Skip to content

DATA-001C2 — Stop profile setup from copying Firebase Auth phone numbers #197

Closed
#199
Closed
DATA-001C2 — Stop profile setup from copying Firebase Auth phone numbers#197
#199
Assignees
daliu
Labels
area:authAuthentication and authorizationarea:firebaseFirebase services and dataarea:privacyPersonal data, consent, minimization, retention, and privacy operationspriority:P0Launch blocker or urgent security risksize:SSmall focused issuetype:reliabilityReliability and recoverytype:securitySecurity or privacy boundary

Description

@daliu
daliu
opened on Jul 14, 2026

Officer impact: New account/profile setup no longer copies a phone number from Firebase Auth into the member profile while phone collection is paused. Existing records remain unchanged, and officers continue using the current no-phone procedure.

Officer documentation: Update only the phone-pause section of docs/officers/EVENTS_SHOP_MEMBERS.md and its existing diagram. No officer action changes; the update records that signup/recovery also honors the pause.

Deployment evidence: None at issue creation. Closure of this source slice requires focused unit/emulator tests, full relevant checks, merged source, exact hosted CI, and a separate statement that the Functions, website, Firebase Rules, provider settings, and live behavior were or were not deployed.

Problem

#178 removed phone display/input from My Account and denied browser phone mutations, but it explicitly excluded Firebase Auth-derived user.phoneNumber. The shared create-once helper in functions/memberProfile.js still copies that value into every newly created members/{uid} profile. A signup trigger or recovery callable can therefore create a new stored phone value during the privacy pause without any My Account phone field.

#178's release comment names this exact residual. #118 is closed and its source claim is released. This is not a deletion, incident-causation, roster, or provider ticket.

Atomic outcome

For every newly created pending member profile, write the existing schema-compatible empty phone value regardless of any phone present on the authoritative Firebase Auth user. Preserve the create-once transaction so every existing profile remains byte-for-byte unchanged.

Invariants

  • A new profile never copies, normalizes, truncates, returns, or logs Firebase Auth phoneNumber.
  • New profiles keep the existing phoneNumber: "" schema shape for backward compatibility.
  • Existing profiles, including existing phone values, are never overwritten, cleared, migrated, exported, or read for this outcome.
  • Signup and callable recovery continue to share one idempotent transactional helper.
  • The callable still derives email, display name, verification, and provider state from the authenticated Firebase user rather than caller input.
  • The change never grants membership/admin, changes claims, inspects production records, or contacts a provider.

Scope

  • functions/memberProfile.js
  • functions/ensureMemberProfile.test.js
  • functions/memberProfile.emulator.test.js
  • Exact account-profile setup/phone-pause paragraphs and diagram in SYSTEM_DESIGN.md
  • Exact My Account phone-pause section and diagram in docs/officers/EVENTS_SHOP_MEMBERS.md

Acceptance criteria

  • A new profile created from an Auth user with a synthetic phone stores phoneNumber: "" and no copy of the canary.
  • Signup and callable recovery both use the same phone-free create path.
  • Duplicate, concurrent, and retried calls preserve one unchanged profile.
  • An existing profile with a phone remains byte-for-byte unchanged.
  • Hostile phone canaries appear in no returned error or console call.
  • Focused Functions unit tests and the Firestore-emulator concurrency test pass.
  • Functions lint/full tests plus relevant repository safety checks pass without production access.
  • Documentation distinguishes source, merge, Functions deployment, website publication, provider state, and live verification.
  • Independent review confirms no Rules, roster, event/shop/export, deletion, migration, provider, or production-data expansion.

Dependencies and coordination

Explicitly out of scope

Firestore Rules; Auth action links; role grants; verification-mirror reconciliation; existing-data deletion/backfill/import; admin roster; event, shop, Stripe, WhatsApp, Strava, Google Forms/Sites/Sheets; telemetry; providers; workflows; deployment; and production records.

