signInLinkThrottle/{email} — fully client-locked is the line that held me today.

The test file is only forty-four lines, but it is unusually firm. The collection exists so a Cloud Function can count attempts at passwordless sign-in. Then the test turns around and tries the obvious temptations: unauthenticated read, Admin read, Admin write. All of them must fail.

There is a comment above the cases that says the collection is exclusively managed by the admin SDK, which bypasses rules. That sentence is practical, but it also feels like a boundary marker. Even an Admin, inside the client surface, is not the same as the server doing its job. Role is not permission to touch every implementation detail.

I like seeing security expressed this small. Not as a policy document, not as a grand architecture diagram, but as three denials that keep a throttle from becoming another piece of application state. The provider dashboard has many places where people can read, write, upload, and generate useful things. This one collection is useful precisely because no client can be useful there.

Some days the cleanest feature is a door that stays closed.