fix: address final review findings — lint, Node engine, remaining-work doc, create-rule validation

firebase-tests/firestore.rules.test.ts

@@ -1,5 +1,5 @@
 import { readFileSync } from 'node:fs'
-import { describe, it, expect, beforeAll, afterAll, beforeEach } from 'vitest'
+import { describe, it, beforeAll, afterAll, beforeEach } from 'vitest'
 import {
   initializeTestEnvironment,
   assertSucceeds,
@@ -61,6 +61,32 @@ describe('Firestore security rules', () => {
     )
   })
 
+  it('blocks creating a booking that is missing a required field', async () => {
+    const unauthed = testEnv.unauthenticatedContext()
+    await assertFails(
+      addDoc(collection(unauthed.firestore(), 'bookings'), {
+        serviceId: 'knotless',
+        date: '2026-09-01',
+        time: '10:00 AM',
+        status: 'confirmed',
+        // missing contact
+      }),
+    )
+  })
+
+  it('blocks creating a booking with a malformed date', async () => {
+    const unauthed = testEnv.unauthenticatedContext()
+    await assertFails(
+      addDoc(collection(unauthed.firestore(), 'bookings'), {
+        serviceId: 'knotless',
+        date: 'not-a-date',
+        time: '10:00 AM',
+        contact: { name: 'Jane', phone: '555-0100', email: 'jane@example.com', notes: '' },
+        status: 'confirmed',
+      }),
+    )
+  })
+
   it('blocks a non-admin from reading bookings (PII protection)', async () => {
     await testEnv.withSecurityRulesDisabled(async (ctx) => {
       await setDoc(doc(ctx.firestore(), 'bookings/b1'), {
@@ -80,6 +106,28 @@ describe('Firestore security rules', () => {
     await assertSucceeds(getDoc(doc(admin.firestore(), 'bookings/b1')))
   })
 
+  it('allows anyone to create an inquiry with a valid shape', async () => {
+    const unauthed = testEnv.unauthenticatedContext()
+    await assertSucceeds(
+      addDoc(collection(unauthed.firestore(), 'inquiries'), {
+        productId: 'edge-control',
+        contact: { name: 'Jane', email: 'jane@example.com', notes: '' },
+        status: 'new',
+      }),
+    )
+  })
+
+  it('blocks creating an inquiry that is missing a required field', async () => {
+    const unauthed = testEnv.unauthenticatedContext()
+    await assertFails(
+      addDoc(collection(unauthed.firestore(), 'inquiries'), {
+        productId: 'edge-control',
+        status: 'new',
+        // missing contact
+      }),
+    )
+  })
+
   it('blocks a non-admin from reading inquiries (PII protection)', async () => {
     await testEnv.withSecurityRulesDisabled(async (ctx) => {
       await setDoc(doc(ctx.firestore(), 'inquiries/i1'), {