feat: Implement Firestore security rules, add security headers, and update Next.js/React dependencies.

Author: Llewellyn500

app/globals.css

@@ -1,5 +1,5 @@
-@import "tailwindcss";
 @import url("https://cdnjs.cloudflare.com/ajax/libs/github-markdown-css/5.2.0/github-markdown-dark.min.css");
+@import "tailwindcss";
 
 iframe[aria-hidden="true"] {
   display: none !important;

bun.lockb

@@ -0,0 +1,43 @@
+rules_version = '2';
+
+service cloud.firestore {
+  match /databases/{database}/documents {
+    // Helper function to check if user is authenticated
+    function isAuthenticated() {
+      return request.auth != null;
+    }
+    
+    // Helper function to check if user has admin/super role
+    // NOTE: This assumes custom claims are set OR we check a user document.
+    // Since custom claims are better for security but require backend setup,
+    // we'll check the 'authors' collection for role as per the app's structure.
+    function isAdmin() {
+      return isAuthenticated() && 
+        exists(/databases/$(database)/documents/authors/$(request.auth.uid)) &&
+        (get(/databases/$(database)/documents/authors/$(request.auth.uid)).data.role in ['admin', 'super']);
+    }
+
+    // Default: Deny all
+    match /{document=**} {
+      allow read, write: if false;
+    }
+    
+    // Articles: Public read, Admin write
+    match /articles/{articleId} {
+      allow read: if true;
+      allow write: if isAdmin();
+    }
+    
+    // News: Public read, Admin write
+    match /news/{newsId} {
+      allow read: if true;
+      allow write: if isAdmin();
+    }
+    
+    // Authors/Team: Public read, Admin write (or self update - optional)
+    match /authors/{userId} {
+      allow read: if true;
+      allow write: if isAdmin() || (isAuthenticated() && request.auth.uid == userId);
+    }
+  }
+}

firestore.rules

@@ -35,6 +35,9 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
       try {
         const { userRole, lastAuthenticated } = JSON.parse(storedAuth)
         // Only use stored data if it's less than 1 hour old
+        // SECURITY NOTE: This is for UI responsiveness only. Backend rules must always verify auth token/claims.
+        // A knowledgeable user can modify localStorage to spoof 'admin' role in the Client UI, but 
+        // they will fail at the database level if rules are correct.
         if (lastAuthenticated && Date.now() - lastAuthenticated < 60 * 60 * 1000) {
           setAuthState((prev) => ({ ...prev, userRole }))
         }

lib/auth-context.tsx

@@ -1,7 +1,45 @@
 import type { NextConfig } from "next";
 
+
 const nextConfig: NextConfig = {
   /* config options here */
+  async headers() {
+    return [
+      {
+        source: '/:path*',
+        headers: [
+          {
+            key: 'X-DNS-Prefetch-Control',
+            value: 'on'
+          },
+          {
+            key: 'Strict-Transport-Security',
+            value: 'max-age=63072000; includeSubDomains; preload'
+          },
+          {
+            key: 'X-XSS-Protection',
+            value: '1; mode=block'
+          },
+          {
+            key: 'X-Frame-Options',
+            value: 'DENY' // Preventing clickjacking
+          },
+          {
+            key: 'X-Content-Type-Options',
+            value: 'nosniff'
+          },
+          {
+            key: 'Referrer-Policy',
+            value: 'strict-origin-when-cross-origin'
+          },
+          {
+             key: 'Permissions-Policy',
+             value: 'camera=(), microphone=(), geolocation=(), interest-cohort=()'
+          }
+        ],
+      },
+    ]
+  },
 };
 
 export default nextConfig;

next.config.ts

@@ -48,11 +48,11 @@
     "markdown-to-jsx": "^7.7.4",
     "marked": "^15.0.7",
     "msw": "^2.7.3",
-    "next": "15.2.1",
+    "next": "^16.1.1",
     "next-themes": "^0.4.6",
-    "react": "^19.0.0",
+    "react": "^19.2.3",
     "react-day-picker": "^9.6.5",
-    "react-dom": "^19.0.0",
+    "react-dom": "^19.2.3",
     "react-hook-form": "^7.55.0",
     "react-hot-toast": "^2.5.2",
     "react-icons": "^5.5.0",

package.json

@@ -1,7 +1,11 @@
 {
   "compilerOptions": {
     "target": "ES2017",
-    "lib": ["dom", "dom.iterable", "esnext"],
+    "lib": [
+      "dom",
+      "dom.iterable",
+      "esnext"
+    ],
     "allowJs": true,
     "skipLibCheck": true,
     "strict": true,
@@ -11,17 +15,27 @@
     "moduleResolution": "bundler",
     "resolveJsonModule": true,
     "isolatedModules": true,
-    "jsx": "preserve",
+    "jsx": "react-jsx",
     "incremental": true,
     "plugins": [
       {
         "name": "next"
       }
     ],
     "paths": {
-      "@/*": ["./*"]
+      "@/*": [
+        "./*"
+      ]
     }
   },
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
-  "exclude": ["node_modules"]
+  "include": [
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
 }