Firebase 3.0.2 HelloWorld Help Needed (using node, service account, simple write, promise, auth, not working)

[mike haberman]

Using node 5.6 on a mac (15.4.0 Darwin).

I recently moved to 3.0.2 and can't get the simplest stuff to work.  All this worked fine in the previous version.

PROBLEM 1
Set Up Service Account: (lots of errors, but got the key file)
1. I created a service account. 
   However, I get the error:   Server Error: There's a problem at our end.  Please try again ....
2.  If I do a page refresh, the service account created in #1 above does show up.
3. Then I tried to go to the IAM tab, "ADD MEMBER"  using the service account name; same error as #1
4. Back to the 'Service accounts' tab, I hit '+PERMISSIONS' created an 'Owner' role
5. Generated key and downloaded the json file. 

PROBLEM 2
Database Rules:
"rules": {
    ".read": "auth == null",
    ".write": "auth != null"
  }
With these rules, I can't get my service account to write.  No errors are generated (see next problem) so I don't see specifics.
If I change the write rule to auth == null, the write 'works' but the returned promise isn't resolved.

PROBLEM 3
Here's my simple test code:
1. writes don't work unless auth == null is there
2. The promises don't get resolved.  Even if I use a simple completion callback instead of the promise, it doesn't get called

var firebase = require("firebase");

var config = {
  databaseURL:   "https://mehsimpletest.firebaseio.com",
  serviceAccount: "./private.json",
  databaseAuthVariableOverride: {
    uid: "nodeAPI"   //  was hoping this write rule would work, doesn't "auth.uid === 'nodeAPI'"
  }
};


var app = firebase.initializeApp(config);
var fbRoot = app.database();

var p1 = fbRoot.ref('hello/123456').set({
  key: "1234",
  responses: [1,2,3]
});
p1.then(function(){
    console.log("success write")
  },
  function(err) {
    console.log("error on write",err);
  }
);


var p2 = fbRoot.ref("hello/123456").once("value", function(snap) {
  console.log("success read", snap.val());
}, function(err) {
  console.log("error", err);
});

[Jonny Dimond]

Hey Mike,

I'm sorry you are running into these problems. Service accounts have full read and write access, so databaseAuthVariableOverride should not be necessary. It is more likely there is some problem in the setup. You can enable debug logging with:

firebase.database.enableLogging(true);

If the authentication in the logs fails with "invalid_token" then the service account was not setup correctly. We're aware that running into this can be frustrating as there is no indication on what went wrong and we're working on better error messages.

The wrong setup might be related to the errors you were seeing in creating a service account. I would suggest creating a new service account and trying again. If the problem persists feel free to contact Firebase support directly so we can troubleshoot in detail.

Have a great day,

Jonny

[Alex]

I have exactly the same issue - have made a detailed post about this in as separate thread - included the debug info from the network request tab of chrome dev tools - but will continue the discussion here. 

When I enable the logging I do indeed get the invalid token as follows:

p:0: Listen on /testdata for default  

p:0: {"r":23,"a":"q","b":{"p":"/testdata","h":""}}  

p:0: from server: {"r":22,"b":{"s":"invalid_token","d":"Access denied."}}  

Auth token revoked: invalid_token/Access denied. 

c:0:11: Closing realtime connection.  

I just created an brand new project ---> https://project-97214277404381397.firebaseio.com/

I did nothing apart from click Permissions --> Service Accounts --> Create Service Account --> Enter a name such as test123 and Select Furnish JSON key 

And I get the same error message again:

Server Error

There's a problem at our end.

Please try again. If the problem persists, please let us know using the "Send feedback" link below. Thanks!

Tracking Number: 2434437075226484796

Send feedback

This is a persistent problem for me - no matter how much I fiddle around with the settings or how many new projects / service accounts I create the problem is the same. 

How does one contact firebase support directly as mentioned in the previous post? 

[Jonny Dimond]

It seems like we may have a bug on our end and are investigating. At this time there is no need to file a bug for this anymore, but in the future you can use this web form:

https://firebase.google.com/support/contact/bugs-features/

We'll report back to this thread once we have more info on this issue.