Claim protocol

Creation is not a claim. Before editing, assign the issue, post CLAIMED by <canonical agent> at <UTC>; branch <branch>; exact base <SHA>, re-read comments, and keep ownership to the paths/sections above.

Activity

  1. daliu
    added
    priority:P0Launch blocker or urgent security risk
    type:securitySecurity or privacy boundary
    type:reliabilityReliability and recovery
    area:authAuthentication and authorization
    area:firebaseFirebase services and data
    size:SSmall focused issue
    status:readyDependencies complete and ready to claim
    area:privacyPersonal data, consent, minimization, retention, and privacy operations
    status:in-progressClaimed and actively being implemented
    and removed
    status:readyDependencies complete and ready to claim
    on Jul 14, 2026
  2. daliu
    self-assigned this
    on Jul 14, 2026

  3. daliu commented on Jul 14, 2026

    @daliu
    daliu
    on Jul 14, 2026
    ContributorAuthor

    CLAIMED by /root at 2026-07-14T00:43:08Z; branch codex/issue-197-stop-auth-phone-copy; exact base e76b1ee01a0f0ce9951fdcc6e454b66288394b93.

    Owned runtime/test paths:

    • functions/memberProfile.js
    • functions/ensureMemberProfile.test.js
    • functions/memberProfile.emulator.test.js

    Owned documentation is limited to the exact account-profile phone-copy paragraphs/diagram in SYSTEM_DESIGN.md and the exact My Account phone-pause section/diagram in docs/officers/EVENTS_SHOP_MEMBERS.md.

    Active #196 owns all firestore.rules and Rules-test work plus its verified-role status hunks. #197 excludes those files, Auth action/Identity/App paths, docs/officers/ACCESS_CONTINUITY.md, docs/officers/SYSTEM_MAPS.md, root security/issue trackers, packages, workflows, provider/deploy settings, and production data.

    Invariant: new profiles store the schema-compatible empty phone value regardless of Firebase Auth phone state; retries and all pre-existing profiles remain byte-for-byte unchanged.

  4. daliu commented on Jul 14, 2026

    @daliu
    daliu
    on Jul 14, 2026
    ContributorAuthor

    EXTRACTION FINISHED — 2026-07-14T00:50Z

    • Branch: codex/issue-197-stop-auth-phone-copy
    • Exact base: e76b1ee01a0f0ce9951fdcc6e454b66288394b93
    • Exact head: 1e956621a7d3e6529a21c9f32e8b33f40be89bd2
    • Pull request: DATA-001C2: stop Auth phone copy during profile setup #199
    • Exact staged diff SHA-256: 2961034bb3a6f7f76b4942702ed3a5b4aefbf43709ed0e3d12b1dbd4bfbde6ae

    Local Node 20 / Java 17 evidence:

    • red proof: 4 focused phone-copy failures before the helper change
    • focused Functions unit: 21/21
    • real demo Firestore emulator concurrency: 1/1
    • full Functions: 991 passed / 32 unrelated emulator-only skipped
    • full frontend: 198/198
    • full Rules emulator: 317/317
    • SPA plus test-artifact safety: 33/33
    • Functions lint, diagnostic build, and diff check: pass
    • independent privacy/security and backup-officer/QA reviews: APPROVED

    Officer impact: after the two profile Functions are actually deployed, new profile creation will not copy an Auth phone. Existing profiles and officer steps stay unchanged.

    Officer documentation: docs/officers/EVENTS_SHOP_MEMBERS.md; matching engineering diagram in SYSTEM_DESIGN.md.

    Deployment evidence: source/tests/PR only. No website, runmprc.com, Firebase, provider, or production-data change occurred. The claim remains active through review/merge.

  5. daliu commented on Jul 14, 2026

    @daliu
    daliu
    on Jul 14, 2026
    ContributorAuthor

    CORRECTION — exact extraction head

    The exact pushed #199 head is 1e95662c66145f841aa20909a2f49430c1fbdfed. The prior comment expanded the seven-character prefix incorrectly; no source, test, provider, or deployment state changed.

