# Firebase Setup — Viață la Țară

Firebase powers two features here:
- **Social login** — the Flutter client signs in with Google/Apple via Firebase, sends the Firebase
  **ID token** to `POST /api/auth/social`, and the backend verifies it with `firebase-admin`.
- **Push (FCM)** — the backend sends notifications via `firebase-admin` (e.g. the `REFRESH_TOKEN`
  message when a partner application is approved).

Firebase is **optional for the backend**: if `FIREBASE_SERVICE_ACCOUNT_PATH` is unset or the file
is missing, the API still boots and logs `[firebase] service account file not found — social auth
disabled`. So you can deploy without Firebase and add it later.

**Minimum to unblock a deploy that uses Firebase: just Part A.**

---

## Part A — Project + backend service account (REQUIRED for the backend)

1. Go to **console.firebase.google.com → Add project** → name it (e.g. `viata-la-tara`) → finish
   (Analytics optional).
2. **⚙ gear → Project settings → Service accounts** tab.
3. **Generate new private key** → confirm → downloads a JSON. This is your `firebase-service-account.json`.
4. Put it on the server at the path in `.env` and lock it down:
   ```bash
   sudo mv firebase-service-account.json /opt/vt-api/firebase-service-account.json
   sudo chown vtapi:vtapi /opt/vt-api/firebase-service-account.json
   sudo chmod 600 /opt/vt-api/firebase-service-account.json
   ```
   The `environment`/`.env` already points here:
   `FIREBASE_SERVICE_ACCOUNT_PATH=/opt/vt-api/firebase-service-account.json`.
5. Restart the API → logs should now show **`[firebase] initialized`**.

> ⚠️ **This JSON is a full-admin secret** for the whole Firebase project — treat it like a root
> password. Never commit it (already gitignored), never share it, keep it `chmod 600`.

That is everything the **backend** needs. Parts B–D make the client features usable.

---

## Part B — Enable sign-in providers (for Google/Apple login)

Console: **Build → Authentication → Get started**, then the **Sign-in method** tab:
- **Google** — enable, set a support email, save. (Easiest; no external account required.)
- **Apple** — enable, but this **requires an Apple Developer account** ($99/yr): create a Services ID
  and a "Sign in with Apple" key in the Apple Developer portal, paste them into Firebase. Defer until
  you're shipping on iOS.

No backend change is needed when you add providers — `verifyIdToken` accepts any enabled provider.

---

## Part C — Register the client apps (for the Flutter app)

Console: **Project settings → General → Your apps**:
- **Add Android app** → package name (e.g. `com.codebyte.viatalatara`) → download **`google-services.json`**
  → place in the Flutter project at `android/app/`.
- **Add iOS app** → bundle ID → download **`GoogleService-Info.plist`** → place in `ios/Runner/`.

Flutter packages: `firebase_core`, `firebase_auth` + `google_sign_in` (and `sign_in_with_apple`),
`firebase_messaging`. See `FLUTTER_FIREBASE_PROMPT.md` for the agent-ready integration prompt.

---

## Part D — Push notifications (FCM)

- Cloud Messaging is **on by default** — nothing to toggle for Android.
- **iOS push only:** **Project settings → Cloud Messaging → Apple app configuration → upload your APNs
  Authentication Key** (a `.p8` from the Apple Developer portal). Required or iOS push won't deliver.
- Runtime flow (backend already built): the Flutter app fetches its **FCM device token** and registers it
  via `POST /api/devices`; the backend stores it and pushes to it. On the `REFRESH_TOKEN` push, the client
  refreshes its access token so an updated role takes effect.

---

## Now vs later

| Now (finish the deploy) | Later (when adding features) |
|---|---|
| **Part A** — service-account JSON on the server | Part B — enable Google, then Apple |
| (or skip Firebase entirely for now) | Part C — register Android/iOS apps |
| | Part D — APNs key for iOS push |