Feat/appcheck debugtoken cli by AustinBenoit · Pull Request #10801 · firebase/firebase-tools

AustinBenoit · 2026-07-15T21:11:27Z

Description

Adding to the Firebase CLI App Check debug token workflows under the unified appcheck:debugtokens namespace, aligning directly with the backend REST API (projects.apps.debugTokens).

Key changes:

Added appcheck:debugtokens:create for both interactive wizard registration and headless/non-interactive script execution in CI/CD automation pipelines.
Implemented appcheck:debugtokens:list to render registered tokens in tabular format (Display Name, Resource Name, Update Time) with full backend pagination.
Implemented appcheck:debugtokens:delete to permanently revoke tokens by ID or resource path, supporting interactive confirmation and --force flag overrides.

Scenarios Tested

Interactive Wizard (appcheck:debugtokens:create): Tested running without --app to verify automatic app detection and interactive choice selection.
Explicit Arguments (appcheck:debugtokens:create [debugToken] --app <appId>): Tested supplying --app and debugToken to confirm prompt skipping.
Display Name Collisions: Verified interactive confirmation prompt asking whether to overwrite when a token with the same display name already exists.
Headless Creation (appcheck:debugtokens:create --non-interactive): Verified execution with global --non-interactive flag using fallback defaults without blocking prompts, and correctly enforcing --force for display name collision overwrites.
Token Listing (appcheck:debugtokens:list --app <appId>): Verified table rendering of returned tokens and multi-page pagination handling.
Token Revocation (appcheck:debugtokens:delete <debugTokenId> --app <appId>): Tested interactive deletion confirmation as well as non-interactive --force deletion.
Build & Test Suite: Ran npm run build and npx mocha src/appcheck/index.spec.ts & src/commands/appcheck-debugtokens-create.spec.ts (12/12 unit tests passing).

Sample Commands

Interactive wizard: Register a token copied from SDK logs

firebase appcheck:debugtokens:create e3d9b1a0-cf48-4389-8d19-482a177ffec8 --app 1:1234567890:ios:0a1b2c3d4e5f6a7b8c9d0e

Interactive wizard: Auto-detect project & prompt for app selection

firebase appcheck:debugtokens:create

Non-interactive creation for CI/CD pipelines

firebase appcheck:debugtokens:create e3d9b1a0-cf48-4389-8d19-482a177ffec8 --app 1:1234567890:ios:0a1b2c3d4e5f6a7b8c9d0e --display-name "CI Runner Token" --non-interactive

List registered tokens for an app

firebase appcheck:debugtokens:list --app 1:1234567890:ios:0a1b2c3d4e5f6a7b8c9d0e

Delete / revoke a token by ID

firebase appcheck:debugtokens:delete 7890-abcd --app 1:1234567890:ios:0a1b2c3d4e5f6a7b8c9d0e --force

gemini-code-assist

Code Review

This pull request introduces Firebase App Check debug token management commands (appcheck:debugtoken, appcheck:debugtoken:create, appcheck:debugtoken:list, and appcheck:debugtoken:delete) along with their corresponding API client methods, CLI command registrations, and unit tests. Feedback focuses on improving robustness and error handling: safely accessing res.body properties via optional chaining in listDebugTokens to prevent potential TypeErrors; explicitly handling non-interactive mode when prompting for a display name in the creation command; failing early in non-interactive mode if --force is omitted during deletion; validating that full resource names belong to the specified app and project; and aborting with a FirebaseError if a user declines to overwrite an existing token with the same display name.

codecov-commenter · 2026-07-16T17:18:34Z

Codecov Report

❌ Patch coverage is 71.25000% with 46 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@b34f512). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
src/commands/appcheck-debugtokens-create.ts	64.00%	12 Missing and 6 partials ⚠️
src/appcheck/prompts.ts	39.28%	16 Missing and 1 partial ⚠️
src/commands/appcheck-debugtokens-delete.ts	78.57%	4 Missing and 2 partials ⚠️
src/commands/appcheck-debugtokens-list.ts	83.33%	2 Missing and 2 partials ⚠️
src/appcheck/api.ts	95.65%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #10801   +/-   ##
=======================================
  Coverage        ?   58.53%           
=======================================
  Files           ?      621           
  Lines           ?    40618           
  Branches        ?     8240           
=======================================
  Hits            ?    23776           
  Misses          ?    14856           
  Partials        ?     1986

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

andrewheard

LGTM. I'd recommend replacing the any with a type like in create and cleaning up get / update if we don't need them but no big concerns on my end.

joehan

Left some comments, but also:

Please move this to a branch on the main repo - go/firebase-github-access will get you access if needed. That will allow the tests to run automatically for you.
Please add a changelog entry - users need to know about this change!

