@firebase/app-check 0.5.1 → 0.5.2

package/dist/index.cjs.js

@@ -78,7 +78,11 @@ var TOKEN_REFRESH_TIME = {
      * This is the maximum retrial wait, currently 16 minutes.
      */
     RETRIAL_MAX_WAIT: 16 * 60 * 1000
-};
+};
+/**
+ * One day in millis, for certain error code backoffs.
+ */
+var ONE_DAY = 24 * 60 * 60 * 1000;
 
 /**
  * @license
@@ -242,6 +246,7 @@ var ERRORS = (_a = {},
     _a["storage-get" /* STORAGE_GET */] = 'Error thrown when reading from storage. Original error: {$originalErrorMessage}.',
     _a["storage-set" /* STORAGE_WRITE */] = 'Error thrown when writing to storage. Original error: {$originalErrorMessage}.',
     _a["recaptcha-error" /* RECAPTCHA_ERROR */] = 'ReCAPTCHA error.',
+    _a["throttled" /* THROTTLED */] = "Requests throttled due to {$httpStatus} error. Attempts allowed again after {$time}",
     _a);
 var ERROR_FACTORY = new util.ErrorFactory('appCheck', 'AppCheck', ERRORS);
 
@@ -284,6 +289,28 @@ function uuidv4() {
         var r = (Math.random() * 16) | 0, v = c === 'x' ? r : (r & 0x3) | 0x8;
         return v.toString(16);
     });
+}
+function getDurationString(durationInMillis) {
+    var totalSeconds = Math.round(durationInMillis / 1000);
+    var days = Math.floor(totalSeconds / (3600 * 24));
+    var hours = Math.floor((totalSeconds - days * 3600 * 24) / 3600);
+    var minutes = Math.floor((totalSeconds - days * 3600 * 24 - hours * 3600) / 60);
+    var seconds = totalSeconds - days * 3600 * 24 - hours * 3600 - minutes * 60;
+    var result = '';
+    if (days) {
+        result += pad(days) + 'd:';
+    }
+    if (hours) {
+        result += pad(hours) + 'h:';
+    }
+    result += pad(minutes) + 'm:' + pad(seconds) + 's';
+    return result;
+}
+function pad(value) {
+    if (value === 0) {
+        return '00';
+    }
+    return value >= 10 ? value.toString() : '0' + value;
 }
 
 /**
@@ -744,9 +771,9 @@ function formatDummyToken(tokenErrorData) {
 function getToken$2(appCheck, forceRefresh) {
     if (forceRefresh === void 0) { forceRefresh = false; }
     return tslib.__awaiter(this, void 0, void 0, function () {
-        var app, state, token, error, cachedToken, tokenFromDebugExchange, _a, _b, _c, e_1, interopTokenResult;
-        return tslib.__generator(this, function (_d) {
-            switch (_d.label) {
+        var app, state, token, error, cachedToken, shouldCallListeners, _a, _b, _c, _d, tokenFromDebugExchange, e_1, interopTokenResult;
+        return tslib.__generator(this, function (_e) {
+            switch (_e.label) {
                 case 0:
                     app = appCheck.app;
                     ensureActivated(app);
@@ -756,14 +783,11 @@ function getToken$2(appCheck, forceRefresh) {
                     if (!!token) return [3 /*break*/, 2];
                     return [4 /*yield*/, state.cachedTokenPromise];
                 case 1:
-                    cachedToken = _d.sent();
+                    cachedToken = _e.sent();
                     if (cachedToken && isValid(cachedToken)) {
                         token = cachedToken;
-                        setState(app, tslib.__assign(tslib.__assign({}, state), { token: token }));
-                        // notify all listeners with the cached token
-                        notifyTokenListeners(app, { token: token.token });
                     }
-                    _d.label = 2;
+                    _e.label = 2;
                 case 2:
                     // Return the cached token (from either memory or indexedDB) if it's valid
                     if (!forceRefresh && token && isValid(token)) {
@@ -771,44 +795,69 @@ function getToken$2(appCheck, forceRefresh) {
                                 token: token.token
                             }];
                     }
-                    if (!isDebugMode()) return [3 /*break*/, 6];
-                    _a = exchangeToken;
-                    _b = getExchangeDebugTokenRequest;
-                    _c = [app];
+                    shouldCallListeners = false;
+                    if (!isDebugMode()) return [3 /*break*/, 7];
+                    if (!!state.exchangeTokenPromise) return [3 /*break*/, 4];
+                    _a = state;
+                    _b = exchangeToken;
+                    _c = getExchangeDebugTokenRequest;
+                    _d = [app];
                     return [4 /*yield*/, getDebugToken()];
-                case 3: return [4 /*yield*/, _a.apply(void 0, [_b.apply(void 0, _c.concat([_d.sent()])), appCheck.platformLoggerProvider])];
-                case 4:
-                    tokenFromDebugExchange = _d.sent();
+                case 3:
+                    _a.exchangeTokenPromise = _b.apply(void 0, [_c.apply(void 0, _d.concat([_e.sent()])), appCheck.platformLoggerProvider]).then(function (token) {
+                        state.exchangeTokenPromise = undefined;
+                        return token;
+                    });
+                    shouldCallListeners = true;
+                    _e.label = 4;
+                case 4: return [4 /*yield*/, state.exchangeTokenPromise];
+                case 5:
+                    tokenFromDebugExchange = _e.sent();
                     // Write debug token to indexedDB.
