firebase-android-sdk: Firestore is not picking up fresh auth token and reinitialising event listeners when the current token is stale.

I was able to reproduce. I am trying a couple of things that might effect the behaviour. Not sure how long it will take as I have to test with the release version via Play store for changes and it takes a while for the error to appear. Will keep this channel updated with any notable updates 👍

Hi @RamsayGit, once I added App Check to my own Android app built with the Firebase Android SDK, I started producing a similar behavior, though in my case logging in again seemed to solve the problem consistently. I do believe this is related to app check, and I have shared it with that team. However I do intend to take another look in the next week to see if I can move it forward.

Not sure if it will be useful to you at this point, but there is an API to listen for AppCheck token state changes.

Hi, there. We’re reasonably sure we’ve identified what is causing the issue. It seems there is a difficulty translating the suspected API to a pure android reproducible implementation which would allow the issue to be resolved. Bear with us, we haven’t given up, it’s a rather difficult one to fix given the time frame the error pops up. The last time I reproduced the bug, it took 3 days for the error to appear. Thank you for your patience 🙏

Hello @russellwheatley, do you have any news regarding the issue ?

@russellwheatley @MarkDuckworth The initial problem I faced was that after resuming the app after an extended period (a day or two), all long-lived snapshots would stop updating, even though new reads and writes would still go through. I managed to apply a temporary patch to the issue by recreating all snapshot listeners when the app resumes. The following is an example of how this was done:

  @override
  void didChangeAppLifecycleState(AppLifecycleState state) {
    if (state == AppLifecycleState.resumed) {
      _attachListener();
    }
  }

  void _attachListener() {
    _hangoutSubscription?.cancel();
    _hangoutSubscription = FirebaseFirestore.instance
        .collection(FirePath.hangouts)
        .where....
        .snapshots(includeMetadataChanges: true)
        .transform(ignorePermissionDeniedTransformer())
        .listen((snapshot) {
          ...
        }, onError: (error) {
          FirebaseCrashlytics.instance.recordError(
            error,
            StackTrace.current,
            reason: 'Error in AdminHangoutRepository',
          );
        });
  }
}

This solution seemed to fix the issue in production for a few days, but today a new variant of the problem appeared. This time, the issue seems to be that the token didn’t refresh, and yet the user remained logged in. I have this code in place to log out the user, but it didn’t trigger:

_authStateSubscription =
    FirebaseAuth.instance.authStateChanges().listen((user) {
  if (user == null) {
    set(RouteState.login()); //did not fire when auth id token expired
  }
});

As shown in this video I captured from my production app today, nothing updates in response to my read and write requests. Connecting my phone to logcat indeed showed permission errors:

 16:29:15.551 19076 Firestore        com.letshang.app        W  (24.6.0) [z0]: (74f4cfa) Stream closed with status: j1{code=PERMISSION_DENIED, description=Missing or insufficient permissions., cause=null}.
16:29:15.564 19076 Firestore        com.letshang.app        W  (24.6.0) [Firestore]: Write failed at users_private/JDGWvPLVtNTcrb: j1{code=PERMISSION_DENIED, description=Missing or insufficient permissions., cause=null}
16:46:09.985 19076 Firestore        com.letshang.app        W  (24.6.0) [Firestore]: Listen for Query(target=Query(hangouts where statein[pre_open,open] order by geohash_6, __name__);limitType=LIMIT_TO_FIRST) failed: j1{code=PERMISSION_DENIED, description=Missing or insufficient permissions., cause=null}

Despite these permission errors, the user remains logged in and authStateChanges doesn’t get called. I’m currently unsure how to patch this until Firebase addresses this fundamental issue. A potential workaround could be calling user.getIdTokenResult() on each app resume, or perhaps performing a single write every few hours on app resume to check for the permission denied error, and then automatically log out the user if it’s encountered.

Please let me know if there are any potential issues with my approach to detecting when the user should be logged out, or if you have found a more effective temporary workaround for this issue.

@russellwheatley, I’ll work on a reproduction and see if we can get this fixed.