fix: harden backend security — CORS, error handling, Firestore rules

Backend/server.js:
- Replace permissive cors() with origin whitelist (CORS_ALLOWED_ORIGINS
  env var, defaults to localhost dev ports)
- Add JSON body size limit (1 MB) to prevent large-payload attacks
- Add security headers (X-Content-Type-Options, X-Frame-Options,
  X-XSS-Protection) and strip X-Powered-By
- Add /health endpoint for monitoring
- Add 404 catch-all and global error handler that hides stack traces
  in production

Backend/firebase.js:
- Fail fast with a clear error message when required Firebase Admin
  environment variables are missing (instead of silently initializing
  with a dummy project)

Backend/middleware/verifyToken.js:
- Add empty-token guard
- Log token verification failure codes for debugging without leaking
  sensitive information

firestore.rules:
- Replace catch-all "any authenticated user can read/write anything"
  rule with per-collection rules enforcing ownership (users can only
  write their own profile, spots/ratings/groups respect createdBy/
  ownerId fields)
- Default deny for any uncovered paths

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: parsa-faraji

Backend/firebase.js

@@ -1,19 +1,33 @@
 const admin = require('firebase-admin');
 require('dotenv').config();
 
-if (process.env.FIREBASE_PRIVATE_KEY) {
-  admin.initializeApp({
-    credential: admin.credential.cert({
-      projectId: process.env.FIREBASE_PROJECT_ID,
-      privateKey: process.env.FIREBASE_PRIVATE_KEY.replace(/\\n/g, '\n'),
-      clientEmail: process.env.FIREBASE_CLIENT_EMAIL,
-    }),
-  });
-} else {
-  console.warn('FIREBASE_PRIVATE_KEY is missing. Firebase Admin SDK not initialized.');
-  // Initialize with dummy config just to prevent crashes if it's used elsewhere
-  admin.initializeApp({ projectId: 'dummy-project' });
+// ---------------------------------------------------------------------------
+// Firebase Admin SDK initialization
+// ---------------------------------------------------------------------------
+const requiredVars = [
+  'FIREBASE_PROJECT_ID',
+  'FIREBASE_PRIVATE_KEY',
+  'FIREBASE_CLIENT_EMAIL',
+];
+
+const missing = requiredVars.filter((v) => !process.env[v]);
+
+if (missing.length > 0) {
+  console.error(
+    `[firebase] Missing required environment variables: ${missing.join(', ')}\n` +
+    'See Backend/.env.example for the full list of required variables.'
+  );
+  process.exit(1);
 }
 
+admin.initializeApp({
+  credential: admin.credential.cert({
+    projectId: process.env.FIREBASE_PROJECT_ID,
+    privateKey: process.env.FIREBASE_PRIVATE_KEY.replace(/\\n/g, '\n'),
+    clientEmail: process.env.FIREBASE_CLIENT_EMAIL,
+  }),
+});
+
 const db = admin.firestore();
+
 module.exports = { admin, db };

Backend/middleware/verifyToken.js

@@ -1,19 +1,29 @@
 const { admin } = require('../firebase');
 
+/**
+ * Express middleware that verifies a Firebase ID token from the
+ * Authorization header. On success, attaches the decoded token to
+ * `req.user` so downstream handlers can access `req.user.uid`.
+ */
 const verifyToken = async (req, res, next) => {
   const authHeader = req.headers.authorization;
 
   if (!authHeader || !authHeader.startsWith('Bearer ')) {
-    return res.status(401).json({ error: 'No token provided' });
+    return res.status(401).json({ error: 'Missing or malformed Authorization header' });
   }
 
   const token = authHeader.split('Bearer ')[1];
 
+  if (!token || token.length === 0) {
+    return res.status(401).json({ error: 'Token is empty' });
+  }
+
   try {
     const decodedToken = await admin.auth().verifyIdToken(token);
-    req.user = decodedToken; // now any route can access req.user.uid
+    req.user = decodedToken;
     next();
   } catch (err) {
+    console.error('[verifyToken] Token verification failed:', err.code || err.message);
     return res.status(401).json({ error: 'Invalid or expired token' });
   }
 };

Backend/server.js

@@ -1,20 +1,92 @@
 const express = require('express');
 const cors = require('cors');
 const verifyToken = require('./middleware/verifyToken');
+require('dotenv').config();
 
 const app = express();
-app.use(cors());
-app.use(express.json());
 
