feat: add Firebase App Check (#878)

* Add package firebase_app_check * Init Firebase AppCheck in Dart * Add Firebase AppCheck dependencies * Enable deploy-playstore for any branch * Fix build issue with iOS simulator * Revert minSdkVersion from 23 to 21 to fix crashed with QTI backend
mlcommons · May 28, 2024 · 9543977 · 9543977
1 parent fdfb73e
commit 9543977
Show file tree

Hide file tree

Showing 8 changed files with 92 additions and 13 deletions.
diff --git a/.github/workflows/android-build-test.yml b/.github/workflows/android-build-test.yml
@@ -294,7 +294,7 @@ jobs:
       - build-android-apk
       - test-android-apk-tflite
     runs-on: ubuntu-22.04
-    if: github.ref == 'refs/heads/master'
+#    if: github.ref == 'refs/heads/master'
     steps:
       - uses: actions/checkout@v4
       - name: Set up authentication for Google Cloud SDK

diff --git a/flutter/android/app/build.gradle b/flutter/android/app/build.gradle
@@ -90,4 +90,10 @@ dependencies {
     testImplementation 'junit:junit:4.13.2'
     androidTestImplementation 'androidx.test:runner:1.2.0'
     androidTestImplementation 'androidx.test.espresso:espresso-core:3.2.0'
+
+    // firebase-bom v32.8.1 is required to use minSdkVersion 21
+    // https://firebase.google.com/support/release-notes/android#2024-05-02
+    implementation(platform("com.google.firebase:firebase-bom:32.8.1"))
+    implementation("com.google.firebase:firebase-appcheck-playintegrity")
+    implementation("com.google.firebase:firebase-appcheck-debug")
 }
diff --git a/flutter/ios/Podfile b/flutter/ios/Podfile
@@ -65,7 +65,9 @@ post_install do |installer|
       config.build_settings.delete 'IPHONEOS_DEPLOYMENT_TARGET'
     end
   end
-  installer.pods_project.build_configurations.each do |config|
-    config.build_settings["EXCLUDED_ARCHS[sdk=iphonesimulator*]"] = "arm64"
+  installer.pods_project.targets.each do |target|
+    target.build_configurations.each do |config|
+      config.build_settings['EXCLUDED_ARCHS[sdk=iphonesimulator*]'] = 'arm64'
+    end
   end
 end
diff --git a/flutter/ios/Podfile.lock b/flutter/ios/Podfile.lock
@@ -1,4 +1,8 @@
 PODS:
+  - AppCheckCore (10.19.1):
+    - GoogleUtilities/Environment (~> 7.13)
+    - GoogleUtilities/UserDefaults (~> 7.13)
+    - PromisesObjC (~> 2.3)
   - desktop_webview_auth (0.0.1):
     - Flutter
   - device_info_plus (0.0.1):
@@ -19,11 +23,16 @@ PODS:
   - Firebase/Storage (10.25.0):
     - Firebase/CoreOnly
     - FirebaseStorage (~> 10.25.0)
+  - firebase_app_check (0.2.2-6):
+    - Firebase/CoreOnly (~> 10.25.0)
+    - firebase_core
+    - FirebaseAppCheck (~> 10.25.0-beta)
+    - Flutter
   - firebase_auth (4.19.5):
     - Firebase/Auth (= 10.25.0)
     - firebase_core
     - Flutter
-  - firebase_core (2.31.0):
+  - firebase_core (2.31.1):
     - Firebase/CoreOnly (= 10.25.0)
     - Flutter
   - firebase_crashlytics (3.5.5):
@@ -38,6 +47,13 @@ PODS:
     - Firebase/Storage (= 10.25.0)
     - firebase_core
     - Flutter
+  - FirebaseAppCheck (10.25.0):
+    - AppCheckCore (~> 10.19)
+    - FirebaseAppCheckInterop (~> 10.17)
+    - FirebaseCore (~> 10.0)
+    - GoogleUtilities/Environment (~> 7.13)
+    - GoogleUtilities/UserDefaults (~> 7.13)
+    - PromisesObjC (~> 2.1)
   - FirebaseAppCheckInterop (10.25.0)
   - FirebaseAuth (10.25.0):
     - FirebaseAppCheckInterop (~> 10.17)
@@ -153,6 +169,7 @@ DEPENDENCIES:
   - desktop_webview_auth (from `.symlinks/plugins/desktop_webview_auth/ios`)
   - device_info_plus (from `.symlinks/plugins/device_info_plus/ios`)
   - file_picker (from `.symlinks/plugins/file_picker/ios`)
+  - firebase_app_check (from `.symlinks/plugins/firebase_app_check/ios`)
   - firebase_auth (from `.symlinks/plugins/firebase_auth/ios`)
   - firebase_core (from `.symlinks/plugins/firebase_core/ios`)
   - firebase_crashlytics (from `.symlinks/plugins/firebase_crashlytics/ios`)
@@ -171,7 +188,9 @@ DEPENDENCIES:
 
