alivirgo Firebase Platform AI Skill Guide
Overview & Engine Architecture
Firebase provides Auth, Firestore/Realtime Database, Storage, Cloud Functions, Hosting, and FCM under Google Cloud projects. Security is enforced by Security Rules and Admin SDK privileges - not by hiding client config. Agents design rules first, use the Emulator Suite for local tests, and keep service-account credentials server-only.
Client SDKs (anon/authenticated)
|
Auth tokens
|
Firestore / Storage (+ Security Rules)
|
Cloud Functions (Admin SDK) / FCM
When to use this skill
- Adding Firebase Auth and Firestore to mobile/web apps
- Writing and testing Security Rules
- Implementing callable/HTTP Cloud Functions
- Wiring push notifications (FCM) safely
Operational directives
- Treat client Firebase config as public; protect data with Rules + Auth claims.
- Never embed service account JSON in apps or public repos.
- Model Firestore for query patterns; avoid unbounded collection scans.
- Test Rules with Emulator Suite before production.
- Use least-privilege IAM on Functions service accounts.
Firestore rules sketch
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /items/{itemId} {
allow read: if request.auth != null
&& resource.data.ownerId == request.auth.uid;
allow create: if request.auth != null
&& request.resource.data.ownerId == request.auth.uid
&& request.resource.data.keys().hasOnly(['ownerId', 'sku', 'qty'])
&& request.resource.data.qty is int
&& request.resource.data.qty >= 0;
allow update, delete: if request.auth != null
&& resource.data.ownerId == request.auth.uid;
}
}
}
Commands
firebase login
firebase init
firebase emulators:start
firebase deploy --only firestore:rules,functions
Common pitfalls
| Pitfall | Why it hurts | Fix |
|---|---|---|
Open Rules (allow read, write: if true) |
Data breach | Auth + ownership checks |
| Admin SDK in client | Full privilege leak | Server/Functions only |
| Unindexed queries | Runtime failures | Composite indexes |
| Trusting client fields blindly | Privilege escalation | Validate in Rules/Functions |
Best practices
- Prefer custom claims for roles; keep claims small and rotate thoughtfully.
- Batch writes and use transactions for multi-doc consistency.
- Separate staging projects from production.
- Monitor usage quotas and set budget alerts on the GCP billing account.
Limitations
- Firestore is not a relational SQL engine - joins are application-side.
- Cold starts and region choice affect Functions latency.
- Some Auth providers need platform-specific SHA/URL allowlists.
Related skills
@flutter/@react-native- common Firebase clients@supabase- alternate BaaS with Postgres@vercel- hosting frontends that call Firebase