Feat/appcheck debugtoken cli by AustinBenoit · Pull Request #10801 · firebase/firebase-tools

AustinBenoit · 2026-07-15T21:11:27Z

Description

Adding to the Firebase CLI App Check debug token workflows under the unified appcheck:debugtokens namespace, aligning directly with the backend REST API (projects.apps.debugTokens).

Key changes:

Added appcheck:debugtokens:create for both interactive wizard registration and headless/non-interactive script execution in CI/CD automation pipelines.
Implemented appcheck:debugtokens:list to render registered tokens in tabular format (Display Name, Resource Name, Update Time) with full backend pagination.
Implemented appcheck:debugtokens:delete to permanently revoke tokens by ID or resource path, supporting interactive confirmation and --force flag overrides.

Scenarios Tested

Interactive Wizard (appcheck:debugtokens:create): Tested running without --app to verify automatic app detection and interactive choice selection.
Explicit Arguments (appcheck:debugtokens:create [debugToken] --app <appId>): Tested supplying --app and debugToken to confirm prompt skipping.
Display Name Collisions: Verified interactive confirmation prompt asking whether to overwrite when a token with the same display name already exists.
Headless Creation (appcheck:debugtokens:create --non-interactive): Verified execution with global --non-interactive flag using fallback defaults without blocking prompts, and correctly enforcing --force for display name collision overwrites.
Token Listing (appcheck:debugtokens:list --app <appId>): Verified table rendering of returned tokens and multi-page pagination handling.
Token Revocation (appcheck:debugtokens:delete <debugTokenId> --app <appId>): Tested interactive deletion confirmation as well as non-interactive --force deletion.
Build & Test Suite: Ran npm run build and npx mocha src/appcheck/index.spec.ts & src/commands/appcheck-debugtokens-create.spec.ts (12/12 unit tests passing).

Sample Commands

Interactive wizard: Register a token copied from SDK logs

firebase appcheck:debugtokens:create e3d9b1a0-cf48-4389-8d19-482a177ffec8 --app 1:1234567890:ios:0a1b2c3d4e5f6a7b8c9d0e

Interactive wizard: Auto-detect project & prompt for app selection

firebase appcheck:debugtokens:create

Non-interactive creation for CI/CD pipelines

firebase appcheck:debugtokens:create e3d9b1a0-cf48-4389-8d19-482a177ffec8 --app 1:1234567890:ios:0a1b2c3d4e5f6a7b8c9d0e --display-name "CI Runner Token" --non-interactive

List registered tokens for an app

firebase appcheck:debugtokens:list --app 1:1234567890:ios:0a1b2c3d4e5f6a7b8c9d0e

Delete / revoke a token by ID

firebase appcheck:debugtokens:delete 7890-abcd --app 1:1234567890:ios:0a1b2c3d4e5f6a7b8c9d0e --force

gemini-code-assist

Code Review

This pull request introduces Firebase App Check debug token management commands (appcheck:debugtoken, appcheck:debugtoken:create, appcheck:debugtoken:list, and appcheck:debugtoken:delete) along with their corresponding API client methods, CLI command registrations, and unit tests. Feedback focuses on improving robustness and error handling: safely accessing res.body properties via optional chaining in listDebugTokens to prevent potential TypeErrors; explicitly handling non-interactive mode when prompting for a display name in the creation command; failing early in non-interactive mode if --force is omitted during deletion; validating that full resource names belong to the specified app and project; and aborting with a FirebaseError if a user declines to overwrite an existing token with the same display name.

codecov-commenter · 2026-07-16T17:18:34Z

Codecov Report

❌ Patch coverage is 70.12195% with 49 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@48242c1). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
src/appcheck/prompts.ts	37.50%	19 Missing and 1 partial ⚠️
src/commands/appcheck-debugtokens-create.ts	63.26%	12 Missing and 6 partials ⚠️
src/commands/appcheck-debugtokens-delete.ts	77.77%	4 Missing and 2 partials ⚠️
src/commands/appcheck-debugtokens-list.ts	82.60%	2 Missing and 2 partials ⚠️
src/appcheck/api.ts	95.65%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #10801   +/-   ##
=======================================
  Coverage        ?   58.33%           
=======================================
  Files           ?      620           
  Lines           ?    40416           
  Branches        ?     8194           
=======================================
  Hits            ?    23577           
  Misses          ?    14881           
  Partials        ?     1958

