diff --git a/src/main/java/com/google/firebase/appcheck/DecodedAppCheckToken.java b/src/main/java/com/google/firebase/appcheck/DecodedAppCheckToken.java new file mode 100644 index 000000000..599bd99e1 --- /dev/null +++ b/src/main/java/com/google/firebase/appcheck/DecodedAppCheckToken.java @@ -0,0 +1,128 @@ +/* + * Copyright 2026 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.google.firebase.appcheck; + +import static com.google.common.base.Preconditions.checkArgument; +import static com.google.common.base.Preconditions.checkNotNull; + +import com.google.common.collect.ImmutableList; +import com.google.common.collect.ImmutableMap; +import java.time.Instant; +import java.util.Date; +import java.util.List; +import java.util.Map; + +/** + * Represents a verified Firebase App Check token. + */ +public class DecodedAppCheckToken { + + private final Map claims; + + /** + * Creates an instance of {@link DecodedAppCheckToken} from a map of JWT claims. + * + * @param claims A map of JWT claims. + */ + public DecodedAppCheckToken(Map claims) { + checkNotNull(claims, "Claims map must not be null"); + checkArgument(claims.containsKey("sub"), "Claims map must contain sub"); + this.claims = ImmutableMap.copyOf(claims); + } + + /** + * Returns the issuer identifier for the token. + */ + public String getIssuer() { + return (String) claims.get("iss"); + } + + /** + * Returns the subject claim ('sub') of the token. + */ + public String getSubject() { + return (String) claims.get("sub"); + } + + /** + * Returns the App ID for which this token was issued. + * This is an alias for {@link #getSubject()}. + */ + public String getAppId() { + return getSubject(); + } + + /** + * Returns the JWT ID ('jti') of the token, or {@code null} if not present. + */ + public String getJti() { + return (String) claims.get("jti"); + } + + /** + * Returns the attestation provider for this token, or {@code null} if not present. + */ + public String getProvider() { + return (String) claims.get("provider"); + } + + /** + * Returns the audience for which this token is intended. + */ + public List getAudience() { + Object audience = claims.get("aud"); + if (audience instanceof String) { + return ImmutableList.of((String) audience); + } else if (audience instanceof List) { + @SuppressWarnings("unchecked") + List audienceList = (List) audience; + return ImmutableList.copyOf(audienceList); + } + return ImmutableList.of(); + } + + /** + * Returns the expiration time as an {@link Instant}, or {@code null} if not present. + */ + public Instant getExpirationTime() { + return toInstant(claims.get("exp")); + } + + /** + * Returns the issued-at time as an {@link Instant}, or {@code null} if not present. + */ + public Instant getIssuedAt() { + return toInstant(claims.get("iat")); + } + + /** + * Returns the entire map of claims. + */ + public Map getClaims() { + return claims; + } + + private static Instant toInstant(Object timeObj) { + if (timeObj instanceof Date) { + return ((Date) timeObj).toInstant(); + } + if (timeObj instanceof Number) { + return Instant.ofEpochSecond(((Number) timeObj).longValue()); + } + return null; + } +} diff --git a/src/main/java/com/google/firebase/appcheck/FirebaseAppCheck.java b/src/main/java/com/google/firebase/appcheck/FirebaseAppCheck.java new file mode 100644 index 000000000..17a7d9c8d --- /dev/null +++ b/src/main/java/com/google/firebase/appcheck/FirebaseAppCheck.java @@ -0,0 +1,139 @@ +/* + * Copyright 2026 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.google.firebase.appcheck; + +import static com.google.common.base.Preconditions.checkNotNull; + +import com.google.api.core.ApiFuture; +import com.google.common.annotations.VisibleForTesting; +import com.google.firebase.FirebaseApp; +import com.google.firebase.ImplFirebaseTrampolines; +import com.google.firebase.appcheck.internal.AppCheckTokenVerifier; +import com.google.firebase.internal.CallableOperation; +import com.google.firebase.internal.FirebaseService; + +/** + * This class is the entry point for the Firebase App Check service. + * + *

You can get an instance of {@link FirebaseAppCheck} via {@link #getInstance()} + * or {@link #getInstance(FirebaseApp)}. + */ +public final class FirebaseAppCheck { + + private static final String SERVICE_ID = FirebaseAppCheck.class.getName(); + + private final FirebaseApp app; + private final AppCheckTokenVerifier tokenVerifier; + + private FirebaseAppCheck(FirebaseApp app) { + this(app, new AppCheckTokenVerifier(app)); + } + + @VisibleForTesting + FirebaseAppCheck(FirebaseApp app, AppCheckTokenVerifier tokenVerifier) { + this.app = checkNotNull(app, "FirebaseApp must not be null"); + this.tokenVerifier = checkNotNull(tokenVerifier, "AppCheckTokenVerifier must not be null"); + } + + /** + * Gets the {@link FirebaseAppCheck} instance for the default {@link FirebaseApp}. + * + * @return The {@link FirebaseAppCheck} instance for the default {@link FirebaseApp}. + */ + public static FirebaseAppCheck getInstance() { + return getInstance(FirebaseApp.getInstance()); + } + + /** + * Gets the {@link FirebaseAppCheck} instance for the specified {@link FirebaseApp}. + * + * @param app The {@link FirebaseApp} instance. + * @return The {@link FirebaseAppCheck} instance for the specified {@link FirebaseApp}. + */ + public static synchronized FirebaseAppCheck getInstance(FirebaseApp app) { + FirebaseAppCheckService service = + ImplFirebaseTrampolines.getService(app, SERVICE_ID, FirebaseAppCheckService.class); + if (service == null) { + service = ImplFirebaseTrampolines.addService(app, new FirebaseAppCheckService(app)); + } + return service.getInstance(); + } + + /** + * Verifies an App Check token string. + * + * @param appCheckToken The App Check token string to verify. + * @return A {@link VerifyAppCheckTokenResponse} containing the decoded token. + * @throws FirebaseAppCheckException If verification fails. + */ + public VerifyAppCheckTokenResponse verifyToken(String appCheckToken) + throws FirebaseAppCheckException { + return verifyToken(appCheckToken, null); + } + + /** + * Verifies an App Check token string with options. + * + * @param appCheckToken The App Check token string to verify. + * @param options Verification options specified via {@link VerifyAppCheckTokenOptions}. + * @return A {@link VerifyAppCheckTokenResponse} containing the decoded token + * and consumption status. + * @throws FirebaseAppCheckException If verification fails. + */ + public VerifyAppCheckTokenResponse verifyToken( + String appCheckToken, VerifyAppCheckTokenOptions options) throws FirebaseAppCheckException { + return this.tokenVerifier.verifyToken(appCheckToken, options); + } + + /** + * Asynchronously verifies an App Check token string. + * + * @param appCheckToken The App Check token string to verify. + * @return An {@link ApiFuture} containing the {@link VerifyAppCheckTokenResponse}. + */ + public ApiFuture verifyTokenAsync(String appCheckToken) { + return verifyTokenAsync(appCheckToken, null); + } + + /** + * Asynchronously verifies an App Check token string with