setup firebase custom token

go/internal/handler/handler.go

@@ -94,6 +94,10 @@ type SignInResponse struct {
 	Token string `json:"token"`
 }
 
+type FirebaseTokenResponse struct {
+	Token string `json:"token"`
+}
+
 // Network Request DTOs
 
 type CreateNetworkRequest struct {
@@ -240,6 +244,27 @@ func (h *Handler) SignIn(w http.ResponseWriter, r *http.Request) {
 	json.NewEncoder(w).Encode(resp)
 }
 
+// FirebaseToken mints a Firebase custom token for the authenticated human so
+// the client can signInWithCustomToken and have request.auth.uid populated in
+// Firestore security rules.
+func (h *Handler) FirebaseToken(w http.ResponseWriter, r *http.Request) {
+	humanId, ok := middleware.HumanIdFromContext(r.Context())
+	if !ok {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+
+	token, err := h.authSvc.MintFirebaseCustomToken(r.Context(), humanId)
+	if err != nil {
+		slog.Error("failed to mint Firebase custom token", "error", err, "humanId", humanId)
+		http.Error(w, "internal server error", http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(FirebaseTokenResponse{Token: token})
+}
+
 // SignOut deletes the session from the token in headers
 func (h *Handler) SignOut(w http.ResponseWriter, r *http.Request) {
 	token := extractBearerToken(r)