[daliu]

Outcome

Role-based Firestore access now fails closed unless Firebase supplies both the already-approved member or admin role and exact boolean email_verified == true in the signed-in token.

Verification alone never grants membership or administrator access. Public reads and the existing own-account profile recovery path remain unchanged.

Closes #196.

Security invariant

• Role access requires an exact verified-email token claim plus the required role.
• Missing, false, string, or numeric verification claims deny.
• A Firestore profile field cannot substitute for Firebase's signed token claim.
• Own-account profile read/name-only update and connection metadata read remain available to an unverified signed-in person so recovery is not locked out.
• Anonymous public event and product reads remain public by design.

Tests and review

• Before the Rules fix, the focused emulator suite failed all 30 new negative assertions, proving the old role-only boundary allowed the unsafe cases.
• After the fix, the full Firestore Rules emulator suite passes: 4 suites, 348 tests.
• Frontend Jest passes: 11 suites, 198 tests.
• Functions passes: 16 suites, 990 tests (2 suites / 32 emulator-only tests skipped by the existing harness).
• Functions lint passes.
• Frontend lint baseline check passes.
• Diagnostic production build passes.
• SPA navigation passes: 11 tests.
• Release/workflow/artifact guard suite passes: 42 tests.
• git diff --check passes.
• Independent security, test, and officer reviews approved the exact staged diff b681c561bbf55017f14d9caad8a3cdb411c34606ee84637c51c6cd9db891b6a5 with no findings.

Officer impact

Private member and administrator screens backed by Firestore Rules will require the same account to have both an approved role and a verified email after this exact Rules revision is deployed. Officers must not change real roles or production records to test it.

Officer documentation

• docs/officers/ACCESS_CONTINUITY.md
• docs/officers/SYSTEM_MAPS.md

The staging drill is explicitly NOT AVAILABLE YET until the exact Rules revision is deployed to protected staging.

Deployment evidence

• Source changed: yes, commit 2da7bfa824fdc2be635f27ec577150940cf6a303.
• Tests passed: yes, locally and in exact-head PR CI run 29297012945 and post-merge CI run 29297116454.
• Code merged: yes, squash merge a8801770e97cf21d81f3307f5893734115140d8f.
• Website published / runmprc.com verified: not applicable; no website runtime changed and nothing was published.
• Firebase deployed: no deployment attempted. The new Rules are not live.
• Outside provider configured: not applicable; no provider setting changed.
• Production behavior verified: no. No production account, role, or data was used.

Remaining work

This focused Rules outcome does not complete AUTH-001. Separate work still owns Functions/Admin SDK authorization, verification-mirror reconciliation, token refresh or revocation behavior, protected Firebase deployment, and live readback. Admin SDK and IAM bypass Firestore Rules and must be reviewed independently.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	2da7bfa
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a5587dcdec3840007bfb46d
😎 Deploy Preview	https://deploy-preview-198--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.