decision(delete-user-data): kit/extension parity – kit service account gets project-wide run.invoker #3253

delete-user-data kit/extension parity. Priority: low. The kit's service account gets broader permissions than the extension's.

Difference

• Extension: the service account has the four declared roles plus eventarc.publisher.
• Kit: the service account also gets project-wide roles/run.invoker and roles/eventarc.eventReceiver. That means it can call any Cloud Run service in the project, not just this kit's functions.

Declaring the roles the platform used to grant implicitly is already accepted for kits. This issue is about the scope of the grant.

Reproduced

Project IAM policy on the test project:

• ext-<id>@: datastore.owner, firebasedatabase.admin, storage.admin, pubsub.admin, eventarc.publisher
• firebase-fn-<n>@ (kit): the same five, plus eventarc.eventReceiver and run.invoker

Code

• Extension: extension.yaml#L45-L57
• Kit: index.ts#L42-L69

Resolution

requiresRole only grants project-level roles, and firebase-tools sets no per-service invoker for event triggers. Two options:

• Record the wider scope as an accepted difference under "Decisions" in delete-user-data kit tracking issue #3249.
• Have firebase-tools bind run.invoker on each kit service, then drop it from REQUIRED_ROLES.