🐛 [storage-resize-images] Resize fails with `CONTENT_FILTER_LEVEL=BLOCK_ONLY_HIGH` from lack of API permissions

[ajperel]

[REQUIRED] Step 2: Describe your configuration

• Kit name: storage-resize-images

• Kit version 0.0.2-rc.2

• Configuration values (redact info where appropriate):

  • CONTENT_FILTER_LEVEL=BLOCK_ONLY_HIGH

[REQUIRED] Step 3: Describe the problem

Steps to reproduce:

1. Deploy a new instance of this kit with CONTENT_FILTER_LEVEL=BLOCK_ONLY_HIGH in a project where Vertex AI API (aiplatform.googleapis.com) is not enabled
2. Upload an image to the GGS Bucket

Expected result

Kit should would and resize the image

Actual result

No resize happens. Looking at the logs:

ERROR 2026-09-03T20:25:12.142142Z Error: Failed to evaluate image content after multiple attempts: ClientError: [VertexAI.ClientError]: got status: 403 Forbidden. {"error":{"code":403,"message":"Agent Platform API has not been used in project ajp-testing before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/aiplatform.googleapis.com/overview?project=ajp-testing then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.","status":"PERMISSION_DENIED","details":[{"@type":"type.googleapis.com/google.rpc.ErrorInfo","reason":"SERVICE_DISABLED","domain":"googleapis.com","metadata":{"service":"aiplatform.googleapis.com","serviceTitle":"Agent Platform API","containerInfo":"ajp-testing","consumer":"projects/ajp-testing","activationUrl":"https://console.developers.google.com/apis/api/aiplatform.googleapis.com/overview?project=ajp-testing"}},{"@type":"type.googleapis.com/google.rpc.LocalizedMessage","locale":"en-US","message":"Agent Platform API has not been used in project ajp-testing before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/aiplatform.googleapis.com/overview?project=ajp-testing then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry."},{"@type":"type.googleapis.com/google.rpc.Help","links":[{"description":"Google developers console API activation","url":"https://console.developers.google.com/apis/api/aiplatform.googleapis.com/overview?project=ajp-testing"}]}]}} at entryFromArgs (/workspace/node_modules/@firebase-function-kits/storage-resize-images/node_modules/firebase-functions/lib/logger/index.js:120:13) at Object.error (/workspace/node_modules/@firebase-function-kits/storage-resize-images/node_modules/firebase-functions/lib/logger/index.js:109:8) at Object.contentFilterFailed (/workspace/node_modules/@firebase-function-kits/storage-resize-images/lib/logs.js:96:66) at attemptWithRetry (/workspace/node_modules/@firebase-function-kits/storage-resize-images/lib/content-filter.js:176:17) at process.processTicksAndRejections (node:internal/process/task_queues:104:5) at async run (/workspace/node_modules/@firebase-function-kits/storage-resize-images/node_modules/p-queue/dist/index.js:163:29)
  {
    "textPayload": "Error: Failed to evaluate image content after multiple attempts: ClientError: [VertexAI.ClientError]: got status: 403 Forbidden. {\"error\":{\"code\":403,\"message\":\"Agent Platform API has not been used in project ajp-testing before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/aiplatform.googleapis.com/overview?project=ajp-testing then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.\",\"status\":\"PERMISSION_DENIED\",\"details\":[{\"@type\":\"type.googleapis.com/google.rpc.ErrorInfo\",\"reason\":\"SERVICE_DISABLED\",\"domain\":\"googleapis.com\",\"metadata\":{\"service\":\"aiplatform.googleapis.com\",\"serviceTitle\":\"Agent Platform API\",\"containerInfo\":\"ajp-testing\",\"consumer\":\"projects/ajp-testing\",\"activationUrl\":\"https://console.developers.google.com/apis/api/aiplatform.googleapis.com/overview?project=ajp-testing\"}},{\"@type\":\"type.googleapis.com/google.rpc.LocalizedMessage\",\"locale\":\"en-US\",\"message\":\"Agent Platform API has not been used in project ajp-testing before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/aiplatform.googleapis.com/overview?project=ajp-testing then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.