Friends feature: hardening & completion (plans A-D)#67
Merged
Conversation
Reviewed docs/friends_feature_plan.md against main: most of it is already implemented. This spec covers the remaining work — legacy name+PIN enforcement via the onboarding gate, Cloud Functions backend (PIN validation with rate limiting, game fan-out, social-graph writes), versioned Firestore rules, full blocking, profile page completion, and the game-over firebaseId overwrite fix. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ns only where required Per review feedback: keep Firebase's direct read/write/stream strengths for the social graph (secured by rules + deterministic request doc IDs) and setPin (client-side salted hash to an owner-only doc). Cloud Functions shrink to the four jobs rules cannot do: validatePin, searchByFriendCode block-hiding, onGameCreated fan-out, onUserDeleted cleanup. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…malformed targetUserId Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…yer customization Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Reorders _onSubmitted so setPin runs before updateUserProfile. Previously a setPin failure after a successful profile save left the user durably marked onboarded-with-PIN with no credentials doc, permanently locking them out of validatePin with nothing to re-prompt. Adds tests for the untouched-pin keep path and pins the new ordering with a regression test. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…tion, PIN dialog reset, deploy-order docs Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Also serializes the test:rules jest run (--runInBand): parallel workers racing against the shared Firestore emulator caused beforeEach's recursiveDelete in one suite to wipe data another suite's transaction was mid-read on, now that a third rules suite runs alongside it.
…g and linked badges
…C/D obligations from Plan B review
… l10n - Add firestore.indexes.json with COLLECTION_GROUP field overrides for friendList/blocks.userId; onUserDeleted's collection-group queries otherwise throw FAILED_PRECONDITION in production even though the emulator can't catch it (indexes unenforced there). Deploy order now starts with firestore:indexes. - Guard ProfileBloc._onSubmitted against saving a present-but-invalid username, which previously flipped isComplete false and bounced users into onboarding. - Localize the profile page's field/button labels (8 new keys, en+es) and drop the dead shareFriendCodeTooltip key. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… peer dep Cloud Build's clean npm install enforces peer dependency resolution strictly and failed with ERESOLVE (rules-unit-testing@4.0.1 requires firebase@^11, we had ^10.12.0 pinned). Dev-tooling only — the deployed function code never imports the client firebase SDK. Verified: build clean, unit suite 8/8, full emulator rules suite 55/55.
…iend-search crash
Replaces the tile-list friend picker with a searchable dropdown that also lists the account owner, and fixes the underlying rehydration bug where reopening an already-linked seat could silently drop or reassign the link. Also scopes two PIN dialog bug fixes (loading state, small- device keyboard overlap) surfaced while touching the same code. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…screens Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…alog The previous commit's small-screen test had been narrowed to a same-size, no-keyboard scrollable-flag check that passed trivially and no longer exercised the actual bug (Verify button unreachable once the keyboard covers the PIN dialog on a small screen). Restore the brief's original 375x667 + FakeViewPadding(bottom: 300) keyboard-inset scenario. Reordered the keyboard-inset simulation to happen after the dialog opens (matching the real sequence: dialog opens, user focuses the PIN field, then the OS keyboard slides in) rather than before the friend tile is even tapped, which was causing the tap to miss its target. CustomizePlayerPage's two-panel layout is a pre-existing landscape-style design that already overflows at phone widths in several unrelated widgets (TrackingPreview's two Rows, _FriendSection's header Row, CommanderSearchBar, and _FriendLinkRow once linked) - out of scope for this task, flagged separately for a follow-up fix. Added _expectOnlyKnownOverflow to drain and fingerprint exactly those known, pre-existing RenderFlex-overflow exceptions via WidgetTester.takeException(), so the test stays honest: it still fails loudly on any different, unexpected exception, while not being blocked by a bug this task doesn't own. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…nctions/FirebaseAuth Xcode 26.4's Swift 6.3 miscompiles async-let teardown in optimized builds, corrupting the Concurrency runtime's task-local stack inside HTTPSCallable.call() and any FirebaseAuth call — this was the real cause of the on-device friend-search crash, not the earlier-suspected IAM invoker gap. Forces SWIFT_OPTIMIZATION_LEVEL=-Onone on the FirebaseFunctions and FirebaseAuth pods until firebase-ios-sdk ships the upstream fix (firebase/firebase-ios-sdk#15974). