Merge branch 'master' into wuandy/SquashBasedOnSebastianDraft

# Conflicts:
#	firebase-firestore/src/main/java/com/google/firebase/firestore/model/mutation/DeleteMutation.java
#	firebase-firestore/src/main/java/com/google/firebase/firestore/model/mutation/Mutation.java
#	firebase-firestore/src/main/java/com/google/firebase/firestore/model/mutation/SetMutation.java
#	firebase-firestore/src/test/java/com/google/firebase/firestore/model/mutation/MutationTest.java

Author: wu-hui

.github/workflows/update-cpp-sdk-on-release.yml

@@ -0,0 +1,74 @@
+# Whenever a new Firebase Android SDK is released, this workflow triggers
+# *another* workflow on the Firebase C++ SDK, which will check for the Android
+# version update and create a PR updating its dependencies if any version
+# numbers changed.
+name: update-cpp-sdk-on-release
+on:
+  push:
+    branches:
+      # Change the below line if the main branch is renamed.
+      - 'master'
+    paths:
+      # Only run this if a gradle.properties file is touched.
+      - '**/gradle.properties'
+
+jobs:
+  check_if_version_changed:
+    name: Check if released version changed
+    # This step checks several things, and sets released_version_changed=1 only if all are true:
+    # - The push must target the main branch.
+    # - The push must modify a gradle.properties file.
+    # - The push must change a "latestReleasedVersion=" line in a gradle.properties file.
+    runs-on: ubuntu-latest
+    outputs:
+      released_version_changed: ${{ steps.check_version.outputs.released_version_changed }}
+    steps:
+      - uses: actions/[email protected]
+        with:
+          # Check out the actual head commit, not any merge commit.
+          ref: ${{ github.sha }}
+          # Specify fetch-depth so we can query the log, the default is a shallow clone.
+          fetch-depth: 0
+      - name: Check if version was updated in git history
+        id: check_version
+        run: |
+          # Query the git history for all gradle.properties files changed by this push.
+          # Then, check the diff to see if any "latestReleasedVersion=" lines changed.
+          if (git diff '${{ github.event.before }}' -- '**/gradle.properties' | grep -q '^[-+]latestReleasedVersion='); then
+            echo "::set-output name=released_version_changed::1"
+          else
+            echo "No change to latestReleasedVersion detected since ${{ github.event.before }}"
+          fi
+
+  trigger_cpp_sdk_update:
+    name: Trigger C++ SDK update
+    # If the previous step set the released_version_changed output param to 1, then
+    # we should trigger the C++ SDK to update its Android dependencies.
+    needs: check_if_version_changed
+    if: ${{ needs.check_if_version_changed.outputs.released_version_changed }}
+    # Fetch an authentication token for firebase-workflow-trigger, then use that
+    # token to trigger the update-dependencies workflow in firebase-cpp-sdk.
+    runs-on: ubuntu-latest
+    steps:
+      - name: Setup python
+        uses: actions/setup-python@v2
+        with:
+          python-version: 3.7
+
+      - name: Check out firebase-cpp-sdk
+        uses: actions/[email protected]
+        with:
+          repository: firebase/firebase-cpp-sdk
+          ref: main
+
+      - name: Get firebase-workflow-trigger token
+        uses: tibdex/github-app-token@v1
+        id: generate-token
+        with:
+          app_id: ${{ secrets.CPP_WORKFLOW_TRIGGER_APP_ID }}
+          private_key: ${{ secrets.CPP_WORKFLOW_TRIGGER_APP_PRIVATE_KEY }}
+          repository: firebase/firebase-cpp-sdk
+
+      - name: Trigger firebase-cpp-sdk update
+        run: |
+          python scripts/gha/trigger_workflow.py -t ${{ steps.generate-token.outputs.token }} -w update-dependencies.yml -p updateAndroid 1 -p updateiOS 0 -p comment "[Triggered]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID) by [firebase-android-sdk $(date '+%b %d') release]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/commit/${{ github.sha }})." -s 10 -A

appcheck/firebase-appcheck/src/main/java/com/google/firebase/appcheck/internal/NetworkClient.java

