deploy --only auth creates a "Default Web App" in a project with only Android and iOS apps #11250

[REQUIRED] Environment info

firebase-tools: 15.14.0. src/deploy/auth/prepare.ts and src/deploy/auth/deploy.ts are the same on main at v15.33.0.

Platform: macOS

[REQUIRED] Test case

A Firebase project on the Spark plan with Android and iOS apps, registered by flutterfire configure, and no web app. Authentication was never opened in the console.

firebase.json:

{
  "auth": {
    "providers": {
      "emailPassword": true
    }
  }
}

[REQUIRED] Steps to reproduce

1. firebase apps:list --project <project> lists Android and iOS apps only.
2. firebase deploy --only auth --project <project>
3. firebase apps:list WEB --project <project>

[REQUIRED] Expected behavior

The deploy enables the sign-in method and leaves the apps of the project as they are. Turning the same method on in the console registers no app.

If the provisioning API needs an app to address the request to, could the deploy take an app that the project already has, whatever its platform? buildProvisionRequest in src/management/provisioning/provision.ts already builds the request for AppPlatform.ANDROID and AppPlatform.IOS.

If a web app is really required, the guide at https://firebase.google.com/docs/auth/configure-providers-cli could say that the command creates one.

[REQUIRED] Actual behavior

The deploy registers a new web app, "Default Web App", and enables the method through it. Step 3 lists that app.

prepare() in src/deploy/auth/prepare.ts lists only the AppPlatform.WEB apps of the project and creates one when it finds none, and deploy() passes platform: AppPlatform.WEB. Nothing in firebase.json asks for a web app, and the project is for a mobile app only, so a web app shows up in the console that nobody added and nothing uses.

Context: we run the command as a set-up step after flutterfire configure for a Flutter app, so the project has its Android and iOS apps by then.

From --debug, with the ids of the project removed:

i  deploying auth
>>> [apiv2][query] GET https://firebase.googleapis.com/v1beta1/projects/<project>/webApps pageSize=100
No Firebase Web App found. Creating 'Default Web App' for Auth provisioning...
>>> [apiv2][body] POST https://firebase.googleapis.com/v1beta1/projects/<project>/webApps {"displayName":"Default Web App"}
Enabling auth providers: email/password...
>>> [apiv2][body] POST https://firebase.googleapis.com/v1alpha/firebase:provisionFirebaseApp {"appNamespace":"1:<project number>:web:<app id>","parent":"projects/<project>","firebaseAuthInput":{"emailAuthProviderMode":"PROVIDER_ENABLED"},"webInput":{}}
✔  Auth providers enabled: email/password
✔  Deploy complete!