Project structure · Backend
Firebase (Cloud Functions and security rules) project structure
Opens with creditsFor students building an app on Firebase who need a real backend: Cloud Functions (2nd gen) in TypeScript, Firestore and Storage security rules with tests, and the Local Emulator Suite. The tree starts from firebase init and grows into feature folders of callables, triggers and scheduled jobs, then adds CI deploys, environments, contract tests and runbooks.
Curated by Tauseef FayyazIntermediate137 files and foldersFirebase CLI 15.32, firebase-functions 7.4, firebase-admin 14.5Checked October 2026How it grows
Each stage opens the explorer there
- 1Day 1What the scaffold and your first hour give you21 files and folders
- 2GrowingWhat a real app with features and tests adds+59 files and folders
- ProductionWhat running it for real users adds+25 files and foldersOpens with credits
- ExpertWhat a team needs to keep it healthy for years+32 files and foldersOpens with credits
How it is organised
- Security rules are your real backend for anything the app reads or writes directly. Write them deny-first, and test every rule with the emulator before it ships.
- Clients write only what the user owns. Anything that involves money, roles, counts or other users goes through a callable function, where the server decides.
- functions/src/index.ts is a list of exports; code lives in feature folders (orders, users, notifications) with shared helpers in shared/. A feature never imports another feature.
- Every trigger is idempotent: events can arrive twice or out of order, so check whether the work was done before doing it.
- Configuration comes from params: plain values in functions/.env files per project, secrets in Secret Manager through defineSecret. Nothing secret is committed.
- Develop and test against the Local Emulator Suite with a demo- project id, so tests never touch real data and cost nothing.
- Set cost guards from day 1: maxInstances, a region close to your database, and a budget alert on the Google Cloud project.
- Only CI deploys, and always with --only, so each deploy changes exactly what the pull request changed.
At the top of the project
Open one in the explorer for the full story
- my-firebase-app/
- .firebase/CLI cache for hosting deploys and emulator state.
- .vscode/Shared editor settings and recommended extensions.1 inside
- functions/The Cloud Functions codebase: a Node.js package of its own, written in TypeScript.15 inside
- node_modules/Root dev tools: the pinned firebase-tools CLI and git hooks.
- scripts/One-off and repeatable scripts that use the Admin SDK.2 inside
- seed/Exported emulator data that every developer and test run starts from.3 inside
- tests/Security rules tests and end-to-end tests, run against the emulators.3 inside
- .firebasercProject aliases: which Firebase project "default", "staging" and "prod" mean.
- .gitignoreIgnores logs, the .firebase cache, node_modules and .env.
- lefthook.ymlGit hooks: lint and type check the functions before each commit.
- .nvmrcThe Node.js version for local development, matching engines.node.
- AGENTS.mdInstructions for AI coding agents: commands, folder rules, rules-first security.
- README.mdHow to install, run the emulators, test and deploy.
- database.rules.jsonRealtime Database rules, only if you chose Realtime Database in firebase init.
- firebase-debug.logDetailed CLI log written when a command fails.
- firebase.jsonWhich rules and index files to deploy, the functions source and predeploy steps, and emulator ports.
- firestore.indexes.jsonComposite indexes and field overrides for Firestore queries.
- firestore.rulesWho can read and write which Firestore documents.
- package.jsonRoot scripts and dev tools: pinned firebase-tools, test:emulated, git hooks.
- package-lock.jsonExact versions of the root dev tools.
- storage.rulesWho can upload, read and delete files in Cloud Storage.
Learn more on Sefism
Roadmaps, cheat sheets and projects that go with Firebase (Cloud Functions and security rules).
- Roadmap· Node.jsBackend development roadmapAPIs, databases, auth, deploys
- RoadmapMobile development roadmapApps for Android and iOS
- RoadmapCybersecurity roadmapDefend systems, test them, secure code
- Cheat sheetBackend development cheat sheetAPIs, databases, auth, deploys.
- Cheat sheetChoosing the right database cheat sheetSQL, document, cache, search, vector and more.
- FYP idea· BeginnerOffline Bird Call Survey App for Wetland and Wildlife Field TeamsBuild an Android app that records bird calls during a structured field survey, identifies likely species on the phone with an open bird sound model, filters suggestions to species expected in that region and season, and sends uncertain recordings to an expert for review. Wildlife departments, university ecology groups and birdwatchers survey Pakistan's wetlands, often with paper forms and no signal. The project turns each survey into consistent, checkable data.
- FYP idea· IntermediateVideo-Observed TB Treatment App with Offline Upload for Patients and Treatment SupportersBuild an Android app that lets a tuberculosis patient record a short video of taking each day's medicine, stores it encrypted, uploads it when there is signal and lets a treatment supporter review doses and follow up on missed ones. Daily in-person observation is hard for patients who work, live far from a clinic or have to travel. The project follows the model of a published randomised trial and focuses on making it work on cheap phones and poor connections.
- FYP idea· IntermediateSchool Hearing Screening App with Ambient Noise Monitoring and Referral TrackingBuild an Android app that lets a school nurse or trained teacher run a pure-tone hearing screen with calibrated headphones, refuses to test when the room is too noisy, catches children who tap at random and tracks referrals to an audiologist. Many children with hearing loss in Pakistan are never screened and are seen as inattentive in class. The project follows a published smartphone screening method and checks its results against an audiologist's tests.
