Hosting My Blog on Firebase

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /comments/{commentId} {
      // Anyone can read comments
      allow read: if true;

      // Authenticated users can create comments
      allow create: if request.auth != null
        && request.auth.uid == request.resource.data.authorId
        && request.resource.data.content.size() <= 1000
        && request.resource.data.content.size() > 0
        && request.resource.data.postPath is string
        && request.resource.data.deleted == false;

      // Users can update their own comments (within 1 hour) or increment reports
      allow update: if request.auth != null
        && (
          // Author can edit their own comment within 1 hour
          (request.auth.uid == resource.data.authorId
           && request.resource.data.content.size() <= 1000
           && request.resource.data.content.size() > 0
           && request.time < resource.data.timestamp + duration.value(1, 'h'))
          // Any authenticated user can increment reports
          || (request.resource.data.reports == resource.data.reports + 1
              && request.resource.data.content == resource.data.content)
        );
    }

    match /reports/{reportId} {
      // Authenticated users can create reports
      // Report ID must be in format: commentId_userId to prevent duplicates
      allow create: if request.auth != null
        && request.auth.uid == request.resource.data.reporterId
        && request.resource.data.commentId is string
        && reportId == request.resource.data.commentId + '_' + request.auth.uid;

      // Allow users to check if they've already reported
      allow get: if request.auth != null
        && reportId == resource.data.commentId + '_' + request.auth.uid;

      // Reports cannot be listed, updated or deleted
      allow list, update, delete: if false;
    }
  }
}

rules_version = '2';

service firebase.storage {
  match /b/{bucket}/o {
    // Public files accessible to all
    match /public/{allPaths=**} {
      allow read;
    }

    // Protected content requires authentication
    match /protected/{allPaths=**} {
      allow read: if request.auth != null;
    }

    // Granular access control (if needed)
    match /private/{userId}/{allPaths=**} {
      allow read: if request.auth != null && request.auth.uid == userId;
    }
  }
}

name: Build & Deploy to Firebase Hosting
on:
  push:
    branches:
      - main
jobs:
  build_and_deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: true
      - name: Setup Hugo
        uses: peaceiris/actions-hugo@v2
        with:
          hugo-version: "0.149.1"
          extended: true
      - name: Build
        run: hugo --minify
      - name: Prepare Protected Content for Upload
        run: |
          # Create upload directory for protected content
          mkdir -p upload/protected

          # Move protected files to upload directory
          if [ -d "public/protected" ]; then
            cd public/protected
            for dir in */; do
              if [ -d "$dir" ] && [ "$dir" != "/" ]; then
                dirname=$(basename "$dir")
                if [ -f "${dir}index.html" ]; then
                  echo "Moving ${dirname}.html to upload directory..."
                  # Move file to upload directory with .html extension
                  cp "${dir}index.html" "../../upload/protected/${dirname}.html"
                  # Create metadata file for TTL configuration
                  echo "30" > "../../upload/protected/${dirname}.ttl"  # 30 days
                  # Remove the directory from public
                  rm -rf "$dir"
                  echo "✓ Moved ${dirname}.html and removed from public"
                fi
              fi
            done
            cd ../..
          fi
      - name: Deploy Hosting
        uses: FirebaseExtended/action-hosting-deploy@v0
        with:
          repoToken: ${{ secrets.GITHUB_TOKEN }}
          firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT }}
          channelId: live
          projectId: my-project
      - name: Upload Protected Content to Firebase Storage
        env:
          GOOGLE_APPLICATION_CREDENTIALS_JSON: ${{ secrets.FIREBASE_SERVICE_ACCOUNT }}
        run: |
          # Configuration
          PROJECT_ID="my-project"
          STORAGE_BUCKET="gs://${PROJECT_ID}.firebasestorage.app"

          # Authenticate with gcloud using service account directly
          echo "$GOOGLE_APPLICATION_CREDENTIALS_JSON" | gcloud auth activate-service-account --key-file=-
          gcloud config set project $PROJECT_ID

          # Set CORS configuration for Firebase Storage
          gsutil cors set storage.cors.json $STORAGE_BUCKET

          # Upload files from upload directory to Firebase Storage
          if [ -d "upload/protected" ]; then
            echo "Uploading protected content to Firebase Storage..."
            cd upload/protected

            # Upload each file with appropriate cache control
            for file in *.html; do
              if [ -f "$file" ]; then
                basename=$(basename "$file" .html)
                echo "Uploading $file to Firebase Storage..."

                # Upload file
                gsutil cp "$file" "${STORAGE_BUCKET}/protected/$file"

                # Set cache control based on TTL file
                if [ -f "${basename}.ttl" ]; then
                  ttl_days=$(cat "${basename}.ttl")
                  ttl_seconds=$((ttl_days * 24 * 60 * 60))
                  gsutil setmeta -h "Cache-Control:public, max-age=${ttl_seconds}" "${STORAGE_BUCKET}/protected/$file"
                fi
                echo "✓ Successfully uploaded $file"
              fi
            done
            cd ../..
          fi