firestore.bak.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    // Enforce a global whitelist-only rule on all documents.
    match /{document=**} {
      allow read, write: if false;
    }

    match /users/{docId} {
      // Allow GET, if the document belongs to the authenticated user.
      allow get:  if isAuthenticated()
                  && request.auth.uid == docId;

      // Allow GET, if the authenticated user has an access level of 2 or more.
      allow get:  if isAuthenticated()
                  && getAccessLevel() >= 2;

      // Allow LIST, if the authenticated user has an access level of 2 or more,
      // and the request limit <= QUERY_LIMIT.
      // Refer to function QUERY_LIMIT.
      allow list: if isAuthenticated()
                  && getAccessLevel() >= 2
                  && isWithinQueryLimit(15);

      // Allow UPDATE, if
      // * the user is authenticated;
      // * the user has an access level of 3 or more;
      // * the update request only has the field `Access Level`;
      // * the field value `Access Level` is the data type of int;
      // * the request field `Access Level` is lower than the resource field;
      allow update: if isAuthenticated()
                    && getAccessLevel() >= 3
                    && isValidUpdate();

      // Allow CREATE, if
      // * the user is authenticated;
      // * the document belongs to the user;
      // * the document structure matches the data model;
      // * the field `User ID` is of type string;
      // * the field `Email` is of type string;
      // * the field `Photo URL` is of type string;
      // * the field `Display Name` is of type string;
      // * the field `Access Level` is of type int;
      // * the field `updatedAt` is of type timestamp;
      // * the field `createdAt` is of type timestamp;
      //
      // * the field `User ID` == the user uid;
      // * the field `Email` == the user email;
      // * the field `Display Name` == user name;
      // * the field `Membership ID` == null;
      // * the field `Access Level` == 0;
      // * the field `updatedAt` == current timestamp;
      // * the field `createdAt` == current timestamp;
      allow create: if isAuthenticated()
                    && isValidCreate();

      // Deny DELETE operations; handled by Cloud Functions.
      allow delete: if false;

      function isValidUpdate() {
        let affectedKeys = getIncomingData().diff(resource.data).affectedKeys();
        return affectedKeys.hasOnly(['Access Level', 'updatedAt'])
            && getIncomingData()['Access Level'] is int
            && getIncomingData()['updatedAt'] is timestamp
            && getIncomingData()['Access Level'] <= getExistingData()['Access Level']
            && getIncomingData()['updatedAt'].toMillis() == request.time.toMillis();
      }

      function isValidCreate() {
        let authUser = request.auth;
        let allowedKeys = [
          'User ID',
          'Email',
          'Photo URL',
          'Display Name',
          'Membership ID',
          'Access Level',
          'updatedAt',
          'createdAt'
        ];

        return docId == authUser.uid
            && getIncomingData().keys().hasOnly(allowedKeys)
            && getIncomingData()['User ID'] is string
            && getIncomingData()['Email'] is string
            && getIncomingData()['Photo URL'] is string
            && getIncomingData()['Display Name'] is string
            && getIncomingData()['Access Level'] is int
            && getIncomingData()['updatedAt'] is timestamp
            && getIncomingData()['createdAt'] is timestamp
            && getIncomingData()['User ID'] == authUser.uid
            && getIncomingData()['Email'] == authUser.token.email
            && getIncomingData()['Photo URL'] != ''
            && getIncomingData()['Display Name'] == authUser.token.name
            && getIncomingData()['Membership ID'] == null
            && getIncomingData()['Access Level'] == 0
            && getIncomingData()['updatedAt'].toMillis() == request.time.toMillis()
            && getIncomingData()['createdAt'].toMillis() == request.time.toMillis();
      }
    }

    match /members/{memberId} {
      allow get:  if isAuthenticated()
                  && getUserData()['Membership ID'] == memberId;

      allow get:  if isAuthenticated()
                  && hasPermissionLevel(2);

      allow list: if isAuthenticated()
                  && hasPermissionLevel(2)
                  && isWithinQueryLimit(15);

      allow create: if isAuthenticated()
                    && hasPermissionLevel(2)
                    && isValidCreate();

      allow update: if isAuthenticated()
                    && hasPermissionLevel(2)
                    && isValidUpdate();

      allow delete: if isAuthenticated()
                    && hasPermissionLevel(2)
                    && isValidUser();

      function isValidCreate() {
        let data = getIncomingData();
        let allowedKeys = [
          'Membership ID',
          'Full Name',
          'Gender',
          'Email',
          'Contact Number',
          'Home Number',
          'Current School',
          'Graduating Class',
          'Graduating Year',
          'Name Of Next-Of-Kin',
          'Relationship With Next-Of-Kin',
          'Contact Number Of Next-Of-Kin',
          'updatedAt',
          'createdAt'
        ];

