Arquitetura Google Maps + Firebase
e Segurança para o Federal Pro

import * as crypto from 'crypto';
import { SecretManagerServiceClient } from '@google-cloud/secret-manager';

const client = new SecretManagerServiceClient();
let cachedKey: Buffer | null = null;

async function getKey(): Promise<Buffer> {
  if (cachedKey) return cachedKey;
  const [version] = await client.accessSecretVersion({
    name: 'projects/federal-pro/secrets/pii-key/versions/latest',
  });
  cachedKey = Buffer.from(version.payload.data as Uint8Array);
  return cachedKey;
}

/** Encripta PII com AES-256-GCM (autenticado) */
export async function encryptPII(plain: string): Promise<string> {
  const key = await getKey();
  const iv = crypto.randomBytes(12);
  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);

  const encrypted = Buffer.concat([
    cipher.update(plain, 'utf8'),
    cipher.final(),
  ]);
  const authTag = cipher.getAuthTag();

  // Formato: iv.authTag.encrypted (base64)
  return [iv, authTag, encrypted].map((b) => b.toString('base64')).join('.');
}

export async function decryptPII(payload: string): Promise<string> {
  const [ivB64, tagB64, dataB64] = payload.split('.');
  const key = await getKey();

  const decipher = crypto.createDecipheriv(
    'aes-256-gcm',
    key,
    Buffer.from(ivB64, 'base64')
  );
  decipher.setAuthTag(Buffer.from(tagB64, 'base64'));

  return Buffer.concat([
    decipher.update(Buffer.from(dataB64, 'base64')),
    decipher.final(),
  ]).toString('utf8');
}

/** Mascara CPF mostrando apenas os últimos 2 dígitos */
export function maskCPF(cpf?: string): string {
  if (!cpf) return '—';
  const d = String(cpf).replace(/\D/g, '');
  if (d.length < 2) return '•••.•••.•••-••';
  return `•••.•••.•••-${d.slice(-2)}`;
}

/** Mascara celular mostrando DDD + últimos 4 */
export function maskPhone(phone?: string): string {
  if (!phone) return '—';
  const d = String(phone).replace(/\D/g, '');
  if (d.length < 11) return '(••) •••••-••••';
  return `(${d.slice(0, 2)}) ${d.slice(2, 3)}••••-${d.slice(-4)}`;
}

/** Mascara email */
export function maskEmail(email?: string): string {
  if (!email || !email.includes('@')) return '—';
  const [user, domain] = email.split('@');
  const visible = user.slice(0, 2);
  return `${visible}${'•'.repeat(Math.max(user.length - 2, 2))}@${domain}`;
}

// Header
{ "alg": "RS256", "typ": "JWT", "kid": "firebase-key-1" }

// Payload (claims)
{
  "iss": "https://securetoken.google.com/federal-pro",
  "aud": "federal-pro",
  "auth_time": 1790000000,
  "user_id": "abc123uid",
  "sub": "abc123uid",
  "iat": 1790000000,
  "exp": 1790003600,          // 1 hora
  "email": "motorista@exemplo.com",
  "email_verified": true,
  "phone_number": "+5511999998888",
  "role": "driver",           // custom claim
  "categoria": "pro",          // custom claim
  "status": "aprovado"          // custom claim
}

// Signature (RS256) — verifica com chave pública do Firebase

import * as SecureStore from 'expo-secure-store';
import auth from '@react-native-firebase/auth';

const REFRESH_KEY = 'fp_refresh_token';

// Guardar o refresh token em armazenamento seguro (Keychain/Keystore)
export async function persistRefreshToken(token: string) {
  await SecureStore.setItemAsync(REFRESH_KEY, token, {
    keychainAccessible: SecureStore.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
  });
}

export async function getRefreshToken() {
  return SecureStore.getItemAsync(REFRESH_KEY);
}


export async function clearTokens() {
  await SecureStore.deleteItemAsync(REFRESH_KEY);
}

/** Devolve um ID Token válido (renova automaticamente se expirado) */
export async function getValidIdToken(forceRefresh = false): Promise<string | null> {
  const user = auth().currentUser;
  if (!user) return null;
  return user.getIdToken(forceRefresh);
}