Have a great day,

  Jonny

[mike haberman]

I appreciate your reaching out to help.

I deleted the old service account;  Tried to create a new one; same error:

Tracking Number: 753760520778695049

When I enabled logging:

p:0: from server: {"r":38,"b":{"s":"invalid_token","d":"Access denied."}} 

Auth token revoked: invalid_token/Access denied.

But shouldn't the promise be fulfilled with an error ?

Anyway, I am still stuck;  How do I contact support directly?  I did submit a ticket (1 of my allotted 5) but haven't heard anything since last week.

thanks for helping

mike

[Jonny Dimond]

Hey Mike,

as mentioned earlier in this thread this might be a bug on our side and we're investigating. We'll ping back on this thread once we have more info.

Regarding the error: Yes this should be a rejected promise and we're working on fixing this in a future release.

Jonny

[Jonny Dimond]

It seems like one issue that can cause this is when the Google Cloud terms of service have not been accepted yet. Try visiting https://console.cloud.google.com/ and accepting ToS there and see if that resolves the issue.

Jonny

[mike haberman]

Some good (small) news.  I did agree to ToS.   And this time when I created a service account no errors were reported. 

After saving the new key, I still got the following errors:
p:0: reportStats {"c":{"sdk.js.3-0-2":1}} 
p:0: {"r":1,"a":"s","b":{"c":{"sdk.js.3-0-2":1}}} 
p:0: {"r":2,"a":"gauth","b":{"cred":"ya29.CjHsArD9aw86Rcz8jr0YWYVMgJNIrgcllG7xt3LRChcbp8Er-jG76DPycs9IQCrpNtVM"}} 
p:0: {"r":3,"a":"p","b":{"p":"/hello/123456","d":{"key":"1234","responses":{"0":1,"1":2,"2":3}}}} 
p:0: from server: {"r":1,"b":{"s":"ok","d":""}} 
c:0:0: Primary connection is healthy. 
p:0: from server: {"r":2,"b":{"s":"invalid_token","d":"Access denied."}} 

Auth token revoked: invalid_token/Access denied.

This was with .write : "auth == null"  as well with "auth != null" , AND  ".write": true

I also went back to Permissions and manually added the owner role using both the Service accounts/'+PERMISSIONS' tab and the IAM tab.
Same error as above.

This seems strange even though I made ".write": true as a last resort.

I appreciate your help on this.

mike

[Alex]

Great!! this fixed the issue for me. 

Thanks a lot for the quick turnaround. Happy to be back on track with the new version of firebase. :)

[Jacob Wenger]

@Alex - Glad you are back on track! We are working on the Terms of Service issue from our side to make sure no one else runs into this issue. At least we have a workaround for now!

@Mike - Did you by chance create a new key after you changed the service account permissions? I am not sure if older keys get their permissions updated after they are created. If that doesn't work, then can you try creating a new service account entirely and see if that works? You should be able to write with the service account despite what your Security Rules are set to. If you want to make it respect your Security Rules, you will need to use the databaseAuthVariableOverride option when initializing the server SDK.

[Chris Raynor]

@Mike sorry if this sounds obvious, but can you just quickly verify for me that the service account you created is for the same project that has the Realtime Database attached to it, and that service account has at least viewer permissions on the project: https://console.firebase.google.com/iam-admin/iam/project

As a side note, when you're using a service account it authenticates entirely with OAuth and skips the security rules altogether unless you explicitly opt-in using the databaseAuthVariableOverride - if the service account is a 'Viewer' on the project it will be able to read from the whole database but not write anything, and if it's an 'Editor' or 'Owner' it will have full admin privileges on the entire database

[mike haberman]

I just did the entire process over, created service account, added permissions of owner, went back and gave it the role of owner under the 'IAM' tab as well.  Then I exported the key.  Still getting the exact same error:

error message:
p:0: from server: {"r":6,"b":{"s":"invalid_token","d":"Access denied."}} 

here's the config:

var config = {
  databaseURL:   "https://mehsimpletest.firebaseio.com",

  serviceAccount: "./node3API.json"
};

write rule:
".write": true


(sounds like the whole promise fulfillment is already on que to be fixed)