@@ -16,9 +16,14 @@
 
 import static com.google.android.gms.common.internal.Preconditions.checkNotNull;
 
+import android.content.Context;
+import android.content.pm.PackageManager.NameNotFoundException;
+import android.util.Log;
 import androidx.annotation.IntDef;
 import androidx.annotation.NonNull;
 import androidx.annotation.VisibleForTesting;
+import com.google.android.gms.common.util.AndroidUtilsLight;
+import com.google.android.gms.common.util.Hex;
 import com.google.firebase.FirebaseApp;
 import com.google.firebase.FirebaseException;
 import com.google.firebase.appcheck.FirebaseAppCheck;
@@ -40,6 +45,8 @@
  */
 public class NetworkClient {
 
+  private static final String TAG = NetworkClient.class.getName();
+
   private static final String SAFETY_NET_EXCHANGE_URL_TEMPLATE =
       "https://firebaseappcheck.googleapis.com/v1beta/projects/%s/apps/%s:exchangeSafetyNetToken?key=%s";
   private static final String DEBUG_EXCHANGE_URL_TEMPLATE =
@@ -49,7 +56,10 @@ public class NetworkClient {
   private static final String UTF_8 = "UTF-8";
   @VisibleForTesting static final String X_FIREBASE_CLIENT = "X-Firebase-Client";
   @VisibleForTesting static final String X_FIREBASE_CLIENT_LOG_TYPE = "X-Firebase-Client-Log-Type";
+  @VisibleForTesting static final String X_ANDROID_PACKAGE = "X-Android-Package";
+  @VisibleForTesting static final String X_ANDROID_CERT = "X-Android-Cert";
 
+  private final Context context;
   private final DefaultFirebaseAppCheck firebaseAppCheck;
   private final String apiKey;
   private final String appId;
@@ -65,6 +75,7 @@ public class NetworkClient {
 
   public NetworkClient(@NonNull FirebaseApp firebaseApp) {
     checkNotNull(firebaseApp);
+    this.context = firebaseApp.getApplicationContext();
     this.firebaseAppCheck = (DefaultFirebaseAppCheck) FirebaseAppCheck.getInstance(firebaseApp);
     this.apiKey = firebaseApp.getOptions().getApiKey();
     this.appId = firebaseApp.getOptions().getApplicationId();
@@ -97,6 +108,10 @@ public AppCheckTokenResponse exchangeAttestationForAppCheckToken(
             X_FIREBASE_CLIENT_LOG_TYPE, firebaseAppCheck.getHeartbeatCode());
       }
 
+      // Headers for Android API key restrictions.
+      urlConnection.setRequestProperty(X_ANDROID_PACKAGE, context.getPackageName());
+      urlConnection.setRequestProperty(X_ANDROID_CERT, getFingerprintHashForPackage());
+
       try (OutputStream out =
           new BufferedOutputStream(urlConnection.getOutputStream(), requestBytes.length)) {
         out.write(requestBytes, /* off= */ 0, requestBytes.length);
@@ -130,6 +145,23 @@ public AppCheckTokenResponse exchangeAttestationForAppCheckToken(
     }
   }
 
+  /** Gets the Android package's SHA-1 fingerprint. */
+  private String getFingerprintHashForPackage() {
+    byte[] hash;
+
+    try {
+      hash = AndroidUtilsLight.getPackageCertificateHashBytes(context, context.getPackageName());
+      if (hash == null) {
+        Log.e(TAG, "Could not get fingerprint hash for package: " + context.getPackageName());
+        return null;
+      }
+      return Hex.bytesToStringUppercase(hash, /* zeroTerminated= */ false);
+    } catch (NameNotFoundException e) {
+      Log.e(TAG, "No such package: " + context.getPackageName(), e);
+      return null;
+    }
+  }
+
   private static String getUrlTemplate(@AttestationTokenType int tokenType) {
     switch (tokenType) {
       case SAFETY_NET:

appcheck/firebase-appcheck/src/test/java/com/google/firebase/appcheck/internal/NetworkClientTest.java

