specifying `--config <path>` also loads parts of `firebase.json`

[trullock]

[REQUIRED] Environment info

firebase-tools: 15.2.1

Platform: Ubuntu

[REQUIRED] Test case

I want to have cache headers when deployed to live, but not on dev.
So I've made a firebase.dev.json which is a copy of firebase.json, but without the hosting.headers section.
However, when running firebase emulators:start --config ./firebase.dev.json it also seems to load the firebase.json because requests are returning the configured headers.
I've verified this by adding the following header

{
        "source": "/",
        "headers": [
          {
            "key": "WTF",
            "value": "is going on?"
          }
        ]
}

to hosting.headers in firebase.json, rebooting the emulators and this header appears (so its not browser caching or anything else mad, its genuinely coming from the firebase.json.

So then I made the assumption that it must merge firebase.json with whatever your provide to --config despite this being undocumented.
So i make a base firebase.json, then firebase.dev.json is just {} and firebase.prod.json just has {hosting: headers: [ ... ] } in it, but then invoking the emulator with --config ./firebase.dev.json complains that all other sections are missing, which they are.

So it isnt merging the whole file, it looks like just the hosting emulator always loads firebase.json regardless of --config and then applies ---config <path> over the top.

Insanity

[REQUIRED] Steps to reproduce

firebase.json

// usual stuff plus:

    "headers": [
      {
        "source": "/",
        "headers": [
          {
            "key": "WTF",
            "value": "is going on?"
          }
        }

firebase.dev.json

// usual stuff but no "headers"

run firebase emulators:start --config ./firebase.dev.json

request localhost:5000/

observe the presence of the WTF header

[REQUIRED] Expected behavior

--config only loads the provided config.json

[REQUIRED] Actual behavior

Hosting emulator seems to always load at least the headers section from firebase.json, havent tested other sections

Theres nothing in the logs of any value, it doesn't print anything to say which config file its loaded except repeating the Command you use to invoke it.

[aalej]

Thanks for the report @trullock! This one was definitely a bit confusing. From what I can tell, the Firebase CLI is correctly using the config you passed with --config flag. However, it looks like superstatic(the library we use to serve the app) is looking for firebase.json config file within your project root directory and combines that with the config specified in --config.

Based on my understanding, these lines https://github.com/firebase/superstatic/blob/02205287b27f2aad805f6a40af1aaf2564798151/src/loaders/config-file.js#L41-L74, will do the ff

  try {
    configObject = JSON.parse(filename); // >> this will error since `filename` is an actual object(the hosting config) not a string
  } catch {
    if (_.isPlainObject(filename)) {
      configObject = filename; // >> configObject is set to the hosting config
      filename = CONFIG_FILE; //  >> set to ["superstatic.json", "firebase.json"]
    }
  }


  if (_.isArray(filename)) { // >> this is true since filename is ["superstatic.json", "firebase.json"]
    filename = _.find(filename, (name) => {
      return fs.existsSync(join(process.cwd(), name));
    }); // >> this sets filename to "firebase.json" since you have this file in your project root
  }


  // Set back to default config file if stringified object is
  // given as config. With this, we override values in the config file
  if (_.isPlainObject(filename)) { // >> skipped since filename is "firebase.json"
    filename = CONFIG_FILE;
  }


  // A file name or array of file names
  if (_.isString(filename) && _.endsWith(filename, "json")) {
    try {
      config = JSON.parse(fs.readFileSync(path.resolve(filename))); // >> loads the contents of your `firebase.json` 
      config = config.hosting ?? config; // >> sets the value of config to `firebase.json#hosting`
    } catch {
      // do nothing
    }
  }


  // Passing an object as the config value merges
  // the config data
  return _.assign(config, configObject); // >>  merges the two configs

I'm not sure if my understanding of the above is correct though, I'll check this issue with someone on our engineering team who is more familiar with superstatic

edit: sharing mcve here - https://github.com/aalej/issues-9773

[aalej]

quick update, I think you should be able to workaround the issue by specifying an empty headers list in your firebase.dev.json file. It would look something like

{
  "hosting": {
    "public": "public",
    "ignore": ["firebase.json", "**/.*", "**/node_modules/**"],
    "headers": []
  }
}

[trullock]

Thanks for the workaround.

I've also worked around this by stopping using the github deploy action (where you cant specify a --config) and I'm just using firebase.dev.json and firebase.prod.json

Means I've had to change CI practices but I wanted to do that anyway in my case :)