pyric-admin 0.1.0-alpha.10 → 0.1.0-alpha.11

package/dist/firestore/index.d.ts

@@ -14,6 +14,24 @@
  * default-app resolution and throw the captured `app/no-app` error when
  * nothing is initialized. The original `getFirestore(ctx)` context form
  * (the load-bearing shape the existing suite uses) is preserved verbatim.
+ *
+ * RULES-BYPASS PARITY (#394): the two APP-resolution forms — `getFirestore(app)`
+ * and no-arg `getFirestore()` — mirror `firebase-admin/firestore`'s
+ * `getFirestore(app?)`, and REAL firebase-admin bypasses security rules. So both
+ * app forms resolve to the rules-BYPASS admin lens (`getAdminFirestore` →
+ * `{ mode: 'admin' }`), exactly as `pyric-admin/database`'s `getDatabase(app)`
+ * and `pyric-admin/storage`'s `getStorage(app)` already do. Previously the app
+ * forms routed through the anon-lens `getFirestore(sandbox.withAuth(null))`,
+ * which evaluates `request.auth == null` and is DENIED by any real ruleset — a
+ * deny-direction divergence from production that blocked the RTDB-trigger →
+ * Firestore-stamp pattern (a Cloud Function's admin write).
+ *
+ * The `getFirestore(ctx)` CONTEXT form is UNCHANGED and stays rules-ENFORCED
+ * (its captured identity is load-bearing for the rules-simulation suite). No
+ * page ever reaches this module: a page's `firebase/firestore` resolves to
+ * `pyric/firestore` (the rules-enforced client), not `pyric-admin`; only the
+ * `firebase-admin/*` → `pyric-admin/*` swap in the trusted functions child
+ * imports this. See {@link getFirestore}.
  */
 export * from 'pyric/sandbox/admin-firestore';
 import { type SandboxFirestore } from 'pyric/sandbox/admin-firestore';
@@ -22,11 +40,19 @@ import { type PyricAdminApp } from '../app/index.js';
 /**
  * Return the admin Firestore handle.
  *
- *   - `getFirestore(ctx)` — the original context form (rules-applied for the
+ *   - `getFirestore(ctx)` — the original context form (rules-APPLIED for the
  *     ctx's captured identity). Unchanged; idempotent per `SandboxContext`.
- *   - `getFirestore(app)` — resolves a {@link PyricAdminApp}'s sandbox.
- *   - `getFirestore()` — resolves the default app; throws `app/no-app` when
- *     nothing is initialized.
+ *     This is the pyric-internal rules-simulation shape, not a firebase-admin
+ *     shape, so it keeps rule evaluation.
+ *   - `getFirestore(app)` — resolves a {@link PyricAdminApp}'s sandbox to the
+ *     rules-BYPASS admin lens (firebase-admin parity, #394).
+ *   - `getFirestore()` — resolves the default app to the rules-BYPASS admin
+ *     lens; throws `app/no-app` when nothing is initialized.
+ *
+ * The app forms mirror `firebase-admin/firestore`'s `getFirestore(app?)`,
+ * which bypasses security rules — so a Cloud Function's admin write lands the
+ * same way it does in production, instead of being denied as `request.auth ==
+ * null` by the sandbox's anon lens (the #394 deny-direction divergence).
  */
 export declare function getFirestore(target?: SandboxContext | PyricAdminApp): SandboxFirestore;
 //# sourceMappingURL=index.d.ts.map

package/dist/firestore/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/firestore/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,cAAc,+BAA+B,CAAC;AAE9C,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,iBAAiB,CAAC;AAoBzB;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,MAAM,CAAC,EAAE,cAAc,GAAG,aAAa,GACtC,gBAAgB,CAUlB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/firestore/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,cAAc,+BAA+B,CAAC;AAE9C,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,iBAAiB,CAAC;AAsBzB;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAC1B,MAAM,CAAC,EAAE,cAAc,GAAG,aAAa,GACtC,gBAAgB,CAUlB"}