@@ -20,10 +20,13 @@
 import static com.google.firebase.appcheck.internal.HttpErrorResponse.CODE_KEY;
 import static com.google.firebase.appcheck.internal.HttpErrorResponse.ERROR_KEY;
 import static com.google.firebase.appcheck.internal.HttpErrorResponse.MESSAGE_KEY;
+import static com.google.firebase.appcheck.internal.NetworkClient.X_ANDROID_CERT;
+import static com.google.firebase.appcheck.internal.NetworkClient.X_ANDROID_PACKAGE;
 import static com.google.firebase.appcheck.internal.NetworkClient.X_FIREBASE_CLIENT;
 import static com.google.firebase.appcheck.internal.NetworkClient.X_FIREBASE_CLIENT_LOG_TYPE;
 import static org.junit.Assert.assertThrows;
 import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.spy;
 import static org.mockito.Mockito.verify;
@@ -116,13 +119,7 @@ public void exchangeSafetyNetToken_successResponse_returnsAppCheckTokenResponse(
     verify(networkClient).createHttpUrlConnection(expectedUrl);
     verify(outputStream)
         .write(JSON_REQUEST.getBytes(), /* off= */ 0, JSON_REQUEST.getBytes().length);
-
-    String userAgent = ((DefaultFirebaseAppCheck) FirebaseAppCheck.getInstance()).getUserAgent();
-    String heartBeatCode =
-        ((DefaultFirebaseAppCheck) FirebaseAppCheck.getInstance()).getHeartbeatCode();
-    verify(mockHttpUrlConnection).setRequestProperty(X_FIREBASE_CLIENT, userAgent);
-    verify(mockHttpUrlConnection).setRequestProperty(X_FIREBASE_CLIENT_LOG_TYPE, heartBeatCode);
-    assertThat(userAgent).contains(SDK_NAME);
+    verifyRequestHeaders();
   }
 
   @Test
@@ -146,13 +143,7 @@ public void exchangeSafetyNetToken_errorResponse_throwsException() throws Except
     verify(networkClient).createHttpUrlConnection(expectedUrl);
     verify(outputStream)
         .write(JSON_REQUEST.getBytes(), /* off= */ 0, JSON_REQUEST.getBytes().length);
-
-    String userAgent = ((DefaultFirebaseAppCheck) FirebaseAppCheck.getInstance()).getUserAgent();
-    String heartBeatCode =
-        ((DefaultFirebaseAppCheck) FirebaseAppCheck.getInstance()).getHeartbeatCode();
-    verify(mockHttpUrlConnection).setRequestProperty(X_FIREBASE_CLIENT, userAgent);
-    verify(mockHttpUrlConnection).setRequestProperty(X_FIREBASE_CLIENT_LOG_TYPE, heartBeatCode);
-    assertThat(userAgent).contains(SDK_NAME);
+    verifyRequestHeaders();
   }
 
   @Test
@@ -174,13 +165,7 @@ public void exchangeDebugToken_successResponse_returnsAppCheckTokenResponse() th
     verify(networkClient).createHttpUrlConnection(expectedUrl);
     verify(outputStream)
         .write(JSON_REQUEST.getBytes(), /* off= */ 0, JSON_REQUEST.getBytes().length);
-
-    String userAgent = ((DefaultFirebaseAppCheck) FirebaseAppCheck.getInstance()).getUserAgent();
-    String heartBeatCode =
-        ((DefaultFirebaseAppCheck) FirebaseAppCheck.getInstance()).getHeartbeatCode();
-    verify(mockHttpUrlConnection).setRequestProperty(X_FIREBASE_CLIENT, userAgent);
-    verify(mockHttpUrlConnection).setRequestProperty(X_FIREBASE_CLIENT_LOG_TYPE, heartBeatCode);
-    assertThat(userAgent).contains(SDK_NAME);
+    verifyRequestHeaders();
   }
 
