Android: send Firebase App Check (Play Integrity) token to the proxy - #27
Draft
eman-cickusic wants to merge 1 commit into
Draft
Android: send Firebase App Check (Play Integrity) token to the proxy#27eman-cickusic wants to merge 1 commit into
eman-cickusic wants to merge 1 commit into
Conversation
Client half of the abuse-control workstream (backend is in the App Check PR). Attaches an X-Firebase-AppCheck header to /analyze and /chat so the backend can, once enforcement is enabled, verify requests come from the genuine app. - App.kt (Application) + network/llm/AppCheckTokenProvider.kt: install the Play Integrity provider and fetch tokens. Dormant until google-services.json exists (no default FirebaseApp -> currentToken() returns null -> no header), so this does not change behavior or break the build before Firebase is configured. - Firebase BoM + appcheck deps; Google Services plugin applied only when google-services.json is present. Manifest registers the Application. - Header added in both proxy workflows (no public API change; existing tests unaffected since the token is null without Firebase). NOTE: unbuilt in the authoring environment (Google Maven dl.google.com is not reachable here, so Firebase artifacts could not download). Needs a normal-network build + google-services.json before merge. Verified by review against the Firebase App Check API. See documentation/15-backend-abuse-controls.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft — blocked on Firebase/Play setup. Do not merge yet. Client half of the abuse-control workstream; pairs with the backend App Check PR (#26).
What it does
Attaches an
X-Firebase-AppCheckheader to/analyzeand/chatso the backend can verify requests come from the genuine app once enforcement is enabled.App.kt(Application) +network/llm/AppCheckTokenProvider.kt: install the Play Integrity provider and fetch tokens.google-services.jsonexists — no default FirebaseApp →currentToken()returns null → no header. So this does not change behavior or break the build before Firebase is configured.google-services.jsonis present. Manifest registers the Application.b2-ultra-processed, register appcom.b2.ultraprocessed, downloadgoogle-services.jsonintoapp/.:app:testDebugUnitTestpasses.APP_CHECK_ENABLED=true) only after this ships and has adoption.I could not compile this where it was written —
dl.google.com(Google's Maven) was unreachable, so the Firebase artifacts couldn't download. Code is reviewed against the Firebase App Check API but needs a real build. Firebase BoM pinned at33.7.0— bump if desired.Full plan:
documentation/15-backend-abuse-controls.md.🤖 Generated with Claude Code