Exercises

# ============================================================
# Drill 1 — Rules: per-user notes
# ============================================================
# TASK: notes collection. Each doc has 'uid'. Each user can read/write their own.
#
# ANSWER:
# match /notes/{id} {
#   allow read, update, delete: if request.auth != null
#                               && resource.data.uid == request.auth.uid;
#   allow create:               if request.auth != null
#                               && request.resource.data.uid == request.auth.uid;
# }

# ============================================================
# Drill 2 — Rules: validate write shape
# ============================================================
# TASK: comments must have only { uid, body, postId, createdAt }, body <= 2000 chars.
#
# ANSWER:
# match /comments/{id} {
#   allow create: if request.auth != null
#                 && request.resource.data.keys().hasOnly(['uid','body','postId','createdAt'])
#                 && request.resource.data.body is string
#                 && request.resource.data.body.size() <= 2000
#                 && request.resource.data.uid == request.auth.uid;
# }

# ============================================================
# Drill 3 — App Check
# ============================================================
# TASK: protect Auth + Firestore from bot signup spam.
#
# ANSWER: enable App Check with Play Integrity (Android), DeviceCheck (iOS),
# reCAPTCHA Enterprise (web). Require enforced App Check in console for the
# Authentication and Firestore APIs.
# Effect: only your real apps with valid integrity tokens can call those APIs.

# ============================================================
# Drill 4 — Cloud Function: idempotent processing
# ============================================================
# TASK: an HTTP webhook function may retry. Process each event ONCE.
#
# ANSWER: deduplicate by event id.
# const ref = db.doc('events/' + event.id);
# const exists = (await ref.get()).exists;
# if (exists) return;                       // already processed
# await ref.set({ processed_at: Date.now() });
# // do the work

# ============================================================
# Drill 5 — Firestore modelling
# ============================================================
# TASK: tasks list page should show 'open tasks for current user + total
# count of all tasks for the user'.
#
# ANSWER:
# - Per-user subcollection: /users/{uid}/tasks/{id}
# - Composite index on (done, created_at desc) for the list
# - Maintain a counter on the user document:
#   - Increment on create / decrement on delete via Cloud Function
#   - Avoid COUNT() on the client; reads bill per doc
# Why: queries scope to one collection; counters are O(1) reads.

# ============================================================
# Drill 6 — Crashlytics: reports missing for one platform
# ============================================================
# TASK: Crashlytics shows iOS crashes but no Android. What is wrong?
#
# ANSWER (common): mapping.txt not uploaded. With R8/ProGuard obfuscation,
# the stack frames are unresolved; Crashlytics deduplicates them into 'unknown'
# groups that never surface.
# Fix: enable the firebase-crashlytics gradle plugin which uploads the
# mapping file on every build; or in fastlane:
#   upload_symbols_to_crashlytics(binary_path: '...')

# ============================================================
# Scoring
# ============================================================
# 6 / 6 -> ready for production
# 4 / 6 -> revisit firebase/cheatsheet + security rules docs
# < 4   -> read security rules + App Check docs before launch

# ============================================================
# Pitfalls
# ============================================================
# - 'allow read, write: if true' shipped from the tutorial
# - Loading 10k docs into memory client-side instead of paginating
# - Storing big blobs in Firestore (use Storage)
# - Cloud Functions deployed without minInstances=1 on hot paths (cold starts)
# - No App Check on Auth (bots burn quota in hours)

// Fill in: const auth = ____Auth(app);