openrtc-trust-firebase-app-check 2.0.0-rc.15

package/LICENSE

@@ -0,0 +1,3 @@
+Copyright (c) OpenRTC contributors. All rights reserved.
+
+Use is governed by the OpenRTC license distributed with this package.

package/README.md

@@ -0,0 +1,22 @@
+# openrtc-trust-firebase-app-check
+
+Optional Firebase App Check evidence for OpenRTC 2.0 device enrollment. The
+consumer app owns Firebase initialization and passes its `AppCheck` instance:
+
+```ts
+import { FirebaseAppCheckAttestationProvider } from 'openrtc-trust-firebase-app-check';
+
+const trust = new FirebaseAppCheckAttestationProvider({ appCheck });
+const rtc = OpenRTC({ apiKey, trust: { attestation: trust } });
+```
+
+The adapter uses normal reusable App Check tokens. It never requests
+limited-use tokens, coalesces concurrent fetches, and honors Firebase's returned
+expiry. Call `invalidate()` after a provider rejection if enrollment is retried
+outside the OpenRTC client.
+
+Firebase App Check proves application integrity for the reusable token session;
+it does not sign OpenRTC's enrollment challenge. OpenRTC records this adapter as
+`app-session` evidence and combines it with its independently challenge-bound
+install-key proof. Use the consumer-backend assertion path, Apple App Attest, or
+Play Integrity when a policy requires request-bound evidence.

package/dist/index.d.ts

@@ -0,0 +1,40 @@
+import { type AppCheck } from 'firebase/app-check';
+import type { OpenRTCAttestationProvider } from 'openrtc';
+export interface FirebaseAppCheckTokenResult {
+    token: string;
+    /** Some host wrappers expose this; the Web SDK token is otherwise decoded. */
+    expireTimeMillis?: number;
+}
+export interface FirebaseAppCheckAttestationProviderOptions {
+    appCheck: AppCheck;
+    /** Refresh this long before Firebase's returned expiry. Defaults to 60s. */
+    refreshSkewMs?: number;
+    /** Test/integration seam. Production callers should use Firebase's getToken. */
+    tokenFetcher?: (appCheck: AppCheck, forceRefresh: boolean) => Promise<FirebaseAppCheckTokenResult>;
+}
+/**
+ * Enrollment-only Firebase App Check adapter.
+ *
+ * This intentionally calls the reusable-token API (`getToken`) and never the
+ * limited-use/replay-protected API. OpenRTC binds enrollment to its own nonce
+ * and device-key proof, so five-minute limited-use polling adds cost without
+ * improving the gateway's connection security.
+ */
+export declare class FirebaseAppCheckAttestationProvider implements OpenRTCAttestationProvider {
+    private readonly options;
+    readonly kind: "firebase-app-check";
+    readonly evidenceBinding: "app-session";
+    private readonly refreshSkewMs;
+    private readonly tokenFetcher;
+    private cached;
+    private pending;
+    private forceRefresh;
+    constructor(options: FirebaseAppCheckAttestationProviderOptions);
+    invalidate(): void;
+    private current;
+    private fetch;
+    getEvidence(): Promise<{
+        token: string;
+    }>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAE1D,MAAM,WAAW,2BAA2B;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,0CAA0C;IACvD,QAAQ,EAAE,QAAQ,CAAC;IACnB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,KAAK,OAAO,CAAC,2BAA2B,CAAC,CAAC;CACtG;AAuBD;;;;;;;GAOG;AACH,qBAAa,mCAAoC,YAAW,0BAA0B;IAStE,OAAO,CAAC,QAAQ,CAAC,OAAO;IARpC,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;IAC9C,QAAQ,CAAC,eAAe,EAAG,aAAa,CAAU;IAClD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0E;IACvG,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,YAAY,CAAS;gBAEA,OAAO,EAAE,0CAA0C;IAKhF,UAAU,IAAI,IAAI;IAKlB,OAAO,CAAC,OAAO;IAOf,OAAO,CAAC,KAAK;IAsBP,WAAW,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAIlD"}