/** Wrapper que injeta o JWT em todos os pedidos HTTP */
export async function secureFetch(url: string, options: RequestInit = {}) {
  const token = await getValidIdToken();

  const res = await fetch(url, {
    ...options,
    headers: {
      ...options.headers,
      'Authorization': `Bearer ${token}`,
      'Content-Type': 'application/json',
    },
  });

  // Se 401, força refresh do token e tenta 1x
  if (res.status === 401) {
    const fresh = await getValidIdToken(true);
    return fetch(url, {
      ...options,
      headers: { ...options.headers, 'Authorization': `Bearer ${fresh}` },
    });
  }

  return res;
}

import * as admin from 'firebase-admin';
import * as functions from 'firebase-functions';

/** Wrapper que exige JWT válido em qualquer Cloud Function */
export function withAuth(
  handler: (data: any, ctx: AuthContext) => Promise<any>,
  requiredRole?: 'driver' | 'passenger' | 'admin'
) {
  return functions.https.onCall(async (data, context) => {
    // 1. Verifica se há token
    if (!context.auth) {
      throw new functions.https.HttpsError(
        'unauthenticated', 'JWT ausente ou inválido'
      );
    }

    const { uid, token } = context.auth;

    // 2. Verifica se o token não foi revogado
    const revoked = await admin.auth().verifyIdToken(context.auth.token.toString(), true);

    // 3. Verifica role (RBAC)
    if (requiredRole && token.role !== requiredRole) {
      throw new functions.https.HttpsError(
        'permission-denied',
        `Requer role '${requiredRole}', tem '${token.role}'`
      );
    }

    // 4. Verifica se a conta está aprovada
    if (token.status !== 'aprovado') {
      throw new functions.https.HttpsError(
        'permission-denied', 'Conta pendente de aprovação'
      );
    }

    // 5. Rate limiting (por uid)
    const allowed = await checkRateLimit(uid, 60, '1m');
    if (!allowed) {
      throw new functions.https.HttpsError(
        'resource-exhausted', 'Demasiados pedidos'
      );
    }

    // 6. Auditoria
    await admin.firestore().collection('audit_logs').add({
      uid, action: 'call', function: handler.name,
      timestamp: admin.firestore.FieldValue.serverTimestamp(),
    });

    return handler(data, { uid, role: token.role, claims: token });
  });
}

type AuthContext = {
  uid: string;
  role: 'driver' | 'passenger' | 'admin';
  claims: any;
};

import * as admin from 'firebase-admin';
import * as functions from 'firebase-functions';

/** Quando um utilizador é criado, define custom claims */
export const onUserCreate = functions.auth.user().onCreate(
  async (user) => {
    // Todos começam como passageiro até aprovação
    await admin.auth().setCustomUserClaims(user.uid, {
      role: 'passenger',
      categoria: 'light',
      status: 'pendente',
    });

    // Cria documento no Firestore com dados públicos
    await admin.firestore().collection('users').doc(user.uid).set({
      email: user.email ?? null,
      phone: user.phoneNumber ?? null,
      role: 'passenger',
      status: 'pendente',
      createdAt: admin.firestore.FieldValue.serverTimestamp(),
    });
  }
);

/** Promover para motorista (chamado pelo admin) */
export const promoteToDriver = functions.https.onCall(
  async (data, context) => {
    if (context.auth?.token.role !== 'admin') {
      throw new functions.https.HttpsError('permission-denied', 'Só admin');
    }

    const { uid, categoria } = data;

    await admin.auth().setCustomUserClaims(uid, {
      role: 'driver',
      categoria,
      status: 'aprovado',
    });

    // Força refresh do token no cliente
    await admin.auth().revokeRefreshTokens(uid);

    return { ok: true };
  }
);

{
  "expo": {
    "plugins": [
      ["expo-build-properties", {
        "android": {
          "networkSecurityConfig": "./network_security_config.xml"
        },
        "ios": {
          "useFrameworks": "static"
        }
      }]
    ]
  }
}

