Authentication model
Authentication and identity are handled by Firebase Auth.
Providers
- Email/password : Primary method for web and mobile. Email verification can be enforced.
- Other providers (e.g. Google) can be enabled per project for staff or SSO.
Identity and authorisation
- Firebase Auth : Provides the signed-in user (UID, email, tokens). Used for Firestore/Storage rules and Cloud Functions (via context.auth).
- Custom claims : Optional. Used to store role (e.g. admin, technician) or organisation ID. Set by a trusted backend (e.g. Cloud Function or Admin SDK) after sign-up or invite.
- Firestore rules : Use
request.auth != null,request.auth.uid, and optionallyrequest.auth.token.role/request.auth.token.orgIdto allow or deny read/write.
Session and security
- Sessions are managed by Firebase Auth (refresh tokens, etc.). No custom session store.
- For the marketing site, demo/signup forms do not use end-user auth; they call a callable Cloud Function that validates input and writes to Firestore (e.g. previewRequests) and may send email server-side.