security: access control for particles (#169)

* setup firebase custom token

* docs

* docs

* feat: allow admin removing members from a network

* fix: properly handle fallback avatar and names

This is especially helpful in the case of members who were removed from
a network

go/internal/handler/handler.go

@@ -94,6 +94,10 @@ type SignInResponse struct {
 	Token string `json:"token"`
 }
 
+type FirebaseTokenResponse struct {
+	Token string `json:"token"`
+}
+
 // Network Request DTOs
 
 type CreateNetworkRequest struct {
@@ -240,6 +244,27 @@ func (h *Handler) SignIn(w http.ResponseWriter, r *http.Request) {
 	json.NewEncoder(w).Encode(resp)
 }
 
+// FirebaseToken mints a Firebase custom token for the authenticated human so
+// the client can signInWithCustomToken and have request.auth.uid populated in
+// Firestore security rules.
+func (h *Handler) FirebaseToken(w http.ResponseWriter, r *http.Request) {
+	humanId, ok := middleware.HumanIdFromContext(r.Context())
+	if !ok {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+
+	token, err := h.authSvc.MintFirebaseCustomToken(r.Context(), humanId)
+	if err != nil {
+		slog.Error("failed to mint Firebase custom token", "error", err, "humanId", humanId)
+		http.Error(w, "internal server error", http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(FirebaseTokenResponse{Token: token})
+}
+
 // SignOut deletes the session from the token in headers
 func (h *Handler) SignOut(w http.ResponseWriter, r *http.Request) {
 	token := extractBearerToken(r)
@@ -521,34 +546,28 @@ func (h *Handler) AddMembersToNetwork(w http.ResponseWriter, r *http.Request) {
 	json.NewEncoder(w).Encode(resp)
 }
 
-// RemoveMemberFromNetwork removes a member from a network
+// RemoveMemberFromNetwork removes a member from a network. Admin-only.
+// Admins cannot remove themselves — doing so would leave networks.admin_human_id
+// dangling. Removal of a non-member is a no-op (204).
 func (h *Handler) RemoveMemberFromNetwork(w http.ResponseWriter, r *http.Request) {
-	humanId, ok := middleware.HumanIdFromContext(r.Context())
+	net, _, ok := h.loadNetworkForAdmin(w, r)
 	if !ok {
-		http.Error(w, "unauthorized", http.StatusUnauthorized)
 		return
 	}
 
-	networkID := r.PathValue("id")
 	memberHumanId := r.PathValue("humanId")
-	if networkID == "" || memberHumanId == "" {
-		http.Error(w, "network id and member humanId are required", http.StatusBadRequest)
+	if memberHumanId == "" {
+		http.Error(w, "member humanId is required", http.StatusBadRequest)
 		return
 	}
 
-	isMember, err := h.networkSvc.IsMember(r.Context(), networkID, humanId)
-	if err != nil {
-		slog.Error("failed to check network membership", "error", err, "network_id", networkID, "humanId", humanId)
-		http.Error(w, "internal server error", http.StatusInternalServerError)
-		return
-	}
-	if !isMember {
-		http.Error(w, "access denied", http.StatusForbidden)
+	if memberHumanId == net.AdminHumanId {
+		http.Error(w, "admin cannot remove themselves", http.StatusConflict)
 		return
 	}
 
-	if err := h.networkSvc.RemoveMember(r.Context(), networkID, memberHumanId); err != nil {
-		slog.Error("failed to remove member from network", "error", err, "network_id", networkID, "memberHumanId", memberHumanId)
+	if err := h.networkSvc.RemoveMember(r.Context(), net.ID, memberHumanId); err != nil {
+		slog.Error("failed to remove member from network", "error", err, "network_id", net.ID, "memberHumanId", memberHumanId)
 		http.Error(w, "internal server error", http.StatusInternalServerError)
 		return
 	}