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
  <domain-config cleartextTrafficPermitted="false">
    <domain includeSubdomains="true">federalpro.com.br</domain>
    <domain includeSubdomains="true">cloudfunctions.net</domain>

    <pin-set expiration="2026-12-31">
      <!-- SHA-256 do certificado (extrair com openssl) -->
      <pin digest="SHA-256">AAAA...base64...=</pin>
      <!-- Backup pin (rotação) -->
      <pin digest="SHA-256">BBBB...base64...=</pin>
    </pin-set>
  </domain-config>

  <!-- Bloquear tudo o resto em cleartext -->
  <base-config cleartextTrafficPermitted="false">
    <trust-anchors>
      <certificates src="system" />
    </trust-anchors>
  </base-config>
</network-security-config>

import * as admin from 'firebase-admin';

/** Sliding window rate limit usando Firestore + TTL */
export async function checkRateLimit(
  identifier: string,
  maxRequests: number,
  window: '1m' | '1h' | '1d' = '1m'
): Promise<boolean> {
  const windowMs = { '1m': 60_000, '1h': 3_600_000, '1d': 86_400_000 }[window];
  const now = Date.now();
  const bucket = Math.floor(now / windowMs);
  const docRef = admin.firestore()
    .collection('rate_limits')
    .doc(`${identifier}_${bucket}`);

  const allowed = await admin.firestore().runTransaction(async (tx) => {
    const doc = await tx.get(docRef);
    const count = (doc.data()?.count ?? 0) + 1;

    if (count > maxRequests) return false;

    tx.set(docRef, {
      count,
      expiresAt: admin.firestore.Timestamp.fromMillis(now + windowMs),
    }, { merge: true });

    return true;
  });

  return allowed;
}

// Configurar TTL no Firestore Console:
// Collection: rate_limits | Field: expiresAt

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // ---------- Helpers ----------
    function isSignedIn() {
      return request.auth != null;
    }

    function isOwner(uid) {
      return isSignedIn() && request.auth.uid == uid;
    }

    function isRole(role) {
      return isSignedIn() && request.auth.token.role == role;
    }

    function isApproved() {
      return isSignedIn() && request.auth.token.status == 'aprovado';
    }

    function isParticipant() {
      return isSignedIn()
        && request.auth.uid in resource.data.participants;
    }

    // ---------- Users ----------
    match /users/{uid} {
      // Só o próprio utilizador lê o seu perfil completo
      allow read: if isOwner(uid) || isRole('admin');

      // Só o próprio pode atualizar o seu perfil, e não pode alterar role/status
      allow update: if isOwner(uid)
        && !request.resource.data.diff(resource.data).affectedKeys()
             .hasAny(['role', 'status', 'cpf_encrypted']);

      // Ninguém apaga o próprio perfil (só admin)
      allow delete: if isRole('admin');
    }

    // ---------- Drivers (localização em tempo real) ----------
    match /drivers/{driverId} {
      // Motorista escreve apenas no seu próprio documento
      allow write: if isOwner(driverId) && isRole('driver') && isApproved();

      // Qualquer utilizador autenticado pode ler (necessário para matching)
      // MAS apenas campos públicos (não inclui cpf, email, etc.)
      allow read: if isSignedIn();
    }

    // ---------- Trips ----------
    match /trips/{tripId} {
      allow read: if isParticipant() || isRole('admin');
      allow create: if isSignedIn()
        && request.resource.data.participants.hasAll([request.auth.uid]);
      allow update: if isParticipant();
    }

    // ---------- Match requests (efémeros) ----------
    match /match_requests/{uid} {
      allow read: if isOwner(uid);
      // Escrita só via Cloud Function (Admin SDK)
      allow write: if false;
    }

    // ---------- Cache (geocoding, places) ----------
    match /cache/{type}/{hash} {
      allow read: if isSignedIn();
      // Nunca escrever diretamente — só Cloud Functions
      allow write: if false;
    }

    // ---------- Audit logs ----------
    match /audit_logs/{logId} {
      allow read: if isRole('admin');
      allow write: if false; // apenas Admin SDK
    }

