fix(node-sdk): switch gcs fallback back to googleapis storage

roncohen · roncohen · commit 8c18ca8c09b6 · 2026-04-07T20:02:38.000+02:00
diff --git a/.changeset/tasty-rabbits-wave.md b/.changeset/tasty-rabbits-wave.md
@@ -2,4 +2,4 @@
 "@reflag/node-sdk": patch
 ---
 
-Replace the built-in GCS fallback provider's default client dependency with `@google-cloud/storage-control`, removing the deprecated `@google-cloud/storage` dependency and its vulnerable transitive request stack.
+Replace the built-in GCS fallback provider's default client dependency with `@googleapis/storage`, removing the deprecated `@google-cloud/storage` dependency and its vulnerable transitive request stack.
diff --git a/packages/node-sdk/package.json b/packages/node-sdk/package.json
@@ -46,7 +46,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.888.0",
-    "@google-cloud/storage-control": "0.8.2",
+    "@googleapis/storage": "21.2.0",
     "@redis/client": "^5.11.0",
     "@reflag/flag-evaluation": "1.0.0"
   }
diff --git a/packages/node-sdk/src/flagsFallbackProvider.ts b/packages/node-sdk/src/flagsFallbackProvider.ts
@@ -83,33 +83,6 @@ type GCSObjectStore = {
   ): Promise<unknown>;
 };
 
-type GCSStorageControlReadResponse = {
-  checksummedData?: {
-    content?: string | Uint8Array | ArrayBuffer;
-  };
-};
-
-type GCSStorageControlStub = {
-  getObject(request: { bucket: string; object: string }): Promise<[unknown]>;
-  readObject(request: { bucket: string; object: string }): {
-    on(event: "data", listener: (response: GCSStorageControlReadResponse) => void): unknown;
-    on(event: "error", listener: (error: unknown) => void): unknown;
-    on(event: "end", listener: () => void): unknown;
-  };
-  writeObject(
-    callback: (error: unknown, response?: unknown) => void,
-  ): {
-    on(event: "error", listener: (error: unknown) => void): unknown;
-    write(chunk: unknown): unknown;
-    end(): unknown;
-  };
-};
-
-type GCSStorageControlClient = {
-  bucketPath(project: string, bucket: string): string;
-  initialize(): Promise<GCSStorageControlStub>;
-};
-
 export type RedisFallbackProviderOptions = {
   /**
    * Optional Redis client. When omitted, a client is created using `REDIS_URL`.
@@ -221,7 +194,6 @@ function parseSnapshot(raw: string) {
 
 function isNotFoundError(error: any) {
   return (
-    error?.code === 5 ||
     error?.code === 404 ||
     error?.status === 404 ||
     error?.response?.status === 404 ||
@@ -274,17 +246,19 @@ function createGCSObjectStore(client: LegacyGCSClient): GCSObjectStore {
 }
 
 async function createDefaultGCSObjectStore(): Promise<GCSObjectStore> {
-  const { v2 } = await import("@google-cloud/storage-control");
-  const gcs = new v2.StorageClient() as unknown as GCSStorageControlClient;
-  const stub = await gcs.initialize();
-
-  const bucketResourceName = (bucket: string) => gcs.bucketPath("_", bucket);
+  const { auth, storage } = await import("@googleapis/storage");
+  const gcs = storage({
+    version: "v1",
+    auth: new auth.GoogleAuth({
+      scopes: ["https://www.googleapis.com/auth/devstorage.read_write"],
+    }),
+  });
 
   return {
     async exists(bucket, path) {
       try {
-        await stub.getObject({
-          bucket: bucketResourceName(bucket),
+        await gcs.objects.get({
+          bucket,
           object: path,
         });
         return true;
@@ -297,81 +271,36 @@ async function createDefaultGCSObjectStore(): Promise<GCSObjectStore> {
     },
 
     async download(bucket, path) {
-      const stream = stub.readObject({
-        bucket: bucketResourceName(bucket),
-        object: path,
-      });
+      const response = await gcs.objects.get(
+        {
+          bucket,
+          object: path,
+          alt: "media",
+        },
+        {
+          responseType: "arraybuffer",
+        },
+      );
 
