Force refresh token if RPC fails with "Unauthenticated" error (#1373)

"Unauthenticated" is presumed to mean that token is expired (which might happen if local clock is wrong) and retried, subject to the usual backoff logic.

5 files changed, 24 insertions, 13 deletions

diff --git a/Firestore/core/src/firebase/firestore/auth/credentials_provider.h b/Firestore/core/src/firebase/firestore/auth/credentials_provider.h
index 0a1930a..d6ed39a 100644
--- a/Firestore/core/src/firebase/firestore/auth/credentials_provider.h
+++ b/Firestore/core/src/firebase/firestore/auth/credentials_provider.h
@@ -46,11 +46,14 @@ class CredentialsProvider {
 
   virtual ~CredentialsProvider();
 
+  /** Requests token for the current user. */
+  virtual void GetToken(TokenListener completion) = 0;
+
   /**
-   * Requests token for the current user, optionally forcing a refreshed token
-   * to be fetched.
+   * Marks the last retrieved token as invalid, making the next `GetToken`
+   * request force refresh the token.
    */
-  virtual void GetToken(bool force_refresh, TokenListener completion) = 0;
+  virtual void InvalidateToken() = 0;
 
   /**
    * Sets the listener to be notified of user changes (sign-in / sign-out). It
diff --git a/Firestore/core/src/firebase/firestore/auth/empty_credentials_provider.cc b/Firestore/core/src/firebase/firestore/auth/empty_credentials_provider.cc
index da4198d..77156cc 100644
--- a/Firestore/core/src/firebase/firestore/auth/empty_credentials_provider.cc
+++ b/Firestore/core/src/firebase/firestore/auth/empty_credentials_provider.cc
@@ -14,17 +14,13 @@
  * limitations under the License.
  */
 
-#define UNUSED(x) (void)(x)
-
 #include "Firestore/core/src/firebase/firestore/auth/empty_credentials_provider.h"
 
 namespace firebase {
 namespace firestore {
 namespace auth {
 
-void EmptyCredentialsProvider::GetToken(bool force_refresh,
-                                        TokenListener completion) {
-  UNUSED(force_refresh);
+void EmptyCredentialsProvider::GetToken(TokenListener completion) {
   if (completion) {
     // Unauthenticated token will force the GRPC fallback to use default
     // settings.
@@ -39,6 +35,9 @@ void EmptyCredentialsProvider::SetUserChangeListener(
   }
 }
 
+void EmptyCredentialsProvider::InvalidateToken() {
+}
+
 }  // namespace auth
 }  // namespace firestore
 }  // namespace firebase
diff --git a/Firestore/core/src/firebase/firestore/auth/empty_credentials_provider.h b/Firestore/core/src/firebase/firestore/auth/empty_credentials_provider.h
index 55b3cc6..3ea0cab 100644
--- a/Firestore/core/src/firebase/firestore/auth/empty_credentials_provider.h
+++ b/Firestore/core/src/firebase/firestore/auth/empty_credentials_provider.h
@@ -26,7 +26,8 @@ namespace auth {
 /** `EmptyCredentialsProvider` always yields an empty token. */
 class EmptyCredentialsProvider : public CredentialsProvider {
  public:
-  void GetToken(bool force_refresh, TokenListener completion) override;
+  void GetToken(TokenListener completion) override;
+  void InvalidateToken() override;
   void SetUserChangeListener(UserChangeListener listener) override;
 };
 
diff --git a/Firestore/core/src/firebase/firestore/auth/firebase_credentials_provider_apple.h b/Firestore/core/src/firebase/firestore/auth/firebase_credentials_provider_apple.h
index 0e1da31..f54b72f 100644
--- a/Firestore/core/src/firebase/firestore/auth/firebase_credentials_provider_apple.h
+++ b/Firestore/core/src/firebase/firestore/auth/firebase_credentials_provider_apple.h
@@ -65,10 +65,12 @@ class FirebaseCredentialsProvider : public CredentialsProvider {
 
   ~FirebaseCredentialsProvider() override;
 
-  void GetToken(bool force_refresh, TokenListener completion) override;
+  void GetToken(TokenListener completion) override;
 
   void SetUserChangeListener(UserChangeListener listener) override;
 
+  void InvalidateToken() override;
+
  private:
   /**
    * Most contents of the FirebaseCredentialProvider are kept in this
@@ -95,6 +97,8 @@ class FirebaseCredentialsProvider : public CredentialsProvider {
     int user_counter = 0;
 
     std::mutex mutex;
+
+    bool force_refresh = false;
   };
 
   /**
diff --git a/Firestore/core/src/firebase/firestore/auth/firebase_credentials_provider_apple.mm b/Firestore/core/src/firebase/firestore/auth/firebase_credentials_provider_apple.mm
index 9d5b89e..74858c6 100644
--- a/Firestore/core/src/firebase/firestore/auth/firebase_credentials_provider_apple.mm
+++ b/Firestore/core/src/firebase/firestore/auth/firebase_credentials_provider_apple.mm
@@ -78,8 +78,7 @@ FirebaseCredentialsProvider::~FirebaseCredentialsProvider() {
   }
 }
 
-void FirebaseCredentialsProvider::GetToken(bool force_refresh,
-                                           TokenListener completion) {
+void FirebaseCredentialsProvider::GetToken(TokenListener completion) {
   HARD_ASSERT(auth_listener_handle_,
               "GetToken cannot be called after listener removed.");
 
@@ -121,8 +120,13 @@ void FirebaseCredentialsProvider::GetToken(bool force_refresh,
         }
       };
 
-  [contents_->app getTokenForcingRefresh:force_refresh
+  [contents_->app getTokenForcingRefresh:contents_->force_refresh
                             withCallback:get_token_callback];
+  contents_->force_refresh = false;
+}
+
+void FirebaseCredentialsProvider::InvalidateToken() {
+  contents_->force_refresh = true;
 }
 
 void FirebaseCredentialsProvider::SetUserChangeListener(