   @Test
@@ -204,13 +189,7 @@ public void exchangeDebugToken_errorResponse_throwsException() throws Exception
     verify(networkClient).createHttpUrlConnection(expectedUrl);
     verify(outputStream)
         .write(JSON_REQUEST.getBytes(), /* off= */ 0, JSON_REQUEST.getBytes().length);
-
-    String userAgent = ((DefaultFirebaseAppCheck) FirebaseAppCheck.getInstance()).getUserAgent();
-    String heartBeatCode =
-        ((DefaultFirebaseAppCheck) FirebaseAppCheck.getInstance()).getHeartbeatCode();
-    verify(mockHttpUrlConnection).setRequestProperty(X_FIREBASE_CLIENT, userAgent);
-    verify(mockHttpUrlConnection).setRequestProperty(X_FIREBASE_CLIENT_LOG_TYPE, heartBeatCode);
-    assertThat(userAgent).contains(SDK_NAME);
+    verifyRequestHeaders();
   }
 
   @Test
@@ -222,6 +201,20 @@ public void exchangeUnknownAttestation_throwsException() {
                 JSON_REQUEST.getBytes(), NetworkClient.UNKNOWN));
   }
 
+  private void verifyRequestHeaders() {
+    String userAgent = ((DefaultFirebaseAppCheck) FirebaseAppCheck.getInstance()).getUserAgent();
+    String heartBeatCode =
+        ((DefaultFirebaseAppCheck) FirebaseAppCheck.getInstance()).getHeartbeatCode();
+
+    verify(mockHttpUrlConnection).setRequestProperty(X_FIREBASE_CLIENT, userAgent);
+    verify(mockHttpUrlConnection).setRequestProperty(X_FIREBASE_CLIENT_LOG_TYPE, heartBeatCode);
+    verify(mockHttpUrlConnection)
+        .setRequestProperty(
+            X_ANDROID_PACKAGE, ApplicationProvider.getApplicationContext().getPackageName());
+    verify(mockHttpUrlConnection).setRequestProperty(eq(X_ANDROID_CERT), any());
+    assertThat(userAgent).contains(SDK_NAME);
+  }
+
   private static JSONObject createAttestationResponse() throws Exception {
     JSONObject responseBodyJson = new JSONObject();
     responseBodyJson.put(ATTESTATION_TOKEN_KEY, ATTESTATION_TOKEN);

firebase-app-distribution/src/main/AndroidManifest.xml

@@ -43,13 +43,13 @@
         </activity>
 
         <provider
-            android:name="androidx.core.content.FileProvider"
-            android:authorities="${applicationId}.appdistro.fileprovider"
+            android:name="com.google.firebase.appdistribution.FirebaseAppDistributionFileProvider"
+            android:authorities="${applicationId}.FirebaseAppDistributionFileProvider"
             android:exported="false"
             android:grantUriPermissions="true">
             <meta-data
                 android:name="android.support.FILE_PROVIDER_PATHS"
-                android:resource="@xml/appdistro_provider_paths" />
+                android:resource="@xml/firebase_app_distribution_provider_paths" />
         </provider>
     </application>
 </manifest>

firebase-app-distribution/src/main/java/com/google/firebase/appdistribution/CheckForNewReleaseClient.java

@@ -125,7 +125,8 @@ AppDistributionReleaseInternal getNewReleaseFromClient(
       throws FirebaseAppDistributionException {
     try {
       AppDistributionReleaseInternal retrievedNewRelease =
-          firebaseAppDistributionTesterApiClient.fetchNewRelease(fid, appId, apiKey, authToken);
+          firebaseAppDistributionTesterApiClient.fetchNewRelease(
+              fid, appId, apiKey, authToken, firebaseApp.getApplicationContext());
 
       if (isNewerBuildVersion(retrievedNewRelease) || !isInstalledRelease(retrievedNewRelease)) {
         return retrievedNewRelease;

firebase-app-distribution/src/main/java/com/google/firebase/appdistribution/FirebaseAppDistributionFileProvider.java

@@ -0,0 +1,19 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.firebase.appdistribution;
+
+import androidx.core.content.FileProvider;
+
+public class FirebaseAppDistributionFileProvider extends FileProvider {}

firebase-app-distribution/src/main/java/com/google/firebase/appdistribution/FirebaseAppDistributionTesterApiClient.java