    // ---------- Tudo o resto: negar por defeito ----------
    match /{document=**} {
      allow read, write: if false;
    }
  }
}

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {

    // Fotos de perfil — só o próprio lê/escreve
    match /avatars/{uid}/{fileName} {
      allow read: if request.auth.uid == uid;
      allow write: if request.auth.uid == uid
        && request.resource.size < 5 * 1024 * 1024 // 5MB
        && request.resource.contentType.matches('image/.*');
    }

    // Documentos (CNH, CRLV) — só o próprio e admins
    match /documents/{uid}/{docId} {
      allow read: if request.auth.uid == uid
        || request.auth.token.role == 'admin';
      allow write: if request.auth.uid == uid
        && request.resource.size < 10 * 1024 * 1024;
    }

    // Nada mais é acessível
    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}

import * as functions from 'firebase-functions';
import * as admin from 'firebase-admin';
import { getGeohashRange } from 'geofire-common';
import axios from 'axios';
import { withAuth } from './middleware';

admin.initializeApp();
const db = admin.firestore();
const GOOGLE_KEY = functions.config().google.key;
const RAIO_KM = 5;

// withAuth exige JWT válido + role passenger + rate limit
export const matchDriver = withAuth(async (data, ctx) => {
  const { lat, lng } = data;

  // Validar input (defesa contra injection)
  if (typeof lat !== 'number' || typeof lng !== 'number') {
    throw new functions.https.HttpsError('invalid-argument', 'Coords inválidas');
  }

  const range = getGeohashRange(lat, lng, RAIO_KM * 1000);

  const snapshot = await db.collection('drivers')
    .where('status', '==', 'online')
    .where('geohash', '>=', range.lower)
    .where('geohash', '<=', range.upper)
    .limit(20)
    .get();

  if (snapshot.empty) {
    return { drivers: [], message: 'Nenhum motorista próximo' };
  }

  const drivers = snapshot.docs.map((d) => {
    const data = d.data();
    // Retorna apenas campos públicos — nunca cpf, email, etc.
    return {
      id: d.id,
      lat: data.lat,
      lng: data.lng,
      name: data.name,
      rating: data.rating,
      vehicle: data.vehicle,
      fcmToken: data.fcmToken,
    };
  });

  const origins = drivers.map((d) => `${d.lat},${d.lng}`).join('|');
  const destination = `${lat},${lng}`;

  const { data: matrix } = await axios.get(
    'https://maps.googleapis.com/maps/api/distancematrix/json',
    { params: { origins, destinations: destination,
        departure_time: 'now', traffic_model: 'best_guess', key: GOOGLE_KEY } }
  );

  const elements = matrix.rows[0].elements;
  const candidates = drivers
    .map((driver, i) => ({
      driver,
      distance: elements[i].distance.value,
      durationInTraffic: elements[i].duration_in_traffic?.value ?? elements[i].duration.value,
    }))
    .filter((c) => c.durationInTraffic > 0)
    .sort((a, b) => a.durationInTraffic - b.durationInTraffic);

  const best = candidates[0];

  // Grava match com TTL de 30s
  await db.collection('match_requests').doc(ctx.uid).set({
    driverId: best.driver.id,
    distanceMeters: best.distance,
    etaSeconds: best.durationInTraffic,
    status: 'pending',
    createdAt: admin.firestore.FieldValue.serverTimestamp(),
    expiresAt: new Date(Date.now() + 30000),
  });

  // Push ao motorista (sem PII no payload)
  await admin.messaging().send({
    token: best.driver.fcmToken,
    notification: {
      title: 'Nova viagem!',
      body: `${(best.distance / 1000).toFixed(1)} km • ${Math.ceil(best.durationInTraffic / 60)} min`,
    },
    data: { matchId: ctx.uid, type: 'new_trip' },
  });

  // Devolve ao cliente apenas o necessário
  return {
    matchId: ctx.uid,
    driver: {
      name: best.driver.name,
      rating: best.driver.rating,
      vehicle: best.driver.vehicle,
    },
    distance: best.distance,
    eta: best.durationInTraffic,
  };
}, 'passenger');