CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

Google API errors as typed findings, never raw JSON: cli/lib/google-errors.ts parses SERVICE_DISABLED (api-disabled: service, Cloud project, console page), PERMISSION_DENIED (no-app-access: which app, Users and permissions), 401 / invalid_grant (auth-revoked) and 429 (quota); health / analytics print one line with the URL, raw text in detail and the log; desktop Health tab: the line, 'Turn it on in Google Cloud' and 'Check again', raw text in a collapsed Details; Portfolio shows a Cloud project blocking several apps once. Findings exit codes are results: the sidecar reports outcome (ok / findings / declined / failed) and the command's own error line; scan / check / validate / health exit 1 with findings show and cache the findings; no bare 'Exit code N' anywhere. tests/google-errors.test.ts, boot check errors cases (api-disabled, scan-findings, scan-failed) (pitfall 57)

Browse source
This commit is contained in:
CRTkafa 2026-10-13 23:20:04 +08:00
parent f69c10d3a0
commit 89256f1e80
28 changed files with 666 additions and 47 deletions
Download patch file Download diff file Expand all files Collapse all files

98
cli/lib/google-errors.ts Normal file
View file

@ -0,0 +1,98 @@
// Google API errors -> typed findings. Google answers a disabled API, a missing app permission, a revoked key or a
// used-up quota with a JSON body ({"error":{"code":403,"status":"PERMISSION_DENIED","details":[{"reason":
// "SERVICE_DISABLED",...}]}}); storebound's clients put that body (on one line, maybe cut at 800 characters) into the
// Error message. This reads the message text (raw or cut), so every layer (CLI tables, health / analytics snapshots,
// the desktop window, even old cached snapshots) can say one plain line instead of showing the JSON. Pure.
export type GoogleFinding =
/** An API is not enabled in the service account's Google Cloud project (403 SERVICE_DISABLED). */
| { kind: 'api-disabled'; service: string; serviceTitle: string; projectId: string | null; activationUrl: string }
/** The service account has no access to this app in Play Console (403 PERMISSION_DENIED, not SERVICE_DISABLED). */
| { kind: 'no-app-access'; app: string | null; usersUrl: string }
/** Google refused the key itself (401 UNAUTHENTICATED, invalid_grant, Invalid JWT): revoked, deleted or expired. */
| { kind: 'auth-revoked' }
/** 429 / RESOURCE_EXHAUSTED / rateLimitExceeded: a quota is used up for now. */
| { kind: 'quota'; serviceTitle: string | null };
export const PLAY_USERS_URL = 'https://play.google.com/console/developers/users-and-permissions';
const TITLES: Record<string, string> = {
'playdeveloperreporting.googleapis.com': 'Google Play Developer Reporting API',
'androidpublisher.googleapis.com': 'Google Play Android Developer API',
'storage.googleapis.com': 'Cloud Storage API',
'storage-api.googleapis.com': 'Cloud Storage API',
};
/** What the owner loses while that API is off (the start of the one line). */
const NEEDS: Record<string, string> = {
'playdeveloperreporting.googleapis.com': 'Crash and ANR data',
'androidpublisher.googleapis.com': 'Reading and updating the app on Google Play',
'storage.googleapis.com': 'Play statistics (store listing visitors, installs)',
'storage-api.googleapis.com': 'Play statistics (store listing visitors, installs)',
};
/** A JSON string's content without its escapes (\\n as a space: one line). */
const unescape = (s: string): string => { try { return (JSON.parse(`"${s}"`) as string).replace(/\s+/g, ' ').trim(); } catch { return s.replace(/\\(.)/g, '$1'); } };
/** The API's own page in the Cloud console (the host the desktop may open), with the project chosen. */
export function enableUrl(service: string, projectId: string | null): string {
return `https://console.cloud.google.com/apis/library/${service}${projectId ? `?project=${projectId}` : ''}`;
}
/** The typed finding in a Google error text, or null when it is another error. `app`: the package, when the caller knows it. */
export function parseGoogleError(text: string, o: { app?: string | null } = {}): GoogleFinding | null {
const s = String(text ?? '');
