CODEWITHSUNDEEP
firebasegoogle-analyticsgoogle-apifirebase-analyticsgoogle-iam
Rins
Rins

Reputation: 2171

Programmatically add Google Analytics to Firebase project

I wish to automate all of the steps involved in setting up a new Firebase project without any user interaction. I've accomplished most of the steps via either the gCloud CLI, Firebase CLI or the GoogleApis NodeJS library.

Authentication has been done via the CLI tools or via service accounts.

The only thing I haven't been able to do so far is adding Google Analytics to the newly created Firebase project. I have found this Google Api which should accomplish this, but I'm having problems authenticating the request.

How would I authenticate a request to this API without any user interaction? The API is not available via the CLI tools, so my best guess would be to use a service account with the owner IAM-role, but the request keeps failing.

My steps so far have been:

  1. Ensuring that the management API is enabled
  2. Add a service account to the GCloud project with owner privileges
  3. Download the service account
  4. Run the following code
import { google } from 'googleapis';
import * as fetch from 'node-fetch';

async function addGoogleAnalytics {
   const token = await getJWTAcessToken();
   await addAnalyticsFetch(token);
};

async function addAnalyticsFetch(accessToken) {
   const url = `https://firebase.googleapis.com/v1beta1/projects/<my-project-id>:addGoogleAnalytics`;

   const fetchResult = await fetch(url, {
       method: 'POST',
       headers: { Authorization: `Bearer ${accessToken}` },
       json: true,
       body: JSON.stringify({ analyticsAccountId: '<my-analytics-account-id>' }),
   });

   const fetchResultText = await fetchResult.text();
   console.log('Fetch result: ', fetchResultText);
}

function getJWTAcessToken() {
   const SCOPES = ['https://www.googleapis.com/auth/cloud-platform'];
   const key = require('../../serviceAccount.json');

   return new Promise((resolve, reject) => {
       const jwtClient = new google.auth.JWT(key.client_email, null, key.private_key, SCOPES, null);
       jwtClient.authorize((err, tokens) => {
           if (err) {
               reject(err);
               return;
           }
           resolve(tokens.access_token);
       });
   });
}

The result of the API call is a simple 403 - "The caller does not have permission". I've also attempted this using the GoogleApis NodeJS library with similar results.

If being a project owner doesn't give enough privileges, how do I permit this service account to perform this API call? I have a suspicion that I'm failing because the service account is in no way associated with the Google Analytics account, but the documentation doesn't list that as a requirement. It is also not listed as a step in Google's own guide.

Upvotes: 2

Views: 587

Answers (1)

Rins
Rins

Reputation: 2171

It turns out that the above code is 100 % valid. The problem was indeed that the service account had enough privileges to edit the Firebase-project, but it had no authorization to create a new property for the Google Analytics account.

After giving the service account edit privileges for the Google Analytics account, the connection between Firebase and Google Analytics was successfully established. This process can be automated via this API.

Upvotes: 1

Related Questions