🐛 [@firebase-function-kits/firestore-bundle-builder] Missing requiresAPI declarations for Cloud Firestore and Cloud Storage APIs

[shettyvarun268]

[REQUIRED] Step 2: Describe your configuration

• Extension / Kit name: firestore-bundle-builder (@firebase-function-kits/firestore-bundle-builder)
• Extension / Kit version: 0.0.2-rc.2
• Firebase Tools version: 15.29.0
• Configuration values:
  • Clean GCP / Firebase project deployment where Cloud Firestore API was not previously enabled.

[REQUIRED] Step 3: Describe the problem

@firebase-function-kits/firestore-bundle-builder fails with HTTP 500 / 7 PERMISSION_DENIED: Cloud Firestore API has not been used in project ... before or it is disabled upon initial request on fresh projects because requiresAPI("firestore.googleapis.com", ...) is not declared in src/index.ts.

Steps to reproduce:

1. Create a brand-new GCP/Firebase project (or test on a clean project where firestore.googleapis.com is not pre-enabled).
2. Scaffold and deploy @firebase-function-kits/firestore-bundle-builder@0.0.2-rc.2 using Firebase CLI 15.29.0 with standard .env:

   FUNCTION_DEFAULT_REGION=us-central1
   BUNDLESPEC_COLLECTION=bundles
   BUNDLE_STORAGE_BUCKET=<bucket-name>
   STORAGE_PREFIX=bundles

   firebase deploy --only functions --force

3. Invoke the deployed function URL:

   curl -i https://<function-url>/test-bundle

Expected result

firebase deploy identifies the required Google Cloud APIs via requiresAPI() and enables firestore.googleapis.com and storage.googleapis.com automatically during deployment. The function successfully queries Firestore and returns HTTP 404: Could not find bundle with ID test-bundle.

Actual result

firebase deploy completes without enabling firestore.googleapis.com because requiresAPI is missing from src/index.ts. When invoked, the function throws a runtime error and returns HTTP 500:

Unhandled error Error: 7 PERMISSION_DENIED: Cloud Firestore API has not been used in project <project-id> before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/firestore.googleapis.com/overview?project=<project-id> then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.
    at callErrorFromStatus (/workspace/node_modules/@firebase-function-kits/firestore-bundle-builder/node_modules/@grpc/grpc-js/build/src/call.js:32:19)
    at Object.onReceiveStatus (/workspace/node_modules/@firebase-function-kits/firestore-bundle-builder/node_modules/@grpc/grpc-js/build/src/client.js:359:73)
    at Object.onReceiveStatus (/workspace/node_modules/@firebase-function-kits/firestore-bundle-builder/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:327:181)
    at /workspace/node_modules/@firebase-function-kits/firestore-bundle-builder/node_modules/@grpc/grpc-js/build/src/resolving-call.js:135:78
    at process.processTicksAndRejections (node:internal/process/task_queues:85:11)

Proposed Fix:

In src/index.ts, declare the required APIs:

import { requiresAPI, requiresRole } from "firebase-functions/v2";

const REQUIRED_APIS = [
  {
    api: "firestore.googleapis.com",
    reason: "Needed to read bundle specifications and documents from Cloud Firestore.",
  },
  {
    api: "storage.googleapis.com",
    reason: "Needed to read and write bundle file caches in Cloud Storage.",
  },
];

for (const { api, reason } of REQUIRED_APIS) {
  requiresAPI(api, reason);
}

[IzaakGough]

@shettyvarun268 Thanks for the detailed report again!

This checks out. kits/firestore-bundle-builder/src/index.ts declares requiresRole() for four roles and no requiresAPI().

On the two APIs in the proposed fix:

• storage.googleapis.com is already enabled by the same deploy that creates the function. In firebase-tools 15.29.0, ensureAllRequiredAPIsEnabled in lib/deploy/functions/prepare.js runs before any function is created, and whenever the backend being deployed contains a gen2 endpoint it enables cloudRunApiOrigin, eventarcOrigin, pubsubOrigin and storageOrigin. storageOrigin() is storage.googleapis.com, and this kit's serve is a gen2 onRequest, so that runs on a first deploy too.

• firestore.googleapis.com is the real gap, and it is not specific to this kit. 11 of the 13 kits use Firestore and none of them declares it.

Most of those fail earlier and more clearly than this one. ensureTriggerRegions looks up the Firestore database at deploy time to resolve a trigger's region, but it skips anything that is not event-triggered. Four kits use Firestore at runtime without a Firestore trigger, so nothing checks them at deploy and the failure lands at runtime: firestore-bundle-builder, bigquery-firestore-export, delete-user-data and speech-to-text.

We will add firestore.googleapis.com to REQUIRED_APIS across all 11.

Two related gaps turned up in the same audit, which we will fix in the same pass:

• firestore-incremental-capture declares roles/dataflow.developer, roles/bigquery.dataEditor and roles/bigquery.user and uses @google-cloud/dataflow and @google-cloud/bigquery, but declares no APIs at all. Missing dataflow.googleapis.com and bigquery.googleapis.com.
• storage-resize-images declares roles/aiplatform.user and uses @genkit-ai/vertexai in its content filter, but declares only storage-component.googleapis.com. Missing aiplatform.googleapis.com.