[Auth] Fix handling of AppCheck placeholder tokens

FirebaseAuth/CHANGELOG.md

@@ -1,5 +1,6 @@
 # Unreleased
 - [fixed] Add a mechanism to prevent concurrent token refreshes. (#15474)
+- [fixed] Fix handling of AppCheck placeholder tokens. (#15372)
 
 # 12.2.0
 - [added] Added TOTP support for macOS.

FirebaseAuth/Sources/Swift/AuthProvider/OAuthProvider.swift

@@ -435,8 +435,8 @@ import Foundation
       let tokenResult = await appCheck.getToken(forcingRefresh: false)
       if let error = tokenResult.error {
         AuthLog.logWarning(code: "I-AUT000018",
-                           message: "Error getting App Check token; using placeholder " +
-                             "token instead. Error: \(error)")
+                           message: "Error getting App Check token. Error: \(error)")
+        throw error
       }
       let appCheckTokenFragment = "fac=\(tokenResult.token)"
       components?.fragment = appCheckTokenFragment

FirebaseAuth/Sources/Swift/AuthProvider/PhoneAuthProvider.swift

@@ -627,8 +627,8 @@ import Foundation
         let tokenResult = await appCheck.getToken(forcingRefresh: false)
         if let error = tokenResult.error {
           AuthLog.logWarning(code: "I-AUT000018",
-                             message: "Error getting App Check token; using placeholder " +
-                               "token instead. Error: \(error)")
+                             message: "Error getting App Check token. Error: \(error)")
+          throw error
         }
         let appCheckTokenFragment = "fac=\(tokenResult.token)"
         components?.fragment = appCheckTokenFragment

FirebaseAuth/Tests/Unit/Fakes/FakeAppCheck.swift

@@ -18,9 +18,10 @@ import Foundation
 
 class FakeAppCheck: NSObject, AppCheckInterop {
   let fakeAppCheckToken = "fakeAppCheckToken"
+  var error: Error?
 
   func getToken(forcingRefresh: Bool, completion: @escaping AppCheckTokenHandlerInterop) {
-    completion(FakeAppCheckResult(token: "fakeAppCheckToken"))
+    completion(FakeAppCheckResult(token: "fakeAppCheckToken", error: error))
   }
 
   func tokenDidChangeNotificationName() -> String {
@@ -40,7 +41,8 @@ class FakeAppCheckResult: NSObject, FIRAppCheckTokenResultInterop {
   var token: String
   var error: Error?
 
-  init(token: String) {
+  init(token: String, error: Error? = nil) {
     self.token = token
+    self.error = error
   }
 }

FirebaseAuth/Tests/Unit/OAuthProviderTests.swift

@@ -229,6 +229,38 @@ import FirebaseCore
       OAuthProviderTests.testAppCheck = false
     }
 
+    func testGetCredentialWithUIDelegateWithAppCheckError() throws {
+      let expectation = self.expectation(description: "App Check error propagated")
+      let fakeAppCheck = FakeAppCheck()
+      let expectedError = NSError(domain: "appCheckError", code: -1)
+      fakeAppCheck.error = expectedError
+      initApp(#function, useAppID: true)
+      let auth = try XCTUnwrap(OAuthProviderTests.auth)
+      auth.requestConfiguration.appCheck = fakeAppCheck
+      let provider = OAuthProvider(providerID: kFakeProviderID, auth: auth)
+
+      let projectConfigExpectation = self.expectation(description: "projectConfiguration")
+      rpcIssuer.projectConfigRequester = { request in
+        projectConfigExpectation.fulfill()
+        do {
+          return try self.rpcIssuer.respond(withJSON: ["authorizedDomains": [
+            Self.kFakeAuthorizedWebDomain,
+            Self.kFakeAuthorizedDomain,
+          ]])
+        } catch {
+          XCTFail("Failure sending response: \(error)")
+          return (nil, nil)
+        }
+      }
+
+      provider.getCredentialWith(nil) { credential, error in
+        XCTAssertNil(credential)
+        XCTAssertEqual(error as? NSError, expectedError)
+        expectation.fulfill()
+      }
+      waitForExpectations(timeout: 2.0)
+    }
+
     /** @fn testOAuthCredentialCoding
         @brief Tests successful archiving and unarchiving of @c GoogleAuthCredential.
      */

FirebaseAuth/Tests/Unit/PhoneAuthProviderTests.swift

@@ -762,10 +762,12 @@
                                     bothClientAndAppID: Bool = false,
                                     reCAPTCHAfallback: Bool = false,
                                     forwardingNotification: Bool = true,
-                                    presenterError: Error? = nil) async throws {
+                                    presenterError: Error? = nil,
+                                    fakeAppCheck: FakeAppCheck? = nil) async throws {
       initApp(function, useClientID: useClientID, bothClientAndAppID: bothClientAndAppID,
               testMode: testMode,
-              forwardingNotification: forwardingNotification)
+              forwardingNotification: forwardingNotification,
+              fakeAppCheck: fakeAppCheck)
       let auth = try XCTUnwrap(PhoneAuthProviderTests.auth)
       let provider = PhoneAuthProvider.provider(auth: auth)
       var expectations: [XCTestExpectation] = []
@@ -807,7 +809,7 @@
             presenterError: presenterError
           )
       }
-      if errorURLString == nil, presenterError == nil {
+      if errorURLString == nil, presenterError == nil, fakeAppCheck?.error == nil {
         let requestExpectation = expectation(description: "verifyRequester")
         expectations.append(requestExpectation)
         rpcIssuer.verifyRequester = { request in
@@ -861,7 +863,8 @@
                          bothClientAndAppID: Bool = false,
                          testMode: Bool = false,
                          forwardingNotification: Bool = true,
-                         fakeToken: Bool = false) {
+                         fakeToken: Bool = false,
+                         fakeAppCheck: FakeAppCheck? = nil) {
       let options = FirebaseOptions(googleAppID: "0:0000000000000:ios:0000000000000000",
                                     gcmSenderID: "00000000000000000-00000000000-000000000")
       options.apiKey = PhoneAuthProviderTests.kFakeAPIKey
@@ -884,6 +887,9 @@
       kAuthGlobalWorkQueue.sync {
         // Wait for Auth protectedDataInitialization to finish.
         PhoneAuthProviderTests.auth = auth
+        if let fakeAppCheck = fakeAppCheck {
+          auth.requestConfiguration.appCheck = fakeAppCheck
+        }
         if testMode {
           // Disable app verification.
           let settings = AuthSettings()
@@ -1095,5 +1101,18 @@
       "://firebaseauth/" +
       "link?deep_link_id=https%3A%2F%2Fexample.firebaseapp.com%2F__%2Fauth%2Fcallback%3FauthType%" +
       "3DverifyApp%26recaptchaToken%3DfakeReCAPTCHAToken"
+
+    func testVerifyPhoneNumberWithAppCheckError() async throws {
+      let fakeAppCheck = FakeAppCheck()
+      let expectedError = NSError(domain: "appCheckError", code: -1)
+      fakeAppCheck.error = expectedError
+      try await internalTestVerify(
+        errorCode: expectedError.code,
+        function: #function,
+        reCAPTCHAfallback: true,
+        presenterError: nil,
+        fakeAppCheck: fakeAppCheck
+      )
+    }
   }
 #endif