feat(firebase_app_check,windows): add custom App Check provider support

[lukemmtt]

Summary

Adds custom App Check provider support for Windows, addressing the custom-provider part of issue 12227. Combined with the debug provider from PR 18140, this allows Flutter Windows apps to meet Firebase App Check enforcement for Firestore, Functions, Storage, Auth, and Realtime Database.

Specifically, this PR adds the FlutterFire plumbing (Pigeon bridge and Windows plugin wiring) that exposes the Firebase C++ SDK's custom-provider interface to Flutter developers. With this infrastructure, Flutter apps on Windows can supply App Check tokens by implementing a custom Dart handler. That handler is the integration point any Windows attestation (TPM hardware attestation, Microsoft Store licensing, Azure Attestation, or an auth-backed token minted by a Cloud Function) needs to feed App Check.

Usage

Activate the provider alongside existing platform providers and register your handler to supply fresh tokens:

await FirebaseAppCheck.instance.activate(
  providerWindows: const WindowsCustomProvider(),
);

FirebaseAppCheckFlutterApi.setUp(MyWindowsHandler());

class MyWindowsHandler implements FirebaseAppCheckFlutterApi {
  @override
  Future<CustomAppCheckToken> getCustomToken() async {
    final result = await myBackend.mintAppCheckToken();
    return CustomAppCheckToken(
      token: result.token,
      expireTimeMillis: result.expireTimeMillis,
    );
  }
}

The Firebase SDK will automatically attach tokens from this handler to subsequent Firebase backend requests.

Design notes

The public Flutter API follows existing naming conventions (providerWindows), aligning with providerAndroid and providerApple. The shared Pigeon activate API includes a corresponding optional windowsProvider parameter.

CustomAppCheckToken includes both the token string and its absolute expiry in Unix epoch milliseconds. Returning the expiry from Dart lets consumer backends pick arbitrary TTLs (short for stricter posture, longer for fewer round trips) without the plugin hardcoding a refresh window.

Currently, GetLimitedUseAppCheckToken delegates to GetAppCheckToken(false) because the Firebase C++ SDK does not yet offer a dedicated limited-use token method. Regular App Check enforcement is unaffected; only replay-protection scenarios see this fallback behavior. This path can transition once the SDK supports limited-use tokens.

References

• Firebase C++ App Check
• Android limited-use token reference

[gemini-code-assist]

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

[SelaseKay]

Hey @lukemmtt, thanks for the contribution. Could you please add tests to cover this change?

[lukemmtt]

Will do, thanks for the reminder @SelaseKay 🙏🏻