Firebase Cheatsheet: Firestore, Auth, Functions and FCM

# CLI
npm install -g firebase-tools
firebase --version
firebase login

# Pick products inside the wizard:
#   firestore, functions, hosting, storage, emulators
firebase init

# Local stack — auth, firestore, functions, storage, hosting on one box
firebase emulators:start --import=./seed --export-on-exit=./seed
# Emulator UI: http://localhost:4000

# Web SDK (modular, tree-shakable)
npm i firebase

# Initialise once per app
cat > src/firebase.ts <<'TS'
import { initializeApp }    from 'firebase/app'
import { getAuth,         connectAuthEmulator }      from 'firebase/auth'
import { getFirestore,    connectFirestoreEmulator } from 'firebase/firestore'
import { getStorage,      connectStorageEmulator }   from 'firebase/storage'

const app = initializeApp({
    apiKey:            import.meta.env.VITE_FB_API_KEY,
    authDomain:        import.meta.env.VITE_FB_AUTH_DOMAIN,
    projectId:         import.meta.env.VITE_FB_PROJECT_ID,
    storageBucket:     import.meta.env.VITE_FB_STORAGE_BUCKET,
    appId:             import.meta.env.VITE_FB_APP_ID,
})
export const auth    = getAuth(app)
export const db      = getFirestore(app)
export const storage = getStorage(app)

if (import.meta.env.DEV) {
    connectAuthEmulator(auth, 'http://localhost:9099')
    connectFirestoreEmulator(db, 'localhost', 8080)
    connectStorageEmulator(storage, 'localhost', 9199)
}
TS

import { db, auth } from './firebase'
import {
    collection, doc, addDoc, setDoc, getDoc, getDocs,
    updateDoc, deleteDoc, query, where, orderBy, limit,
    onSnapshot, serverTimestamp, writeBatch,
} from 'firebase/firestore'

const uid = auth.currentUser!.uid

// 1. Create — server-assigned ID
const ref = await addDoc(collection(db, 'notes'), {
    title:   'Ship firebase cheatsheet',
    owner:   uid,
    done:    false,
    created: serverTimestamp(),                  // resolves on the server
})

// 2. Upsert with merge — safe re-create
await setDoc(doc(db, 'notes', ref.id),
    { tags: ['draft'], updated: serverTimestamp() },
    { merge: true })

// 3. Read one
const snap = await getDoc(doc(db, 'notes', ref.id))
if (snap.exists()) console.log(snap.id, snap.data())

// 4. Query + live updates
const q = query(
    collection(db, 'notes'),
    where('owner', '==', uid),
    where('done',  '==', false),
    orderBy('created', 'desc'),
    limit(20),
)
const unsub = onSnapshot(q, (qs) => {
    qs.docChanges().forEach((ch) => {
        console.log(ch.type, ch.doc.id, ch.doc.data())  // added | modified | removed
    })
})

// 5. Atomic batch (up to 500 ops)
const batch = writeBatch(db)
batch.update(doc(db, 'notes', ref.id), { done: true })
batch.delete(doc(db, 'notes', 'stale-id'))
await batch.commit()

// later: unsub() in your effect cleanup

// firestore.rules — owner-only access pattern with a small admin helper.
rules_version = '2';

service cloud.firestore {
    match /databases/{database}/documents {

        // Helpers (reusable predicates)
        function isSignedIn() { return request.auth != null; }
        function isOwner()    { return request.auth.uid == resource.data.owner; }
        function becomesOwn() { return request.auth.uid == request.resource.data.owner; }
        function isAdmin()    {
            return exists(/databases/$(database)/documents/admins/$(request.auth.uid));
        }

        // Per-user private notes
        match /notes/{noteId} {
            allow read:   if isSignedIn() && (isOwner() || isAdmin());
            allow create: if isSignedIn() && becomesOwn()
                          && request.resource.data.created == request.time;
            allow update: if isOwner()
                          && request.resource.data.owner == resource.data.owner;   // owner immutable
            allow delete: if isOwner();
        }

        // Wildcard subtree — every doc under /users//...
        match /users/{uid}/{document=**} {
            allow read, write: if isSignedIn() && request.auth.uid == uid;
        }

