Case Study: Designing a Zero-Trust 3-Tier Architecture with Isolated Microservices & Firebase

Executive Summary

A common anti-pattern in modern web development is embedding database credentials (like Firebase or Supabase keys) directly inside client-side single-page applications. Even with database security rules, exposing direct database sockets to public client bundles increases surface-area vulnerabilities and couples client code directly to database schemas.

To solve this, I designed a 3-Tier Decoupled Microservice Architecture for a Daily Checklist & Management platform. The architecture segregates the Frontend Client, Admin Audit Portal, and Backend Database Gateway into three completely isolated services running on independent ports.

The Core Rule: Zero-Trust Database Isolation

The foundational rule of this architecture is strict separation of concerns:

1. 1.Service 1 (Frontend App): Handles user authentication, checklist management, and item toggles with zero database credentials.
2. 2.Service 2 (Admin Panel): Handles user auditing, checklist inspection, and platform metrics with zero database credentials.
3. 3.Service 3 (Backend API): The sole service holding Firebase Firestore credentials, SDK initializations, and database access logic.

Architecture Communication Topology

+------------------------------------+       +------------------------------------+
| SERVICE 1: FRONTEND APP            |       | SERVICE 2: ADMIN PANEL             |
| - User Login / Signup              |       | - User & Checklist Audit Views     |
| - Daily Checklist CRUD UI          |       | - Firebase Admin Auth              |
| - Runs on Port 3000 (No DB Keys)   |       | - Runs on Port 3001 (No DB Keys)   |
+------------------------------------+       +------------------------------------+
                  │                                             │
                  │ HTTP REST Requests                          │ HTTP REST Requests
                  └──────────────────────┬──────────────────────┘
                                         │
                                         ▼
                      +------------------------------------+
                      | SERVICE 3: BACKEND API             |
                      | - Express.js Gateway Controller    |
                      | - Holds Firebase Admin SDK Keys    |
                      | - Runs on Port 5000                |
                      +------------------------------------+
                                         │
                                         │ Native Admin SDK Connection
                                         ▼
                      +------------------------------------+
                      | FIREBASE FIRESTORE DATABASE        |
                      | - Protected Isolated Data Store    |
                      +------------------------------------+

Key Technical Features

1. Enforcing Proxy API Communication

Neither the Frontend nor the Admin panel connects to Firestore directly. All data mutation requests follow a strict proxy pattern:

• Creating a Checklist Item:Frontend App ➔ POST /api/checklists/item ➔ Backend API (Validation) ➔ Firestore Insert

• Admin User Inspection:Admin Panel ➔ GET /api/admin/users-summary ➔ Backend API (Auth Check) ➔ Firestore Query

// Express.js Backend API Controller (Sole Database Gateway)
const express = require('express');
const router = express.Router();
const { db } = require('../config/firebaseAdmin'); // Firestore initialized ONLY here

// Protected Route for Fetching User Checklists
router.get('/api/checklists/:userId', async (req, res) => {
  try {
    const { userId } = req.params;
    
    // Server-side query execution
    const snapshot = await db.collection('checklists')
      .where('userId', '==', userId)
      .get();

    const checklists = snapshot.docs.map(doc => ({ id: doc.id, ...doc.data() }));
    return res.status(200).json({ success: true, data: checklists });
  } catch (error) {
    return res.status(500).json({ success: false, error: error.message });
  }
});

module.exports = router;

2. Frontend Checklist App

The client application focuses purely on user experience and state management:

• Authentication: User signup and session persistence handled via token exchange with the Backend API.
• Checklist Operations: Creating daily checklists, adding sub-items, and marking items complete via async REST API calls.

3. Isolated Admin Audit Portal

Built with Firebase Admin Authentication middleware running on its own dedicated port:

• User Auditing: Lists all registered users across the platform inside a private view.
• Checklist Inspection: Allows administrators to inspect checklists created by specific users to monitor engagement without exposing raw database connection strings to the admin frontend bundle.

Architectural Lessons Learned

• Security Through Decoupling: Isolating database credentials inside a dedicated backend microservice prevents accidental API key leaks in client JavaScript bundles.
• Simplified Maintenance: Because database schema logic is encapsulated inside the Backend service, database migrations or SDK updates do not require re-deploying or modifying the Frontend or Admin client applications.