options. + * + * @param appCheckToken The App Check token string to verify. + * @param options Verification options specified via {@link VerifyAppCheckTokenOptions}. + * @return An {@link ApiFuture} containing the {@link VerifyAppCheckTokenResponse}. + */ + public ApiFuture verifyTokenAsync( + String appCheckToken, VerifyAppCheckTokenOptions options) { + return verifyTokenOp(appCheckToken, options).callAsync(this.app); + } + + private CallableOperation verifyTokenOp( + final String appCheckToken, final VerifyAppCheckTokenOptions options) { + return new CallableOperation() { + @Override + protected VerifyAppCheckTokenResponse execute() throws FirebaseAppCheckException { + return verifyToken(appCheckToken, options); + } + }; + } + + private static class FirebaseAppCheckService extends FirebaseService { + FirebaseAppCheckService(FirebaseApp app) { + super(SERVICE_ID, new FirebaseAppCheck(app)); + } + } +} diff --git a/src/main/java/com/google/firebase/appcheck/FirebaseAppCheckException.java b/src/main/java/com/google/firebase/appcheck/FirebaseAppCheckException.java new file mode 100644 index 000000000..29c3ddb15 --- /dev/null +++ b/src/main/java/com/google/firebase/appcheck/FirebaseAppCheckException.java @@ -0,0 +1,55 @@ +/* + * Copyright 2026 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.google.firebase.appcheck; + +import com.google.firebase.ErrorCode; +import com.google.firebase.FirebaseException; +import com.google.firebase.IncomingHttpResponse; +import com.google.firebase.internal.NonNull; +import com.google.firebase.internal.Nullable; + +/** + * Generic exception related to Firebase App Check. Check the error code and message for more + * details. + */ +public class FirebaseAppCheckException extends FirebaseException { + + public FirebaseAppCheckException( + @NonNull ErrorCode errorCode, + @NonNull String message, + @Nullable Throwable cause, + @Nullable IncomingHttpResponse response) { + super(errorCode, message, cause, response); + } + + public FirebaseAppCheckException( + @NonNull ErrorCode errorCode, + @NonNull String message, + @Nullable Throwable cause) { + this(errorCode, message, cause, null); + } + + public FirebaseAppCheckException( + @NonNull ErrorCode errorCode, + @NonNull String message) { + this(errorCode, message, null, null); + } + + public FirebaseAppCheckException(@NonNull FirebaseException base) { + this(base.getErrorCode(), base.getMessage(), base.getCause(), base.getHttpResponse()); + } +} diff --git a/src/main/java/com/google/firebase/appcheck/VerifyAppCheckTokenOptions.java b/src/main/java/com/google/firebase/appcheck/VerifyAppCheckTokenOptions.java new file mode 100644 index 000000000..4b1c7bc2c --- /dev/null +++ b/src/main/java/com/google/firebase/appcheck/VerifyAppCheckTokenOptions.java @@ -0,0 +1,80 @@ +/* + * Copyright 2026 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.google.firebase.appcheck; + +import static com.google.common.base.Preconditions.checkNotNull; + +import java.util.Optional; + +/** + * Options for verifying a Firebase App Check token. + */ +public final class VerifyAppCheckTokenOptions { + + private final Optional consume; + + private VerifyAppCheckTokenOptions(Builder builder) { + this.consume = builder.consume; + } + + /** + * Returns whether to consume the App Check token during verification for replay protection. + */ + public Optional getConsume() { + return consume; + } + + public static Builder builder() { + return new Builder(); + } + + public static final class Builder { + + private Optional consume = Optional.empty(); + + private Builder() {} + + /** + * Sets whether to consume the token during verification. + * + * @param consume Set to true to consume the token. + * @return This builder. + */ + public Builder setConsume(boolean consume) { + this.consume = Optional.of(consume); + return this; + } + + /** + * Sets whether to consume the token during verification. + * + * @param consume Optional boolean value. Must not be null. + * @return This builder. + */ + public Builder setConsume(Optional consume) { + this.consume = checkNotNull(consume, "consume must not be null"); + return this; + } + + /** + * Builds a new {@link VerifyAppCheckTokenOptions} instance. + */ + public VerifyAppCheckTokenOptions build() { + return new VerifyAppCheckTokenOptions(this); + } + } +} diff --git a/src/main/java/com/google/firebase/appcheck/VerifyAppCheckTokenResponse.java b/src/main/java/com/google/firebase/appcheck/VerifyAppCheckTokenResponse.java new file mode 100644 index 000000000..f9cd71e7c --- /dev/null +++ b/src/main/java/com/google/firebase/appcheck/VerifyAppCheckTokenResponse.java @@ -0,0 +1,64 @@ +/* + * Copyright 2026 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.google.firebase.appcheck; + +import static com.google.common.base.Preconditions.checkNotNull; + +import com.google.firebase.internal.NonNull; +import com.google.firebase.internal.Nullable; +import java.util.Optional; + +/** + * Represents the response from verifying a Firebase App Check token. + */ +public final class VerifyAppCheckTokenResponse { + + private final String appId; + private final DecodedAppCheckToken token; + private final Optional alreadyConsumed; + + public VerifyAppCheckTokenResponse( + @NonNull String appId, + @NonNull DecodedAppCheckToken token, + @Nullable Boolean alreadyConsumed) { + this.appId = checkNotNull(appId, "appId must not be null"); + this.token = checkNotNull(token, "token must not be null"); + this.alreadyConsumed = Optional.ofNullable(alreadyConsumed); + } + + /** + * Returns the App ID associated with the App Check token. + */ + public String getAppId() { + return appId; + } + + /** + * Returns the decoded App Check token. + */ + public DecodedAppCheckToken getToken() { + return token; + } + + /** + * Returns whether the token was already consumed prior to verification, + * if consume option was requested. + */ + public Optional isAlreadyConsumed() { + return alreadyConsumed; + } +} diff --git a/src/main/java/com/google/firebase/appcheck/internal/AppCheckTokenVerifier.java b/src/main/java/com/google/firebase/appcheck/internal/AppCheckTokenVerifier.java new file mode 100644 index 000000000..acbe9fa1e --- /dev/null +++ b/src/main/java/com/google/firebase/appcheck/internal/AppCheckTokenVerifier.java @@ -0,0 +1,301 @@ +/* + * Copyright 2026 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.google.firebase.appcheck.internal; + +import static com.google.common.base.Preconditions.checkArgument; +import static com.google.common.base.Preconditions.checkNotNull; + +import com.google.api.client.http.GenericUrl; +import com.google.api.client.http.HttpRequest; +import com.google.api.client.http.HttpRequestFactory; +import com.google.api.client.http.HttpResponse; +import com.google.api.client.http.json.JsonHttpContent; +import com.google.api.client.json.GenericJson; +import com.google.api.client.json.JsonFactory; +import com.google.common.annotations.VisibleForTesting; +import com.google.common.base.Strings; +import com.google.firebase.ErrorCode; +import