OWNER — Firebase Auth Hybrid (welife-2412)

WP-AUTH-FIREBASE-HYBRID-01 · WP-AUTH-FIREBASE-WEB-01 Kiến trúc: Firebase Auth = IdP (Email/Password + Google) · Firestore = users/{uid} profile mirror · Nest + Postgres = business API + WELIFE JWT. Không migrate rides/wallet/orders sang Firestore.

0. CLI setup (Web app + Auth + Rules) — làm một lần

$env:NODE_OPTIONS='--use-system-ca'
cd D:\welife
npx -y firebase-tools@latest login --no-localhost
# mở URL → lấy code →:
npx -y firebase-tools@latest login <authorizationCode>

# Tạo Web app + sdkconfig + deploy auth/firestore:
node scripts/firebase-owner-setup.mjs

Script sẽ:

1. firebase use welife-2412
2. apps:create web welife-consumer-web (nếu chưa có)
3. Ghi mobile/.env.firebase-web.snippet — merge vào mobile/.env.local (không commit)
4. deploy --only auth,firestore

Manual tương đương:

npx -y firebase-tools@latest apps:create web welife-consumer-web --project welife-2412
npx -y firebase-tools@latest apps:sdkconfig WEB <APP_ID> --project welife-2412
npx -y firebase-tools@latest deploy --only auth,firestore --project welife-2412

Repo đã có: .firebaserc · firebase.json · firestore.rules.

I've set up prototype Security Rules to keep the data in Firestore safe. They are designed to be secure for owner-only read/write on users/{uid} with field validation. However, you should review and verify them before broadly sharing your app.

1. Authentication providers

firebase.json → deploy --only auth bật:

1. Email/Password
2. Google Sign-In (brand WELIFE)

Hoặc Console → Authentication → Sign-in method.

Authorized domains (bắt buộc — lỗi auth/unauthorized-domain)

Console → Authentication → Settings → Authorized domains → Add:

Không thêm http://, port (:8081), hay IP LAN (192.168.x.x) — Firebase không chấp nhận.

Expo Go (fix app): bỏ qua Firebase Auth client → Nest /auth/google · email OTP / password Nest (tránh auth/unauthorized-domain). Firebase Auth client dùng trên EAS Dev Client / store build.

Google Cloud OAuth (Web client) — kèm theo

APIs & Services → Credentials → OAuth Web client:

• Authorized JavaScript origins: http://localhost, https://auth.expo.io, https://welife-2412.firebaseapp.com
• Authorized redirect URIs (đúng slug welife-consumer, không dùng @…/welife): https://auth.expo.io/@adminmarketingnx/welife-consumer, https://welife-2412.firebaseapp.com/__/auth/handler

3. Phone (tuỳ chọn) — test numbers trên Console.

2. Apps

Expo web ưu tiên Web appId. Native Android vẫn dùng google-services.json.

3. Service account (Nest bridge — optional)

Cần cho POST /api/v1/auth/firebase (email/password Firebase → WELIFE JWT).

# api/.env — KHÔNG commit
FIREBASE_PROJECT_ID=welife-2412
FIREBASE_CLIENT_EMAIL=firebase-adminsdk-….iam.gserviceaccount.com
FIREBASE_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n…\n-----END PRIVATE KEY-----\n"

# mobile/.env.local — bật Nest bridge
EXPO_PUBLIC_FIREBASE_BRIDGE=1

Google login không bắt buộc Admin SA — fallback Nest POST /auth/google với Google idToken.

4. Mobile public config

# mobile/.env.local
EXPO_PUBLIC_FIREBASE_API_KEY=
EXPO_PUBLIC_FIREBASE_AUTH_DOMAIN=welife-2412.firebaseapp.com
EXPO_PUBLIC_FIREBASE_PROJECT_ID=welife-2412
EXPO_PUBLIC_FIREBASE_STORAGE_BUCKET=welife-2412.firebasestorage.app
EXPO_PUBLIC_FIREBASE_MESSAGING_SENDER_ID=303268260300
EXPO_PUBLIC_FIREBASE_APP_ID=           # fallback · ưu tiên WEB/ANDROID/IOS bên dưới
# EXPO_PUBLIC_FIREBASE_WEB_APP_ID=     # Expo web — 1:…:web:…
# EXPO_PUBLIC_FIREBASE_ANDROID_APP_ID=
# EXPO_PUBLIC_FIREBASE_IOS_APP_ID=
# EXPO_PUBLIC_FIREBASE_BRIDGE=1        # chỉ khi đã có Admin SA

5. App behavior (code IMP)

Khi EXPO_PUBLIC_FIREBASE_* đủ:

• Register / password login → Firebase Auth → Firestore users/{uid} → Nest /auth/firebase nếu bridge ON · else Nest password
• Google → Firebase credential + Firestore → Nest /auth/firebase nếu bridge · else Nest /auth/google
• Web Google → signInWithPopup

6. Phone trên Expo

Expo Go không đủ reCAPTCHA native. Test numbers / EAS dev build.

7. Smoke

npm run env:check
npm run api:dev
cd mobile && npm run start:clear