firestore.TEMPLATE.rules

//When you update this file, also run 'npm run test:security' to verify all tests pass
rules_version = '2'
service cloud.firestore {
  match /databases/{database}/documents {

    function userMatchesDomain() {
      //inject here:domain
      return loggedIn() && !isAnonymous() && request.auth.token.email.lower().split('@')[1] == domain;
    }

    function userTypeAllComposedPermissions() {
      //inject here:all
      return rules;
    }

    function userTypeAnonymousComposedPermissions() {
      //inject here:anonymous
      //Should return if the user is AT LEAST anonymous
      return rules;
    }

    function userTypeSignedInComposedPermissions() {
      //inject here:signed_in
      return rules;
    }

    function userTypeSignedInDomainComposedPermissions() {
      //inject here:signed_in_domain
      return rules;
    }

    function userTypePermissions() {
      //Returns the highest userType permission (they're all composed)
      return userMatchesDomain() ? userTypeSignedInDomainComposedPermissions() : loggedIn() && !isAnonymous() ? userTypeSignedInComposedPermissions() : loggedIn() ? userTypeAnonymousComposedPermissions() : userTypeAllComposedPermissions();
    }

    function userPermissions() {
      return (request.auth != null && request.auth.uid != null && exists(/databases/$(database)/documents/permissions/$(request.auth.uid))) ? get(/databases/$(database)/documents/permissions/$(request.auth.uid)).data : {};
    }

    function getPermissions(keys) {
      //we can convert to a set because we disallow userTypePermissions to mark
      //negative keys, and also do the same (in client side checks, at least,
      //for permissions on user object)
      let mergedSet = userPermissions().keys().toSet().union(userTypePermissions().keys().toSet());
      return mergedSet.hasAny(keys);
    }

    function getPermission(key) {
      return getPermissions([key])
    }

    function userIsAdmin() {
      //don't do the whole transform of getPermission, because admin is so sensitive that it should only be 
      //able to be set per user, and getPermission is really expensive to run twice
      return userPermissions().get('admin', false);
    }

    function userMayViewApp() {
      return userIsAdmin() || getPermission('viewApp');
    }
    
    function userMayViewUnpublished() {
      return loggedIn() && userIsAdmin() || getPermissions(['edit', 'editCard', 'viewUnpublished']) || request.auth.uid in resource.data.permissions.editCard || request.auth.uid == resource.data.author;
    }

    function userMayEditPermissions() {
      //For now we don'b bother having an editPermissions permission, but factor this out so it's easier to add later if necessary
      return userIsAdmin();
    }

    function userMayEditCard(cardID) {
      return userIsAdmin() || getPermissions(['edit', 'editCard']) || userIsAuthorOrEditorForCard(cardID);
    }

    function userIsAuthorOrEditorForCard(cardID) {
      //This rule might be called in the context of a card, or in the context of a card update, where it needs to be fetched
      //TODO: use request.resource.data if it's in the former context
      let card = get(/databases/$(database)/documents/cards/$(cardID)).data;
      let uid = request.auth.uid;
      return uid == card.author || uid in card.permissions.editCard;
    }

    function userMayEditSection(sectionID) {
      return userIsAdmin() || getPermissions(['edit', 'editSection']);
    }

    function userMayEditTag(tagID) {
      return userIsAdmin() || getPermissions(['edit', 'editTag']);
    }

    function userMayCreateCard() {
      return userIsAdmin() || getPermissions(['edit','createCard']);
    }

    function userMayComment() {
      return userIsAdmin() || getPermission('comment');
    }

    function userMayStar() {
      return userIsAdmin() || getPermission('star');
    }

    function userMayMarkRead() {
      return userIsAdmin() || getPermission('markRead');
    }

    function userMayModifyReadingList() {
      return userIsAdmin() || getPermission('modifyReadingList');
    }

    function editDoesNotAffectAdminKey() {
      return !request.resource.data.diff(resource == null || resource.data == null ? {} : resource.data).affectedKeys().hasAny(['admin']);
    }

    function editOnlyUpdatesTimestamp(key) {
      let requestData = request.resource.data;
      return requestData.diff(resource.data).affectedKeys().hasOnly([key]) && requestData[key] == request.time;
    }

