Revival: secure, deployable, and maintainable again (waves 1–4)

[epodol]

Vibe: https://youtu.be/QWIcz3ab358 🎶

Revives the project after ~3 years of dormancy. The audited plan lives in changelog/2026-07-04-revival-roadmap.md; this PR is the single integration branch for all of it. Kept as a draft until the waves below land.

Why

• Deploys were broken: Cloud Functions pinned Node 16, a decommissioned GCF runtime, so every release failed.
• The AI feature was dead in prod: all OpenAI-backed functions called shut-down models/endpoints (Datamuse fallback kept idea generation limping).
• A confirmed Firestore rules vulnerability: any public map — including view-only — can be modified, and ownership can be taken over, by any request that includes permissions.canPublicEdit: true in its payload.
• 113 root + 36 functions npm audit findings, almost all via dead react-scripts.

Landed so far

• Merge release-0.2.0 (CRA → Vite); react-scripts fully gone
• Node 24 everywhere (functions engines, CI, .nvmrc, CONTRIBUTING)
• CI/CD modernization: actions/*@v4, archived/unpinned actions replaced, deploys via firebase-tools directly
• Dependency overhaul: firebase-functions 7 + firebase-admin 13, TS 5.9, Vite 8 / Vitest 4, react-router-dom 7, react-zoom-pan-pinch back on upstream v4 (MUI and React went to 5.18/18.3 here, then to 9/19 in Wave 3)
• Dead code removed: ai.ts, gpt3_parent.ts, cowsay, dotenv, peer-override blocks
• Audit baseline: root 113 → 18, functions 36 → 15; after Wave 3's firebase 12 bump the root is at 11, all transitive through dev-only firebase-tools (rest are deliberate holds, see roadmap)
• Repo hygiene: 24 stale snyk-* branches deleted; backlog triaged into [SECURITY] Firestore rules: public maps can be hijacked — fix update/create rules and add rules unit tests #188–Local/session undo for the mind-map editor #198

Wave 1 — security & unblockers (done)

• [SECURITY] Firestore rules: public maps can be hijacked — fix update/create rules and add rules unit tests #188 Firestore rules fix + 22 rules unit tests (privilege escalation on public maps; tests run in CI via the emulator)
• .env hygiene: untrack .env, add .env.example, verify API key restrictions #189 .env hygiene: .env untracked/gitignored, real (public, client-visible) values live in .env.example, CD/preview workflows copy it before building
• Replace react-hotkeys with react-hotkeys-hook or plain keydown handlers #192 Replaced dead react-hotkeys with react-hotkeys-hook 5; bindings centralized in src/pages/MindMap/keybindings.ts (should close GENERATE_IDEAS & TOGGLE_SIDE_MENU Broken #147 — pending manual verification)
• Service worker: finish the vite-plugin-pwa port or remove PWA support #194 Service worker: kept PWA, configured vite-plugin-pwa (autoUpdate + manifest), deleted the CRA-era public/service-worker.js / src/serviceWorker.js / offline.html; old registration is replaced at the same scope and its orphaned cache is cleaned up
• Cherry-pick assessment: nothing to pick. The 145 delete-confirmation fix already landed on main via Manage MindMaps UI Improvements #146 (ID-scoped dialog state), and no-logout-if-no-account was superseded by Auth Improvements #152's anonymous-user handling a week later; 334a91b on the 145 branch would actually regress the permissions schema. Both stale branches can be deleted.
• Bonus: fixed the Home page logo (process.env.PUBLIC_URL is undefined under Vite)

Wave 2 — write model & AI (done)

• Data integrity: random node IDs and a safe write model (transactions or subcollection) #195 Write model (620f362): crypto.randomUUID() node IDs; all node ops go through a single runTransaction wrapper (read fresh doc → pure transform → write back), killing the arrayRemove/arrayUnion duplicate/resurrection failure modes. Pure helpers + normalizeNodes() (legacy numeric-ID coercion) in src/nodeOps.ts; 16 unit tests + 3 rules tests locking in the transaction write shape. Unblocks Local/session undo for the mind-map editor #198 undo (its natural unit: one committed transaction).
• Convert gpt3 function to Groq chat completions (single shared key) #190 Groq swap (36d439d): gpt3.ts now calls Groq's OpenAI-compatible chat endpoint via plain fetch (llama-3.1-8b-instant); openai@3 deleted. Any failure (missing key, quota, API error) logs and returns [] so the panel degrades to Datamuse. Callable keeps its deployed name gpt3; not live until a human sets the GROQ_API_KEY secret (checklist below).

