fix(billing): do not grant unlimited access from spoofed Firestore email - #79
Draft
cursor[bot] wants to merge 1 commit into
Draft
cursor[bot] wants to merge 1 commit into
cursor[bot] wants to merge 1 commit into
Conversation
PAYG users could write an allowlisted email onto users/{uid} because email
was client-writable. consumeBillingAction and generate-mystical then treated
them as no-charge. Trust Firebase Auth email only and protect email in rules.
Co-authored-by: Andy Oliver Rozario <andyrozario7@gmail.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
users/{uid}.emailno longer skips Seer or regen credits.firestore.rulestreatsemailas a protected field so profile saves cannot change it.Why this change is safe
hasUnlimitedBillingAccesstrusted FirestoreemailagainstNO_CHARGE_SUBSCRIPTION_EMAILS, and rules allowed clients to changeemail.users/{uid}.emailto an allowlisted address (often visible viaNEXT_PUBLIC_*admin/no-charge env), then asks the Seer or regenerates. Server skipped debit.noChargeAccountand paid subscription checks are unchanged. Distinct from open drafts Fix mystical regeneration billing bypass #24 (preview regen), Fix credit pack payment verification bypass #25 (credit pack verify), and Fix client-controlled subscription and credit pack pricing #30 (subscription amount).Verification
pnpm exec eslinton touched TS files (0 errors)pnpm run lint:security(0 errors; pre-existing warning inlib/firebase.ts)pnpm test— 75 suites / 403 teststests/unit/billingCredits.test.tsfails the spoofed-email path withoutwithTrustedBillingEmailRegression prevention
Release checklist (solo-friendly)
firestore.ruleswith the app (rules are not applied by this PR alone)users.emailwrite, and a real no-charge Auth account still skips debit