feat(schematics): generate .firebaserc and Firestore starter files during ng add

ng add asks the user to pick a Firebase project but never records the
choice, so every later firebase-tools command has no default project.
It also leaves firebase.json empty and creates no security rules, so a
Firestore-selected workspace cannot deploy rules at all.

Now, after the project prompt, the schematic records the selection in
.firebaserc (merging into an existing file rather than replacing it).
When Firestore is selected it also generates firestore.rules and
firestore.indexes.json — the same test-mode starter files that
'firebase init firestore' produces, with a warning that the rules
expire in 30 days — and wires the firestore section into firebase.json.
Existing rules files are left untouched.

The new files go through the schematic Tree; firebase.json stays on the
real filesystem because firebase-tools reads and rewrites it during the
same run, and its firestore section is added only after those rewrites.

Author: armando-navarro

src/schematics/interfaces.ts

@@ -155,9 +155,15 @@ export interface DataConnectConfig {
   source?: string;
 }
 
+export interface FirebaseFirestoreConfig {
+  rules?: string;
+  indexes?: string;
+}
+
 export interface FirebaseJSON {
   hosting?: FirebaseHostingConfig[] | FirebaseHostingConfig;
   functions?: FirebaseFunctionsConfig;
+  firestore?: FirebaseFirestoreConfig;
   dataconnect?: DataConnectConfig;
 }
 

