Boss: Cloud connected

Play this quiz

Quick check

Garden Defense, the client on a player's phone, sends a POST request to our backend to save a garden. The server answers with status 200. What does that mean?

  1. The save worked
  2. Nothing lives at that address
  3. Something broke on the server
Show the answer

The save worked

Codes starting with 2 mean success, and 200 means OK. 404 means not found, and codes starting with 5, like 500, mean the server had a problem.

Quick check

A player starts with anonymous sign-in, then links a Google account. What happens to their progress?

  1. It is deleted
  2. It stays, because the UID stays the same
  3. It moves to a different player
Show the answer

It stays, because the UID stays the same

Linking keeps the same UID, so the same save card belongs to them. Now they can log in on any device.

Read the code

shop.js
// card before: wave 12, seeds 340, sprigHat "acorn"const ref = doc(db, "players", user.uid);await setDoc(ref, { seeds: 400 });

What does the player's save card hold after this runs?

  1. Only seeds: 400
  2. wave 12, seeds 400 and sprigHat "acorn"
  3. The same as before, because setDoc only reads
Show the answer

Only seeds: 400

setDoc replaces the whole card with exactly what it is given. To change only the seeds, add { merge: true } or use updateDoc.

Quick check

10,000 players open the Garden Defense leaderboard every day. Which change cuts Firestore reads the most?

  1. A Cloud Function builds the top 10 into one cached document that everyone reads
  2. Refresh the board every second so it is always up to date
  3. Turn off the budget alerts
Show the answer

A Cloud Function builds the top 10 into one cached document that everyone reads

Reading one cached document instead of 10 score documents cuts leaderboard reads by 10 times. Refreshing every second does the opposite, and alerts only warn us about costs.

Phish or real?

Email to Remy, from "Stripe Billing"
Payouts paused! Confirm your login within 12 hours or your account will be closed: https://stripe.com.payout-check.co/login

What should Remy do?

  1. Not click. Open stripe.com by typing it, check the dashboard there, and show a parent the email
  2. Click the link and log in fast, before the account closes
  3. Forward the email to Claude together with the Stripe password, and ask if it is real
Show the answer

Not click. Open stripe.com by typing it, check the dashboard there, and show a parent the email

The real site in that link is payout-check.co, not stripe.com, and the 12-hour threat is there to make Remy rush. Going to the site yourself is always safe, and a password never goes into a chat.

Fix the rule

firestore.rules
match /players/{userId} {  allow read, write: if request.auth != null;}

Kai wrote this rule for the saves. What could a cheater do with it?

  1. Nothing, it is safe
  2. Change any player's save, as long as they are logged in
  3. Only read the leaderboard
Show the answer

Change any player's save, as long as they are logged in

The rule only checks that someone is logged in. It should also check request.auth.uid == userId, so each player can change only their own save.

Quick check

Why does the Hyper Shards score check run in a Cloud Function instead of inside the game?

  1. Code on Google's servers can't be read or changed by players
  2. Cloud Functions make the game run at a higher FPS
  3. Cloud Functions are free without any billing account
Show the answer

Code on Google's servers can't be read or changed by players

Anything in the game can be changed with developer tools, so the check lives on the server. Functions need the Blaze plan with a billing account, and they have nothing to do with FPS.

Quick check

Since the 2025 COPPA update, a child's face print or voice print counts as personal information, and sharing a child's data with advertisers needs a separate parent consent.

Show the answer

True

The 2025 update added biometric data like face and voice prints to personal information, and made sharing with advertisers need its own parent consent. The safest plan is to not collect it at all.