{"record":{"id":"fc42b36b33a300fa","repo":"googleapis/mcp-toolbox","slug":"failed-to-initialize-firebase-rules-client-w","errorCode":null,"errorMessage":"failed to initialize Firebase Rules client: %w","messagePattern":"failed to initialize Firebase Rules client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/firestore/firestore.go","lineNumber":82,"sourceCode":"}\n\nfunc (r Config) SourceConfigType() string {\n\t// Returns Firestore source type\n\treturn SourceType\n}\n\nfunc (r Config) Initialize(ctx context.Context, tracer trace.Tracer) (sources.Source, error) {\n\t// Initializes a Firestore source\n\tclient, err := initFirestoreConnection(ctx, tracer, r.Name, r.Project, r.Database)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// Initialize Firebase Rules client\n\trulesClient, err := initFirebaseRulesConnection(ctx, r.Project)\n\tif err != nil {\n\t\tclient.Close()\n\t\treturn nil, fmt.Errorf(\"failed to initialize Firebase Rules client: %w\", err)\n\t}\n\n\ts := &Source{\n\t\tConfig:      r,\n\t\tClient:      client,\n\t\tRulesClient: rulesClient,\n\t}\n\treturn s, nil\n}\n\nvar _ sources.Source = &Source{}\n\ntype Source struct {\n\tConfig\n\tClient      *firestore.Client\n\tRulesClient *firebaserules.Service\n}\n","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/firestore/firestore.go#L64-L100","documentation":"Wrapped by Firestore Config.Initialize when initFirebaseRulesConnection fails to build the Firebase Rules API client (firebaserules service). Initialize closes the already-created Firestore client before returning, so this error aborts source startup entirely. It indicates the Google Cloud Rules API client could not be created — usually project/credentials/scope problems, not Firestore itself.","triggerScenarios":"Initialize called with a Project whose Rules API is not enabled, Application Default Credentials missing or lacking the firebaserules scope, or the Rules service endpoint unreachable (network, restricted VIP, private Google access misconfig).","commonSituations":"GOOGLE_APPLICATION_CREDENTIALS unset in the environment; service account without Firebase Rules API permissions; FIREBASE_RULES_API not enabled on the project; running on-prem without route to googleapis.com; wrong project id in config.","solutions":["Verify credentials: set GOOGLE_APPLICATION_CREDENTIALS or run under a service account with firebaserules permissions","Enable the Firebase Rules API (firebaserules.googleapis.com) on the project","Confirm the project id is correct and reachable (gcloud services list --enabled)","Check network egress to googleapis.com (proxy, Private Google Access, firewall rules)"],"exampleFix":"// before\nrulesClient, err := initFirebaseRulesConnection(ctx, r.Project)\nif err != nil {\n    client.Close()\n    return nil, fmt.Errorf(\"failed to initialize Firebase Rules client: %w\", err)\n}\n// after\nif r.Project == \"\" {\n    client.Close()\n    return nil, fmt.Errorf(\"project id is required for Firebase Rules client\")\n}\nrulesClient, err := initFirebaseRulesConnection(ctx, r.Project)\nif err != nil {\n    client.Close()\n    return nil, fmt.Errorf(\"failed to initialize Firebase Rules client (project=%s): %w\", r.Project, err)\n}","handlingStrategy":"validation","validationCode":"// Preflight GCP setup before Initialize\nfunc preflightFirebaseRules(ctx context.Context, project string) error {\n    if project == \"\" { return errors.New(\"project id required\") }\n    creds, err := google.FindDefaultCredentials(ctx, \"https://www.googleapis.com/auth/firebase.service.managed\")\n    if err != nil { return fmt.Errorf(\"no valid Application Default Credentials: %w\", err) }\n    _ = creds\n    return nil\n}","typeGuard":"func isRulesAPIUnavailable(err error) bool {\n    s := err.Error()\n    return strings.Contains(s, \"has not been used\") || strings.Contains(s, \"is disabled\") || strings.Contains(s, \"403\")\n}","tryCatchPattern":"rulesClient, err := initFirebaseRulesConnection(ctx, r.Project)\nif err != nil {\n    client.Close()\n    if isRulesAPIUnavailable(err) {\n        return nil, fmt.Errorf(\"enable firebaserules.googleapis.com for project %s: %w\", r.Project, err)\n    }\n    return nil, fmt.Errorf(\"failed to initialize Firebase Rules client: %w\", err)\n}","preventionTips":["Set GOOGLE_APPLICATION_CREDENTIALS or run under an attached service account","Enable the Firebase Rules API on the target project before deployment","Grant the service account firebaserules get/update permissions","Verify egress to googleapis.com from restricted networks (Private Google Access/proxy)"],"tags":["firestore","firebase-rules","gcp","authentication","initialization"],"backgroundTag":"missing-gcp-credentials","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}