package/dist/firestore/index.js

@@ -14,18 +14,38 @@
  * default-app resolution and throw the captured `app/no-app` error when
  * nothing is initialized. The original `getFirestore(ctx)` context form
  * (the load-bearing shape the existing suite uses) is preserved verbatim.
+ *
+ * RULES-BYPASS PARITY (#394): the two APP-resolution forms — `getFirestore(app)`
+ * and no-arg `getFirestore()` — mirror `firebase-admin/firestore`'s
+ * `getFirestore(app?)`, and REAL firebase-admin bypasses security rules. So both
+ * app forms resolve to the rules-BYPASS admin lens (`getAdminFirestore` →
+ * `{ mode: 'admin' }`), exactly as `pyric-admin/database`'s `getDatabase(app)`
+ * and `pyric-admin/storage`'s `getStorage(app)` already do. Previously the app
+ * forms routed through the anon-lens `getFirestore(sandbox.withAuth(null))`,
+ * which evaluates `request.auth == null` and is DENIED by any real ruleset — a
+ * deny-direction divergence from production that blocked the RTDB-trigger →
+ * Firestore-stamp pattern (a Cloud Function's admin write).
+ *
+ * The `getFirestore(ctx)` CONTEXT form is UNCHANGED and stays rules-ENFORCED
+ * (its captured identity is load-bearing for the rules-simulation suite). No
+ * page ever reaches this module: a page's `firebase/firestore` resolves to
+ * `pyric/firestore` (the rules-enforced client), not `pyric-admin`; only the
+ * `firebase-admin/*` → `pyric-admin/*` swap in the trusted functions child
+ * imports this. See {@link getFirestore}.
  */
 export * from 'pyric/sandbox/admin-firestore';
-import { getFirestore as baseGetFirestore, } from 'pyric/sandbox/admin-firestore';
+import { getFirestore as baseGetFirestore, getAdminFirestore as baseGetAdminFirestore, } from 'pyric/sandbox/admin-firestore';
 import { ADMIN_APP_TARGET, getApp, isSandboxAdminApp, } from '../app/index.js';
 import { assertAdminAppActive } from '../app/lifecycle.js';
-/** Narrow a `PyricAdminApp` to the anonymous {@link SandboxContext} the
- *  admin firestore backend runs against. Sandbox apps expose their
- *  `Sandbox` — LOCAL and REMOTE alike: the base `getFirestore` is
- *  remote-aware (it dispatches a remote-branded sandbox to the
- *  channel-backed arm), so no guard is needed here. Prod apps require
- *  firebase-admin's real Firestore, which the in-process backend does
- *  not model. */
+/** Narrow a `PyricAdminApp` to the {@link SandboxContext} the admin
+ *  firestore backend runs against. Sandbox apps expose their `Sandbox` —
+ *  LOCAL and REMOTE alike: the base resolvers are remote-aware (they
+ *  dispatch a remote-branded sandbox to the channel-backed arm), so no
+ *  guard is needed here. The context's captured auth is IRRELEVANT on the
+ *  admin path (rules are bypassed, so no rule reads `request.auth`); it is
+ *  normalised to `withAuth(null)` only to obtain a context. Prod apps
+ *  require firebase-admin's real Firestore, which the in-process backend
+ *  does not model. */
 function adminAppToContext(app) {
     if (isSandboxAdminApp(app)) {
         return app.sandbox.withAuth(null);
@@ -36,20 +56,28 @@ function adminAppToContext(app) {
 /**
  * Return the admin Firestore handle.
  *
- *   - `getFirestore(ctx)` — the original context form (rules-applied for the
+ *   - `getFirestore(ctx)` — the original context form (rules-APPLIED for the
  *     ctx's captured identity). Unchanged; idempotent per `SandboxContext`.
- *   - `getFirestore(app)` — resolves a {@link PyricAdminApp}'s sandbox.
- *   - `getFirestore()` — resolves the default app; throws `app/no-app` when
- *     nothing is initialized.
+ *     This is the pyric-internal rules-simulation shape, not a firebase-admin
+ *     shape, so it keeps rule evaluation.
+ *   - `getFirestore(app)` — resolves a {@link PyricAdminApp}'s sandbox to the
+ *     rules-BYPASS admin lens (firebase-admin parity, #394).
+ *   - `getFirestore()` — resolves the default app to the rules-BYPASS admin
+ *     lens; throws `app/no-app` when nothing is initialized.
+ *
+ * The app forms mirror `firebase-admin/firestore`'s `getFirestore(app?)`,
+ * which bypasses security rules — so a Cloud Function's admin write lands the
+ * same way it does in production, instead of being denied as `request.auth ==
+ * null` by the sandbox's anon lens (the #394 deny-direction divergence).
  */
 export function getFirestore(target) {
     if (target === undefined) {
-        return baseGetFirestore(adminAppToContext(getApp()));
+        return baseGetAdminFirestore(adminAppToContext(getApp()));
     }
     if (typeof target === 'object' && target !== null && ADMIN_APP_TARGET in target) {
         const app = target;
         assertAdminAppActive(app);
-        return baseGetFirestore(adminAppToContext(app));
+        return baseGetAdminFirestore(adminAppToContext(app));
     }
     return baseGetFirestore(target);
 }

package/dist/firestore/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/firestore/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,cAAc,+BAA+B,CAAC;AAE9C,OAAO,EACL,YAAY,IAAI,gBAAgB,GAEjC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,gBAAgB,EAChB,MAAM,EACN,iBAAiB,GAElB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D;;;;;;iBAMiB;AACjB,SAAS,iBAAiB,CAAC,GAAkB;IAC3C,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,KAAK,CACb,wEAAwE;QACtE,sEAAsE,CACzE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAuC;IAEvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,gBAAgB,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,gBAAgB,IAAI,MAAM,EAAE,CAAC;QAChF,MAAM,GAAG,GAAG,MAAuB,CAAC;QACpC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,gBAAgB,CAAC,MAAwB,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/firestore/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,cAAc,+BAA+B,CAAC;AAE9C,OAAO,EACL,YAAY,IAAI,gBAAgB,EAChC,iBAAiB,IAAI,qBAAqB,GAE3C,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,gBAAgB,EAChB,MAAM,EACN,iBAAiB,GAElB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D;;;;;;;;sBAQsB;AACtB,SAAS,iBAAiB,CAAC,GAAkB;IAC3C,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,KAAK,CACb,wEAAwE;QACtE,sEAAsE,CACzE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAuC;IAEvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,qBAAqB,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,gBAAgB,IAAI,MAAM,EAAE,CAAC;QAChF,MAAM,GAAG,GAAG,MAAuB,CAAC;QACpC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,qBAAqB,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,gBAAgB,CAAC,MAAwB,CAAC,CAAC;AACpD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pyric-admin",
-  "version": "0.1.0-alpha.10",
+  "version": "0.1.0-alpha.11",
   "license": "Apache-2.0",
   "homepage": "https://pyric.dev",
   "repository": {
@@ -46,7 +46,7 @@
     "typecheck": "bun x tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "pyric": "^0.1.0-alpha.10"
+    "pyric": "^0.1.0-alpha.11"
   },
   "devDependencies": {
     "@types/bun": "latest",