docs: codebase audit, riverpod 3 plan, and firestore rules#82
Merged
Conversation
- full architecture and code-structure review of the app - unbiased rating of 5.5/10 with per-dimension scoring - documents strengths: layering, functional error handling, docs, ci/cd - flags gaps: no tests, di defeated by global singletons, real model bugs - notes privacy concerns for health data: verbose logging, no firestore rules - prioritized recommendations and a riverpod 3 upgrade pointer Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- effort and risk assessment for the 2.x to 3.0 upgrade - inventories the breaking changes that actually touch this codebase - estimates ~2-4 days, low surface but elevated risk due to no tests - recommends fixing the global-singleton di in the same pass - step-by-step migration sequence with a pre-migration checklist Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- add firestore.rules with a locked-down per-user baseline
- deny all by default, allow access only where the {uid} path segment matches request.auth.uid
- covers users/{uid}, meds/{uid} and logs/{uid} trees plus nested subcollections
- wire firestore rules and indexes targets into firebase.json
- add empty firestore.indexes.json and .firebaserc pinning the default project
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a full codebase audit, a Riverpod 3.0 migration plan, and scaffolds the previously-missing Firestore security rules.
docs/codebase_audit.md— architecture and code-structure review with an unbiased 5.5/10 rating. Highlights strengths (layering, functional error handling, docs, CI/CD) and gaps (no test coverage, DI defeated by global singletons, a few real model bugs, health-data privacy concerns).docs/riverpod_3_migration_plan.md— effort/risk assessment (~2–4 days, low surface but elevated risk from the lack of tests) plus a step-by-step migration sequence.firestore.rules(deny-all baseline, per-user access where the{uid}path segment matchesrequest.auth.uid, coveringusers/{uid},meds/{uid}, andlogs/{uid}trees), wired intofirebase.jsonalongsidefirestore.indexes.jsonand.firebaserc.Notes
firebase deploy --only firestore:ruleswhen ready, and verify the app still reads/writes after the lockdown (current live rules are likely more permissive).🤖 Generated with Claude Code