feat(appcheck): Add support for minting limited-use tokens and custom JTI

[lahirumaramba]

This PR adds support for the limitedUse and jti parameters in the createToken() API of the App Check module. This allows users to generate tokens with replay protection, suitable for one-time use or session-based contexts.

RELEASE_NOTE: Added support for creating limited use App Check tokens with custom jti in the createToken() API.

Internal: go/firebase-admin-node-limited-use-fac-tokens

[gemini-code-assist]

Summary of Changes

Hello @lahirumaramba, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the App Check module by enabling the creation of limited use tokens. This feature provides developers with the ability to generate tokens that offer replay protection, making them ideal for securing one-time operations or session-specific interactions within applications.

Highlights

• Feature Addition: Introduced support for the limitedUse parameter in the createToken() API of the App Check module.
• Replay Protection: This new parameter allows users to generate tokens with replay protection, suitable for one-time or session-based contexts.
• API Updates: The AppCheckTokenOptions interface was updated to include the limitedUse property, and internal API calls were modified to pass this option.
• Testing: New integration and unit tests have been added to ensure the correct functionality of limited use tokens.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces support for creating limited-use App Check tokens by adding a limitedUse parameter to the createToken() API. The changes are well-implemented across the API, client, and internal methods, and are accompanied by thorough unit and integration tests. My review includes one suggestion to enhance input validation for the new limitedUse parameter to improve robustness and provide clearer feedback to developers on invalid usage.

[jonathanedey]

LGTM, Thanks!

[lahirumaramba]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces support for minting limited-use App Check tokens by adding jti and limitedUse options to the createToken() API. The changes include updates to the API definition, implementation of validation logic for the new options, and corresponding unit and integration tests. The new validation ensures that jti is only specified when limitedUse is set to true, which is a good practice for maintaining API consistency and preventing misuse. Overall, the changes are well-implemented and tested.

[gemini-code-assist]

There's a small typo here; "vaild" should be "valid".

Suggested change

	it('should succeed with a vaild limited use token', function () {
	it('should succeed with a valid limited use token', function () {