firestore-rules-audit

name	firestore-rules-audit
description	Audit skill for Firestore security rules. Validates that rules match business logic, enforce LGPD compliance, and protect clinical data across all NEXUS collections.

Firestore Security Rules Audit

When auditing Firestore security rules, validate each collection against this checklist:

1. Authentication Gate

• Every collection requires request.auth != null
• No public read/write access on any clinical data
• Auth token validation is present (not just auth != null)

2. Collection-Specific Rules

patients/

• Read: authenticated professionals only
• Write: authenticated professionals only
• Delete: admin only (or disabled — archive preferred over delete for LGPD)
• Fields: consent, nexusId, status must be present on create

protocols/

• Read: creator + assigned professional + admin
• Write: creator + admin (no modification after APPROVED status)
• sha256Hash field must be present on create
• Status transitions validated (DRAFT → PENDING → APPROVED → ACTIVE → COMPLETED)

audit_logs/

• Read: admin only
• Create: authenticated professionals only
• Update: DENIED (immutable)
• Delete: DENIED (immutable)

sample_queue/

• Read: authenticated professionals only
• Write: authenticated professionals only
• Status transitions validated (WAITING → IN_ADMISSION → ADMITTED → IN_COLLECTION → COLLECTED → DISPATCHED)

sample_compliance/ + sample_inventory/

• Read: authenticated professionals only
• Write: authenticated professionals only
• Delete: validated (compliance: admin only; inventory: qty=0 only)

stock/

• Read: authenticated professionals
• Write: authorized pharmacists only (role check)

rateLimits/

• Read: admin only
• Write: admin only (or Cloud Functions service account)

medications/ + labResults/ + endoinjectSessions/ + bodyScanRecords/ + lifestyleRecords/

• Read: authenticated professionals only
• Write: authenticated professionals only

3. LGPD Compliance

• Patient data cannot be bulk-exported (no list without filters)
• Deletion rules support right-to-be-forgotten (archive workflow)
• No cross-tenant data leakage (clinicId isolation if multi-tenant)

4. Rate Limiting

• Public endpoints have rate limiting via rateLimits collection
• Cloud Functions check rate limits before processing

5. Index Validation

• All composite queries have matching Firestore indexes
• No unnecessary indexes (cost optimization)

Output Format

For each finding:

1. Collection: Which collection
2. Rule: Current rule
3. Issue: What's wrong
4. Risk: LGPD / ANVISA / Security impact
5. Fix: Corrected rule with code example