src/schematics/setup/firebaseConfigs.jasmine.ts

@@ -0,0 +1,168 @@
+import { mkdtempSync, readFileSync, writeFileSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { logging } from '@angular-devkit/core';
+import { HostTree, SchematicContext } from '@angular-devkit/schematics';
+import fsExtra from 'fs-extra';
+import { FEATURES } from '../interfaces.js';
+import {
+  addFirestoreToFirebaseJson,
+  createFirestoreStarterFiles,
+  setDefaultProjectInFirebaseRc,
+} from './firebaseConfigs.js';
+import 'jasmine';
+
+const context = { logger: new logging.Logger('test') } as unknown as SchematicContext;
+
+describe('setDefaultProjectInFirebaseRc', () => {
+  let projectRoot: string;
+
+  beforeEach(() => {
+    projectRoot = mkdtempSync(join(tmpdir(), 'angularfire-test-'));
+  });
+
+  afterEach(() => {
+    fsExtra.removeSync(projectRoot);
+  });
+
+  const firebaseRcOnDisk = () =>
+    JSON.parse(readFileSync(join(projectRoot, '.firebaserc')).toString());
+
+  it('creates .firebaserc recording the selected project as default', () => {
+    setDefaultProjectInFirebaseRc(projectRoot, 'my-project');
+    expect(firebaseRcOnDisk()).toEqual({
+      projects: { default: 'my-project' },
+    });
+  });
+
+  it('merges into an existing .firebaserc, preserving targets and other aliases', () => {
+    writeFileSync(join(projectRoot, '.firebaserc'), JSON.stringify({
+      projects: { default: 'old-project', staging: 'staging-project' },
+      targets: { 'old-project': { hosting: { app: ['app-site'] } } },
+    }));
+    setDefaultProjectInFirebaseRc(projectRoot, 'new-project');
+    expect(firebaseRcOnDisk()).toEqual({
+      projects: { default: 'new-project', staging: 'staging-project' },
+      targets: { 'old-project': { hosting: { app: ['app-site'] } } },
+    });
+  });
+
+  it('names the file when an existing .firebaserc cannot be parsed', () => {
+    writeFileSync(join(projectRoot, '.firebaserc'), '{ not json');
+    expect(() => setDefaultProjectInFirebaseRc(projectRoot, 'my-project'))
+      .toThrowError(/\.firebaserc/);
+  });
+
+});
+
+describe('createFirestoreStarterFiles', () => {
+
+  it('creates test-mode rules and an empty index manifest when Firestore is selected', () => {
+    const tree = new HostTree();
+    createFirestoreStarterFiles(tree, context, [FEATURES.Firestore]);
+    const rules = tree.readText('/firestore.rules');
+    expect(rules).toContain("rules_version='2'");
+    expect(rules).toContain('allow read, write: if request.time < timestamp.date(');
+    expect(JSON.parse(tree.readText('/firestore.indexes.json'))).toEqual({
+      indexes: [],
+      fieldOverrides: [],
+    });
+  });
+
+  it('sets the rules to expire roughly 30 days out', () => {
+    const tree = new HostTree();
+    createFirestoreStarterFiles(tree, context, [FEATURES.Firestore]);
+    const match = /timestamp\.date\((\d+), (\d+), (\d+)\)/.exec(tree.readText('/firestore.rules'));
+    expect(match).not.toBeNull();
+    const [, year, month, day] = match.map(Number);
+    const expiry = new Date(year, month - 1, day);
+    const daysOut = (expiry.getTime() - Date.now()) / (1000 * 60 * 60 * 24);
+    expect(daysOut).toBeGreaterThan(28);
+    expect(daysOut).toBeLessThan(31);
+  });
+
+  it('never overwrites an existing rules file', () => {
+    const tree = new HostTree();
+    tree.create('/firestore.rules', 'my existing rules');
+    createFirestoreStarterFiles(tree, context, [FEATURES.Firestore]);
+    expect(tree.readText('/firestore.rules')).toBe('my existing rules');
+  });
+
+  it('still creates the index manifest when only the rules file exists', () => {
+    const tree = new HostTree();
+    tree.create('/firestore.rules', 'my existing rules');
+    createFirestoreStarterFiles(tree, context, [FEATURES.Firestore]);
+    expect(tree.exists('/firestore.indexes.json')).toBeTrue();
+  });
+
+  it('does nothing when Firestore is not selected', () => {
+    const tree = new HostTree();
+    createFirestoreStarterFiles(tree, context, [FEATURES.Authentication]);
+    expect(tree.exists('/firestore.rules')).toBeFalse();
+    expect(tree.exists('/firestore.indexes.json')).toBeFalse();
+  });
+
+  it('creates nothing when firebase.json already has a firestore section', () => {
+    const tree = new HostTree();
+    createFirestoreStarterFiles(tree, context, [FEATURES.Firestore], {
+      firestore: { rules: 'custom.rules' },
+    });
+    expect(tree.exists('/firestore.rules')).toBeFalse();
+    expect(tree.exists('/firestore.indexes.json')).toBeFalse();
+  });
+
+});
+
+describe('addFirestoreToFirebaseJson', () => {
+  let projectRoot: string;
+
+  beforeEach(() => {
+    projectRoot = mkdtempSync(join(tmpdir(), 'angularfire-test-'));
+  });
+
+  afterEach(() => {
+    fsExtra.removeSync(projectRoot);
+  });
+
+  const firebaseJsonOnDisk = () =>
+    JSON.parse(readFileSync(join(projectRoot, 'firebase.json')).toString());
+
+  it('adds the firestore section pointing at the starter files', () => {
+    writeFileSync(join(projectRoot, 'firebase.json'), '{}');
+    addFirestoreToFirebaseJson(projectRoot, context, [FEATURES.Firestore]);
+    expect(firebaseJsonOnDisk().firestore).toEqual({
+      rules: 'firestore.rules',
+      indexes: 'firestore.indexes.json',
+    });
+  });
+
+  it('preserves sections other tools wrote to firebase.json', () => {
+    writeFileSync(join(projectRoot, 'firebase.json'), JSON.stringify({
+      dataconnect: { source: 'dataconnect' },
+    }));
+    addFirestoreToFirebaseJson(projectRoot, context, [FEATURES.Firestore]);
+    expect(firebaseJsonOnDisk().dataconnect).toEqual({ source: 'dataconnect' });
+    expect(firebaseJsonOnDisk().firestore).toBeDefined();
+  });
+
+  it('leaves an existing firestore section untouched', () => {
+    writeFileSync(join(projectRoot, 'firebase.json'), JSON.stringify({
+      firestore: { rules: 'custom.rules' },
+    }));
+    addFirestoreToFirebaseJson(projectRoot, context, [FEATURES.Firestore]);
+    expect(firebaseJsonOnDisk().firestore).toEqual({ rules: 'custom.rules' });
+  });
+
+  it('does nothing when Firestore is not selected', () => {
+    writeFileSync(join(projectRoot, 'firebase.json'), '{}');
+    addFirestoreToFirebaseJson(projectRoot, context, [FEATURES.Authentication]);
+    expect(firebaseJsonOnDisk().firestore).toBeUndefined();
+  });
+
+  it('warns and skips when firebase.json cannot be read', () => {
+    const warnSpy = spyOn(context.logger, 'warn');
+    addFirestoreToFirebaseJson(projectRoot, context, [FEATURES.Firestore]);
+    expect(warnSpy).toHaveBeenCalled();
+  });
+
+});