-// A protected route
+// ---------------------------------------------------------------------------
+// Security: Restrict CORS to known origins in production
+// ---------------------------------------------------------------------------
+const allowedOrigins = process.env.CORS_ALLOWED_ORIGINS
+  ? process.env.CORS_ALLOWED_ORIGINS.split(',').map((o) => o.trim())
+  : ['http://localhost:5173', 'http://localhost:3000'];
+
+app.use(
+  cors({
+    origin(origin, callback) {
+      // Allow requests with no origin (e.g. server-to-server, curl)
+      if (!origin || allowedOrigins.includes(origin)) {
+        callback(null, true);
+      } else {
+        callback(new Error(`CORS: origin ${origin} not allowed`));
+      }
+    },
+    methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
+    allowedHeaders: ['Content-Type', 'Authorization'],
+    credentials: true,
+  })
+);
+
+// ---------------------------------------------------------------------------
+// Body parsing with size limit to prevent large-payload attacks
+// ---------------------------------------------------------------------------
+app.use(express.json({ limit: '1mb' }));
+
+// ---------------------------------------------------------------------------
+// Security headers
+// ---------------------------------------------------------------------------
+app.use((_req, res, next) => {
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+  res.setHeader('X-Frame-Options', 'DENY');
+  res.setHeader('X-XSS-Protection', '1; mode=block');
+  res.removeHeader('X-Powered-By');
+  next();
+});
+
+// ---------------------------------------------------------------------------
+// Health check (public)
+// ---------------------------------------------------------------------------
+app.get('/', (_req, res) => {
+  res.json({ status: 'ok', timestamp: new Date().toISOString() });
+});
+
+app.get('/health', (_req, res) => {
+  res.json({ status: 'ok', timestamp: new Date().toISOString() });
+});
+
+// ---------------------------------------------------------------------------
+// Protected routes
+// ---------------------------------------------------------------------------
 app.get('/profile', verifyToken, (req, res) => {
   res.json({ message: `Hello user ${req.user.uid}` });
 });
 
-// Another public route just to test
-app.get('/', (req, res) => {
-  res.send('Backend is running!');
+// ---------------------------------------------------------------------------
+// 404 handler
+// ---------------------------------------------------------------------------
+app.use((_req, res) => {
+  res.status(404).json({ error: 'Route not found' });
 });
 
+// ---------------------------------------------------------------------------
+// Global error handler
+// ---------------------------------------------------------------------------
+app.use((err, _req, res, _next) => {
+  console.error('Unhandled error:', err.message);
+  const status = err.status || 500;
+  res.status(status).json({
+    error:
+      process.env.NODE_ENV === 'production'
+        ? 'Internal server error'
+        : err.message,
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Start server
+// ---------------------------------------------------------------------------
 const PORT = process.env.PORT || 5000;
-app.listen(PORT, () => console.log(`Server running on port ${PORT}`));
+app.listen(PORT, () => {
+  console.log(`Server running on port ${PORT} (${process.env.NODE_ENV || 'development'})`);
+});

firestore.rules

@@ -5,9 +5,45 @@ service cloud.firestore {
       return request.auth != null;
     }
 
-    // Start locked down. Expand these rules as your data model is added.
+    function isOwner(userId) {
+      return isSignedIn() && request.auth.uid == userId;
+    }
+
+    // Users: owners can read/write their own profile; others cannot
+    match /users/{userId} {
+      allow read: if isSignedIn();
+      allow create: if isOwner(userId);
+      allow update, delete: if isOwner(userId);
+    }
+
+    // Study spots: any authenticated user can read; writes restricted
+    match /spots/{spotId} {
+      allow read: if isSignedIn();
+      allow create: if isSignedIn();
+      allow update, delete: if isSignedIn()
+        && resource.data.createdBy == request.auth.uid;
+    }
+
+    // Ratings: authenticated users can read all; write only their own
+    match /ratings/{ratingId} {
+      allow read: if isSignedIn();
+      allow create: if isSignedIn()
+        && request.resource.data.userId == request.auth.uid;
+      allow update, delete: if isSignedIn()
+        && resource.data.userId == request.auth.uid;
+    }
+
+    // Study groups: authenticated users can read; owner manages
+    match /groups/{groupId} {
+      allow read: if isSignedIn();
+      allow create: if isSignedIn();
+      allow update, delete: if isSignedIn()
+        && resource.data.ownerId == request.auth.uid;
+    }
+
+    // Deny everything else by default
     match /{document=**} {
-      allow read, write: if isSignedIn();
+      allow read, write: if false;
     }
   }
 }