test: verify Secret Manager API enablement for Developer Connect changes

[annajowang]

Description

Ensures that the Firebase App Hosting onboarding flow explicitly enables the Secret Manager API alongside the Developer Connect API. Developer Connect is undergoing changes starting September 21, 2026, where it will no longer automatically enable the Secret Manager API.

This PR adds unit tests to backend.spec.ts verifying that ensureRequiredApisEnabled and createGitRepoLink correctly and explicitly enable the Secret Manager API. The codebase already explicitly enables this API in these locations, so this change guarantees that the flow will not break when the dependency is removed.

Fixes b/524212868

Scenarios Tested

• Ran npx mocha src/apphosting/backend.spec.ts to verify tests pass.
• Ran npm run lint:changed-files to ensure formatting/linting is clean.

Sample Commands

npx mocha src/apphosting/backend.spec.ts

[gemini-code-assist]

Code Review

This pull request adds unit tests for ensureRequiredApisEnabled and createGitRepoLink in src/apphosting/backend.spec.ts. The review feedback recommends removing a redundant try-finally block in the createGitRepoLink test, as stubs are already automatically restored in the afterEach hook. Removing this block simplifies the test structure and aligns with the repository's style guide to minimize nesting.

[gemini-code-assist]

The try-finally block is redundant here because sinon.verifyAndRestore() is already called in the afterEach hook (line 88), which automatically restores all stubs created on the default sandbox. Removing the try-finally block reduces unnecessary nesting and improves readability, adhering to the repository style guide's recommendation to reduce nesting as much as possible.

      await createGitRepoLink(projectId, location, "connectionId");
      expect(ensureStub).to.have.been.calledWith(
        projectId,
        developerConnectOrigin(),
        "apphosting",
        true,
      );
      expect(ensureStub).to.have.been.calledWith(
        projectId,
        secretManagerOrigin(),
        "apphosting",
        true,
      );
      expect(ensureStub).to.have.been.calledWith(projectId, iamOrigin(), "apphosting", true);
      expect(linkGitHubRepositoryStub).to.have.been.calledWith(
        projectId,
        location,
        "connectionId",
      );

References

1. Reduce nesting as much as possible. Code should avoid unnecessarily deep nesting or long periods of nesting. ^(link)