@@ -14,10 +14,16 @@
 
 package com.google.firebase.appdistribution;
 
+import static android.content.ContentValues.TAG;
 import static com.google.firebase.appdistribution.FirebaseAppDistributionException.Status.AUTHENTICATION_FAILURE;
 import static com.google.firebase.appdistribution.FirebaseAppDistributionException.Status.NETWORK_FAILURE;
 
+import android.content.Context;
+import android.content.pm.PackageManager;
+import android.util.Log;
 import androidx.annotation.NonNull;
+import com.google.android.gms.common.util.AndroidUtilsLight;
+import com.google.android.gms.common.util.Hex;
 import com.google.firebase.appdistribution.internal.AppDistributionReleaseInternal;
 import java.io.BufferedInputStream;
 import java.io.ByteArrayOutputStream;
@@ -36,18 +42,27 @@ class FirebaseAppDistributionTesterApiClient {
   private static final String REQUEST_METHOD = "GET";
   private static final String API_KEY_HEADER = "x-goog-api-key";
   private static final String INSTALLATION_AUTH_HEADER = "X-Goog-Firebase-Installations-Auth";
+  private static final String X_ANDROID_PACKAGE_HEADER_KEY = "X-Android-Package";
+  private static final String X_ANDROID_CERT_HEADER_KEY = "X-Android-Cert";
+
   private static final String BUILD_VERSION_JSON_KEY = "buildVersion";
   private static final String DISPLAY_VERSION_JSON_KEY = "displayVersion";
   private static final String RELEASE_NOTES_JSON_KEY = "releaseNotes";
   private static final String BINARY_TYPE_JSON_KEY = "binaryType";
   private static final String CODE_HASH_KEY = "codeHash";
   private static final String IAS_ARTIFACT_ID_KEY = "iasArtifactId";
   private static final String DOWNLOAD_URL_KEY = "downloadUrl";
+
   private static final String TAG = "TesterApiClient:";
+
   public static final int DEFAULT_BUFFER_SIZE = 8192;
 
   public @NonNull AppDistributionReleaseInternal fetchNewRelease(
-      @NonNull String fid, @NonNull String appId, @NonNull String apiKey, @NonNull String authToken)
+      @NonNull String fid,
+      @NonNull String appId,
+      @NonNull String apiKey,
+      @NonNull String authToken,
+      @NonNull Context context)
       throws FirebaseAppDistributionException {
 
     AppDistributionReleaseInternal newRelease;
@@ -56,6 +71,9 @@ class FirebaseAppDistributionTesterApiClient {
       connection.setRequestMethod(REQUEST_METHOD);
       connection.setRequestProperty(API_KEY_HEADER, apiKey);
       connection.setRequestProperty(INSTALLATION_AUTH_HEADER, authToken);
+      connection.addRequestProperty(X_ANDROID_PACKAGE_HEADER_KEY, context.getPackageName());
+      connection.addRequestProperty(
+          X_ANDROID_CERT_HEADER_KEY, getFingerprintHashForPackage(context));
 
       InputStream inputStream = connection.getInputStream();
       JSONObject newReleaseJson = readFetchReleaseInputStream(inputStream);
@@ -185,4 +203,27 @@ private static String convertInputStreamToString(InputStream is) throws IOExcept
     }
     return result.toString();
   }
+
+  /**
+   * Gets the Android package's SHA-1 fingerprint.
+   *
+   * @param context
+   */
+  private String getFingerprintHashForPackage(Context context) {
+    byte[] hash;
+
+    try {
+      hash = AndroidUtilsLight.getPackageCertificateHashBytes(context, context.getPackageName());
+
+      if (hash == null) {
+        Log.e(TAG, "Could not get fingerprint hash for package: " + context.getPackageName());
+        return null;
+      } else {
+        return Hex.bytesToStringUppercase(hash, /* zeroTerminated= */ false);
+      }
+    } catch (PackageManager.NameNotFoundException e) {
+      Log.e(TAG, "No such package: " + context.getPackageName(), e);
+      return null;
+    }
+  }
 }