        return data.keys().hasOnly(allowedKeys)
            && data['Membership ID'] is string
            && data['Full Name'] is string
            && data['Gender'] is string
            && (data['Email'] is string || isNull('Email'))
            && data['Contact Number'] is int
            && (data['Home Number'] is int || isNull('Home Number'))
            && (data['Current School'] is string || isNull('Current School'))
            && data['Graduating Class'] is string
            && data['Graduating Year'] is int
            && data['Name Of Next-Of-Kin'] is string
            && data['Relationship With Next-Of-Kin'] is string
            && data['Contact Number Of Next-Of-Kin'] is int
            && data['updatedAt'] is timestamp
            && data['createdAt'] is timestamp
            && data['Membership ID'] == memberId
            && isNotEmpty('Full Name')
            && isOneOf('Gender', ['Male', 'Female'])
            && (isNotEmpty('Email') || isNull('Email'))
            && isValidPhoneNumber('Contact Number')
            && (isValidPhoneNumber('Home Number') || isNull('Home Number'))
            && (isNotEmpty('Current School') || isNull('Current School'))
            && isNotEmpty('Graduating Class')
            && isValidGraduatingClass('Graduating Class')
            && isValidGraduatingYear('Graduating Year')
            && isNotEmpty('Name Of Next-Of-Kin')
            && isNotEmpty('Relationship With Next-Of-Kin')
            && isValidPhoneNumber('Contact Number Of Next-Of-Kin')
            && data['updatedAt'].toMillis() == request.time.toMillis()
            && data['createdAt'].toMillis() == request.time.toMillis();
      }

      function isValidUpdate() {
        let data = getIncomingData();
        let affectedKeys = request.resource.data.diff(resource.data).affectedKeys();
        let allowedKeys = [
          'Full Name',
          'Gender',
          'Email',
          'Contact Number',
          'Home Number',
          'Current School',
          'Graduating Class',
          'Graduating Year',
          'Name Of Next-Of-Kin',
          'Relationship With Next-Of-Kin',
          'Contact Number Of Next-Of-Kin',
          'updatedAt'
        ];

        return affectedKeys.hasOnly(allowedKeys)
            && data['Full Name'] is string
            && data['Gender'] is string
            && (data['Email'] is string || isNull('Email'))
            && data['Contact Number'] is int
            && (data['Home Number'] is int || isNull('Home Number'))
            && (data['Current School'] is string || isNull('Current School'))
            && data['Graduating Class'] is string
            && data['Graduating Year'] is int
            && data['Name Of Next-Of-Kin'] is string
            && data['Relationship With Next-Of-Kin'] is string
            && data['Contact Number Of Next-Of-Kin'] is int
            && data['updatedAt'] is timestamp
            && isNotEmpty('Full Name')
            && isOneOf('Gender', ['Male', 'Female'])
            && (isNotEmpty('Email') || isNull('Email'))
            && isValidPhoneNumber('Contact Number')
            && (isValidPhoneNumber('Home Number') || isNull('Home Number'))
            && (isNotEmpty('Current School') || isNull('Current School'))
            && isNotEmpty('Graduating Class')
            && isValidGraduatingClass('Graduating Class')
            && isValidGraduatingYear('Graduating Year')
            && isNotEmpty('Name Of Next-Of-Kin')
            && isNotEmpty('Relationship With Next-Of-Kin')
            && isValidPhoneNumber('Contact Number Of Next-Of-Kin')
            && data['updatedAt'].toMillis() == request.time.toMillis();
      }
    }

    match /events/{eventId} {
      allow get:  if isAuthenticated()
                  && hasPermissionLevel(1)
                  && isNotEmpty('Membership ID');

      allow list: if isAuthenticated()
                  && hasPermissionLevel(1)
                  && isWithinQueryLimit(15);

      allow create: if isAuthenticated()
                    && hasPermissionLevel(2)
                    && isValidCreate();

      function isValidCreate() {
        let data = getIncomingData();
        let allowedKeys = [
          'Event Code',
          'Event Year',
          'Event Name',
          'Event Thumbnail',
          'Event Overall In-Charge',
          'Event Assistant In-Charge',
          'Google Drive',
          'Roles',
          'Official Event',
          'updatedAt',
          'createdAt'
        ];