 SPEC REPOS:
   trunk:
+    - AppCheckCore
     - Firebase
+    - FirebaseAppCheck
     - FirebaseAppCheckInterop
     - FirebaseAuth
     - FirebaseAuthInterop
@@ -199,6 +218,8 @@ EXTERNAL SOURCES:
     :path: ".symlinks/plugins/device_info_plus/ios"
   file_picker:
     :path: ".symlinks/plugins/file_picker/ios"
+  firebase_app_check:
+    :path: ".symlinks/plugins/firebase_app_check/ios"
   firebase_auth:
     :path: ".symlinks/plugins/firebase_auth/ios"
   firebase_core:
@@ -231,15 +252,18 @@ EXTERNAL SOURCES:
     :path: ".symlinks/plugins/wakelock/ios"
 
 SPEC CHECKSUMS:
+  AppCheckCore: db04d539b37794558391bc56bc65e2440b01a195
   desktop_webview_auth: d645139460ef203d50bd0cdb33356785dd939cce
   device_info_plus: 97af1d7e84681a90d0693e63169a5d50e0839a0d
   file_picker: 684373a825f14becb5556cf6c5b88610290914b2
   Firebase: 0312a2352584f782ea56f66d91606891d4607f06
+  firebase_app_check: b67baa1ab3942b51fde8855f614f543d9d6b4dba
   firebase_auth: 76ea642e91a9e914b3af751a416046ce1a965cf4
-  firebase_core: 0b39f4f424e02eecabb2356ddf331fa07b772af8
+  firebase_core: 22e117a2e0dec3cb318c8f53f2dd01c140375617
   firebase_crashlytics: 5adb9a5ac7858811cef7a9447a011bb4dcb540c3
   firebase_dynamic_links: c4713196b078b72fe8ca825433eb7fbebc009dd9
   firebase_storage: e8b44d3f47e35f60dde2a119da11dc6e8962bef3
+  FirebaseAppCheck: 148fa858b8070710c8f83d3f545b5f1e85d104a4
   FirebaseAppCheckInterop: 5da5ce93e8797a215e3f677fb0654b74e736c8b8
   FirebaseAuth: c0f93dcc570c9da2bffb576969d793e95c344fbb
   FirebaseAuthInterop: 2753ef68cb3cd5aefebe0f58082671cede78350f
@@ -270,6 +294,6 @@ SPEC CHECKSUMS:
   url_launcher_ios: 5334b05cef931de560670eeae103fd3e431ac3fe
   wakelock: d0fc7c864128eac40eba1617cb5264d9c940b46f
 
-PODFILE CHECKSUM: 7efefa9b0888bed7351e3ede8a076c7bd0e778fa
+PODFILE CHECKSUM: 18d7eaa7268917aa5a2b60c97965d26617ab88fd
 
 COCOAPODS: 1.15.2
diff --git a/flutter/ios/Runner/Runner.entitlements b/flutter/ios/Runner/Runner.entitlements
@@ -4,6 +4,8 @@
 <dict>
 	<key>aps-environment</key>
 	<string>development</string>
+	<key>com.apple.developer.devicecheck.appattest-environment</key>
+	<string>production</string>
 	<key>com.apple.security.app-sandbox</key>
 	<true/>
 </dict>

diff --git a/flutter/lib/firebase/firebase_manager.dart b/flutter/lib/firebase/firebase_manager.dart
@@ -1,5 +1,8 @@
 import 'dart:convert';
 
