-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathfirestore.rules
More file actions
117 lines (109 loc) · 5.4 KB
/
Copy pathfirestore.rules
File metadata and controls
117 lines (109 loc) · 5.4 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
// ===============================================================
// Helper Functions
// ===============================================================
function isAuthenticated() {
return request.auth != null;
}
function isOwner(userId) {
return isAuthenticated() && request.auth.uid == userId;
}
function isDocOwner() {
return isAuthenticated() && request.auth.uid == resource.data.uid;
}
function isAuthor() {
return isAuthenticated() && request.auth.uid == resource.data.authorUid;
}
function hasRequiredFields(fields) {
return request.resource.data.keys().hasAll(fields);
}
function hasOnlyAllowedFields(fields) {
return request.resource.data.keys().hasOnly(fields);
}
function isValidEmail(email) {
return email is string && email.matches("^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$");
}
function isValidUrl(url) {
return url is string && (url == "" || url.matches("^https://.*") || url.matches("^http://.*") || url.matches("^data:image/.*"));
}
function isValidString(field, minLen, maxLen) {
return request.resource.data[field] is string &&
request.resource.data[field].size() >= minLen &&
request.resource.data[field].size() <= maxLen;
}
function isValidList(list, maxItems) {
return list is list && list.size() <= maxItems;
}
// ===============================================================
// Domain Validators
// ===============================================================
function isValidUser(data) {
return data.uid == request.auth.uid &&
data.email is string && isValidEmail(data.email) &&
(!('displayName' in data) || (data.displayName is string && data.displayName.size() < 100)) &&
(!('photoURL' in data) || (data.photoURL is string && isValidUrl(data.photoURL))) &&
(!('theme' in data) || (data.theme in ['light', 'dark']));
}
function isValidAnalysis(data) {
return data.uid == request.auth.uid &&
data.crop_name is string && data.crop_name.size() > 0 && data.crop_name.size() < 100 &&
data.disease_detected is string && data.disease_detected.size() < 200 &&
data.confidence_score is number && data.confidence_score >= 0 && data.confidence_score <= 100 &&
data.severity_level in ['Low', 'Moderate', 'High', 'None'] &&
isValidList(data.organic_treatments, 10) &&
isValidList(data.chemical_treatments, 10) &&
data.immediate_action is string && data.immediate_action.size() < 1000 &&
(!('imageUrl' in data) || (data.imageUrl is string && isValidUrl(data.imageUrl))) &&
data.createdAt is string;
}
function isValidPost(data) {
return data.authorUid == request.auth.uid &&
data.authorName is string && data.authorName.size() > 0 && data.authorName.size() < 100 &&
(!('authorPhoto' in data) || (data.authorPhoto is string && isValidUrl(data.authorPhoto))) &&
data.title is string && data.title.size() > 0 && data.title.size() < 200 &&
data.content is string && data.content.size() > 0 && data.content.size() < 5000 &&
(!('imageUrl' in data) || (data.imageUrl is string && isValidUrl(data.imageUrl))) &&
data.createdAt is string &&
data.commentCount is number;
}
function isValidComment(data) {
return data.authorUid == request.auth.uid &&
data.authorName is string && data.authorName.size() > 0 && data.authorName.size() < 100 &&
(!('authorPhoto' in data) || (data.authorPhoto is string && isValidUrl(data.authorPhoto))) &&
data.postId is string &&
data.content is string && data.content.size() > 0 && data.content.size() < 1000 &&
data.createdAt is string;
}
// ===============================================================
// Match Rules
// ===============================================================
match /users/{uid} {
allow read: if isAuthenticated();
allow create: if isOwner(uid) && isValidUser(request.resource.data);
allow update: if isOwner(uid) && isValidUser(request.resource.data);
}
match /analyses/{analysisId} {
allow read: if isAuthenticated() && resource.data.uid == request.auth.uid;
allow create: if isAuthenticated() && isValidAnalysis(request.resource.data);
allow delete: if isAuthenticated() && resource.data.uid == request.auth.uid;
}
match /posts/{postId} {
allow read: if true;
allow create: if isAuthenticated() && isValidPost(request.resource.data);
allow update: if isAuthenticated() && (
(isAuthor() && isValidPost(request.resource.data)) ||
(request.resource.data.diff(resource.data).affectedKeys().hasOnly(['commentCount']) &&
(request.resource.data.commentCount == resource.data.commentCount + 1 ||
request.resource.data.commentCount == resource.data.commentCount - 1))
);
allow delete: if isAuthor();
match /comments/{commentId} {
allow read: if true;
allow create: if isAuthenticated() && isValidComment(request.resource.data) && request.resource.data.postId == postId;
allow delete: if isAuthor();
}
}
}
}