firestore.rules

rules_version = '2';
//Firestore database is in complete lockdown
//The data stored in Cloud Firestore (which is FCM token data, user metadata and friend recs)
//is managed entirely by the admin ADK and cloud functions
service cloud.firestore {
  match /databases/{database}/documents {

    function changedKeysInSet(old, new, set){
      return (old == null && new.data.keys().hasOnly(set)) || new.data.diff(old.data).affectedKeys().hasOnly(set)
    }

    function isLatLngLike(data){
      return data is map &&
      data.keys().hasOnly(["latitude", "longitude"]) &&
      data.latitude is number &&
      math.abs(data.latitude) <= 90 &&
      data.longitude is float && 
      math.abs(data.longitude) <= 180
    }

    // Users can read their notification data, only cloud functions can write to it
    match /fcmData/{userUid} {
      allow read: if request.auth != null && request.auth.uid == userUid;
      allow write: if false;
    }

    match /userMetadata/{userUid} {
      allow read: if request.auth != null && request.auth.uid == userUid;
      allow write: if false;
    }

    match /publicExtraUserInfo/{userUid} {
      allow read: if request.auth != null
      allow write: if false;
    }

    match /friendRecommendations/{docName} {
      allow read: if request.auth != null && (request.auth.uid in resource.data.uids || docName.matches(".*"+request.auth.uid+".*"));
      allow write: if false;
    }

    match /userEmailVerifications/{userUid}{
      allow read, write: if false
    }


    match /publicFlareUserMetadataPrivate/{userUid}{
      allow read: if false
      allow write: if request.auth != null &&
       request.auth.uid == userUid &&
       changedKeysInSet(resource, request.resource, ["geoHash", "geolocation"].toSet()) &&
       request.resource.data.geoHash is string &&
       //For some reason the "is latlng" works in the console, but only isLatLngLike works in prod
       //TODO: investigate
       (request.resource.data.geolocation is latlng || isLatLngLike(request.resource.data.geolocation))
    }

    match /shortenedPublicFlares/{orgoHash}/public_flares_short/{flareID} {
      allow read: if request.auth != null;
      allow write: if false;
    }

    //For collection group queries in the app feed
    match /{path=**}/public_flares/{flareID} {
      allow read: if request.auth.uid == resource.data.owner.uid;
    }

    match /publicFlares/{orgoHash}/public_flares/{flareUid} {
      allow read: if request.auth != null;
      allow write: if false;

      match /responders/{responderUid} {
        allow read: if request.auth != null;
        allow write: if false;
      }
    }
  }
}