Update generate-thumbnail example because file.getSignedURL() does not work in the Cloud Functions environment

How to reproduce these conditions

Sample name or URL where you found the bug https://github.com/firebase/functions-samples/blob/master/generate-thumbnail/functions/index.js Failing Function code used (including require/import commands at the top)

Steps to set up and reproduce This is the part that need to be updated to avoid the error. const config = { action: 'read', expires: '03-01-2500', }; const results = await Promise.all([ thumbFile.getSignedUrl(config), file.getSignedUrl(config), ]);

Debug output

Errors in the console logs

Error: The caller does not have permission at Gaxios._request (/workspace/node_modules/gaxios/build/src/gaxios.js:89:23) at processTicksAndRejections (internal/process/task_queues.js:97:5) at async Compute.requestAsync (/workspace/node_modules/@google-cloud/common/node_modules/google-auth-library/build/src/auth/oauth2client.js:343:18) at async GoogleAuth.sign (/workspace/node_modules/@google-cloud/common/node_modules/google-auth-library/build/src/auth/googleauth.js:573:21) at async sign (/workspace/node_modules/@google-cloud/storage/build/src/signer.js:91:35)

Error: Process exited with code 16 at process.<anonymous> (/layers/google.nodejs.functions-framework/functions-framework/node_modules/@google-cloud/functions-framework/build/src/invoker.js:271:38) at process.emit (events.js:315:20) at process.EventEmitter.emit (domain.js:483:12) at process.exit (internal/process/per_thread.js:167:15) at Object.logAndSendError (/layers/google.nodejs.functions-framework/functions-framework/node_modules/@google-cloud/functions-framework/build/src/logger.js:37:9) at process.<anonymous> (/layers/google.nodejs.functions-framework/functions-framework/node_modules/@google-cloud/functions-framework/build/src/invoker.js:268:22) at process.emit (events.js:315:20) at process.EventEmitter.emit (domain.js:483:12) at processPromiseRejections (internal/process/promises.js:209:33) at processTicksAndRejections (internal/process/task_queues.js:98:32) Screenshots

Expected behavior

When it calls file.getSignedUrl() it should retrieve a temporary url to download the new file.

Actual behavior

There is an error indicating that the caller does not have permission, inspecting the documentation of the cloud storage library for node in https://googleapis.dev/nodejs/storage/latest/File.html#getSignedUrl it says that in GCP environmets like Cloud Functions the signBlob API should be used. I think that the example should be updated to use this API.

[leechy]

Just follow the instructions in the README, and this error will gone:

Go to your project’s Cloud Console > IAM & admin > IAM, Find the App Engine default service account and add the Service Account Token Creator role to that member. This will allow your app to create signed public URLs to the images.

[fchabouis]

And if there are French speaking person here, Service Account Token Creator is “Créateur de jetons du compte de service”.