com.google.firebase.FirebaseApp; +import com.google.firebase.ImplFirebaseTrampolines; +import com.google.firebase.appcheck.DecodedAppCheckToken; +import com.google.firebase.appcheck.FirebaseAppCheckException; +import com.google.firebase.appcheck.VerifyAppCheckTokenOptions; +import com.google.firebase.appcheck.VerifyAppCheckTokenResponse; +import com.google.firebase.internal.ApiClientUtils; +import com.nimbusds.jose.JOSEException; +import com.nimbusds.jose.JOSEObjectType; +import com.nimbusds.jose.JWSAlgorithm; +import com.nimbusds.jose.JWSHeader; +import com.nimbusds.jose.jwk.source.JWKSource; +import com.nimbusds.jose.jwk.source.JWKSourceBuilder; +import com.nimbusds.jose.proc.BadJOSEException; +import com.nimbusds.jose.proc.JWSKeySelector; +import com.nimbusds.jose.proc.JWSVerificationKeySelector; +import com.nimbusds.jose.proc.SecurityContext; +import com.nimbusds.jwt.JWTClaimsSet; +import com.nimbusds.jwt.SignedJWT; +import com.nimbusds.jwt.proc.DefaultJWTProcessor; +import com.nimbusds.jwt.proc.ExpiredJWTException; +import java.io.IOException; +import java.net.MalformedURLException; +import java.net.URI; +import java.text.ParseException; +import java.util.List; +import java.util.concurrent.TimeUnit; + +/** + * Internal verifier for Firebase App Check tokens. + */ +public class AppCheckTokenVerifier { + + private static final String JWKS_URL = "https://firebaseappcheck.googleapis.com/v1/jwks"; + private static final String APP_CHECK_ISSUER = "https://firebaseappcheck.googleapis.com/"; + private static final String APP_CHECK_AUDIENCE_PREFIX = "projects/"; + private static final String VERIFY_TOKEN_URL_FORMAT = + "https://firebaseappcheck.googleapis.com/v1/projects/%s:verifyAppCheckToken"; + private static final long JWKS_CACHE_TTL_MILLIS = TimeUnit.HOURS.toMillis(6); + + private final FirebaseApp app; + private final String projectId; + private final HttpRequestFactory requestFactory; + private final JsonFactory jsonFactory; + private final DefaultJWTProcessor jwtProcessor; + + public AppCheckTokenVerifier(FirebaseApp app) { + this( + app, + ApiClientUtils.newAuthorizedRequestFactory(app), + ApiClientUtils.getDefaultJsonFactory(), + null); + } + + /** + * Package-private constructor designed explicitly for dependency injection + * of mock HTTP request factories, JSON factories, or mock JWT processors + * during isolated unit testing flows. + */ + @VisibleForTesting + AppCheckTokenVerifier( + FirebaseApp app, + HttpRequestFactory requestFactory, + JsonFactory jsonFactory, + DefaultJWTProcessor jwtProcessor) { + this.app = checkNotNull(app, "FirebaseApp must not be null"); + this.projectId = getProjectId(app); + this.requestFactory = checkNotNull(requestFactory, "HttpRequestFactory must not be null"); + this.jsonFactory = checkNotNull(jsonFactory, "JsonFactory must not be null"); + this.jwtProcessor = jwtProcessor != null ? jwtProcessor : createJwtProcessor(); + } + + /** + * Verifies an App Check token string. + * + * @param token The App Check token string to verify. + * @return A {@link VerifyAppCheckTokenResponse} containing the decoded token. + * @throws FirebaseAppCheckException If verification fails. + */ + public VerifyAppCheckTokenResponse verifyToken(String token) throws FirebaseAppCheckException { + return verifyToken(token, null); + } + + /** + * Verifies an App Check token string with options. + * + * @param token The App Check token string to verify. + * @param options Verification options specified via {@link VerifyAppCheckTokenOptions}. + * @return A {@link VerifyAppCheckTokenResponse} containing the decoded token + * and consumption status. + * @throws FirebaseAppCheckException If verification fails. + */ + public VerifyAppCheckTokenResponse verifyToken( + String token, VerifyAppCheckTokenOptions options) throws FirebaseAppCheckException { + checkArgument( + !Strings.isNullOrEmpty(token), "App Check token string must not be null or empty"); + + DecodedAppCheckToken decodedToken = verifyTokenLocally(token); + String appId = decodedToken.getSubject(); + + boolean consume = options != null && options.getConsume().orElse(false); + Boolean alreadyConsumed = null; + + if (consume) { + alreadyConsumed = verifyOneTimeToken(token); + } + + return new VerifyAppCheckTokenResponse(appId, decodedToken, alreadyConsumed); + } + + /** + * Performs local JWT signature and claims verification. + */ + private DecodedAppCheckToken verifyTokenLocally(String token) throws FirebaseAppCheckException { + try { + SignedJWT signedJwt = SignedJWT.parse(token); + verifyHeader(signedJwt.getHeader()); + JWTClaimsSet claims = this.jwtProcessor.process(signedJwt, null); + verifyClaims(claims); + return new DecodedAppCheckToken(claims.getClaims()); + } catch (ParseException e) { + throw new FirebaseAppCheckException( + ErrorCode.INVALID_ARGUMENT, "Failed to parse App Check JWT token: " + e.getMessage(), e); + } catch (ExpiredJWTException e) { + throw new FirebaseAppCheckException( + ErrorCode.INVALID_ARGUMENT, "Firebase App Check token has expired.", e); + } catch (BadJOSEException e) { + throw new FirebaseAppCheckException( + ErrorCode.INVALID_ARGUMENT, + "Check your project: " + projectId + ". Failed to verify App Check token signature: " + + e.getMessage(), + e); + } catch (JOSEException e) { + throw new FirebaseAppCheckException( + ErrorCode.INTERNAL, + "Check your project: " + projectId + ". Internal error processing App Check token: " + + e.getMessage(), + e); + } + } + + private void verifyHeader(JWSHeader header) throws FirebaseAppCheckException { + if (header.getAlgorithm() == null || !JWSAlgorithm.RS256.equals(header.getAlgorithm())) { + throw new FirebaseAppCheckException( + ErrorCode.INVALID_ARGUMENT, + "App Check token has incorrect algorithm. Expected " + + JWSAlgorithm.RS256.getName() + + " but got: " + + header.getAlgorithm()); + } + if (Strings.isNullOrEmpty(header.getKeyID())) { + throw new FirebaseAppCheckException( + ErrorCode.INVALID_ARGUMENT, "App Check token has no 'kid' (key ID) header."); + } + if (header.getType() == null || !JOSEObjectType.JWT.equals(header.getType())) { + throw new FirebaseAppCheckException( + ErrorCode.INVALID_ARGUMENT, + "App Check token has incorrect 'typ' header. Expected JWT but got: " + + header.getType()); + } + } + + private void verifyClaims(JWTClaimsSet claims) throws FirebaseAppCheckException { + checkNotNull(claims, "JWTClaimsSet claims must not be null"); + String issuer = claims.getIssuer(); + + if (Strings.isNullOrEmpty(issuer)) { + throw new FirebaseAppCheckException( + ErrorCode.INVALID_ARGUMENT, "App Check token has no 'iss' (issuer) claim."); + } + + // The issuer is of the form https://firebaseappcheck.googleapis.com/. + // Because the SDK currently only has access to the project ID (not the project number), + // the verifier checks the issuer prefix rather than strict equality. If the SDK is updated in + // the future to expose the project number (per https://google.aip.dev/cloud/2510), this check + // should be updated to verify strict equality against + // https://firebaseappcheck.googleapis.com/. + if (!issuer.startsWith(APP_CHECK_ISSUER)) { + throw new FirebaseAppCheckException( + ErrorCode.INVALID_ARGUMENT, + "App Check token has incorrect issuer. Expected to start with: " + + APP_CHECK_ISSUER + + " but got: " + + issuer); + } + + List audience = claims.getAudience(); + String expectedAudience = APP_CHECK_AUDIENCE_PREFIX + this.projectId; + if (audience == null || audience.isEmpty() || !audience.contains(expectedAudience)) { + throw new FirebaseAppCheckException( + ErrorCode.INVALID_ARGUMENT, + "App Check token has incorrect audience. Expected to contain: " + + expectedAudience + + " but got: " + + audience); + } + + if (Strings.isNullOrEmpty(claims.getSubject())) { + throw new FirebaseAppCheckException( + ErrorCode.INVALID_ARGUMENT, "App Check token has empty 'sub' (app ID) claim."); + } + } + + /** + * Sends an RPC request to the Firebase App Check backend service to verify + * and consume a limited-use (one-time) App Check token. + * + * @param token The raw App Check token string to consume. + * @return {@code true} if the token was already consumed prior to this verification call; + * {@code false} otherwise. + * @throws FirebaseAppCheckException If an HTTP error or backend service failure occurs. + */ + private boolean verifyOneTimeToken(String token) + throws FirebaseAppCheckException { + String url = String.format(VERIFY_TOKEN_URL_FORMAT, this.projectId); + GenericUrl genericUrl = new GenericUrl(url); + + GenericJson requestPayload = new GenericJson(); + requestPayload.put("app_check_token", token); + + HttpResponse httpResponse = null; + try { + HttpRequest httpRequest = + requestFactory.buildPostRequest( + genericUrl, new JsonHttpContent(jsonFactory, requestPayload)); + httpRequest.setParser(jsonFactory.createJsonObjectParser()); + httpResponse = httpRequest.execute(); + + GenericJson response = httpResponse.parseAs(GenericJson.class); + Boolean alreadyConsumed = (Boolean) response.get("alreadyConsumed"); + if (alreadyConsumed == null) { + alreadyConsumed = (Boolean) response.get("already_consumed"); + } + return Boolean.TRUE.equals(alreadyConsumed); + } catch (IOException e) { + throw new FirebaseAppCheckException( + ErrorCode.INTERNAL, "Error verifying App Check token with backend: " + e.getMessage(), e); + } finally { + ApiClientUtils.disconnectQuietly(httpResponse); + } + } + + private DefaultJWTProcessor createJwtProcessor() { + DefaultJWTProcessor processor = new DefaultJWTProcessor<>(); + try { + JWKSource keySource = createKeySource(); + JWSKeySelector keySelector = + new JWSVerificationKeySelector<>(JWSAlgorithm.RS256, keySource); + processor.setJWSKeySelector(keySelector); + } catch (MalformedURLException e) { + throw new IllegalStateException("Invalid JWKS URL", e); + } + return processor; + } + + protected JWKSource createKeySource() throws MalformedURLException { + return JWKSourceBuilder.create(URI.create(JWKS_URL).toURL()) + .cache(JWKS_CACHE_TTL_MILLIS, JWKSourceBuilder.DEFAULT_CACHE_REFRESH_TIMEOUT) + .retrying(true) + .build(); + } + + private String getProjectId(FirebaseApp app) { + String projectId = ImplFirebaseTrampolines.getProjectId(app); + if (Strings.isNullOrEmpty(projectId)) { + throw new IllegalArgumentException("Project ID is required in FirebaseOptions."); + } + return projectId; + } +} diff --git a/src/test/java/com/google/firebase/appcheck/DecodedAppCheckTokenTest.java b/src/test/java/com/google/firebase/appcheck/DecodedAppCheckTokenTest.java new file mode 100644 index 000000000..6a36d7e78 --- /dev/null +++ b/src/test/java/com/google/firebase/appcheck/DecodedAppCheckTokenTest.java @@ -0,0 +1,164 @@ +/* + * Copyright 2026 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.google.firebase.appcheck; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertNotNull; +import static org.junit.Assert.assertNull; +import static org.junit.Assert.assertThrows; +import static org.junit.Assert.assertTrue; + +import com.google.common.collect.ImmutableList; +import com.google.common.collect.ImmutableMap; +import com.google.firebase.TestOnlyImplFirebaseTrampolines; +import com.google.firebase.internal.FirebaseProcessEnvironment; +import java.time.Instant; +import java.util.Date; +import java.util.HashMap; +import java.util.Map; +import org.junit.After; +import org.junit.Test; + +public class DecodedAppCheckTokenTest { + + private static final String APP_ID = "test-app-id"; + private static final String ISSUER = "https://firebaseappcheck.googleapis.com/"; + private static final String AUDIENCE = "projects/test-project-id"; + + @After + public void tearDown() { + FirebaseProcessEnvironment.clearCache(); + TestOnlyImplFirebaseTrampolines.clearInstancesForTest(); + } + + @Test + public void testNullClaims_ThrowsException() { + NullPointerException e = + assertThrows(NullPointerException.class, () -> new DecodedAppCheckToken(null)); + assertTrue(e.getMessage().contains("Claims map must not be null")); + } + + @Test + public void testMissingSub_ThrowsException() { + Map claims = new HashMap<>(); + claims.put("iss", ISSUER); + + IllegalArgumentException e = + assertThrows(IllegalArgumentException.class, () -> new DecodedAppCheckToken(claims)); + assertTrue(e.getMessage().contains("Claims map must contain sub")); + } + + @Test + public void testGetters_WithDateTimestamps() { + Date iat = new Date(1600000000000L); + Date exp = new Date(1600003600000L); + + Map claims = + ImmutableMap.builder() + .put("sub", APP_ID) + .put("iss", ISSUER) + .put("aud", AUDIENCE) + .put("iat", iat) + .put("exp", exp) + .put("jti", "test-jwt-id") + .put("provider", "play_integrity") + .build(); + + DecodedAppCheckToken token = new DecodedAppCheckToken(claims); + + assertNotNull(token); + assertEquals(APP_ID, token.getSubject()); + assertEquals(APP_ID, token.getAppId()); + assertEquals(ISSUER, token.getIssuer()); + assertEquals("test-jwt-id", token.getJti()); + assertEquals("play_integrity", token.getProvider()); + assertEquals(ImmutableList.of(AUDIENCE), token.getAudience()); + assertEquals(Instant.ofEpochMilli(1600000000000L), token.getIssuedAt()); + assertEquals(Instant.ofEpochMilli(1600003600000L), token.getExpirationTime()); + assertEquals(claims, token.getClaims()); + } + + @Test + public void testGetters_WithNumericTimestamps() { + Map claims = + ImmutableMap.builder() + .put("sub", APP_ID) + .put("iat", 1600000000L) + .put("exp", 1600003600L) + .build(); + + DecodedAppCheckToken token = new DecodedAppCheckToken(claims); + + assertNotNull(token); + assertEquals(APP_ID, token.getAppId()); + assertNull(token.getJti()); + assertNull(token.getProvider()); + assertEquals(Instant.ofEpochSecond(1600000000L), token.getIssuedAt()); + assertEquals(Instant.ofEpochSecond(1600003600L), token.getExpirationTime()); + } + + @Test + public void testGetAudience_ListFormat() { + Map claims = + ImmutableMap.of( + "sub", APP_ID, + "aud", ImmutableList.of("aud1", "aud2")); + + DecodedAppCheckToken token = new DecodedAppCheckToken(claims); + + assertEquals(ImmutableList.of("aud1", "aud2"), token.getAudience()); + } + + @Test + public void testGetAudience_StringFormat() { + Map claims = + ImmutableMap.of( + "sub", APP_ID, + "aud", AUDIENCE); + + DecodedAppCheckToken token = new DecodedAppCheckToken(claims); + + assertEquals(ImmutableList.of(AUDIENCE), token.getAudience()); + } + + @Test + public void testGetAudience_EmptyList() { + Map claims = + ImmutableMap.of( + "sub", APP_ID, + "aud", ImmutableList.of()); + + DecodedAppCheckToken token = new DecodedAppCheckToken(claims); + + assertEquals(ImmutableList.of(), token.getAudience()); + } + + @Test + public void testGetAudience_EmptyWhenMissingOrUnknownType() { + Map claims = ImmutableMap.of("sub", APP_ID); + DecodedAppCheckToken token = new DecodedAppCheckToken(claims); + assertEquals(ImmutableList.of(), token.getAudience()); + } + + @Test + public void testTimestamps_NullWhenMissingOrUnknownType() { + Map claims = ImmutableMap.of("sub", APP_ID); + DecodedAppCheckToken token = new DecodedAppCheckToken(claims); + assertNull(token.getIssuedAt()); + assertNull(token.getExpirationTime()); + } +} diff --git a/src/test/java/com/google/firebase/appcheck/FirebaseAppCheckTest.java b/src/test/java/com/google/firebase/appcheck/FirebaseAppCheckTest.java new file mode 100644 index 000000000..096e51f1d --- /dev/null +++ b/src/test/java/com/google/firebase/appcheck/FirebaseAppCheckTest.java @@ -0,0 +1,167 @@ +/* + * Copyright 2026 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.google.firebase.appcheck; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertNotNull; +import static org.junit.Assert.assertSame; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.times; +import static org.mockito.Mockito.verify; +import static org.mockito.Mockito.when; + +import com.google.api.core.ApiFuture; +import com.google.common.collect.ImmutableMap; +import com.google.firebase.FirebaseApp; +import com.google.firebase.FirebaseOptions; +import com.google.firebase.TestOnlyImplFirebaseTrampolines; +import com.google.firebase.appcheck.internal.AppCheckTokenVerifier; +import com.google.firebase.internal.FirebaseProcessEnvironment; +import com.google.firebase.testing.ServiceAccount; +import com.google.firebase.testing.TestUtils; +import java.lang.reflect.Field; +import org.junit.After; +import org.junit.Before; +import org.junit.Test; +import org.mockito.Mock; +import org.mockito.MockitoAnnotations; + +public class FirebaseAppCheckTest { + + private static final FirebaseOptions firebaseOptions = + FirebaseOptions.builder() + .setCredentials(TestUtils.getCertCredential(ServiceAccount.OWNER.asStream())) + .setProjectId("test-project-id") + .build(); + + @Mock private AppCheckTokenVerifier mockVerifier; + + private FirebaseAppCheck firebaseAppCheck; + + @Before + public void setUp() throws Exception { + MockitoAnnotations.openMocks(this); + + FirebaseApp.initializeApp(firebaseOptions); + firebaseAppCheck = FirebaseAppCheck.getInstance(); + + Field verifierField = FirebaseAppCheck.class.getDeclaredField("tokenVerifier"); + verifierField.setAccessible(true); + verifierField.set(firebaseAppCheck, mockVerifier); + } + + @After + public void tearDown() { + FirebaseProcessEnvironment.clearCache(); + TestOnlyImplFirebaseTrampolines.clearInstancesForTest(); + } + + @Test + public void testGetInstance() { + FirebaseAppCheck instance = FirebaseAppCheck.getInstance(); + assertNotNull(instance); + assertSame(instance, FirebaseAppCheck.getInstance()); + } + + @Test + public void testGetInstanceForApp() { + FirebaseApp app = FirebaseApp.initializeApp(firebaseOptions, "testGetInstanceForApp"); + FirebaseAppCheck instance = FirebaseAppCheck.getInstance(app); + assertNotNull(instance); + assertSame(instance, FirebaseAppCheck.getInstance(app)); + } + + @Test + public void testVerifyToken_DelegatesToVerifier() throws FirebaseAppCheckException { + String testToken = "test.token"; + DecodedAppCheckToken decodedToken = + new DecodedAppCheckToken(ImmutableMap.of("sub", "app-id")); + VerifyAppCheckTokenResponse expectedResponse = + new VerifyAppCheckTokenResponse("app-id", decodedToken, null); + + when(mockVerifier.verifyToken(testToken, null)).thenReturn(expectedResponse); + + VerifyAppCheckTokenResponse result = firebaseAppCheck.verifyToken(testToken); + + assertEquals(expectedResponse, result); + verify(mockVerifier, times(1)).verifyToken(testToken, null); + } + + @Test + public void testVerifyTokenWithOptions_DelegatesToVerifier() throws FirebaseAppCheckException { + String testToken = "test.token"; + VerifyAppCheckTokenOptions options = + VerifyAppCheckTokenOptions.builder().setConsume(true).build(); + DecodedAppCheckToken decodedToken = + new DecodedAppCheckToken(ImmutableMap.of("sub", "app-id")); + VerifyAppCheckTokenResponse expectedResponse = + new VerifyAppCheckTokenResponse("app-id", decodedToken, true); + + when(mockVerifier.verifyToken(testToken, options)).thenReturn(expectedResponse); + + VerifyAppCheckTokenResponse result = firebaseAppCheck.verifyToken(testToken, options); + + assertEquals(expectedResponse, result); + verify(mockVerifier, times(1)).verifyToken(testToken, options); + } + + @Test + public void testVerifyTokenAsync_DelegatesToVerifier() throws Exception { + String testToken = "test.token"; + DecodedAppCheckToken decodedToken = + new DecodedAppCheckToken(ImmutableMap.of("sub", "app-id")); + VerifyAppCheckTokenResponse expectedResponse = + new VerifyAppCheckTokenResponse("app-id", decodedToken, null); + + when(mockVerifier.verifyToken(testToken, null)).thenReturn(expectedResponse); + + ApiFuture future = firebaseAppCheck.verifyTokenAsync(testToken); + + assertEquals(expectedResponse, future.get()); + verify(mockVerifier, times(1)).verifyToken(testToken, null); + } + + @Test + public void testVerifyTokenAsyncWithOptions_DelegatesToVerifier() throws Exception { + String testToken = "test.token"; + VerifyAppCheckTokenOptions options = + VerifyAppCheckTokenOptions.builder().setConsume(true).build(); + DecodedAppCheckToken decodedToken = + new DecodedAppCheckToken(ImmutableMap.of("sub", "app-id")); + VerifyAppCheckTokenResponse expectedResponse = + new VerifyAppCheckTokenResponse("app-id", decodedToken, true); + + when(mockVerifier.verifyToken(testToken, options)).thenReturn(expectedResponse); + + ApiFuture future = + firebaseAppCheck.verifyTokenAsync(testToken, options); + + assertEquals(expectedResponse, future.get()); + verify(mockVerifier, times(1)).verifyToken(testToken, options); + } + + @Test(expected = NullPointerException.class) + public void testNullApp_ThrowsException() { + new FirebaseAppCheck(null, mockVerifier); + } + + @Test(expected = NullPointerException.class) + public void testNullVerifier_ThrowsException() { + FirebaseApp app = FirebaseApp.getInstance(); + new FirebaseAppCheck(app, null); + } +} diff --git a/src/test/java/com/google/firebase/appcheck/VerifyAppCheckTokenOptionsTest.java b/src/test/java/com/google/firebase/appcheck/VerifyAppCheckTokenOptionsTest.java new file mode 100644 index 000000000..5948ffcd3 --- /dev/null +++ b/src/test/java/com/google/firebase/appcheck/VerifyAppCheckTokenOptionsTest.java @@ -0,0 +1,80 @@ +/* + * Copyright 2026 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.google.firebase.appcheck; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertNotNull; +import static org.junit.Assert.assertThrows; +import static org.junit.Assert.assertTrue; + +import java.util.Optional; +import org.junit.Test; + +public class VerifyAppCheckTokenOptionsTest { + + @Test + public void testDefaultBuilder_EmptyConsume() { + VerifyAppCheckTokenOptions options = VerifyAppCheckTokenOptions.builder().build(); + assertNotNull(options); + assertFalse(options.getConsume().isPresent()); + } + + @Test + public void testBuilder_SetConsumeTrue() { + VerifyAppCheckTokenOptions options = + VerifyAppCheckTokenOptions.builder().setConsume(true).build(); + assertNotNull(options); + assertTrue(options.getConsume().isPresent()); + assertTrue(options.getConsume().get()); + } + + @Test + public void testBuilder_SetConsumeFalse() { + VerifyAppCheckTokenOptions options = + VerifyAppCheckTokenOptions.builder().setConsume(false).build(); + assertNotNull(options); + assertTrue(options.getConsume().isPresent()); + assertFalse(options.getConsume().get()); + } + + @Test + public void testBuilder_SetConsumeOptional_Present() { + VerifyAppCheckTokenOptions options = + VerifyAppCheckTokenOptions.builder().setConsume(Optional.of(true)).build(); + assertNotNull(options); + assertTrue(options.getConsume().isPresent()); + assertTrue(options.getConsume().get()); + } + + @Test + public void testBuilder_SetConsumeOptional_Empty() { + VerifyAppCheckTokenOptions options = + VerifyAppCheckTokenOptions.builder().setConsume(Optional.empty()).build(); + assertNotNull(options); + assertFalse(options.getConsume().isPresent()); + } + + @Test + public void testBuilder_SetConsumeOptionalNull_ThrowsException() { + NullPointerException e = + assertThrows( + NullPointerException.class, + () -> VerifyAppCheckTokenOptions.builder().setConsume((Optional) null)); + assertEquals("consume must not be null", e.getMessage()); + } +} diff --git a/src/test/java/com/google/firebase/appcheck/VerifyAppCheckTokenResponseTest.java b/src/test/java/com/google/firebase/appcheck/VerifyAppCheckTokenResponseTest.java new file mode 100644 index 000000000..ba605621f --- /dev/null +++ b/src/test/java/com/google/firebase/appcheck/VerifyAppCheckTokenResponseTest.java @@ -0,0 +1,86 @@ +/* + * Copyright 2026 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.google.firebase.appcheck; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertNotNull; +import static org.junit.Assert.assertThrows; +import static org.junit.Assert.assertTrue; + +import com.google.common.collect.ImmutableMap; +import org.junit.Test; + +public class VerifyAppCheckTokenResponseTest { + + private static final String APP_ID = "test-app-id"; + private static final DecodedAppCheckToken DECODED_TOKEN = + new DecodedAppCheckToken(ImmutableMap.of("sub", APP_ID)); + + @Test + public void testNullAppId_ThrowsException() { + NullPointerException e = + assertThrows( + NullPointerException.class, + () -> new VerifyAppCheckTokenResponse(null, DECODED_TOKEN, null)); + assertTrue(e.getMessage().contains("appId must not be null")); + } + + @Test + public void testNullToken_ThrowsException() { + NullPointerException e = + assertThrows( + NullPointerException.class, + () -> new VerifyAppCheckTokenResponse(APP_ID, null, null)); + assertTrue(e.getMessage().contains("token must not be null")); + } + + @Test + public void testGetters_WithoutAlreadyConsumed() { + VerifyAppCheckTokenResponse response = + new VerifyAppCheckTokenResponse(APP_ID, DECODED_TOKEN, null); + + assertNotNull(response); + assertEquals(APP_ID, response.getAppId()); + assertEquals(DECODED_TOKEN, response.getToken()); + assertFalse(response.isAlreadyConsumed().isPresent()); + } + + @Test + public void testGetters_WithAlreadyConsumedTrue() { + VerifyAppCheckTokenResponse response = + new VerifyAppCheckTokenResponse(APP_ID, DECODED_TOKEN, true); + + assertNotNull(response); + assertEquals(APP_ID, response.getAppId()); + assertEquals(DECODED_TOKEN, response.getToken()); + assertTrue(response.isAlreadyConsumed().isPresent()); + assertTrue(response.isAlreadyConsumed().get()); + } + + @Test + public void testGetters_WithAlreadyConsumedFalse() { + VerifyAppCheckTokenResponse response = + new VerifyAppCheckTokenResponse(APP_ID, DECODED_TOKEN, false); + + assertNotNull(response); + assertEquals(APP_ID, response.getAppId()); + assertEquals(DECODED_TOKEN, response.getToken()); + assertTrue(response.isAlreadyConsumed().isPresent()); + assertFalse(response.isAlreadyConsumed().get()); + } +} diff --git a/src/test/java/com/google/firebase/appcheck/internal/AppCheckTokenVerifierTest.java b/src/test/java/com/google/firebase/appcheck/internal/AppCheckTokenVerifierTest.java new file mode 100644 index 000000000..005531c76 --- /dev/null +++ b/src/test/java/com/google/firebase/appcheck/internal/AppCheckTokenVerifierTest.java @@ -0,0 +1,441 @@ +/* + * Copyright 2026 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.google.firebase.appcheck.internal; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertNotNull; +import static org.junit.Assert.assertThrows; +import static org.junit.Assert.assertTrue; +import static org.mockito.ArgumentMatchers.any; +import static org.mockito.Mockito.doReturn; +import static org.mockito.Mockito.doThrow; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.spy; +import static org.mockito.Mockito.when; + +import com.google.api.client.http.HttpRequest; +import com.google.api.client.http.HttpRequestFactory; +import com.google.api.client.http.HttpResponse; +import com.google.api.client.http.HttpStatusCodes; +import com.google.api.client.http.HttpTransport; +import com.google.api.client.http.LowLevelHttpRequest; +import com.google.api.client.http.LowLevelHttpResponse; +import com.google.api.client.json.JsonFactory; +import com.google.api.client.testing.http.MockHttpTransport; +import com.google.api.client.testing.http.MockLowLevelHttpRequest; +import com.google.api.client.testing.http.MockLowLevelHttpResponse; +import com.google.auth.oauth2.GoogleCredentials; +import com.google.firebase.ErrorCode; +import com.google.firebase.FirebaseApp; +import com.google.firebase.FirebaseOptions; +import com.google.firebase.TestOnlyImplFirebaseTrampolines; +import com.google.firebase.appcheck.DecodedAppCheckToken; +import com.google.firebase.appcheck.FirebaseAppCheckException; +import com.google.firebase.appcheck.VerifyAppCheckTokenOptions; +import com.google.firebase.appcheck.VerifyAppCheckTokenResponse; +import com.google.firebase.internal.ApiClientUtils; +import com.google.firebase.internal.FirebaseProcessEnvironment; +import com.google.firebase.testing.ServiceAccount; +import com.google.firebase.testing.TestUtils; +import com.nimbusds.jose.JOSEException; +import com.nimbusds.jose.JOSEObjectType; +import com.nimbusds.jose.JWSAlgorithm; +import com.nimbusds.jose.JWSHeader; +import com.nimbusds.jose.crypto.RSASSASigner; +import com.nimbusds.jose.proc.BadJOSEException; +import