                     return [4 /*yield*/, writeTokenToStorage(app, tokenFromDebugExchange)];
-                case 5:
+                case 6:
                     // Write debug token to indexedDB.
-                    _d.sent();
+                    _e.sent();
                     // Write debug token to state.
                     setState(app, tslib.__assign(tslib.__assign({}, state), { token: tokenFromDebugExchange }));
                     return [2 /*return*/, { token: tokenFromDebugExchange.token }];
-                case 6:
-                    _d.trys.push([6, 8, , 9]);
-                    return [4 /*yield*/, state.provider.getToken()];
                 case 7:
-                    // state.provider is populated in initializeAppCheck()
-                    // ensureActivated() at the top of this function checks that
-                    // initializeAppCheck() has been called.
-                    token = _d.sent();
-                    return [3 /*break*/, 9];
+                    _e.trys.push([7, 9, , 10]);
+                    // Avoid making another call to the exchange endpoint if one is in flight.
+                    if (!state.exchangeTokenPromise) {
+                        // state.provider is populated in initializeAppCheck()
+                        // ensureActivated() at the top of this function checks that
+                        // initializeAppCheck() has been called.
+                        state.exchangeTokenPromise = state.provider.getToken().then(function (token) {
+                            state.exchangeTokenPromise = undefined;
+                            return token;
+                        });
+                        shouldCallListeners = true;
+                    }
+                    return [4 /*yield*/, state.exchangeTokenPromise];
                 case 8:
-                    e_1 = _d.sent();
-                    // `getToken()` should never throw, but logging error text to console will aid debugging.
-                    logger.error(e_1);
-                    error = e_1;
-                    return [3 /*break*/, 9];
+                    token = _e.sent();
+                    return [3 /*break*/, 10];
                 case 9:
-                    if (!!token) return [3 /*break*/, 10];
+                    e_1 = _e.sent();
+                    if (e_1.code === "appCheck/" + "throttled" /* THROTTLED */) {
+                        // Warn if throttled, but do not treat it as an error.
+                        logger.warn(e_1.message);
+                    }
+                    else {
+                        // `getToken()` should never throw, but logging error text to console will aid debugging.
+                        logger.error(e_1);
+                    }
+                    // Always save error to be added to dummy token.
+                    error = e_1;
+                    return [3 /*break*/, 10];
+                case 10:
+                    if (!!token) return [3 /*break*/, 11];
                     // if token is undefined, there must be an error.
