Loopa/firestore.rules at main · UltraBot05/Loopa · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // Helper: is the requesting user authenticated?
    function isAuth() {
      return request.auth != null;
    }

    // Helper: get the requesting user's role from Firestore
    function userRole() {
      return get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role;
    }

    function isAdmin() {
      return isAuth() && userRole() == 'admin';
    }

    function isOwner(uid) {
      return isAuth() && request.auth.uid == uid;
    }

    // ── Users ──────────────────────────────────────────────
    match /users/{uid} {
      // Any authenticated user can read any user doc (for display names, roles)
      allow read: if isAuth();

      // User can create their own doc (on first sign-in)
      allow create: if isOwner(uid);

      // User can update their own doc, EXCEPT role field
      // Admin can update any doc including role
      allow update: if isAdmin()
        || (isOwner(uid) && !('role' in request.resource.data.diff(resource.data).affectedKeys()));

      allow delete: if isAdmin();
    }

    // ── Posts ──────────────────────────────────────────────
    match /posts/{postId} {
      allow read: if isAuth();

      allow create: if isAuth()
        && request.resource.data.authorUid == request.auth.uid;

      allow update: if isAdmin()
        || (isAuth() && resource.data.authorUid == request.auth.uid);

      allow delete: if isAdmin()
        || (isAuth() && resource.data.authorUid == request.auth.uid);

      // ── Replies ──────────────────────────────────────────
      match /replies/{replyId} {
        allow read: if isAuth();

        allow create: if isAuth()
          && request.resource.data.authorUid == request.auth.uid;

        allow update: if isAdmin()
          || (isAuth() && resource.data.authorUid == request.auth.uid);

        allow delete: if isAdmin()
          || (isAuth() && resource.data.authorUid == request.auth.uid);
      }
    }
  }
}