Flutter启用AppCheck PlayIntegrity时出现Firestore权限拒绝问题

近几日在Flutter项目中尝试用AndroidProvider.playIntegrity配置Firebase AppCheck，始终碰到权限错误。Firestore已强制启用AppCheck，用AndroidProvider.debug（添加调试令牌后）一切正常，但关闭调试模式就出问题。

错误日志 #

W/Firestore( 5050): (24.4.1) [Firestore]: Listen for Query(target=Query(users/abc123/foo order by __name__);limitType=LIMIT_TO_FIRST) failed: Status{code=PERMISSION_DENIED, description=Missing or insufficient permissions., cause=null}
W/Firestore( 5050): (24.4.1) [Firestore]: Listen for Query(target=Query(users/abc123 order by __name__);limitType=LIMIT_TO_FIRST) failed: Status{code=PERMISSION_DENIED, description=Missing or insufficient permissions., cause=null}

相关代码 #

main.dart代码 #

WidgetsFlutterBinding.ensureInitialized();
await Firebase.initializeApp();

// Trying to use AndroidProvider.playIntegrity
await FirebaseAppCheck.instance.activate();

// Works fine in debug
// await FirebaseAppCheck.instance.activate(
//   androidProvider: AndroidProvider.debug
// );

android/app/build.gradle配置 #

def localProperties = new Properties()
def localPropertiesFile = rootProject.file('local.properties')
if (localPropertiesFile.exists()) {
    localPropertiesFile.withReader('UTF-8') { reader ->
        localProperties.load(reader)
    }
}

def flutterRoot = localProperties.getProperty('flutter.sdk')
if (flutterRoot == null) {
    throw new GradleException("Flutter SDK not found. Define location with flutter.sdk in the local.properties file.")
}

def flutterVersionCode = localProperties.getProperty('flutter.versionCode')
if (flutterVersionCode == null) {
    flutterVersionCode = '1'
}

def flutterVersionName = localProperties.getProperty('flutter.versionName')
if (flutterVersionName == null) {
    flutterVersionName = '1.0'
}

apply plugin: 'com.android.application'
apply plugin: 'kotlin-android'
apply plugin: 'com.google.gms.google-services'
apply from: "$flutterRoot/packages/flutter_tools/gradle/flutter.gradle"

def keystoreProperties = new Properties()
def keystorePropertiesFile = rootProject.file('key.properties')
if (keystorePropertiesFile.exists()) {
    keystoreProperties.load(new FileInputStream(keystorePropertiesFile))
}

android {
    compileSdkVersion 33
    ndkVersion flutter.ndkVersion

    compileOptions {
        sourceCompatibility JavaVersion.VERSION_1_8
        targetCompatibility JavaVersion.VERSION_1_8
    }

    kotlinOptions {
        jvmTarget = '1.8'
    }

    sourceSets {
        main.java.srcDirs += 'src/main/kotlin'
    }

    defaultConfig {
        // TODO: Specify your own unique Application ID (https://developer.android.com/studio/build/application-id.html).
        applicationId "com.foo.bar"
        // You can update the following values to match your application needs.
        // For more information, see: https://docs.flutter.dev/deployment/android#reviewing-the-build-configuration.
        minSdkVersion 26
        targetSdkVersion 31
        versionCode flutterVersionCode.toInteger()
        versionName flutterVersionName
    }

    signingConfigs {
        release {
            keyAlias keystoreProperties['keyAlias']
            keyPassword keystoreProperties['keyPassword']
            storeFile keystoreProperties['storeFile'] ? file(keystoreProperties['storeFile']) : null
            storePassword keystoreProperties['storePassword']
        }
    }
    buildTypes {
        release {
            signingConfig signingConfigs.release
        }
    }
}

flutter {
    source '../..'
}

dependencies {
    implementation "org.jetbrains.kotlin:kotlin-stdlib-jdk8:$kotlin_version"
    implementation platform('com.google.firebase:firebase-bom:31.1.1')
    implementation 'com.google.firebase:firebase-analytics'

    // Tried enabling this but nothing really happened
    // implementation 'com.google.firebase:firebase-appcheck-playintegrity'

    // Facebook
    implementation 'com.facebook.android:facebook-android-sdk:latest.release'

    // flutter_local_notifications
    coreLibraryDesugaring("com.android.tools:desugar_jdk_libs:1.0.4")
}

Firestore规则（开发环境） #

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
  
    function isAuth() {
      return request.auth != null;
    }
    
    function isDev() {
      return isAuth() && request.auth.token.email in [
        'testemail@gmail.com'
      ];
    }

    match /{document=**} {
      allow read, write: if isDev();
    }
  }
}

已尝试操作 #

• 曾怀疑缺少依赖，在build.gradle中添加implementation 'com.google.firebase:firebase-appcheck-playintegrity'，无效果后注释该行
• 上传Alpha版本至Play Console，审核通过后下载应用，仍无法连接Firestore
• 已在项目设置和AppCheck PlayIntegrity中配置调试证书、Play Console应用签名密钥及上传密钥的SHA-256指纹

疑问 #

compileSdkVersion设置为33，targetSdkVersion设置为31，这两个版本是否需要保持一致？

内容的提问来源于stack exchange，提问作者enchance