Excessive usage of cloud functions is slowing down my app , whats the alternative?

I have made almost all my requests through cloud functions and jwt , due to security fears of a user editing a field he is not supposed to .

This unfortunately means instead of the almost instant direct call , sometimes the function takes up to 20 seconds to load (when it hasn’t been active in a while)

Regardless even normal functions usually take 4-5 seconds and it’s not a complexity issue it’s rather the usage of the cloud .

What’s the alternative to all this ? (Thats also secure )

You answered the question yourself, use the SDK and set collection or document or file level permissions properly.

but for documents that need duo access like a business and a user , I have no way of restricting the business from forging a fake userID and vice versa (unless i use functions)

I don’t think I understand the use case you are trying to solve for. “forging fake user id” ?? How will one do that ? To assign groups of users access to a document you can use teams for example and only users who are part of the admin team can do admin thing and users can do user things .. the document you assign team based role .. just an example since I don’t know your precise situation ..

I have a food ordering app ,
The order has restaurant_id and client_id .

When the client makes an order i send the JWT and verify the user_id alone using a cloud function .

To do that without a function is a security risk because the user_id is not verified and the scammer/bad actor can just send whatever id he wants and whatever restaurant_id .

I haven’t even touched “order_state” which a bad actor can forcibly change to “completed” even when it’s not

The only way around this whole mess is functions , but doing this for orders and group orders and the driver and change order etc etc is super slow makes each button in my app takes 30 seconds to load instead of instantly