[TekMol]

2: The code does not handle authentification. The code literally just says "Give me this, give me that...".

3: It is still a "a client-server http roundtrip" for every query. It does not open and close the http connection every time. But it sends a "GET / HTTP ..." request for every query. With hostname, accepted formats, encodings etc.

[shhsshs]

The code does not handle authentication because it does not need to - all data access and auth rules happen within Firestore/Firebase. If a client requests data they do not have access to, they won’t get it.