From 1a563c995c7535914e54c5a5f28f9c612f947acd Mon Sep 17 00:00:00 2001 From: Logan Cusano Date: Tue, 18 Aug 2026 20:53:20 -0400 Subject: [PATCH] Point the org backfill at the database the app actually uses The script initialised firebase_admin from a hardcoded gcp-key.json path and then called a bare firestore.client(). Production has neither: the server is a GCE instance using Application Default Credentials, and the app talks to FIRESTORE_DATABASE=c2-server, not "(default)". The credentials half failed loudly. The database half would not have: the script would have scanned an empty (default) database, found nothing to backfill, created the founding org there, and printed a clean success while the real data stayed untenanted and invisible. Both now read the same environment the app reads, and the chosen database is printed before any work so a wrong one is visible in the dry run. Co-Authored-By: Claude Opus 5 --- drb-c2-core/scripts/backfill_org_id.py | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/drb-c2-core/scripts/backfill_org_id.py b/drb-c2-core/scripts/backfill_org_id.py index f493704..e130d97 100644 --- a/drb-c2-core/scripts/backfill_org_id.py +++ b/drb-c2-core/scripts/backfill_org_id.py @@ -86,10 +86,24 @@ def main() -> None: parser.add_argument("--dry-run", action="store_true", help="Print what would change; write nothing") args = parser.parse_args() - creds_path = os.getenv("GCP_CREDENTIALS_PATH", "gcp-key.json") - cred = credentials.Certificate(creds_path) + # Match app/internal/firestore.py exactly. Two ways this script diverged + # from the app and would have failed or, worse, half-succeeded: + # * credentials — GCP_CREDENTIALS_PATH is unset in production (the server + # is a GCE instance and the app uses Application Default Credentials via + # the metadata server). Defaulting to a "gcp-key.json" that does not + # exist made the script unrunnable there. + # * database — the app talks to FIRESTORE_DATABASE (c2-server in prod), + # while a bare firestore.client() talks to "(default)". That one is the + # dangerous half: the script would have scanned an empty database, found + # nothing to backfill, created the founding org in the wrong place and + # printed a clean success. + creds_path = os.getenv("GCP_CREDENTIALS_PATH") + cred = credentials.Certificate(creds_path) if creds_path else credentials.ApplicationDefault() firebase_admin.initialize_app(cred) - db = firestore.client() + + database_id = os.getenv("FIRESTORE_DATABASE", "(default)") + print(f"Using Firestore database: {database_id}") + db = firestore.client(database_id=database_id) try: owner = auth.get_user_by_email(args.owner_email)