fix: Set quota project ID for ADC human accounts

Author: lahirumaramba

src/app/credential-internal.ts

@@ -39,6 +39,7 @@ export class ApplicationDefaultCredential implements Credential {
   private readonly googleAuth: GoogleAuth;
   private authClient: AnyAuthClient;
   private projectId?: string;
+  private quotaProjectId?: string;
   private accountId?: string;
 
   constructor(httpAgent?: Agent) {
@@ -58,6 +59,7 @@ export class ApplicationDefaultCredential implements Credential {
     }
     await this.authClient.getAccessToken();
     const credentials = this.authClient.credentials;
+    this.quotaProjectId = this.authClient.quotaProjectId;
     return populateCredential(credentials);
   }
 
@@ -68,6 +70,13 @@ export class ApplicationDefaultCredential implements Credential {
     return Promise.resolve(this.projectId);
   }
 
+  public getQuotaProjectId(): string | undefined {
+    if (!this.quotaProjectId) {
+      this.quotaProjectId = this.authClient.quotaProjectId;
+    }
+    return this.quotaProjectId;
+  }
+
   public async isComputeEngineCredential(): Promise<boolean> {
     if (!this.authClient) {
       this.authClient = await this.googleAuth.getClient();

src/utils/api-request.ts

@@ -26,6 +26,7 @@ import url = require('url');
 import { EventEmitter } from 'events';
 import { Readable } from 'stream';
 import * as zlibmod from 'zlib';
+import { ApplicationDefaultCredential } from '../app/credential-internal';
 
 /** Http method type definition. */
 export type HttpMethod = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'HEAD';
@@ -1076,10 +1077,13 @@ export class AuthorizedHttpClient extends HttpClient {
       const authHeader = 'Authorization';
       requestCopy.headers[authHeader] = `Bearer ${token}`;
 
-      // Fix issue where firebase-admin does not specify quota project that is
-      // necessary for use when utilizing human account with ADC (RSDF)
-      if (!requestCopy.headers['x-goog-user-project'] && this.app.options.projectId) {
-        requestCopy.headers['x-goog-user-project'] = this.app.options.projectId
+      let quotaProjectId: string | undefined;
+      if (this.app.options.credential instanceof ApplicationDefaultCredential){
+        quotaProjectId = this.app.options.credential.getQuotaProjectId();
+      }
+      quotaProjectId = process.env.GOOGLE_CLOUD_QUOTA_PROJECT || undefined;
+      if (!requestCopy.headers['x-goog-user-project'] && validator.isNonEmptyString(quotaProjectId)) {
+        requestCopy.headers['x-goog-user-project'] = quotaProjectId;
       }
 
       if (!requestCopy.httpAgent && this.app.options.httpAgent) {

test/integration/setup.ts

@@ -19,7 +19,7 @@ import minimist = require('minimist');
 import path = require('path');
 import { random } from 'lodash';
 import {
-  App, Credential, GoogleOAuthAccessToken, cert, deleteApp, initializeApp,
+  App, Credential, GoogleOAuthAccessToken, applicationDefault, cert, deleteApp, initializeApp,
 } from '../../lib/app/index'
 
 // eslint-disable-next-line @typescript-eslint/no-var-requires
@@ -87,7 +87,8 @@ before(() => {
   storageBucket = projectId + '.appspot.com';
 
   defaultApp = initializeApp({
-    ...getCredential(),
+    //...getCredential(),
+    credential: applicationDefault(),
     projectId,
     databaseURL: databaseUrl,
     storageBucket,

test/unit/app-check/app-check-api-client-internal.spec.ts

@@ -45,7 +45,6 @@ describe('AppCheckApiClient', () => {
   const EXPECTED_HEADERS = {
     'Authorization': 'Bearer mock-token',
     'X-Firebase-Client': `fire-admin-node/${getSdkVersion()}`,
-    'x-goog-user-project': 'test-project',
   };
 
   const noProjectId = 'Failed to determine project ID. Initialize the SDK with service '

test/unit/data-connect/data-connect-api-client-internal.spec.ts

@@ -43,7 +43,6 @@ describe('DataConnectApiClient', () => {
   const EXPECTED_HEADERS = {
     'Authorization': 'Bearer mock-token',
     'X-Firebase-Client': `fire-admin-node/${getSdkVersion()}`,
-    'x-goog-user-project': 'test-project',
   };
 
   const noProjectId = 'Failed to determine project ID. Initialize the SDK with service '

test/unit/functions/functions-api-client-internal.spec.ts

@@ -46,7 +46,6 @@ describe('FunctionsApiClient', () => {
   const EXPECTED_HEADERS = {
     'X-Firebase-Client': `fire-admin-node/${getSdkVersion()}`,
     'Authorization': 'Bearer mock-token',
-    'x-goog-user-project': 'test-project',
   };
 
   const noProjectId = 'Failed to determine project ID. Initialize the SDK with service '

test/unit/machine-learning/machine-learning-api-client.spec.ts

@@ -117,7 +117,6 @@ describe('MachineLearningApiClient', () => {
   const EXPECTED_HEADERS = {
     'Authorization': 'Bearer mock-token',
     'X-Firebase-Client': `fire-admin-node/${getSdkVersion()}`,
-    'x-goog-user-project': 'test-project',
   };
   const noProjectId = 'Failed to determine project ID. Initialize the SDK with service '
     + 'account credentials, or set project ID as an app option. Alternatively, set the '

test/unit/remote-config/remote-config-api-client.spec.ts

@@ -57,7 +57,6 @@ describe('RemoteConfigApiClient', () => {
     'Authorization': 'Bearer mock-token',
     'X-Firebase-Client': `fire-admin-node/${getSdkVersion()}`,
     'Accept-Encoding': 'gzip',
-    'x-goog-user-project': 'test-project',
   };
 
   const VERSION_INFO: Version = {

test/unit/security-rules/security-rules-api-client.spec.ts

@@ -44,7 +44,6 @@ describe('SecurityRulesApiClient', () => {
   const EXPECTED_HEADERS = {
     'Authorization': 'Bearer mock-token',
     'X-Firebase-Client': `fire-admin-node/${getSdkVersion()}`,
-    'x-goog-user-project': 'test-project',
   };
   const noProjectId = 'Failed to determine project ID. Initialize the SDK with service '
     + 'account credentials, or set project ID as an app option. Alternatively, set the '