fix: EB Firebase 인증 파일 자동 생성 #63

coderabbitai · 2026-08-11T07:13:32Z

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash set -eu printf '%s\n' '--- hook ---' cat -n .platform/hooks/predeploy/10-firebase-credentials.sh printf '%s\n' '--- Firebase configuration references ---' rg -n -C 3 'FIREBASE_ENABLED|FirebaseConfig|getApplicationDefault|credential_dir|temporary_path|secret_id|aws_region' \ .platform . 2>/dev/null | head -n 300 printf '%s\n' '--- related platform files ---' git ls-files '.platform/*' '*application*.yml' '*FirebaseConfig*' '*firebase*' | head -n 200

Repository: DayTodo/DayTodo_BE

Length of output: 5790

🏁 Script executed:

#!/bin/bash set -eu printf '%s\n' '--- deployment configuration and documentation ---' git ls-files | rg '(^|/)(\.ebextensions|\.platform|Dockerfile|docker-compose|.*ya?ml|.*properties|README)' | head -n 300 rg -n -C 4 'FIREBASE_ENABLED|GOOGLE_APPLICATION_CREDENTIALS|firebase-service-account|secretsmanager|get-secret-value|AWS_REGION|environment|env' \ .github .ebextensions .platform README.md src 2>/dev/null | head -n 400 printf '%s\n' '--- Firebase configuration and application resources ---' cat -n src/main/java/com/daytodo/global/config/FirebaseConfig.java sed -n '60,82p' src/main/resources/application.yml sed -n '14,28p' README.md

Repository: DayTodo/DayTodo_BE

Length of output: 9313

🏁 Script executed:

#!/bin/bash set -eu python3 - <<'PY' from pathlib import Path import re hook = Path(".platform/hooks/predeploy/10-firebase-credentials.sh").read_text() config = Path("src/main/resources/application.yml").read_text() firebase = Path("src/main/java/com/daytodo/global/config/FirebaseConfig.java").read_text() aws_call = re.search(r'(?m)^\s*aws\s+secretsmanager\s+get-secret-value\s+\\', hook) guard = re.search(r'(?ms)if\s+\[\[.*?FIREBASE_ENABLED.*?\]\];\s*then.*?exit\s+0', hook) default_disabled = re.search(r'(?m)^\s*enabled:\s*\$\{FIREBASE_ENABLED:false\}', config) conditional = re.search( r'`@ConditionalOnProperty`$prefix\s*=\s*"firebase",\s*name\s*=\s*"enabled",\s*havingValue\s*=\s*"true"$', firebase, ) print({ "unconditional_secrets_manager_call_present": bool(aws_call), "firebase_disabled_guard_present_before_call": bool(guard and guard.start() < aws_call.start()) if aws_call else False, "application_default_is_false": bool(default_disabled), "firebase_config_requires_enabled_true": bool(conditional), }) assert aws_call assert not (guard and guard.start() < aws_call.start()) assert default_disabled assert conditional PY

Repository: DayTodo/DayTodo_BE

Length of output: 348

Skip credential retrieval when Firebase is disabled.

The predeploy hook always calls Secrets Manager. FIREBASE_ENABLED defaults to false, and FirebaseConfig loads only when firebase.enabled=true. Add a guard before credential setup so disabled environments do not require the secret or IAM permission.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.platform/hooks/predeploy/10-firebase-credentials.sh around lines 14 - 19, Update the predeploy credential setup before the aws secretsmanager call to check FIREBASE_ENABLED, and skip the entire Firebase credential retrieval when Firebase is disabled. Preserve the existing secret retrieval behavior when Firebase is enabled, including the current secret_id, aws_region, and temporary_path handling.

coderabbitai · 2026-08-11T07:13:32Z

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash set -eu file=".platform/hooks/predeploy/10-firebase-credentials.sh" printf '%s\n' "--- hook ---" cat -n "$file" printf '%s\n' "--- related references ---" rg -n --hidden -S \ 'temporary_path|FIREBASE|GoogleCredentials|getApplicationDefault|firebase|jq|webapp' \ -g '!node_modules' -g '!dist' -g '!build' . | head -300 printf '%s\n' "--- jq availability ---" if command -v jq >/dev/null 2>&1; then jq --version else echo "jq: unavailable" fi

Repository: DayTodo/DayTodo_BE

Length of output: 5369

🏁 Script executed:

#!/bin/bash set -eu printf '%s\n' "--- deployment configuration ---" git ls-files | rg '(^|/)(Dockerfile|docker-compose|.*ebextensions.*|.*platform.*|.*workflow.*|.*ya?ml$|.*json$)' | head -300 printf '%s\n' "--- validator and platform references ---" rg -n --hidden -S \ 'jq|yum|dnf|apt|amazon linux|platform|Elastic Beanstalk|aws-elasticbeanstalk|predeploy|SecretString' \ .platform .ebextensions-dev .github README.md build.gradle 2>/dev/null || true printf '%s\n' "--- proposed jq predicate behavior ---" python3 - <<'PY' import json from pathlib import Path fixtures = { "valid service account": { "type": "service_account", "project_id": "p", "client_email": "x@example.com", "private_key": "-----BEGIN PRIVATE KEY-----\\nkey\\n-----END PRIVATE KEY-----\\n", }, "malformed JSON": '{"type":"service_account"', "unrelated object": {"kind": "config", "value": "not credentials"}, "nonempty scalar": "secret", "missing private_key": { "type": "service_account", "project_id": "p", "client_email": "x@example.com", }, } for name, value in fixtures.items(): path = Path("/tmp") / ("firebase-" + name.replace(" ", "-") + ".json") if isinstance(value, str) and value.startswith("{"): path.write_text(value) else: path.write_text(json.dumps(value)) print(f"{name}: {path}") PY predicate=' type == "object" and .type == "service_account" and (.project_id | type == "string") and (.client_email | type == "string") and (.private_key | type == "string") ' for file in /tmp/firebase-*.json; do if jq -e "$predicate" "$file" >/dev/null 2>&1; then printf 'accepted: %s\n' "$file" else printf 'rejected: %s\n' "$file" fi done

