GCP Firebase Developer
Overview
Firebase is Google's app development platform for web and mobile. It provides a unified suite of backend services, SDKs, and tooling. Key products: Firestore (NoSQL real-time database), Firebase Auth (identity), Hosting (global CDN), Cloud Functions for Firebase (server logic), Firebase Storage (file storage), App Check (abuse prevention), Remote Config, Analytics.
Quick Start
# Install Firebase CLI
npm install -g firebase-tools
# Login
firebase login
# Initialize project
firebase init
# Deploy
firebase deploy
Reference Directory
Load only when needed:
| Scenario |
Trigger Keywords |
Reference |
| Firestore data modeling |
collection, document, subcollection, NoSQL schema, query design |
references/firestore.md |
| Authentication |
auth, sign-in, OAuth, email, phone, anonymous, custom claims |
references/auth.md |
| Security Rules |
rules, allow, deny, Firestore rules, Storage rules |
references/security-rules.md |
| Cloud Functions |
functions, trigger, callable, HTTP, Pub/Sub, Firestore trigger |
references/functions.md |
| Hosting |
deploy, hosting, CDN, SPA, redirect, custom domain |
references/hosting.md |
| App Check |
abuse, attestation, reCAPTCHA, DeviceCheck, Play Integrity |
references/app-check.md |
| Emulator Suite |
local testing, emulator, integration test |
references/emulators.md |
| Firebase Extensions |
extension, marketplace, prebuilt |
references/extensions.md |
Core Operating Rules
- Firebase SDKs come in Web (v9 modular), React Native, Flutter, iOS (Swift), and Android (Kotlin/Java) variants. Always confirm the platform before providing SDK code.
- Firestore security rules are the primary access control layer for client-side apps — never assume the app logic is sufficient authorization.
- Use Firebase Emulator Suite for local development and integration testing before deploying to production.
- App Check is mandatory for production apps to prevent unauthorized API access and quota abuse.
- Cloud Functions for Firebase run on Cloud Run (gen2) by default in new projects — prefer gen2 for better performance, concurrency, and VPC connectivity.
- Firebase Auth supports custom claims for role-based access — use claims, not Firestore documents, as the authority for authorization decisions.
- Never expose service account keys or private Firebase config in client-side code. The Firebase client SDK config (apiKey, projectId) is not a secret — it is safe to embed in client bundles.
- Use Firebase Hosting rewrites to serve SPAs and proxy Cloud Functions securely.
Response Shape
Platform/SDK confirmation, Firestore data model, security rules, auth flow, functions, hosting config, App Check setup, test plan with emulators.
Official Docs
Security Notes
Read-only skill. Do not deploy to production, modify Firestore security rules, or change Firebase project settings without explicit approval. Client config (apiKey, projectId) is public — service account keys are private and must never be embedded in client code.
1---2name: gcp-firebase-developer3description: Build, configure, and operate Firebase-powered web and mobile applications — covering Firestore, Firebase Auth, Firebase Hosting, Cloud Functions for Firebase, Firebase Storage, App Check, Firebase Remote Config, and Firebase Analytics. Use when building mobile/web apps with Firebase, setting up authentication flows, designing Firestore data models, deploying Firebase Hosting, or configuring Firebase security rules.4---5
6# GCP Firebase Developer
7
8## Overview
9
10Firebase is Google's app development platform for web and mobile. It provides a unified suite of backend services, SDKs, and tooling. Key products: Firestore (NoSQL real-time database), Firebase Auth (identity), Hosting (global CDN), Cloud Functions for Firebase (server logic), Firebase Storage (file storage), App Check (abuse prevention), Remote Config, Analytics.
11
12## Quick Start
13
14```bash
15# Install Firebase CLI
16npm install -g firebase-tools
17
18# Login
19firebase login
20
21# Initialize project
22firebase init
23
24# Deploy
25firebase deploy
26```
27
28## Reference Directory
29
30Load only when needed:
31
32| Scenario | Trigger Keywords | Reference |
33|---|---|---|
34| Firestore data modeling | collection, document, subcollection, NoSQL schema, query design | references/firestore.md |
35| Authentication | auth, sign-in, OAuth, email, phone, anonymous, custom claims | references/auth.md |
36| Security Rules | rules, allow, deny, Firestore rules, Storage rules | references/security-rules.md |
37| Cloud Functions | functions, trigger, callable, HTTP, Pub/Sub, Firestore trigger | references/functions.md |
38| Hosting | deploy, hosting, CDN, SPA, redirect, custom domain | references/hosting.md |
39| App Check | abuse, attestation, reCAPTCHA, DeviceCheck, Play Integrity | references/app-check.md |
40| Emulator Suite | local testing, emulator, integration test | references/emulators.md |
41| Firebase Extensions | extension, marketplace, prebuilt | references/extensions.md |
42
43## Core Operating Rules
44
45- Firebase SDKs come in Web (v9 modular), React Native, Flutter, iOS (Swift), and Android (Kotlin/Java) variants. Always confirm the platform before providing SDK code.
46- Firestore security rules are the primary access control layer for client-side apps — never assume the app logic is sufficient authorization.
47- Use Firebase Emulator Suite for local development and integration testing before deploying to production.
48- App Check is mandatory for production apps to prevent unauthorized API access and quota abuse.
49- Cloud Functions for Firebase run on Cloud Run (gen2) by default in new projects — prefer gen2 for better performance, concurrency, and VPC connectivity.
50- Firebase Auth supports custom claims for role-based access — use claims, not Firestore documents, as the authority for authorization decisions.
51- Never expose service account keys or private Firebase config in client-side code. The Firebase client SDK config (apiKey, projectId) is not a secret — it is safe to embed in client bundles.
52- Use Firebase Hosting rewrites to serve SPAs and proxy Cloud Functions securely.
53
54## Response Shape
55
56Platform/SDK confirmation, Firestore data model, security rules, auth flow, functions, hosting config, App Check setup, test plan with emulators.
57
58## Official Docs
59
60- https://firebase.google.com/docs
61- https://firebase.google.com/docs/firestore
62- https://firebase.google.com/docs/auth
63- https://firebase.google.com/docs/hosting
64- https://firebase.google.com/docs/functions
65- https://firebase.google.com/docs/app-check
66
67## Security Notes
68
69Read-only skill. Do not deploy to production, modify Firestore security rules, or change Firebase project settings without explicit approval. Client config (apiKey, projectId) is public — service account keys are private and must never be embedded in client code.
aibot88