App Check: optimize auto-refresh

FirebaseAppCheck/CHANGELOG.md

@@ -1,4 +1,5 @@
-# 8.1.0 -- M97
+# 8.1.0 -- M98
 - [added] Apple's App Attest attestation provider support. (#8133)
+- [changed] Token auto-refresh optimizations. (#8232)
 # v8.0.0 -- M95
 - [added] Firebase abuse reduction support SDK. (#7928, #7937, #7948)

FirebaseAppCheck/Sources/AppAttestProvider/DCAppAttestService+FIRAppAttestService.h

@@ -14,6 +14,8 @@
  * limitations under the License.
  */
 
+#import <TargetConditionals.h>
+
 // Currently DCAppAttestService is available on iOS only.
 #if TARGET_OS_IOS && !TARGET_OS_MACCATALYST  // Catalyst should be possible with Xcode 12.5+
 

FirebaseAppCheck/Sources/AppAttestProvider/DCAppAttestService+FIRAppAttestService.m

@@ -17,7 +17,7 @@
 #import "FirebaseAppCheck/Sources/AppAttestProvider/DCAppAttestService+FIRAppAttestService.h"
 
 // Currently DCAppAttestService is available on iOS only.
-#if TARGET_OS_IOS
+#if TARGET_OS_IOS && !TARGET_OS_MACCATALYST  // Catalyst should be possible with Xcode 12.5+
 
 @implementation DCAppAttestService (FIRAppAttestService)
 

FirebaseAppCheck/Sources/Core/APIService/FIRAppCheckToken+APIResponse.m

@@ -15,6 +15,7 @@
  */
 
 #import "FirebaseAppCheck/Sources/Core/APIService/FIRAppCheckToken+APIResponse.h"
+#import "FirebaseAppCheck/Sources/Core/FIRAppCheckToken+Internal.h"
 
 #if __has_include(<FBLPromises/FBLPromises.h>)
 #import <FBLPromises/FBLPromises.h>
@@ -81,7 +82,7 @@ - (nullable instancetype)initWithResponseDict:(NSDictionary<NSString *, id> *)re
 
   NSDate *expirationDate = [requestDate dateByAddingTimeInterval:secondsToLive];
 
-  return [self initWithToken:token expirationDate:expirationDate];
+  return [self initWithToken:token expirationDate:expirationDate receivedAtDate:requestDate];
 }
 
 @end

FirebaseAppCheck/Sources/Core/FIRAppCheck.m

@@ -22,15 +22,16 @@
 #import "FBLPromises.h"
 #endif
 
+#import "FirebaseAppCheck/Sources/Core/FIRAppCheckToken+Internal.h"
 #import "FirebaseAppCheck/Sources/Public/FirebaseAppCheck/FIRAppCheckProvider.h"
 #import "FirebaseAppCheck/Sources/Public/FirebaseAppCheck/FIRAppCheckProviderFactory.h"
-#import "FirebaseAppCheck/Sources/Public/FirebaseAppCheck/FIRAppCheckToken.h"
 
 #import "FirebaseAppCheck/Sources/Core/Errors/FIRAppCheckErrorUtil.h"
 #import "FirebaseAppCheck/Sources/Core/FIRAppCheckLogger.h"
 #import "FirebaseAppCheck/Sources/Core/FIRAppCheckSettings.h"
 #import "FirebaseAppCheck/Sources/Core/FIRAppCheckTokenResult.h"
 #import "FirebaseAppCheck/Sources/Core/Storage/FIRAppCheckStorage.h"
+#import "FirebaseAppCheck/Sources/Core/TokenRefresh/FIRAppCheckTokenRefreshResult.h"
 #import "FirebaseAppCheck/Sources/Core/TokenRefresh/FIRAppCheckTokenRefresher.h"
 
 #import "FirebaseAppCheck/Sources/Interop/FIRAppCheckInterop.h"
@@ -124,10 +125,10 @@ - (nullable instancetype)initWithApp:(FIRApp *)app {
       [[FIRAppCheckSettings alloc] initWithApp:app
                                    userDefault:[NSUserDefaults standardUserDefaults]
                                     mainBundle:[NSBundle mainBundle]];
+  FIRAppCheckTokenRefreshResult *refreshResult =
+      [[FIRAppCheckTokenRefreshResult alloc] initWithStatusNever];
   FIRAppCheckTokenRefresher *tokenRefresher =
-      [[FIRAppCheckTokenRefresher alloc] initWithTokenExpirationDate:[NSDate date]
-                                            tokenExpirationThreshold:kTokenExpirationThreshold
-                                                            settings:settings];
+      [[FIRAppCheckTokenRefresher alloc] initWithRefreshResult:refreshResult settings:settings];
 
