Personal Catalogue: React & Firebase — Chapter 1, Exercise 2
=====================================================================

TASK
Create a Firebase project with Firestore enabled in production mode,
wire up the client SDK in a React app, and confirm a working `db`
reference. Then explain why Firebase's client-side config object is
safe to include directly in frontend source code, when a real
third-party API key is not.

SOLUTION

Setup:
1. Create a project at the Firebase console.
2. Enable Firestore, choosing "production mode" (not "test mode," which
   allows unrestricted reads and writes to anyone with the project's
   config).
3. In the React project: `npm install firebase`.
4. Create `firebase.js`:
   `import { initializeApp } from "firebase/app";`
   `import { getFirestore } from "firebase/firestore";`
   `const firebaseConfig = { apiKey: "...", authDomain: "...", projectId: "..." };`
   `const app = initializeApp(firebaseConfig);`
   `export const db = getFirestore(app);`
5. Import `db` anywhere else in the app and confirm it's a real,
   non-null Firestore instance (e.g. `console.log(db)` from a component
   that imports it).

Run:
Output:
Firestore { app: FirebaseApp {...}, ... }

A real, initialized Firestore instance confirms the config values
successfully reached a real Firebase project.

Explanation:
A traditional server API key is a genuine secret — anyone who obtains
it can act as if they were the server itself, with whatever access that
server has. Firebase's client-side config object is different in kind:
`apiKey`, `authDomain`, and `projectId` only identify *which* Firebase
project a request is talking to, the same way a URL identifies which
website you're visiting. They grant no access on their own. Every
actual read or write is checked against Firestore Security Rules,
evaluated on Firebase's own servers, regardless of what config values
the requesting client presents — so even someone who copies this exact
config object out of the page source can only do whatever the Security
Rules for this project already permit anyone to do.

WHY THIS WORKS AS AN ANSWER
----------------------------
It walks through the real setup steps in the order they need to happen,
shows what confirming a working `db` reference actually looks like
rather than just asserting success, and gives the precise reason the
config object is safe — what it actually identifies vs. what a real
secret would grant — rather than a vague "Firebase handles security for
you" claim.