# Firebase Setup for Android

## Security Notice

⚠️ **IMPORTANT**: The `google-services.json` file contains sensitive Firebase API keys and credentials. It should **NEVER** be committed to version control.

## Setup Instructions

### 1. Download google-services.json from Firebase Console

1. Go to [Firebase Console](https://console.firebase.google.com/)
2. Select your project (or create a new one)
3. Navigate to **Project Settings** (gear icon)
4. Scroll down to **Your apps** section
5. Click on your Android app (or add a new Android app if needed)
   - Package name: `be.harmonics.saas`
6. Click **Download google-services.json**
7. Place the downloaded file in: `android/app/google-services.json`

### 2. Verify .gitignore

The file is already configured to be ignored in `android/.gitignore`:

```
# Google Services (e.g. APIs or Firebase)
google-services.json
```

### 3. Template File

A template file is provided at `android/app/google-services.json.example` for reference. Copy this file and replace the placeholder values with your actual Firebase configuration:

```bash
cd android/app
cp google-services.json.example google-services.json
# Then edit google-services.json with your actual values
```

## For CI/CD Pipelines

If you need to use Firebase in CI/CD:

### Option 1: Base64 Encoding (Recommended)

1. Encode the file:
   ```bash
   base64 -i android/app/google-services.json | pbcopy
   ```

2. Store the base64 string as a secret in your CI/CD system (e.g., GitHub Secrets, GitLab CI Variables)

3. In your CI/CD pipeline, decode it:
   ```bash
   echo "$GOOGLE_SERVICES_JSON_BASE64" | base64 -d > android/app/google-services.json
   ```

### Option 2: Secure File Storage

Use your CI/CD platform's secure file storage feature:
- GitHub Actions: Use encrypted secrets
- GitLab CI: Use file-type CI/CD variables
- CircleCI: Use contexts and environment variables

## Security Best Practices

1. ✅ **DO**: Keep `google-services.json` in `.gitignore`
2. ✅ **DO**: Use Firebase App Check to protect your APIs
3. ✅ **DO**: Set up Firebase Security Rules
4. ✅ **DO**: Restrict API keys in Firebase Console (set application restrictions)
5. ❌ **DON'T**: Commit `google-services.json` to version control
6. ❌ **DON'T**: Share the file publicly or via insecure channels

## Restricting API Keys

To further secure your Firebase API key:

1. Go to [Google Cloud Console](https://console.cloud.google.com/)
2. Navigate to **APIs & Services** > **Credentials**
3. Find your API key (the one from `google-services.json`)
4. Click **Edit**
5. Under **Application restrictions**, select **Android apps**
6. Add your package name: `be.harmonics.saas`
7. Add your SHA-1 certificate fingerprints
8. Save the restrictions

## If Your Key Was Exposed

If you accidentally committed `google-services.json` to version control:

1. **Immediately regenerate the API key** in Firebase Console
2. Remove the file from git history:
   ```bash
   git filter-branch --force --index-filter \
     'git rm --cached --ignore-unmatch android/app/google-services.json' \
     --prune-empty --tag-name-filter cat -- --all
   ```
3. Force push (⚠️ coordinate with your team first):
   ```bash
   git push origin --force --all
   ```
4. Download the new `google-services.json` with the regenerated key
5. Ensure `.gitignore` is properly configured
6. Review Firebase Security Rules and enable App Check

## Troubleshooting

### Build fails with "google-services.json not found"

- Make sure you've downloaded and placed the file in `android/app/google-services.json`
- Check that the file is not corrupted (should be valid JSON)

### Firebase features not working

- Verify the package name matches: `be.harmonics.saas`
- Check that all required Firebase services are enabled in the console
- Review Firebase Security Rules

## Additional Resources

- [Firebase Android Setup Guide](https://firebase.google.com/docs/android/setup)
- [Firebase Security Best Practices](https://firebase.google.com/docs/rules/security-rules)
- [Firebase App Check](https://firebase.google.com/docs/app-check)