package/dist/index.js

@@ -0,0 +1,77 @@
+import { getToken } from 'firebase/app-check';
+function tokenExpiryMillis(result) {
+    if (Number.isFinite(result.expireTimeMillis))
+        return result.expireTimeMillis;
+    try {
+        const part = result.token.split('.')[1];
+        if (!part)
+            throw new Error('missing payload');
+        const base64 = part.replace(/-/g, '+').replace(/_/g, '/');
+        const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');
+        const claims = JSON.parse(atob(padded));
+        const expiresAtMs = Number(claims.exp) * 1000;
+        if (!Number.isFinite(expiresAtMs))
+            throw new Error('missing exp');
+        return expiresAtMs;
+    }
+    catch {
+        throw new Error('Firebase App Check returned a token without a valid expiry.');
+    }
+}
+/**
+ * Enrollment-only Firebase App Check adapter.
+ *
+ * This intentionally calls the reusable-token API (`getToken`) and never the
+ * limited-use/replay-protected API. OpenRTC binds enrollment to its own nonce
+ * and device-key proof, so five-minute limited-use polling adds cost without
+ * improving the gateway's connection security.
+ */
+export class FirebaseAppCheckAttestationProvider {
+    constructor(options) {
+        this.options = options;
+        this.kind = 'firebase-app-check';
+        this.evidenceBinding = 'app-session';
+        this.cached = null;
+        this.pending = null;
+        this.forceRefresh = false;
+        this.refreshSkewMs = Math.max(0, options.refreshSkewMs ?? 60000);
+        this.tokenFetcher = options.tokenFetcher ?? getToken;
+    }
+    invalidate() {
+        this.cached = null;
+        this.forceRefresh = true;
+    }
+    current() {
+        if (!this.cached || this.cached.expiresAtMs <= Date.now() + this.refreshSkewMs) {
+            return null;
+        }
+        return this.cached;
+    }
+    fetch() {
+        if (this.pending)
+            return this.pending;
+        const forceRefresh = this.forceRefresh;
+        this.forceRefresh = false;
+        this.pending = this.tokenFetcher(this.options.appCheck, forceRefresh)
+            .then((result) => {
+            if (!result.token) {
+                throw new Error('Firebase App Check returned an invalid token result.');
+            }
+            const cached = {
+                token: result.token,
+                expiresAtMs: tokenExpiryMillis(result),
+            };
+            this.cached = cached;
+            return cached;
+        })
+            .finally(() => {
+            this.pending = null;
+        });
+        return this.pending;
+    }
+    async getEvidence() {
+        const result = this.current() ?? await this.fetch();
+        return { token: result.token };
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAiB,MAAM,oBAAoB,CAAC;AAsB7D,SAAS,iBAAiB,CAAC,MAAmC;IAC1D,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAAE,OAAO,MAAM,CAAC,gBAA0B,CAAC;IACvF,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAsB,CAAC;QAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAK,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QAClE,OAAO,WAAW,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACnF,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,mCAAmC;IAS5C,YAA6B,OAAmD;QAAnD,YAAO,GAAP,OAAO,CAA4C;QARvE,SAAI,GAAG,oBAA6B,CAAC;QACrC,oBAAe,GAAG,aAAsB,CAAC;QAG1C,WAAM,GAAuB,IAAI,CAAC;QAClC,YAAO,GAAgC,IAAI,CAAC;QAC5C,iBAAY,GAAG,KAAK,CAAC;QAGzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,aAAa,IAAI,KAAM,CAAC,CAAC;QAClE,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,QAAQ,CAAC;IACzD,CAAC;IAED,UAAU;QACN,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC7B,CAAC;IAEO,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YAC7E,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC;IAEO,KAAK;QACT,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACvC,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC;aAChE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,MAAM,GAAG;gBACX,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC;aACzC,CAAC;YACF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACrB,OAAO,MAAM,CAAC;QAClB,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACV,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACxB,CAAC,CAAC,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,WAAW;QACb,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;CACJ"}

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "openrtc-trust-firebase-app-check",
+  "version": "2.0.0-rc.15",
+  "private": false,
+  "type": "module",
+  "sideEffects": false,
+  "description": "Optional Firebase App Check attestation adapter for OpenRTC 2.0 device enrollment.",
+  "license": "SEE LICENSE IN LICENSE",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": ["dist", "LICENSE", "README.md"],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc",
+    "test": "vitest run",
+    "test:deterministic": "vitest run",
+    "prepublishOnly": "pnpm run build && pnpm run test"
+  },
+  "peerDependencies": {
+    "firebase": "^9.0.0 || ^10.0.0 || ^11.0.0 || ^12.0.0",
+    "openrtc": "2.0.0-rc.15"
+  },
+  "devDependencies": {
+    "firebase": "^12.16.0",
+    "openrtc": "workspace:*",
+    "typescript": "^5.8.3",
+    "vitest": "^4.0.18"
+  }
+}