Skip to content

dataconnect(change): Use SecureRandom when generating internal operation IDs#7910

Merged
dconeybe merged 5 commits into
mainfrom
dconeybe/dataconnect/RequestIdSecureRandom
Mar 16, 2026
Merged

dataconnect(change): Use SecureRandom when generating internal operation IDs#7910
dconeybe merged 5 commits into
mainfrom
dconeybe/dataconnect/RequestIdSecureRandom

Conversation

@dconeybe

@dconeybe dconeybe commented Mar 13, 2026

Copy link
Copy Markdown
Contributor

This PR updates the firebase-dataconnect module to use SecureRandom to generate internal operation IDs. Previously, standard random number generation was used for request IDs; this change passes a lazily created SecureRandom instance down through core implementation classes like MutationRefImpl and LiveQuery to improve randomness and security. Additionally, the PR adds new arbitrary utilities to support injecting SecureRandom instances for comprehensive property-based testing.

Highlights

  • Secure Random IDs: Switched to using a lazily-initialized SecureRandom instance for generating requestId values in MutationRefImpl and LiveQuery.
  • Centralized Instantiation: Updated FirebaseDataConnectFactory to manage and reuse a single SecureRandom instance, passing it down to necessary core components.
  • Testing Improvements: Introduced new Kotest arbitrary data generators (RandomArb, RandomSeed, RandomSourceArb) to reliably inject randomized seeds and instances during property-based testing.
Changelog
  • CHANGELOG.md
    • Added an entry to document the internal change to use SecureRandom for operation IDs.
  • FirebaseDataConnectFactory.kt
    • Updated to lazily instantiate a SecureRandom object and supply it when creating FirebaseDataConnect instances.
  • FirebaseDataConnectImpl.kt
    • Accepted secureRandom in the constructor and passed it down to LiveQuery and MutationRefImpl initializations.
  • MutationRefImpl.kt
    • Updated execute() to use secureRandom for request ID generation via a new randomRequestId() internal method.
  • LiveQuery.kt
    • Updated start() to generate request IDs using the provided secureRandom.
  • FirebaseDataConnectImplUnitTest.kt
    • Modified to provide a Random instance to the FirebaseDataConnectImpl constructor for testing.
  • MutationRefImplUnitTest.kt
    • Added unit tests to ensure that randomRequestId() respects the injected secureRandom object.
  • arbs.kt
    • Updated mutationRefImpl Kotest generators to support providing a Random instance.
  • RandomArb.kt
    • New file providing an Arb utility to generate Random instances for property testing.
  • RandomSeed.kt
    • New file providing an Arb utility to generate suitable long values for random seed generation.
  • RandomSourceArb.kt
    • New file providing an Arb utility to generate RandomSource instances for seeded property tests.

@gemini-code-assist

Copy link
Copy Markdown
Contributor
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

@dconeybe

Copy link
Copy Markdown
Contributor Author

/gemini review

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request correctly replaces the default Random with SecureRandom for generating internal operation IDs, which enhances security. The changes are consistently applied across the relevant classes, and the tests are updated to reflect this. I have one suggestion to optimize the instantiation of SecureRandom for better performance.

@github-actions

github-actions Bot commented Mar 13, 2026

Copy link
Copy Markdown
Contributor

📝 PRs merging into main branch

Our main branch should always be in a releasable state. If you are working on a larger change, or if you don't want this change to see the light of the day just yet, consider using a feature branch first, and only merge into the main branch when the code complete and ready to be released.

@dconeybe dconeybe marked this pull request as ready for review March 13, 2026 20:38
aashishpatil-g
aashishpatil-g previously approved these changes Mar 13, 2026
@dconeybe dconeybe merged commit ca90e16 into main Mar 16, 2026
43 checks passed
@dconeybe dconeybe deleted the dconeybe/dataconnect/RequestIdSecureRandom branch March 16, 2026 15:31
@firebase firebase locked and limited conversation to collaborators Apr 15, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants