Fix error handling when fetching fresh token in App Check

[nermeen-mattar]

Fixes #8822

Issue:

When calling Firebase App Check’s getToken with forceRefresh: true while a cached token exists, if fetching a new token failed, the error is stored in internalError but not returned or thrown to third-party callers. This leads to silent failures, causing the function to return a cached token instead of propagating the error.

Impact:

This misleads the caller, who has no clue that the cached token was returned instead of a new one, preventing proper error handling. While the cached token may still be valid, forceRefresh is intended to fetch a new token, making this behavior inconsistent with its purpose.

Fix:

Now, when forceRefresh is true, the function returns both the error and token, ensuring failure is recognized.

Why This is Correct:

This aligns with the expected behavior—if forceRefresh is requested, failures should be surfaced, not masked.

Benefit:

Allows third-party apps to handle errors properly and take proper corrective actions.

[changeset-bot]

🦋 Changeset detected

Latest commit: f4e1391

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@firebase/app-check	Minor
@firebase/app-check-compat	Patch
firebase	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[hsubox76]

Thanks for looking into this bug, but taking a different approach to solving it with #8842