Merge branch 'master' into mrschmidt/storagenode

Author: schmidt-sebastian

.changeset/empty-countries-run.md

@@ -0,0 +1,7 @@
+---
+'@firebase/app-check': minor
+'@firebase/app-check-types': minor
+'firebase': minor
+---
+
+Added `getToken()` and `onTokenChanged` methods to App Check.

packages-exp/auth-exp/src/platform_browser/persistence/indexed_db.ts

@@ -113,8 +113,10 @@ export function _openDatabase(): Promise<IDBDatabase> {
       // https://github.com/firebase/firebase-js-sdk/issues/634
 
       if (!db.objectStoreNames.contains(DB_OBJECTSTORE_NAME)) {
+        // Need to close the database or else you get a `blocked` event
+        db.close();
         await _deleteDatabase();
-        return _openDatabase();
+        resolve(await _openDatabase());
       } else {
         resolve(db);
       }

packages-exp/auth-exp/test/integration/webdriver/persistence.test.ts

@@ -47,7 +47,7 @@ async function testPersistedUser() {
   };
 }
 
-browserDescribe('WebDriver persistence test', driver => {
+browserDescribe('WebDriver persistence test', (driver, browser) => {
   const fullPersistenceKey = `firebase:authUser:${API_KEY}:[DEFAULT]`;
   context('default persistence hierarchy (indexedDB > localStorage)', () => {
     it('stores user in indexedDB by default', async () => {
@@ -381,6 +381,12 @@ browserDescribe('WebDriver persistence test', driver => {
     });
 
     it('stays logged in when switching from legacy SDK and then back (no indexedDB support)', async () => {
+      // Skip this test if running in Firefox. The Legacy SDK incorrectly
+      // implements the db delete + reopen workaround for Firefox.
+      if (browser === 'firefox') {
+        return;
+      }
+
       await driver.webDriver.navigate().refresh();
       // Simulate browsers that do not support indexedDB.
       await driver.webDriver.executeScript('delete window.indexedDB');

packages-exp/auth-exp/test/integration/webdriver/util/test_runner.ts

@@ -31,7 +31,7 @@ import { AuthDriver } from './auth_driver';
  */
 
 interface TempSuite {
-  generator: (driver: AuthDriver) => void;
+  generator: (driver: AuthDriver, browser: string) => void;
   title: string;
 }
 
@@ -45,7 +45,7 @@ const SUITES: TempSuite[] = [];
 /** Main entry point for all WebDriver tests */
 export function browserDescribe(
   title: string,
-  generator: (driver: AuthDriver) => void
+  generator: (driver: AuthDriver, browser: string) => void
 ): void {
   SUITES.push({
     title,
@@ -75,7 +75,7 @@ setTimeout(() => {
       });
 
       for (const { title, generator } of SUITES) {
-        describe(title, () => generator(DRIVER));
+        describe(title, () => generator(DRIVER, browser));
       }
     });
   }

packages-exp/functions-exp/package.json

@@ -52,6 +52,8 @@
   "dependencies": {
     "@firebase/component": "0.5.3",
     "@firebase/messaging-types": "0.5.0",
+    "@firebase/auth-interop-types": "0.1.6",
+    "@firebase/app-check-interop-types": "0.1.0",
     "@firebase/util": "1.1.0",
     "node-fetch": "2.6.1",
     "tslib": "^2.1.0"

packages-exp/functions-exp/src/config.ts

@@ -24,7 +24,10 @@ import {
   InstanceFactory
 } from '@firebase/component';
 import { FUNCTIONS_TYPE } from './constants';
+import { AppCheckInternalComponentName } from '@firebase/app-check-interop-types';
 
