ccatcher/firestore.rules at main · planmarks/ccatcher · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    function signedIn() { return request.auth != null; }
    function isOwner(uid) { return signedIn() && request.auth.uid == uid; }


    match /users/{uid} {
      allow read: if signedIn();
      allow create: if isOwner(uid);
      allow update: if isOwner(uid)
        || (signedIn() &&
            request.resource.data.diff(resource.data).affectedKeys().hasOnly(['score']));
      allow delete: if isOwner(uid);
    }


    match /usernames/{name} {
      allow read: if true;
      allow create: if signedIn() && request.resource.data.uid == request.auth.uid;
      allow update: if signedIn() && resource.data.uid == request.auth.uid
                    && request.resource.data.uid == request.auth.uid;
      allow delete: if signedIn() && resource.data.uid == request.auth.uid;
    }


    match /cameras/{id} {
      allow read: if signedIn() &&
        (resource.data.visibility == 'public' ||
         resource.data.ownerId == request.auth.uid);
      allow create: if isOwner(request.resource.data.ownerId);
      allow update: if isOwner(resource.data.ownerId)
        || request.resource.data.diff(resource.data).affectedKeys()
             .hasOnly(['likes', 'dislikes']);
      allow delete: if isOwner(resource.data.ownerId)
        || resource.data.dislikes >= 10;

      // One vote per user, keyed by uid. You cannot vote on your own entry.
      match /votes/{voterUid} {
        allow read: if signedIn();
        allow write: if request.auth.uid == voterUid
          && get(/databases/$(database)/documents/cameras/$(id)).data.ownerId
             != request.auth.uid;
      }
    }


    match /teams/{id} {
      allow read: if signedIn();
      allow create: if signedIn()
        && request.resource.data.creatorId == request.auth.uid
        && request.auth.uid in request.resource.data.admins;
      allow update: if signedIn() && (
        request.auth.uid in resource.data.admins
        || (
          request.resource.data.name == resource.data.name
          && request.resource.data.admins == resource.data.admins
          && (
            request.auth.uid in resource.data.members
            || request.auth.uid in request.resource.data.members
          )
        )
      );
      allow delete: if signedIn() && request.auth.uid in resource.data.admins;
    }


    match /teamInvites/{id} {
      allow read: if signedIn() &&
        (resource.data.invitedUid == request.auth.uid ||
         resource.data.invitedByUid == request.auth.uid);
      allow create: if signedIn() &&
        request.resource.data.invitedByUid == request.auth.uid;
      allow update: if signedIn() &&
        resource.data.invitedUid == request.auth.uid;
    }
  }
}