Repository navigation
Conversation
Stop logging externally provided debug tokens when a token exchange fails. Environment variables often hold CI secrets, and the token from FIREBASE_APPCHECK_DEBUG_TOKEN or AppCheckDebugToken was printed at warning level on any exchange error. Log the token source instead. Resolve the token and create the AppCheckCore provider under one lock, and skip the environment handoff when AppCheckCore reads the same variable anyway. Detect HTTP 403 by status code rather than by matching "403" in the error text, which contains the request URL and response body. Drop the #if DEBUG check on injected tokens: it reflects how Firebase was built, which broke zip and Carthage users, and the generated class is already wrapped in #if DEBUG. Check XDG_CONFIG_HOME first, like the Firebase CLI, and use the real home directory on macOS because NSHomeDirectory() is the container in sandboxed apps. Clear the stored debug token between tests and only run the configuration file tests on platforms that read the file, which fixes the Mac Catalyst jobs.
The plugin looked for inject_debug_token.sh in the client's package or Xcode project, where it never exists, so it always generated an empty stub. Embed the generator in the plugin as a prebuild command, which runs on every build and so picks up a new or rotated token without a clean build. Embed only the token for the target's app instead of every token in the Firebase CLI configuration, validate values before writing them into Swift source, and drop the python3 dependency. Apply the same fixes to inject_debug_token.sh for Run Script build phases, ship it with the pod, and document both.
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. |
Firebase 13 no longer supports CocoaPods, so don't ship inject_debug_token.sh with the pod. Document running the script from the Swift package checkout instead, for apps that can't use the plugin.
|
@AustinBenoit I'm still working through this - and will add you back when I'm done |
Follow-up to #16994, based on its branch, that addresses review feedback. It can be merged into #16994 or cherry-picked.
Build plugin and script
inject_debug_token.shundercontext.package.directoryURL(andxcodeProject.directoryURL), which is the client's package or project, so it always fell back to an empty stub. The generator is now embedded in the plugin.--force) wasn't picked up without a clean build. The plugin now uses a prebuild command that runs on every build and rewrites the generated file only when it changes.$XDG_CONFIG_HOME/configstoreis checked before~/.config/configstore, matching configstore. The app ID and token are validated before being written into Swift source. Thepython3dependency is gone (plutilis used instead).inject_debug_token.shis kept, with the same fixes, for apps that use a Run Script build phase instead of the plugin.Runtime
FIREBASE_APPCHECK_DEBUG_TOKEN/AppCheckDebugTokenat warning level. AppCheckCore deliberately avoids this to prevent leaking CI secrets. Only locally generated tokens are printed now; otherwise the message names the source.setenvhandoff to AppCheckCore. Token resolution and AppCheckCore provider creation now happen under one lock (previously resolution ran outside it, so a concurrent init could pick up another app's token). The handoff is skipped when AppCheckCore reads the same environment variable anyway. It remains for the new sources until AppCheckCore can accept a token directly; itsinit(...environment:)is internal today.GACAppCheckHTTPError's description includes the request URL (project and app IDs) and the response body, so matching"403"in the text misclassified other errors. Its errorcodeis0, so thecode == 403check never matched.#if DEBUGcheck on injected tokens. It reflects how Firebase was compiled, so zip and Carthage users (Release-built binaries) never got the injected token and saw a "SECURITY WARNING" error during Debug development. The generated class is already wrapped in#if DEBUG.NSHomeDirectory(), which is the app container in sandboxed apps.[FirebaseAppCheck]prefix, log the token source at Notice level (Info isn't shown by default), and added the project and app IDs to the 403 hint.FIRAppCheckDebugProvider.hdocs and the CHANGELOG.Tests
GACAppCheckDebugTokeninsetUp/tearDown. It leaked between tests:stored_user_defaults_token_555showed up in the Catalyst failures.+tokenskeyed by app ID.Testing
FirebaseAppCheckUnitpasses on macOS, Mac Catalyst, and iOS Simulator.xcodebuild, a rotated, removed, or newly created token is picked up by the next incremental build.XcodeBuildToolPluginentry point on an Xcode project (non-package) target.Open questions
firebase appcheck:debugtokens:create --project <id> --app <id> --forcematch the CLI?