Skip to content

security_spec.md

Latest commit

 

History

History
34 lines (31 loc) · 1.98 KB

security_spec.md

File metadata and controls

34 lines (31 loc) · 1.98 KB
Raw

Firebase Security Specification for InkBlots

Data Invariants

  1. User Profiles: Every user must have a profile. A user can only modify their own profile.
  2. Challenges & Prompts: These are managed by the Chief-AI-Editor/Admin. Users have read-only access.
  3. Submissions:
    • Must be linked to a valid prompt and user.
    • Visibility toggle (isVisible) controls community access.
    • Users can only create/edit their own submissions.
  4. Comments:
    • Can only be added to visible submissions.
    • Users can only edit/delete their own comments.
  5. Chats:
    • Private conversations between two users.
    • Only the sender and receiver have read access.
  6. Events: Community events are read-only for users.

The "Dirty Dozen" Payloads (Deny cases)

  1. Identity Theft: User A tries to update User B's profile.
  2. Shadow Submission: User A tries to create a submission claiming to be User B.
  3. Prompt Hijack: User A tries to create or delete a global writing prompt.
  4. Invisible Commenting: User A tries to comment on User B's private (isVisible: false) submission.
  5. Ghost Chat: User C tries to read a chat between User A and User B.
  6. Admin Spoofing: User A tries to set isAdmin: true on their own profile during creation.
  7. Resource Poisoning: Submitting a 1MB string to a tiny field like displayName.
  8. Orphaned Submission: Creating a submission for a non-existent promptId.
  9. Relational Leak: Updating someone else's submission visibility.
  10. State Shortcut: Deleting a challenge that has active participants.
  11. PII Exposure: Reading the private bio of another user who has not shared it.
  12. Batch Inconsistency: Creating a comment without checking if the parent submission still exists.

Security Rules Implementation Plan

I will implement firestore.rules using the "Master Gate" and "isValidEntity" patterns. Verification of email_verified will be enforced for all writes.