firestore.rules

/**
 * Copyright 2020 The Ground Authors.
 *
 * Licensed under the Apache License, Version 2.0 (the 'License');
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     https://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an 'AS IS' BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

 // Define access rules for Firestore collections and documents.
 service cloud.firestore {
  match /databases/{database}/documents {

    /**
     * Fetches and returns the survey with the specified id.
     */
    function getSurvey(surveyId) {
      return get(/databases/$(database)/documents/surveys/$(surveyId)).data;
    }

   /**
     * Returns the current user's role in the given survey.
     */
    function getRole(survey) {
      // Get role from `acl` nested object (field 4).
      return survey["4"][request.auth.token.email];
    }

    /**
     * Returns the regular expression matching emails granted access.
     */
    function getPassRegexp() {
      return get(/databases/$(database)/documents/passlist/regexp).data.regexp
    }

    /**
     * Returns true iff the user's email is explicitly listed in the passlist.
     */
    function inPasslist() {
      return exists(/databases/$(database)/documents/passlist/$(request.auth.token.email));
    }

    /**
     * Returns true iff the user's email matches the passlist regex or
     * is explicitly listed in the passlist.
     */
    function canAccess() {
      return request.auth != null && (request.auth.token.email.matches(getPassRegexp()) || inPasslist());
    }

    /**
     * Returns true iff the user with the given email can read the specified
     * survey.
     */
    function canViewSurvey(survey) {
      return canAccess() && getRole(survey) != null;
    }

    /**
     * Returns true if the current user has one of the specified roles in the
     * given survey.
     */
    function isOneOf(survey, roles) {
     return survey["4"][request.auth.token.email] in roles;
    }

    /**
     * Returns true if the current user is passlisted and has the `SURVEY_ORGANIZER` role
     * in the specified survey. Note that this include survey owners, since they are
     * assigned this role by default.
     */
    function canManageSurvey(survey) {
      return canAccess() && isOneOf(survey, [
        3 /* SURVEY_ORGANIZER */
      ]);
    }

    /**
     * Returns true iff the current user with the given email can contribute LOIs 
     * and submissions to the specified survey.
     */
    function canCollectData(survey) {
      return canAccess() && isOneOf(survey, [
        2 /* DATA_COLLECTOR */,
        3 /* SURVEY_ORGANIZER */
      ]);
    }

    /**
     * Returns true iff the current user is the owner of the specified LOI.
     */
    function isLoiOwner(loi) {
      return loi.data['5'] == request.auth.uid;
    }

    /**
     * Returns true iff the current user is the owner of the specified submission.
     */
    function isSubmissionOwner(submission) {
      return submission.data['5'] == request.auth.uid;
    }

    // Allow users to read, create, and write their own profiles in the db.
    match /users/{userId} {
      allow read: if userId == request.auth.uid || canAccess();
      allow create, write: if userId == request.auth.uid;
    }

    // All users need to be able to read the passlist for rules to work.
    match /passlist/{entry} {
      // TODO(#1602): Replace "regexp" with simple pattern matching.
      allow read: if request.auth != null && entry in ['regexp', request.auth.token.email];
    }

    // Apply passlist and survey-level ACLs to survey documents.
    match /surveys/{surveyId} {
      allow read: if canViewSurvey(resource.data);
      allow write: if canManageSurvey(resource.data);
      allow create: if canAccess();
    }

    // Allow passlisted users to access Terms of Service and other config.
    match /config/{id} {
      allow read: if canAccess();
    }

    // Allow all users to access Access Denied config.
    match /config/accessDenied {
      allow read: if request.auth != null;
    }

    // Apply passlist and survey-level ACLs to LOI documents.
    match /surveys/{surveyId}/lois/{loiId} {
      // Allow if user has has read access to the survey.
      allow read: if canViewSurvey(getSurvey(surveyId));
      // Allow if user is owner of the new LOI and can collect data.
      allow create: if isLoiOwner(request.resource) && canCollectData(getSurvey(surveyId));
      // Allow if user is owner of the existing LOI or can manage survey.
      allow write: if isLoiOwner(resource) || canManageSurvey(getSurvey(surveyId));
    }

    // Apply passlist and survey-level ACLs to submission documents.
    match /surveys/{surveyId}/submissions/{submissionId} {
      // Allow if user has has read access to the survey.
      allow read: if canViewSurvey(getSurvey(surveyId));
      // Allow if user is owner of the new submission and can collect data.
      allow create: if isSubmissionOwner(request.resource) && canCollectData(getSurvey(surveyId));
      // Allow if user is owner of the existing submission or can manage survey.
      allow write: if isSubmissionOwner(resource) || canManageSurvey(getSurvey(surveyId));
    }

    // Apply passlist and survey-level ACLs to job documents.
    match /surveys/{surveyId}/jobs/{jobId} {
      // Allow if user has has read access to the survey.
      allow read: if canViewSurvey(getSurvey(surveyId));
      // Allow if user can manage survey.
      allow create, write: if canManageSurvey(getSurvey(surveyId));
    }
  }
}