Wave 3 — remaining stack risk (done)

• Replace reactfire with custom hooks and upgrade firebase SDK 9 -> 12 #191 (d0597dd) reactfire (dead since 2023) removed → src/firebase/ module: singleton SDK init + the handful of hooks the app uses (useUser/useSigninCheck over one onIdTokenChanged subscription; Firestore doc/collection hooks over onSnapshot with queryEqual-stable resubscription). firebase 9 → 12, @firebase/rules-unit-testing 2 → 5 (lockfile regenerated). Riders: unused Storage/Remote Config inits + remoteconfig.template.json deleted; MindMap rules-of-hooks bug fixed via loader/LoadedMindMap split — missing/denied docs now show the friendly error instead of a raw TypeError.
• Evaluate and migrate MUI 5 -> latest major #193 (1630982) MUI 5 → 9 + React 18.3 → 19.2 bundled. Go decision: MUI skipped v8, and v9 still defaults to emotion (pigment-css optional) with React 19 support, so we took the latest major directly. @mui/codemod deprecations/all + manual fixes (Menu PaperProps, InputBase inputProps, nine legacy Grid item xs/sm → size); React 19 needed one code change (useRef initial value).

Wave 4 — product (done)

• Export mind maps as PNG, SVG, and Markdown outline #197 (c0ceaf7) PNG/SVG/Markdown export from a new menu in the map bottom bar. SVG clones the live canvas element and crops to the full map via getBBox() (not just the viewport), inlining background/font so the file stands alone; PNG rasterizes that SVG at 2x (capped 4096px); Markdown walks the tree into an indented outline with cycle protection and orphan recovery. Read-only — works on view-only maps.
• Local/session undo for the mind-map editor #198 (3e171af) Session-local undo on Ctrl/Cmd+Z. Each committed transaction records a per-node before/after diff onto an in-memory stack (max 100, cleared on refresh); undo inverts one entry in a new transaction, and every piece applies only if the node still matches the state the recorded op left it in — newer remote edits win, conflicted pieces are skipped, never resurrected. No redo. Documented in the help dialog.
• Privacy policy page and site footer #196 (4791c69) /privacy page + site footer. Policy drafted from the live data inventory (auth incl. auto-created anonymous guests, Firestore content/edit history, Groq + Datamuse suggestion calls, Analytics/Perf, App Check reCAPTCHA v3, COPPA posture). Footer (privacy/GitHub/contact/award) on every Navigation route, deliberately absent on the map canvas. Policy text is a DRAFT — see checklist.

All four waves have landed. What remains before un-drafting is the human-only checklist below.

Human-only checklist (not automatable from this branch)

• Manual click-through of the canvas (pan/zoom/drag/hotkeys) after the zoom-fork migration — now also covers the Wave 3 visual pass (all routes on MUI 9 + React 19: theme toggle, dialogs, Account grids; post-reactfire auth/data flows: anonymous sign-in, claim-account snackbar, list loading states) and Wave 4: the three export formats on a real map, undo across add/edit/delete incl. a two-tab conflict check, footer present on marketing routes / absent on the canvas
• Create a Groq API key and run npx firebase-tools functions:secrets:set GROQ_API_KEY (then OPENAI_SECRET can be destroyed)
• Firebase console: verify App Check enforcement is ON for Firestore + API-key HTTP-referrer restrictions on both projects
• Read and edit the privacy policy draft (src/pages/PrivacyPolicy/index.tsx) — it makes operational commitments (deletion requests via support@bubblemap.app, anonymous-account cleanup, COPPA handling) a human must stand behind; counsel review if being careful. Record the review here before un-drafting.
• Firebase console: enable auto-deletion of stale anonymous accounts (Authentication → Settings → User account management) — the policy draft now promises it

🤖 Generated with Claude Code

[github-actions]

Visit the preview URL for this PR (updated for commit 1ff7df2):

https://mind-map-testing--pr199-revival-2m3jalm0.web.app

_{(expires Tue, 14 Jul 2026 04:43:27 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: 37740e843bbe4e42b860dff5fdcfb0718403cafd}

[SpiritSeal]

Oh boy

[SpiritSeal]

Few things:

• Let's add tests across all of this code we are adding. Generally, I'm hoping for ~80% code coverage on business logic and >70% coverage on UI and everything else. Use techniques like dependency injection to model for nondeterministic components like the LLM functions.
• I see that we are changing some of the GCP products we are using. Could I get an updated cost analysis?
• Let's talk about deleting stale anon accounts. Do we really want to do this for now? It's not really costing us anything to keep them at our current scale. I'm probably fine with the code we have written for it (haven't read it yet), but may be worth && falseing it for now until we have a business need to activate it
• Could we have an updated live preview URL for these changes
• Let's have an LLM do a rudimentary security model and security analysis of our app and make sure there aren't any gaping holes (post results mb in changelog or new similarly styled dir?). Would p also be worth adding a SECURITY.md and security policy to bubblemap in case a security researcher finds something and would like to disclose it.
• Generally going forward, let's try to keep 1 PR as 1 atomic reviewable unit of code (i.e. 1 new feature)