# MotorSignal — Phase 2E: Production Setup & Deployment Runbook

**Target Firebase Project**: `motoapp-d22e0`  
**Storage Provider**: Cloudflare R2 (`motorsignal-telemetry`)  
**Authorization Gateway**: Cloudflare Worker (`motorsignal-r2-worker`)  

---

## 1. Firebase Project Verification & Firestore Rules Deployment

### Windows PowerShell Workflow

Open a Windows PowerShell terminal in the project root:

```powershell
# 1. Login to Firebase CLI
firebase login

# 2. List available projects and ensure motoapp-d22e0 is present
firebase projects:list

# 3. Explicitly select the MotorSignal project
firebase use motoapp-d22e0

# 4. Verify the active project is motoapp-d22e0
firebase use
```

> **CRITICAL WARNING**:
> The project `obd-f3b2ae62` is a separate OBD scanner application. NEVER deploy MotorSignal rules or configurations to `obd-f3b2ae62`. Always ensure `firebase use` outputs:
> `Active project: motoapp-d22e0 (default)`

### Deploy Firestore Security Rules

Deploy the locked-down, user-isolated Firestore security rules:

```powershell
firebase deploy --only firestore:rules
```

### Verified Firestore Rules (`firestore.rules`)

```javascript
rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
      
      match /rides/{remoteRideId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
        
        match /{allSubcollections=**} {
          allow read, write: if request.auth != null && request.auth.uid == userId;
        }
      }
    }
  }
}
```

---

## 2. Cloudflare R2 & Worker Gateway Setup

### Prerequisites
* Cloudflare account with R2 enabled.
* Node.js & npm installed.

### Step 1: Create the Cloudflare R2 Bucket
```powershell
npm install -g wrangler
cd cloudflare/motorsignal-r2-worker
wrangler r2 bucket create motorsignal-telemetry
```

### Step 2: Configure Worker Secrets & Environment
```powershell
wrangler secret put FIREBASE_PROJECT_ID
# Enter: motoapp-d22e0
```

### Step 3: Deploy Cloudflare Worker
```powershell
wrangler deploy
```

---

## 3. End-to-End Verification Checklist

1. **Firebase Authentication**: User registers/logs in via Email/Password, Google Sign-In, or Anonymous.
2. **ID Token Generation**: Client retrieves fresh cryptographic JWT via `FirebaseAuth.instance.currentUser?.getIdToken()`.
3. **R2 Upload**: Client streams binary `telemetry.zip` with `Authorization: Bearer <JWT>` to Worker `/r2/upload`.
4. **Worker Validation**: Worker verifies `iss`, `aud == "motoapp-d22e0"`, `exp`, validates SHA-256 integrity, and derives path `users/{uid}/rides/{remoteRideId}/telemetry.zip`.
5. **Firestore Commit**: Client commits metadata referencing `provider: "cloudflare-r2"`, SHA-256 hash, and R2 `objectKey`.
6. **Offline Riding**: If offline or signed out, rides save to local SQLite and sync queues gracefully without blocking.