Feat: add in limited use tokens by AustinBenoit · Pull Request #1385 · firebase/firebase-unity-sdk

AustinBenoit · 2026-01-30T21:40:22Z

Description

Provide details of the change, and generalize the change in the PR title above.

Feat: add in limited use tokens

This changes the current interface implementation IAppCheckProvider to have both a

Testing

Describe how you've tested these changes.

I have the new limited use token locally

Android:

iOS:

Desktop:

Along with running the integration tests
[replace this line]: # (Describe your testing in detail.)

Type of Change

Place an x the applicable box:

Bug fix. Add the issue # below if applicable.
New feature. A non-breaking change which adds functionality.
Other, such as a build process or documentation change.

gemini-code-assist · 2026-01-30T21:40:45Z

Summary of Changes

Hello @AustinBenoit, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces comprehensive support for limited-use tokens within the Firebase App Check system. It expands the public API for developers to request these specialized tokens, updates the core provider interface to accommodate this new token type, and establishes the necessary communication infrastructure between the C# and C++ components. The changes also include user interface elements and automated tests to ensure the proper functioning and integration of this new feature.

Highlights

Limited Use Token API: Introduced a new public API method, GetLimitedUseAppCheckTokenAsync(), in FirebaseAppCheck.cs for requesting limited-use tokens, specifically for non-Firebase backends protected with Replay Protection.
Provider Interface Extension: The IAppCheckProvider interface has been extended with a new method, GetLimitedUseTokenAsync(), which includes a default implementation that calls the existing GetTokenAsync().
C# and C++ Interoperability: Implemented new C# delegates and C++ SWIG bindings to facilitate the fetching of limited-use tokens across the C# and C++ layers, mirroring the existing token fetching mechanism.
Testing and Sample App Updates: The sample application (UIHandler.cs) now includes a UI button to trigger the new limited-use token request, and automated tests (UIHandlerAutomated.cs) have been added to verify its functionality.
Build System Update: The cmake/project.template file was updated to change the ToolsVersion from 4.0 to 15.0, likely for build compatibility or feature support.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces support for limited-use App Check tokens, which is a valuable feature. The overall implementation is logical, but there are several areas with significant code duplication across both the C# and C++ (SWIG) files. I've provided detailed comments and code suggestions to refactor these sections by extracting common logic into helper methods. Addressing these points will improve the code's maintainability and reduce the chance of future bugs.

AustinBenoit · 2026-02-02T21:55:21Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces support for limited-use tokens in App Check, a valuable feature for non-Firebase backends. The changes are comprehensive, touching the public API, C# implementation, C++ interop layer, and tests.

My review focuses on improving maintainability. I've identified several instances of significant code duplication where new methods for limited-use tokens are nearly identical to their existing counterparts. Refactoring this duplicated logic into shared helper methods would make the code cleaner and easier to maintain. I've also suggested modernizing an asynchronous call to use async/await, which improves readability and error handling. Lastly, there's a minor comment inconsistency in one of the new tests.

Overall, the implementation is solid, and addressing these points will enhance the long-term quality of the codebase.

gemini-code-assist · 2026-02-02T21:57:10Z

+  public System.Threading.Tasks.Task<AppCheckToken>
+      GetLimitedUseAppCheckTokenAsync() {
+    ThrowIfNull();
+    return appCheckInternal.GetLimitedUseAppCheckTokenAsync().ContinueWith(task => {
+      if (task.IsFaulted) {
+        throw task.Exception;
+      }
+      AppCheckTokenInternal tokenInternal = task.Result;
+      return AppCheckToken.FromAppCheckTokenInternal(tokenInternal);
+    });


Using async/await simplifies asynchronous code, improves readability, and provides better exception handling compared to using ContinueWith. The await keyword automatically unwraps an AggregateException if it contains a single inner exception, making error handling more straightforward.

