Firebase Authentication — NutriFlow SaaS

{
  "auth": {
    "providers": {
      "anonymous": true,
      "emailPassword": true,
      "googleSignIn": {
        "oAuthBrandDisplayName": "NutriFlow",
        "supportEmail": "soporte@nutriflow.app",
        "authorizedRedirectUris": [
          "https://nutriflow.app",
          "http://localhost"
        ]
      }
    },
    "authorizedDomains": [
      "nutriflow.app",
      "localhost"
    ]
  },
  "hosting": {
    "public": "dist",
    "ignore": ["firebase.json", "**/.*", "**/node_modules/**"],
    "rewrites": [{ "source": "**", "destination": "/index.html" }]
  }
}

# Instalar Firebase CLI e inicializar proyecto
npx -y firebase-tools@latest login
npx -y firebase-tools@latest projects:create nutriflow-prod

# Desplegar configuración de auth (OBLIGATORIO después de editar firebase.json)
npx -y firebase-tools@latest deploy --only auth

# Verificar proveedores activos
npx -y firebase-tools@latest auth:export users.json --project nutriflow-prod

import { initializeApp } from "firebase/app";

const firebaseConfig = {
  apiKey: "AIzaSy...nutriflow-key",
  authDomain: "nutriflow-prod.firebaseapp.com",
  projectId: "nutriflow-prod",
  storageBucket: "nutriflow-prod.appspot.com",
  messagingSenderId: "482019374650",
  appId: "1:482019374650:web:a3f7c2"
};

export const app = initializeApp(firebaseConfig);

import {
  getAuth, connectAuthEmulator,
  createUserWithEmailAndPassword,
  signInWithEmailAndPassword,
  signInWithPopup, GoogleAuthProvider,
  signInAnonymously,
  onAuthStateChanged,
  signOut
} from "firebase/auth";
import { app } from "./config";

const auth = getAuth(app);

// Conectar al emulador local en desarrollo
if (location.hostname === "localhost") {
  connectAuthEmulator(auth, "http://localhost:9099");
}

/** Registro de dietista con email/password */
export const registerDietista = (email, password) =>
  createUserWithEmailAndPassword(auth, email, password);

/** Login con email/password */
export const loginEmail = (email, password) =>
  signInWithEmailAndPassword(auth, email, password);

/** Google Sign-In popup — para pacientes */
export const loginGoogle = () => {
  const provider = new GoogleAuthProvider();
  provider.addScope("email");
  return signInWithPopup(auth, provider);
};

/** Acceso anónimo — demo sin registro */
export const loginAnonimo = () =>
  signInAnonymously(auth);

/** Observer de estado — usar en App.jsx */
export const onAuthChange = (callback) =>
  onAuthStateChanged(auth, callback);

/** Cerrar sesión */
export const logout = () => signOut(auth);

export { auth };

import { useState, useEffect } from "react";
import {
  registerDietista, loginEmail,
  loginGoogle, loginAnonimo,
  onAuthChange, logout
} from "../firebase/auth";

export default function AuthPanel() {
  const [user, setUser] = useState(null);
  const [email, setEmail] = useState("");
  const [password, setPassword] = useState("");
  const [error, setError] = useState(null);

  // Observar cambios de sesión (se limpia al desmontar)
  useEffect(() => {
    const unsubscribe = onAuthChange((u) => setUser(u));
    return unsubscribe;
  }, []);

  const handleError = (err) =>
    setError(err.code === "auth/unauthorized-domain"
      ? "Dominio no autorizado. Añade localhost a Authorized Domains."
      : err.message);

  if (user) {
    return (
      <div className="dashboard">
        <p>Bienvenido, <strong>{user.displayName || user.email}</strong></p>
        <p>UID: {user.uid}</p>
        <p>Email verificado: {user.emailVerified ? "✓" : "✗"}</p>
        <button onClick={logout}>Cerrar sesión</button>
      </div>
    );
  }

  return (
    <div className="auth-panel">
      <h2>Acceder a NutriFlow</h2>

      {/* Email/Password — dietistas */}
      <input type="email" value={email}
        onChange={e => setEmail(e.target.value)}
        placeholder="email@nutriflow.app" />
      <input type="password" value={password}
        onChange={e => setPassword(e.target.value)} />
      <button onClick={() =>
        loginEmail(email, password).catch(handleError)}>
        Entrar con email
      </button>
      <button onClick={() =>
        registerDietista(email, password).catch(handleError)}>
        Registrarme como dietista
      </button>

      {/* Google — pacientes */}
      <button onClick={() =>
        loginGoogle().catch(handleError)}>
        Entrar con Google (pacientes)
      </button>

      {/* Anónimo — demo */}
      <button onClick={() =>
        loginAnonimo().catch(handleError)}>
        Ver demo sin registro
      </button>

      {error && <p className="error">{error}</p>}
    </div>
  );
}

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // ── Perfiles de dietistas ─────────────────────────────
    match /dietistas/{userId} {
      // Cada dietista solo lee y escribe su propio perfil
      allow read, write: if request.auth != null
        && request.auth.uid == userId;
    }

    // ── Pacientes: solo el dietista propietario ───────────
    match /patients/{patientId} {
      allow read, write: if request.auth != null
        && request.auth.uid == resource.data.owner_uid;

      // Crear paciente nuevo: el campo owner_uid debe coincidir
      allow create: if request.auth != null
        && request.resource.data.owner_uid == request.auth.uid;
    }

    // ── Planes de comidas: requiere email verificado ──────
    match /meal_plans/{planId} {
      allow read: if request.auth != null
        && request.auth.uid == resource.data.owner_uid;

      // Solo dietistas con email verificado pueden crear planes
      allow create: if request.auth != null
        && request.auth.token.email_verified == true
        && request.resource.data.owner_uid == request.auth.uid;

      allow update, delete: if request.auth != null
        && request.auth.uid == resource.data.owner_uid;
    }

    // ── Perfil del paciente: solo él mismo puede leer ─────
    match /patient_profiles/{uid} {
      allow read: if request.auth != null
        && request.auth.uid == uid;
      allow write: if request.auth != null
        && request.auth.uid == uid;
    }

    // ── Bloquear todo lo demás por defecto ────────────────
    match /{document=**} {
      allow read, write: if false;
    }
  }
}

import { auth } from "./firebase/auth";

// Obtener el token actual (fuerza renovación si expira pronto)
const getToken = async () => {
  const user = auth.currentUser;
  if (!user) throw new Error("No hay sesión activa");
  return user.getIdToken(/* forceRefresh= */ false);
};

// Enviar al backend NutriFlow API
const fetchPacientes = async () => {
  const token = await getToken();
  const res = await fetch("/api/pacientes", {
    headers: { "Authorization": `Bearer ${token}` }
  });
  return res.json();
};