2.9 KiB

Raw Blame History

MotorSignal — Phase 2E: Production Setup & Deployment Runbook

Target Firebase Project: motoapp-d22e0
Storage Provider: Cloudflare R2 (motorsignal-telemetry)
Authorization Gateway: Cloudflare Worker (motorsignal-r2-worker)

1. Firebase Project Verification & Firestore Rules Deployment

Windows PowerShell Workflow

Open a Windows PowerShell terminal in the project root:

# 1. Login to Firebase CLI
firebase login

# 2. List available projects and ensure motoapp-d22e0 is present
firebase projects:list

# 3. Explicitly select the MotorSignal project
firebase use motoapp-d22e0

# 4. Verify the active project is motoapp-d22e0
firebase use

CRITICAL WARNING: The project obd-f3b2ae62 is a separate OBD scanner application. NEVER deploy MotorSignal rules or configurations to obd-f3b2ae62. Always ensure firebase use outputs: Active project: motoapp-d22e0 (default)

Deploy Firestore Security Rules

Deploy the locked-down, user-isolated Firestore security rules:

firebase deploy --only firestore:rules

Verified Firestore Rules (`firestore.rules`)

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
      
      match /rides/{remoteRideId} {
        allow read, write: if request.auth != null && request.auth.uid == userId;
        
        match /{allSubcollections=**} {
          allow read, write: if request.auth != null && request.auth.uid == userId;
        }
      }
    }
  }
}

2. Cloudflare R2 & Worker Gateway Setup

Prerequisites

Cloudflare account with R2 enabled.
Node.js & npm installed.

Step 1: Create the Cloudflare R2 Bucket

npm install -g wrangler
cd cloudflare/motorsignal-r2-worker
wrangler r2 bucket create motorsignal-telemetry

Step 2: Configure Worker Secrets & Environment

wrangler secret put FIREBASE_PROJECT_ID
# Enter: motoapp-d22e0

Step 3: Deploy Cloudflare Worker

wrangler deploy

3. End-to-End Verification Checklist

Firebase Authentication: User registers/logs in via Email/Password, Google Sign-In, or Anonymous.
ID Token Generation: Client retrieves fresh cryptographic JWT via FirebaseAuth.instance.currentUser?.getIdToken().
R2 Upload: Client streams binary telemetry.zip with Authorization: Bearer <JWT> to Worker /r2/upload.
Worker Validation: Worker verifies iss, aud == "motoapp-d22e0", exp, validates SHA-256 integrity, and derives path users/{uid}/rides/{remoteRideId}/telemetry.zip.
Firestore Commit: Client commits metadata referencing provider: "cloudflare-r2", SHA-256 hash, and R2 objectKey.
Offline Riding: If offline or signed out, rides save to local SQLite and sync queues gracefully without blocking.

2.9 KiB Raw Blame History