setup firebase custom token

go/internal/auth/service.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 	"time"
 
+	firebaseauth "firebase.google.com/go/v4/auth"
 	"github.com/flowy-live/llink/genproto/aero"
 	"github.com/flowy-live/llink/internal/utils"
 	"github.com/redis/go-redis/v9"
@@ -56,16 +57,30 @@ type AuthService interface {
 	ExtendSession(ctx context.Context, sessionToken string) error
 	SignOut(ctx context.Context, sessionToken string) error
 
+	// MintFirebaseCustomToken returns a Firebase custom token with uid=humanId
+	// and no custom claims. Network membership is enforced via a Firestore
+	// mirror (humans/{humanId}.networks) read at rule eval time, so the token
+	// only needs to carry identity.
+	MintFirebaseCustomToken(ctx context.Context, humanId string) (string, error)
+
 	IsSystemAdmin(ctx context.Context, email string) bool
 }
 
 type authServiceImpl struct {
 	redisClient *redis.Client
 	aeroSvc     pbaero.PrimaryClient
+	fbAuth      *firebaseauth.Client
 }
 
-func NewAuthService(redisClient *redis.Client, aeroSvc pbaero.PrimaryClient) AuthService {
-	return &authServiceImpl{redisClient: redisClient, aeroSvc: aeroSvc}
+func NewAuthService(redisClient *redis.Client, aeroSvc pbaero.PrimaryClient, fbAuth *firebaseauth.Client) AuthService {
+	return &authServiceImpl{redisClient: redisClient, aeroSvc: aeroSvc, fbAuth: fbAuth}
+}
+
+func (a *authServiceImpl) MintFirebaseCustomToken(ctx context.Context, humanId string) (string, error) {
+	if humanId == "" {
+		return "", errors.New("humanId is required")
+	}
+	return a.fbAuth.CustomToken(ctx, humanId)
 }
 
 func (a *authServiceImpl) IsSystemAdmin(ctx context.Context, email string) bool {