+import 'package:flutter/foundation.dart';
+
+import 'package:firebase_app_check/firebase_app_check.dart';
 import 'package:firebase_core/firebase_core.dart';
 import 'package:firebase_storage/firebase_storage.dart';
 import 'package:firebase_ui_auth/firebase_ui_auth.dart';
@@ -34,14 +37,32 @@ class FirebaseManager {
     }
     final currentPlatform = DefaultFirebaseOptions.currentPlatform;
     final app = await Firebase.initializeApp(options: currentPlatform);
-    print('Firebase initialized using projectId: ${app.options.projectId}');
-
+    // _initAppCheck() must run before any Firebase services,
+    // but after calling Firebase.initializeApp();
+    await _initAppCheck();
     await _initAuthentication();
     _initStorage();
     _isInitialized = true;
+    print('Firebase initialized using projectId: ${app.options.projectId}');
     return instance;
   }
 
+  Future<void> _initAppCheck() async {
+    if (kReleaseMode) {
+      await FirebaseAppCheck.instance.activate(
+        androidProvider: AndroidProvider.playIntegrity,
+        appleProvider: AppleProvider.deviceCheck,
+      );
+      print('Init Firebase App Check in release mode');
+    } else {
+      await FirebaseAppCheck.instance.activate(
+        androidProvider: AndroidProvider.debug,
+        appleProvider: AppleProvider.debug,
+      );
+      print('Init Firebase App Check in debug mode');
+    }
+  }
+
   Future<void> _initAuthentication() async {
     FirebaseUIAuth.configureProviders(FirebaseAuthService.providers);
     _authService.firebaseAuth = FirebaseAuth.instance;

diff --git a/flutter/pubspec.lock b/flutter/pubspec.lock
@@ -13,10 +13,10 @@ packages:
     dependency: transitive
     description:
       name: _flutterfire_internals
-      sha256: "2350805d7afefb0efe7acd325cb19d3ae8ba4039b906eade3807ffb69938a01f"
+      sha256: e4be6711f96d3d4eebe79728897d645b7a5585bbfdd6d534878d202c171266d7
       url: "https://pub.dev"
     source: hosted
-    version: "1.3.33"
+    version: "1.3.34"
   analyzer:
     dependency: transitive
     description:
@@ -305,6 +305,30 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "8.0.3"
+  firebase_app_check:
+    dependency: "direct main"
+    description:
+      name: firebase_app_check
+      sha256: ea050dc4abccb6c46610c9a8cc0e72eabcf5ade8e84f5d580d988e5ad2e3ddbc
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.2.2+6"
+  firebase_app_check_platform_interface:
+    dependency: transitive
+    description:
+      name: firebase_app_check_platform_interface
+      sha256: b1ea7152bdf7907f2ba78b64aecdd48a3ae08cffef5dab1667414fd274e52f22
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.0+28"
+  firebase_app_check_web:
+    dependency: transitive
+    description:
+      name: firebase_app_check_web
+      sha256: "8bd316e66c2e4a7da00718eb96dc3b04d7b3122681a30ce6e5a1833c9d409a3a"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.2+6"
   firebase_auth:
     dependency: "direct main"
     description:
@@ -333,10 +357,10 @@ packages:
     dependency: "direct main"
     description:
       name: firebase_core
-      sha256: "372d94ced114b9c40cb85e18c50ac94a7e998c8eec630c50d7aec047847d27bf"
+      sha256: "4b5100e2dbc3fe72c2d4241a046d3f01457fe11293283a324f5c52575e3406f8"
       url: "https://pub.dev"
     source: hosted
-    version: "2.31.0"
+    version: "2.31.1"
   firebase_core_platform_interface:
     dependency: transitive
     description:

diff --git a/flutter/pubspec.yaml b/flutter/pubspec.yaml
@@ -52,7 +52,7 @@ dependencies:
   firebase_auth: ^4.19.5
   firebase_ui_auth: ^1.14.0
   firebase_crashlytics: ^3.5.5
-
+  firebase_app_check: ^0.2.2+6
 
 dev_dependencies:
   flutter_test: