Check if an existing upserted bucket belongs to the user's project.

src/gcp/storage.spec.ts

@@ -3,18 +3,21 @@
 
 import * as storage from "./storage";
 import * as utils from "../utils";
+import * as projects from "../management/projects";
 import { FirebaseError } from "../error";
 
 describe("storage", () => {
   describe("upsertBucket", () => {
     let getBucketStub: sinon.SinonStub;
     let createBucketStub: sinon.SinonStub;
+    let getProjectStub: sinon.SinonStub;
     let logLabeledBulletStub: sinon.SinonStub;
     let logLabeledWarningStub: sinon.SinonStub;
 
     beforeEach(() => {
       getBucketStub = sinon.stub(storage, "getBucket");
       createBucketStub = sinon.stub(storage, "createBucket");
+      getProjectStub = sinon.stub(projects, "getProject");
       logLabeledBulletStub = sinon.stub(utils, "logLabeledBullet");
       logLabeledWarningStub = sinon.stub(utils, "logLabeledWarning");
     });
@@ -24,7 +27,8 @@
     });
 
     it("should not call createBucket if the bucket already exists", async () => {
-      getBucketStub.resolves();
+      getBucketStub.resolves({projectNumber: 123456});
+      getProjectStub.resolves({projectNumber:123456});
 
       await storage.upsertBucket({
         product: "test",
@@ -34,6 +38,7 @@
       });
 
       expect(getBucketStub).to.be.calledOnceWith("test-bucket");
+      expect(getProjectStub).to.be.calledOnceWith("test-project");
       expect(createBucketStub).to.not.be.called;
       expect(logLabeledBulletStub).to.not.be.called;
     });

src/gcp/storage.ts

@@ -1,6 +1,7 @@
 import { Readable } from "stream";
 import * as path from "path";
 import * as clc from "colorette";
+import { getProject } from "../management/projects";
 
 import { firebaseStorageOrigin, storageOrigin } from "../api";
 import { Client } from "../apiv2";
@@ -369,7 +370,18 @@ export async function upsertBucket(opts: {
   req: CreateBucketRequest;
 }): Promise<void> {
   try {
-    await (exports as { getBucket: typeof getBucket }).getBucket(opts.req.name);
+    const bucketResponse = await (exports as { getBucket: typeof getBucket }).getBucket(
+      opts.req.name,
+    );
+    const projectMetadata = await getProject(opts.projectId);
+    if (
+      !bucketResponse.projectNumber ||
+      bucketResponse.projectNumber !== projectMetadata.projectNumber
+    ) {
+      throw new FirebaseError(
+        "There is already an existing bucket that belongs to another project.",
+      );
+    }
     return;
   } catch (err) {
     const errStatus = getErrStatus((err as FirebaseError).original);