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Introduces CLI support for managing Firebase App Check debug tokens via the App Check REST API (`projects.apps.debugTokens`). Key changes: * api: Added `appCheckOrigin` to `src/api.ts` (`https://firebaseappcheck.googleapis.com`). * appcheck: Created the `src/appcheck/index.ts` API client supporting `create`, `list`, `get`, `update`, and `delete` operations, along with comprehensive unit tests in `index.spec.ts`. * commands: Added a suite of management commands under the `appcheck:debug-tokens` namespace: - `appcheck:debug-tokens:create <appId> [debugToken]`: Creates a debug token (with auto-generated UUIDv4 fallback and interactive display name prompting). - `appcheck:debug-tokens:list <appId>`: Lists all debug tokens for an app in a formatted table. - `appcheck:debug-tokens:get <appId> <debugTokenId>`: Fetches and displays metadata for a specific debug token. - `appcheck:debug-tokens:update <appId> <debugTokenId>`: Updates the display name of a debug token via `patch`. - `appcheck:debug-tokens:delete <appId> <debugTokenId>`: Revokes/deletes a debug token with interactive confirmation support. * commands: Registered the new commands in `src/commands/index.ts`. feat: Add App Check debug token commands

…rebase-debug-token and update .gitignore

…ication

…T layer

… CI runner

…ames in non-interactive mode

…ate.ts and remove old files

andrewheard

LGTM. I'd recommend replacing the any with a type like in create and cleaning up get / update if we don't need them but no big concerns on my end.

joehan

Left some comments, but also:

Please move this to a branch on the main repo - go/firebase-github-access will get you access if needed. That will allow the tests to run automatically for you.
Please add a changelog entry - users need to know about this change!

joehan · 2026-07-24T20:15:29Z

+/**
+ *
+ */
+export async function getOrPromptProjectAndAppId(


We shouldn't be prompting for project ID here. The CLI has a well established way of handling project selection (either using the active project system, or the -P flag), and we do not want this command to subvert that.

If a project ID is not specified, the command should jsut error our with a clear message.

joehan · 2026-07-24T20:21:01Z

+  }
+
+  const projectDir = options.cwd || process.cwd();
+  let apps = await listFirebaseApps(projectId, AppPlatform.ANY);


As I'm revieiwng this, I'm realizing that there is duplicated logic for selecting an app from the list of exisitng apps in 3 places in the CLI already 🤦 That's an oversight on my part, but we really ought to centralize this . I'm gonna send you a PR shortly to do so - please review and we can merge that before this one.

joehan · 2026-07-24T20:21:49Z

@@ -0,0 +1,74 @@
+import { Options } from "../options";


The src/commands directory should only include files that implement and export a command. Please move the types to src/appcheck/types.ts, and the prompt function (if it is still needed after that pr to centralize logic) to src/appcheck/prompts.ts

joehan · 2026-07-24T20:24:31Z

@@ -0,0 +1,67 @@
+import { appCheckOrigin } from "../api";


index.ts is a very generic name for a file that tells us nothing. We do it in a few other places in the codebase, but it is a code smell. This file just has API methods and types. Please split it into 2 files: src/appcheck/types.ts and src/appcheck/api.ts

Then, we can also move the AppCheckDebugOptions to the types file too.

AustinBenoit · 2026-07-24T20:34:02Z

Left some comments, but also:

Please move this to a branch on the main repo - go/firebase-github-access will get you access if needed. That will allow the tests to run automatically for you.

Please add a changelog entry - users need to know about this change!

