Remove fiam scope tokens (#11361)

Getting rid of "fiam" scoped tokens which are cached in keychain by old FIAM SDK.

Author: eldhosembabu

FirebaseMessaging/CHANGELOG.md

@@ -1,3 +1,6 @@
+# 10.12.0
+- [changed] Removing fiam scoped tokens set by old FIAM SDK(s) from keychain if exisits (b/284207019).
+
 # 10.6.0
 - [fixed] Configure flow validates existence of an APNS token before fetching an FCM token (#10742). This also addresses the scenario 1 mentioned in the comment - https://github.com/firebase/firebase-ios-sdk/issues/10679#issuecomment-1402776795
 

FirebaseMessaging/Sources/FIRMessagingConstants.h

@@ -59,6 +59,8 @@ FOUNDATION_EXPORT NSString *const kFIRMessaging_CMD_RST;
 FOUNDATION_EXPORT NSString *const kFIRMessagingAllScopeIdentifier;
 /// The scope used to save the IID "*" scope token.
 FOUNDATION_EXPORT NSString *const kFIRMessagingDefaultTokenScope;
+/// Denylisted "fiam" token scope.
+FOUNDATION_EXPORT NSString *const kFIRMessagingFIAMTokenScope;
 
 /// Subdirectory in search path directory to store InstanceID preferences.
 FOUNDATION_EXPORT NSString *const kFIRMessagingInstanceIDSubDirectoryName;

FirebaseMessaging/Sources/FIRMessagingConstants.m

@@ -67,6 +67,7 @@
 // Miscellaneous
 NSString *const kFIRMessagingAllScopeIdentifier = @"iid-all";
 NSString *const kFIRMessagingDefaultTokenScope = @"*";
+NSString *const kFIRMessagingFIAMTokenScope = @"fiam";
 NSString *const kFIRMessagingInstanceIDSubDirectoryName = @"Google/FirebaseInstanceID";
 
 // Registration Options

FirebaseMessaging/Sources/Token/FIRMessagingTokenInfo.m

@@ -81,6 +81,10 @@ - (BOOL)isFreshWithIID:(NSString *)IID {
     return NO;
   }
 
+  if ([self hasDenylistedScope]) {
+    return NO;
+  }
+
   // Check if app has just been updated to a new version.
   NSString *currentAppVersion = FIRMessagingCurrentAppVersion();
   if (!_appVersion || ![_appVersion isEqualToString:currentAppVersion]) {
@@ -115,6 +119,16 @@ - (BOOL)isFreshWithIID:(NSString *)IID {
   return (timeSinceLastFetchToken < kDefaultFetchTokenInterval);
 }
 
+- (BOOL)hasDenylistedScope {
+  /// The token with fiam scope is set by old FIAM SDK(s) which will remain in keychain for ever. So
+  /// we need to remove these tokens to deny its usage.
+  if ([self.scope isEqualToString:kFIRMessagingFIAMTokenScope]) {
+    return YES;
+  }
+
+  return NO;
+}
+
 - (BOOL)isDefaultToken {
   return [self.scope isEqualToString:kFIRMessagingDefaultTokenScope];
 }