Master Firebase Backend Development

This skill covers Firebase Authentication, Firestore, Realtime Database, Cloud Functions, Cloud Storage, and Firebase Hosting, built around the key insight that Firebase is optimized for read-heavy, denormalized data - thinking relationally about it is a mistake that surfaces expensive surprises later, since Firestore pricing can spike when reads or a poorly designed listener cost more than a dedicated database would.

Its core principles: design data for queries, not relationships; treat security rules as mandatory, not optional; denormalize aggressively since duplication is cheap but joins are expensive in Firestore; use batch writes and transactions for consistency; use offline persistence deliberately since it isn't free; push logic clients shouldn't run into Cloud Functions; and use environment-based config, never hardcoding keys client-side. Its capabilities span firebase-auth, firestore, firebase-realtime-database, firebase-cloud-functions, firebase-storage, firebase-hosting, firebase-security-rules, firebase-admin-sdk, and firebase-emulators.

Its tooling covers the modular client SDK firebase (tree-shakeable), firebase-admin for server-side/Cloud Functions use (full access, bypasses security rules), and firebase-functions (v2 recommended); testing via @firebase/rules-unit-testing (essential since rules bugs are security bugs) and firebase-tools for the local emulator suite; and framework bindings reactfire, vuefire, and angularfire.

Its patterns cover modular SDK imports; Firestore security rules design (helper functions like isSignedIn()/isOwner()/isAdmin(), public-read/owner-write patterns for a users collection with a private subcollection, published-or-owner read rules for posts, and admin-only collection restrictions - treating rules as the last line of defense since every read and write passes through them); data modeling for queries (Firestore isn't relational and can't JOIN, so schemas should embed frequently-needed data like author info directly in documents, use arrays for array-contains/in queries, use maps for compound queries, and accept that this trades more complex writes - updating denormalized copies - for fast single-read queries); real-time listeners; Cloud Functions v2 patterns; and batch writes and transactions for atomic multi-document consistency.

It also covers Firebase Auth in depth: social login (Google, GitHub, etc.), the popup-vs-redirect auth tradeoff (popup is simpler for desktop/SPA but can be blocked, redirect always works but is needed for mobile/iOS Safari), account linking, auth state persistence, email verification and password reset flows, and token management for calling external APIs.

Its delegation triggers route out-of-scope needs to other skills: complex OAuth flows to authentication-oauth (Firebase Auth handles only the basics), payment integration to stripe, email functionality to email (Firebase doesn't include email sending), container deployment to devops (beyond Firebase Hosting), highly relational data models to postgres-wizard (Firestore is the wrong choice there), and full-text search to elasticsearch-search (Firestore doesn't support it natively). It works well alongside nextjs-app-router, react-patterns, authentication-oauth, and stripe.

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    function isSignedIn() {
      return request.auth != null;
    }

    function isOwner(userId) {
      return request.auth.uid == userId;
    }

    match /users/{userId} {
      allow read: if true;
      allow write: if isOwner(userId);

      match /private/{document=**} {
        allow read, write: if isOwner(userId);
      }
    }

    match /posts/{postId} {
      allow read: if resource.data.published == true
                  || isOwner(resource.data.authorId);
      allow create: if isSignedIn()
                    && request.resource.data.authorId == request.auth.uid;
      allow update, delete: if isOwner(resource.data.authorId);
    }
  }
}

Use this skill when the user mentions Firebase, Firestore, Firebase Auth, Cloud Functions, Firebase Storage, Realtime Database, Firebase Hosting, the Firebase emulator, security rules, or Firebase Admin.

Not for general backend architecture (use backend), payment processing (use stripe), email sending (use email), advanced/complex auth flows (use authentication-oauth), or Kubernetes deployment (use devops).

Inputs: a Firebase feature requirement - authentication, Firestore data modeling, security rules, Cloud Functions, storage, or hosting.

Outputs: Firestore security rules matching the data model, a query-optimized denormalized schema, Cloud Functions v2 implementations, real-time listener code, and configured Firebase Auth flows (social login, persistence, token management).

Firebase client SDK, firebase-admin, firebase-functions, @firebase/rules-unit-testing, firebase-tools emulator suite, reactfire, vuefire, angularfire.

Developers building Firebase-backed applications who need query-optimized Firestore data modeling, correct security rules, Cloud Functions, and Firebase Auth flows.