parandum/firestore.rules

rules_version = '2';

service cloud.firestore {
  	match /databases/{database}/documents {
		function isSignedIn() {
			return request.auth != null;
		}

		function isAdmin() {
			return request.auth.token.admin == true;
		}

		function getGroupRole(groupId) {
			return get(/databases/$(database)/documents/users/$(request.auth.uid)/groups/$(groupId)).data.role;
		}
		
		function isSetOwner(setId) {
			return get(/databases/$(database)/documents/sets/$(setId)).data.owner == request.auth.uid;
		}
		
		function isPublicSet(setId) {
			return get(/databases/$(database)/documents/sets/$(setId)).data.public;
		}

		function verifyCreateFields(fields) {
			return request.resource.data.keys().hasAll(fields[0]) && request.resource.data.keys().hasOnly(fields[1]);
		}

		function verifyUpdateFields(fields) {
			let affectedKeys = request.resource.data.diff(resource.data).affectedKeys();
			return affectedKeys.hasAll([]) && affectedKeys.hasOnly(fields[1]);
		}

		function getRequestField(field, default_value) {
			return request.resource.data.get(field, default_value);
		}

		function verifyBoolType(field) {
			return getRequestField(field, true) is bool;
		}

		function verifyStringType(field) {
			return getRequestField(field, "") is string;
		}

		function verifyNullType(field) {
			return getRequestField(field, null) == null;
		}

		match /users/{userId} {
			function isSignedInUser() {
				return request.auth.uid == userId;
			}
			
			function verifyFieldTypes() {
				return verifyBoolType("sound") &&
					verifyStringType("theme");
			}

			function getPossibleFields() {
				let requiredFields = ["sound", "theme"];
				let optionalFields = [];
				let allFields = requiredFields.concat(optionalFields);
				return [requiredFields, allFields];
			}

			allow read: if isSignedIn() && isSignedInUser(); // is current user's data
			allow update: if isSignedIn() && isSignedInUser() && verifyUpdateFields(getPossibleFields()) && verifyFieldTypes();

			match /groups/{groupId} {
				function verifyGroupFieldTypes() {
					return getRequestField("role", "") == "member" ||
						getRequestField("role", "") == "contributor" ||
						getRequestField("role", "") == "owner";
				}

				function getPossibleGroupFields() {
					let requiredFields = ["role"];
					let optionalFields = [];
					let allFields = requiredFields.concat(optionalFields);
					return [requiredFields, allFields];
				}

				allow read, delete: if isSignedIn() && (isSignedInUser() || getGroupRole(groupId) == "owner" || isAdmin()); // is current user's data or is owner of group or is admin
				allow create: if isSignedIn() && isSignedInUser() && (getRequestField("role", "") == "member" || (isAdmin() && verifyGroupFieldTypes())) && verifyCreateFields(getPossibleGroupFields());
				allow update: if isSignedIn() && ((getGroupRole(groupId) == "owner" || isAdmin()) && verifyGroupFieldTypes()) && verifyUpdateFields(getPossibleGroupFields());
			}
		}

		match /groups/{groupId} {
			function verifyFieldTypes() {
				return verifyStringType("display_name");
			}

			function getPossibleFields() {
				let nonStaticFields = ["display_name"];
				let staticFields = ["join_code", "sets", "users"];

				let allFields = staticFields.concat(nonStaticFields);
				return [nonStaticFields, allFields];
			}

			function getPossibleUpdateFields() {
				let fields = getPossibleFields();
				return [[], fields[0]];
			}

			allow read: if isSignedIn() && (getGroupRole(groupId) != null || isAdmin());
			allow update: if isSignedIn() && (getGroupRole(groupId) == "owner" || isAdmin()) && verifyUpdateFields(getPossibleUpdateFields()) && verifyFieldTypes();
			allow delete: if isSignedIn() && (getGroupRole(groupId) == "owner" || isAdmin());
		}


		match /sets/{setId} {
			function verifyFieldTypes() {
				return verifyBoolType("public") &&
					verifyStringType("title") &&
					verifyStringType("owner") &&
					verifyNullType("groups");
			}

			function getPossibleFields() {
				let nonStaticFields = ["public", "title"];
				let staticFields = ["owner", "groups"];

				let allFields = staticFields.concat(nonStaticFields);
				return [nonStaticFields, allFields];
			}

			function getPossibleCreateFields() {
				let fields = getPossibleFields();
				return [fields[1], fields[1]];
			}

			function getPossibleUpdateFields() {
				let fields = getPossibleFields();
				return [[], fields[0]];
			}

			allow read, delete: if isSignedIn() && request.auth.uid == resource.data.owner;
			allow read: if isSignedIn() && resource.data.public;
			allow create: if isSignedIn() && request.auth.uid == request.resource.data.owner && verifyCreateFields(getPossibleCreateFields()) && verifyFieldTypes();
			allow update: if isSignedIn() && request.auth.uid == resource.data.owner && verifyUpdateFields(getPossibleUpdateFields()) && verifyFieldTypes();

			match /vocab/{vocabId} {
				function verifyVocabFieldTypes() {
					return verifyStringType("term") &&
						verifyStringType("sound") &&
						verifyStringType("definition");
				}

				function getPossibleVocabFields() {
					let requiredFields = ["term", "sound", "definition"];
					let optionalFields = [];
					let allFields = requiredFields.concat(optionalFields);
					return [requiredFields, allFields];
				}

				allow read, delete: if isSignedIn() && isSetOwner(setId);
				allow read: if isSignedIn() && isPublicSet(setId);
				allow create: if isSignedIn() && isSetOwner(setId) && verifyCreateFields(getPossibleVocabFields()) && verifyVocabFieldTypes();
				allow update: if isSignedIn() && isSetOwner(setId) && verifyUpdateFields(getPossibleVocabFields()) && verifyVocabFieldTypes();
			}
		}

		match /progress/{progressId} {
			function isProgressUser() {
				return get(/databases/$(database)/documents/progress/$(progressId)).data.uid == request.auth.uid;
			}

			function isLanguageSwitched() {
				return get(/databases/$(database)/documents/progress/$(progressId)).data.switch_language;
			}
			
			function isNotComplete() {
				return get(/databases/$(database)/documents/progress/$(progressId)).data.progress < get(/databases/$(database)/documents/progress/$(progressId)).data.questions.size();
			}

			allow read: if isSignedIn() && isProgressUser();
			allow delete: if isSignedIn() && isProgressUser() && isNotComplete();
			// NOTE: update and create disallowed as these are handled by Cloud Functions to ensure sound file Ids aren't altered to illegally access other files
			// NOTE: disallow start_time update

			match /terms/{vocabId} {
				allow read: if isSignedIn() && isProgressUser() && !(isLanguageSwitched());
				// NOTE: create handled by Cloud Functions
			}

			match /definitions/{vocabId} {
				allow read: if isSignedIn() && isProgressUser() && isLanguageSwitched();
				// NOTE: create handled by Cloud Functions
			}
		}
  	}
}