[daliu]

Outcome

Replaces the recursive browser-admin Firestore catch-all with explicit resource rules. Browser admins retain the minimum read access used by the current UI and may create only inert catalog drafts or change display-only catalog fields. Membership authority, event eligibility and capacity, prices, variants, waivers, payment state, audit state, secrets, operational collections, and unknown collections remain server-owned.

Fixes #100

Security invariants

• A browser admin is not a trusted server boundary.
• A member may edit only the approved fields on an existing profile document with the matching UID.
• Public event access uses explicit published states; draft and unknown states fail closed.
• Browser-created event and product drafts are inert and cannot become saleable or registrable through Rules alone.
• Browser writes cannot choose price, capacity, eligibility, availability, variants, waiver/data collection, lifecycle, payment, audit, mail, OAuth, rate-limit, or Stripe state.
• Protected collection-group queries and unknown collections are denied.

Compatibility and migration

This is a Rules-only boundary change with no data migration. Existing server-configured protected fields may be carried unchanged while display fields are edited. Current browser roster, order, registration, event, and product reads remain explicit transitional access pending the scoped server-admin work. Operational admin actions remain NOT AVAILABLE YET.

Verification

• Node 20.20.2 + Java 17: Rules emulator suite — 4 suites, 295/295 tests passed.
• ESLint — all four changed Rules test files passed.
• Frontend Jest baseline — 2 suites, 16/16 tests passed.
• git diff --check — clean.
• Secret-pattern review — clean.
• Two independent exact-commit security reviews approved with no P0/P1/P2 findings.
• GitHub CI: frontend lint/build, Functions lint/tests, and Rules tests passed.
• Netlify: deploy preview passed; header/pages contexts were skipped because this PR does not change those surfaces.
• Runtime dependency audit reported 33 existing findings (1 low, 20 moderate, 9 high, 3 critical). No forced upgrade was applied; dependency remediation remains separate supply-chain work.

Officer impact

Officers still must not use the current Admin screens for production catalog or member changes. The guide now explains, in plain language, which display fields this source change allows and which operational or financial fields require a future reviewed server action.

Officer documentation

Updated docs/officers/EVENTS_SHOP_MEMBERS.md with a short status statement, field-ownership diagram, stop conditions, success proof, undo path, and escalation role.

Deployment evidence

• Website: no website behavior changed; not deployed or production-tested by this PR.
• Firebase: NOT deployed. Rules deployment and live verification remain gated by CI-001 — Establish trustworthy quality gates and protected deployment #105.
• Profile editing: source policy is covered, but the reported live defect remains unproven/unfixed pending AUTH-PROFILE-001 — Restore safe profile setup and editing after the Firebase cutover #118 and a safe CI-001 — Establish trustworthy quality gates and protected deployment #105 deployment.
• Outside providers: none configured or tested.
• Production data: no member/customer data, email, role, payment, or provider action was used.

A green source workflow is not evidence that Firebase Rules are live.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	044ae58
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a548f0b88b6ee000877a1bd
😎 Deploy Preview	https://deploy-preview-123--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.