The latest Firebase CLI breaks some local extensions

[umaar]

Environment info

firebase-tools: 12.4.2

Platform: macOS

Has the new Firebase CLI changed how Extensions work? Because things aren't working for me anymore:

i  functions: Beginning execution of "europe-west2-ext-storage-extract-image-text-extractText"
⚠  functions: Error: 3 INVALID_ARGUMENT: Project 'project:demo-codelab-test-1' not found or deleted.
    at callErrorFromStatus (/Users/umarhansa/.cache/firebase/extensions/googlecloud/storage-extract-image-text@0.1.3/functions/node_modules/@grpc/grpc-js/build/src/call.js:31:19)
    at Object.onReceiveStatus (/Users/umarhansa/.cache/firebase/extensions/googlecloud/storage-extract-image-text@0.1.3/functions/node_modules/@grpc/grpc-js/build/src/client.js:192:76)

This was working fine previously, using local Firebase demo projects. After having upgraded Firebase to 12.4.2, it has stopped working showing the error above.

To reproduce, just install an extension in a local Firebase demo project, for example googlecloud/storage-extract-image-text. The extension doesn't work on the latest Firebase CLI.

[google-oss-bot]

This issue does not seem to follow the issue template. Make sure you provide all the required information.

[aalej]

Hi @umaar. I tried to replicate this issue, but I encountered no errors when running the Firebase Extensions emulator. I understand that you used a demo project for this, but since it looks like the extension makes calls to Google Cloud APIs that do not have Emulators, I used an actual project ID to try and repro this.

Let me know if I may have made a mistake or missed anything; the steps I took were:

1. Run firebase init --project <project_id>
   1. Selected extensions, firestore, and storage
2. Run firebase ext:install googlecloud/storage-extract-image-text
3. Run firebase emulators:start
4. Upload an image to the Cloud Storage emulator in the INCLUDE_PATH_LIST path

After doing the steps above, a collection was created in the Firestore emulator containing the extracted text and no errors were raised.

Could you provide an MCVE or more details on the steps you took so that we can reproduce the issue on our end? Thanks!

[umaar]

Hi @aalej I believe the reason you could not reproduce is because you've not used a demo project which is what this bug report is about.

Previously, a demo project did work when using a Firebase extension. The workflow worked just as a user might expect. After upgrading the Firebase CLI, a regression happened and this same workflow stopped working.

Using Firebase extensions in a demo project, regardless of whether they call out to Google Cloud APIs, is a supported feature, and was working fine in v12.4.0. After upgrading to v12.4.2, this breaks certain Firebase extensions.

As for the steps to reproduce, the steps you have written are correct, but needs to factor in the previously mentioned caveat: this is related to demo projects. Not real project IDs.

Project IDs for demo projects have the demo- prefix.

So just to clarify, local demo projects were fully compatible with Firebase extensions, but the latest Firebase CLI breaks this.

[joehan]

Hey @umaar, thanks for reporting this. I dug into the code a bit, and I believe this an issue with the extension code, not with the emulator suite. The extract-images extension makes a call to the Cloud Vision API, as whatever project is provided by the application default credentials (https://github.com/GoogleCloudPlatform/firebase-extensions/blob/73b251dcb06d6495cf9d714bc545548b67ffa87c/storage-extract-image-text/functions/src/index.ts#L48). Since the demo project does not exist and there is no Cloud Vision emulator, this call fails. Although the extensions emulator does support demo- projects, there are some cases where extension code makes it impossible to do so, hence the warning the CLI displays:

I don't think this was caused by a new version of the CLI - I tested this on 12.4.2, 12.4.0, and 12.0.0 with the same results each time. If this was working in the past for you, its possible that you had GOOGLE_APPLICATION_CREDENTIALS set to a service account from a different project, and the extension's code picked that up & called the Cloud Vision API as that project.

[umaar]

Thank you so much for investigating this one! I'm happy to file a bug in any place you think is best. But I thought I'd give a full output of:

• No GOOGLE_APPLICATION_CREDENTIALS set of 12.4.0
• GOOGLE_APPLICATION_CREDENTIALS set of 12.4.0
• GOOGLE_APPLICATION_CREDENTIALS set on 12.4.3

I think the thing that's throwing me off, is if the same extension code is being used, how are we seeing different results based on the Firebase CLI version? Wouldn't that suggest the Firebase CLI introduced a breaking change, or maybe handles certain extensions differently? Anyway, here's the logs of those 3 scenarios, maybe it helps with figuring something out, or maybe it reinforces your suspicion that it's an extension bug! If the latter, I'll file it in their repo.

