react-doctor/firebase-client-owned-authz-field

When the client writes ownership or role fields (`ownerId`, `orgId`, `role`, `isAdmin`) to Firebase/Supabase, an attacker can forge them and grant themselves access.

Validation prompt

Confirm the detector match and collect the required evidence before deciding whether an edit is warranted.

Fires only in CLIENT-side production source (server dirs like api//server//functions//middleware/ and *.server.* files are excluded) where the file shows Firebase/Supabase evidence: the words firebase/firestore/supabase, or a setDoc(/addDoc( call, in the path or content. Within that file it matches a client write: setDoc(/updateDoc(/addDoc(, or a collection(...).set|update|add(: occurring within ~700 chars of an authority-field name: ownerId/creatorId/providerId/orgId/tenantId/workspaceId/ghostOrg/role/roles/isAdmin.

Suppress when: already guarded: an in-house data writer that merely shares a method name like updateDoc(...) without any Firebase/Supabase evidence is skipped; a remaining FP is a write where the authority field is server-derived/immutable and re-validated by Firestore rules or RLS (e.g. the client echoes its own already-authenticated uid that the rules pin to request.auth.uid), rather than a value an attacker could forge.

Evidence boundary

The diagnostic proves only that the detector’s modeled source pattern matched. It does not prove runtime impact, product intent, rendered failure, or that one remediation is correct.

Establish the environment, repository policy, exceptions, and required rendered or runtime evidence before deciding the occurrence.

Record one outcome:

• Confirmed failure: The required evidence establishes the violation.
• Rejected: A documented exception or false-positive predicate applies.
• Needs evidence: Named evidence can still be collected.
• Unavailable: Required evidence cannot be collected in this run.
• Waived with evidence: An authorized, scoped exception applies to an established failure.
• Observation: The review records an optional tradeoff without claiming a defect.

A waiver records its scope, authority, evidence, and review condition. It is not a pass or false positive.

Default severity is registry metadata. Use the occurrence’s JSON severity after repository configuration when ordering real findings.

Fix prompt

Apply this candidate correction only after the required evidence confirms the risk.

Do not let the client set authority fields. Write ownerId, tenantId, role, and isAdmin on the server (a callable/cloud function or your backend) from the authenticated identity, and enforce them in Firestore/Storage rules (or Supabase RLS) so a forged client write is rejected. For example, require request.auth.uid == request.resource.data.ownerId on create and make the field immutable on update. Never write isAdmin/role from client code.

Repository-wide copy prompt

Use this repository-wide prompt only after validating each occurrence. For one occurrence, use the guidance above.