Fix two security holes, two data-loss bugs, and the cost leak

Pre-release review by three reviewers. Most of what they found was mine.

SECURITY (rules deployed)
`allow update` only checked that coupleId was UNCHANGED, never that the
record was yours — the other three verbs check ownership and this one
didn't. Any member knowing a document id could rewrite, cancel or
unschedule another couple's date. Reads being blocked made ids hard to
guess, which is obscurity, not a boundary.

onlyMyMemory() treated `after == null` as "memories untouched", but that
is also what nulling or deleting the field looks like. Either partner
could erase the other's rating with one field, which is the whole of
rate-blind-then-reveal. A create can no longer arrive pre-loaded with a
rating in the partner's name either.

DATA LOSS
"never mind" in the rating editor restored from `item.memory` — the
deprecated single-memory field that nothing writes any more. It reset to
empty, and the next save overwrote a real rating with blanks. Restores
from `mine` now.

The editor was also seeded once at mount, and this component is memoised
and keyed by id, so it survives every snapshot: rate a date on your
phone and an open card on your laptop still held the old values, ready
to write them back over the newer rating. It re-seeds when opened.

WRONG BEHAVIOUR
A date happening TODAY counted as past from midnight — it offered "we
went" and sat under "how did it go?" instead of "next up". The countdown
even had an unreachable branch that rendered the word "today", which is
what tipped the reviewer off that this was a slip rather than a choice.

Signing out terminated the Firestore client, and that instance is a
module singleton created once at import. Signing back in without a
reload hit a dead client and failed every read and write. Now reloads.

"Later" on the update pill destroyed the prompt rather than deferring
it: workbox only fires `waiting` when a NEW worker arrives, so a worker
already parked never announced itself again — the exact
stranded-on-an-old-build case that component exists to prevent.

The overflow sheet's last row, delete, sat under the iPhone home
indicator inside its swipe-up region. EditSheet already handled this.

COST
`photos` was requested on every Place Details lookup and the resulting
photoUrl was never rendered anywhere — a higher billing tier for a field
with no reader. Details are also cached per place per session: every tap
on a map POI fired a fresh billable lookup with no dedupe, so tapping
the same café three times while deciding cost three of them.

The map re-framed itself to fit all pins on every Firestore emission
rather than once per mount, throwing you away from the pin you had just
added. The multi-date card claimed to scroll but its parent disabled
pointer events, so any place with enough dates silently truncated.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: Kjubikstronk

design_handoff_nct127/NCT 127.dc.html

@@ -0,0 +1,15 @@
+repo: Kjubikstronk/press-it
+branch: main
+
+## Last sync
+date: 2026-08-08T13:20:00Z
+
+### Updated in this project
+- Read press-it's full design system (style.css) and page structure (index.html)
+- Rebuilt the layout for NCT 127 with a neon green/magenta palette
+- Kept Anton / Inter / Space Mono / Noto Sans KR, zero border-radius, hairline rules
+
+## Screen map
+| Project screen | Repo files |
+| --- | --- |
+| NCT 127.dc.html | index.html, assets/css/style.css, README.md |

design_handoff_nct127/README.md

@@ -31,11 +31,17 @@ service cloud.firestore {
     function onlyMyMemory() {
       let before = resource.data.get('memories', null);
       let after = request.resource.data.get('memories', null);
-      return after == null
+      // `after == null` must NOT mean "untouched" — it is also what a write
+      // that nulls or deletes the field looks like, which would let either
+      // partner erase the other's rating with a single field and make
+      // rate-blind-then-reveal meaningless.
+      return (before == null && after == null)
         ? true
-        : (before is map
-            ? after.diff(before).affectedKeys().hasOnly([request.auth.uid])
-            : after.keys().hasOnly([request.auth.uid]));
+        : (after is map
+            ? (before is map
+                ? after.diff(before).affectedKeys().hasOnly([request.auth.uid])
+                : after.keys().hasOnly([request.auth.uid]))
+            : false);
     }
 
