{"record":{"id":"6da83185f8c86afb","repo":"googleapis/mcp-toolbox","slug":"failed-to-create-firebase-rules-client-for-project","errorCode":null,"errorMessage":"failed to create Firebase Rules client for project %q: %w","messagePattern":"failed to create Firebase Rules client for project %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/sources/firestore/firestore.go","lineNumber":983,"sourceCode":"\t}\n\n\t// Create the Firestore client\n\tclient, err := firestore.NewClientWithDatabase(ctx, project, database, option.WithUserAgent(userAgent))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create Firestore client for project %q and database %q: %w\", project, database, err)\n\t}\n\n\treturn client, nil\n}\n\nfunc initFirebaseRulesConnection(\n\tctx context.Context,\n\tproject string,\n) (*firebaserules.Service, error) {\n\t// Create the Firebase Rules client\n\trulesClient, err := firebaserules.NewService(ctx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create Firebase Rules client for project %q: %w\", project, err)\n\t}\n\n\treturn rulesClient, nil\n}\n","sourceCodeStart":965,"sourceCodeEnd":988,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/firestore/firestore.go#L965-L988","documentation":"This error is returned by initFirebaseRulesConnection when firebaserules.NewService fails to construct the Firebase Rules API client. The Rules API client needs valid credentials and an endpoint connection; failures are almost always authentication/ADC related or network access to firebaserules.googleapis.com. The project string in the message is context only — it is not passed to NewService.","triggerScenarios":"firebaserules.NewService(ctx) returns non-nil err during Initialize of a Firebase Rules-oriented source: no Application Default Credentials available, invalid service-account key file, or blocked network access to the Firebase Rules API endpoint.","commonSituations":"Missing GOOGLE_APPLICATION_CREDENTIALS in local/container environments; disabled firebaserules.googleapis.com API on the project; outbound firewall rules blocking googleapis.com; corrupt or wrong-type credential file referenced by ADC.","solutions":["Provide valid ADC: set GOOGLE_APPLICATION_CREDENTIALS to a service-account key or run `gcloud auth application-default login`","Enable the Firebase Rules API (firebaserules.googleapis.com) for the project","Verify network egress to googleapis.com (proxy/firewall) from the runtime environment"],"exampleFix":"// before\n# container runs with no credential mount\nrulesSrc, err := cfg.Initialize(ctx, tracer) // fails\n// after\n# docker run -v $PWD/sa.json:/sa.json -e GOOGLE_APPLICATION_CREDENTIALS=/sa.json ...","handlingStrategy":"validation","validationCode":"if _, err := google.FindDefaultCredentials(ctx, \"https://www.googleapis.com/auth/cloud-platform\"); err != nil {\n    log.Fatal(\"no valid ADC for Firebase Rules API\")\n}","typeGuard":null,"tryCatchPattern":"src, err := cfg.Initialize(ctx, tracer)\nif err != nil && strings.Contains(err.Error(), \"failed to create Firebase Rules client\") {\n    log.Fatalf(\"Firebase Rules client init failed — check ADC/API access: %v\", err)\n}","preventionTips":["Provide service-account credentials via GOOGLE_APPLICATION_CREDENTIALS in local/container runs","Enable firebaserules.googleapis.com on the project","Confirm outbound HTTPS to googleapis.com is not blocked"],"tags":["firebase","firebaserules","authentication","initialization","gcp"],"backgroundTag":"missing-credentials","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}