Inappropriate 403 when attempting to commit an empty batch

[joshforman]

If you are still having issues, please be sure to include as much information as possible:

Environment details

• OS type and version: I am running on modal containers, off of their Image.debian_slim()
• Python version: 3.11.10 (main, Dec 3 2024, 02:25:00) [GCC 12.2.0]
• google-cloud-firestore version: 2.19.0

Steps to reproduce

1. Start a batch
2. Perform a batch.commit without any operations in the batch
3. Get a 403

Code example

db = firestore.Client(project="{proj}", credentials=credentials, database="{db}")
batch = db.batch()
batch.commit()

Stack trace

Traceback (most recent call last):
  File "/root/clean-dataset.py", line 111, in clean_dataset
    batch.commit()
  File "/usr/local/lib/python3.11/site-packages/google/cloud/firestore_v1/batch.py", line 59, in commit
    commit_response = self._client._firestore_api.commit(
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/google/cloud/firestore_v1/services/firestore/client.py", line 1372, in commit
    response = rpc(
               ^^^^
  File "/usr/local/lib/python3.11/site-packages/google/api_core/gapic_v1/method.py", line 131, in __call__
    return wrapped_func(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/google/api_core/retry/retry_unary.py", line 293, in retry_wrapped_func
    return retry_target(
           ^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/google/api_core/retry/retry_unary.py", line 153, in retry_target
    _retry_error_helper(
  File "/usr/local/lib/python3.11/site-packages/google/api_core/retry/retry_base.py", line 212, in _retry_error_helper
    raise final_exc from source_exc
  File "/usr/local/lib/python3.11/site-packages/google/api_core/retry/retry_unary.py", line 144, in retry_target
    result = target()
             ^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/google/api_core/timeout.py", line 120, in func_with_timeout
    return func(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/google/api_core/grpc_helpers.py", line 78, in error_remapped_callable
    raise exceptions.from_grpc_error(exc) from exc
google.api_core.exceptions.PermissionDenied: 403 Missing or insufficient permissions.

Note that with

os.environ["GOOGLE_CLOUD_DEBUG_LOGGING"] = "true"
logging.basicConfig(level=logging.DEBUG)
logging.getLogger("google.cloud").setLevel(logging.DEBUG)

there was nothing in the output suggestive of an error, and in fact the most recent entry before the failure was:

DEBUG:hpack.hpack:Decoded (b'grpc-status', b'0'), consumed 1

I ran into this problem while cleaning a dataset, where I stream through batches of X documents and add fields to certain documents noting that I want them excluded from downstream processing. This process was failing deterministically but seemingly randomly when my batch sizes were set at different numbers, with a correlation between larger batch sizes and longer operation until failure. Eventually I added a check to skip batch.commit() if there were no batch.set() operations being performed on the batch, and the error no longer occurs in my script.