-      return await new Promise<Uint8Array>((resolve, reject) => {
-        const chunks: Uint8Array[] = [];
-        let settled = false;
-
-        const fail = (error: unknown) => {
-          if (settled) return;
-          settled = true;
-          reject(error);
-        };
-
-        stream.on("data", (response) => {
-          const content = response?.checksummedData?.content;
-          if (content === undefined || content === null) {
-            return;
-          }
-
-          if (typeof content === "string") {
-            chunks.push(Buffer.from(content, "utf-8"));
-            return;
-          }
-          if (content instanceof Uint8Array) {
-            chunks.push(content);
-            return;
-          }
-          if (content instanceof ArrayBuffer) {
-            chunks.push(new Uint8Array(content));
-            return;
-          }
-
-          fail(new TypeError("Unexpected GCS download response body format"));
-        });
+      if (response.data instanceof Uint8Array) {
+        return response.data;
+      }
+      if (response.data instanceof ArrayBuffer) {
+        return new Uint8Array(response.data);
+      }
 
-        stream.on("error", fail);
-        stream.on("end", () => {
-          if (settled) return;
-          settled = true;
-          resolve(Buffer.concat(chunks.map((chunk) => Buffer.from(chunk))));
-        });
-      });
+      throw new TypeError("Unexpected GCS download response body format");
     },
 
     async save(bucket, path, body, options) {
-      const content = Buffer.from(body, "utf-8");
-
-      await new Promise<void>((resolve, reject) => {
-        const stream = stub.writeObject((error) => {
-          if (error) {
-            reject(error);
-            return;
-          }
-          resolve();
-        });
-
-        stream.on("error", reject);
-        stream.write({
-          writeObjectSpec: {
-            resource: {
-              bucket: bucketResourceName(bucket),
-              name: path,
-              contentType: options.contentType,
-            },
-            objectSize: content.byteLength,
-          },
-          writeOffset: 0,
-          checksummedData: {
-            content,
-          },
-          finishWrite: true,
-        });
-        stream.end();
+      await gcs.objects.insert({
+        bucket,
+        name: path,
+        uploadType: "media",
+        media: {
+          mimeType: options.contentType,
+          body,
+        },
       });
     },
   };
diff --git a/packages/node-sdk/test/flagsFallbackProvider.test.ts b/packages/node-sdk/test/flagsFallbackProvider.test.ts
@@ -1,4 +1,3 @@
-import { EventEmitter } from "events";
 import { mkdtemp, readFile, rm } from "fs/promises";
 import os from "os";
 import path from "path";
@@ -242,55 +241,27 @@ describe("flagsFallbackProvider", () => {
     });
   });
 
-  it("creates the default GCS client from @google-cloud/storage-control", async () => {
+  it("creates the default GCS client from @googleapis/storage", async () => {
     vi.resetModules();
 
-    const getObject = vi.fn().mockResolvedValue([{}]);
-    const readObject = vi.fn().mockImplementation(() => {
-      const stream = new EventEmitter();
-      queueMicrotask(() => {
-        stream.emit("data", {
-          checksummedData: {
-            content: Buffer.from(JSON.stringify(snapshot), "utf-8"),
-          },
-        });
-        stream.emit("end");
+    const get = vi
+      .fn()
+      .mockResolvedValueOnce({ data: { kind: "storage#object" } })
+      .mockResolvedValueOnce({
+        data: Buffer.from(JSON.stringify(snapshot), "utf-8"),
       });
-      return stream;
-    });
-    const write = vi.fn();
-    const end = vi.fn().mockImplementation(function (this: EventEmitter) {
-      queueMicrotask(() => callback(null, {}));
-      this.emit("finish");
-    });
-    let callback: ((error: unknown, response?: unknown) => void) | undefined;
-    const writeObject = vi.fn().mockImplementation((cb) => {
-      callback = cb;
-      const stream = new EventEmitter() as EventEmitter & {
-        write: typeof write;
-        end: typeof end;
-      };
-      stream.write = write;
-      stream.end = end;
-      return stream;
-    });
-    const initialize = vi.fn().mockResolvedValue({
-      getObject,
-      readObject,
-      writeObject,
+    const insert = vi.fn().mockResolvedValue({});
+    const storage = vi.fn().mockReturnValue({
+      objects: {
+        get,
+        insert,
+      },
     });
-    const bucketPath = vi
-      .fn()
-      .mockImplementation((project: string, bucket: string) =>
-        `projects/${project}/buckets/${bucket}`,
-      );
-    const StorageClient = vi.fn().mockImplementation(() => ({
-      initialize,
-      bucketPath,
-    }));
+    const GoogleAuth = vi.fn();
 
