Auth and Firebase

Auth and Firebase

Why Firebase looks “serverless”

Cloud Functions require the Blaze plan. AnyLM stays on Spark: Auth + Firestore + Hosting only. Service logic that used to live in NestJS now runs in app/src/main/api/ using the signed-in user’s ID token. firestore.rules is authorization.

Implications (from firebase/README.md):

• Usage limits are cooperative (a patched client can skip reporting).
• Domain auto-join / SSO enforcement were removed (would require reading foreign orgs).
• Google Calendar connector disabled (token endpoint wants a client secret).
• Log TTL is swept when admins open compliance views (no billing TTL policies).

Sign-in flows

Email / password

Main process → Identity Toolkit directly → tokens into OS keystore (token-store.ts).

Google / GitHub

1. App opens a loopback port and launches the system browser to the Hosting page: https://<project>.web.app/?provider=…&port=….
2. Page runs signInWithPopup with Firebase web SDK; provider secrets stay inside Firebase.
3. Redirect to http://127.0.0.1:<port>/callback?refreshToken=….
4. App stores refresh/session via keystore.

Loopback (not custom URL scheme) follows RFC 8252 for native apps.

App configuration

In app/.env (public, baked in):

• ANYLM_FIREBASE_PROJECT
• ANYLM_FIREBASE_API_KEY
• Optional ANYLM_SITE_URL
• Outlook: ANYLM_MS_CLIENT_ID

Build refuses secret-like keys — see Configuration.

Data model (Firestore)

Collection	Doc id pattern	Notes
users	uid	Email lookup mirror
orgs	auto	createdBy seeds owner
members	<orgId>__<userId>	Point-read role checks
teams	auto
invites	auto	Includes orgName for invitees
policies	auto	config JSON string
usage	auto	Append-only
interactionLogs	auto	Soft TTL via expiresAt
audit	auto	Append-only
apiKeys	sha256(key)	Possession authorizes
connectors	<userId>__<provider>	Owner-only

Id conventions matter: rules cannot query arbitrarily for membership.

In-process API

• Entry: auth.request(method, path, body)
• Dispatch: app/src/main/api/index.ts
• Firestore access: app/src/main/data/*

REST shapes are intentional so a future hosted server can take over by changing only request() to HTTPS.

Putting a server back

Host the same router (Cloudflare Workers, Deno Deploy, Render, etc.), keep Auth + Firestore, flip request() to remote. See firebase/README.md.

One-time Firebase setup (summary)

1. Create project; set .firebaserc.
2. Enable Email/Password, Google, GitHub sign-in methods.
3. Create Firestore (Native mode).
4. Register a Web app (Hosting needs /__/firebase/init.js).
5. Fill app/.env.
6. firebase deploy (rules, indexes, hosting).

Emulators

./scripts/dev.sh --emulator — use for local rules iteration. Treat emulator rules tests plus a careful first production deploy as the real gate; live rules coverage is historically thin.

Contributor rules of thumb

1. Read firestore.rules before changing api/.
2. Never assume the client is honest about usage.
3. Don’t reintroduce NestJS as a required dependency.
4. Keep connector tokens out of the renderer.
5. Prefer invitations over cross-org reads.