   FIRAppCheckStorage *storage = [[FIRAppCheckStorage alloc] initWithAppName:app.name
                                                                       appID:app.options.googleAppID
@@ -306,7 +307,10 @@ - (nonnull NSString *)notificationTokenKey {
         // TODO: Make sure the self.tokenRefresher is updated only once. Currently the timer will be
         // updated twice in the case when the refresh triggered by self.tokenRefresher, but it
         // should be fine for now as it is a relatively cheap operation.
-        [self.tokenRefresher updateTokenExpirationDate:token.expirationDate];
+        __auto_type refreshResult = [[FIRAppCheckTokenRefreshResult alloc]
+            initWithStatusSuccessAndExpirationDate:token.expirationDate
+                                    receivedAtDate:token.receivedAtDate];
+        [self.tokenRefresher updateWithRefreshResult:refreshResult];
         [self postTokenUpdateNotificationWithToken:token];
         return token;
       });
@@ -317,11 +321,15 @@ - (nonnull NSString *)notificationTokenKey {
 - (void)periodicTokenRefreshWithCompletion:(FIRAppCheckTokenRefreshCompletion)completion {
   [self retrieveOrRefreshTokenForcingRefresh:NO]
       .then(^id _Nullable(FIRAppCheckToken *_Nullable token) {
-        completion(YES, token.expirationDate);
+        __auto_type refreshResult = [[FIRAppCheckTokenRefreshResult alloc]
+            initWithStatusSuccessAndExpirationDate:token.expirationDate
+                                    receivedAtDate:token.receivedAtDate];
+        completion(refreshResult);
         return nil;
       })
       .catch(^(NSError *error) {
-        completion(NO, nil);
+        __auto_type refreshResult = [[FIRAppCheckTokenRefreshResult alloc] initWithStatusFailure];
+        completion(refreshResult);
       });
 }
 

FirebaseAppCheck/Sources/Core/FIRAppCheckToken+Internal.h

@@ -0,0 +1,39 @@
+/*
+ * Copyright 2021 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#import <Foundation/Foundation.h>
+
+#import "FirebaseAppCheck/Sources/Public/FirebaseAppCheck/FIRAppCheckToken.h"
+
+NS_ASSUME_NONNULL_BEGIN
+
+@interface FIRAppCheckToken ()
+
+/// A date when the Firebase App Check token was received in the device's local time.
+@property(nonatomic) NSDate *receivedAtDate;
+
+/// The designated initializer.
+/// @param token A Firebase App Check token.
+/// @param expirationDate A Firebase App Check token expiration date in the device local time.
+/// @param receivedAtDate A date when the Firebase App Check token was received in the device's
+/// local time.
+- (instancetype)initWithToken:(NSString *)token
+               expirationDate:(NSDate *)expirationDate
+               receivedAtDate:(NSDate *)receivedAtDate NS_DESIGNATED_INITIALIZER;
+
+@end
+
+NS_ASSUME_NONNULL_END

FirebaseAppCheck/Sources/Core/FIRAppCheckToken.m

@@ -14,17 +14,28 @@
  * limitations under the License.
  */
 
-#import "FirebaseAppCheck/Sources/Public/FirebaseAppCheck/FIRAppCheckToken.h"
+#import "FirebaseAppCheck/Sources/Core/FIRAppCheckToken+Internal.h"
+
+NS_ASSUME_NONNULL_BEGIN
 
 @implementation FIRAppCheckToken
 
-- (instancetype)initWithToken:(NSString *)token expirationDate:(NSDate *)expirationDate {
+- (instancetype)initWithToken:(NSString *)token
+               expirationDate:(NSDate *)expirationDate
+               receivedAtDate:(NSDate *)receivedAtDate {
   self = [super init];
   if (self) {
     _token = [token copy];
     _expirationDate = expirationDate;
+    _receivedAtDate = receivedAtDate;
   }
   return self;
 }
 