I have requested access and will update the change log.

joehan · 2026-07-24T20:58:30Z

-      throw new FirebaseError("Must specify an App ID using --app.");
-    }
+  .action(async (debugTokenId: string, options: AppCheckDebugOptions): Promise<void> => {
+    const { appId } = await getOrPromptProjectAndAppId(options);


Moe directly - use needProjectID here instead of rolling your own

gemini-code-assist Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread src/appcheck/index.ts Outdated

Comment thread src/commands/appcheck-debugtokens-create.ts

Comment thread src/commands/appcheck-debugtokens-delete.ts

Comment thread src/commands/appcheck-debugtokens-delete.ts

Comment thread src/commands/appcheck-debug.ts Outdated

AustinBenoit force-pushed the feat/appcheck-debugtoken-cli branch 3 times, most recently from 1804817 to f6b9b82 Compare July 15, 2026 22:21

AustinBenoit force-pushed the feat/appcheck-debugtoken-cli branch from 93e4a1e to ee6de4f Compare July 20, 2026 19:26

andrewheard and others added 15 commits July 21, 2026 15:14

feat: Implement firebase appcheck:debug <appId> to generate local .fi…

6e21452

…rebase-debug-token and update .gitignore

feat: align appcheck:debugtoken CLI commands with REST backend specif…

841163f

…ication

test: add command unit tests for appcheck:debugtoken CLI scenario suite

46929a6

fix: address code review comments for appcheck:debugtoken CLI and RES…

3eee375

…T layer

fix: resolve lint errors and formatting in appcheck commands and spec

13908a1

fix: stub requireAuth in spec and enable auth on App Check Client for…

8ff64a4

… CI runner

fix: bypass command pre-action hooks in spec for CI test runner

938c4ec

Fix nock matching for Node 24 by using RegExp

c52dc01

Fix prettier formatting in tests

6959ebf

fix(appcheck): stub client directly to bypass Node 24 nock fetch bug

38dd12d

feat(appcheck): refactor cli command namespace and args

c65733b

feat(appcheck): require --force to overwrite existing token display n…

7ba9039

…ames in non-interactive mode

fix(lint): fix prettier formatting errors in appcheck-debugtokens-cre…

a384b53

…ate.ts and remove old files

chore: remove old appcheck-debug files properly

acd5428

AustinBenoit force-pushed the feat/appcheck-debugtoken-cli branch from ee6de4f to acd5428 Compare July 21, 2026 15:14

andrewheard approved these changes Jul 21, 2026

View reviewed changes

AustinBenoit force-pushed the feat/appcheck-debugtoken-cli branch 7 times, most recently from 727ff90 to 8fd9577 Compare July 24, 2026 18:57

joehan requested changes Jul 24, 2026

View reviewed changes

AustinBenoit force-pushed the feat/appcheck-debugtoken-cli branch 2 times, most recently from 48031bd to c203f4d Compare July 24, 2026 20:41

joehan reviewed Jul 24, 2026

View reviewed changes

AustinBenoit force-pushed the feat/appcheck-debugtoken-cli branch 2 times, most recently from 4425171 to c203f4d Compare July 26, 2026 13:34

Refactor: extract App Check prompt utils and remove stale endpoints

6e6d3ac

AustinBenoit force-pushed the feat/appcheck-debugtoken-cli branch from c203f4d to 6e6d3ac Compare July 26, 2026 13:37

Uh oh!

Conversation

AustinBenoit commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Scenarios Tested

Sample Commands

Interactive wizard: Register a token copied from SDK logs

Interactive wizard: Auto-detect project & prompt for app selection

Non-interactive creation for CI/CD pipelines

List registered tokens for an app

Delete / revoke a token by ID

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov-commenter commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

andrewheard left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

joehan left a comment

Choose a reason for hiding this comment

Uh oh!

joehan Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

joehan Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

joehan Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

joehan Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

joehan Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

AustinBenoit commented Jul 24, 2026

Uh oh!

joehan Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

AustinBenoit commented Jul 15, 2026 •

edited

Loading

codecov-commenter commented Jul 16, 2026 •

edited

Loading