src/schematics/setup/firebaseConfigs.ts

@@ -0,0 +1,119 @@
+import { existsSync, readFileSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { SchematicContext, SchematicsException, Tree } from '@angular-devkit/schematics';
+import { stringifyFormatted } from '../common.js';
+import { FEATURES, FirebaseJSON, FirebaseRc } from '../interfaces.js';
+
+/**
+ * Builds the same test-mode starter rules `firebase init firestore` generates: anyone can read
+ * and write until a date 30 days from generation, after which all client requests are denied.
+ */
+const testModeFirestoreRules = () => {
+  const expiry = new Date();
+  expiry.setDate(expiry.getDate() + 30);
+  return `rules_version='2'
+
+service cloud.firestore {
+  match /databases/{database}/documents {
+    match /{document=**} {
+      // This rule allows anyone with your database reference to view, edit,
+      // and delete all data in your database. It is useful for getting
+      // started, but it is configured to expire after 30 days because it
+      // leaves your app open to attackers. At that time, all client
+      // requests to your database will be denied.
+      //
+      // Make sure to write security rules for your app before that time, or
+      // else all client requests to your database will be denied until you
+      // update your rules.
+      allow read, write: if request.time < timestamp.date(${expiry.getFullYear()}, ${expiry.getMonth() + 1}, ${expiry.getDate()});
+    }
+  }
+}
+`;
+};
+
+/**
+ * Records the selected Firebase project as the workspace's default in `.firebaserc`, so
+ * firebase-tools commands the user runs after setup completes don't prompt for (or fail without)
+ * a project. Merges into an existing file — only `projects.default` is set; targets and other
+ * aliases are preserved. Written to the real filesystem (not the schematic Tree) because
+ * `firebaseTools.init` writes `.firebaserc` on disk during the same `ng add` run — a Tree-staged
+ * copy would collide with it when the schematic commits; call this after the last
+ * `firebaseTools.init` call for that reason.
+ */
+export const setDefaultProjectInFirebaseRc = (projectRoot: string, projectId: string) => {
+  const path = join(projectRoot, '.firebaserc');
+  let rc: FirebaseRc = {};
+  if (existsSync(path)) {
+    try {
+      rc = JSON.parse(readFileSync(path).toString());
+    } catch (e) {
+      throw new SchematicsException(`Error when parsing ${path}: ${e.message}`);
+    }
+  }
+  rc.projects = { ...rc.projects, default: projectId };
+  writeFileSync(path, stringifyFormatted(rc));
+};
+
+/**
+ * When Firestore is selected, generates `firestore.rules` (test mode, with a logged warning
+ * about the 30-day expiry) and `firestore.indexes.json`. Existing files are never overwritten —
+ * a later `firebase deploy` would replace rules already deployed from elsewhere. A workspace
+ * whose firebase.json already has a `firestore` section is left entirely untouched: its section
+ * may point at differently-named files, and creating the default-named ones would only add
+ * orphans nothing references.
+ */
+export const createFirestoreStarterFiles = (
+  host: Tree,
+  context: SchematicContext,
+  features: FEATURES[],
+  firebaseJsonConfig?: FirebaseJSON,
+) => {
+  if (!features.includes(FEATURES.Firestore)) { return; }
+  if (firebaseJsonConfig?.firestore) {
+    context.logger.info('firebase.json already has a firestore section — leaving its rules and indexes untouched.');
+    return;
+  }
+  if (host.exists('/firestore.rules')) {
+    context.logger.info('firestore.rules already exists — leaving it untouched.');
+  } else {
+    host.create('/firestore.rules', testModeFirestoreRules());
+    context.logger.warn(
+      'Generated firestore.rules in test mode: anyone can read and write your database until the rules expire in 30 days. ' +
+      'Write real security rules before then — https://firebase.google.com/docs/rules'
+    );
+  }
+  if (!host.exists('/firestore.indexes.json')) {
+    // Must exist once firebase.json references it — `firebase deploy` errors on a missing indexes file.
+    host.create('/firestore.indexes.json', stringifyFormatted({ indexes: [], fieldOverrides: [] }));
+  }
+};
+
+/**
+ * When Firestore is selected, points the `firestore` section of `firebase.json` at the starter
+ * files so `firebase deploy` includes rules and indexes. Written to the real filesystem (not the
+ * schematic Tree) because firebase-tools reads and rewrites `firebase.json` during the same
+ * `ng add` run; call this after the last `firebaseTools.init` call for that reason.
+ */
+export const addFirestoreToFirebaseJson = (
+  projectRoot: string,
+  context: SchematicContext,
+  features: FEATURES[],
+) => {
+  if (!features.includes(FEATURES.Firestore)) { return; }
+  // Re-read first: firebaseTools.init calls may have rewritten firebase.json on disk.
+  let firebaseJson: FirebaseJSON;
+  try {
+    firebaseJson = JSON.parse(readFileSync(join(projectRoot, 'firebase.json')).toString());
+  } catch (e) {
+    context.logger.warn(
+      `Could not read firebase.json to add the firestore section (${e.message}). Add ` +
+      '{ "firestore": { "rules": "firestore.rules", "indexes": "firestore.indexes.json" } } to it manually.'
+    );
+    return;
+  }
+  if (!firebaseJson.firestore) {
+    firebaseJson.firestore = { rules: 'firestore.rules', indexes: 'firestore.indexes.json' };
+    writeFileSync(join(projectRoot, 'firebase.json'), stringifyFormatted(firebaseJson));
+  }
+};