- QuestionShould I use Firebase or Supabase for my app?Both let you ship an app fast with auth, a database, storage and hosting-style services. Supabase is built on PostgreSQL, so it suits relational data and SQL skills you will reuse anywhere. Firebase is a mature Google platform with a document database and strong mobile tooling. Choose by your data shape, your platform, and how much you want to learn transferable database skills.
See 7 moreShow fewer
- QuestionShould I use PostgreSQL or MongoDB for my project?For most student and startup projects, PostgreSQL is the safer default: relational data, joins, constraints and transactions fit most apps, and it handles JSON and vector search too. MongoDB is a good fit when your data is naturally document-shaped and varies a lot, or your team already knows it well. Model your data first, then choose.
- QuestionHow do I practise on AWS, Azure or Google Cloud without getting a surprise bill?Use the free offer that fits you, set a budget alert before you create anything, tag every resource, build and destroy your labs with code, and run a five-minute check for the usual culprits, such as NAT gateways, load balancers, databases and public IPs, before you close your laptop.
- Resource· GuideFirebase DocumentationThe official guides for Firebase, Google's app development platform and the backend many student mobile and web apps start on. It covers Authentication, Cloud Firestore and Realtime Database, Cloud Storage, Cloud Functions, Hosting, Cloud Messaging for push notifications, Crashlytics, Analytics and newer AI features, with setup for Android, iOS, web and Flutter. The docs are free; services have a free tier and pay-as-you-go usage beyond it.
- Resource· GuideGoogle Cloud DocumentationThe official documentation for every Google Cloud product, now at docs.cloud.google.com: product guides, quickstarts, the gcloud CLI reference, the Cloud Architecture Center and the Well-Architected Framework. Free, and the reference Associate Cloud Engineer questions follow.
- Resource· GuideThe TypeScript HandbookThe TypeScript Handbook is the official, free guide to TypeScript's type system from the TypeScript team, written for working programmers and kept current with each release. It covers everyday types, narrowing, functions, object types, generics, type manipulation, classes and modules, and it is designed to be read in a few hours. It suits JavaScript developers adopting TypeScript and anyone who writes types by copying patterns without understanding them.
- Resource· GuideVitest DocumentationThe official documentation for Vitest, the test runner built on Vite. Its getting started guide has you writing and running a real test in minutes, then covers matchers, async tests, setup and teardown, mocking (functions, modules, timers, dates, requests), snapshots, coverage, the UI dashboard and browser mode for component tests. It uses a Jest-compatible API, so it suits JavaScript and TypeScript developers starting to test, and teams moving from Jest.
- Resource· GuideGitHub Actions DocumentationThe official documentation for GitHub Actions, GitHub's built in CI/CD and automation system: workflow syntax, triggers, runners, caching, artifacts, environments, secrets and OpenID Connect deployments to AWS, Azure and Google Cloud. Actions is free for public repositories on standard runners, so it is the CI tool most students and open source projects learn first. It suits developers setting up tests and deployments for the first time.
Checked against 18 official sources, October 2026. If something has changed, the docs win.Show sourcesHide sources
- firebase-tools init templates
- Cloud Functions: Get started (TypeScript)
- Cloud Functions: Configure your environment (params and secrets)
- Cloud Functions: Organize multiple functions (codebases)
- Cloud Functions: Manage functions (runtimes and regions)
- Cloud Firestore triggers
- Call functions from your app (callables)
- Enqueue functions with Cloud Tasks
- Schedule functions
- Extend Firebase Authentication with blocking functions
- Unit testing of Cloud Functions
- Local Emulator Suite
- Build unit tests for security rules
- Get started with Cloud Firestore Security Rules
- Manage indexes in Cloud Firestore
- Firebase App Check
- Install extensions from a manifest
- google-github-actions/auth (Workload Identity Federation)
Best practices and checklists for this stack
Picked from the other libraries by shared topics.
Best practices
See all- Authentication Best PracticesBuild sign-in that holds up: password rules from NIST, Argon2id hashing, login throttling, MFA and passkeys, secure sessions and safe account recovery.
- Secure Coding Best PracticesWrite code that resists attack: untrusted input, validation, parameterized queries, output encoding, safe parsing, uploads, SSRF and errors that fail closed.
- Node.js API Best PracticesBuild Node.js REST APIs that hold up in production: structure, validation, error handling, security headers, rate limits, logging, testing and graceful shutdown.
Checklists
See all- Production Readiness ChecklistCheck a service before it takes real traffic: ownership, SLOs, capacity, timeouts and retries, alerts, rollout and rollback, backups, security and on-call.
- API Security ChecklistCheck your REST or GraphQL API against the OWASP API Security Top 10: authentication, object authorization, rate limits, input validation, SSRF, CORS and logging.
- Database Migration ChecklistCheck a schema or data migration before it ships: expand and contract, lock behaviour, online indexes, batched backfills, rehearsal on real data, backups, rollback, deploy order and monitoring.
Work with me
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com