Add a warning/confirmation when using BUILD-available secrets for local builds (#10337)

* Enable secret resolution during local App Hosting builds

* fix build error

* Handle env vars (especially secrets) with a Promise.all so it can be parallelized

* Add a warning so that we do not use build-available secrets unless the user confirms

* fix undefined boolean flag behavior

* fix tests, address some review comments

* fix test mocking

Author: falahat

src/apphosting/localbuilds.spec.ts

@@ -76,7 +76,10 @@ describe("localBuild", () => {
       MY_PLAIN_VAR: { value: "plain-value" },
     };
 
-    await localBuild("test-project", "./", "nextjs", envMap);
+    await localBuild("test-project", "./", "nextjs", envMap, {
+      nonInteractive: true,
+      allowLocalBuildSecrets: true,
+    });
 
     expect(loadSecretStub).to.have.been.calledWith("test-project", "my-secret-id");
     // Confirm RUNTIME-only secret was ignored
@@ -117,4 +120,86 @@ describe("localBuild", () => {
     expect(process.env.MY_PLAIN_VAR).to.be.undefined;
     expect(process.env.ANOTHER_VAR).to.be.undefined;
   });
+
+  describe("localBuild secret confirmations", () => {
+    let confirmStub: sinon.SinonStub;
+
+    beforeEach(() => {
+      confirmStub = sinon.stub(require("../prompt"), "confirm");
+    });
+
+    it("throws an error in non-interactive mode if build-available secrets are used without the bypass flag", async () => {
+      const envMap: EnvMap = {
+        MY_BUILD_SECRET: { secret: "my-secret-id", availability: ["BUILD"] },
+      };
+
+      await expect(
+        localBuild("test-project", "./", "nextjs", envMap, { nonInteractive: true }),
+      ).to.be.rejectedWith(
+        "Using build-available secrets during a local build in non-interactive mode requires the --allow-local-build-secrets flag.",
+      );
+    });
+
+    it("allows build-available secrets in non-interactive mode if bypass flag is provided", async () => {
+      const bundleConfig = {
+        version: "v1" as const,
+        runConfig: { runCommand: "npm run build:prod" },
+        metadata: {
+          adapterPackageName: "@apphosting/angular-adapter",
+          adapterVersion: "14.1",
+          framework: "nextjs",
+        },
+        outputFiles: { serverApp: { include: ["./next/standalone"] } },
+      };
+      sinon.stub(localBuildModule, "localBuild").resolves(bundleConfig);
+      sinon.stub(secrets, "loadSecret").resolves("secret-value");
+
+      const envMap: EnvMap = {
+        MY_BUILD_SECRET: { secret: "my-secret-id", availability: ["BUILD"] },
+      };
+
+      await localBuild("test-project", "./", "nextjs", envMap, {
+        nonInteractive: true,
+        allowLocalBuildSecrets: true,
+      });
+
+      expect(confirmStub).to.not.have.been.called;
+    });
+
+    it("cancels the build if the user declines the secrets confirmation prompt", async () => {
+      confirmStub.resolves(false);
+
+      const envMap: EnvMap = {
+        MY_BUILD_SECRET: { secret: "my-secret-id", availability: ["BUILD"] },
+      };
+
+      await expect(
+        localBuild("test-project", "./", "nextjs", envMap, { nonInteractive: false }),
+      ).to.be.rejectedWith("Cancelled local build due to BUILD-available secrets.");
+      expect(confirmStub).to.have.been.calledOnce;
+    });
+
+    it("proceeds with the build if the user accepts the secrets confirmation prompt", async () => {
+      confirmStub.resolves(true);
+      const bundleConfig = {
+        version: "v1" as const,
+        runConfig: { runCommand: "npm run build:prod" },
+        metadata: {
+          adapterPackageName: "@apphosting/angular-adapter",
+          adapterVersion: "14.1",
+          framework: "nextjs",
+        },
+        outputFiles: { serverApp: { include: ["./next/standalone"] } },
+      };
+      sinon.stub(localBuildModule, "localBuild").resolves(bundleConfig);
+      sinon.stub(secrets, "loadSecret").resolves("secret-value");
+
+      const envMap: EnvMap = {
+        MY_BUILD_SECRET: { secret: "my-secret-id", availability: ["BUILD"] },
+      };
+
+      await localBuild("test-project", "./", "nextjs", envMap, { nonInteractive: false });
+      expect(confirmStub).to.have.been.calledOnce;
+    });
+  });
 });