        return data.keys().hasOnly(allowedKeys)
            && data['Event Code'] is int
            && data['Event Year'] is int
            && data['Event Name'] is string
            && data['Event Thumbnail'] is string
            && data['Event Overall In-Charge'] is string
            && data['Event Assistant In-Charge'] is string
            && data['Google Drive'] is string
            && data['Roles'] is list
            && data['Official Event'] is bool
            && data['updatedAt'] is timestamp
            && data['createdAt'] is timestamp
            && data['Event Code'] == eventId
            && isWithinRange(data['Event Year'], 2000, request.time.year())
            && isNotEmpty('Event Name')
            && isNotEmpty('Event Thumbnail')
            && isNotEmpty('Event Overall In-Charge')
            && isNotEmpty('Event Assistant In-Charge')
            && isNotEmpty('Google Drive')
            && isNotEmpty('Roles')
            && data['updatedAt'].toMillis() == request.time.toMillis()
            && data['createdAt'].toMillis() == request.time.toMillis();
      }
    }

    // Events collection contains all the past and upcoming events.
    //
    // GET      If the authenticated user has an access level of 1 (Alumni) or
    //          higher.
    //
    // LIST     If the authenticated user has an access level of 1 (Alumni) or
    //          higher and the query limit not exceeding 10 documents at once.
    //
    // CREATE   If the authenticated user has an access level of 2 (Editor) or
    //          higher.
    //
    // UPDATE   If the authenticated user has an access level of 2 (Editor) or
    //          higher and having the locked document data not being modified.
    //
    // DELETE   If the authenticated user has an access level of 3 (Administrator)
    //          or higher.
    match /events/{eventId} {
      allow get:  if isAuthenticated()
                  && getAccessLevel() >= 1
                  && getUserData()['Membership ID'] != null;

      allow list: if isAuthenticated()
                  && getAccessLevel() >= 1
                  && request.query.limit <= QUERY_LIMIT();

      allow create: if isAuthenticated()
                    && getAccessLevel() >= 2;

      allow update: if isAuthenticated()
                    && getAccessLevel() >= 2
                    && getIncomingData()['Event Code'] == getExistingData()['Event Code']
                    && getIncomingData()['Event Year'] == getExistingData()['Event Year']
                    && getIncomingData()['updatedAt'] == getExistingData()['updatedAt']
                    && getIncomingData()['createdAt'] == getExistingData()['createdAt'];

      allow delete: if isAuthenticated()
                    && getAccessLevel() >= 3;
    }

    // Participations collection contains all records of alumni participation.
    // Used for identifying events participated and collating total VIA hours.
    //
    // GET      If the document belongs to the authenticated user or the
    //          authenticated user has an access level of 2 (Editor) or higher.
    //
    // LIST     If the document belongs to the authenticated user or the
    //          authenticated user has an access level of 2 (Editor) or higher.
    //          And the query limit not exceeding 10 documents at once.
    //
    // CREATE   If the authenticated user has an access level of 2 (Editor) or
    //          higher.
    //
    // UPDATE   If the authenticated user has an access level of 2 (Editor) or
    //          higher and the locked document data not being modified.
    //
    // DELETE   If the authenticated user has an access level of 3 (Administrator)
    //          or higher.
    match /participations/{participationId} {
      allow get:  if isAuthenticated()
                  && getExistingData()['Membership ID'] == getUserData()['Membership ID'];

      allow get:  if isAuthenticated()
                  && hasPermissionLevel(2);

      allow list: if isAuthenticated()
                  && getExistingData()['Membership ID'] == getUserData()['Membership ID']
                  && isWithinQueryLimit(15);

      allow list: if isAuthenticated()
                  && hasPermissionLevel(2)
                  && isWithinQueryLimit(15);

      allow create: if isAuthenticated()
                    && hasPermissionLevel(2)
                    && isValidCreate();

      allow update: if isAuthenticated()
                    && hasPermissionLevel(2)
                    && isValidUpdate();

      allow delete: if isAuthenticated()
                    && hasPermissionLevel(2)
                    && isValidUser();

      function isValidCreate() {
        let data = getIncomingData();
        let allowedKeys = [
          'Participation ID',
          'Membership ID',
          'Event Code',
          'Role',
          'VIA Hours',
          'updatedAt',
          'createdAt'
        ];

        return data.keys().hasOnly(allowedKeys)
            && data['Participation ID'] is string
            && data['Membership ID'] is string
            && data['Event Code'] is int
            && data['Role'] is string
            && (data['VIA Hours'] is int
            ||  data['VIA Hours'] is float)
            && data['updatedAt'] is timestamp
            && data['createdAt'] is timestamp
            && data['Participation ID'] == participationId
            && isNotEmpty('Membership ID')
            && isNotEmpty('Event Code')
            && isNotEmpty('Role')
            && isNotEmpty('VIA Hours')
            && data['updatedAt'].toMillis() == request.time.toMillis()
            && data['createdAt'].toMillis() == request.time.toMillis();
      }