\"},{\"@type\":\"type.googleapis.com/google.rpc.Help\",\"links\":[{\"description\":\"Google developers console API activation\",\"url\":\"https://console.developers.google.com/apis/api/aiplatform.googleapis.com/overview?project=ajp-testing\"}]}]}}\n    at entryFromArgs (/workspace/node_modules/@firebase-function-kits/storage-resize-images/node_modules/firebase-functions/lib/logger/index.js:120:13)\n    at Object.error (/workspace/node_modules/@firebase-function-kits/storage-resize-images/node_modules/firebase-functions/lib/logger/index.js:109:8)\n    at Object.contentFilterFailed (/workspace/node_modules/@firebase-function-kits/storage-resize-images/lib/logs.js:96:66)\n    at attemptWithRetry (/workspace/node_modules/@firebase-function-kits/storage-resize-images/lib/content-filter.js:176:17)\n    at process.processTicksAndRejections (node:internal/process/task_queues:104:5)\n    at async run (/workspace/node_modules/@firebase-function-kits/storage-resize-images/node_modules/p-queue/dist/index.js:163:29)",
    "insertId": "6a99d7a800022b3ef7c681c2",
    "resource": {
      "type": "cloud_run_revision",
      "labels": {
        "revision_name": "kit-storage-resize-images-generateresizedimage-00001-wiv",
        "configuration_name": "kit-storage-resize-images-generateresizedimage",
        "location": "us-east1",
        "project_id": "ajp-testing",
        "service_name": "kit-storage-resize-images-generateresizedimage"
      }
    },
    "timestamp": "2026-09-03T20:25:12.142142Z",
    "severity": "ERROR",
    "labels": {
      "execution_id": "lz4zce86b5bi",
      "firebase-declarative-security-etag": "b9h82tvb4a-g7mlzvnymct535ninwf9jdvtwkarsoee",
      "firebase-functions-codebase": "storage-resize-images",
      "goog-managed-by": "cloudfunctions",
      "firebase-functions-hash": "4dd251dbd35e645ed5904b43e4d43a1cf5d3c961",
      "instanceId": "00a41e8c1df76bec2d6fdb77929ea60b053bbbd3431cb612a198bd877b0c001e8cc2c7f75d0edaf63f31a1114190ff678aedffd21b062e9b63ba064750a945fec018ce8b62993f770d1786fad309",
      "run.googleapis.com/base_image_versions": "us-docker.pkg.dev/serverless-runtimes/google-24-full/runtimes/nodejs24:nodejs24_20260819_24_19_0_RC00"
    },
    "logName": "projects/ajp-testing/logs/run.googleapis.com%2Fstderr",
    "trace": "projects/ajp-testing/traces/0f1dbffe3e4f86dfd6e3869db26b4045",
    "receiveTimestamp": "2026-09-03T20:25:12.263096022Z",
    "spanId": "5999323791439393253",
    "errorGroups": [
      {
        "id": "CPTJ2fj3s5D8zwE"
      }
    ]
  }

Analysis from Gemini

Why this happened: Your instance configuration (.env.ajp-testing) has CONTENT_FILTER_LEVEL=BLOCK_ONLY_HIGH set. This activates the kit's image moderation check (content-filter.ts), which uses Genkit (@genkit-ai/vertexai) and Vertex AI (gemini-2.5-flash).

[ajperel]

After running gcloud services enable aiplatform.googleapis.com --project=ajp-testing upload does complete successfully. I think we just need to add this to the declarative security declarations.

[CorieW]

Oh, interesting. Looks like the extension didn't have this API documented either:

extensions/storage-resize-images/extension.yaml

Lines 45 to 48 in 716ae2c

	apis:
	- apiName: storage-component.googleapis.com
	reason: Needed to use Cloud Storage

Appreciate these issue reports!

[CorieW]

Applied the fix.

One downside, though, is that this API will be required for all users of the kit, even if they aren’t using the content filter.