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…riend codes Adds a block-aware searchByUsername callable so the search box now finds people by name (auto-detecting friend-code-shaped input to route to the existing exact-match search instead) — usernames aren't unique, so friend code remains the precise way to add a specific person. Fixes the confusion between username and friend code on the profile page: friend requests were denormalizing the Firebase Auth display name instead of the actual profile username, so a request could show a name that didn't match anything on the sender's own profile. SearchBloc now looks up the sender's real profile before creating a request, and friend code is shown consistently on every card where another user's identity appears (search results, friends list, friend requests, blocked users) since it's the only field that's actually guaranteed unique. Also drops the "YETI-" prefix from generated friend codes in favor of a plain random 8-character code — the prefix carried no information (every code had the same one), and a username-derived alternative was rejected since usernames are editable and would make the code go stale on rename. Existing users keep their already-issued YETI-XXXX codes; the search auto-detect and callable both still recognize the legacy shape. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…p reachability A re-reviewer empirically verified (isolated worktree, scrollable:true stripped from production code to reproduce the genuine pre-fix bug) that the previous small-screen test's full tap-through-to-dismissal flow still passed against the broken code: at Size(375, 667) with a 300px keyboard inset, the dialog's Material card fits comfortably either way in the widget-test harness, so tester.tap()/hit-testing never actually discriminated fixed-vs-broken at these parameters. Flutter's widget-test harness doesn't faithfully reproduce real on-device keyboard occlusion for button hit-testing here. Scoped the test down to what it can actually prove: dialog.scrollable == true is present once the dialog is open at a small screen size with a keyboard inset applied. Kept the small screen + FakeViewPadding setup as context for why scrollable matters, and a code comment explaining the scope decision and pointing to Task 6's manual on-device verification step for real reachability. Trimmed _expectOnlyKnownOverflow's usage to only the pre-existing overflow widgets that still fire in this shorter flow (_FriendLinkRow no longer applies, since the friend link no longer happens in this test). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…ed dropdown Replaces _FriendSection's tile list + Clear button with a single DropdownMenu<String?> (Not linked / Me / each friend, alphabetical, type-to-search). _FriendTile is deleted. Also sets requestFocusOnTap: true on the DropdownMenu — without it, DropdownMenu.canRequestFocus() defaults to false on iOS/Android (this app's primary platforms), which makes the internal TextField readOnly and silently disables type-to-search on a real device.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…into the name field Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ssion Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…on save Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…lidation Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ations Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…-only Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ions Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Completes and hardens the friends feature per the approved design (spec, plan index + deploy gates, as-shipped README). Built in four independently-reviewed plans:
firestore.rules; PIN hashes moved to owner-onlyusers/{uid}/private/credentials(salted, lazily migrated); rate-limited friends-onlyvalidatePincallable (5 fails → 15-min lockout).UserProfileModel.isComplete(legacy users complete name+PIN in the pre-filled wizard); server-side game fan-out (onGameCreatedtrigger) with cross-usermatcheswrites denied by rules; game-overfirebaseIdoverwrite bug fixed ("I'm not playing" option, linked badges, disowned-slot unlink).searchByFriendCodecallable, blocked-users screen); trigger injection hardening (gamescreate requires ownhostId).UserProfileModelwith PIN change (no old-PIN prompt) and friend-code copy;onUserDeletedcleanup trigger (+ required COLLECTION_GROUP indexes);includeIfNull: falseacross repository models; save-failure UX on game over; l10n sweep (en+es).Deployment is manual and ordered — full details in the INDEX:
firebase deploy --only firestore:indexes→ wait READY (the emulator cannot validate index requirements).firebase deploy --only functionsfirebase deploy --only firestore:rulesTesting
flutter analyze: 165 (net improved vs pre-branch baseline)Notes
🤖 Generated with Claude Code