feat: automatically track lastUpdated time on all firestore docs (#227)

- it is often helpful to query for “new” firestore docs (for sync or backup)
- this commit adds an automatic server timestamp to all subject documents and top level project documents when updated or created so that this can be queried
- non-breaking change because without this it just will not store those fields.
- update tests for last updated
- update default rules to allow anonymous updates to last updated for parent/project doc
- [autofix.ci] apply automated fixes


---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

Author: gureckis

firebase/firebase.rules

@@ -17,6 +17,8 @@ service cloud.firestore {
     match /testing/{studyID} {
       allow create: if isAuthenticated() && !exists(/databases/$(database)/documents/testing/$(studyID));
       allow read: if isAuthenticated();  // Add this line
+      allow update: if isAuthenticated() &&
+                      request.resource.data.diff(resource.data).affectedKeys().hasOnly(['lastUpdated']);
       match /data/{partID} {
         allow create: if isAuthenticated() && 
                         request.resource.data.firebaseAnonAuthID == request.auth.uid;
@@ -36,6 +38,8 @@ service cloud.firestore {
     match /real/{studyID} {
       allow create: if isAuthenticated() && !exists(/databases/$(database)/documents/real/$(studyID));
       allow read: if isAuthenticated();  // Add this line
+      allow update: if isAuthenticated() &&
+                      request.resource.data.diff(resource.data).affectedKeys().hasOnly(['lastUpdated']);
       match /data/{partID} {
         allow create: if isAuthenticated() && 
                         request.resource.data.firebaseAnonAuthID  == request.auth.uid;

src/core/stores/firestore-db.js

@@ -27,6 +27,7 @@ import {
   updateDoc,
   getDoc,
   Timestamp,
+  serverTimestamp,
   connectFirestoreEmulator,
 } from 'firebase/firestore'
 import appconfig from '@/core/config'
@@ -148,7 +149,11 @@ export const updateSubjectDataRecord = async (data, docid) => {
   try {
     validateFirestoreData(data)
     const docRef = doc(db, `${mode}/${appconfig.projectRef}/data/`, docid)
-    await setDoc(docRef, data, { merge: true })
+    await setDoc(docRef, { ...data, lastUpdated: serverTimestamp() }, { merge: true })
+
+    // Also update the parent project document's lastUpdated field
+    const projectRef = doc(db, mode, appconfig.projectRef)
+    await setDoc(projectRef, { lastUpdated: serverTimestamp() }, { merge: true })
   } catch (e) {
     log.error('FIRESTORE-DB: Error updating document:', e.message)
     throw e // Re-throw to allow caller to handle the error
@@ -167,9 +172,17 @@ export const updatePrivateSubjectDataRecord = async (data, docid) => {
   // is it weird to have a aync method that doesn't return anything?
   try {
     const docRef = doc(db, `${mode}/${appconfig.projectRef}/data/${docid}/private/`, 'private_data')
-    setDoc(docRef, data, {
-      merge: true,
-    })
+    await setDoc(
+      docRef,
+      { ...data, lastUpdated: serverTimestamp() },
+      {
+        merge: true,
+      }
+    )
+
+    // Also update the parent project document's lastUpdated field
+    const projectRef = doc(db, mode, appconfig.projectRef)
+    await setDoc(projectRef, { lastUpdated: serverTimestamp() }, { merge: true })
   } catch (e) {
     log.error('FIRESTORE-DB: Error updating private document', e)
     throw e
@@ -232,6 +245,7 @@ export const createDoc = async (data) => {
         projectRef: appconfig.projectRef,
         codeName: appconfig.codeName,
         codeNameURL: appconfig.codeNameURL,
+        lastUpdated: serverTimestamp(),
       })
       log.log('FIRESTORE-DB: New experiment registered with ID: ', `${mode}/${appconfig.projectRef}`)
     }
@@ -242,11 +256,13 @@ export const createDoc = async (data) => {
     const docRef = await addDoc(collection(db, `${mode}/${appconfig.projectRef}/data`), {
       ...data,
       firebaseAnonAuthID: user.uid,
+      lastUpdated: serverTimestamp(),
     })
 
     // Update the document with its own ID
     await updateDoc(docRef, {
       firebaseDocID: docRef.id,
+      lastUpdated: serverTimestamp(),
     })
 
     data.firebaseAnonAuthID = user.uid
@@ -277,7 +293,13 @@ export const createPrivateDoc = async (data, docId) => {
     await setDoc(docRef, {
       ...data,
       firebaseAnonAuthID: user.uid,
+      lastUpdated: serverTimestamp(),
     })
+
+    // Also update the parent project document's lastUpdated field
+    const projectRef = doc(db, mode, appconfig.projectRef)
+    await setDoc(projectRef, { lastUpdated: serverTimestamp() }, { merge: true })
+
     log.log(`FIRESTORE-DB: Private document written with ID: `, docRef.id)
     return docRef.id
   } catch (e) {

tests/vitest/core/stores/firestore-db.test.js

@@ -28,6 +28,7 @@ vi.mock('firebase/firestore', () => ({
   Timestamp: {
     now: vi.fn(() => ({ seconds: 1234567890, nanoseconds: 123456789 })),
   },
+  serverTimestamp: vi.fn(() => ({ seconds: 1234567890, nanoseconds: 123456789 })),
   connectFirestoreEmulator: vi.fn(),
 }))
 
@@ -67,9 +68,9 @@ import {
   fsnow,
 } from '@/core/stores/firestore-db'
 
-import { getAuth, signInAnonymously } from 'firebase/auth'
+import { signInAnonymously } from 'firebase/auth'
 
-import { doc, getDoc, addDoc, setDoc, updateDoc, Timestamp } from 'firebase/firestore'
+import { getDoc, addDoc, setDoc, updateDoc, Timestamp } from 'firebase/firestore'
 
 describe('firestore-db', () => {
   beforeEach(() => {