🔐 Firebase Authentication & Firestore Configuration

This page documents how authentication and data security are implemented in the Unique Postcard app using Firebase.

---

🔑 Authentication Setup

I opened the Firebase Console, navigated to:

Build → Authentication → Sign-in method

Then configured the available providers. Only Google sign-in is enabled.

✅ This setup ensures users must authenticate with their Google accounts.

---

🔥 Firestore Rules

In the Firebase Console, under:

Build → Firestore Database → Rules

I defined the security rules for accessing user data and postcards:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // ✅ Allow reading user list
    match /users/{userEmail} {
      allow read: if request.auth != null;
      allow write: if request.auth.token.email == userEmail;
    }

    // ✅ Allow reading postcards for any user
    match /postcards/{userEmail}/postcards/{docId} {
      allow read: if request.auth != null;
      allow write, delete: if request.auth.token.email == userEmail;
    }
  }
}

🔒 What These Rules Do:

• ✅ Only authenticated users can read any data
• ✅ Users can only write to their own users/{email} and postcards/{email}/postcards/{docId}
• ✅ Any logged-in user can view public postcards from any user

---

⚙️ Firebase Configuration

To connect the app to Firebase, I created a Web App inside the Firebase Console and copied the generated config object into a local file.

This configuration authorizes communication with Firebase services including Authentication, Firestore, and Analytics.

The configuration looks like this:

const firebaseConfig = {
  apiKey: "######",
  authDomain: "unique-postcard.firebaseapp.com",
  projectId: "unique-postcard",
  storageBucket: "######",
  messagingSenderId: "######",
  appId: "######",
  measurementId: "######"
};

This configuration was saved in a file named:

firebase.js

It is used to:

• Initialize Firebase
• Enable Authentication
• Access Firestore
• Set up Analytics (optional)

🔐 Note: Only authDomain and projectId are safe to leave visible in documentation.
Other keys are hidden here out of good habit, even though they are technically safe in frontend code.

👉 URL till Readme Tillbaka till förstasidan