Firestore rules and indexes are in source control but never deployed #13

New Issue

2026-08-19T22:06:55-04:00

logan commented

2026-08-19 22:06:55 -04:00

infra/firestore/firestore.rules and firestore.indexes.json landed during the tenancy pass but have not been deployed — deployment is a manual step documented inside the files themselves.

Until that happens, the rules actually enforcing browser direct-reads are whatever is live in the Firebase console, not what is in the repo. The repository and production are silently out of sync on a security boundary, which is the worst kind of drift: reviewing the repo gives false assurance.

Also unverified: whether Firestore genuinely requires the composite index for org_id == combined with array_contains that was included defensively.

`infra/firestore/firestore.rules` and `firestore.indexes.json` landed during the tenancy pass but have not been deployed — deployment is a manual step documented inside the files themselves. Until that happens, the rules actually enforcing browser direct-reads are whatever is live in the Firebase console, not what is in the repo. The repository and production are silently out of sync on a security boundary, which is the worst kind of drift: reviewing the repo gives false assurance. Also unverified: whether Firestore genuinely requires the composite index for `org_id ==` combined with `array_contains` that was included defensively.

logan commented

2026-08-23 02:13:36 -04:00

Confirmed live in prod (drb.cusano.net, git_sha 861ea41, 2026-08-23 02:07 EDT) — both halves of this are still undeployed and now cause visible, misleading UI failures:

Indexes. useIncidents fails on every load of /incidents:

useIncidents: FirebaseError: The query requires an index. ...collectionGroups/incidents/indexes/... org_id, started_at

That index IS declared in infra/firestore/firestore.indexes.json (incidents: org_id ASC + started_at ASC). It has never been pushed. The consequence is worse than a blank page: app/incidents/page.tsx renders the empty state "No incidents recorded yet / Incidents appear automatically once calls start correlating." while the real cause is a failed query. The page lies about the state of the system. Same shape is waiting for calls (org_id+started_at, org_id+incident_ids) and both alert_events indexes.

Rules. useUnacknowledgedAlerts: FirebaseError: Missing or insufficient permissions. fires from the root layout on every page load, so every route in the app logs an error. firestore.rules:98 does grant allow read: if docInMyOrg() on alert_events — so this is the rules file not being deployed, or docInMyOrg() failing because live alert_events docs predate org_id.

Deploy command is in the header comment of the indexes file: firebase deploy --only firestore:indexes --project discord-radio-bot-461301 (plus firestore:rules).

Secondary fix worth doing at the same time: the hooks swallow the error into an empty array, so useIncidents/useCalls should surface error to the page and the page should render an error state instead of "nothing recorded yet".

Confirmed live in prod (drb.cusano.net, git_sha 861ea41, 2026-08-23 02:07 EDT) — both halves of this are still undeployed and now cause visible, misleading UI failures: **Indexes.** `useIncidents` fails on every load of `/incidents`: ``` useIncidents: FirebaseError: The query requires an index. ...collectionGroups/incidents/indexes/... org_id, started_at ``` That index IS declared in `infra/firestore/firestore.indexes.json` (incidents: org_id ASC + started_at ASC). It has never been pushed. The consequence is worse than a blank page: `app/incidents/page.tsx` renders the empty state **"No incidents recorded yet / Incidents appear automatically once calls start correlating."** while the real cause is a failed query. The page lies about the state of the system. Same shape is waiting for `calls` (org_id+started_at, org_id+incident_ids) and both `alert_events` indexes. **Rules.** `useUnacknowledgedAlerts: FirebaseError: Missing or insufficient permissions.` fires from the root layout on *every* page load, so every route in the app logs an error. `firestore.rules:98` does grant `allow read: if docInMyOrg()` on `alert_events` — so this is the rules file not being deployed, or `docInMyOrg()` failing because live `alert_events` docs predate `org_id`. Deploy command is in the header comment of the indexes file: `firebase deploy --only firestore:indexes --project discord-radio-bot-461301` (plus `firestore:rules`). Secondary fix worth doing at the same time: the hooks swallow the error into an empty array, so `useIncidents`/`useCalls` should surface `error` to the page and the page should render an error state instead of "nothing recorded yet".