security: access control for particles (#169)

* setup firebase custom token

* docs

* docs

* feat: allow admin removing members from a network

* fix: properly handle fallback avatar and names

This is especially helpful in the case of members who were removed from
a network

js/src/api/client.ts

@@ -5,6 +5,7 @@ import {
   BillingStatusSchema,
   CheckoutSessionResponseSchema,
   DepotObjectSchema,
+  FirebaseTokenResponseSchema,
   GetLivekitTokenResponseSchema,
   HumanSchema,
   ListInvitationsResponseSchema,
@@ -121,6 +122,14 @@ class ApiClient {
     await this.requestVoid("POST", "/auth/sign-out");
   }
 
+  async getFirebaseToken() {
+    return this.request(
+      FirebaseTokenResponseSchema,
+      "POST",
+      "/auth/firebase-token",
+    );
+  }
+
   // TODO: security: require passing in the particle id once api deprecates this
   async getParticleDownloadUrl(objectId: string): Promise<string> {
     const response = await this.fetch(
@@ -183,10 +192,10 @@ class ApiClient {
     );
   }
 
-  async removeMember(networkId: string, email: string): Promise<void> {
+  async removeMember(networkId: string, humanId: string): Promise<void> {
     await this.requestVoid(
       "DELETE",
-      `/networks/${networkId}/members/${email}`,
+      `/networks/${networkId}/members/${humanId}`,
     );
   }