백엔드 없는 정적 사이트 Q&A 보드: Firestore 보안 규칙과 Web Crypto SHA-256Serverless Static Site Q&A Board: Firestore Security Rules and Web Crypto SHA-256

// --- [1. 브라우저 Web Crypto API 기반 SHA-256 해시 생성] ---
async function sha256Hex(plainText) {
    const encoder = new TextEncoder();
    const data = encoder.encode(plainText);
    const hashBuffer = await crypto.subtle.digest('SHA-256', data);
    const hashArray = Array.from(new Uint8Array(hashBuffer));
    return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
}

// 댓글 문서 생성 페이로드 구성
async function submitComment(db, pageId, nickname, password, bodyText, turnstileToken) {
    if (!turnstileToken) throw new Error('봇 방지 인증을 완료해 주세요.');
    const passwordHash = await sha256Hex(password);

    await addDoc(collection(db, 'comments'), {
        pageId: pageId.slice(0, 200),
        nickname: nickname.trim().slice(0, 20),
        passwordHash: passwordHash, // 길이 64자의 16진수 문자열
        body: bodyText.trim().slice(0, 1000),
        createdAt: serverTimestamp() // request.time 과 일치 강제
    });
}

/* --- [2. Firestore Security Rules (firestore.rules)] ---
service cloud.firestore {
  match /databases/{database}/documents {
    match /comments/{commentId} {
      allow read: if true;
      allow create: if isValidComment();
      allow update, delete: if false;
    }
    function isValidComment() {
      let d = request.resource.data;
      let k = d.keys();
      return k.hasAll(['pageId', 'nickname', 'passwordHash', 'body', 'createdAt'])
        && k.hasOnly(['pageId', 'nickname', 'passwordHash', 'body', 'createdAt'])
        && d.pageId is string && d.pageId.size() > 0 && d.pageId.size() <= 200
        && d.nickname is string && d.nickname.size() > 0 && d.nickname.size() <= 20
        && d.passwordHash is string && d.passwordHash.size() == 64
        && d.body is string && d.body.size() > 0 && d.body.size() <= 1000
        && d.createdAt == request.time;
    }
  }
}
*/

// --- [1. Browser Web Crypto API SHA-256 Hash Generation] ---
async function sha256Hex(plainText) {
    const encoder = new TextEncoder();
    const data = encoder.encode(plainText);
    const hashBuffer = await crypto.subtle.digest('SHA-256', data);
    const hashArray = Array.from(new Uint8Array(hashBuffer));
    return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
}

// Construct and submit comment document payload
async function submitComment(db, pageId, nickname, password, bodyText, turnstileToken) {
    if (!turnstileToken) throw new Error('Please complete the bot verification check.');
    const passwordHash = await sha256Hex(password);

    await addDoc(collection(db, 'comments'), {
        pageId: pageId.slice(0, 200),
        nickname: nickname.trim().slice(0, 20),
        passwordHash: passwordHash, // Fixed 64-character hex string
        body: bodyText.trim().slice(0, 1000),
        createdAt: serverTimestamp() // Enforced to match request.time
    });
}

/* --- [2. Firestore Security Rules (firestore.rules)] ---
service cloud.firestore {
  match /databases/{database}/documents {
    match /comments/{commentId} {
      allow read: if true;
      allow create: if isValidComment();
      allow update, delete: if false;
    }
    function isValidComment() {
      let d = request.resource.data;
      let k = d.keys();
      return k.hasAll(['pageId', 'nickname', 'passwordHash', 'body', 'createdAt'])
        && k.hasOnly(['pageId', 'nickname', 'passwordHash', 'body', 'createdAt'])
        && d.pageId is string && d.pageId.size() > 0 && d.pageId.size() <= 200
        && d.nickname is string && d.nickname.size() > 0 && d.nickname.size() <= 20
        && d.passwordHash is string && d.passwordHash.size() == 64
        && d.body is string && d.body.size() > 0 && d.body.size() <= 1000
        && d.createdAt == request.time;
    }
  }
}
*/