➜ echo $GOOGLE_APPLICATION_CREDENTIALS
# <nothing>

 ➜ firebase --version
# 12.4.0

Output of using the translate extension:

function[europe-west2-ext-firestore-translate-text-fstranslate]
extension[firestore-translate-text]
Google API requested!
   - URL: "https://oauth2.googleapis.com/token"
   - Be careful, this may be a production service.
19:49:14
W
function[europe-west2-ext-firestore-translate-text-fstranslate]
extension[firestore-translate-text]
Google API requested!
   - URL: "https://translation.googleapis.com/language/translate/v2/"
   - Be careful, this may be a production service.
19:49:14
I
function[europe-west2-ext-firestore-translate-text-fstranslate]
extension[firestore-translate-text]

Cloud Translation API has not been used in project 563584335869 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/translate.googleapis.com/overview?project=563584335869 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.\n    at new ApiError (/Users/me/.cache/firebase/extensions/firebase/firestore-translate-text@0.1.12/functions/node_modules/@google-cloud/common/build/src/util.js:58:15....

Output of using the text to speech extension:

Beginning execution of "europe-west2-ext-text-to-speech-textToSpeech"
19:59:55
W
function[europe-west2-ext-text-to-speech-textToSpeech]
extension[text-to-speech]
Google API requested!
   - URL: "https://oauth2.googleapis.com/token"
   - Be careful, this may be a production service.

user.message="Error: 7 PERMISSION_DENIED: Cloud Text-to-Speech API has not been used in project 563584335869 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/texttospeech.googleapis.com/overview?project=563584335869 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.\n    at callErrorFromStatus (/Users/me/.cache/firebase/extensions/googlecloud/text-to-speech@0.1.3/functions/node_modules/@grpc/grpc-js/build/src/call.js:31:19)...

Run:

 ➜ export GOOGLE_APPLICATION_CREDENTIALS="creds.json"
 ➜ echo $GOOGLE_APPLICATION_CREDENTIALS
# creds.json

Re-run the firebase emulators:start command and trigger the translate extension (it works as expected):

20:06:37
I
function[europe-west2-ext-firestore-translate-text-fstranslate]
extension[firestore-translate-text]
Beginning execution of "europe-west2-ext-firestore-translate-text-fstranslate"

Output of using the text to speech extension (it works):

20:08:26
I
function[europe-west2-ext-speech-to-text-transcribeAudio]
extension[speech-to-text]
Beginning execution of "europe-west2-ext-speech-to-text-transcribeAudio"

Update firebase-tools

npm install -g firebase-tools
 ➜ firebase --version
# 12.4.3

 ➜ echo $GOOGLE_APPLICATION_CREDENTIALS
# creds.json

Re-run the firebase emulators:start command.

The translate extension works, but how about triggering the text to speech extension:

function[europe-west2-ext-text-to-speech-textToSpeech]
extension[text-to-speech]
Beginning execution of "europe-west2-ext-text-to-speech-textToSpeech"
20:15:49
I
function[europe-west2-ext-text-to-speech-textToSpeech]
extension[text-to-speech]
{
  "severity": "ERROR",
  "message": "Error: 3 INVALID_ARGUMENT: Project 'project:demo-codelab-test-1' not found or deleted.\n    at callErrorFromStatus (/Users/me/.cache/firebase/extensions/googlecloud/text-to-speech@0.1.3/functions/node_modules/@grpc/grpc-js/build/src/call.js:31:19)...

That's it for now, but I think it's worth noting Project 'project:demo-codelab-test-1' not found or deleted is not the same error that appears when GOOGLE_APPLICATION_CREDENTIALS is not set on 12.4.0.

its possible that you had GOOGLE_APPLICATION_CREDENTIALS set to a service account from a different project, and the extension's code picked that up & called the Cloud Vision API as that project.

This is indeed the case! And my (maybe naive) understanding is that this is expected behaviour. But what's left unclear, is if this is working on 12.4.0, why isn't it working after upgrading the Firebase CLI. If the extension code can successfully use the service account of a different project with the older Firebase CLI, why can the same extension not use that same service account of a different project with the newer Firebase CLI?

Thanks again for digging into this and if I need to file this elsewhere, let me know!