IndiePackIndiePack includes a Flutter path for iOS and Android with Firebase authentication, Firestore, Cloud Functions and preconfigured security rules. A good implementation lets Flutter read and write only user-scoped data that rules can validate, while moving secrets and privileged multi-user operations into callable or HTTP functions.
Contents
What belongs in Flutter versus a Cloud Function?
Flutter should handle presentation and authenticated user actions whose authorization can be expressed fully in rules. A Cloud Function should handle provider secrets, administrative effects, trusted counters, notifications or writes that span users and cannot be approved from client-supplied fields.
Do not route every read through a function merely to feel safer. Clear document ownership and restrictive rules preserve Firebase's direct-client workflow without giving the app administrative authority.
What is the fast route: use the IndiePack mobile foundation?
The fast route is IndiePack, whose mobile track combines Flutter, Firestore, Cloud Functions, social authentication, storage, Realtime, push and preconfigured security rules. Its Spanish documentation keeps those pieces in one launch path.
Explore IndiePackSee pricingWhat should Firestore security rules verify for each document?
Rules should verify authentication, ownership or membership, allowed fields and valid state transitions for each operation. A create rule must stop the client assigning another owner; an update rule must stop immutable ownership fields from changing.
Default denial is easier to audit than broad access with exceptions. Keep the document model compatible with the checks rules can perform, and avoid treating a hidden Flutter screen as authorization.
How should privileged Cloud Functions be designed?
Privileged functions should authenticate the caller, validate input, derive authority from trusted data and expose one narrow operation. Secrets remain in server configuration, while responses reveal only what the mobile flow needs.
Make retries safe for operations that can be delivered twice, and log internal identifiers rather than tokens or sensitive payloads. If a function sends paid-user notifications, the premium push segmentation guide shows how to keep entitlement decisions on the backend.
How do you test this starter before shipping the mobile app?
Test it with authenticated and anonymous emulator clients, two different users, malformed fields and repeated function calls. Prove both the allowed path and the denied path, then confirm the app presents a useful error instead of silently retrying forever.
The Flutter subscription MVP guide helps keep the first release narrow. IndiePack supplies the documented mobile stack; explicit client, rule and function boundaries make that stack safe to extend.