+const APP_CHECK_INTERNAL_NAME: AppCheckInternalComponentName =
+  'app-check-internal';
 export function registerFunctions(fetchImpl: typeof fetch): void {
   const factory: InstanceFactory<'functions-exp'> = (
     container: ComponentContainer,
@@ -34,12 +37,14 @@ export function registerFunctions(fetchImpl: typeof fetch): void {
     const app = container.getProvider('app-exp').getImmediate();
     const authProvider = container.getProvider('auth-internal');
     const messagingProvider = container.getProvider('messaging');
+    const appCheckProvider = container.getProvider(APP_CHECK_INTERNAL_NAME);
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     return new FunctionsService(
       app,
       authProvider,
       messagingProvider,
+      appCheckProvider,
       regionOrCustomDomain,
       fetchImpl
     );

packages-exp/functions-exp/src/context.ts

@@ -24,6 +24,10 @@ import {
 } from '@firebase/messaging-types';
 
 import { Provider } from '@firebase/component';
+import {
+  AppCheckInternalComponentName,
+  FirebaseAppCheckInternal
+} from '@firebase/app-check-interop-types';
 
 /**
  * The metadata that should be supplied with function calls.
@@ -32,6 +36,7 @@ import { Provider } from '@firebase/component';
 export interface Context {
   authToken?: string;
   messagingToken?: string;
+  appCheckToken: string | null;
 }
 
 /**
@@ -41,9 +46,11 @@ export interface Context {
 export class ContextProvider {
   private auth: FirebaseAuthInternal | null = null;
   private messaging: FirebaseMessaging | null = null;
+  private appCheck: FirebaseAppCheckInternal | null = null;
   constructor(
     authProvider: Provider<FirebaseAuthInternalName>,
-    messagingProvider: Provider<FirebaseMessagingName>
+    messagingProvider: Provider<FirebaseMessagingName>,
+    appCheckProvider: Provider<AppCheckInternalComponentName>
   ) {
     this.auth = authProvider.getImmediate({ optional: true });
     this.messaging = messagingProvider.getImmediate({
@@ -67,6 +74,15 @@ export class ContextProvider {
         }
       );
     }
+
+    if (!this.appCheck) {
+      appCheckProvider.get().then(
+        appCheck => (this.appCheck = appCheck),
+        () => {
+          /* get() never rejects */
+        }
+      );
+    }
   }
 
   async getAuthToken(): Promise<string | undefined> {
@@ -103,9 +119,22 @@ export class ContextProvider {
     }
   }
 
+  async getAppCheckToken(): Promise<string | null> {
+    if (this.appCheck) {
+      const result = await this.appCheck.getToken();
+      // If getToken() fails, it will still return a dummy token that also has
+      // an error field containing the error message. We will send any token
+      // provided here and show an error if/when it is rejected by the functions
+      // endpoint.
+      return result.token;
+    }
+    return null;
+  }
+
   async getContext(): Promise<Context> {
     const authToken = await this.getAuthToken();
     const messagingToken = await this.getMessagingToken();
-    return { authToken, messagingToken };
+    const appCheckToken = await this.getAppCheckToken();
+    return { authToken, messagingToken, appCheckToken };
   }
 }

packages-exp/functions-exp/src/service.ts

@@ -27,6 +27,7 @@ import { encode, decode } from './serializer';
 import { Provider } from '@firebase/component';
 import { FirebaseAuthInternalName } from '@firebase/auth-interop-types';
 import { FirebaseMessagingName } from '@firebase/messaging-types';
+import { AppCheckInternalComponentName } from '@firebase/app-check-interop-types';
 
 export const DEFAULT_REGION = 'us-central1';
 
@@ -86,10 +87,15 @@ export class FunctionsService implements _FirebaseService {
     readonly app: FirebaseApp,
     authProvider: Provider<FirebaseAuthInternalName>,
     messagingProvider: Provider<FirebaseMessagingName>,
+    appCheckProvider: Provider<AppCheckInternalComponentName>,
     regionOrCustomDomain: string = DEFAULT_REGION,
     readonly fetchImpl: typeof fetch
   ) {
-    this.contextProvider = new ContextProvider(authProvider, messagingProvider);
+    this.contextProvider = new ContextProvider(
+      authProvider,
+      messagingProvider,
+      appCheckProvider
+    );
     // Cancels all ongoing requests when resolved.
     this.cancelAllRequests = new Promise(resolve => {
       this.deleteService = () => {
@@ -234,6 +240,9 @@ async function call(
   if (context.messagingToken) {
     headers['Firebase-Instance-ID-Token'] = context.messagingToken;
   }
+  if (context.appCheckToken !== null) {
+    headers['X-Firebase-AppCheck'] = context.appCheckToken;
+  }
 
