Worklog/firestore.rules at main · Aydan-A/Worklog · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function isSignedIn() {
      return request.auth != null;
    }

    function isOwner(userId) {
      return isSignedIn() && request.auth.uid == userId;
    }

    function isValidUserDocument(data) {
      return data.keys().hasOnly([
               'fullName',
               'email',
               'phone',
               'timezone',
               'language',
               'updatedAt'
             ]) &&
             (!data.keys().hasAny(['fullName']) || data.fullName is string) &&
             (!data.keys().hasAny(['email']) || data.email is string) &&
             (!data.keys().hasAny(['phone']) || data.phone is string) &&
             (!data.keys().hasAny(['timezone']) || data.timezone is string) &&
             (!data.keys().hasAny(['language']) || data.language is string) &&
             (!data.keys().hasAny(['updatedAt']) || data.updatedAt is string);
    }

    function isValidEntry() {
      return request.resource.data.keys().hasOnly([
               'date',
               'startTime',
               'endTime',
               'hours',
               'projectId',
               'projectName',
               'isRemote',
               'note',
               'createdAt',
               'updatedAt'
             ]) &&
             request.resource.data.keys().hasAll([
               'date',
               'startTime',
               'endTime',
               'hours',
               'projectId',
               'projectName',
               'isRemote',
               'updatedAt'
             ]) &&
             request.resource.data.date is string &&
             request.resource.data.date.matches('^\\d{4}-\\d{2}-\\d{2}$') &&
             request.resource.data.startTime is string &&
             request.resource.data.startTime.matches('^\\d{2}:\\d{2}$') &&
             request.resource.data.endTime is string &&
             request.resource.data.endTime.matches('^\\d{2}:\\d{2}$') &&
             request.resource.data.hours is number &&
             request.resource.data.hours > 0 &&
             request.resource.data.hours <= 24 &&
             request.resource.data.projectId is string &&
             request.resource.data.projectName is string &&
             request.resource.data.isRemote is bool &&
             (!request.resource.data.keys().hasAny(['note']) || request.resource.data.note is string) &&
             (!request.resource.data.keys().hasAny(['createdAt']) || request.resource.data.createdAt is string) &&
             request.resource.data.updatedAt is string;
    }

    function isValidProject() {
      return request.resource.data.keys().hasOnly([
               'name',
               'color',
               'archived',
               'createdAt',
               'updatedAt'
             ]) &&
             request.resource.data.keys().hasAll([
               'name',
               'archived',
               'updatedAt'
             ]) &&
             request.resource.data.name is string &&
             request.resource.data.name.size() > 0 &&
             request.resource.data.name.size() <= 60 &&
             (!request.resource.data.keys().hasAny(['color']) || request.resource.data.color == null || request.resource.data.color is string) &&
             request.resource.data.archived is bool &&
             (!request.resource.data.keys().hasAny(['createdAt']) || request.resource.data.createdAt is string) &&
             request.resource.data.updatedAt is string;
    }

    match /users/{userId} {
      allow read: if isSignedIn();
      allow create: if isOwner(userId) && isValidUserDocument(request.resource.data);
      allow update: if isOwner(userId) && isValidUserDocument(request.resource.data);

      match /entries/{entryId} {
        allow read, delete: if isOwner(userId);
        allow create, update: if isOwner(userId) && isValidEntry();
      }

      match /projects/{projectId} {
        allow read, delete: if isOwner(userId);
        allow create, update: if isOwner(userId) && isValidProject();
      }
    }

    match /{document=**} {
      allow read, write: if false;
    }
  }
}