xamarin / GoogleApisForiOSComponents

MIT License
225 stars 161 forks source link

iOS apps using FireAuth will not be approved for publishing due to not meeting token revocation requirement #625

Open derekvantonder opened 1 year ago

derekvantonder commented 1 year ago

First of all, a big thank you to @dmariogatto, @bholmes, @SotoiGhost and @robinryf for creating this excellent project, it has helped me a lot in developing my Xamarin app.

Unfortunately, any app using FireAuth from this SDK will fail Apple's certification and will not be able to be placed in the App Store.

Why? Because Apple now requires all apps that use Sign In With Apple (which is ALSO required to be present) to let users delete the user's Apple user account. That doesn't mean deleting the FireAuth account, that means to revoke the user's Apple token using a complex process that involves using the Sign in with Apple REST API. The process is shown here: https://github.com/jooyoungho/apple-token-revoke-in-firebase

From what I can see, this is fixed in the latest version of the Google iOS FireAuth SDK: https://github.com/firebase/firebase-ios-sdk/issues/9906#issuecomment-1516867126

Here is the official Google doc mentioning how it should be done in the latest iOS FireAuth SDK: https://firebase.google.com/docs/auth/ios/apple#token_revocation

The specific API is 'revokeToken': https://github.com/firebase/firebase-ios-sdk/blob/2e7eecd7a0f8b65ae2833cdc1da0591732cd1eed/FirebaseAuth/Sources/Auth/FIRAuth.m#L1775

However this repository uses an older version of the SDK (as far as I can see), so our apps will still fail App Store certification.

Would be great if we could see a newer version of the Google iOS FireAuth SDK updated in this repo so that we can get our apps published.

Thank you.