OpenNotes/firestore.rules at main · sameerthedeveloper/OpenNotes · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // Helper: Validates Super Admin authentication identity from backend token
    function isSuperAdmin() {
      return request.auth != null &&
             request.auth.token.email != null &&
             request.auth.token.email.lower() == 'mohamedsameer.s.2007@gmail.com';
    }

    // --- User Profiles & Subcollections (Bookmarks, Pins, Settings) ---
    match /users/{userId} {
      allow read: if request.auth != null;
      allow write: if (request.auth != null && request.auth.uid == userId) || isSuperAdmin();

      match /{document=**} {
        allow read, write: if (request.auth != null && request.auth.uid == userId) || isSuperAdmin();
      }
    }

    // --- Notes ---
    match /notes/{noteId} {
      // Allow read if super admin OR note is public OR user is author (or note doesn't exist yet)
      allow read: if isSuperAdmin() || resource == null || (
          resource.data.visibility == 'public' ||
          (request.auth != null && request.auth.uid == resource.data.authorId)
      );

      allow create: if request.auth != null &&
          (request.resource.data.authorId == request.auth.uid || isSuperAdmin());

      // Allow update if super admin OR author OR if it's a public note incrementing viewCount
      allow update: if isSuperAdmin() ||
          (request.auth != null && resource.data.authorId == request.auth.uid) ||
          (resource.data.visibility == 'public' &&
           request.resource.data.diff(resource.data).affectedKeys().hasOnly(['viewCount']));

      allow delete: if isSuperAdmin() || (
          request.auth != null && resource.data.authorId == request.auth.uid
      );

      // --- Views Subcollection ---
      match /views/{viewId} {
        allow read: if isSuperAdmin() || (request.auth != null &&
            get(/databases/$(database)/documents/notes/$(noteId)).data.authorId == request.auth.uid);

        allow create, update: if isSuperAdmin() ||
            get(/databases/$(database)/documents/notes/$(noteId)).data.visibility == 'public';
      }
    }

    // --- Provider Verifications (Admin & Creator Access) ---
    match /providerVerifications/{verifId} {
      allow read, write: if isSuperAdmin();
      // Allow individual creator to read/write their own verification submission document
      allow read, create, update: if request.auth != null &&
          verifId.matches('^' + request.auth.uid + '_.*');
    }

    // --- Creator Monetization Settings ---
    match /creatorMonetization/{uid} {
      allow read: if request.auth != null;
      allow write: if isSuperAdmin() || (request.auth != null && request.auth.uid == uid);
    }

    // --- Platform Settings (Super Admin Writes, Public/Auth Read) ---
    match /platformSettings/{settingDoc} {
      allow read: if true;
      allow write: if isSuperAdmin();
    }

    // --- Platform Secrets (Super Admin Only - API Keys, Secrets) ---
    match /platformSecrets/{secretDoc} {
      allow read, write: if isSuperAdmin();
    }

    // --- Note Discussion Forum Topics ---
    match /discussionTopics/{topicId} {
      allow read: if true;
      allow create: if request.auth != null;
      allow update: if isSuperAdmin() || (request.auth != null && (
        resource.data.authorId == request.auth.uid ||
        resource.data.noteAuthorId == request.auth.uid ||
        request.resource.data.diff(resource.data).affectedKeys().hasOnly(['likeCount', 'replyCount', 'updatedAt', 'viewCount', 'bestAnswerReplyId', 'isSolved', 'isLocked', 'isPinned'])
      ));
      allow delete: if isSuperAdmin() || (request.auth != null && (
        resource.data.authorId == request.auth.uid ||
        resource.data.noteAuthorId == request.auth.uid
      ));
    }

    // --- Note Discussion Forum Replies ---
    match /discussionReplies/{replyId} {
      allow read: if true;
      allow create: if request.auth != null;
      allow update: if isSuperAdmin() || (request.auth != null && (
        resource.data.authorId == request.auth.uid ||
        resource.data.noteAuthorId == request.auth.uid ||
        request.resource.data.diff(resource.data).affectedKeys().hasOnly(['likes'])
      ));
      allow delete: if isSuperAdmin() || (request.auth != null && (
        resource.data.authorId == request.auth.uid ||
        resource.data.noteAuthorId == request.auth.uid
      ));
    }

    // --- Note Discussion Forum Likes / Upvotes ---
    match /discussionLikes/{likeId} {
      allow read: if true;
      allow create, delete: if request.auth != null;
    }

    // --- Community Chat Rooms ---
    match /chatRooms/{roomId} {
      allow read: if true;
      allow write: if isSuperAdmin() || request.auth != null;
    }

    // --- Community Chat Messages ---
    match /chatMessages/{messageId} {
      allow read: if true;
      allow create: if request.auth != null;
      allow update, delete: if isSuperAdmin() || (request.auth != null && resource.data.authorId == request.auth.uid);
    }

    // --- Global Access Denied by Default (Super Admin Backup Exception) ---
    match /{document=**} {
      allow read, write: if isSuperAdmin();
    }
  }
}