   // Default timeout to 70s, but let the options override it.
   const timeout = options.timeout || 70000;

packages-exp/functions-exp/test/utils.ts

@@ -19,6 +19,7 @@ import { FirebaseOptions, FirebaseApp } from '@firebase/app-exp';
 import { Provider, ComponentContainer } from '@firebase/component';
 import { FirebaseAuthInternalName } from '@firebase/auth-interop-types';
 import { FirebaseMessagingName } from '@firebase/messaging-types';
+import { AppCheckInternalComponentName } from '@firebase/app-check-interop-types';
 import { FunctionsService } from '../src/service';
 import { useFunctionsEmulator } from '../src/api';
 import nodeFetch from 'node-fetch';
@@ -51,6 +52,10 @@ export function createTestService(
   messagingProvider = new Provider<FirebaseMessagingName>(
     'messaging',
     new ComponentContainer('test')
+  ),
+  appCheckProvider = new Provider<AppCheckInternalComponentName>(
+    'app-check-internal',
+    new ComponentContainer('test')
   )
 ): FunctionsService {
   const fetchImpl: typeof fetch =
@@ -59,6 +64,7 @@ export function createTestService(
     app,
     authProvider,
     messagingProvider,
+    appCheckProvider,
     region,
     fetchImpl
   );

packages/app-check-types/index.d.ts

@@ -15,6 +15,8 @@
  * limitations under the License.
  */
 
+import { PartialObserver, Unsubscribe } from '@firebase/util';
+
 export interface FirebaseAppCheck {
   /**
    * Activate AppCheck
@@ -36,6 +38,40 @@ export interface FirebaseAppCheck {
    * during `activate()`.
    */
   setTokenAutoRefreshEnabled(isTokenAutoRefreshEnabled: boolean): void;
+
+  /**
+   * Get the current App Check token. Attaches to the most recent
+   * in-flight request if one is present. Returns null if no token
+   * is present and no token requests are in flight.
+   *
+   * @param forceRefresh - If true, will always try to fetch a fresh token.
+   * If false, will use a cached token if found in storage.
+   */
+  getToken(forceRefresh?: boolean): Promise<AppCheckTokenResult>;
+
+  /**
+   * Registers a listener to changes in the token state. There can be more
+   * than one listener registered at the same time for one or more
+   * App Check instances. The listeners call back on the UI thread whenever
+   * the current token associated with this App Check instance changes.
+   *
+   * @returns A function that unsubscribes this listener.
+   */
+  onTokenChanged(observer: PartialObserver<AppCheckTokenResult>): Unsubscribe;
+
+  /**
+   * Registers a listener to changes in the token state. There can be more
+   * than one listener registered at the same time for one or more
+   * App Check instances. The listeners call back on the UI thread whenever
+   * the current token associated with this App Check instance changes.
+   *
+   * @returns A function that unsubscribes this listener.
+   */
+  onTokenChanged(
+    onNext: (tokenResult: AppCheckTokenResult) => void,
+    onError?: (error: Error) => void,
+    onCompletion?: () => void
+  ): Unsubscribe;
 }
 
 /**
@@ -64,6 +100,16 @@ interface AppCheckToken {
   readonly expireTimeMillis: number;
 }
 
+/**
+ * Result returned by `getToken()`.
+ */
+interface AppCheckTokenResult {
+  /**
+   * The token string in JWT format.
+   */
+  readonly token: string;
+}
+
 export type AppCheckComponentName = 'appCheck';
 declare module '@firebase/component' {
   interface NameServiceMapping {