Re-establish streams when App Check token expires. (#9233)

* Re-establish streams when App Check token expires.

* Add comment about why we ignore notification before client initialization.

* Add to CHANGELOG.md

* Update Firestore/CHANGELOG.md

Co-authored-by: Sebastian Schmidt <[email protected]>

Co-authored-by: Sebastian Schmidt <[email protected]>

Author: ehsannas

Firestore/CHANGELOG.md

@@ -1,3 +1,8 @@
+# Unreleased
+- [fixed] Fixed an AppCheck issue that caused Firestore listeners to stop
+working and receive a "Permission Denied" error. This issue only occurred for
+AppCheck users that set their expiration time to under an hour.
+
 # v8.11.0
 - [fixed] Fixed an issue that can result in incomplete Query snapshots when an
   app is backgrounded during query execution.

Firestore/core/src/core/firestore_client.cc

@@ -145,10 +145,23 @@ std::shared_ptr<FirestoreClient> FirestoreClient::Create(
   };
 
   shared_client->app_check_credentials_provider_->SetCredentialChangeListener(
-      [](std::string) {
-        // Register an empty credentials change listener to activate token
-        // refresh.
+      [weak_client](const std::string&) {
+        auto shared_client = weak_client.lock();
+        if (!shared_client) return;
+        // It is okay to ignore an App Check token change notification if
+        // FirestoreClient::Initialize has not been invoked yet because
+        // once initialization does occur, setting up new watch streams will use
+        // the latest App Check token available.
+        if (shared_client->credentials_initialized_) {
+          shared_client->worker_queue_->Enqueue([shared_client] {
+            LOG_DEBUG("App Check token Changed.");
+            // This will ensure that once a new App Check token is retrieved,
+            // streams are re-established using the new token.
+            shared_client->remote_store_->HandleCredentialChange();
+          });
+        }
       });
+
   shared_client->auth_credentials_provider_->SetCredentialChangeListener(
       credential_change_listener);