                     // we return a dummy token along with the error
                     interopTokenResult = makeDummyTokenResult(error);
-                    return [3 /*break*/, 12];
-                case 10:
+                    return [3 /*break*/, 13];
+                case 11:
                     interopTokenResult = {
                         token: token.token
                     };
@@ -816,11 +865,13 @@ function getToken$2(appCheck, forceRefresh) {
                     // Only do it if we got a valid new token
                     setState(app, tslib.__assign(tslib.__assign({}, state), { token: token }));
                     return [4 /*yield*/, writeTokenToStorage(app, token)];
-                case 11:
-                    _d.sent();
-                    _d.label = 12;
                 case 12:
-                    notifyTokenListeners(app, interopTokenResult);
+                    _e.sent();
+                    _e.label = 13;
+                case 13:
+                    if (shouldCallListeners) {
+                        notifyTokenListeners(app, interopTokenResult);
+                    }
                     return [2 /*return*/, interopTokenResult];
             }
         });
@@ -834,44 +885,31 @@ function addTokenListener(appCheck, type, listener, onError) {
         error: onError,
         type: type
     };
-    var newState = tslib.__assign(tslib.__assign({}, state), { tokenObservers: tslib.__spreadArray(tslib.__spreadArray([], state.tokenObservers), [tokenObserver]) });
-    /**
-     * Invoke the listener with the valid token, then start the token refresher
-     */
-    if (!newState.tokenRefresher) {
-        var tokenRefresher = createTokenRefresher(appCheck);
-        newState.tokenRefresher = tokenRefresher;
-    }
-    // Create the refresher but don't start it if `isTokenAutoRefreshEnabled`
-    // is not true.
-    if (!newState.tokenRefresher.isRunning() && state.isTokenAutoRefreshEnabled) {
-        newState.tokenRefresher.start();
-    }
+    setState(app, tslib.__assign(tslib.__assign({}, state), { tokenObservers: tslib.__spreadArray(tslib.__spreadArray([], state.tokenObservers), [tokenObserver]) }));
     // Invoke the listener async immediately if there is a valid token
     // in memory.
     if (state.token && isValid(state.token)) {
         var validToken_1 = state.token;
         Promise.resolve()
-            .then(function () { return listener({ token: validToken_1.token }); })
-            .catch(function () {
-            /* we don't care about exceptions thrown in listeners */
-        });
-    }
-    else if (state.token == null) {
-        // Only check cache if there was no token. If the token was invalid,
-        // skip this and rely on exchange endpoint.
-        void state
-            .cachedTokenPromise // Storage token promise. Always populated in `activate()`.
-            .then(function (cachedToken) {
-            if (cachedToken && isValid(cachedToken)) {
-                listener({ token: cachedToken.token });
-            }
+            .then(function () {
+            listener({ token: validToken_1.token });
+            initTokenRefresher(appCheck);
         })
             .catch(function () {
-            /** Ignore errors in listeners. */
+            /* we don't care about exceptions thrown in listeners */
         });
     }
-    setState(app, newState);
+    /**
+     * Wait for any cached token promise to resolve before starting the token
+     * refresher. The refresher checks to see if there is an existing token
+     * in state and calls the exchange endpoint if not. We should first let the
+     * IndexedDB check have a chance to populate state if it can.
+     *
+     * Listener call isn't needed here because cachedTokenPromise will call any
+     * listeners that exist when it resolves.
+     */
+    // state.cachedTokenPromise is always populated in `activate()`.
+    void state.cachedTokenPromise.then(function () { return initTokenRefresher(appCheck); });
 }
 function removeTokenListener(app, listener) {
     var state = getState(app);
@@ -883,6 +921,23 @@ function removeTokenListener(app, listener) {
     }
     setState(app, tslib.__assign(tslib.__assign({}, state), { tokenObservers: newObservers }));
 }
+/**
+ * Logic to create and start refresher as needed.
+ */
+function initTokenRefresher(appCheck) {
+    var app = appCheck.app;
+    var state = getState(app);
+    // Create the refresher but don't start it if `isTokenAutoRefreshEnabled`
+    // is not true.
+    var refresher = state.tokenRefresher;
+    if (!refresher) {
+        refresher = createTokenRefresher(appCheck);
+        setState(app, tslib.__assign(tslib.__assign({}, state), { tokenRefresher: refresher }));
+    }
+    if (!refresher.isRunning() && state.isTokenAutoRefreshEnabled) {
+        refresher.start();
+    }
+}
 function createTokenRefresher(appCheck) {
     var _this = this;
     var app = appCheck.app;
@@ -913,7 +968,6 @@ function createTokenRefresher(appCheck) {
             }
         });
     }); }, function () {
-        // TODO: when should we retry?
         return true;
     }, function () {
         var state = getState(app);
@@ -1014,7 +1068,7 @@ function internalFactory(appCheck) {
 }
 
 var name = "@firebase/app-check";
-var version = "0.5.1";
+var version = "0.5.2";
 
 /**
  * @license
@@ -1181,23 +1235,53 @@ var ReCaptchaV3Provider = /** @class */ (function () {
      */
     function ReCaptchaV3Provider(_siteKey) {
         this._siteKey = _siteKey;
+        /**
+         * Throttle requests on certain error codes to prevent too many retries
+         * in a short time.