AustinBenoit · 2026-07-24T20:34:02Z

Left some comments, but also:

Please move this to a branch on the main repo - go/firebase-github-access will get you access if needed. That will allow the tests to run automatically for you.

Please add a changelog entry - users need to know about this change!

I have requested access and will update the change log.

Introduces CLI support for managing Firebase App Check debug tokens via the App Check REST API (`projects.apps.debugTokens`). Key changes: * api: Added `appCheckOrigin` to `src/api.ts` (`https://firebaseappcheck.googleapis.com`). * appcheck: Created the `src/appcheck/index.ts` API client supporting `create`, `list`, `get`, `update`, and `delete` operations, along with comprehensive unit tests in `index.spec.ts`. * commands: Added a suite of management commands under the `appcheck:debug-tokens` namespace: - `appcheck:debug-tokens:create <appId> [debugToken]`: Creates a debug token (with auto-generated UUIDv4 fallback and interactive display name prompting). - `appcheck:debug-tokens:list <appId>`: Lists all debug tokens for an app in a formatted table. - `appcheck:debug-tokens:get <appId> <debugTokenId>`: Fetches and displays metadata for a specific debug token. - `appcheck:debug-tokens:update <appId> <debugTokenId>`: Updates the display name of a debug token via `patch`. - `appcheck:debug-tokens:delete <appId> <debugTokenId>`: Revokes/deletes a debug token with interactive confirmation support. * commands: Registered the new commands in `src/commands/index.ts`. feat: Add App Check debug token commands

…rebase-debug-token and update .gitignore

…ication

…T layer

… CI runner

…ames in non-interactive mode

…ate.ts and remove old files

joehan

LGTM if this has alreayd been approved by API council - otherwise, lets stick it behind an experiement and remove the changelog entry

joehan · 2026-07-28T18:48:13Z

@@ -0,0 +1,3 @@
+export * from "./types";


Nit: No need to use an index file here. It's generally better to just have importing files pull in from the individual files, as it keeps our dependency graph a little bit cleaner (and avoids unnecessary improts

Cleaned up.

AustinBenoit · 2026-07-29T14:29:48Z

LGTM if this has alreayd been approved by API council - otherwise, lets stick it behind an experiement and remove the changelog entry

I have gotten the API council LGTM!

* feat: Add App Check debug token management commands Introduces CLI support for managing Firebase App Check debug tokens via the App Check REST API (`projects.apps.debugTokens`). Key changes: * api: Added `appCheckOrigin` to `src/api.ts` (`https://firebaseappcheck.googleapis.com`). * appcheck: Created the `src/appcheck/index.ts` API client supporting `create`, `list`, `get`, `update`, and `delete` operations, along with comprehensive unit tests in `index.spec.ts`. * commands: Added a suite of management commands under the `appcheck:debug-tokens` namespace: - `appcheck:debug-tokens:create <appId> [debugToken]`: Creates a debug token (with auto-generated UUIDv4 fallback and interactive display name prompting). - `appcheck:debug-tokens:list <appId>`: Lists all debug tokens for an app in a formatted table. - `appcheck:debug-tokens:get <appId> <debugTokenId>`: Fetches and displays metadata for a specific debug token. - `appcheck:debug-tokens:update <appId> <debugTokenId>`: Updates the display name of a debug token via `patch`. - `appcheck:debug-tokens:delete <appId> <debugTokenId>`: Revokes/deletes a debug token with interactive confirmation support. * commands: Registered the new commands in `src/commands/index.ts`. feat: Add App Check debug token commands * feat: Implement firebase appcheck:debug <appId> to generate local .firebase-debug-token and update .gitignore * feat: align appcheck:debugtoken CLI commands with REST backend specification * test: add command unit tests for appcheck:debugtoken CLI scenario suite * fix: address code review comments for appcheck:debugtoken CLI and REST layer * fix: resolve lint errors and formatting in appcheck commands and spec * fix: stub requireAuth in spec and enable auth on App Check Client for CI runner * fix: bypass command pre-action hooks in spec for CI test runner * Fix nock matching for Node 24 by using RegExp * Fix prettier formatting in tests * fix(appcheck): stub client directly to bypass Node 24 nock fetch bug * feat(appcheck): refactor cli command namespace and args * feat(appcheck): require --force to overwrite existing token display names in non-interactive mode * fix(lint): fix prettier formatting errors in appcheck-debugtokens-create.ts and remove old files * chore: remove old appcheck-debug files properly * Refactor: extract App Check prompt utils and remove stale endpoints --------- Co-authored-by: Andrew Heard <andrewheard@google.com>

gemini-code-assist Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread src/appcheck/index.ts Outdated