com.nimbusds.jose.proc.SecurityContext; +import com.nimbusds.jwt.JWTClaimsSet; +import com.nimbusds.jwt.SignedJWT; +import com.nimbusds.jwt.proc.DefaultJWTProcessor; +import com.nimbusds.jwt.proc.ExpiredJWTException; +import java.lang.reflect.Method; +import java.net.MalformedURLException; +import java.security.KeyPair; +import java.security.KeyPairGenerator; +import java.util.Collections; +import java.util.Date; +import org.junit.After; +import org.junit.Before; +import org.junit.Test; +import org.mockito.Mock; +import org.mockito.MockitoAnnotations; + +public class AppCheckTokenVerifierTest { + + private static final String PROJECT_ID = "test-project-id"; + private static final FirebaseOptions firebaseOptions = + FirebaseOptions.builder() + .setProjectId(PROJECT_ID) + .setCredentials(TestUtils.getCertCredential(ServiceAccount.OWNER.asStream())) + .build(); + private static final String ISSUER = "https://firebaseappcheck.googleapis.com/"; + private static final String AUDIENCE = "projects/" + PROJECT_ID; + private static final String APP_ID = "test-app-id"; + private static final String KEY_ID = "key-id-1"; + + @Mock private DefaultJWTProcessor mockJwtProcessor; + + private AppCheckTokenVerifier verifier; + private KeyPair rsaKeyPair; + private JWSHeader header; + private JWTClaimsSet claims; + private Date issueTime; + private Date expirationTime; + + @Before + public void setUp() throws Exception { + MockitoAnnotations.openMocks(this); + + issueTime = new Date(); + expirationTime = new Date(System.currentTimeMillis() + 10000); + + KeyPairGenerator gen = KeyPairGenerator.getInstance("RSA"); + gen.initialize(2048); + rsaKeyPair = gen.generateKeyPair(); + + FirebaseApp firebaseApp = FirebaseApp.initializeApp(firebaseOptions); + + HttpRequestFactory requestFactory = ApiClientUtils.newAuthorizedRequestFactory(firebaseApp); + JsonFactory jsonFactory = ApiClientUtils.getDefaultJsonFactory(); + + verifier = + new AppCheckTokenVerifier(firebaseApp, requestFactory, jsonFactory, mockJwtProcessor); + + header = + new JWSHeader.Builder(JWSAlgorithm.RS256) + .keyID(KEY_ID) + .type(JOSEObjectType.JWT) + .build(); + + claims = + new JWTClaimsSet.Builder() + .issuer(ISSUER) + .audience(AUDIENCE) + .subject(APP_ID) + .issueTime(issueTime) + .expirationTime(expirationTime) + .build(); + } + + @After + public void tearDown() { + FirebaseProcessEnvironment.clearCache(); + TestOnlyImplFirebaseTrampolines.clearInstancesForTest(); + } + + private String createToken(JWSHeader header, JWTClaimsSet claims) throws Exception { + SignedJWT jwt = new SignedJWT(header, claims); + + if (JWSAlgorithm.RS256.equals(header.getAlgorithm()) + || JWSAlgorithm.RS384.equals(header.getAlgorithm()) + || JWSAlgorithm.RS512.equals(header.getAlgorithm())) { + jwt.sign(new RSASSASigner(rsaKeyPair.getPrivate())); + } else if (JWSAlgorithm.HS256.equals(header.getAlgorithm())) { + jwt.sign(new com.nimbusds.jose.crypto.MACSigner("12345678901234567890123456789012")); + } + + return jwt.serialize(); + } + + @Test + public void testVerifyToken_Success() throws Exception { + String token = createToken(header, claims); + when(mockJwtProcessor.process(any(SignedJWT.class), any())).thenReturn(claims); + + VerifyAppCheckTokenResponse response = verifier.verifyToken(token); + + assertNotNull(response); + assertEquals(APP_ID, response.getAppId()); + assertNotNull(response.getToken()); + assertFalse(response.isAlreadyConsumed().isPresent()); + + DecodedAppCheckToken decodedToken = response.getToken(); + assertEquals(APP_ID, decodedToken.getSubject()); + assertEquals(ISSUER, decodedToken.getIssuer()); + assertEquals(Collections.singletonList(AUDIENCE), decodedToken.getAudience()); + assertEquals(issueTime.toInstant(), decodedToken.getIssuedAt()); + assertEquals(expirationTime.toInstant(), decodedToken.getExpirationTime()); + assertEquals(ISSUER, decodedToken.getClaims().get("iss")); + assertEquals(APP_ID, decodedToken.getClaims().get("sub")); + } + + @Test + public void testVerifyToken_WithConsumeOption_CallsBackend() throws Exception { + when(mockJwtProcessor.process(any(SignedJWT.class), any())).thenReturn(claims); + + MockLowLevelHttpResponse mockResponse = new MockLowLevelHttpResponse(); + mockResponse.setContentType("application/json"); + mockResponse.setContent("{\"alreadyConsumed\": true}"); + + MockHttpTransport transport = + new MockHttpTransport.Builder().setLowLevelHttpResponse(mockResponse).build(); + + HttpRequestFactory mockRequestFactory = transport.createRequestFactory(); + JsonFactory jsonFactory = ApiClientUtils.getDefaultJsonFactory(); + + FirebaseApp app = FirebaseApp.getInstance(); + AppCheckTokenVerifier customVerifier = + new AppCheckTokenVerifier(app, mockRequestFactory, jsonFactory, mockJwtProcessor); + + String token = createToken(header, claims); + VerifyAppCheckTokenOptions options = + VerifyAppCheckTokenOptions.builder().setConsume(true).build(); + VerifyAppCheckTokenResponse response = customVerifier.verifyToken(token, options); + + assertNotNull(response); + assertEquals(APP_ID, response.getAppId()); + assertTrue(response.isAlreadyConsumed().isPresent()); + assertTrue(response.isAlreadyConsumed().get()); + } + + @Test + public void testVerifyToken_NullOrEmptyToken_ThrowsException() { + IllegalArgumentException ex1 = + assertThrows(IllegalArgumentException.class, () -> verifier.verifyToken(null)); + assertTrue(ex1.getMessage().contains("must not be null or empty")); + + IllegalArgumentException ex2 = + assertThrows(IllegalArgumentException.class, () -> verifier.verifyToken("")); + assertTrue(ex2.getMessage().contains("must not be null or empty")); + } + + @Test + public void testVerifyHeader_IncorrectAlgorithm_ThrowsException() throws Exception { + JWSHeader badHeader = + new JWSHeader.Builder(JWSAlgorithm.RS384) + .keyID(KEY_ID) + .type(JOSEObjectType.JWT) + .build(); + final String token = createToken(badHeader, claims); + + FirebaseAppCheckException ex = + assertThrows(FirebaseAppCheckException.class, () -> verifier.verifyToken(token)); + assertEquals(ErrorCode.INVALID_ARGUMENT, ex.getErrorCode()); + assertTrue(ex.getMessage().contains("incorrect algorithm")); + } + + @Test + public void testVerifyHeader_MissingKid_ThrowsException() throws Exception { + JWSHeader badHeader = + new JWSHeader.Builder(JWSAlgorithm.RS256).type(JOSEObjectType.JWT).build(); + final String token = createToken(badHeader, claims); + + FirebaseAppCheckException ex = + assertThrows(FirebaseAppCheckException.class, () -> verifier.verifyToken(token)); + assertEquals(ErrorCode.INVALID_ARGUMENT, ex.getErrorCode()); + assertTrue(ex.getMessage().contains("no 'kid'")); + } + + @Test + public void testVerifyHeader_IncorrectType_ThrowsException() throws Exception { + JWSHeader badHeader = + new JWSHeader.Builder(JWSAlgorithm.RS256) + .keyID(KEY_ID) + .type(JOSEObjectType.JOSE) + .build(); + String token = createToken(badHeader, claims); + + FirebaseAppCheckException ex = + assertThrows(FirebaseAppCheckException.class, () -> verifier.verifyToken(token)); + assertEquals(ErrorCode.INVALID_ARGUMENT, ex.getErrorCode()); + assertTrue(ex.getMessage().contains("incorrect 