Cheatsheet

# ===== Which product for which job =====
# Auth                user identities, MFA, OAuth providers, phone auth
# Firestore           document DB, real-time, offline-friendly client SDK
# Realtime Database   smaller, simpler tree; best for very high write rates
# Cloud Storage       binary blobs (images, video), signed URLs
# Cloud Functions     event triggers, REST endpoints, scheduled jobs
# Hosting             static + serverless front end with global CDN
# Crashlytics         crash + non-fatal reporting (mobile/web)
# Analytics           event-based product analytics, BigQuery export
# Remote Config       feature flags + dynamic config without redeploy
# App Check           bot / scraper / SSRF defence on Auth + Firestore

# ===== Firestore data modelling =====
# - Document = JSON of small size (max 1 MB, prefer < 100 KB)
# - Collections nest naturally; references via document path
# - Composite indexes are AUTO-suggested on first query that needs them
# - Lists of small bounded items embed; unbounded lists -> sub-collection
# - Many-to-many: separate collection of edges with composite key

# ===== Security rules cheat sheet =====
# rules.firestore
# rules_version = '2';
# service cloud.firestore {
#   match /databases/{database}/documents {

#     // Per-user CRUD on /tasks/{id}
#     match /tasks/{id} {
#       allow read, update, delete: if request.auth != null
#                                   && resource.data.uid == request.auth.uid;
#       allow create:               if request.auth != null
#                                   && request.resource.data.uid == request.auth.uid;
#     }

#     // Admin-only collection
#     match /admin/{id} {
#       allow read, write: if request.auth.token.role == 'admin';
#     }

#     // Validate shape of writes
#     match /comments/{id} {
#       allow create: if request.auth != null
#                     && request.resource.data.keys().hasOnly(['uid','body','postId','createdAt'])
#                     && request.resource.data.body is string
#                     && request.resource.data.body.size() <= 2000;
#     }
#   }
# }

# ===== Cost levers =====
# - Cache reads with the client SDK; offline persistence cuts reads
# - Use queries with limit + cursor instead of full-collection reads
# - Cloud Functions: cold starts are expensive; prefer minInstances=1 for hot paths
# - Crashlytics is free; Analytics is free; both export to BigQuery (priced)
# - Hosting: bandwidth is metered; configure long cache + Brotli to win this

# ===== Local development with the emulator =====
firebase init emulators
firebase emulators:start   # firestore, auth, functions, hosting, pubsub
# Front end connect:
# import { getFirestore, connectFirestoreEmulator } from 'firebase/firestore';
# connectFirestoreEmulator(getFirestore(app), 'localhost', 8080);

# Run rules tests:
firebase emulators:exec --only firestore 'npm test'

# ===== Deploys =====
firebase deploy                              # everything
firebase deploy --only firestore:rules
firebase deploy --only functions:onUserCreate
firebase hosting:channel:deploy preview-pr-42

# ===== Backups =====
# Firestore -> Storage bucket (gcloud)
gcloud firestore export gs://my-backup-bucket/$(date +%F)
# Schedule via Cloud Scheduler + a Cloud Function

# ===== Common pitfalls =====
# - Rules left as 'allow read, write: if true' from the tutorial
# - Writes from anonymous users without rate limit / App Check
# - Real-time listeners that never detach -> quota burn
# - Storing big JSON blobs in Firestore (use Storage)
# - Per-user 'inbox' collections with millions of docs each (split or use BigQuery)
# - Crashlytics not configured to capture release builds (it is opt-in via setUserId etc.)

// firebase login | init | deploy | emulators:start