Comment thread src/commands/appcheck-debugtokens-create.ts

Comment thread src/commands/appcheck-debugtokens-delete.ts

Comment thread src/commands/appcheck-debugtokens-delete.ts

Comment thread src/commands/appcheck-debug.ts Outdated

AustinBenoit force-pushed the feat/appcheck-debugtoken-cli branch 3 times, most recently from 1804817 to f6b9b82 Compare July 15, 2026 22:21

AustinBenoit force-pushed the feat/appcheck-debugtoken-cli branch 2 times, most recently from ee6de4f to acd5428 Compare July 21, 2026 15:14

andrewheard approved these changes Jul 21, 2026

View reviewed changes

AustinBenoit force-pushed the feat/appcheck-debugtoken-cli branch 7 times, most recently from 727ff90 to 8fd9577 Compare July 24, 2026 18:57

joehan requested changes Jul 24, 2026

View reviewed changes

Comment thread src/commands/appcheck-debugtokens-utils.ts Outdated

Comment thread src/appcheck/prompts.ts

Comment thread src/commands/appcheck-debugtokens-utils.ts Outdated

Comment thread src/appcheck/index.ts

AustinBenoit force-pushed the feat/appcheck-debugtoken-cli branch 2 times, most recently from 48031bd to c203f4d Compare July 24, 2026 20:41

joehan reviewed Jul 24, 2026

View reviewed changes

Comment thread src/commands/appcheck-debugtokens-delete.ts

AustinBenoit force-pushed the feat/appcheck-debugtoken-cli branch 3 times, most recently from c203f4d to 6e6d3ac Compare July 26, 2026 13:37

andrewheard and others added 7 commits July 27, 2026 14:38

feat: Implement firebase appcheck:debug <appId> to generate local .fi…

82b99ec

…rebase-debug-token and update .gitignore

feat: align appcheck:debugtoken CLI commands with REST backend specif…

e4b0c85

…ication

test: add command unit tests for appcheck:debugtoken CLI scenario suite

af4791c

fix: address code review comments for appcheck:debugtoken CLI and RES…

2923b69

…T layer

fix: resolve lint errors and formatting in appcheck commands and spec

16f5b66

fix: stub requireAuth in spec and enable auth on App Check Client for…

32bf9cc

… CI runner

AustinBenoit added 8 commits July 27, 2026 14:38

fix: bypass command pre-action hooks in spec for CI test runner

e703b3c

Fix nock matching for Node 24 by using RegExp

687fa9d

Fix prettier formatting in tests

12e511a

fix(appcheck): stub client directly to bypass Node 24 nock fetch bug

c0f6c2c

feat(appcheck): refactor cli command namespace and args

759221c

feat(appcheck): require --force to overwrite existing token display n…

12a1f85

…ames in non-interactive mode

fix(lint): fix prettier formatting errors in appcheck-debugtokens-cre…

c424e61

…ate.ts and remove old files

chore: remove old appcheck-debug files properly

018b192

AustinBenoit force-pushed the feat/appcheck-debugtoken-cli branch from 6e6d3ac to 06960f6 Compare July 27, 2026 18:39

AustinBenoit requested a review from joehan July 28, 2026 15:34

joehan approved these changes Jul 28, 2026

View reviewed changes

Refactor: extract App Check prompt utils and remove stale endpoints

32d71ad

AustinBenoit force-pushed the feat/appcheck-debugtoken-cli branch from c2e4e65 to 32d71ad Compare July 28, 2026 19:52

Merge branch 'main' into feat/appcheck-debugtoken-cli

a87f3ed

AustinBenoit enabled auto-merge (squash) July 29, 2026 14:29

AustinBenoit disabled auto-merge July 29, 2026 14:38

joehan merged commit 437c404 into firebase:main Jul 29, 2026
38 of 44 checks passed

marb2000 mentioned this pull request Aug 4, 2026

feat(appcheck): add appcheck:services commands for enforcement #10887

Merged

Uh oh!

Conversation

AustinBenoit commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Scenarios Tested

Sample Commands

Interactive wizard: Register a token copied from SDK logs

Interactive wizard: Auto-detect project & prompt for app selection

Non-interactive creation for CI/CD pipelines

List registered tokens for an app

Delete / revoke a token by ID

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov-commenter commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

andrewheard left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

joehan left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

AustinBenoit commented Jul 24, 2026

Uh oh!

Uh oh!

joehan left a comment

Choose a reason for hiding this comment

Uh oh!

joehan Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

AustinBenoit Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

AustinBenoit commented Jul 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

AustinBenoit commented Jul 15, 2026 •

edited

Loading

codecov-commenter commented Jul 16, 2026 •

edited

Loading