motorsignal
/
MotorSignal-App
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

SECURITY: fix motorcycle delete rule and preserve ownership enforcement

This commit is contained in:
bponders12-cell 2026-09-01 17:07:15 -04:00
parent 50330f6867
commit 21012993dd
1 changed files with 2 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
firestore.rules
View File

@ -28,9 +28,6 @@ service cloud.firestore {
]); ]);
} }
// Firebase UID is the security boundary. Profile fields are explicitly
// allow-listed so clients cannot turn the account document into a secret
// or entitlement store.
match /users/{userId} { match /users/{userId} {
allow create: if validUserCreate(userId); allow create: if validUserCreate(userId);
allow read: if ownsUser(userId); allow read: if ownsUser(userId);
@ -48,8 +45,9 @@ service cloud.firestore {
} }
match /motorcycles/{motorcycleId} { match /motorcycles/{motorcycleId} {
allow read, write: if ownsUser(userId) allow create, update: if ownsUser(userId)
&& request.resource.data.ownerId == userId; && request.resource.data.ownerId == userId;
allow read, delete: if ownsUser(userId);
} }
match /trips/{tripId} { match /trips/{tripId} {
@ -65,8 +63,6 @@ service cloud.firestore {
} }
} }
// Future collaborative resources must get explicit membership/field-level
// authorization before they are exposed.
match /groupRides/{groupRideId} { match /groupRides/{groupRideId} {
allow read, write: if false; allow read, write: if false;
} }