How to Integrate AppCheck in Android | The Vagueness of AppCheck Docs

[erayerdin]

I have successfully integrated Firebase into my project (I can log in with Auth and write to Firestore and such) but the AppCheck integration is damn near impossible. The docs are too vague about how to set it up.

Here's the docs.

Register Firebase Apps is okay.

The Configure a Custom Provider section makes no sense in practice. Nearly all the import statement contains template literal instead of string literal, which errs in code. Even if you change it to string literal, ReactNativeFirebaseAppCheckProvider does not exist.

In Verify AppCheck was initialized correctly section, even though the code imports getToken (with weird spacing around it), it uses appCheckInstance.getToken instead.

So, given the quite strange nature of the docs, the questions here are:

• How do I initialize AppCheck?
• How do I create my custom provider? (It seems it needs a custom provider.)
• How do I getToken?

[mikehardy]

Glad you appreciate the docs, always happy to merge PRs that improve them.

Have you consulted the e2e suite where we exercise all the APIs to verify they work? They're a great reference

react-native-firebase/packages/app-check/e2e/appcheck.e2e.js

Lines 368 to 557 in c0c5054

	describe('modular', function () {
	let appCheckInstance;
	before(async function () {
	const { initializeAppCheck, ReactNativeFirebaseAppCheckProvider } = appCheckModular;
	let provider;
	if (!Platform.other) {
	provider = new ReactNativeFirebaseAppCheckProvider();
	provider.configure({
	android: {
	provider: 'debug',
	debugToken: '698956B2-187B-49C6-9E25-C3F3530EEBAF',
	},
	apple: {
	provider: 'debug',
	debugToken: '698956B2-187B-49C6-9E25-C3F3530EEBAF',
	},
	web: {
	provider: 'debug',
	siteKey: 'none',
	},
	});
	} else {
	provider = new ReactNativeFirebaseAppCheckProvider({
	getToken() {
	return FirebaseHelpers.fetchAppCheckToken();
	},
	});
	}
	// Our tests configure a debug provider with shared secret so we should get a valid token
	appCheckInstance = await initializeAppCheck(undefined, {
	provider,
	isTokenAutoRefreshEnabled: false,
	});
	});
	describe('setTokenAutoRefresh())', function () {
	it('should set token refresh', async function () {
	const { setTokenAutoRefreshEnabled } = appCheckModular;
	setTokenAutoRefreshEnabled(appCheckInstance, false);
	// Only iOS lets us assert on this unfortunately, other platforms have no accessor
	if (Platform.ios) {
	let tokenRefresh =
	await NativeModules.RNFBAppCheckModule.isTokenAutoRefreshEnabled('[DEFAULT]');
	tokenRefresh.should.equal(false);
	}
	setTokenAutoRefreshEnabled(appCheckInstance, true);
	// Only iOS lets us assert on this unfortunately, other platforms have no accessor
	if (Platform.ios) {
	tokenRefresh =
	await NativeModules.RNFBAppCheckModule.isTokenAutoRefreshEnabled('[DEFAULT]');
	tokenRefresh.should.equal(true);
	}
	});
	});
	// TODO flakey after many runs, sometimes fails on android & ios,
	// possibly a rate limiting issue on the server side
	xdescribe('getToken()', function () {
	it('token fetch attempt with configured debug token should work', async function () {
	const { getToken } = appCheckModular;
	const { token } = await getToken(appCheckInstance, true);
	token.should.not.equal('');
	const decodedToken = decodeJWT(token);
	decodedToken.aud[1].should.equal('projects/react-native-firebase-testing');
	if (decodedToken.exp * 1000 < Date.now()) {
	return Promise.reject(
	`Token expired? now ${Date.now()} token exp: ${decodedToken.exp * 1000}`,
	);
	}
	// on android if you move too fast, you may not get a fresh token
	await Utils.sleep(2000);
	// Force refresh should get a different token?
	// TODO sometimes fails on android https://github.com/firebase/firebase-android-sdk/issues/2954
	const { token: token2 } = await getToken(appCheckInstance, true);
	token2.should.not.equal('');
	const decodedToken2 = decodeJWT(token2);
	decodedToken2.aud[1].should.equal('projects/react-native-firebase-testing');
	if (decodedToken2.exp * 1000 < Date.now()) {
	return Promise.reject(
	`Token expired? now ${Date.now()} token exp: ${decodedToken2.exp * 1000}`,
	);
	}
	(token === token2).should.be.false();
	});
	it('token fetch with config switch to invalid then valid should fail then work', async function () {
	const { initializeAppCheck, getToken, ReactNativeFirebaseAppCheckProvider } =
	appCheckModular;
	rnfbProvider = new ReactNativeFirebaseAppCheckProvider();
	rnfbProvider.configure({
	android: {
	provider: 'playIntegrity',
	},
	apple: {
	provider: 'appAttest',
	},
	web: {
	provider: 'debug',
	siteKey: 'none',
	},
	});
	// Our tests configure a debug provider with shared secret so we should get a valid token
	const instance1 = await initializeAppCheck(undefined, {
	provider: rnfbProvider,
	isTokenAutoRefreshEnabled: false,
	});
	try {
	await getToken(instance1, true);
	return Promise.reject(new Error('should have thrown an error'));
	} catch (e) {
	e.message.should.containEql('appCheck/token-error');
	}
	rnfbProvider.configure({
	android: {
	provider: 'debug',
	debugToken: '698956B2-187B-49C6-9E25-C3F3530EEBAF',
	},
	apple: {
	provider: 'debug',
	},
	web: {
	provider: 'debug',
	siteKey: 'none',
	},
	});
	const instance2 = await initializeAppCheck(undefined, {
	provider: rnfbProvider,
	isTokenAutoRefreshEnabled: false,
	});
	const { token } = await getToken(instance2, true);
	token.should.not.equal('');
	const decodedToken = decodeJWT(token);
	decodedToken.aud[1].should.equal('projects/react-native-firebase-testing');
	if (decodedToken.exp * 1000 < Date.now()) {
	return Promise.reject(
	`Token expired? now ${Date.now()} token exp: ${decodedToken.exp * 1000}`,
	);
	}
	});
	});
	describe('getLimitedUseToken()', function () {
	it('limited use token fetch attempt with configured debug token should work', async function () {
	const { initializeAppCheck, getLimitedUseToken, ReactNativeFirebaseAppCheckProvider } =
	appCheckModular;
	const rnfbProvider = new ReactNativeFirebaseAppCheckProvider();
	rnfbProvider.configure({
	android: {
	provider: 'debug',
	debugToken: '698956B2-187B-49C6-9E25-C3F3530EEBAF',
	},
	apple: {
	provider: 'debug',
	},
	web: {
	provider: 'debug',
	siteKey: 'none',
	},
	});
	const appCheckInstance = await initializeAppCheck(undefined, {
	provider: rnfbProvider,
	isTokenAutoRefreshEnabled: false,
	});
	const { token } = await getLimitedUseToken(appCheckInstance);
	token.should.not.equal('');
	const decodedToken = decodeJWT(token);
	decodedToken.aud[1].should.equal('projects/react-native-firebase-testing');
	if (decodedToken.exp * 1000 < Date.now()) {
	return Promise.reject(
	`Token expired? now ${Date.now()} token exp: ${decodedToken.exp * 1000}`,
	);
	}
	});
	});
	});