+         */
+        this._throttleData = null;
     }
     /**
      * Returns an App Check token.
      * @internal
      */
     ReCaptchaV3Provider.prototype.getToken = function () {
+        var _a;
         return tslib.__awaiter(this, void 0, void 0, function () {
-            var attestedClaimsToken;
-            return tslib.__generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, getToken$1(this._app).catch(function (_e) {
-                            // reCaptcha.execute() throws null which is not very descriptive.
-                            throw ERROR_FACTORY.create("recaptcha-error" /* RECAPTCHA_ERROR */);
-                        })];
+            var attestedClaimsToken, result, e_1;
+            return tslib.__generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        throwIfThrottled(this._throttleData);
+                        return [4 /*yield*/, getToken$1(this._app).catch(function (_e) {
+                                // reCaptcha.execute() throws null which is not very descriptive.
+                                throw ERROR_FACTORY.create("recaptcha-error" /* RECAPTCHA_ERROR */);
+                            })];
                     case 1:
-                        attestedClaimsToken = _a.sent();
-                        return [2 /*return*/, exchangeToken(getExchangeRecaptchaV3TokenRequest(this._app, attestedClaimsToken), this._platformLoggerProvider)];
+                        attestedClaimsToken = _b.sent();
+                        _b.label = 2;
+                    case 2:
+                        _b.trys.push([2, 4, , 5]);
+                        return [4 /*yield*/, exchangeToken(getExchangeRecaptchaV3TokenRequest(this._app, attestedClaimsToken), this._platformLoggerProvider)];
+                    case 3:
+                        result = _b.sent();
+                        return [3 /*break*/, 5];
+                    case 4:
+                        e_1 = _b.sent();
+                        if (e_1.code === "fetch-status-error" /* FETCH_STATUS_ERROR */) {
+                            this._throttleData = setBackoff(Number((_a = e_1.customData) === null || _a === void 0 ? void 0 : _a.httpStatus), this._throttleData);
+                            throw ERROR_FACTORY.create("throttled" /* THROTTLED */, {
+                                time: getDurationString(this._throttleData.allowRequestsAfter - Date.now()),
+                                httpStatus: this._throttleData.httpStatus
+                            });
+                        }
+                        else {
+                            throw e_1;
+                        }
+                    case 5:
+                        // If successful, clear throttle data.
+                        this._throttleData = null;
+                        return [2 /*return*/, result];
                 }
             });
         });
@@ -1238,23 +1322,53 @@ var ReCaptchaEnterpriseProvider = /** @class */ (function () {
      */
     function ReCaptchaEnterpriseProvider(_siteKey) {
         this._siteKey = _siteKey;
+        /**
+         * Throttle requests on certain error codes to prevent too many retries
+         * in a short time.
+         */
+        this._throttleData = null;
     }
     /**
      * Returns an App Check token.
      * @internal
      */
     ReCaptchaEnterpriseProvider.prototype.getToken = function () {
+        var _a;
         return tslib.__awaiter(this, void 0, void 0, function () {
-            var attestedClaimsToken;
-            return tslib.__generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, getToken$1(this._app).catch(function (_e) {
-                            // reCaptcha.execute() throws null which is not very descriptive.
-                            throw ERROR_FACTORY.create("recaptcha-error" /* RECAPTCHA_ERROR */);
-                        })];
+            var attestedClaimsToken, result, e_2;
+            return tslib.__generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        throwIfThrottled(this._throttleData);
+                        return [4 /*yield*/, getToken$1(this._app).catch(function (_e) {
+                                // reCaptcha.execute() throws null which is not very descriptive.
