mirror of
https://github.com/kuhyx/utils.git
synced 2026-11-12 21:30:58 +01:00
Krzysztof kuhy Rudnicki
fc99eff005
Every repo in this fleet is public, so where each value lives is a disclosure decision rather than a style choice. FirebaseProject holds apiKey + databaseUrl: these identify the *project*, and the Web API key is a public identifier by design -- it ships inside every Android APK, and the security rules, not the key, are what protect the data. Safe to bake into app source, which keeps a reinstall zero-setup. FirebaseAccount holds the email and password: these identify *a person*, so they are entered once per device and kept in the platform keystore, never in SharedPreferences and never in a repo. The uid is deliberately absent from both. Nothing client-side needs it -- the rules compare auth.uid server-side, so a wrong account is refused by the database. A local copy would add a way to be wrong without adding protection. Keyed at `firebase.account`, distinct from `sync.token` (the GitHub PAT) and `firebase.credentials` (the refresh token), so all three coexist during the mirrored cutover. 13 tests, 100% line coverage; 241 in the suite. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SJ9sxEw3ymzXNjL7SHNpJc |
||
|---|---|---|
| .. | ||
| firebase_auth_rest.dart | ||
| firebase_client.dart | ||
| firebase_config.dart | ||
| firebase_settings.dart | ||
| github_client.dart | ||
| hlc.dart | ||
| io_store.dart | ||
| log.dart | ||
| mirror_store.dart | ||
| record.dart | ||
| remote_store.dart | ||
| secure_credential_store.dart | ||
| store.dart | ||
| sync.dart | ||