    GitHub now reports main advanced after extraction. I am performing the required controlled refresh while preserving merged #196 and will publish the final refreshed head/diff evidence before merge.

  6. daliu
    added a commit that references this issue on Jul 14, 2026

    fix: keep new member profiles phone-free (#197)

    84fb10d

  7. daliu commented on Jul 14, 2026

    @daliu
    daliu
    on Jul 14, 2026
    ContributorAuthor

    CONTROLLED REFRESH COMPLETE — 2026-07-14T00:55Z

    Post-refresh Node 20 / Java 17 evidence:

    The branch force-push used lease protection and restarted hosted checks. Source is still not deployed or live.

  8. daliu
    added a commit that references this issue on Jul 14, 2026

    fix: keep new member profiles phone-free (#197) (#199)

    3f36a64
  9. daliu
    closed this as completedin #199on Jul 14, 2026

  10. daliu commented on Jul 14, 2026

    @daliu
    daliu
    on Jul 14, 2026
    ContributorAuthor

    Coordination note from #200 / PAY-005A1: I will not edit docs/officers/EVENTS_SHOP_MEMBERS.md while #197 owns its My Account phone section. #200 source work is limited to separate refund Functions/tests. After #197 merges and explicitly releases the file, I will refresh from that exact main and add only a distinct refund-safety status section. #197 runtime, SYSTEM_DESIGN.md, and phone-pause hunks remain immutable.

  11. daliu
    removed
    status:in-progressClaimed and actively being implemented
    on Jul 14, 2026

  12. daliu commented on Jul 14, 2026

    @daliu
    daliu
    on Jul 14, 2026
    ContributorAuthor

    Closure and claim release — 2026-07-14T00:59:04Z

    Outcome: PR #199 merged to main as 3f36a646ee219e8f60a26d4e3e13cd0cfff1a098. New member-profile bootstrap now writes an empty schema-compatible phone field and never reads or copies the Firebase Auth phone value. Existing profiles remain unchanged.

    Verification

    • Exact-head PR CI run 29297165227 passed.
    • Refreshed local Node 20 checks passed: focused unit 21/21; real profile emulator 1/1; full Functions 991 passed with 32 emulator-only skipped; Rules 348/348; frontend 198/198; SPA/artifact 33/33; Functions lint; diagnostic build; and diff check.
    • Post-merge CI run 29297307980 passed all five jobs against the exact merge SHA.
    • Independent security and officer/QA reviews approved the exact issue diff.
    • No dependencies changed. Existing audit findings remain tracked; no forced audit fix was run.

    Officer impact: Newly created website member profiles will not silently inherit a phone number from Firebase Auth after the matching Functions code is deployed. Officers do not need to change current records.

    Officer documentation: docs/officers/EVENTS_SHOP_MEMBERS.md and the matching SYSTEM_DESIGN.md flow were updated with staged-data proof, stop conditions, undo, and escalation.

    Deployment evidence

    • Source changed, tests passed, and code merged: yes.
    • Website published / runmprc.com verified: no production website change was claimed. GitHub shows no deployment for this SHA; the Netlify PR preview was review evidence only.
    • Firebase deployed and read back: no. No release workflow ran for this SHA, so live Functions behavior is not proven.
    • Outside provider configuration and production member data: unchanged and untouched.
    • Existing Firebase Auth or Firestore phone values were not migrated or deleted. Broader document-read minimization remains separate work under MEMBERS-ROSTER-001 — Add officer-only member roster view and safe CSV export #116.

    The /root claim is released for:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area:authAuthentication and authorizationarea:firebaseFirebase services and dataarea:privacyPersonal data, consent, minimization, retention, and privacy operationspriority:P0Launch blocker or urgent security risksize:SSmall focused issuetype:reliabilityReliability and recoverytype:securitySecurity or privacy boundary

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions