@doubling/compound-sync 1.7.0 → 1.7.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@doubling/compound-sync",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "description": "Bidirectional sync between Compound and local markdown files",
   "type": "module",
   "bin": {

package/sync.js

@@ -833,7 +833,15 @@ async function setupOrgSync({ orgId, localPath: rawLocalPath }) {
       }, err => console.error(`  [${orgId}] Private files listener error:`, err));
       console.log(`  [${orgId}]   Listening: Private files + Shared by Me symlinks`);
 
-      const sharedQ = query(filesRef, where('sharedWith', 'array-contains', USER_ID));
+      // scope=='private' is required: Firestore rules only grant
+      // sharedWith-based reads on private files, so the query must
+      // constrain scope or the whole listen is denied (rules are not
+      // filters). See tests/rules.test.js "shared-with-me query".
+      const sharedQ = query(
+        filesRef,
+        where('scope', '==', 'private'),
+        where('sharedWith', 'array-contains', USER_ID),
+      );
       onSnapshot(sharedQ, snapshot => {
         snapshot.docChanges().forEach(change => {
           const data = change.doc.data();