+- (instancetype)initWithToken:(NSString *)token expirationDate:(NSDate *)expirationDate {
+  return [self initWithToken:token expirationDate:expirationDate receivedAtDate:[NSDate date]];
+}
+
 @end
+
+NS_ASSUME_NONNULL_END

FirebaseAppCheck/Sources/Core/Storage/FIRAppCheckStoredToken+FIRAppCheckToken.m

@@ -16,17 +16,20 @@
 
 #import "FirebaseAppCheck/Sources/Core/Storage/FIRAppCheckStoredToken+FIRAppCheckToken.h"
 
-#import "FirebaseAppCheck/Sources/Public/FirebaseAppCheck/FIRAppCheckToken.h"
+#import "FirebaseAppCheck/Sources/Core/FIRAppCheckToken+Internal.h"
 
 @implementation FIRAppCheckStoredToken (FIRAppCheckToken)
 
 - (void)updateWithToken:(FIRAppCheckToken *)token {
   self.token = token.token;
   self.expirationDate = token.expirationDate;
+  self.receivedAtDate = token.receivedAtDate;
 }
 
 - (FIRAppCheckToken *)appCheckToken {
-  return [[FIRAppCheckToken alloc] initWithToken:self.token expirationDate:self.expirationDate];
+  return [[FIRAppCheckToken alloc] initWithToken:self.token
+                                  expirationDate:self.expirationDate
+                                  receivedAtDate:self.receivedAtDate];
 }
 
 @end

FirebaseAppCheck/Sources/Core/Storage/FIRAppCheckStoredToken.h

@@ -22,10 +22,14 @@ NS_ASSUME_NONNULL_BEGIN
 
 @interface FIRAppCheckStoredToken : NSObject <NSSecureCoding>
 
-/// FAA token.
-@property(nonatomic, copy) NSString *token;
-/// FAA token expiration date in the device local time.
-@property(nonatomic, strong) NSDate *expirationDate;
+/// The Firebase App Check token.
+@property(nonatomic, copy, nullable) NSString *token;
+
+/// The Firebase App Check token expiration date in the device local time.
+@property(nonatomic, strong, nullable) NSDate *expirationDate;
+
+/// The date when the Firebase App Check token was received in the device's local time.
+@property(nonatomic, strong, nullable) NSDate *receivedAtDate;
 
 /// The version of local storage.
 @property(nonatomic, readonly) NSInteger storageVersion;

FirebaseAppCheck/Sources/Core/Storage/FIRAppCheckStoredToken.m

@@ -18,9 +18,10 @@
 
 static NSString *const kTokenKey = @"token";
 static NSString *const kExpirationDateKey = @"expirationDate";
+static NSString *const kReceivedAtDateKey = @"receivedAtDate";
 static NSString *const kStorageVersionKey = @"storageVersion";
 
-static const NSInteger kStorageVersion = 1;
+static const NSInteger kStorageVersion = 2;
 
 NS_ASSUME_NONNULL_BEGIN
 
@@ -37,19 +38,21 @@ + (BOOL)supportsSecureCoding {
 - (void)encodeWithCoder:(NSCoder *)coder {
   [coder encodeObject:self.token forKey:kTokenKey];
   [coder encodeObject:self.expirationDate forKey:kExpirationDateKey];
+  [coder encodeObject:self.receivedAtDate forKey:kReceivedAtDateKey];
   [coder encodeInteger:self.storageVersion forKey:kStorageVersionKey];
 }
 
 - (nullable instancetype)initWithCoder:(NSCoder *)coder {
   self = [super init];
   if (self) {
-    NSInteger storageVersion = [coder decodeIntegerForKey:kStorageVersionKey];
-    if (storageVersion > kStorageVersion) {
+    NSInteger decodedStorageVersion = [coder decodeIntegerForKey:kStorageVersionKey];
+    if (decodedStorageVersion > kStorageVersion) {
       // TODO: Log a message.
     }
 
     _token = [coder decodeObjectOfClass:[NSString class] forKey:kTokenKey];
     _expirationDate = [coder decodeObjectOfClass:[NSDate class] forKey:kExpirationDateKey];
+    _receivedAtDate = [coder decodeObjectOfClass:[NSDate class] forKey:kReceivedAtDateKey];
   }
   return self;
 }