src/schematics/setup/index.ts

@@ -16,6 +16,11 @@ import {
   parseDataConnectConfig,
   setupTanstackDependencies,
 } from '../utils';
+import {
+  addFirestoreToFirebaseJson,
+  createFirestoreStarterFiles,
+  setDefaultProjectInFirebaseRc,
+} from './firebaseConfigs';
 import { appPrompt, featuresPrompt, projectPrompt, userPrompt } from './prompts';
 
 // FirebaseOptions keys — apps.sdkconfig responses include management-API extras that initializeApp() rejects.
@@ -84,7 +89,9 @@ export const ngAddSetupProject = (
     const [ defaultProjectName ] = getFirebaseProjectNameFromHost(host, ngProjectName);
 
     const firebaseProject = await projectPrompt(defaultProjectName, { projectRoot, account: user.email });
-    
+
+    createFirestoreStarterFiles(host, context, features, firebaseJson);
+
     let firebaseApp: FirebaseApp|undefined;
     let sdkConfig: Record<string, string>|undefined;
 
@@ -139,9 +146,14 @@ export const ngAddSetupProject = (
           setupTanstackDependencies(host, context);
           setupConfig.dataConnectConfig = dataConnectConfig;
         }
-      
+
     }
 
+    // Both write the real filesystem, after the last firebaseTools.init call — init writes
+    // .firebaserc and rewrites firebase.json on disk during the run.
+    setDefaultProjectInFirebaseRc(projectRoot, firebaseProject.projectId);
+    addFirestoreToFirebaseJson(projectRoot, context, features);
+
     return setupProject(host, context, features, setupConfig);
   }
 };