I'm working on a small scale ERP using Firebase's free plan (for a single user). I started out hard-coding html and serving it with firebase hosting, a flow that proved uneffective in the long run. Soon I needed routes, authentication and a database, which led me to using a Express server running in a single firebase function for everything, so I could protect the routes and database access. This gives me the feel I'm doing something terribly wrong as firebase functions has an obnoxiously long URL and my API routes are just one directory away from my front-end routes.
I'm at a loss to how I should proceed but I believe there are the following options:
A seems unsafe and B annoys me as I don't get a custom URL, how should I proceed and serve the project?
By definition, your static code is public because there is no value in it. The value comes from the API calls that you perform to Functions or Database to fill in your static pages.
If your static code doesn't contain critical information, you can use firebase hosting to host it without any problem.
If not, you have to check the authentication AND the authorization (is that authenticated user has the permission to access that resource?) with dynamic code (i.e. a functions).
If default URL are too long, you can use a custom domain.