From 5f0f25330110eb55d077ecc375b8f5afdabb408a Mon Sep 17 00:00:00 2001
From: Rafael Fox <20726634+foxrafa@users.noreply.github.com>
Date: Wed, 19 Jun 2024 13:40:16 -0300
Subject: [PATCH] fix: Make ADC + human account work with firebase-admin
 (#2553)

* Make ADC + human account work with firebase-admin

* Update api-request.ts

* fix unit tests

---------

Co-authored-by: Lahiru Maramba <llahiru@gmail.com>
---
 src/utils/api-request.ts                                    | 6 ++++++
 test/unit/app-check/app-check-api-client-internal.spec.ts   | 1 +
 test/unit/functions/functions-api-client-internal.spec.ts   | 3 ++-
 .../machine-learning/machine-learning-api-client.spec.ts    | 1 +
 test/unit/remote-config/remote-config-api-client.spec.ts    | 1 +
 test/unit/security-rules/security-rules-api-client.spec.ts  | 1 +
 6 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/utils/api-request.ts b/src/utils/api-request.ts
index 2408e92344..5d1b9ecf4c 100644
--- a/src/utils/api-request.ts
+++ b/src/utils/api-request.ts
@@ -818,6 +818,12 @@ export class AuthorizedHttpClient extends HttpClient {
       const authHeader = 'Authorization';
       requestCopy.headers[authHeader] = `Bearer ${token}`;
 
+      // Fix issue where firebase-admin does not specify quota project that is
+      // necessary for use when utilizing human account with ADC (RSDF)
+      if (!requestCopy.headers['x-goog-user-project'] && this.app.options.projectId) {
+        requestCopy.headers['x-goog-user-project'] = this.app.options.projectId
+      }
+
       if (!requestCopy.httpAgent && this.app.options.httpAgent) {
         requestCopy.httpAgent = this.app.options.httpAgent;
       }
diff --git a/test/unit/app-check/app-check-api-client-internal.spec.ts b/test/unit/app-check/app-check-api-client-internal.spec.ts
index bd048bd9e4..e5a483d91c 100644
--- a/test/unit/app-check/app-check-api-client-internal.spec.ts
+++ b/test/unit/app-check/app-check-api-client-internal.spec.ts
@@ -45,6 +45,7 @@ describe('AppCheckApiClient', () => {
   const EXPECTED_HEADERS = {
     'Authorization': 'Bearer mock-token',
     'X-Firebase-Client': `fire-admin-node/${getSdkVersion()}`,
+    'x-goog-user-project': 'test-project',
   };
 
   const noProjectId = 'Failed to determine project ID. Initialize the SDK with service '
diff --git a/test/unit/functions/functions-api-client-internal.spec.ts b/test/unit/functions/functions-api-client-internal.spec.ts
index 138280f287..f000d21c0a 100644
--- a/test/unit/functions/functions-api-client-internal.spec.ts
+++ b/test/unit/functions/functions-api-client-internal.spec.ts
@@ -44,7 +44,8 @@ describe('FunctionsApiClient', () => {
 
   const EXPECTED_HEADERS = {
     'X-Firebase-Client': `fire-admin-node/${getSdkVersion()}`,
-    'Authorization': 'Bearer mock-token'
+    'Authorization': 'Bearer mock-token',
+    'x-goog-user-project': 'test-project',
   };
 
   const noProjectId = 'Failed to determine project ID. Initialize the SDK with service '
diff --git a/test/unit/machine-learning/machine-learning-api-client.spec.ts b/test/unit/machine-learning/machine-learning-api-client.spec.ts
index 9fbb94066e..4d6873d200 100644
--- a/test/unit/machine-learning/machine-learning-api-client.spec.ts
+++ b/test/unit/machine-learning/machine-learning-api-client.spec.ts
@@ -117,6 +117,7 @@ describe('MachineLearningApiClient', () => {
   const EXPECTED_HEADERS = {
     'Authorization': 'Bearer mock-token',
     'X-Firebase-Client': `fire-admin-node/${getSdkVersion()}`,
+    'x-goog-user-project': 'test-project',
   };
   const noProjectId = 'Failed to determine project ID. Initialize the SDK with service '
     + 'account credentials, or set project ID as an app option. Alternatively, set the '
diff --git a/test/unit/remote-config/remote-config-api-client.spec.ts b/test/unit/remote-config/remote-config-api-client.spec.ts
index 52abb968c1..fa464c089a 100644
--- a/test/unit/remote-config/remote-config-api-client.spec.ts
+++ b/test/unit/remote-config/remote-config-api-client.spec.ts
@@ -57,6 +57,7 @@ describe('RemoteConfigApiClient', () => {
     'Authorization': 'Bearer mock-token',
     'X-Firebase-Client': `fire-admin-node/${getSdkVersion()}`,
     'Accept-Encoding': 'gzip',
+    'x-goog-user-project': 'test-project',
   };
 
   const VERSION_INFO: Version = {
diff --git a/test/unit/security-rules/security-rules-api-client.spec.ts b/test/unit/security-rules/security-rules-api-client.spec.ts
index 512bcc9a20..d4139fdb34 100644
--- a/test/unit/security-rules/security-rules-api-client.spec.ts
+++ b/test/unit/security-rules/security-rules-api-client.spec.ts
@@ -44,6 +44,7 @@ describe('SecurityRulesApiClient', () => {
   const EXPECTED_HEADERS = {
     'Authorization': 'Bearer mock-token',
     'X-Firebase-Client': `fire-admin-node/${getSdkVersion()}`,
+    'x-goog-user-project': 'test-project',
   };
   const noProjectId = 'Failed to determine project ID. Initialize the SDK with service '
     + 'account credentials, or set project ID as an app option. Alternatively, set the '