Quiz

# ============================================================
# Q1) Phone-auth-only mobile app. How do you keep the SMS bill bounded?
# ============================================================
# ANSWER: enable App Check (Play Integrity / DeviceCheck) and Cloud Functions
# rate-limit per phone number. Firebase's console-side per-region restriction
# blocks countries you do not serve, killing the most common abuse pattern
# (a script that hammers signInWithPhoneNumber from another continent).

# ============================================================
# Q2) Anonymous-only writes are getting flooded with junk.
# ============================================================
# ANSWER: turn on App Check FIRST, then add Firestore rules that verify the
# write shape AND a recent reCAPTCHA / Play Integrity token. App Check on
# Auth + Firestore stops scrapers at the door; the rule shape verifies
# legitimate writes.

# ============================================================
# Q3) Real-time data needs to update across web + iOS + Android instantly.
# ============================================================
# ANSWER: Firestore real-time listeners (onSnapshot) — they multiplex over a
# single connection, support offline, and cost only the document reads
# triggered by changes. Use Realtime Database ONLY when the data is a tiny
# JSON tree with extreme write rates (chat presence, counters); Firestore
# is the default in 2026.

# ============================================================
# Q4) A function should ONLY run once per Firestore write, even on retries.
# ============================================================
# ANSWER: idempotency key.
# Cloud Functions v2 may retry. Use the event id (event.id) as a dedup key in
# a small Firestore doc:
#   const ref = db.doc('events/' + event.id);
#   const exists = await ref.get();
#   if (exists.exists) return;
#   await ref.set({ processed_at: Date.now() });
#   // ... do the work
# The compare-and-set semantics of Firestore guarantee one-time execution.

# ============================================================
# Q5) Crashlytics shows no crashes from one specific build.
# ============================================================
# ANSWER: dSYMs / mapping.txt missing.
# iOS: ensure dSYMs are uploaded (Xcode Build Phase 'Upload Symbols' or fastlane
# pilot's upload_symbols_to_crashlytics).
# Android: enable mapping file uploads in the firebase-crashlytics gradle plugin.
# Without symbols, crashes are deduped by un-resolvable hashes and become invisible.

# ============================================================
# Q6) BigQuery costs from Analytics export are climbing fast.
# ============================================================
# ANSWER: partition-aware queries.
# Filter on _PARTITIONTIME / event_date and project ONLY the fields you need:
#   SELECT event_name, count(*)
#   FROM `proj.analytics_xxx.events_*`
#   WHERE _TABLE_SUFFIX BETWEEN '20260601' AND '20260618'
#     AND event_name = 'purchase'
# Without _TABLE_SUFFIX, every query scans every day of history.

# ============================================================
# Bonus — what to never do in production
# ============================================================
# - 'allow read, write: if true' in Firestore rules (the tutorial default)
# - Calling auth.currentUser? from a server-side function (server has no client SDK auth)
# - Writes from anonymous users without App Check on a money-touching path
# - Cloud Functions deployed without minInstances=1 on hot paths -> cold starts ruin UX
# - Loading 10k docs into memory client-side instead of paginating with cursors

# Scoring
# 6 / 6 -> safe to ship to production
# 4 / 6 -> revisit firebase/cheatsheet
# < 4   -> read security rules + App Check docs before launch

// 3 questions per lesson.