Implement R-GCIP Token-Only Session via ExchangeToken
#14986
Conversation
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback. |
srushtisv
changed the base branch from
main
to
byociam-sample-app-implementation
Generated by 🚫 Danger |
| private var _rGCIPFirebaseToken: FirebaseToken? | ||
|
|
||
| /// A lock to ensure thread-safe access to the R-GCIP token state. | ||
| private let rGCIPStateLock = NSLock() |
There was a problem hiding this comment.
Trying adding import FirebaseCoreInternal and try using the FIRAllocatedUnfairLock type which should combine the token and token lock into one property.
There was a problem hiding this comment.
Sure Nick, updated the code.
| if let token = rGCIPToken { | ||
| /// If a token exists, this session is active. Check for expiration. | ||
| if forceRefresh || token.expirationDate < Date() { | ||
| let errorMessage = forceRefresh ? "A new token was requested via forceRefresh." : |
There was a problem hiding this comment.
Shoul the error message say forceRefresh is not supported
There was a problem hiding this comment.
Yes Pavan, updated this.
srushtisv
force-pushed
the
byociam-sample-app-implementation
branch
from
80647da to
859ec86
Compare
srushtisv
force-pushed
the
byociam-auth-interop
branch
from
7ac16e2 to
955cc5e
Compare
srushtisv
force-pushed
the
byociam-sample-app-implementation
branch
from
a42c578 to
d958c95
Compare
srushtisv
force-pushed
the
byociam-auth-interop
branch
from
955cc5e to
d9dfa0d
Compare
| } | ||
| } | ||
| #endif | ||
| guard let self = self else { |
There was a problem hiding this comment.
| guard let self = self else { | |
| guard let self else { |
| } | ||
| #endif | ||
| guard let self = self else { | ||
| DispatchQueue.main.async { callback(nil, nil) } |
There was a problem hiding this comment.
Would using any of the Auth.wrapMainAsync APIs work here?
| /// Clear any R-GCIP session state when a standard user signs in. This ensures we exit | ||
| /// Token-Only Mode. | ||
| self.rGCIPFirebaseTokenLock.withLock { $0 = nil } | ||
| /// ... rest of original function |
There was a problem hiding this comment.
| /// ... rest of original function |
| /// GCIP, where no `User` object is created. It is mutually exclusive with `_currentUser`. | ||
| /// If the wrapped value is non-nil, the `AuthInterop` layer will use it for token generation | ||
| /// instead of relying on a `currentUser`. | ||
| private var rGCIPFirebaseTokenLock = FIRAllocatedUnfairLock<FirebaseToken?>(initialState: nil) |
There was a problem hiding this comment.
FIRAllocatedUnfairLock is a class. It's instances should be a constant.
| private var rGCIPFirebaseTokenLock = FIRAllocatedUnfairLock<FirebaseToken?>(initialState: nil) | |
| private let rGCIPFirebaseTokenLock = FIRAllocatedUnfairLock<FirebaseToken?>(initialState: nil) |
| } | ||
|
|
||
| /// Regionalized auth | ||
| // MARK: Regionalized auth |
There was a problem hiding this comment.
not: the added dash adds a horizontal line divider in Xcode
| // MARK: Regionalized auth | |
| // MARK: - Regionalized auth |
|
duplicated in #15041 |
Description
This PR introduces support for a "token-only" session mode, primarily for Bring Your Own CIAM (BYO-CIAM) use cases with Regionalized GCIP (R-GCIP). This allows developers to use Firebase services with a Firebase token obtained from a third-party OIDC provider, without creating a
Userentity or a standard Firebase Auth session.Key Changes
Auth.exchangeToken): AddsexchangeToken(idToken:idpConfigId:completion:)and itsasynccounterpart. This method exchanges a third-party OIDC ID token for a Firebase ID token._rGCIPFirebaseToken, has been added to theAuthclass to store the token returned fromexchangeToken. This state is mutually exclusive withcurrentUser.AuthInteropModification: ThegetToken(forcingRefresh:completion:)method in theAuthInteropextension has been updated. It now first checks for an active R-GCIP token session.forceRefreshis true, anAuthErrorCode.userTokenExpirederror is returned, signaling that the developer must callexchangeTokenagain.currentUser.signInWithEmail:password:) now clear the R-GCIP token session to prevent conflicting states.ExchangeTokenRequestTests.swift, to validate the URL construction and body of the new API request. UpdatedAuthTests.swiftto cover the newAuthInteroplogic paths.Changelog
Auth.exchangeToken(idToken:idpConfigId:completion:)R-GCIP sessions by exchanging a third-party OIDC token for a Firebase token.AuthInteropprotocol now supports a token-only authentication state, which is activated by a successfulexchangeTokencall.