Firebase App Check: Not Enabled for Application¶

const admin = require('firebase-admin');

async function checkAppCheckStatus() {
  try {
    // Get project configuration
    const projectConfig = await admin.projectManagement().getProjectConfig();
    const apps = await admin.projectManagement().listApps();

    console.log('App Check Status Audit:');
    console.log('==================');

    for (const app of apps) {
      const appConfig = await admin.projectManagement().getApp(app.appId);
      console.log(`\nApp: ${appConfig.displayName || appConfig.appId}`);
      console.log(`Platform: ${appConfig.platform}`);
      console.log(`App ID: ${appConfig.appId}`);

      try {
        // Check App Check configuration
        const appCheckConfig = await admin.appCheck().getAppCheckConfig(appConfig.appId);
        console.log(`App Check: ENABLED`);
        console.log(`Token TTL: ${appCheckConfig.ttlSeconds}s`);
      } catch (error) {
        if (error.code === 'NOT_FOUND') {
          console.log(`App Check: NOT CONFIGURED ⚠️`);
        } else {
          console.log(`App Check: ERROR - ${error.message}`);
        }
      }
    }

    return apps;
  } catch (error) {
    console.error('Error checking App Check status:', error);
  }
}

// Audit which Firebase services lack App Check protection
async function auditAppCheckCoverage() {
  const services = [
    'firestore.googleapis.com',
    'storage.googleapis.com', 
    'cloudfunctions.googleapis.com',
    'firebase-db.googleapis.com'
  ];

  const coverage = {};

  for (const service of services) {
    try {
      const config = await admin.appCheck().getServiceConfig(service);
      coverage[service] = {
        enforcement: config.enforcementMode,
        protected: config.enforcementMode === 'ENFORCED'
      };
    } catch (error) {
      coverage[service] = {
        enforcement: 'UNENFORCED',
        protected: false,
        error: error.message
      };
    }
  }

  console.log('Service Protection Status:');
  console.log(JSON.stringify(coverage, null, 2));

  return coverage;
}

// Web - Enable App Check with reCAPTCHA Enterprise
import { initializeApp } from 'firebase/app';
import { initializeAppCheck, ReCaptchaEnterpriseProvider } from 'firebase/app-check';

const app = initializeApp(firebaseConfig);

// Initialize App Check before other Firebase services
const appCheck = initializeAppCheck(app, {
  provider: new ReCaptchaEnterpriseProvider('6LcqXXXXXXXXXXXXXXXXXXXXXXXX'),
  isTokenAutoRefreshEnabled: true
});

// Enable App Check enforcement for all Firebase services
async function enableAppCheckEnforcement() {
  const services = [
    'firestore.googleapis.com',
    'storage.googleapis.com',
    'cloudfunctions.googleapis.com', 
    'firebase-db.googleapis.com'
  ];

  for (const service of services) {
    try {
      await admin.appCheck().updateServiceConfig(service, {
        enforcementMode: 'ENFORCED'
      });
      console.log(`✅ Enabled App Check enforcement for ${service}`);
    } catch (error) {
      console.error(`❌ Failed to enable enforcement for ${service}:`, error);
    }
  }
}

// Implement gradual enforcement to minimize user impact
async function gradualEnforcementRollout() {
  // Step 1: Enable unenforced mode to collect metrics
  await admin.appCheck().updateServiceConfig('firestore.googleapis.com', {
    enforcementMode: 'UNENFORCED'
  });
  console.log('📊 App Check metrics collection enabled');

  // Wait 24-48 hours to collect baseline metrics

  // Step 2: Enable enforcement during low-traffic periods
  await admin.appCheck().updateServiceConfig('firestore.googleapis.com', {
    enforcementMode: 'ENFORCED'
  });
  console.log('🛡️ App Check enforcement enabled');

  // Monitor for any issues and be ready to roll back if needed
}

// Proper error handling for App Check failures
import { getToken } from 'firebase/app-check';

async function safeFirebaseOperation() {
  try {
    // Ensure App Check token is available
    const appCheckToken = await getToken(appCheck, /* forceRefresh= */ false);

    // Proceed with Firebase operation
    const result = await someFirebaseOperation();
    return result;

  } catch (error) {
    if (error.code === 'app-check/fetch-token-error') {
      // Handle App Check token failure
      console.error('App Check token failed:', error);
      showUserFriendlyError('Please update your app to the latest version');
    } else if (error.code === 'app-check/throttled') {
      // Handle rate limiting
      console.error('App Check throttled:', error);
      showUserFriendlyError('Too many requests. Please try again later');
    } else {
      // Handle other Firebase errors
      console.error('Firebase operation failed:', error);
      handleGeneralError(error);
    }
  }
}

// Verify App Check tokens in Cloud Functions
const functions = require('firebase-functions');
const admin = require('firebase-admin');

exports.secureFunction = functions.https.onCall(async (data, context) => {
  // Verify App Check token
  if (!context.app) {
    throw new functions.https.HttpsError(
      'failed-precondition',
      'The function must be called from an App Check verified app.'
    );
  }

  // Proceed with secure operation
  return await processSecureRequest(data, context);
});

// Monitor App Check token usage and failures
exports.monitorAppCheckMetrics = functions.pubsub.schedule('every 1 hours').onRun(async (context) => {
  try {
    // Get App Check metrics from Firebase Analytics or custom logging
    const metrics = await getAppCheckMetrics();

    // Check for anomalies
    if (metrics.failureRate > 0.05) { // 5% failure rate threshold
      await sendAlert({
        type: 'app_check_high_failure_rate',
        failureRate: metrics.failureRate,
        timestamp: new Date().toISOString()
      });
    }

    if (metrics.unverifiedRequests > 1000) {
      await sendAlert({
        type: 'app_check_unverified_requests',
        count: metrics.unverifiedRequests,
        timestamp: new Date().toISOString()
      });
    }

  } catch (error) {
    console.error('Error monitoring App Check metrics:', error);
  }
});