Firestore Data Model

Firestore Data Model

All state lives in Firestore. Access is governed by Security Rules.

/devices/{hardwareId}

The device document. hardwareId is the stable ID (IMEI → serial → Android ID).

model, manufacturer, osVersion     device info
customName: string                 friendly name set in the console
status: "online" | "offline"
ownerId: string                    Firebase UID of the admin who owns the device
deviceUid: string                  Firebase UID the device itself signed in as
lastSeen: Timestamp                updated on the 60s heartbeat
imei, serial, androidId            hardware identifiers (IMEI/serial need Device Owner)
hardwareId: string
fcmToken: string                   for push messaging
alarmActive: boolean               persistent alarm state (instant toggle)
installedApps: [ {pkg,label,version,system} ]   synced inventory (≤400, no icons)
installedAppsUpdatedAt: Timestamp
policies: { ... }                  see below

policies map

installAppsBlocked, uninstallAppsBlocked, unknownSourcesBlocked,
playStoreHidden, browsersHidden, socialMediaBlocked, cameraDisabled,
screenCaptureDisabled, safeBootBlocked, factoryResetBlocked, debuggingBlocked,
addUserBlocked, userSwitchBlocked, statusBarDisabled, wifiConfigBlocked,
mobileNetworksBlocked, bluetoothConfigBlocked, vpnBlocked, networkResetBlocked,
usbTransferBlocked, bluetoothDisabled, outgoingCallsBlocked, physicalMediaBlocked,
mdmUninstallProtected,
pinMinLength: number,          // 4 | 6 | 8
blockedApps: string[],         // packages to hide
privateDnsHost: string,        // "" clears
filterRunning: boolean,        // content filter VPN
kioskPackages: string[]

Meanings: Policies Reference.

/devices/{hardwareId}/commands/{cmdId}

The command queue (see Commands and Command Queue).

type: "lock" | "reboot" | "wipe" | "lockdown"
state: "pending" | "executed" | "cancelled"
createdAt: Timestamp
executedAt: Timestamp      // set when the device claims/runs it
issuedBy: string           // admin email

/audit_logs/{logId}

action      e.g. LOGIN, LOCK_SCREEN, WIPE, POLICY, RENAME, CANCEL_CMD, FULL_LOCKDOWN
deviceId, details
userEmail, userId
timestamp, userAgent

Any signed-in user can create; only the super-admin can read.

/device_inventory/{imei}

Pre-provisioning record.

enrollmentStatus: "PENDING" | "ENROLLED" | "DISENROLLED"
enrolledAt, enrollmentToken, enrollmentTokenExpiresAt

/enrollment_tokens/{token}

The 32-char token is the secret.

(token metadata)

Readable by any signed-in device; creatable only by the super-admin; deleted by the device after use.

Field conventions

• Commands are a subcollection, not booleans on the device doc (legacy lockCommand/etc. are no longer written).
• Policies are the desired state; the device converges to them and never deletes them.
• status/lastSeen are heartbeat fields the device may write without owning the doc (bootstrap rule).