matematch/firebase.rules at responsive-branch2 · nintang/matematch · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    // Helper functions
    function isSignedIn() {
      return request.auth != null;
    }

    function isOwner(userId) {
      return isSignedIn() && request.auth.uid == userId;
    }

    // User profiles
    match /profiles/{userId} {
      allow read: if isSignedIn();
      allow write: if isOwner(userId);
    }

    // Starred listings
    match /starredListings/{userId}/listings/{listingId} {
      allow read: if isOwner(userId);
      allow write: if isOwner(userId);
    }

    // Listing interests
    match /listingInterests/{listingId} {
      allow read: if isSignedIn();
      allow write: if isSignedIn();
    }

    // Activities
    match /activities/{activityId} {
      allow read: if isSignedIn();
      allow create: if isSignedIn() &&
        request.resource.data.data.userId == request.auth.uid &&
        request.resource.data.type in ['new_listing', 'expressed_interest', 'new_roommate', 'starred_listing'];
      allow delete: if isSignedIn() &&
        resource.data.data.userId == request.auth.uid;

      // Comments on activities
      match /comments/{commentId} {
        allow read: if isSignedIn();
        allow create: if isSignedIn() && request.resource.data.userId == request.auth.uid;
        allow update, delete: if isSignedIn() && resource.data.userId == request.auth.uid;
      }

      // Likes on activities
      match /likes/{userId} {
        allow read: if isSignedIn();
        allow write: if isSignedIn() && userId == request.auth.uid;
      }
    }

    // User interactions (likes, shares, saves)
    match /userInteractions/{userId} {
      allow read: if isOwner(userId);
      allow write: if isOwner(userId);

      match /likes/{activityId} {
        allow read: if isSignedIn();
        allow write: if isOwner(userId);
      }

      match /saves/{activityId} {
        allow read: if isOwner(userId);
        allow write: if isOwner(userId);
      }
    }
  }
}