Summary

# ===== Products =====
# Auth                identities + sign-in flows (email, social, phone)
# Firestore           real-time document DB, offline-capable client SDK
# Realtime Database   smaller, simpler tree (chat presence, live counters)
# Cloud Storage       binary blobs (images, video) with rules
# Cloud Functions     event triggers, REST endpoints, scheduled jobs
# Hosting             static + serverless front end with global CDN
# Crashlytics         crash + non-fatal reporting (mobile + web)
# Analytics           event-based product analytics with BigQuery export
# Remote Config       feature flags + dynamic config
# App Check           bot / scraper / SSRF defence on Auth + Firestore
# Cloud Messaging     push notifications (FCM)
# Performance Mon.    web vitals + mobile traces
# AppDistribution     beta builds + test groups

# ===== Day-one safety controls =====
# 1) Firestore rules with proper scoping; tested in CI via emulator
# 2) App Check enforced on Auth + Firestore + Functions
# 3) Rate limits in Cloud Functions (Firestore counters or middleware)
# 4) Crashlytics with dSYM / mapping upload
# 5) Scheduled Firestore export to GCS
# 6) Cost ceiling alert in GCP billing
# 7) Anonymous auth disabled if not needed

# ===== Firestore data modelling =====
# - Documents up to 1 MB (prefer < 100 KB)
# - Collections nest naturally; reference via document path
# - Composite indexes auto-suggested by first query that needs them
# - Lists embed when bounded; sub-collection when unbounded
# - Many-to-many: separate edges collection

# ===== Rules cheat sheet =====
# rules_version = '2';
# service cloud.firestore {
#   match /databases/{db}/documents {
#     match /notes/{id} {
#       allow read, update, delete: if request.auth != null
#                                   && resource.data.uid == request.auth.uid;
#       allow create: if request.auth != null
#                     && request.resource.data.keys().hasOnly(['uid','body','createdAt'])
#                     && request.resource.data.body is string
#                     && request.resource.data.body.size() <= 2000;
#     }
#   }
# }

# ===== Cost levers =====
# - Cache reads with the client SDK; offline persistence cuts reads
# - Pagination with cursors; never load 10k docs
# - Cloud Functions: minInstances=1 on hot paths to avoid cold starts
# - Crashlytics + Analytics are FREE; BigQuery export is metered
# - Hosting: long cache + Brotli for hashed assets

# ===== Local development =====
# firebase init emulators
# firebase emulators:start --only firestore,auth,functions
# Connect:
# import { connectFirestoreEmulator } from 'firebase/firestore';
# connectFirestoreEmulator(getFirestore(app), 'localhost', 8080);

# Test rules:
# firebase emulators:exec --only firestore 'npm test'

# ===== Deploys =====
# firebase deploy --only firestore:rules
# firebase deploy --only functions:onUserCreate
# firebase deploy --only hosting

# ===== Backups =====
# Firestore -> GCS
# gcloud firestore export gs://shop-backups/$(date +%F)
# Schedule via Cloud Scheduler + a small function

# ===== Decision matrix =====
# - Quick MVP                     Firestore + Auth + Hosting
# - Real-time presence            Realtime Database
# - Heavy analytics queries       Analytics -> BigQuery
# - Push notifications            FCM
# - Webhooks / serverless         Cloud Functions
# - Static landing page           Hosting + prerender
# - Mobile auth flows             Auth + App Check + dynamic links

# ===== Pitfalls =====
# - 'allow read, write: if true' shipped from a tutorial
# - Anonymous writes without rate limit / App Check
# - Loading huge collections client-side
# - Storing big blobs in Firestore (use Storage)
# - Cloud Functions deployed without minInstances=1 on hot paths
# - No backups -> a bug or malicious write loses data permanently
# - Mapping / dSYM not uploaded -> Crashlytics shows mystery hashes

// Next: App Check, security rules deep dive, GenKit, Data Connect (Postgres).