      function isValidUpdate() {
        let data = getIncomingData();
        let affectedKeys = request.resource.data.diff(resource.data).affectedKeys();
        let allowedKeys = [
          'Role',
          'VIA Hours',
          'updatedAt'
        ];

        return affectedKeys.hasOnly(allowedKeys)
            && data['Role'] is string
            && data['VIA Hours'] is float
            && isNotEmpty(data['Role'])
            && isNotEmpty(data['VIA Hours'])
            && data['updatedAt'].toMillis() == request.time.toMillis();
      }

      // allow list: if isAuthenticated()
      //             && getExistingData()['Membership ID'] == getUserData()['Membership ID']
      //             && request.query.limit <= QUERY_LIMIT();

      // allow get:  if isAuthenticated()
      //             && getAccessLevel() >= 2;

      // allow list: if isAuthenticated()
      //             && getAccessLevel() >= 2
      //             && request.query.limit <= QUERY_LIMIT();

      // allow create: if isAuthenticated()
      //               && getAccessLevel() >= 2;

      // allow update: if isAuthenticated()
      //               && getAccessLevel() >= 2
      //               && getIncomingData()['Membership ID'] == getExistingData()['Membership ID']
      //               && getIncomingData()['Event Code'] == getExistingData()['Event Code']
      //               && getIncomingData()['updatedAt'] == getExistingData()['updatedAt']
      //               && getIncomingData()['createdAt'] == getExistingData()['createdAt'];

      // allow delete: if isAuthenticated()
      //               && getAccessLevel() >= 3;
    }

    match /aggregations/{aggregationId} {
      allow get:  if isAuthenticated()
                  && getAccessLevel() >= 2;

      allow list,
            create,
            update,
            delete: if false;
    }

    function isAuthenticated() {
      return request.auth != null
          && request.auth.token.email_verified
          && exists(/databases/$(database)/documents/users/$(request.auth.uid));
    }

    function hasPermissionLevel(level) {
      let currentUser = get(/databases/$(database)/documents/users/$(request.auth.uid)).data;
      return currentUser['Access Level'] >= level;
    }

    function getExistingData() {
      return resource.data;
    }

    function getIncomingData() {
      return request.resource.data;
    }

    function getUserData() {
    	return get(/databases/$(database)/documents/users/$(request.auth.uid)).data;
    }

    function getAccessLevel() {
      return getUserData()['Access Level'];
    }

    function isNull(key) {
      return request.resource.data[key] == null;
    }

    function isOneOf(key, list) {
      return request.resource.data[key] in list;
    }

    function isNotEmpty(key) {
      let data = request.resource.data[key];
      return (data is string
          &&  data.trim() != ''
          &&  data.trim().size() > 0)
          || (data is int
          &&  data >= 0)
          || (data is float
          &&  data >= 0)
          || (data is list
          &&  data.size() > 0);
    }

    function isWithinRange(number, start, end) {
      return number is int
          && (start <= number) && (number <= end);
    }

    function isWithinQueryLimit(limit) {
      return request.query.limit <= limit;
    }

    function isValidUser() {
      let userExists = exists(/databases/$(database)/documents/users/$(request.auth.uid));
      let currentUser = get(/databases/$(database)/documents/users/$(request.auth.uid)).data;
      let memberExists = exists(/databases/$(database)/documents/members/$(currentUser['Membership ID']));
      return userExists && memberExists;
    }

    function isValidPhoneNumber(key) {
      let data = request.resource.data[key];
      return data is int
          && (isWithinRange(data, 81000000, 99999999)
          ||  isWithinRange(data, 60000000, 69999999));
    }

    function isValidGraduatingClass(key) {
      let classes = [
        '6A',
        '6B',
        '6C',
        '6D',
        '6E',
        '6F',
        '6G',
        '6H',
        '6I',
        '6J',
        '6 Respect',
        '6 Resilience',
        '6 Responsibility',
        '6 Integrity',
        '6 Care',
        '6 Harmony'
      ];
      return request.resource.data[key] in classes;
    }

    function isValidGraduatingYear(key) {
      let data = request.resource.data[key];
      return isWithinRange(data, 2000, request.time.year());
    }

    function QUERY_LIMIT() {
      return 15;
    }
  }
}