'typ'")); + } + + @Test + public void testVerifyClaims_MissingIssuer_ThrowsException() throws Exception { + JWTClaimsSet badClaims = + new JWTClaimsSet.Builder() + .audience(AUDIENCE) + .subject(APP_ID) + .expirationTime(new Date(System.currentTimeMillis() + 10000)) + .build(); + String token = createToken(header, badClaims); + when(mockJwtProcessor.process(any(SignedJWT.class), any())).thenReturn(badClaims); + + FirebaseAppCheckException ex = + assertThrows(FirebaseAppCheckException.class, () -> verifier.verifyToken(token)); + assertEquals(ErrorCode.INVALID_ARGUMENT, ex.getErrorCode()); + assertTrue(ex.getMessage().contains("no 'iss'")); + } + + @Test + public void testVerifyClaims_IncorrectIssuer_ThrowsException() throws Exception { + JWTClaimsSet badClaims = + new JWTClaimsSet.Builder() + .issuer("https://invalid-issuer.com") + .audience(AUDIENCE) + .subject(APP_ID) + .expirationTime(new Date(System.currentTimeMillis() + 10000)) + .build(); + String token = createToken(header, badClaims); + when(mockJwtProcessor.process(any(SignedJWT.class), any())).thenReturn(badClaims); + + FirebaseAppCheckException ex = + assertThrows(FirebaseAppCheckException.class, () -> verifier.verifyToken(token)); + assertEquals(ErrorCode.INVALID_ARGUMENT, ex.getErrorCode()); + assertTrue(ex.getMessage().contains("incorrect issuer")); + } + + @Test + public void testVerifyClaims_MissingAudience_ThrowsException() throws Exception { + JWTClaimsSet badClaims = + new JWTClaimsSet.Builder() + .issuer(ISSUER) + .subject(APP_ID) + .expirationTime(new Date(System.currentTimeMillis() + 10000)) + .build(); + String token = createToken(header, badClaims); + when(mockJwtProcessor.process(any(SignedJWT.class), any())).thenReturn(badClaims); + + FirebaseAppCheckException ex = + assertThrows(FirebaseAppCheckException.class, () -> verifier.verifyToken(token)); + assertEquals(ErrorCode.INVALID_ARGUMENT, ex.getErrorCode()); + assertTrue(ex.getMessage().contains("incorrect audience")); + } + + @Test + public void testVerifyClaims_IncorrectAudience_ThrowsException() throws Exception { + JWTClaimsSet badClaims = + new JWTClaimsSet.Builder() + .issuer(ISSUER) + .audience("projects/wrong-project-id") + .subject(APP_ID) + .expirationTime(new Date(System.currentTimeMillis() + 10000)) + .build(); + String token = createToken(header, badClaims); + when(mockJwtProcessor.process(any(SignedJWT.class), any())).thenReturn(badClaims); + + FirebaseAppCheckException ex = + assertThrows(FirebaseAppCheckException.class, () -> verifier.verifyToken(token)); + assertEquals(ErrorCode.INVALID_ARGUMENT, ex.getErrorCode()); + assertTrue(ex.getMessage().contains("incorrect audience")); + } + + @Test + public void testVerifyClaims_MissingSubject_ThrowsException() throws Exception { + JWTClaimsSet badClaims = + new JWTClaimsSet.Builder() + .issuer(ISSUER) + .audience(AUDIENCE) + .expirationTime(new Date(System.currentTimeMillis() + 10000)) + .build(); + String token = createToken(header, badClaims); + when(mockJwtProcessor.process(any(SignedJWT.class), any())).thenReturn(badClaims); + + FirebaseAppCheckException ex = + assertThrows(FirebaseAppCheckException.class, () -> verifier.verifyToken(token)); + assertEquals(ErrorCode.INVALID_ARGUMENT, ex.getErrorCode()); + assertTrue(ex.getMessage().contains("empty 'sub'")); + } + + @Test + public void testVerifyToken_ExpiredToken_ThrowsException() throws Exception { + String token = createToken(header, claims); + when(mockJwtProcessor.process(any(SignedJWT.class), any())) + .thenThrow(new ExpiredJWTException("Expired token")); + + FirebaseAppCheckException ex = + assertThrows(FirebaseAppCheckException.class, () -> verifier.verifyToken(token)); + assertEquals(ErrorCode.INVALID_ARGUMENT, ex.getErrorCode()); + assertTrue(ex.getMessage().contains("has expired")); + } + + @Test + public void testVerifyToken_BadJOSEException_ThrowsException() throws Exception { + String token = createToken(header, claims); + when(mockJwtProcessor.process(any(SignedJWT.class), any())) + .thenThrow(new BadJOSEException("Bad signature")); + + FirebaseAppCheckException ex = + assertThrows(FirebaseAppCheckException.class, () -> verifier.verifyToken(token)); + assertEquals(ErrorCode.INVALID_ARGUMENT, ex.getErrorCode()); + assertTrue(ex.getMessage().contains("Failed to verify App Check token signature")); + } + + @Test + public void testVerifyToken_JOSEException_ThrowsException() throws Exception { + String token = createToken(header, claims); + when(mockJwtProcessor.process(any(SignedJWT.class), any())) + .thenThrow(new JOSEException("Key error")); + + FirebaseAppCheckException ex = + assertThrows(FirebaseAppCheckException.class, () -> verifier.verifyToken(token)); + assertEquals(ErrorCode.INTERNAL, ex.getErrorCode()); + assertTrue(ex.getMessage().contains("Internal error processing App Check token")); + } + + @Test + public void testVerifyToken_ParseException_ThrowsException() { + String invalidToken = "invalid-token-string"; + + FirebaseAppCheckException ex = + assertThrows(FirebaseAppCheckException.class, () -> verifier.verifyToken(invalidToken)); + assertEquals(ErrorCode.INVALID_ARGUMENT, ex.getErrorCode()); + assertTrue(ex.getMessage().contains("Failed to parse App Check JWT token")); + } + + @Test + public void testVerifyToken_Claims_Null() throws Exception { + JWTClaimsSet noSubClaims = new JWTClaimsSet.Builder().build(); + String tokenString = createToken(header, noSubClaims); + when(mockJwtProcessor.process(any(SignedJWT.class), any())).thenReturn(null); + + NullPointerException e = + assertThrows(NullPointerException.class, () -> verifier.verifyToken(tokenString)); + assertTrue(e.getMessage().contains("JWTClaimsSet claims must not be null")); + } + + @Test + public void testVerifierWithoutProjectId() { + FirebaseOptions localFirebaseOptions = + FirebaseOptions.builder() + .setCredentials(GoogleCredentials.create(null)) + .build(); + + FirebaseApp localApp = + FirebaseApp.initializeApp(localFirebaseOptions, "no-project-id-app"); + + IllegalArgumentException e = + assertThrows( + IllegalArgumentException.class, () -> new AppCheckTokenVerifier(localApp)); + assertEquals("Project ID is required in FirebaseOptions.", e.getMessage()); + } + + @Test + public void testCreateJwtProcessor_HandlesException() throws Exception { + FirebaseApp app = FirebaseApp.initializeApp(firebaseOptions, "third"); + AppCheckTokenVerifier original = new AppCheckTokenVerifier(app); + AppCheckTokenVerifier spyClass = spy(original); + + doThrow(new MalformedURLException("Simulated bad URL")) + .when(spyClass) + .createKeySource(); + + Method method = AppCheckTokenVerifier.class.getDeclaredMethod("createJwtProcessor"); + method.setAccessible(true); + + try { + method.invoke(spyClass); + } catch (Exception e) { + Throwable cause = e.getCause(); + assertEquals(IllegalStateException.class, cause.getClass()); + assertEquals("Invalid JWKS URL", cause.getMessage()); + assertTrue(cause.getCause() instanceof MalformedURLException); + } + } +}