     /**
@@ -55,12 +61,20 @@ service cloud.firestore {
       // must belong to your couple, and must be signed by you.
       allow create: if isMember()
         && request.resource.data.coupleId == myCouple()
-        && request.resource.data.createdBy == request.auth.uid;
+        && request.resource.data.createdBy == request.auth.uid
+        // Nobody starts a date with a rating already in their partner's name.
+        && (request.resource.data.get('memories', null) == null
+            || request.resource.data.memories.keys().hasOnly([request.auth.uid]));
 
       allow update: if isMember()
+        // The record must already be yours. Checking only that coupleId is
+        // UNCHANGED left every date in the deployment writable by any member
+        // who knew its id — the other three verbs check ownership, this one
+        // didn't.
+        && resource.data.coupleId == myCouple()
         && request.resource.data.createdBy == resource.data.createdBy
         && onlyMyMemory()
-        // Nothing may ever move a record from one couple to another.
+        // Nor may anything move a record from one couple to another.
         && request.resource.data.coupleId == resource.data.coupleId;
     }
 

design_handoff_nct127/github.md

@@ -60,6 +60,22 @@ function DateCard({
   const [stars, setStars] = useState(mine?.stars ?? 0)
   const [memoryNote, setMemoryNote] = useState(mine?.note ?? '')
 
+  /**
+   * Re-seed the editor from whatever is actually stored, each time it opens.
+   *
+   * These were set once at mount, and this component is memoised and keyed by
+   * id, so it survives every snapshot. Rate a date on your phone and the open
+   * card on your laptop still held the old values — saving there wrote them
+   * back over the newer rating.
+   */
+  useEffect(() => {
+    if (mode !== 'remembering') return
+    setStars(mine?.stars ?? 0)
+    setMemoryNote(mine?.note ?? '')
+    // Keyed on the stored memory, so a partner's write while the editor is
+    // closed is picked up next time it opens.
+  }, [mode, mine?.stars, mine?.note])
+
   const cancelled = item.status === 'cancelled'
 
   /**
@@ -82,7 +98,7 @@ function DateCard({
    * timezone.
    */
   const isPast = item.scheduledFor
-    ? item.scheduledFor <= format(new Date(), 'yyyy-MM-dd')
+    ? item.scheduledFor < format(new Date(), 'yyyy-MM-dd')
     : false
 
   function remember() {
@@ -345,7 +361,7 @@ function DateCard({
             </button>
           </header>
 
-          <div className="flex flex-col p-3">
+          <div className="safe-bottom flex flex-col p-3">
             <SheetRow
               onClick={() => {
                 closeSheet()
@@ -459,8 +475,12 @@ function DateCard({
               type="button"
               className="pixel-btn legend px-2 py-1"
               onClick={() => {
-                setStars(item.memory?.stars ?? 0)
-                setMemoryNote(item.memory?.note ?? '')
+                // From `mine`, not the deprecated `item.memory` — that field
+                // is never written any more, so restoring from it silently
+                // reset the editor to empty and the next save destroyed the
+                // real rating.
+                setStars(mine?.stars ?? 0)
+                setMemoryNote(mine?.note ?? '')
                 setMode('idle')
               }}
             >
@@ -484,7 +504,10 @@ function DateCard({
               autoFocus
               onKeyDown={(e) => {
                 if (e.key === 'Enter') callOff()
-                if (e.key === 'Escape') setMode('idle')
+                if (e.key === 'Escape') {
+                  setReason('')
+                  setMode('idle')
+                }
               }}
             />
           </label>

design_handoff_nct127/image-slot.js

@@ -1,4 +1,4 @@
-import { useEffect, useMemo, useState } from 'react'
+import { useEffect, useMemo, useRef, useState } from 'react'
 import { format, parseISO } from 'date-fns'
 // Aliased: the library's `Map` component otherwise shadows the global Map
 // constructor, which broke `new Map()` in this file.
@@ -92,10 +92,17 @@ function LiveMap(props: Props) {
   const [me, setMe] = useState<{ lat: number; lng: number } | null>(null)
 
   const groups = useMemo(() => groupByPlace(props.items), [props.items])
+  const framed = useRef(false)
 
