Add Firebase Storage rules for GPX file uploads - #74
Open
aleexwong wants to merge 5 commits into
Open
Conversation
Enforces that only the file owner can upload GPX files (filename must be prefixed with the authenticated user's UID), caps uploads at 10 MB, and restricts content types to GPX/XML. Denies all other storage paths by default. Adds storage.rules to source control so it deploys alongside firestore.rules via the Firebase CLI. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019d81oQrnrfShaqUsxcPTBj
Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019d81oQrnrfShaqUsxcPTBj
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
✅ Deploy Preview for trainpace ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Not up to standards ⛔🔴 Issues
|
| Category | Results |
|---|---|
| BestPractice | 3 medium 1 minor |
| ErrorProne | 10 medium 58 high |
| Security | 12 high |
| CodeStyle | 2 minor |
| Complexity | 8 medium |
🟢 Metrics 182 complexity · -2 duplication
Metric Results Complexity 182 Duplication -2
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
Adds /simulate: pick a course and goal time, get a Minetti GAP-based even-effort pacing plan adjusted for elevation. Includes 15 major marathons, full/half toggle, km/mi units, shareable URL state, VDOT feasibility check, training implications panel, graded elevation chart, and CTAs wired to Fuel Planner (pre-filled with simulated finish time) and Pace Calculator. Also adds blog posts driving traffic to the feature and wires the simulator into race SEO landing pages, VDOT calculator, footer, and nav. Bug fixes from code review: displayPace "X:60 /mi" rollover, effort pace stat ignoring units toggle, sub-1h regex corrupting realistic-goal button, misleading "flat marathon" label in half mode, gapFactor math deduplicated via shared helper, paceSecPerKm checkpoint fallback with float tolerance, empty-segments guard, activePoints.length guard, inline goal error message. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add storage.rules (gpx_files: public read, owner-prefixed write) and register a storage target in firebase.json so `deploy --only storage` works - Add .firebaserc aliases: production -> trainpace-prod, staging -> trainpace-staging for project-level isolation of Vercel preview/staging data from prod - Document VITE_FIREBASE_* vars + env scoping in .env.example - Document the prod/staging environment setup in CLAUDE.md Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- storage.rules: split allow write into create/update + delete to avoid null-deref on request.resource during DELETE operations - firestore.rules: restrict gpx_uploads list to owner; restore createdBy ownership check on elevation_analysis_cache update/delete - firestore.indexes.json: add composite indexes for gpx_uploads duplicate check (userId+fileHash+deleted) and rate limit queries (userId+uploadedAt) - firebase.json: wire up indexes file alongside existing rules config - GpxUploader: wrap checkRateLimits in useCallback with correct deps; make handleDuplicateAction async and clear modal state before awaiting upload; add missing fileHash/deleted/contentValidated to Method 3 addDoc - AuthContext: guard posthog.identify against repeated calls on page refresh; wrap posthog calls in try/catch so ad-blocker exceptions don't stall auth state - useTrainingPlans: add stale-response guard for rapid userId changes; add error state on removePlan failure - useGpxAnalysis: preserve raceName through cache round-trip - types.ts: add routeName to StaticRouteData interface - Settings.tsx: remove user_training_goals from hardDeleteCollections to prevent account deletion abort on docId-keyed Firestore rule Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019d81oQrnrfShaqUsxcPTBj
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Configure Firebase Storage security rules to enable authenticated GPX file uploads for the elevation analysis feature while maintaining public read access and enforcing file size/type constraints.
Changes
storage.rules (new file): Added Firebase Storage security rules with:
/gpx_files/directoryfirebase.json: Updated to include storage rules configuration alongside existing Firestore rules
.gitignore: Added Firebase CLI debug logs and
.firebase/directory to prevent accidental commitsImplementation Details
The storage rules follow the principle of least privilege:
gpx_files/user123_filename.gpx)This enables the Course Elevation Analysis feature to securely handle GPX file uploads from authenticated users.
https://claude.ai/code/session_019d81oQrnrfShaqUsxcPTBj