Firebase函数onUserStatusChanged权限拒绝问题求助

我有一个名为onUserStatusChanged的Firebase函数，用于将Firebase Realtime Database中的实时数据同步到Firestore，代码基于官方示例编写，正常运行一年后，在集成Firebase的BigQuery扩展后突然失效（不确定是否为巧合）。目前应用其他功能（读写Firestore/Realtime Database、认证等）均正常，仅该同步函数抛出权限拒绝错误。

函数代码 #

const functions = require("firebase-functions");
const admin = require("firebase-admin");
admin.initializeApp();

const firestore = admin.firestore();

exports.onUserStatusChanged = functions
    .region("europe-west1")
    .database.ref("/users/{uid}").onUpdate(
        async (change, context) => {
          // 获取写入Realtime Database的数据
          const eventStatus = change.after.val();

          // 创建对应Firestore文档的引用
          const userStatusFirestoreRef = firestore.doc(`users/${context.params.uid}`);

          // 重新读取当前数据并比较时间戳，避免快速状态变更导致的重复处理
          const statusSnapshot = await change.after.ref.once("value");
          const status = statusSnapshot.val();
          functions.logger.log(status, eventStatus);
          // 如果当前数据的时间戳比触发事件的数据新，则退出函数
          if (status.lastChanged > eventStatus.lastChanged) {
            return null;
          }

          // 将lastChanged字段转换为Date类型
          eventStatus.lastChanged = new Date(eventStatus.lastChanged);

          // 写入Firestore
          return userStatusFirestoreRef.update(eventStatus);
        });

错误日志 #

onUserStatusChangedoplb4jqmbm76 Error: 7 PERMISSION_DENIED: Missing or insufficient permissions.
    at callErrorFromStatus (/workspace/node_modules/@grpc/grpc-js/build/src/call.js:31:19)
    at Object.onReceiveStatus (/workspace/node_modules/@grpc/grpc-js/build/src/client.js:192:76)
    at Object.onReceiveStatus (/workspace/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:360:141)
    at Object.onReceiveStatus (/workspace/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:323:181)
    at /workspace/node_modules/@grpc/grpc-js/build/src/resolving-call.js:94:78
    at process.processTicksAndRejections (node:internal/process/task_queues:77:11) 

数据库规则 #

Firestore规则 #

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write;
    }
  }
}

Realtime Database规则 #

{
  "rules": {
    ".read": true,
    ".write": true
  }
}

Google Cloud服务账号信息 #

Google Cloud Service Accounts for myApp-68ccf

App Engine Default Service Account
Email: myApp-68ccf@appspot.gserviceaccount.com
Status: Enabled
Keys: No keys

Default Compute Service Account
Email: 16497200245-compute@developer.gserviceaccount.com
Status: Enabled
Keys: No keys

Firestore BigQuery Export Service Account
Email: ext-firestore-bigquery-export@myApp--68ccf.iam.gserviceaccount.com
Status: Enabled
Keys: No keys

Firestore BigQuery Export (Alternate) Service Account
Email: ext-firestore-bigquery-ex-p6tr@myApp--68ccf.iam.gserviceaccount.com
Status: Enabled
Keys: No keys

Firebase Admin SDK Service Account
Email: firebase-adminsdk-9ebsh@myApp-68ccf.iam.gserviceaccount.com
Status: Enabled
Keys:
Key ID: cedfssdfsfsdfsbsndksandlkanfklanalnlk765 (Created: Sep 23, 2024)
Key ID: alkdlklknlkdjfkjdjzkmdlakjffoihkjaiowjwo (Created: Sep 23, 2024)
Key ID: faklkdlmfoijoiewjpojeoqjepowjepoajdajwwp5 (Created: Mar 13, 2025)

Google Cloud IAM权限配置 #

Google Cloud IAM Roles for myApp
1. Default Compute Service Account
Email: 16497200245-compute@developer.gserviceaccount.com
Type: Default Compute Service Account
Roles:
Editor

2. Firestore BigQuery Export (Alternate) Service Account
Email: ext-firestore-bigquery-ex-p6tr@myApp.iam.gserviceaccount.com
Type: Firebase Extensions Firestore BigQuery Export-r7pi Service Account
Roles:
BigQuery Data Editor
BigQuery User
Cloud Datastore User

3. Firestore BigQuery Export Service Account
Email: ext-firestore-bigquery-export@myApp.iam.gserviceaccount.com
Type: Firebase Extensions Firestore BigQuery Export Service Account
Roles:
BigQuery Data Editor
BigQuery User
Cloud Datastore User

4. Firebase Admin SDK Service Account
Email: firebase-adminsdk-9ebsh@myApp-68ccf.iam.gserviceaccount.com
Type: Firebase Admin SDK
Roles:
Cloud Functions Admin
Editor
Firebase Admin
Firebase Admin SDK Administrator Service Agent
Firebase Authentication Admin
Firebase Realtime Database Admin
Firestore Database Reliability Recommender Admin
Firestore Service Agent
Service Account Token Creator
Storage Admin

5. Firebase Service Management Service Agent
Email: firebase-service-account@firebase-sa-management.iam.gserviceaccount.com
Type: Firebase Service Management Service Agent
Roles: (Not specified)
6. Personal Account - Owner
Email: qbm.moee@gmail.com
Name: Mohammed Hamdan
Role: Owner

7. BigQuery & Firebase Admin Account
Email: showupbigqkoe@myApp.iam.gserviceaccount.com?uid=117641135490648667432
Roles:
BigQuery Admin
Firebase Admin

8. App Engine Default Service Account
Email: myApp@appspot.gserviceaccount.com
Type: App Engine Default Service Account
Roles: (Not specified)

排查解决建议 #

1. 确认云函数使用的服务账号
   云函数默认使用App Engine Default Service Account（myApp-68ccf@appspot.gserviceaccount.com），而非Firebase Admin SDK服务账号。当前该账号未配置任何IAM角色，这是权限拒绝的核心原因。

2. 为App Engine默认服务账号添加必要权限
   给myApp-68ccf@appspot.gserviceaccount.com添加以下角色：

   • Firebase Realtime Database Admin：允许读取Realtime Database触发事件的数据
   • Firestore Admin：允许写入Firestore文档
     或者直接添加Editor角色（但最小权限原则建议按需添加）。

3. 验证BigQuery扩展的影响
   检查BigQuery扩展安装过程中是否修改了项目的IAM权限或Firestore配置，比如是否误操作移除了云函数服务账号的权限。可以暂时禁用BigQuery扩展，测试函数是否恢复正常，以此确认是否存在关联。

4. 检查云函数的运行环境
   确认云函数部署时没有指定自定义服务账号，若有则需确保该账号具备Realtime Database读取和Firestore写入权限。

5. 重新部署云函数
   在更新IAM权限后，重新部署云函数，确保权限变更生效。

内容的提问来源于stack exchange，提问作者Mohammed Hamdan