Repository navigation
SEC-001 — Replace the Firestore admin catch-all with resource-specific rules #100
Description
Problem
The recursive browser-admin allow granted every admin claim read/write access to OAuth secrets, registrations, orders, mail, rate limits, webhook ledgers, audit data, and future collections. Firestore rules are additive, so narrower nested denies did not repair that boundary.
Outcome
Remove recursive browser-admin authority and retain only explicit, minimum reads plus narrowly allowlisted current catalog editing while financial, secret, operational, audit, and unknown data remain server-owned.
Scope
firestore.rules- Security reversals and negative coverage in
tests/firestore-rules/events.test.js,members.test.js,members-only.test.js, andshop-and-locked.test.js - No IAM, App Check, AUTH-001, or ADMIN-001 server-API migration
Acceptance criteria
- Browser admins cannot read OAuth secrets or mutate registrations/orders/payment/audit state.
- Mail, rate limits, Stripe event records, checkout commands, audit records, retention jobs, and unknown collections are denied.
- Public legacy drafts are denied.
- Existing minimum admin event/product editor and roster/order reads remain explicitly tested.
- Anonymous/member/admin allow and deny behavior is covered.
- Full Rules emulator suite compiles and passes.
Dependencies
None. #81, #83, #88, and #92 continue to depend on this issue until merged and closed.
Coordination
A verified local working-tree implementation predates publication of this issue. This issue records the exact ownership boundary before any further editing or PR work. The existing diff must be isolated onto the claimed branch before review; unrelated changes and the pre-existing public/sitemap.xml modification are excluded.
Do not edit the listed paths or duplicate this outcome while the issue is assigned and has a valid timestamped CLAIMED marker.
Activity
daliu commentedon Jul 12, 2026
CLAIMED by Codex agent /root at 2026-07-12T20:50:04Z; branch codex/issue-100-firestore-boundaries.
Existing shared working-tree implementation predates issue publication. I will isolate this outcome onto the named branch serially before opening a PR; no unrelated dirty path is included.
daliu commentedon Jul 12, 2026
CLAIM RETAINED / EXTRACTION QUEUED at 2026-07-12T21:53:37.334Z. Assignment and the original timestamped CLAIMED marker remain authoritative. Dependencies are currently clear, but no issue-specific extraction has begun. #103 is the dependency-leverage next item after active #104; #100 remains reserved and queued. When started, base the isolated branch on refreshed main ce22c11 or later so merged #98 behavior is preserved. Do not duplicate this outcome.
daliu commentedon Jul 13, 2026
USER-REPORTED DEFECT / COORDINATION (2026-07-12; not a new claim): a signed-in user received
Missing or insufficient permissionswhen saving name/phone. Current source Rules already allow the exact existing-doc self-update, so this is not evidence that the allowlist should be widened.Read-only cutover evidence instead shows the new Auth/browser project was configured without repository proof that the matching Rules or profile-creation Function were deployed. The account UI hides read/setup failure and then issues an update-only write. A missing profile document, stale/default-deny deployed Rules, or both can produce the reported error.
#118 now owns idempotent pending-profile setup and honest UI failure handling. #100 retains the exact secure Rules boundary. Do not hot-deploy current
mainRules merely to restore editing: the recursive admin catch-all is still present until this issue merges. #105 must stage and deploy the exact #100 revision before dependent profile UI is enabled.daliu commentedon Jul 13, 2026
EXTRACTION STARTED by Codex agent /root at 2026-07-13T06:41:56Z; branch codex/issue-100-firestore-boundaries; base 0e03ac1. Scope remains exactly firestore.rules and the four listed Rules test files. The branch was refreshed onto origin/main; already-merged #77/#98/#104 behavior is preserved. No deployment is authorized by this extraction.
daliu commentedon Jul 13, 2026
SCOPE AMENDMENT by Codex agent /root at 2026-07-13T07:03:29Z: add only docs/officers/EVENTS_SHOP_MEMBERS.md to the five-file #100 boundary. Reason: the repository contract requires the affected officer guide in the same PR when admin permissions change. The update will remain plain-language and source-only, keep Admin screens NOT AVAILABLE YET, state that Firebase deployment/live behavior is unproven under #105, and diagram display-only browser fields versus server-owned operational/financial fields. No #103 root-document path is included.
daliu commentedon Jul 13, 2026
EXTRACTION FINISHED by Codex agent /root at 2026-07-13T07:08:26Z.\n\nExact candidate commit: 044ae58\nBase: bb9ae29\n\nOwned scope is exactly six paths: firestore.rules, the four named Rules tests, and the approved officer-guide amendment.\n\nVerification:\n- Node 20.20.2 and Java 17: Rules emulator suite 4 suites / 295 tests passed.\n- ESLint: all four changed Rules test files passed.\n- Frontend Jest baseline: 2 suites / 16 tests passed.\n- git diff --check: clean.\n- Independent security review: approved with no P0/P1/P2 findings.\n- Production dependency audit remains a separate supply-chain risk: 33 runtime findings (1 low, 20 moderate, 9 high, 3 critical); no forced upgrades were applied.\n\nDeployment truth:\n- Source changed and tests passed.\n- Website not changed or deployed by this issue.\n- Firebase Rules are NOT deployed.\n- Live profile behavior remains unproven under #105/#118.\n- No production data, email, role, payment, or provider test was performed.
daliu commentedon Jul 13, 2026
PR #123 is open for review at https://github.com/Run-MPRC/Run-MPRC.github.io/pull/123.\n\nStatus is now in review. The exact source commit is 044ae58. Firebase deployment remains deliberately blocked on #105; merging source is not evidence that the live Rules changed.
daliu commentedon Jul 13, 2026
DELIVERED / SOURCE COMPLETE at 2026-07-13T07:13:30Z.\n\nPR #123 was squash-merged to main as a7fc301 after two independent exact-commit security reviews approved with no P0/P1/P2 findings.\n\nVerification:\n- Local Node 20.20.2 + Java 17 Rules suite: 295/295 passed.\n- Hosted CI run 29231225145: frontend lint/build, Functions lint/tests, and Rules tests all passed.\n- Public runmprc.com read-only availability check returned HTTP 200.\n- No production member data or write action was used.\n\nDeployment truth:\n- The Pages job succeeded, but the built website was identical: gh-pages stayed at 6efc53b and the action reported nothing to commit / everything up-to-date.\n- The workflow is green, but Firebase was NOT deployed. Run 29231224213 explicitly printed No FIREBASE_SERVICE_ACCOUNT secret; skipping Firebase deploy.\n- The live profile-edit defect therefore remains unproven and is still owned by #118.\n- #105 owns protected Firebase deployment and exact live verification.\n\nThis source issue is complete. It is closed manually because the repository default branch is dev, while the reviewed delivery branch is main, so the Fixes reference did not auto-close it.