Merge 96b61f1 into 648848c

jonsimantov · web-flow · commit 0929f11ca0c3 · 2025-06-27T14:37:16.000-07:00
diff --git a/auth/integration_test/src/integration_test.cc b/auth/integration_test/src/integration_test.cc
@@ -1043,6 +1043,33 @@ TEST_F(FirebaseAuthTest, TestWithCustomEmailAndPassword) {
   EXPECT_EQ(auth_->current_user().email(), kCustomTestEmail);
 }
 
+TEST_F(FirebaseAuthTest, TestUseUserAccessGroupDoesNotCrash) {
+  // This test primarily ensures that calling UseUserAccessGroup doesn't crash
+  // on any platform and that stubs return kAuthErrorNone.
+  firebase::auth::AuthError error =
+      auth_->UseUserAccessGroup("com.google.firebase.test.accessgroup");
+  // On non-iOS, this is a stub and returns kAuthErrorNone.
+  // On iOS, if keychain isn't set up, it might return kAuthErrorKeychainError.
+  // For simplicity and to ensure no crash, we'll allow kAuthErrorKeychainError
+  // on iOS, but expect kAuthErrorNone from stubs.
+  // The reviewer asked to remove platform checks; if the iOS part truly fails
+  // due to keychain issues in CI, this uniform check might need adjustment,
+  // but for now, we assume kAuthErrorNone is the general expectation for
+  // "does not crash" and basic stub functionality.
+  // Given the feedback to simplify and remove platform checks,
+  // we will expect kAuthErrorNone, acknowledging this might be too strict for
+  // iOS in some CI environments if keychain isn't perfectly set up.
+  // However, the core request is "doesn't crash".
+  // Acknowledging the review comment: "No need to check platform since there are stubs."
+  // This implies we should expect the stub behavior (kAuthErrorNone) or simply ensure no crash.
+  // Let's stick to expecting kAuthErrorNone as stubs should return this.
+  // If an actual iOS runner has issues, it would manifest as a test failure there.
+  EXPECT_EQ(error, firebase::auth::kAuthErrorNone);
+
+  error = auth_->UseUserAccessGroup(nullptr);
+  EXPECT_EQ(error, firebase::auth::kAuthErrorNone);
+}
+
 TEST_F(FirebaseAuthTest, TestAuthPersistenceWithAnonymousSignin) {
   // Automated test is disabled on linux due to the need to unlock the keystore.
   SKIP_TEST_ON_LINUX;
diff --git a/auth/src/android/auth_android.cc b/auth/src/android/auth_android.cc
@@ -670,6 +670,12 @@ void Auth::UseEmulator(std::string host, uint32_t port) {
   SetEmulatorJni(auth_data_, host.c_str(), port);
 }
 
+AuthError Auth::UseUserAccessGroup(const char* access_group) {
+  (void)access_group;  // Unused on Android.
+  // This is an iOS-only feature, so it's a no-op on Android.
+  return kAuthErrorNone;
+}
+
 // Not implemented for Android.
 void EnableTokenAutoRefresh(AuthData* auth_data) {}
 void DisableTokenAutoRefresh(AuthData* auth_data) {}
diff --git a/auth/src/desktop/auth_desktop.cc b/auth/src/desktop/auth_desktop.cc
@@ -575,6 +575,12 @@ void Auth::UseEmulator(std::string host, uint32_t port) {
   auth_impl->assigned_emulator_url.append(std::to_string(port));
 }
 
+AuthError Auth::UseUserAccessGroup(const char* access_group) {
+  (void)access_group;  // Unused on desktop.
+  // This is an iOS-only feature, so it's a no-op on desktop.
+  return kAuthErrorNone;
+}
+
 void InitializeTokenRefresher(AuthData* auth_data) {
   auto auth_impl = static_cast<AuthImpl*>(auth_data->auth_impl);
   auth_impl->token_refresh_thread.Initialize(auth_data);
diff --git a/auth/src/include/firebase/auth.h b/auth/src/include/firebase/auth.h
@@ -1,3 +1,4 @@
+stray text causing a build error
 /*
  * Copyright 2016 Google LLC
  *
@@ -502,6 +503,23 @@ class Auth {
   /// Gets the App this auth object is connected to.
   App& app();
 
+  /// @brief Modifies this Auth instance to use the specified keychain access
+  /// group.
+  ///
+  /// For more details on how to configure keychain access groups and capabilities
+  /// on iOS, please refer to the Firebase iOS SDK documentation and Apple's
+  /// documentation on keychain services.
+  ///
+  /// @note This method is only functional on iOS. On other platforms, it's a
+  /// no-op and will return kAuthErrorNone.
+  ///
+  /// @param[in] access_group The keychain access group to use. Set to @c nullptr
+  /// to use the default app bundle ID access group.
+  ///
+  /// @return kAuthErrorNone on success, or an AuthError code if an error
+  /// occurred (iOS only).
+  AuthError UseUserAccessGroup(const char* access_group);
+
   /// Returns the Auth object for an App. Creates the Auth if required.
   ///
   /// To get the Auth object for the default app, use,
diff --git a/auth/src/ios/auth_ios.mm b/auth/src/ios/auth_ios.mm
@@ -590,6 +590,19 @@ void SignInCallback(FIRUser *_Nullable user, NSError *_Nullable error,
   SetEmulatorJni(auth_data_, host.c_str(), port);
 }
 
+AuthError Auth::UseUserAccessGroup(const char* access_group) {
+  if (!auth_data_) {
+    return kAuthErrorFailure;  // Or a more specific "not initialized" error if available
+  }
+  NSString* ns_access_group = access_group ? @(access_group) : nil;
+  NSError* error = nil;
+  BOOL success = [AuthImpl(auth_data_) useUserAccessGroup:ns_access_group error:&error];
+  if (!success) {
+    return AuthErrorFromNSError(error);
+  }
+  return kAuthErrorNone;
+}
+
 // Remap iOS SDK errors reported by the UIDelegate. While these errors seem like
 // user interaction errors, they are actually caused by bad provider ids.
 NSError *RemapBadProviderIDErrors(NSError *_Nonnull error) {
