Allow staff to read/manage patient docs and referrals - #61
Open
naasanov wants to merge 3 commits into
Open
Conversation
The Patient Dashboard and member page query the users collection for other people's docs (patients, social workers) and write to them (assignment, status, verification), and manage patient referrals. The firestore rules only permitted reading/writing one's own user doc and blocked all referral writes, so these queries were denied with permission errors. - Add isStaff() helper (social_worker/admin) via requester's user doc - Let staff read patient and social_worker user docs (never admin) - Let staff update assignment/status/verification fields on user docs - Let staff read/create/update referrals (hard delete still blocked) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
firestore.rules forked at 85d8674 and the two lines never merged. This branch has the staff line (isStaff, staff user/referral access); main has the events line (16a607d), and arya/unverified-patient-changes has the verify gate (6e0b291). Whichever side was deployed last silently broke the other, which is why the staff portal looked flaky rather than broken. Takes the union, plus three fixes that were in neither line: - events create/update/delete now require isStaff(). The web calendar's add/edit/delete form writes client-side (calendar.tsx:224/229/242) and every write was hitting `if false`. - messages update allows an isRead flip on messages you did not send. Both lineages had `allow update: if false`, so the web's read receipts (member.tsx:394) failed regardless of which side was deployed. - isChatParticipant guards with exists(). It dereferenced a possibly missing chat doc, which errors the rule out instead of evaluating false. From the staff line, the users read stays widened to plain isStaff() rather than the role-narrowed form: staff_admin.tsx:139 queries role in ['social_worker','admin'], and a per-document role condition makes Firestore reject that list query outright. From the events/verify line, isOwnEmailVerificationMirrorUpdate stays deleted so a patient cannot self-approve; isVerified is writable only via isStaffUserUpdate and admin Cloud Functions. Also adds isOwnPhoneNumberUpdate so mobile signup (auth.dart:53) can set its own phoneNumber. users create stays closed on purpose: the onAuthUserCreated trigger skips seeding when a doc already exists, so an open create would let a client self-issue role:'admin' and win the race against the trigger. The residual race that drops the phone number needs an app-side fix. Note: this branch predates 16a607d, so firestore.indexes.json here still lacks the events index and the messages.timestamp fieldOverrides that the events rules and chat search depend on. Merge main before deploying. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Patient Dashboard failed to load with "Failed to load patients. Please try again." after the last firestore rules deploy. The rules restricted
usersreads to a user's own doc (isCurrentUser(uid)), but the dashboard and member page query theuserscollection for other people's docs. Firestore rejects a list query outright unless the rule permits every doc it could return, so the whole query was denied. The same rules also blocked staff writes (assignment/status/verification) and all referral reads/writes.Changes (
backend/firestore.rules)isStaff()helper — social workers/admins, resolved from the requester's own user doc, guarded bysignedIn()./usersread — own doc, or staff reading apatient/social_workerdoc. Admin docs stay private. (List queries must constrainrole, which the existing dashboard queries all do.)/usersupdate — existing self-update branches, orisStaffUserUpdate()limited toassignedSocialWorkerId,assignedSocialWorkerName,status,isVerified,isBanned,updatedAt./referrals— read for patient owner or staff; create/update for staff (covers Add/Edit and soft-delete viaisDeleted); hard delete stays blocked.Notes / follow-ups
isStaff()costs oneget()per rule evaluation. If the dashboard gets read-heavy, promoteroleto a custom auth claim to drop the extra reads.🤖 Generated with Claude Code