harbor/firestore.rules at develop · jhorback/harbor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    function userHasRole(role) {
      return get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == role;
    }

    function hasOnly(fields) {
      return request.resource.data.diff(resource.data).affectedKeys().hasOnly(fields);
    }

    match /pages/{page} {
      allow read;
      allow create: if userHasRole("SITE_ADMIN") || userHasRole("AUTHOR") || userHasRole("USER_ADMIN")
      allow update: if request.auth.uid == resource.data.authorUid || userHasRole("SITE_ADMIN");
      allow delete: if request.auth.uid == resource.data.authorUid || userHasRole("SITE_ADMIN");
    }

    match /users/{user} {
      allow read;
      allow create:
        if request.resource.data.role == "NONE";
      allow update:
        if userHasRole("USER_ADMIN") || userHasRole("SITE_ADMIN") || hasOnly(['lastLogin'])
    }

    match /files/{file} {
        allow read;
        allow create: if userHasRole("SITE_ADMIN") || userHasRole("AUTHOR") || userHasRole("USER_ADMIN")
        allow update: if request.auth.uid == resource.data.uploaderUid || userHasRole("SITE_ADMIN");
        allow delete: if request.auth.uid == resource.data.uploaderUid || userHasRole("SITE_ADMIN");
    }

    match /system/app {
      allow read;
      allow create:
        if userHasRole("SITE_ADMIN");
      allow update:
        if userHasRole("SITE_ADMIN");
    }
  }
}