public async System.Threading.Tasks.Task<AppCheckToken> GetLimitedUseAppCheckTokenAsync() { ThrowIfNull(); AppCheckTokenInternal tokenInternal = await appCheckInternal.GetLimitedUseAppCheckTokenAsync(); return AppCheckToken.FromAppCheckTokenInternal(tokenInternal); }

Umm yeah I'll come back to this and clean both limiteduse and get token together.

gemini-code-assist · 2026-02-02T21:57:10Z

+  void GetLimitedUseToken(std::function<void(AppCheckToken, int, const std::string&)>
+                  completion_callback) override {
+    if (g_get_limited_use_token_from_csharp) {
+      // Save the callback in the map, and generate a key
+      int key;
+      {
+        MutexLock lock(g_pending_get_tokens_mutex);
+        key = g_pending_token_keys++;
+        g_pending_get_tokens[key] = completion_callback;
+      }
+      // Queue a call to the C# function that will generate the token.
+      firebase::callback::AddCallback(
+        new firebase::callback::CallbackValue1String1<int>(
+          key, app_->name(), CallGetLimitedUseTokenFromCSharp));
+    } else {
+      completion_callback({}, kAppCheckErrorInvalidConfiguration,
+        "Missing AppCheckProvider C# configuration");
+    }
+  }


The implementation of GetLimitedUseToken is almost identical to GetToken. To reduce code duplication, consider refactoring the common logic into a helper function. This helper could take the C# callback function pointer (e.g., g_get_token_from_csharp or g_get_limited_use_token_from_csharp) and the corresponding C++ wrapper function (e.g., CallGetTokenFromCSharp or CallGetLimitedUseTokenFromCSharp) as arguments.

I can't get default interface to work so I'll just make it its own interface

AustinBenoit added the tests-requested: quick Trigger a quick set of integration tests. label Jan 30, 2026

gemini-code-assist Bot reviewed Jan 30, 2026

View reviewed changes

gemini-code-assist Bot reviewed Feb 2, 2026

View reviewed changes

AustinBenoit force-pushed the limitedusetoken branch from 48096d8 to 862ea8d Compare February 2, 2026 21:57

AustinBenoit added tests-requested: quick Trigger a quick set of integration tests. and removed tests-requested: quick Trigger a quick set of integration tests. labels Feb 2, 2026

AustinBenoit requested a review from a-maurice February 2, 2026 22:30

a-maurice reviewed Feb 4, 2026

View reviewed changes

Comment thread app_check/src/FirebaseAppCheck.cs Outdated

a-maurice reviewed Feb 4, 2026

View reviewed changes

Comment thread app_check/src/swig/app_check.i Outdated

AustinBenoit added 6 commits February 6, 2026 10:23

Feat: add in limited use tokens

f484fd7

Change to have limited use in its own interface

a1f1d2b

I can't get default interface to work so I'll just make it its own interface

Make this a breaking change for the app check providers

015fd64

Update the release notes and final clean up

e6ab745

clean up spacing

2d660ee

Fix up and merge setting of token callback

ac7e120

AustinBenoit force-pushed the limitedusetoken branch from 7cac6ca to ac7e120 Compare February 6, 2026 15:24

a-maurice approved these changes Feb 17, 2026

View reviewed changes

AustinBenoit added 2 commits February 18, 2026 08:31

Merge branch 'main' into limitedusetoken

0e6fbae

Update readme.md

8e31095

AustinBenoit merged commit 96777b1 into main Feb 18, 2026
3 checks passed

AustinBenoit deleted the limitedusetoken branch February 18, 2026 16:37

firebase locked and limited conversation to collaborators Mar 20, 2026

Conversation

AustinBenoit commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Testing

Type of Change

Uh oh!

gemini-code-assist Bot commented Jan 30, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

AustinBenoit commented Feb 2, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

gemini-code-assist Bot Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

AustinBenoit Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gemini-code-assist Bot Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

AustinBenoit commented Jan 30, 2026 •

edited

Loading