+                                throw ERROR_FACTORY.create("recaptcha-error" /* RECAPTCHA_ERROR */);
+                            })];
                     case 1:
-                        attestedClaimsToken = _a.sent();
-                        return [2 /*return*/, exchangeToken(getExchangeRecaptchaEnterpriseTokenRequest(this._app, attestedClaimsToken), this._platformLoggerProvider)];
+                        attestedClaimsToken = _b.sent();
+                        _b.label = 2;
+                    case 2:
+                        _b.trys.push([2, 4, , 5]);
+                        return [4 /*yield*/, exchangeToken(getExchangeRecaptchaEnterpriseTokenRequest(this._app, attestedClaimsToken), this._platformLoggerProvider)];
+                    case 3:
+                        result = _b.sent();
+                        return [3 /*break*/, 5];
+                    case 4:
+                        e_2 = _b.sent();
+                        if (e_2.code === "fetch-status-error" /* FETCH_STATUS_ERROR */) {
+                            this._throttleData = setBackoff(Number((_a = e_2.customData) === null || _a === void 0 ? void 0 : _a.httpStatus), this._throttleData);
+                            throw ERROR_FACTORY.create("throttled" /* THROTTLED */, {
+                                time: getDurationString(this._throttleData.allowRequestsAfter - Date.now()),
+                                httpStatus: this._throttleData.httpStatus
+                            });
+                        }
+                        else {
+                            throw e_2;
+                        }
+                    case 5:
+                        // If successful, clear throttle data.
+                        this._throttleData = null;
+                        return [2 /*return*/, result];
                 }
             });
         });
@@ -1331,7 +1445,58 @@ var CustomProvider = /** @class */ (function () {
         }
     };
     return CustomProvider;
-}());
+}());
+/**
+ * Set throttle data to block requests until after a certain time
+ * depending on the failed request's status code.
+ * @param httpStatus - Status code of failed request.
+ * @param throttleData - `ThrottleData` object containing previous throttle
+ * data state.
+ * @returns Data about current throttle state and expiration time.
+ */
+function setBackoff(httpStatus, throttleData) {
+    /**
+     * Block retries for 1 day for the following error codes:
+     *
+     * 404: Likely malformed URL.
+     *
+     * 403:
+     * - Attestation failed
+     * - Wrong API key
+     * - Project deleted
+     */
+    if (httpStatus === 404 || httpStatus === 403) {
+        return {
+            backoffCount: 1,
+            allowRequestsAfter: Date.now() + ONE_DAY,
+            httpStatus: httpStatus
+        };
+    }
+    else {
+        /**
+         * For all other error codes, the time when it is ok to retry again
+         * is based on exponential backoff.
+         */
+        var backoffCount = throttleData ? throttleData.backoffCount : 0;
+        var backoffMillis = util.calculateBackoffMillis(backoffCount, 1000, 2);
+        return {
+            backoffCount: backoffCount + 1,
+            allowRequestsAfter: Date.now() + backoffMillis,
+            httpStatus: httpStatus
+        };
+    }
+}
+function throwIfThrottled(throttleData) {
+    if (throttleData) {
+        if (Date.now() - throttleData.allowRequestsAfter <= 0) {
+            // If before, throw.
+            throw ERROR_FACTORY.create("throttled" /* THROTTLED */, {
+                time: getDurationString(throttleData.allowRequestsAfter - Date.now()),
+                httpStatus: throttleData.httpStatus
+            });
+        }
+    }
+}
 
 /**
  * @license
@@ -1388,6 +1553,17 @@ function initializeAppCheck(app$1, options) {
     }
     var appCheck = provider.initialize({ options: options });
     _activate(app$1, options.provider, options.isTokenAutoRefreshEnabled);
+    // If isTokenAutoRefreshEnabled is false, do not send any requests to the
+    // exchange endpoint without an explicit call from the user either directly
+    // or through another Firebase library (storage, functions, etc.)
+    if (getState(app$1).isTokenAutoRefreshEnabled) {
+        // Adding a listener will start the refresher and fetch a token if needed.
+        // This gets a token ready and prevents a delay when an internal library
+        // requests the token.
+        // Listener function does not need to do anything, its base functionality
+        // of calling getToken() already fetches token and writes it to memory/storage.
+        addTokenListener(appCheck, "INTERNAL" /* INTERNAL */, function () { });
+    }
     return appCheck;
 }
 /**
@@ -1407,6 +1583,8 @@ function _activate(app, provider, isTokenAutoRefreshEnabled) {
     newState.cachedTokenPromise = readTokenFromStorage(app).then(function (cachedToken) {
         if (cachedToken && isValid(cachedToken)) {
             setState(app, tslib.__assign(tslib.__assign({}, getState(app)), { token: cachedToken }));
+            // notify all listeners with the cached token
+            notifyTokenListeners(app, { token: cachedToken.token });
         }
         return cachedToken;
     });