99 lines
3.7 KiB
Markdown
99 lines
3.7 KiB
Markdown
# MotorSignal — Phase 2B Firebase Cloud Setup & Security Rules
|
|
|
|
**Document Version**: 1.0.0
|
|
**Phase**: Phase 2B — Firebase Cloud Sync & Remote Ride Backup
|
|
**Status**: SPECIFICATION & DEPLOYMENT INSTRUCTIONS
|
|
|
|
---
|
|
|
|
## 1. Overview
|
|
|
|
MotorSignal utilizes Firebase Cloud Firestore (for structured ride summaries and aggregates) and Firebase Cloud Storage (for compressed 20Hz forensic telemetry bundles).
|
|
|
|
All client synchronization adheres strictly to:
|
|
1. **User Isolation**: All cloud assets are namespaced under the authenticated user's ID (`/users/{uid}/...`).
|
|
2. **Offline-First Downstream Sync**: Riding, recording, and local SQLite persistence never require cloud connectivity or authentication.
|
|
3. **No Secret Embedding**: Client apps rely purely on platform configuration files (`google-services.json` for Android, `GoogleService-Info.plist` for iOS).
|
|
|
|
---
|
|
|
|
## 2. Cloud Firestore Security Rules
|
|
|
|
Deploy the following security rules to Firebase Cloud Firestore:
|
|
|
|
```javascript
|
|
rules_version = '2';
|
|
service cloud.firestore {
|
|
match /databases/{database}/documents {
|
|
|
|
// User Profile Documents
|
|
match /users/{userId} {
|
|
allow read, write: if request.auth != null && request.auth.uid == userId;
|
|
|
|
// Ride Summaries and Metadata
|
|
match /rides/{remoteRideId} {
|
|
allow read, write: if request.auth != null && request.auth.uid == userId;
|
|
|
|
// Discrete Events & Performance Benchmarks Subcollections
|
|
match /{allSubcollections=**} {
|
|
allow read, write: if request.auth != null && request.auth.uid == userId;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
```
|
|
|
|
### Security Enforcement:
|
|
* Authenticated users can only read and write documents within `/users/{request.auth.uid}/`.
|
|
* Unauthenticated requests are rejected immediately at the Firebase gateway.
|
|
* Cross-user reading or writing is blocked.
|
|
|
|
---
|
|
|
|
## 3. Firebase Cloud Storage Security Rules
|
|
|
|
Deploy the following security rules to Firebase Cloud Storage:
|
|
|
|
```javascript
|
|
rules_version = '2';
|
|
service firebase.storage {
|
|
match /b/{bucket}/o {
|
|
|
|
// User-Isolated Forensic Telemetry Bundles
|
|
match /users/{userId}/rides/{remoteRideId}/{allPaths=**} {
|
|
allow read, write: if request.auth != null && request.auth.uid == userId;
|
|
}
|
|
}
|
|
}
|
|
```
|
|
|
|
### Storage Protection:
|
|
* Bundles uploaded to `users/{uid}/rides/{remoteRideId}/telemetry.zip` are restricted solely to the owner.
|
|
* Multi-part and resumable chunked uploads require active authentication tokens.
|
|
|
|
---
|
|
|
|
## 4. Required Firebase Console Setup Steps
|
|
|
|
Before testing live cloud synchronization with a real Firebase project:
|
|
|
|
1. **Create Firebase Project**:
|
|
* Navigate to the [Firebase Console](https://console.firebase.google.com/).
|
|
* Create a new project (e.g. `motorsignal-app`).
|
|
2. **Enable Authentication Providers**:
|
|
* Under **Build > Authentication > Sign-in method**:
|
|
* Enable **Email/Password**.
|
|
* Enable **Google** (Configure OAuth Web Client ID and SHA-1 fingerprint for Android).
|
|
* Enable **Anonymous** (optional for guest linking).
|
|
3. **Provision Cloud Firestore**:
|
|
* Under **Build > Firestore Database**, click **Create Database**.
|
|
* Select a region and apply the security rules above.
|
|
4. **Provision Firebase Storage**:
|
|
* Under **Build > Storage**, click **Get Started**.
|
|
* Select the default bucket and apply the storage security rules above.
|
|
5. **Download Platform Configurations**:
|
|
* **Android**: Register `com.example.motorcycle_dash` (or production package name), download `google-services.json`, and place it in `android/app/`.
|
|
* **iOS**: Register bundle ID, download `GoogleService-Info.plist`, and place it in `ios/Runner/`.
|
|
* *(Note: Configuration files are gitignored to prevent secret leaks).*
|