Firebase App Check warnings in the app on registration time

[AsadAli93916]

“No AppCheckProvider installed. Using placeholder token instead.”This means App Check is not configured yet. Right now it’s only a warning and not breaking functionality, but it affects Firebase Storage security (e.g. profile image uploads) and may cause issues if enforced later.
Required action:
We need to enable Firebase App Check from Firebase Console and set it up in the Flutter app.
What needs to be done:

Enable App Check in Firebase Console (preferably Play Integrity)
Keep it in Monitoring mode first (not enforce)
Add Flutter initialization in app (FirebaseAppCheck.instance.activate(...))

[CherryCIC]

Firebase App Check — Implementation Plan

I've investigated the current state and have everything ready. Here's the full breakdown:

---

What I found

• Firebase Console: App Check is fully unregistered — all 5 apps (cherry Android production, cherry_mvp android, cherry iOS production, cherry_mvp ios, cherry_mvp web) show as Unregistered with no attestation provider
• Flutter code: firebase_app_check package is not in pubspec.yaml and FirebaseAppCheck.instance.activate() is not called anywhere in the codebase
• google-services.json: No SHA-256 fingerprint is registered — only SHA-1s exist in project settings

---

Step 1: Get the SHA-256 fingerprint (ACTION REQUIRED — needs Play Console access)

Play Integrity requires the SHA-256 of the production signing certificate. Since the app uses Google Play App Signing:

1. Go to Google Play Console → Cherry app → Setup → App integrity
2. Under App signing key certificate, copy the SHA-256 certificate fingerprint
3. Also add this SHA-256 to Firebase Project Settings → Your apps → cherry Android production → SHA certificate fingerprints

---

Step 2: Register apps in Firebase App Check Console

Go to Firebase Console → App Check → Apps

Android (cherry Android production — uk.org.cherry.app):

• Click Register → select Play Integrity
• Enter the SHA-256 from Step 1
• Token TTL: leave as 1 hour
• Click Save
• Status will show Monitoring (not Enforced) — leave it there for now ✅

iOS (cherry iOS production — uk.org.cherry.app):

• Click Register → select App Attest
• Token TTL: leave as 1 hour
• Click Save
• Status: Monitoring ✅

Skip registering com.example.cherry_mvp (android) and com.cherrymvp.cherry (ios) — those are dev/example package names and shouldn't be in production App Check.

---

Step 3: Flutter code changes

pubspec.yaml — add under dependencies (compatible with firebase_core: ^4.10.0):

firebase_app_check: ^0.3.2+2

lib/main.dart — add import at top:

import 'package:firebase_app_check/firebase_app_check.dart';

Then add App Check activation after Firebase.initializeApp() and before _configureFirebaseEmulators():

await Firebase.initializeApp();

// Activate App Check — use Debug provider in debug builds, Play Integrity in release
await FirebaseAppCheck.instance.activate(
  androidProvider: kDebugMode 
      ? AndroidProvider.debug 
      : AndroidProvider.playIntegrity,
  appleProvider: kDebugMode 
      ? AppleProvider.debug 
      : AppleProvider.appAttest,
);

await _configureFirebaseEmulators();

Also add kDebugMode import if not already present:

import 'package:flutter/foundation.dart';

---

Step 4: Debug token for local development

When running in debug mode, App Check generates a debug token that you need to register in Firebase Console so local dev still works:

1. Run the app in debug mode — look for a log line like:
   D/FirebaseAppCheck: Debug App Check token: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
2. Go to Firebase Console → App Check → Apps
3. Click the 3-dot menu (⋮) next to the Android app → Manage debug tokens
4. Add the token from the log
5. Repeat for iOS

---

Step 5: DO NOT enforce yet

Leave all apps in Monitoring mode until:

• You've confirmed the App Check dashboard shows legitimate traffic
• All team members have debug tokens registered
• At least 1–2 weeks of monitoring data confirms no false rejections

To enforce later: Firebase Console → App Check → APIs tab → toggle enforcement on for each service (Firestore, Storage, etc.)

---

Summary of files to change

File	Change
pubspec.yaml	Add firebase_app_check: ^0.3.2+2
lib/main.dart	Add import + FirebaseAppCheck.instance.activate(...) after Firebase.initializeApp()

I'll raise a PR with the Flutter code changes. The Firebase Console registration (Steps 1–2) needs someone with Play Console access to get the SHA-256 first.