

我无法使用keyFilename，我宁愿明确传递服务帐户电子邮件和私钥。

Answer 1

工作代码：

const projectId = process.env.GOOGLE_PROJECT_ID;
const email = process.env.GOOGLE_SERVICE_ACCOUNT_EMAIL;
const key = process.env.GOOGLE_PRIVATE_KEY.replace(/\\n/g, '\n');

const Firestore = require('@google-cloud/firestore');
const firestore = new Firestore({
  projectId: projectId,
  credentials: {
    client_email: email,
    private_key: key,
  },
});

请注意，我的GOOGLE_PRIVATE_KEYenv var 有文字\ns，与 Google Cloud 的 JSON 完全相同，因此我用.replace()它来将它们转换为实际的换行符。这实际上只在我使用的本地环境中需要.env.local，因为 Vercel 环境变量可以采用实际的换行符。

来源

该settings对象（构造函数的参数Firestore()）的记录很少，但我自己通过 grep 源代码找到了它，我发现：

node_modules/@google-cloud/firestore/types/firestore.d.ts
Line 217:

/**
 * Settings used to directly configure a `Firestore` instance.
 */
export interface Settings {
  /**
   * The project ID from the Google Developer's Console, e.g.
   * 'grape-spaceship-123'. We will also check the environment variable
   * GCLOUD_PROJECT for your project ID.  Can be omitted in environments that
   * support {@link https://cloud.google.com/docs/authentication Application
   * Default Credentials}
   */
  projectId?: string;

  /** The hostname to connect to. */
  host?: string;

  /** The port to connect to. */
  port?: number;

  /**
   * Local file containing the Service Account credentials as downloaded from
   * the Google Developers Console. Can  be omitted in environments that
   * support {@link https://cloud.google.com/docs/authentication Application
   * Default Credentials}. To configure Firestore with custom credentials, use
   * the `credentials` property to provide the `client_email` and
   * `private_key` of your service account.
   */
  keyFilename?: string;

  /**
   * The 'client_email' and 'private_key' properties of the service account
   * to use with your Firestore project. Can be omitted in environments that
   * support {@link https://cloud.google.com/docs/authentication Application
   * Default Credentials}. If your credentials are stored in a JSON file, you
   * can specify a `keyFilename` instead.
   */
  credentials?: {client_email?: string; private_key?: string};

  /** Whether to use SSL when connecting. */
  ssl?: boolean;

  /**
   * The maximum number of idle GRPC channels to keep. A smaller number of idle
   * channels reduces memory usage but increases request latency for clients
   * with fluctuating request rates. If set to 0, shuts down all GRPC channels
   * when the client becomes idle. Defaults to 1.
   */
  maxIdleChannels?: number;

  /**
   * Whether to use `BigInt` for integer types when deserializing Firestore
   * Documents. Regardless of magnitude, all integer values are returned as
   * `BigInt` to match the precision of the Firestore backend. Floating point
   * numbers continue to use JavaScript's `number` type.
   */
  useBigInt?: boolean;

  /**
   * Whether to skip nested properties that are set to `undefined` during
   * object serialization. If set to `true`, these properties are skipped
   * and not written to Firestore. If set `false` or omitted, the SDK throws
   * an exception when it encounters properties of type `undefined`.
   */
  ignoreUndefinedProperties?: boolean;

  [key: string]: any; // Accept other properties, such as GRPC settings.
}