From 2a505edaae5475b5f03dcf2e4024bcc63b63496a Mon Sep 17 00:00:00 2001 From: Corie Watson Date: Wed, 26 Aug 2026 17:34:38 +0100 Subject: [PATCH 1/2] fix(firestore-vector-search): bind provider secrets to task functions GEMINI_API_KEY / OPENAI_API_KEY were bound to the Firestore and callable functions but not to updateTask, backfillTask, updateTrigger, or backfillTrigger -- all of which reach getSingleEmbedding, so a gemini or openai backfill read an undefined key. Tracked in #2974. The secrets now ride on DEFAULT_TASK_OPTIONS and EMBEDDING_TASK_OPTIONS; initVectorSearch's explicit spread becomes redundant and is simplified. --- kits/firestore-vector-search/src/index.ts | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/kits/firestore-vector-search/src/index.ts b/kits/firestore-vector-search/src/index.ts index b8770b537..151defca6 100644 --- a/kits/firestore-vector-search/src/index.ts +++ b/kits/firestore-vector-search/src/index.ts @@ -79,14 +79,19 @@ const REQUIRED_APIS = [ }, ] as const; const FUNCTION_SECRETS = [geminiApiKey, openAiApiKey]; +// The task and trigger functions reach getSingleEmbedding, so they need the +// provider API keys bound like the Firestore and callable functions do -- +// without them a gemini/openai backfill reads an undefined key. const DEFAULT_TASK_OPTIONS = { memory: "512MiB", timeoutSeconds: FUNCTION_TIMEOUT_SECONDS, + secrets: FUNCTION_SECRETS, } as const; const EMBEDDING_TASK_OPTIONS = { memory: "1GiB", timeoutSeconds: FUNCTION_TIMEOUT_SECONDS, retryConfig: { maxAttempts: TASK_MAX_ATTEMPTS }, + secrets: FUNCTION_SECRETS, } as const; const FIRESTORE_FUNCTION_OPTIONS = { memory: "512MiB", @@ -191,10 +196,7 @@ export const queryCallable = onCall(CALLABLE_FUNCTION_OPTIONS, (request) => ); export const initVectorSearch = onTaskDispatched( - { - ...DEFAULT_TASK_OPTIONS, - secrets: FUNCTION_SECRETS, - }, + DEFAULT_TASK_OPTIONS, async () => { await handleInit(getContext()); } From 1ea77fa053bdf7ad3a717e51c01b828fb6765622 Mon Sep 17 00:00:00 2001 From: Corie Watson Date: Thu, 27 Aug 2026 14:27:18 +0100 Subject: [PATCH 2/2] chore(firestore-vector-search): correct the secret-binding rationale comment --- kits/firestore-vector-search/src/index.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kits/firestore-vector-search/src/index.ts b/kits/firestore-vector-search/src/index.ts index 151defca6..5efc8d130 100644 --- a/kits/firestore-vector-search/src/index.ts +++ b/kits/firestore-vector-search/src/index.ts @@ -79,9 +79,9 @@ const REQUIRED_APIS = [ }, ] as const; const FUNCTION_SECRETS = [geminiApiKey, openAiApiKey]; -// The task and trigger functions reach getSingleEmbedding, so they need the -// provider API keys bound like the Firestore and callable functions do -- -// without them a gemini/openai backfill reads an undefined key. +// Only the task functions reach getSingleEmbedding, but every function here +// resolves the same config (which reads the provider keys), and the extension +// bound its secrets to all functions in the instance -- so bind them uniformly. const DEFAULT_TASK_OPTIONS = { memory: "512MiB", timeoutSeconds: FUNCTION_TIMEOUT_SECONDS,