Prefix secret resource IDs for kits instances with kit instance ID - #11092

🔴 [Logic & Runtime Safety] Update endpoint.secretEnvironmentVariables in applyKitSecretRefPrefix and hoist prefix computation

Rationale: In Build, secret references exist in both build.params (SecretParam.resourceId, used by ensureSecret to create/verify secrets in Cloud Secret Manager) and build.endpoints[ep].secretEnvironmentVariables (SecretEnvVar.secret, copied by toBackend and validated by validateSecretVersions).

Because applyEnvSecretBindingsToBuild only updates secretEnvironmentVariables for secrets explicitly overridden in .env files, any default kit secret (not in .env) will have kit-<instanceId>-<name> created in Secret Manager by ensureSecret, while toBackend and validateSecretVersions still reference the unprefixed <name>. Additionally, per go/tsstyle#descriptive-names and go/ts-practices/iteration#for-of, avoid single-letter variable p, intermediate .filter() array allocation, and repeated addKitPrefix(instanceId) calls inside the loop.

Suggested Fix:

export function applyKitSecretRefPrefix(build: Build, instanceId: string): void {
  if (!instanceId) {
    return;
  }
  const prefix = addKitPrefix(instanceId);
  const prefixedSecrets = new Map<string, string>();

  for (const param of build.params) {
    if (params.isSecretParam(param)) {
      const prefixedId = `${prefix}-${param.name}`;
      param.resourceId = prefixedId;
      prefixedSecrets.set(param.name, prefixedId);
    }
  }

  for (const endpoint of Object.values(build.endpoints)) {
    for (const envVar of endpoint.secretEnvironmentVariables ?? []) {
      const prefixedSecret = prefixedSecrets.get(envVar.key);
      if (prefixedSecret) {
        envVar.secret = prefixedSecret;
      }
    }
  }
}

just for the record, if you go to the go links and find what rules the bot is referencing:

Exception: Variables that are in scope for 10 lines or fewer, including arguments that are not part of an exported API, may use short (e.g. single letter) variable names.

For simple transformations, prefer the appropriate transformation function. So the bit about dropping filter in here is specifically against instructions.

🟡 Nit: Consolidate duplicate isKitConfig(codebaseConfig) checks (go/tsstyle#control-flow-statements-blocks)

isKitConfig(codebaseConfig) is evaluated in the ternary on line 855 and immediately checked again in the if statement on line 859.

I could go either way on this one.

i'm not super convinced this is more readable either yeah

🔴 [Architecture & Consistency] kits:install (promptAndWriteKitParams) provisions unprefixed secrets

Rationale: During firebase functions:kits:install (lines 1346 and 1596), discoveredBuild.params is passed to promptAndWriteKitParams without calling applyKitSecretRefPrefix. Consequently, ensureSecret creates unprefixed secrets in Cloud Secret Manager (and writes unprefixed FIREBASE_SECRET_REF_<NAME>=<NAME> bindings to .env.<projectId> when secretEnvParams is enabled). When the user later runs firebase deploy, prepare.ts expects kit-<instanceId>-<NAME>.

Please ensure applyKitSecretRefPrefix is applied to the discovered kit build/params before applyEnvSecretBindingsToParams and resolveParams run in install.ts (and similarly in src/emulator/functionsEmulator.ts:629 for local kit emulation).

Does the emulator support local kit emulation?

This is missing the kit- at the beginning since you didn't use addKitPrefix

Ack

nit extra space in " SMTP_ADDRESS""

Ack