src/apphosting/localbuilds.ts

@@ -2,6 +2,8 @@ import { BuildConfig, Env } from "../gcp/apphosting";
 import { localBuild as localAppHostingBuild } from "@apphosting/build";
 import { EnvMap } from "./yaml";
 import { loadSecret } from "./secrets";
+import { confirm } from "../prompt";
+import { FirebaseError } from "../error";
 
 /**
  * Triggers a local build of your App Hosting codebase.
@@ -23,11 +25,33 @@ export async function localBuild(
   projectRoot: string,
   framework: string,
   env: EnvMap = {},
+  options?: { nonInteractive?: boolean; allowLocalBuildSecrets?: boolean },
 ): Promise<{
   outputFiles: string[];
   annotations: Record<string, string>;
   buildConfig: BuildConfig;
 }> {
+  const hasBuildAvailableSecrets = Object.values(env).some(
+    (v) => v.secret && (!v.availability || v.availability.includes("BUILD")),
+  );
+
+  if (hasBuildAvailableSecrets && !options?.allowLocalBuildSecrets) {
+    if (options?.nonInteractive) {
+      throw new FirebaseError(
+        "Using build-available secrets during a local build in non-interactive mode requires the --allow-local-build-secrets flag.",
+      );
+    }
+    if (
+      !(await confirm({
+        message:
+          "Your build includes secrets that are available to the build environment. Using secrets in local builds may leave sensitive values in local artifacts/temporary files. Do you want to continue?",
+        default: false,
+      }))
+    ) {
+      throw new FirebaseError("Cancelled local build due to BUILD-available secrets.");
+    }
+  }
+
   // We need to inject the environment variables into the process.env
   // because the build adapter uses them to build the app.
   // We'll restore the original process.env after the build is done.

src/commands/deploy.ts

@@ -14,6 +14,7 @@ import { pickHostingSiteName } from "../hosting/interactive";
 import { logBullet } from "../utils";
 import { createSite } from "../hosting/api";
 import { Options } from "../options";
+import * as experiments from "../experiments";
 
 // in order of least time-consuming to most time-consuming
 export const VALID_DEPLOY_TARGETS = [
@@ -101,7 +102,16 @@ export const command = new Command("deploy")
     "--dry-run",
     "perform a dry run of your deployment. Validates your changes and builds your code without deploying any changes to your project. " +
       "In order to provide better validation, this may still enable APIs on the target project",
-  )
+  );
+
+if (experiments.isEnabled("apphostinglocalbuilds")) {
+  command.option(
+    "--allow-local-build-secrets",
+    "allow the use of build-available secrets in local builds for App Hosting without interactive confirmation",
+  );
+}
+
+command
   .before(requireConfig)
   .before((options: Options) => {
     options.filteredTargets = filterTargets(options, VALID_DEPLOY_TARGETS);

src/deploy/apphosting/prepare.ts

@@ -193,6 +193,10 @@ export default async function (context: Context, options: Options): Promise<void
         options.projectRoot || "./",
         "nextjs",
         buildEnv[cfg.backendId] || {},
+        {
+          nonInteractive: options.nonInteractive,
+          allowLocalBuildSecrets: !!options.allowLocalBuildSecrets,
+        },
       );
       if (outputFiles.length !== 1) {
         throw new FirebaseError(