const status = Number(/-> (\d{3})\b/.exec(s)?.[1] ?? /"code":\s*(\d{3})/.exec(s)?.[1] ?? NaN);
const app = o.app ?? /\/(?:applications|apps)\/([A-Za-z][\w.]*\.[\w.]+)/.exec(s)?.[1] ?? null;
if (/SERVICE_DISABLED|has not been used in project|accessNotConfigured|API has not been used|it is disabled\. Enable it| turned on in Google Cloud project/i.test(s)) {
const service = /"service":\s*"([a-z0-9.-]+\.googleapis\.com)"/.exec(s)?.[1] ?? /apis\/api\/([a-z0-9.-]+\.googleapis\.com)/.exec(s)?.[1]
?? /apis\/library\/([a-z0-9.-]+\.googleapis\.com)/.exec(s)?.[1] ?? /([a-z0-9-]+\.googleapis\.com)/.exec(s)?.[1] ?? 'playdeveloperreporting.googleapis.com';
const projectId = /"consumer":\s*"projects\/([a-z0-9-]+)"/i.exec(s)?.[1] ?? /in (?:Google Cloud )?project ([a-z0-9-]+)/i.exec(s)?.[1] ?? /[?&]project=([a-z0-9-]+)/i.exec(s)?.[1] ?? null;
const serviceTitle = (/"serviceTitle":\s*"((?:[^"\\]|\\.)*)"/.exec(s)?.[1] && unescape(/"serviceTitle":\s*"((?:[^"\\]|\\.)*)"/.exec(s)![1]!))
?? /"message":\s*"([^"]*?) has not been used in project/.exec(s)?.[1] ?? / needs the (.+?) turned on in Google Cloud/.exec(s)?.[1] ?? TITLES[service] ?? service;
return { kind: 'api-disabled', service, serviceTitle, projectId, activationUrl: enableUrl(service, projectId) };
}
if (status === 429 || /RESOURCE_EXHAUSTED|rateLimitExceeded|quota(?: exceeded| metric)|Quota exceeded/i.test(s)) {
const service = /"service":\s*"([a-z0-9.-]+\.googleapis\.com)"/.exec(s)?.[1];
return { kind: 'quota', serviceTitle: service ? TITLES[service] ?? service : null };
}
if (status === 401 || /UNAUTHENTICATED|invalid_grant|Invalid JWT|account not found|invalid_client/i.test(s)) return { kind: 'auth-revoked' };
if (status === 403 && /PERMISSION_DENIED|caller does not have permission|does not have permission|not have access/i.test(s)) return { kind: 'no-app-access', app, usersUrl: PLAY_USERS_URL };
return null;
}
/** The one plain line for a finding (no JSON). `withUrl`: the CLI adds where to fix it; the window has a button. */
export function findingText(f: GoogleFinding, o: { withUrl?: boolean } = {}): string {
switch (f.kind) {
case 'api-disabled': {
const what = NEEDS[f.service] ?? 'This read';
const line = `${what} needs the ${f.serviceTitle} turned on in Google Cloud project ${f.projectId ?? '(the service account\'s project)'}.`;
return o.withUrl ? `${line} Turn it on: ${f.activationUrl}` : line;
}
case 'no-app-access': {
const line = `The service account has no access to ${f.app ?? 'this app'} in Play Console: add it under Users and permissions (invite the service account, give it access to ${f.app ?? 'the app'}).`;
return o.withUrl ? `${line} ${f.usersUrl}` : line;
}
case 'auth-revoked':
return 'Google refused the service account key: it was revoked, deleted or has expired. Add a new JSON key (Google Cloud > IAM & Admin > Service accounts > Keys) and set it again.';
case 'quota':
return `The ${f.serviceTitle ?? 'Google API'} quota is used up for now: try again later (quotas reset per minute and per day).`;
}
}
/** An error text for people: the finding's line when there is one, else the text without a JSON body. */
export function plainError(text: string, o: { app?: string | null; withUrl?: boolean } = {}): string {
const f = parseGoogleError(text, o);
if (f) return findingText(f, o);
const s = String(text ?? '');
const msg = /"(?:message|detail|error_description)":\s*"((?:[^"\\]|\\.)*)"/.exec(s)?.[1];
const head = s.split(/\s[{[]"/)[0]!.trim();
return msg ? `${head} ${unescape(msg)}`.trim().slice(0, 300) : s.split('\n')[0]!.slice(0, 300);
}
/** A store read that failed, for snapshots (health, analytics) and JSON results: the plain line (with the fix URL),
* the typed finding when Google said what is wrong, and the raw text as `detail` (logs, a collapsed "Details"). */
export function storeReadError(raw: string, o: { app?: string | null } = {}): { error: string; finding?: GoogleFinding; detail?: string } {
const f = parseGoogleError(raw, o);
const error = f ? findingText(f, { withUrl: true }) : plainError(raw);
return { error, ...(f ? { finding: f } : {}), ...(error !== raw ? { detail: raw } : {}) };
}