NodeJS: firebase-tools firestore delete failing - node.js

Question

I am attempting to delete a sub collection when the parent document is deleted.
I have created the following cloud function to do so:
import { firestore, logger } from 'firebase-functions';
import { recursiveDelete } from '../utils/db';
export const deleteListItems = firestore.document('owners/{owner}/lists/{list}').onDelete(snap => {
const collPath = snap.ref.collection('items').path;
logger.info('Why do you hate me?');
logger.debug({ collPath });
return recursiveDelete(collPath);
});
---------
db.ts
---------------------------------
import * as functions from 'firebase-functions';
const firebase_tools = require('firebase-tools');
export const recursiveDelete = (path: string): Promise<any> => {
console.debug({ project: process.env.GCLOUD_PROJECT });
console.debug({ token: functions.config().fb.token });
return firebase_tools.firestore.delete(path, {
project: process.env.GCLOUD_PROJECT,
recursive: true,
yes: true,
token: functions.config().fb.token,
});
};
From my logging, I can see that the path I'm trying to delete is correct, owners/G-470728052545159171/lists/anime/items. I can also see that the project and token values are present.
I am, however, seeing the following error in the cloud functions logs:
deleteListItems
FirebaseError: Deletion failed. Errors: Failed to fetch documents to delete >= 3 times..
at Timeout.<anonymous> (/workspace/node_modules/firebase-tools/lib/firestore/delete.js:272:32)
at listOnTimeout (internal/timers.js:554:17)
at processTimers (internal/timers.js:497:7)
I ideally want the delete to be performed at the list doc level, but I thought that, that doc being deleted already might have been causing the error, which clearly it isn't.
I tried running the equivalent command in my console:
firebase firestore:delete -r -y owners/G-470728052545159171/lists/anime/items
This works as expected, even if the list doc (anime), is already deleted, so I'm not understanding why the one in the function isn't working.
EDIT: Set DEBUG env var
Debug output:
2:05:30.175 PM
deleteListItems
[2021-04-17T18:05:30.171Z] > command requires scopes: ["email","openid","https://www.googleapis.com/auth/cloudplatformprojects.readonly","https://www.googleapis.com/auth/firebase","https://www.googleapis.com/auth/cloud-platform"]
2:05:30.176 PM
deleteListItems
[2021-04-17T18:05:30.175Z] > authorizing via --token option
2:05:30.176 PM
deleteListItems
[2021-04-17T18:05:30.176Z] [iam] checking project watchlist-bot for permissions ["datastore.entities.delete","datastore.entities.list","firebase.projects.get"]
2:05:30.246 PM
deleteListItems
[2021-04-17T18:05:30.244Z] > refreshing access token with scopes: ["email","https://www.googleapis.com/auth/cloud-platform","https://www.googleapis.com/auth/cloudplatformprojects.readonly","https://www.googleapis.com/auth/firebase","openid"]
2:05:30.246 PM
deleteListItems
[2021-04-17T18:05:30.245Z] >>> HTTP REQUEST POST https://www.googleapis.com/oauth2/v3/token
2:05:30.246 PM
deleteListItems
<request body omitted>
2:05:30.478 PM
deleteListItems
[2021-04-17T18:05:30.477Z] <<< HTTP RESPONSE 400 {"cache-control":"no-cache, no-store, max-age=0, must-revalidate","date":"Sat, 17 Apr 2021 18:05:30 GMT","pragma":"no-cache","expires":"Mon, 01 Jan 1990 00:00:00 GMT","content-type":"application/json; charset=utf-8","vary":"X-Origin, Referer, Origin,Accept-Encoding","server":"scaffolding on HTTPServer2","x-xss-protection":"0","x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","alt-svc":"h3-29=\":443\"; ma=2592000,h3-T051=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\"","accept-ranges":"none","transfer-encoding":"chunked"}
2:05:30.581 PM
deleteListItems
[2021-04-17T18:05:30.581Z] <<< HTTP RESPONSE 401 {"www-authenticate":"Bearer realm=\"https://accounts.google.com/\", error=\"invalid_token\"","vary":"X-Origin, Referer, Origin,Accept-Encoding","content-type":"application/json; charset=UTF-8","date":"Sat, 17 Apr 2021 18:05:30 GMT","server":"ESF","cache-control":"private","x-xss-protection":"0","x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","server-timing":"gfet4t7; dur=4","alt-svc":"h3-29=\":443\"; ma=2592000,h3-T051=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\"","accept-ranges":"none","transfer-encoding":"chunked"}
2:05:30.581 PM
deleteListItems
[2021-04-17T18:05:30.581Z] <<< HTTP RESPONSE BODY {"error":{"code":401,"message":"Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.","status":"UNAUTHENTICATED"}}
2:05:30.583 PM
deleteListItems
[2021-04-17T18:05:30.583Z] [iam] error while checking permissions, command may fail: FirebaseError: HTTP Error: 401, Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.
It seems there is an issue with my token, which I suspected, but I'm not sure why. I generated the token using firebase login:ci as they specified.
Then I set it using firebase functions:config:set fb.token=***.

Answer 1

As you can see in your log messages, your current token generated by login:ci is incorrectly missing the "https://www.googleapis.com/auth/cloud-platform" scope. Try updating your firebase-tools instance that you used to create the token and try generating a fresh token.
Regarding why this same error doesn't appear on your local system: On your system, firebase-tools makes use of your full account credential (to deploy code, etc) rather than a credential with targeted scopes.