# `react-doctor/firebase-client-owned-authz-field`

When the client writes ownership or role fields (`ownerId`, `orgId`, `role`, `isAdmin`) to Firebase/Supabase, an attacker can forge them and grant themselves access.

- **Category:** Security
- **Severity:** error
- **Source:** oxlint-plugin-react-doctor
- **Framework:** global
- **Enabled when:** client-side production source only (server dirs api/server/functions/middleware/routes and *.server.* files skipped) where the file shows Firebase/Supabase evidence in its path or content

## Validation prompt

Use this to decide whether a fired diagnostic is real or a false positive.

Fires only in CLIENT-side production source (server dirs like `api/`/`server/`/`functions/`/`middleware/` and `*.server.*` files are excluded) where the file shows Firebase/Supabase evidence — the words `firebase`/`firestore`/`supabase`, or a `setDoc(`/`addDoc(` call, in the path or content. Within that file it matches a client write — `setDoc(`/`updateDoc(`/`addDoc(`, or a `collection(...).set|update|add(` — occurring within ~700 chars of an authority-field name: `ownerId`/`creatorId`/`providerId`/`orgId`/`tenantId`/`workspaceId`/`ghostOrg`/`role`/`roles`/`isAdmin`. FALSE POSITIVE to suppress: already guarded — an in-house data writer that merely shares a method name like `updateDoc(...)` without any Firebase/Supabase evidence is skipped; a remaining FP is a write where the authority field is server-derived/immutable and re-validated by Firestore rules or RLS (e.g. the client echoes its own already-authenticated `uid` that the rules pin to `request.auth.uid`), rather than a value an attacker could forge.

## Fix prompt

Use this once validation confirms the diagnostic is real.

Do not let the client set authority fields. Write `ownerId`, `tenantId`, `role`, and `isAdmin` on the server (a callable/cloud function or your backend) from the authenticated identity, and enforce them in Firestore/Storage rules (or Supabase RLS) so a forged client write is rejected. For example, require `request.auth.uid == request.resource.data.ownerId` on create and make the field immutable on update. Never write `isAdmin`/`role` from client code.