AppCheck token(forcingRefresh: true) returns cached token if token(forcingRefresh: false) in progress

[andrewheard]

Calls to token(forcingRefresh:) with forcingRefresh: true may return a cached token if a call is already in progress where forcingRefresh: false. This may be as simple as adding || forcingRefresh to if (self.ongoingRetrieveOrRefreshTokenPromise == nil) (see below) but needs testing.

app-check/AppCheckCore/Sources/Core/GACAppCheck.m

Lines 138 to 153 in 5746b2d

	if (self.ongoingRetrieveOrRefreshTokenPromise == nil) {
	// Kick off a new operation only when there is not an ongoing one.
	self.ongoingRetrieveOrRefreshTokenPromise =
	[self createRetrieveOrRefreshTokenPromiseForcingRefresh:forcingRefresh]
	// Release the ongoing operation promise on completion.
	.then(^GACAppCheckToken *(GACAppCheckToken *token) {
	self.ongoingRetrieveOrRefreshTokenPromise = nil;
	return token;
	})
	.recover(^NSError *(NSError *error) {
	self.ongoingRetrieveOrRefreshTokenPromise = nil;
	return error;
	});
	}
	return self.ongoingRetrieveOrRefreshTokenPromise;

Note: this issue isn't new (already exists in FirebaseAppCheck 10.17.0) but the code has moved to this repo.