   // Frame every pin on first load, so you open the map to the overview.
   useEffect(() => {
     if (!map || groups.length === 0) return
+    // Once per mount. `groups` derives from a fresh array on every Firestore
+    // emission, so this used to re-run whenever either partner edited
+    // anything — including right after adding a place from the map, which
+    // threw you away from the pin you'd just dropped.
+    if (framed.current) return
+    framed.current = true
     const bounds = new google.maps.LatLngBounds()
     for (const [, items] of groups) {
       bounds.extend({ lat: items[0].place.lat, lng: items[0].place.lng })

firestore.rules

@@ -25,6 +25,11 @@ export default function UpdatePill() {
       if (!registration) return
 
       const check = () => {
+        // A worker that is already waiting will never fire `waiting` again, so
+        // dismissing the pill once would otherwise silence it forever — the
+        // exact stranded-on-an-old-build case this component exists to stop.
+        // Re-raise it here so "later" means "next time" rather than "never".
+        if (registration.waiting) setNeedRefresh(true)
         // Pointless while offline, and it throws on some browsers.
         if (navigator.onLine) void registration.update()
       }

src/components/DateCard.tsx

@@ -57,6 +57,11 @@ export function AuthProvider({ children }: { children: ReactNode }) {
         // into the entry chunk and undo the login screen's code split.
         const { clearCache } = await import('./db')
         await clearCache()
+        // clearCache() terminates the Firestore client, and that instance is a
+        // module singleton created once at import — signing back in without a
+        // reload would hit a dead client and fail every read and write. The
+        // reload is what makes the wipe survivable.
+        window.location.reload()
       },
     }),
     [user, loading],

src/components/DateMap.tsx

@@ -3,17 +3,37 @@ import { useMap, useMapsLibrary } from '@vis.gl/react-google-maps'
 import { MAP_INSTANCE_ID, lastViewport } from './maps'
 import type { Place } from '../types'
 
-/** Only the fields we store. Places bills by field tier, so asking for more
-    than this costs real money for data we'd throw away. */
+/**
+ * Only the fields we actually use. Places bills Place Details by the tier of
+ * the highest field requested, so anything unused here costs real money per
+ * lookup for data we throw away.
+ *
+ * `photos` was in this list and its result was never rendered anywhere — the
+ * stored photoUrl had no reader. Removed.
+ *
+ * `rating` is the one remaining Enterprise-tier field, and it buys exactly the
+ * "4.3 ★" line on the map's candidate card. Dropping it too would put every
+ * lookup on the cheapest tier.
+ */
 const FIELDS = [
   'id',
   'displayName',
   'formattedAddress',
   'location',
-  'photos',
   'rating',
 ] as const
 
+/**
+ * Place details, once per place per session.
+ *
+ * Every tap on a map POI fired a fresh billable lookup, with no dedupe — so
+ * tapping the same café three times while deciding cost three of them, as did
+ * every stray tap while panning. Details are stable enough that a
+ * session-lifetime cache is safe, and it turns the one uncapped spend vector
+ * into a bounded one.
+ */
+const detailCache = new globalThis.Map<string, Place>()
+
 type PlacesLib = google.maps.PlacesLibrary
 
 export function toPlace(
@@ -26,7 +46,8 @@ export function toPlace(
     lat: p.location?.lat() ?? null,
     lng: p.location?.lng() ?? null,
     placeId: p.id ?? null,
-    photoUrl: p.photos?.[0]?.getURI({ maxWidth: 640 }) ?? null,
+    // Never requested any more — see FIELDS.
+    photoUrl: null,
     rating: p.rating ?? null,
   }
 }
@@ -40,10 +61,14 @@ export async function fetchPlaceById(
   placeId: string,
 ): Promise<Place | null> {
   if (!places) return null
+  const hit = detailCache.get(placeId)
+  if (hit) return hit
   try {
     const place = new places.Place({ id: placeId })
     await place.fetchFields({ fields: [...FIELDS] })
-    return toPlace(place)
+    const converted = toPlace(place)
+    if (converted) detailCache.set(placeId, converted)
+    return converted
   } catch {
     return null
   }