fix(fac): Use v1beta endpoint for verifyAppCheckToken

Updated _AppCheckService._VERIFY_URL_FORMAT to point to the v1beta endpoint (https://firebaseappcheck.googleapis.com/v1beta/projects/{project_id}:verifyAppCheckToken) for replay protection verification.

Author: lahirumaramba

firebase_admin/app_check.py

@@ -54,7 +54,7 @@ class _AppCheckService:
     _APP_CHECK_ISSUER = 'https://firebaseappcheck.googleapis.com/'
     _JWKS_URL = 'https://firebaseappcheck.googleapis.com/v1/jwks'
     _VERIFY_URL_FORMAT = (
-        'https://firebaseappcheck.googleapis.com/v1/projects/{project_id}:verifyAppCheckToken'
+        'https://firebaseappcheck.googleapis.com/v1beta/projects/{project_id}:verifyAppCheckToken'
     )
     _project_id = None
     _scoped_project_id = None

tests/test_app_check.py

@@ -319,7 +319,7 @@ def test_verify_token_with_consume_true_not_consumed(self, mocker):
         assert payload == expected
 
         expected_url = (
-            f"https://firebaseappcheck.googleapis.com/v1/projects/{PROJECT_ID}:verifyAppCheckToken"
+            f"https://firebaseappcheck.googleapis.com/v1beta/projects/{PROJECT_ID}:verifyAppCheckToken"
         )
         mock_body.assert_called_once_with(
             "post", expected_url, json={"app_check_token": "encoded"}
@@ -340,7 +340,7 @@ def test_verify_token_with_consume_true_already_consumed(self, mocker):
         assert payload == expected
 
         expected_url = (
-            f"https://firebaseappcheck.googleapis.com/v1/projects/{PROJECT_ID}:verifyAppCheckToken"
+            f"https://firebaseappcheck.googleapis.com/v1beta/projects/{PROJECT_ID}:verifyAppCheckToken"
         )
         mock_body.assert_called_once_with(
             "post", expected_url, json={"app_check_token": "encoded"}