    function editOnlyIncrementsAndUpdatesTimestamp(incrementKey, timestampKey) {
      let requestData = request.resource.data;
      let resourceData = resource.data;
      return requestData.diff(resourceData).affectedKeys().hasOnly([incrementKey, timestampKey]) && requestData[timestampKey] == request.time && resourceData[incrementKey] + 1 == requestData[incrementKey]
    }

    function editOnlyAddsMessage() {
      let requestData = request.resource.data;
      let requestMessages = requestData.messages;
      let resourceMessages = resource.data.messages;
      return requestData.diff(resource.data).affectedKeys().hasOnly(['messages', 'updated']) && requestMessages.size() == resourceMessages.size() + 1 && requestMessages[0:resourceMessages.size()] == resourceMessages;
    }
        
    function editOnlyIncrements(key) {
      let requestData = request.resource.data;
      let resourceData = resource.data;
      return requestData.diff(resourceData).affectedKeys().hasOnly([key]) && resourceData[key] + 1 == requestData[key];
    }
    
    function editOnlyIncrementsOrDecrements(key, otherKey) {
      let requestData = request.resource.data;
      let resourceData = resource.data;
      let resourceDataKey = resourceData[key];
      let requestDataKey = requestData[key];
      let resourceDataOtherKey = resourceData[otherKey];
      let requestDataOtherKey = requestData[otherKey];
      return requestData.diff(resourceData).affectedKeys().hasOnly([key, otherKey]) && (resourceDataKey + 1 == requestDataKey || resourceDataKey - 1 == requestDataKey) && (resourceDataOtherKey + 1 == requestDataOtherKey || resourceDataOtherKey - 1 == requestDataOtherKey);
     }
    
    function editOnlyIncrementsAndDecrements(incKey, decKey) {
      let requestData = request.resource.data;
      let resourceData = resource.data;
      return requestData.diff(resourceData).affectedKeys().hasOnly([incKey, decKey]) && resourceData[decKey] - 1 == requestData[decKey] && resourceData[incKey] + 1 == requestData[incKey];
    }

    function cardEditInboundReferences() {
      let affectedKeys = request.resource.data.diff(resource.data).affectedKeys();
      let allKeys = ['references_inbound', 'references_info_inbound'];
      //TODO: for each modifiedCardID, verify userMayEditCard. There is no way
      //to access keys by index in the set, or to loop currently which will mean
      //it would always be hacky.

      //let modifiedCardIDs = request.resource.data.get('references_inbound', {}).diff(resource.data.get('references_inbound', {})).changedKeys();
      return (resource.data.published || userMayViewUnpublished()) && affectedKeys.hasOnly(allKeys) && affectedKeys.hasAny(allKeys);
    }

    function cardEditMinor() {
      let affectedKeys = request.resource.data.diff(resource.data).affectedKeys();
      //we can bail only if there are any keys not in this set, or if they aren't any keys in this set, without doing the more expensive calculations.
      let allKeys = ['star_count', 'star_count_manual', 'thread_count', 'thread_resolved_count', 'thread_count', 'updated_message'];
      return affectedKeys.hasOnly(allKeys) && affectedKeys.hasAny(allKeys) && cardEditLegalMessages(affectedKeys) || cardEditLegalStars(affectedKeys);
    }

    function cardEditLegalMessages(affectedKeys) {
      //TODO: pass in the affectedKeys into the children to save another calculation
      return userMayComment() && (editOnlyIncrements('thread_count') || editOnlyIncrementsAndDecrements('thread_resolved_count', 'thread_count') || editOnlyUpdatesTimestamp('updated_message') || editOnlyIncrementsAndUpdatesTimestamp('thread_count', 'updated_message'));
    }

    function cardEditLegalStars(affectedKeys) {
      //TODO: pass in the affectedKeys into the children to save another calculation
      return userMayStar() && editOnlyIncrementsOrDecrements('star_count', 'star_count_manual');
    }
    
    function loggedIn() {
      return request.auth != null && request.auth.uid != null;
    }

    function isAnonymous() {
      return request.auth != null && request.auth.token != null && request.auth.token.firebase != null && request.auth.token.firebase.sign_in_provider == 'anonymous';
    }
    
    function createIsOwner() {
      return loggedIn() && request.auth.uid == request.resource.data.owner;
    }
    
    function createIsAuthor() {
      return loggedIn() && request.auth.uid == request.resource.data.author;
    }
    
    function updateIsOwner() {
      return loggedIn() && request.auth.uid == resource.data.owner;
    }
    
    function updateIsAuthor() {
      return loggedIn() && request.auth.uid == resource.data.author;
    }

    match /permissions/{user} {
      allow read: if request.auth.uid == user || userMayEditPermissions();
      allow write: if userMayEditPermissions() && editDoesNotAffectAdminKey();
      allow delete: if userMayEditPermissions()
    }

    match /sections/{section} {
      allow read: if userMayViewApp();
      allow write: if userMayEditSection(section);

      match /updates/{update} {
        allow read, write: if userMayEditSection(section);
      }
    }

    match /tags/{tag} {
      allow read: if userMayViewApp();
      allow write: if userMayEditTag(tag);

      match /updates/{update} {
        allow read, write: if userMayEditTag(tag);
      }
    }
    
    match /authors/{author} {
      allow read: if userMayViewApp();
      //Allow authors to write their own author entry, or any admin to create a
      //stub placeholder to be filled in later. The user must be an admin
      //because a) they need to know the uid, which implies access to the
      //firebase auth console anyway, and secondarily, anyone who can edit any
      //card can note editors, and there's no good way to detect that, so this
      //would be left open to anyeone, which would mean anyone could compell a
      //user to divulge their displayName and photoURL to the public when they
      //next visited.
      allow create: if request.auth.uid == author || (userIsAdmin() && request.resource.data.size() == 0)
      allow write: if request.auth.uid == author || (userIsAdmin() && request.resource.data.diff(resource.data).affectedKeys().size() == 0);
    }

    match /users/{user} {
      allow read: if request.auth.uid == user;
      allow write: if request.auth.uid == user;
    }
    
    match /cards/{card} {
      allow read: if userMayViewApp() && (resource.data.published == true || userMayViewUnpublished());
      allow create: if userMayCreateCard() && createIsAuthor();
      allow update: if cardEditMinor() || cardEditInboundReferences() || userMayEditCard(card);
      //This logic mirrors the logic in selectors/getReasonUserMayNotDeleteCard
      allow delete: if userMayEditCard(card) && resource.data.get('section', '') == '' && resource.data.get('tags', []).size() == 0 && resource.data.get('references_inbound', {}).size() == 0;
    
      match /updates/{update} {
        allow read, write: if userMayEditCard(card);
      }
    }

    match /embeddings/{card} {
      allow read, write: if false;
    }

    match /maintenance_tasks/{task} {
      allow read: if userIsAdmin();
      allow write: if userIsAdmin();
    }
    
    match /messages/{message} {
      allow read: if userMayViewApp();
      allow create: if createIsAuthor() && userMayComment();
      allow update: if (updateIsAuthor() || userIsAdmin()) && userMayComment();
    }
    
    match /threads/{thread} {
      allow read: if userMayViewApp();
      allow create: if createIsAuthor() && userMayComment()
      allow update: if userMayComment() && (updateIsAuthor() || (!isAnonymous() && editOnlyAddsMessage()) || userIsAdmin());
    }
    
    match /stars/{star} {
      allow create: if userMayStar() && createIsOwner();
      allow update: if userMayStar() && updateIsOwner();
      allow delete: if userMayStar() && updateIsOwner();
      allow read: if updateIsOwner();
    }

    match /reads/{read} {
      allow create: if userMayMarkRead() && createIsOwner();
      allow update: if userMayMarkRead() && updateIsOwner();
      allow delete: if userMayMarkRead() && updateIsOwner();
      allow read: if updateIsOwner();
    }

    match /tweets/{tweet} {
      allow read: if userMayViewApp();
    }

    match /reading_lists/{list_id} {
      allow create: if userMayModifyReadingList() && createIsOwner();
      allow update: if userMayModifyReadingList() && updateIsOwner();
      allow delete: if userMayModifyReadingList() && updateIsOwner();
      allow read: if updateIsOwner();

      match /updates/{update} {
        //Anyone can read or write the updates sub-collection as long as they're logged in as 
        //the ID of the reading_list, which is the same as the owner of the reading-list.
        allow read, write: if list_id == request.auth.uid;
      }
    }
  }
}