firebase.json

{
  "flutter": {
    "platforms": {
      "android": {
        "default": {
          "projectId": "zs-auth-app",
          "appId": "1:18736676875:android:29ce1b60c5a33d3d87870e",
          "fileOutput": "android/app/google-services.json"
        }
      },
      "dart": {
        "lib/firebase_options.dart": {
          "projectId": "zs-auth-app",
          "configurations": {
            "android": "1:18736676875:android:29ce1b60c5a33d3d87870e",
            "ios": "1:18736676875:ios:5edcdd1ea9a7393787870e",
            "macos": "1:18736676875:ios:5edcdd1ea9a7393787870e",
            "web": "1:18736676875:web:81e99c4b04da97fe87870e",
            "windows": "1:18736676875:web:9f70ad50fdc41c5887870e"
          }
        }
      }
    }
  },
  "hosting": {
    "public": "build/web",
    "ignore": [
      "firebase.json",
      "**/.*"
    ],
    "frameworksBackend": {
      "region": "europe-west1"
    },
    /* ───────────── Self-hosted backend for email verification ─────────── */
    "redirects": [
      {
        "source": "/verify-email",
        "destination": "https://auth-demo-api.dmitrii.app/verify-email",
        "type": 307
      },
      /* ───────────── /verify-email/something ─────────── */
      {
        "source": "/verify-email/:path*",
        "destination": "https://auth-demo-api.dmitrii.app/verify-email/:path*",
        "type": 307
      }
    ],
    "rewrites": [
      /* ─────────────  Cloud Run backend for email verification
      {
        "source": "/verify-email{,/**}",
        "run": {
          "serviceId": "auth-app-api",
          "region": "europe-west1",
          "pinTag": false
        }
      },*/
      {
        "source": "**",
        "destination": "/index.html"
      }
    ],
    // ── Cache-Control policy ──────────────────────────────────────────
    // The Service Worker generated by `sw: ^0.1.2` owns all caching:
    // it precaches Core/Required resources with MD5-versioned URLs and
    // lazy-caches Optional assets. The HTTP layer must therefore stay
    // out of the way — a single `Cache-Control: no-cache` on every path
    // lets browsers keep files on disk but forces a conditional GET on
    // each load (Firebase replies with 304 when unchanged).
    //
    // Why a blanket rule rather than per-file no-cache + per-extension
    // wildcards:
    //   - Firebase applies matching `headers` entries top-to-bottom and
    //     the last match wins for a given key. A trailing wildcard on
    //     js/wasm/json extensions therefore silently overrode the
    //     explicit no-cache on /bootstrap.js, /sw.js, /version.json.
    //   - Flutter's `--tree-shake-icons` (see deploy/build_flutter_web.sh)
    //     mutates MaterialIcons-Regular.otf between builds while keeping
    //     its filename stable — URL-cache-busting does not exist for it,
    //     so an HTTP-level `max-age` would be unsafe. The SW manifest
    //     fingerprints every asset by content hash and handles staleness.
    //
    // See packages/sw README (DoctorinaAI/service-worker-generator) for
    // the reference server config this mirrors.
    "headers": [
      {
        "source": "**",
        "headers": [
          {
            "key": "X-Frame-Options",
            "value": "DENY"
          },
          {
            "key": "X-Content-Type-Options",
            "value": "nosniff"
          },
          {
            "key": "Referrer-Policy",
            "value": "no-referrer"
          },
          {
            "key": "Strict-Transport-Security",
            "value": "max-age=31536000; includeSubDomains; preload"
          },
          /* ─────────────  Enable WASM multithreading (SharedArrayBuffer) ─────────── */
          {
            "key": "Cross-Origin-Opener-Policy",
            "value": "same-origin"
          },
          {
            "key": "Cross-Origin-Embedder-Policy",
            "value": "require-corp"
          },
          /* ─────────────  Enable WASM multithreading (SharedArrayBuffer)  ─────────── */
          {
            "key": "Cache-Control",
            "value": "no-cache"
          }
        ]
      },
      {
        "source": "**/*.@(eot|otf|ttf|ttc|woff|woff2|font.css)",
        "headers": [
          {
            "key": "Access-Control-Allow-Origin",
            "value": "*"
          }
        ]
      }
    ]
  }
}