FirebaseAppCheck/Sources/Core/TokenRefresh/FIRAppCheckTokenRefreshResult.h

@@ -0,0 +1,63 @@
+/*
+ * Copyright 2021 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#import <Foundation/Foundation.h>
+
+NS_ASSUME_NONNULL_BEGIN
+
+/// Represents possible results of a Firebase App Check token refresh attempt that matter for
+/// `FIRAppCheckTokenRefresher`.
+typedef NS_ENUM(NSInteger, FIRAppCheckTokenRefreshStatus) {
+  // The token has not been refreshed.
+  FIRAppCheckTokenRefreshStatusNever,
+
+  // The token was successfully refreshed.
+  FIRAppCheckTokenRefreshStatusSuccess,
+
+  // The token refresh failed.
+  FIRAppCheckTokenRefreshStatusFailure
+};
+
+/// An object to pass the possible results of a Firebase App Check token refresh attempt and
+/// supplementary data.
+@interface FIRAppCheckTokenRefreshResult : NSObject
+
+/// Status of the refresh.
+@property(nonatomic, readonly) FIRAppCheckTokenRefreshStatus status;
+
+/// A date when the new Firebase App Check token is expiring.
+@property(nonatomic, readonly, nullable) NSDate *tokenExpirationDate;
+
+/// A date when the new Firebase App Check token was received from the server.
+@property(nonatomic, readonly, nullable) NSDate *tokenReceivedAtDate;
+
+- (instancetype)init NS_UNAVAILABLE;
+
+/// Initializes the instance with `FIRAppCheckTokenRefreshStatusNever`.
+- (instancetype)initWithStatusNever;
+
+/// Initializes the instance with `FIRAppCheckTokenRefreshStatusFailure`.
+- (instancetype)initWithStatusFailure;
+
+/// Initializes the instance with `FIRAppCheckTokenRefreshStatusFailure`.
+/// @param tokenExpirationDate See `tokenExpirationDate` property.
+/// @param tokenReceivedAtDate See `tokenReceivedAtDate` property.
+- (instancetype)initWithStatusSuccessAndExpirationDate:(NSDate *)tokenExpirationDate
+                                        receivedAtDate:(NSDate *)tokenReceivedAtDate;
+
+@end
+
+NS_ASSUME_NONNULL_END

FirebaseAppCheck/Sources/Core/TokenRefresh/FIRAppCheckTokenRefreshResult.m

@@ -0,0 +1,64 @@
+/*
+ * Copyright 2021 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#import "FirebaseAppCheck/Sources/Core/TokenRefresh/FIRAppCheckTokenRefreshResult.h"
+
+NS_ASSUME_NONNULL_BEGIN
+
+@interface FIRAppCheckTokenRefreshResult ()
+
+- (instancetype)initWithStatus:(FIRAppCheckTokenRefreshStatus)status
+                expirationDate:(nullable NSDate *)tokenExpirationDate
+                receivedAtDate:(nullable NSDate *)tokenReceivedAtDate NS_DESIGNATED_INITIALIZER;
+
+@end
+
+@implementation FIRAppCheckTokenRefreshResult
+
+- (instancetype)initWithStatus:(FIRAppCheckTokenRefreshStatus)status
+                expirationDate:(nullable NSDate *)tokenExpirationDate
+                receivedAtDate:(nullable NSDate *)tokenReceivedAtDate {
+  self = [super init];
+  if (self) {
+    _status = status;
+    _tokenExpirationDate = tokenExpirationDate;
+    _tokenReceivedAtDate = tokenReceivedAtDate;
+  }
+  return self;
+}
+
+- (instancetype)initWithStatusNever {
+  return [self initWithStatus:FIRAppCheckTokenRefreshStatusNever
+               expirationDate:nil
+               receivedAtDate:nil];
+}
+
+- (instancetype)initWithStatusFailure {
+  return [self initWithStatus:FIRAppCheckTokenRefreshStatusFailure
+               expirationDate:nil
+               receivedAtDate:nil];
+}
+
+- (instancetype)initWithStatusSuccessAndExpirationDate:(NSDate *)tokenExpirationDate
+                                        receivedAtDate:(NSDate *)tokenReceivedAtDate {
+  return [self initWithStatus:FIRAppCheckTokenRefreshStatusSuccess
+               expirationDate:tokenExpirationDate
+               receivedAtDate:tokenReceivedAtDate];
+}
+
+@end
+
+NS_ASSUME_NONNULL_END