App check debug token (GoogleCloudPlatform#9930)

* App check debug token

* Make app_id a parameter instead of a virtual field. It seems virtual fields are all forced optional.

* Add update displayName test

* Use api_name and identity to wire up debugTokenId

mmv1/products/firebaseappcheck/DebugToken.yaml

@@ -0,0 +1,90 @@
+# Copyright 2024 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+---
+!ruby/object:Api::Resource
+name: "DebugToken"
+base_url: projects/{{project}}/apps/{{app_id}}/debugTokens
+self_link: projects/{{project}}/apps/{{app_id}}/debugTokens/{{debug_token_id}}
+update_verb: :PATCH
+update_mask: true
+identity:
+  - debugTokenId
+description: |
+  A debug token is a secret used during the development or integration testing of
+  an app. It essentially allows the development or integration testing to bypass
+  app attestation while still allowing App Check to enforce protection on supported
+  production Firebase services.
+references: !ruby/object:Api::Resource::ReferenceLinks
+  guides:
+    "Official Documentation": "https://firebase.google.com/docs/app-check"
+  api: "https://firebase.google.com/docs/reference/appcheck/rest/v1/projects.apps.debugTokens"
+import_format:
+  [
+    "projects/{{project}}/apps/{{app_id}}/debugTokens/{{debug_token_id}}",
+    "{{project}}/{{app_id}}/{{debug_token_id}}",
+    "{{app_id}}/{{debug_token_id}}",
+  ]
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: "firebase_app_check_debug_token_basic"
+    # Need the time_sleep resource
+    pull_external: true
+    primary_resource_id: "default"
+    vars:
+      display_name: "Debug Token"
+      token: "00000000-AAAA-BBBB-CCCC-000000000000"
+    test_vars_overrides:
+      # Don't add prefix. This string is a random UUID4
+      token: "\"5E728315-E121-467F-BCA1-1FE71130BB98\""
+    test_env_vars:
+      project_id: :PROJECT_NAME
+parameters:
+  - !ruby/object:Api::Type::String
+    name: app_id
+    description: |
+      The ID of a
+      [Web App](https://firebase.google.com/docs/reference/firebase-management/rest/v1beta1/projects.webApps#WebApp.FIELDS.app_id),
+      [Apple App](https://firebase.google.com/docs/reference/firebase-management/rest/v1beta1/projects.iosApps#IosApp.FIELDS.app_id),
+      or [Android App](https://firebase.google.com/docs/reference/firebase-management/rest/v1beta1/projects.androidApps#AndroidApp.FIELDS.app_id)
+    required: true
+    immutable: true
+    url_param_only: true
+properties:
+  - !ruby/object:Api::Type::String
+    name: debugTokenId
+    api_name: name
+    description: |
+      The last segment of the resource name of the debug token.
+    output: true
+    custom_flatten: templates/terraform/custom_flatten/name_from_self_link.erb
+  - !ruby/object:Api::Type::String
+    name: displayName
+    description: |
+      A human readable display name used to identify this debug token.
+    required: true
+  - !ruby/object:Api::Type::String
+    name: token
+    description: |
+      The secret token itself. Must be provided during creation, and must be a UUID4,
+      case insensitive. You may use a method of your choice such as random/random_uuid
+      to generate the token.
+
+      This field is immutable once set, and cannot be updated. You can, however, delete
+      this debug token to revoke it.
+
+      For security reasons, this field will never be populated in any response.
+    required: true
+    immutable: true
+    sensitive: true
+    ignore_read: true

mmv1/templates/terraform/examples/firebase_app_check_debug_token_basic.tf.erb

@@ -0,0 +1,20 @@
+resource "google_firebase_web_app" "default" {
+  project = "<%= ctx[:test_env_vars]['project_id'] %>"
+  display_name = "Web App for debug token"
+}
+
+# It takes a while for App Check to recognize the new app
+# If your app already exists, you don't have to wait 30 seconds.
+resource "time_sleep" "wait_30s" {
+  depends_on = [google_firebase_web_app.default]
+  create_duration = "30s"
+}
+
+resource "google_firebase_app_check_debug_token" "default" {
+  project      = "<%= ctx[:test_env_vars]['project_id'] %>"
+  app_id       = google_firebase_web_app.default.app_id
+  display_name = "<%= ctx[:vars]['display_name'] %>"
+  token        = "<%= ctx[:vars]['token'] %>"
+
+  depends_on = [time_sleep.wait_30s]
+}

mmv1/third_party/terraform/services/firebaseappcheck/resource_firebase_app_check_debug_token_test.go

@@ -0,0 +1,81 @@
+package firebaseappcheck_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+)
+
+func TestAccFirebaseAppCheckDebugToken_firebaseAppCheckDebugTokenUpdate(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"project_id":   envvar.GetTestProjectFromEnv(),
+		"display_name": "Debug Token 1",
+		"token":        "5E728315-E121-467F-BCA1-1FE71130BB98",
+	}
+
+	contextUpdated := map[string]interface{}{
+		"project_id":   envvar.GetTestProjectFromEnv(),
+		"display_name": "Debug Token 2",
+		"token":        "5E728315-E121-467F-BCA1-1FE71130BB98",
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		ExternalProviders: map[string]resource.ExternalProvider{
+			"random": {},
+			"time":   {},
+		},
+		CheckDestroy: testAccCheckFirebaseAppCheckDebugTokenDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccFirebaseAppCheckDebugToken_firebaseAppCheckDebugTokenTemplate(context),
+			},
+			{
+				ResourceName:            "google_firebase_app_check_debug_token.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"token", "app_id"},
+			},
+			{
+				Config: testAccFirebaseAppCheckDebugToken_firebaseAppCheckDebugTokenTemplate(contextUpdated),
+			},
+			{
+				ResourceName:            "google_firebase_app_check_debug_token.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"token", "app_id"},
+			},
+		},
+	})
+}
+
+func testAccFirebaseAppCheckDebugToken_firebaseAppCheckDebugTokenTemplate(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_firebase_web_app" "default" {
+  project = "%{project_id}"
+  display_name = "Web App for debug token"
+}
+
+# It takes a while for App Check to recognize the new app
+# If your app already exists, you don't have to wait 30 seconds.
+resource "time_sleep" "wait_30s" {
+  depends_on = [google_firebase_web_app.default]
+  create_duration = "30s"
+}
+
+resource "google_firebase_app_check_debug_token" "default" {
+  project      = "%{project_id}"
+  app_id       = google_firebase_web_app.default.app_id
+  display_name = "%{display_name}"
+  token        = "%{token}"
+
+  depends_on = [time_sleep.wait_30s]
+}
+`, context)
+}