gcp-firestore-authed-rules

id: gcp-firestore-authed-rules
emits: ExposedToTenant
description: "Firebase Security Rules requiring only 'request.auth != null' (authenticated but no domain/claim\
  \ restriction) make the Firestore database accessible to any Firebase Auth user \u2014 including users\
  \ outside the organization."
match_record:
  resource_type: firebase.rules.Ruleset
  field: source.files[].content
where:
- 'Security Rules source contains ''allow read: if request.auth != null'' (or write, or both) without
  further domain, email, or custom-claim restriction'
- no additional condition scopes the auth check to a specific domain (e.g. no @company.com domain check,
  no custom claim check)
- the release named 'cloud.firestore' points to this ruleset
emit:
  source_type: Data
  target_type: Organization
  source: <Firestore Database / NoSQLDatabase node>
  target: <GCP Organization / Tenant node>
  permissions: []
  conditions:
  - resource_policy
  state_logic: ACTIVE when the live ruleset contains an auth-only check with no further domain or claim
    restriction and the check covers at least read access for the matched path; CONDITIONAL(resource_policy)
    when the ruleset coverage is partial or the match path is a subset of collections.
  confidence: '0.90'
  derived_from:
  - 'firebase.rules.Ruleset source: allow read/write if request.auth != null (no domain scoping)'
  - firebase.rules.Release 'cloud.firestore' points to this ruleset
  false_positive_note: "'request.auth != null' is NOT organization-scoped: any Firebase Auth user from\
    \ any Firebase project can authenticate (depending on sign-in method configuration) and access the\
    \ data. If the app allows anonymous sign-in (auth/anon enabled in Firebase Auth settings), then ANY\
    \ internet user can obtain a Firebase Auth token (even without an account) and satisfy the check \u2014\
    \ in that scenario emit ExposedToInternet, not just ExposedToTenant. Check whether anonymous sign-in\
    \ is enabled in Firebase Auth. If the rule includes a domain check such as 'request.auth.token.email.matches(\"\
    .*@company.com$\")' or a custom claim check, that is NOT a blanket exposure \u2014 do not emit this\
    \ rule. Only emit ExposedToTenant (not ExposedToInternet) for auth-required rules when anonymous sign-in\
    \ is confirmed DISABLED."
  narrative: Firestore database {database.name} is accessible to any Firebase Auth user (request.auth
    != null with no domain restriction). Firebase Auth accounts are freely creatable and not restricted
    to the organization. Any Firebase- authenticated user (including from other apps or organizations)
    can read and/or write documents matching the permissive rule paths.