Firebase Setup

Use

firebase_core

for initialization — call

Firebase.initializeApp()

before

runApp()

Authentication

Handle auth state changes via

FirebaseAuth.instance.authStateChanges()

stream in

AuthBloc

Store auth tokens via
```
flutter_secure_storage
```
— never in
```
SharedPreferences
```
or source code
Implement proper sign-out: clear local cache, navigate to login, dispose user-specific BLoCs

Use
```
cloud_firestore
```
for remote data persistence
DataSources wrap all Firestore calls (
```
get
```
,
```
set
```
,
```
update
```
,
```
delete
```
,
```
snapshots
```
)
Use typed model classes with
```
fromFirestore
```
/
```
toFirestore
```
factory methods
Prefer
```
.withConverter<T>()
```
for type-safe collection references
Use batch writes for multi-document operations — never multiple sequential writes
Implement offline persistence (enabled by default on mobile)

NEVER rely on client-side validation alone — enforce rules in Firestore Security Rules
Default deny: start with
```
allow read, write: if false;
```
and open only what's needed
Always validate
```
request.auth != null
```
for authenticated-only collections
Test rules with the Firebase Emulator Suite before deploying

Use
```
firebase_messaging
```
for push notifications
Request notification permissions early but gracefully (explain value before requesting)
Handle foreground, background, and terminated-state messages separately
Store FCM token in Firestore user document for server-side targeting
Re-register token on
```
onTokenRefresh
```
stream

Record Flutter errors:

FlutterError.onError = FirebaseCrashlytics.instance.recordFlutterFatalError

Add custom keys for user context:

Crashlytics.instance.setCustomKey('userId', id)

Log meaningful events with descriptive names:

analytics.logEvent(name: 'purchase_completed')

Set user properties for segmentation:

analytics.setUserProperty(name: 'plan', value: 'premium')