Selected stack
| Responsibility | Service | Reason |
|---|---|---|
| Source | GitHub | Version control, reviews, tests, deployment workflows |
| Frontend | Firebase Hosting | Fast static hosting, HTTPS, custom domain, preview deployments |
| Identity | Auth0 | Universal Login and role-based identity |
| Backend | Cloud Run + FastAPI | Server-side token validation and business rules |
| Data | Firestore | Serverless document database integrated with Google Cloud |
| Files | Private Cloud Storage | Protected PDFs and uploads through short-lived access |
| Secrets | Secret Manager | No secrets in repositories or browser code |
Protected request flow
1. User signs in
2. Auth0 issues token
3. Browser calls API
4. API verifies role
5. Data is returned
Security boundary: hiding a button is user-interface behavior. The Cloud Run API must independently verify the token, role, ownership, and requested operation.
Repository model
| Repository | Visibility | Purpose |
|---|---|---|
| Become-SWE | Public | Lessons, PDFs, tutorials, mistakes, and learning record |
| swe-tickerbell | Public | Frontend HTML, CSS, JavaScript, images, and safe configuration |
| swe-backend | Private | Python API, authorization, models, tests, and migrations |
Non-negotiable rules
- No Auth0 client secret, API key, service-account key, password, or customer data in GitHub.
- Use GitHub-to-Google workload identity rather than long-lived deployment keys.
- Give the Cloud Run service account only the Firestore and Storage permissions it needs.
- Store protected PDFs in a private bucket, never in the public frontend repository.
- Record admin changes in an audit log.
Implementation phases
- Run this frontend locally and review the page structure.
- Create Auth0 tenant and connect login/logout.
- Deploy frontend preview to Firebase Hosting.
- Create private FastAPI backend and one protected profile endpoint.
- Add Firestore learner profile and progress documents.
- Add team content operations and admin analytics.