Add support for limited use tokens #1811
Conversation
Summary of ChangesHello @AustinBenoit, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces a significant new feature to the Firebase App Check C++ SDK: support for limited use tokens. This enhancement allows developers to request App Check tokens specifically designed for short-lived or single-use operations, improving the flexibility and security posture of applications. The changes span across the core App Check provider interface, platform-specific implementations for Android and iOS, and the desktop debug provider, ensuring comprehensive coverage and testability. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces support for 'Limited Use Tokens' in Firebase App Check across various platforms. The changes include adding a GetLimitedUseToken method to the AppCheckProvider interface with a default implementation that falls back to GetToken if not overridden. The Debug provider for desktop is updated to implement GetLimitedUseToken by calling a new internal GetTokenInternal method with a limited_use flag, which is then propagated to the DebugTokenRequest via a new SetLimitedUse method and a limited_use field in its FlatBuffers schema. For Android, JNI bindings for nativeGetLimitedUseToken are added, though the provided diffs show an issue where the nativeGetToken implementation was modified to call GetLimitedUseToken, and the nativeGetLimitedUseToken implementation appears incomplete. On iOS, a new getLimitedUseTokenWithCompletion: method is added to FIRAppCheckProvider to call the C++ GetLimitedUseToken. An integration test for TestDebugProviderValidLimitedUseToken is also added. Review comments highlight code duplication in the new Android and iOS getLimitedUseToken implementations, suggesting extraction of common logic into helper methods, and point out a typo ('Limted' to 'Limited') in the release notes.
| - (void)getLimitedUseTokenWithCompletion:(nonnull void (^)(FIRAppCheckToken* _Nullable, | ||
| NSError* _Nullable))handler { | ||
| auto token_callback{[handler](firebase::app_check::AppCheckToken token, int error_code, | ||
| const std::string& error_message) { | ||
| NSError* ios_error = firebase::app_check::internal::AppCheckErrorToNSError( | ||
| static_cast<firebase::app_check::AppCheckError>(error_code), error_message); | ||
| FIRAppCheckToken* ios_token = | ||
| firebase::app_check::internal::AppCheckTokenToFIRAppCheckToken(token); | ||
| handler(ios_token, ios_error); | ||
| }}; | ||
| _cppProvider->GetLimitedUseToken(token_callback); | ||
| } |
There was a problem hiding this comment.
This new method getLimitedUseTokenWithCompletion: is almost identical to the existing getTokenWithCompletion: method. To avoid code duplication, consider extracting the common logic into a private helper method that takes a boolean flag to decide whether to call GetToken or GetLimitedUseToken.
For example:
- (void)getTokenInternalWithLimitedUse:(BOOL)limitedUse
completion:(nonnull void (^)(FIRAppCheckToken* _Nullable,
NSError* _Nullable))handler {
auto token_callback{[handler](firebase::app_check::AppCheckToken token, int error_code,
const std::string& error_message) {
NSError* ios_error = firebase::app_check::internal::AppCheckErrorToNSError(
static_cast<firebase::app_check::AppCheckError>(error_code), error_message);
FIRAppCheckToken* ios_token =
firebase::app_check::internal::AppCheckTokenToFIRAppCheckToken(token);
handler(ios_token, ios_error);
}};
if (limitedUse) {
_cppProvider->GetLimitedUseToken(token_callback);
} else {
_cppProvider->GetToken(token_callback);
}
}Then both getTokenWithCompletion: and getLimitedUseTokenWithCompletion: can call this helper.
| public Task<AppCheckToken> getLimitedUseToken() { | ||
| TaskCompletionSource<AppCheckToken> taskCompletionSource = | ||
| new TaskCompletionSource<AppCheckToken>(); | ||
| // Call the C++ provider to get an AppCheckToken and set the task result. | ||
| // The C++ code will call handleGetTokenResult with the resulting token. | ||
| nativeGetLimitedUseToken(cProvider, taskCompletionSource); | ||
| return taskCompletionSource.getTask(); | ||
| } |
There was a problem hiding this comment.
The new getLimitedUseToken() method is very similar to the existing getToken() method. To reduce code duplication, you could extract the common logic into a private helper method. This helper could accept a functional interface that wraps the native method call.
For example (assuming Java 8+):
private Task<AppCheckToken> getTokenInternal(
java.util.function.BiConsumer<Long, TaskCompletionSource<AppCheckToken>> nativeMethod) {
TaskCompletionSource<AppCheckToken> taskCompletionSource = new TaskCompletionSource<>();
// Call the C++ provider to get an AppCheckToken and set the task result.
// The C++ code will call handleGetTokenResult with the resulting token.
nativeMethod.accept(cProvider, taskCompletionSource);
return taskCompletionSource.getTask();
}
@Override
public Task<AppCheckToken> getToken() {
return getTokenInternal(this::nativeGetToken);
}
public Task<AppCheckToken> getLimitedUseToken() {
return getTokenInternal(this::nativeGetLimitedUseToken);
}
AustinBenoit
force-pushed
the
limitedusetoken
branch
from
131d24a to
4fb6af1
Compare
1 participant
Description
Testing
Added a new integration test and ran them locally to ensure they pass.
Type of Change
Place an
xthe applicable box:Notes
Release Notessection ofrelease_build_files/readme.md.