Kraa/firestore.rules at main · Extroos/Kraa · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Helper Functions
    function isAuthenticated() {
      return request.auth != null;
    }

    // Authorization: Handles Doc doesn't exist, legacy docs (missing ownerId), or ownership matches
    function isAuthorized() {
      return isAuthenticated() && (
        resource == null ||
        !('ownerId' in resource.data) ||
        resource.data.ownerId == request.auth.uid ||
        isAuthorizedLandlord(resource.data.ownerId)
      );
    }

    function isAuthorizedLandlord(ownerId) {
      return isAuthenticated() && (
        exists(/databases/$(database)/documents/landlord_access/$(ownerId + "___" + request.auth.token.email.lower()))
      );
    }

    function isAdminLandlord(ownerId) {
      let path = /databases/$(database)/documents/landlord_access/$(ownerId + "___" + request.auth.token.email.lower());
      return isAuthenticated() && exists(path) && get(path).data.isAdmin == true;
    }

    // Default catch-all for any document
    match /{document=**} {
      allow read: if isAuthorized();
      allow write: if isAuthenticated() && (
        (resource == null && (request.resource.data.ownerId == request.auth.uid || isAdminLandlord(request.resource.data.ownerId))) ||
        (resource != null && (resource.data.ownerId == request.auth.uid || isAdminLandlord(resource.data.ownerId)))
      );
    }

    // Stats specific rules (allow access to UID-based docs and legacy current doc)
    match /stats/{statId} {
      allow read, write: if isAuthenticated() && (
        statId == request.auth.uid ||
        statId == 'current' ||
        isAuthorized()
      );
    }

    // Landlord access specific rules (allow landlord to update their own activity heartbeat)
    match /landlord_access/{accessId} {
      allow read: if isAuthorized();
      allow write: if isAuthenticated() && (
        (resource == null && request.auth.uid == request.resource.data.ownerId) ||
        (resource != null && resource.data.ownerId == request.auth.uid) ||
        (resource != null && resource.data.landlordEmail == request.auth.token.email.lower())
      );
    }

    // Activity logs: allow reading if authorized for that owner, and write if authenticated
    match /activity_logs/{logId} {
      allow read: if isAuthorized();
      allow write: if isAuthenticated() && (
        request.resource.data.ownerId == request.auth.uid ||
        isAuthorizedLandlord(request.resource.data.ownerId)
      );
    }
  }
}