        // Default deny
        match /{document=**} {
            allow read, write: if false;
        }
    }
}

import { auth } from './firebase'
import {
    createUserWithEmailAndPassword, signInWithEmailAndPassword,
    signInWithPopup, signInWithRedirect, getRedirectResult,
    signInAnonymously, sendPasswordResetEmail, updateProfile,
    onAuthStateChanged, signOut,
    GoogleAuthProvider, GithubAuthProvider,
} from 'firebase/auth'

// 1. Email + password
await createUserWithEmailAndPassword(auth, 'ada@example.com', 'correct horse battery')
const cred = await signInWithEmailAndPassword(auth, 'ada@example.com', 'correct horse battery')

// 2. OAuth — popup vs redirect (mobile-safer)
await signInWithPopup(auth, new GoogleAuthProvider())
// or:
await signInWithRedirect(auth, new GithubAuthProvider())
const after = await getRedirectResult(auth)        // call on the callback page

// 3. Anonymous (great for "try before sign up")
await signInAnonymously(auth)

// 4. Profile + password resets
await updateProfile(auth.currentUser!, { displayName: 'Ada Lovelace' })
await sendPasswordResetEmail(auth, 'ada@example.com')

// 5. React to sign-in state across the whole app
const unsub = onAuthStateChanged(auth, async (user) => {
    if (!user) return navigate('/login')
    const token = await user.getIdToken()          // JWT for your backend
    setHeader('Authorization', `Bearer ${token}`)
})

// later: await signOut(auth); unsub();

// Cloud Functions for Firebase — Gen 2 (Cloud Run under the hood).
import { onRequest, onCall, HttpsError } from 'firebase-functions/v2/https'
import { onDocumentCreated }              from 'firebase-functions/v2/firestore'
import { onSchedule }                     from 'firebase-functions/v2/scheduler'
import { defineSecret }                   from 'firebase-functions/params'
import { initializeApp }                  from 'firebase-admin/app'
import { getFirestore }                   from 'firebase-admin/firestore'

initializeApp()
const OPENAI = defineSecret('OPENAI_KEY')           // bound at deploy

// 1. HTTPS endpoint
export const api = onRequest(
    { region: 'us-central1', cors: true, secrets: [OPENAI] },
    async (req, res) => {
        res.json({ ok: true, key_prefix: OPENAI.value().slice(0, 5) })
    },
)

// 2. Callable — auth context resolved server-side
export const sayHello = onCall(async (req) => {
    if (!req.auth) throw new HttpsError('unauthenticated', 'sign in first')
    return { hello: req.auth.uid }
})

// 3. Firestore trigger — fires on every new /notes doc
export const onNewNote = onDocumentCreated(
    { document: 'notes/{noteId}', region: 'us-central1' },
    async (event) => {
        const before = event.data?.data()
        await event.data?.ref.update({ ingestedAt: new Date() })
    },
)

// 4. Scheduled — cron syntax or "every day 02:00"
export const nightly = onSchedule('every day 02:00', async () => {
    const stale = await getFirestore().collection('notes')
        .where('done', '==', true).get()
    await Promise.all(stale.docs.map((d) => d.ref.delete()))
})

// End-to-end: auth-gated notes app in ~30 lines.
// RLS-equivalent enforcement lives in firestore.rules (request.auth.uid == owner).
import { auth, db } from './firebase'
import {
    signInWithEmailAndPassword, onAuthStateChanged, signOut,
} from 'firebase/auth'
import {
    collection, addDoc, query, where, orderBy, onSnapshot,
    updateDoc, doc, serverTimestamp,
} from 'firebase/firestore'

async function main() {
    // 1. Sign in
    await signInWithEmailAndPassword(auth, 'ada@example.com', '****')

    onAuthStateChanged(auth, async (user) => {
        if (!user) return console.log('signed out')

        // 2. Insert — owner field must equal auth.uid (rules enforce this)
        const ref = await addDoc(collection(db, 'notes'), {
            title:   'Ship firebase cheatsheet',
            owner:   user.uid,
            done:    false,
            created: serverTimestamp(),
        })

        // 3. Subscribe to my own notes only
        const q = query(
            collection(db, 'notes'),
            where('owner', '==', user.uid),
            orderBy('created', 'desc'),
        )
        const unsub = onSnapshot(q, (qs) =>
            qs.docChanges().forEach((c) => console.log(c.type, c.doc.id)))

        // 4. Complete the note
        await updateDoc(doc(db, 'notes', ref.id), { done: true })

        // 5. Tidy up
        unsub()
        await signOut(auth)
    })
}

main().catch(console.error)