Repository: DayTodo/DayTodo_BE

Length of output: 1565

🌐 Web query:

AWS Elastic Beanstalk Amazon Linux 2 platform jq preinstalled package

💡 Result:

The jq command-line JSON processor is not preinstalled on AWS Elastic Beanstalk platforms running Amazon Linux 2 [1][2][3]. Because jq is frequently required to parse configuration data or environment variables on these platforms [4][1][5][3], users must explicitly include it in their environment configuration. To install jq on an Elastic Beanstalk environment using Amazon Linux 2, you can add it to your.ebextensions configuration file using the packages key [2][3][6]: packages: yum: jq: [] While Elastic Beanstalk documentation now recommends using Buildfile, Procfile, and platform hooks for configuration on Amazon Linux 2 environments [7], adding jq via.ebextensions remains a standard and widely used approach for ensuring the tool is available on the instance [1][3][6].

Citations:

1: https://repost.aws/questions/QU4Dpikh78ThGEDCHGF4RKOA/unable-to-update-environment-properties-in-aml-2-rails

2: https://stackoverflow.com/questions/59094752/reference-environment-properties-in-ebextension-script

3: https://blog.richardchou.dev/upgrading-elastic-beanstalk-from-amazon-linux-1-to-amazon-linux-2-1c2e0344c326

4: https://nick.pearson.dev/posts/ebenv

5: /opt/elasticbeanstalk/bin/get-config doesn't exist for Amazon Linux 2 Platforms awsdocs/elastic-beanstalk-samples#111

6: https://stackoverflow.com/questions/69713927/upgrading-elastic-beanstalk-environment-from-aws-linux-1-to-aws-linux-2

7: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/customize-containers-ec2.html

🏁 Script executed:

#!/bin/bash set -eu printf '%s\n' "--- deployment workflow ---" cat -n .github/workflows/dev-deploy.yml printf '%s\n' "--- Elastic Beanstalk configuration ---" for file in .ebextensions-dev/00-makefiles.config .ebextensions-dev/01-set-timezone.config; do printf '%s\n' "--- $file ---" cat -n "$file" done printf '%s\n' "--- credential path consumers and environment wiring ---" rg -n --hidden -S \ 'GOOGLE_APPLICATION_CREDENTIALS|firebase-service-account|credential_path|/opt/daytodo|FIREBASE_ENABLED|GoogleCredentials' \ . \ -g '!node_modules' -g '!dist' -g '!build'

Repository: DayTodo/DayTodo_BE

Length of output: 4412

Validate the Firebase service-account JSON before installation.

test -s accepts malformed JSON and unrelated non-empty values. Validate the JSON and required service-account fields before chown and mv. jq is not installed by default on Elastic Beanstalk, so provision it in .ebextensions-dev or use a validator guaranteed on the target image.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.platform/hooks/predeploy/10-firebase-credentials.sh at line 21, Replace the non-empty check in the Firebase credential installation flow with validation that parses the service-account JSON and verifies all required fields before chown and mv. Ensure the validator is available on the Elastic Beanstalk image by provisioning jq through .ebextensions-dev or using another guaranteed validator, while preserving failure handling for invalid credentials.

-Original file line number
+Diff line change
@@ -0,0 +1,26 @@
+    #!/usr/bin/env bash
+    set -euo pipefail
+    secret_id="daytodo/firebase-service-account"
+    aws_region="${AWS_REGION:-ap-northeast-2}"
+    credential_dir="/opt/daytodo"
+    credential_path="${credential_dir}/firebase-service-account.json"
+    install -d -m 0750 -o root -g webapp "${credential_dir}"
+    temporary_path="$(mktemp "${credential_dir}/firebase-service-account.json.XXXXXX")"
+    trap 'rm -f "${temporary_path}"' EXIT
+    aws secretsmanager get-secret-value \
+      --secret-id "${secret_id}" \
+      --region "${aws_region}" \
+      --query SecretString \
+      --output text \
+      --no-cli-pager > "${temporary_path}"
+    test -s "${temporary_path}"
+    chown root:webapp "${temporary_path}"
+    chmod 0640 "${temporary_path}"
+    mv -f "${temporary_path}" "${credential_path}"
+    trap - EXIT

Navigation Menu

Repository navigation

fix: EB Firebase 인증 파일 자동 생성 #63

Uh oh!

Diff view

Diff view

There are no files selected for viewing

coderabbitai Bot Aug 11, 2026

Uh oh!

coderabbitai Bot Aug 11, 2026

Uh oh!

Uh oh!

fix: EB Firebase 인증 파일 자동 생성 #63

Uh oh!

fix: EB Firebase 인증 파일 자동 생성 #63

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

coderabbitai Bot Aug 11, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Aug 11, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!