fix: close the remaining rule gaps, including the one the tests were endorsing

[duuyguyiilmaz]

Three commits. The first is the sharpest finding of the review so far, and the one CI was actively wrong about.

A vote could be written without the score that follows from it

The link between a vote and a note's total was enforced in one direction only. The note's rule said "if the totals move, show me the vote that justifies them." Nothing said the reverse. So a rating document could be written entirely on its own — and the test suite asserted that as correct behaviour, which is why the suite stayed green over it. The suite described the hole instead of catching it.

It is unbounded score inflation from a single voter, four points a lap:

1. write the vote alone as 1 — totals untouched
2. raise it to 5 with the totals — sum += 4, count unchanged, because the rule correctly sees a changed vote
3. write it alone as 1 again — totals untouched
4. go to 2

Step 1 is what was permitted. The ratings rule now mirrors the note's arithmetic from its own side and requires the note to actually carry the numbers.

Verified by mutation, not by a green run: deleting the single new clause turns exactly three tests red and leaves the other 86 green. Several existing ratings tests were rewritten too — they wrote a lone rating document and passed for the wrong reason, the range check among them.

Two further tests cover the mechanism the app actually ships: submitRating uses runTransaction, not writeBatch, and nothing had exercised that.

The university restriction was never enforced on the server

The profile create rule checked that you were writing your own document and that its id field matched. Nothing else — so @ogr.akdeniz.edu.tr lived only in RegisterActivity. Firebase Auth accepts any address; signing up with a personal one and writing the profile directly was enough to become a student. Since reads are scoped by department and ownDepartment() reads it from this very document, that forged profile was read access to a department's notes.

The rule now pins the field set, takes the address from request.auth.token.email rather than the request body, checks the domain itself, requires a non-empty department, and requires createdAt to be request.time.

A bug this introduced, caught by running the app rather than by the suite: getTimestamp() throws rather than returning null when the field holds a number, so reading any profile written before the change crashed the profile screen. toPost() already had the guard and it was not reused. Now both carry it, each pointing at the other. This is the gap the README documents — no test executes repository code.

Edits were a blacklist; votes were world-readable

• Editing a note named the fields that must not move and let everything else through, so an unforeseen field was writable by default and the allowed metadata had no type or size bound. Now a whitelist, checked the way creation is.
• Replacing a file skipped the schema that creation pinned, so writing the document twice walked around it.
• Every vote was readable by every signed-in user — who rated what, and how. Reads are now scoped to the voter and to the rated note's owner, which are exactly the two reads the app makes.
• The bulk delete was only tested with one vote. Rules cap document access calls per request, and each rating delete evaluates existsAfter() and get() on the note; counted per rating rather than per path, a note with a dozen votes would have become undeletable. A test now deletes one with twelve. It passes, so the calls are cached per path.

Documentation

RatingCalculatorTest no longer claims to check "average recalculation" — there has been no average since the field was removed — and Data migrations no longer says the feed downloads every note. Continuous integration was sitting under Data migrations as though CI were a migration; it is its own section now, and it states what it cannot check: it runs the rules against the emulator, which says the file is correct and nothing about the live project running it.

Tests

Suite	Before	After
rules.test.js	65	87
firestore-tests total	85	107
JVM	126	126

Verified

Rules deployed to the live project after each commit. On the device: registration passes the new profile rule end to end, and the feed, upload and note-plus-file batch still work. Not re-verified on the device: note editing and deletion — updateNote writes exactly the five whitelisted fields with a server timestamp, checked by reading both sides, and the emulator covers the positive case.

🤖 Generated with Claude Code