-    vi.doMock("@google-cloud/storage-control", () => ({
-      v2: { StorageClient },
+    vi.doMock("@googleapis/storage", () => ({
+      auth: { GoogleAuth },
+      storage,
     }));
 
     try {
@@ -305,34 +276,40 @@ describe("flagsFallbackProvider", () => {
       await expect(provider.load(context)).resolves.toEqual(snapshot);
       await provider.save(context, snapshot);
 
-      expect(StorageClient).toHaveBeenCalledWith();
-      expect(initialize).toHaveBeenCalledTimes(1);
-      expect(bucketPath).toHaveBeenCalledWith("_", "bucket-name");
-      expect(getObject).toHaveBeenCalledWith({
-        bucket: "projects/_/buckets/bucket-name",
-        object: `reflag/flags-fallback/flags-fallback-${context.secretKeyHash.slice(0, 16)}.json`,
+      expect(GoogleAuth).toHaveBeenCalledWith({
+        scopes: ["https://www.googleapis.com/auth/devstorage.read_write"],
       });
-      expect(readObject).toHaveBeenCalledWith({
-        bucket: "projects/_/buckets/bucket-name",
+      expect(storage).toHaveBeenCalledWith(
+        expect.objectContaining({
+          version: "v1",
+        }),
+      );
+      expect(get).toHaveBeenNthCalledWith(1, {
+        bucket: "bucket-name",
         object: `reflag/flags-fallback/flags-fallback-${context.secretKeyHash.slice(0, 16)}.json`,
       });
-      expect(write).toHaveBeenCalledWith({
-        writeObjectSpec: {
-          resource: {
-            bucket: "projects/_/buckets/bucket-name",
-            name: `reflag/flags-fallback/flags-fallback-${context.secretKeyHash.slice(0, 16)}.json`,
-            contentType: "application/json",
-          },
-          objectSize: Buffer.byteLength(JSON.stringify(snapshot), "utf-8"),
+      expect(get).toHaveBeenNthCalledWith(
+        2,
+        {
+          bucket: "bucket-name",
+          object: `reflag/flags-fallback/flags-fallback-${context.secretKeyHash.slice(0, 16)}.json`,
+          alt: "media",
         },
-        writeOffset: 0,
-        checksummedData: {
-          content: Buffer.from(JSON.stringify(snapshot), "utf-8"),
+        {
+          responseType: "arraybuffer",
+        },
+      );
+      expect(insert).toHaveBeenCalledWith({
+        bucket: "bucket-name",
+        name: `reflag/flags-fallback/flags-fallback-${context.secretKeyHash.slice(0, 16)}.json`,
+        uploadType: "media",
+        media: {
+          mimeType: "application/json",
+          body: JSON.stringify(snapshot),
         },
-        finishWrite: true,
       });
     } finally {
-      vi.doUnmock("@google-cloud/storage-control");
+      vi.doUnmock("@googleapis/storage");
       vi.resetModules();
     }
   });
diff --git a/yarn.lock b/yarn.lock

Original file line number	Diff line number	Diff line change
`@@ -46,7 +46,7 @@`
`46`	`46`	`},`
`47`	`47`	`"dependencies": {`
`48`	`48`	`"@aws-sdk/client-s3": "^3.888.0",`
`49`		`- "@google-cloud/storage-control": "0.8.2",`
	`49`	`+ "@googleapis/storage": "21.2.0",`
`50`	`50`	`"@redis/client": "^5.11.0",`
`51`	`51`	`"@reflag/flag-evaluation": "1.0.0"`
`52`	`52`	`}`