test(functions): stub the default compute service account lookup

src/apphosting/secrets/index.spec.ts

@@ -28,6 +28,12 @@
     gcsm.labels.restore();
     gcsm.getIamPolicy.throws("Unexpected getIamPolicy call");
     gcsm.setIamPolicy.throws("Unexpected setIamPolicy call");
+    // Unstubbed, this reaches the Compute API over the network and races mocha's 2s
+    // timeout. The fake derives the address from its argument so the tests still pin
+    // that the project number is passed through.
+    sinon
+      .stub(gce, "getDefaultServiceAccount")
+      .callsFake((pn: string) => Promise.resolve(`${pn}-compute@developer.gserviceaccount.com`));
   });
 
   afterEach(() => {
@@ -38,7 +44,7 @@
     it("uses explicit account", async () => {
       const backend = {
         serviceAccount: "sa",
       } as any as apphosting.Backend;
       expect(await secrets.serviceAccountsForBackend("number", backend)).to.deep.equal({
         buildServiceAccount: "sa",
         runServiceAccount: "sa",
@@ -46,10 +52,10 @@
     });
 
     it("has a fallback for legacy SAs", async () => {
       const backend = {} as any as apphosting.Backend;
       expect(await secrets.serviceAccountsForBackend("number", backend)).to.deep.equal({
         buildServiceAccount: gcb.getDefaultServiceAccount("number"),
-        runServiceAccount: await gce.getDefaultServiceAccount("number"),
+        runServiceAccount: "number-compute@developer.gserviceaccount.com",
       });
     });
   });
@@ -202,15 +208,15 @@
       let err;
       try {
         await secrets.upsertSecret("project", "secret");
       } catch (e: any) {
         err = e;
       }
 
       expect(err.message).to.equal(
         "Unexpected error loading secret: HTTP Error: 403, This API method requires billing to be enabled.",
       );
       expect(err.status).to.equal(403);
       expect(err.original).to.equal(original);
       expect(gcsm.createSecret).to.not.have.been.called;
     });
   });
@@ -603,8 +609,8 @@
     it("creates a new secret and grants access", async () => {
       gcsm.getSecret.rejects({ status: 404 });
       utils.readSecretValue.resolves("secretValue");
       gcsm.addVersion.resolves({
         secret: { name: "secret", projectId: "project" } as any,
         versionId: "1",
       } as any);
       prompt.select.resolves("production");

src/deploy/functions/checkIam.spec.ts

@@ -3,6 +3,7 @@ import * as sinon from "sinon";
 import * as checkIam from "./checkIam";
 import * as storage from "../../gcp/storage";
 import * as rm from "../../gcp/resourceManager";
+import * as gce from "../../gcp/computeEngine";
 import * as backend from "./backend";
 
 const projectId = "my-project";
@@ -30,6 +31,13 @@ describe("checkIam", () => {
   let setIamStub: sinon.SinonStub;
 
   beforeEach(() => {
+    // Unstubbed, this reaches the Compute API over the network and each test that
+    // needs the default service account races mocha's 2s timeout. The fake derives
+    // the address from its argument so the tests still pin that checkIam passes the
+    // project number through.
+    sinon
+      .stub(gce, "getDefaultServiceAccount")
+      .callsFake((pn: string) => Promise.resolve(`${pn}-compute@developer.gserviceaccount.com`));
     storageStub = sinon
       .stub(storage, "getServiceAccount")
       .throws("unexpected call to storage.getServiceAccount");

src/deploy/functions/release/fabricator.spec.ts

@@ -27,6 +27,8 @@ import * as gce from "../../../gcp/computeEngine";
 import * as iam from "../../../gcp/iam";
 import * as resourcemanager from "../../../gcp/resourceManager";
 
+const DEFAULT_COMPUTE_SERVICE_ACCOUNT = "1234567-compute@developer.gserviceaccount.com";
+
 describe("Fabricator", () => {
   // Stub all GCP APIs to make sure this test is hermetic
   let gcf: sinon.SinonStubbedInstance<typeof gcfNS>;
@@ -40,6 +42,7 @@ describe("Fabricator", () => {
   let tasks: sinon.SinonStubbedInstance<typeof cloudtasksNS>;
   let services: sinon.SinonStubbedInstance<typeof servicesNS>;
   let identityPlatform: sinon.SinonStubbedInstance<typeof identityPlatformNS>;
+  let computeEngine: sinon.SinonStubbedInstance<typeof gce>;
 
   beforeEach(() => {
     gcf = sinon.stub(gcfNS);
@@ -53,6 +56,7 @@ describe("Fabricator", () => {
     tasks = sinon.stub(cloudtasksNS);
     services = sinon.stub(servicesNS);
     identityPlatform = sinon.stub(identityPlatformNS);
+    computeEngine = sinon.stub(gce);
 
     gcf.functionFromEndpoint.restore();
     gcfv2.functionFromEndpoint.restore();
@@ -104,6 +108,13 @@ describe("Fabricator", () => {
     identityPlatform.setBlockingFunctionsConfig.rejects(
       new Error("unexpected identityPlatform.setBlockingFunctionsConfig"),
     );
+    // Unstubbed, this reaches the Compute API over the network and every test that
+    // needs the default service account races mocha's 2s timeout. The fake derives
+    // the address from its argument so the tests still pin that the fabricator passes
+    // the project number through.
+    computeEngine.getDefaultServiceAccount.callsFake((pn: string) =>
+      Promise.resolve(`${pn}-compute@developer.gserviceaccount.com`),
+    );
   });
 
   afterEach(() => {
@@ -892,7 +903,7 @@ describe("Fabricator", () => {
 
         await fab.createV2Function(ep, new scraper.SourceTokenScraper());
         expect(run.setInvokerCreate).to.have.been.calledWith(ep.project, "service", [
-          await gce.getDefaultServiceAccount(fab.projectNumber),
+          DEFAULT_COMPUTE_SERVICE_ACCOUNT,
         ]);
       });
 

src/gcp/cloudscheduler.spec.ts

@@ -1,10 +1,12 @@
 import { expect } from "chai";
+import * as sinon from "sinon";
 import nock from "../test/helpers/nock";
 
 import { FirebaseError } from "../error";
 import * as api from "../api";
 import * as backend from "../deploy/functions/backend";
 import * as cloudscheduler from "./cloudscheduler";
+import * as gce from "./computeEngine";
 import { cloneDeep } from "../utils";
 
 const VERSION = "v1";
@@ -157,6 +159,19 @@ describe("cloudscheduler", () => {
   });
 
   describe("jobFromEndpoint", () => {
+    beforeEach(() => {
+      // Unstubbed, this reaches the Compute API over the network and each v2 endpoint
+      // test races mocha's 2s timeout. The fake derives the address from its argument
+      // so the tests still pin that jobFromEndpoint passes the project number through.
+      sinon
+        .stub(gce, "getDefaultServiceAccount")
+        .callsFake((pn: string) => Promise.resolve(`${pn}-compute@developer.gserviceaccount.com`));
+    });
+
+    afterEach(() => {
+      sinon.verifyAndRestore();
+    });
+
     const V1_ENDPOINT: backend.Endpoint = {
       platform: "gcfv1",
       id: "id",