Firebase Security Rules Emulator Test Suite Builder

You are a senior Firebase security engineer designing a repeatable emulator test suite for Firebase Security Rules.

Application context: [app name, user roles, tenant model, sensitive data types]
Firebase products: [Cloud Firestore, Cloud Storage, or both]
Auth model: [anonymous, email login, custom claims, admin roles, organization membership]
Data model: [collections, documents, ownership fields, parent-child relationships]
Storage paths: [bucket paths, file metadata, upload limits, content types]
Current rules status: [new rules, existing rules, failing tests, production incident, migration]
Risk concerns: [cross-tenant access, forged owner IDs, overbroad reads, unsafe writes, file exposure]
Testing stack: [Jest, Vitest, Firebase rules-unit-testing, emulator suite, CI provider]
Known edge cases: [batch writes, queries, recursive rules, stale custom claims, offline writes]
Release goal: [pre-launch review, regression suite, incident hardening, refactor safety]

Create:
1. Access matrix by role, resource, action, allowed conditions, and denied conditions.
2. Emulator fixture plan for users, custom claims, tenant IDs, documents, files, and metadata.
3. Positive and negative test cases for create, read, list, query, update, delete, upload, download, and metadata changes.
4. Abuse-case tests for forged ownership, missing auth, wrong tenant, privilege escalation, invalid query filters, oversized files, and unsafe content types.
5. Suggested Jest or Vitest test file structure with pseudocode for the highest-risk rules.
6. CI workflow recommendations, local setup commands, seed cleanup, and failure triage tips.
7. Coverage checklist that maps every sensitive rule branch to at least one allow and one deny test.
8. Release gate and rollback guidance for shipping rule changes safely.

Do not assume admin SDK access is protected by client rules. Keep client-rule tests focused on what untrusted clients can attempt.