[Jacob Wenger]

Okay, that's a bummer. Sorry this is such a headache for you. I'm running out a possible answers for you, but here are two suggestions:

• Ensure you spelled the name of your database correctly and that it matches the product ID in the service account JSON file.
• Instead of using the relative path './node3API.json' as your service account path, try doing this:
  
  var path = require('path');
  var pathToServiceAccountKey = path.resolve(__dirname, './node3API.json');

• 
  var config = {
    databaseURL:   "https://mehsimpletest.firebaseio.com",
  

•   serviceAccount: pathToServiceAccountKey
};

I don't think this is the problem and you should get a better error if you passed the wrong path, but it's worth the shot.

If none of those work, I'll try to escalate this to some more people.

Thanks for your patience here,

Jacob

--
You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to firebase-tal...@googlegroups.com.
To post to this group, send email to fireba...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/fd8cdbb5-92a9-4f53-89fd-901f5613b7da%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[mike haberman]

Good news.  I just did the entire workflow to get a key and it succeeded!
It worked with the relative path (not needing the path.resolve -- but I appreciate the valiant effort).
Even with my original write rule of using:

databaseAuthVariableOverride: {
  uid: "nodeAPI"
}
it succeeded.

So here's where we are:
1. Agree to Terms of Service first to avoid the 'server error'
2. When you create a service account, do NOT export the key; First attach owner roles to it via 
"Service accounts->+PERMISSION" AND the "IAM" tab.  I had to do it in both places; NOW export the key.
3. If all goes well (in terms of access/permissions), promises do resolve on writes.  
If not, no promises get fulfilled -- even with an all access write rule.

I appreciate the persistent help.  I think I can move on to HelloUniverse.

mike

[Neil Shweky]

Hi, has anyone found a fix for this yet? I'm trying to add a new member and I get the following error:

Server Error
There's a problem at our end.

Please try again. If the problem persists, please let us know using the "Send feedback" link below. Thanks!

Let me know if you guys find everything. I've been banging my head over this for what feels like forever.

Thanks,

Neil

[Taymoor Khan]

Hey,

So I was having the same problem and Jacob linked me to this group.

I was able to solve the problem by doing some of the things that were mentioned in this thread.

1. Agreeing to the ToS at console.cloud.google.com stopped any issues I was having generating a service account (the migration already made me an IAM Owner)
2. I generated a new Service Account and moved the newly generated json file into my project folder

2a. DO NOT RENAME THE JSON's FILE NAME (This causes issues with your project being able to authenticate with firebases' services)

3. Using path.resolve(__dirname, '...') works so in my config, this works

serviceAccount: path.resolve(__dirname, './projectname-1a2b3c4d5e6f.json')

4. databaseAuthVariable & auth.uid === '...' should now work as specified in the docs

I hope this works for others who are also having problems, and I suggest that it should be mentioned/noted in the upgrade docs that these steps have to be taken to minimize any migration/upgrade errors and generated user troubleshooting requests.

Best,

Taymoor Khan

[Jacob Wenger]

Hey gang,

I'm glad people are starting to resolve this issue. We are still working on resolving it from our end so no one else runs into it.

As for the instructions above, you definitely do currently need to accept the Google Cloud Terms of Service at https://console.cloud.google.com and then create a service account.

@Taymooor - I don't know how the name of the file would make any difference since that is just a local name and is never shared outside your computer. Can you try again and confirm that this is indeed the behavior you are seeing?

Cheers,

Jacob

To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/5c5fde20-bc26-4f75-b1ca-6a6f5ec7385a%40googlegroups.com.

[Jacob Wenger]

The Terms of Service issue has been resolved on our end and you should now be able to create service accounts having accepted the Firebase ToS but not the Cloud ToS. If you are still experiencing issues after refreshing the page and creating a brand new service account, please let us know. Thanks to all who helped us track this down!

Jacob

[Taymoor Khan]

@Jacob, the filename was an isolated incident (i guess). When i first did it I was getting connection reset type error (sorry, i didnt log it and don't remember the specific error name). Having a different name works and i dont need path.resolve anymore either.

-Taymoor