feat(appcheck): Add support for minting limited use tokens

[lahirumaramba]

This PR adds support for the limitedUse parameter in the createToken() API of the App Check module. This allows users to generate tokens with replay protection, suitable for one-time use or session-based contexts.

RELEASE_NOTE: Added support for creating limited use App Check tokens in the createToken() API

[gemini-code-assist]

Summary of Changes

Hello @lahirumaramba, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the App Check module by enabling the creation of limited use tokens. This feature provides developers with the ability to generate tokens that offer replay protection, making them ideal for securing one-time operations or session-specific interactions within applications.

Highlights

• Feature Addition: Introduced support for the limitedUse parameter in the createToken() API of the App Check module.
• Replay Protection: This new parameter allows users to generate tokens with replay protection, suitable for one-time or session-based contexts.
• API Updates: The AppCheckTokenOptions interface was updated to include the limitedUse property, and internal API calls were modified to pass this option.
• Testing: New integration and unit tests have been added to ensure the correct functionality of limited use tokens.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces support for creating limited-use App Check tokens by adding a limitedUse parameter to the createToken() API. The changes are well-implemented across the API, client, and internal methods, and are accompanied by thorough unit and integration tests. My review includes one suggestion to enhance input validation for the new limitedUse parameter to improve robustness and provide clearer feedback to developers on invalid usage.

[gemini-code-assist]

For improved robustness and a better developer experience, it would be beneficial to add input validation for the limitedUse parameter. This ensures that if a value is provided, it must be a boolean. This is consistent with how other parameters like appId and customToken are validated within this method, and it provides clearer error messages to developers for invalid inputs.

You can add the following check at the beginning of the function body:

if (typeof limitedUse !== 'undefined' && !validator.isBoolean(limitedUse)) {
  throw new FirebaseAppCheckError(
    'invalid-argument',
    '`limitedUse` must be a boolean value.');
}