firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /projects/{project} {
      function isInGalleryNotRestricted(uid, galleryID) {
        let gallery = get(/databases/$(database)/documents/galleries/$(galleryID)).data;
        return gallery != null && (gallery.public || uid in gallery.creators || uid in gallery.curators) && 
          (!("restrictedGallery" in resource.data) || !resource.data.restrictedGallery);
      }

      function isInGalleryRestricted(uid, galleryID) {
        let gallery = get(/databases/$(database)/documents/galleries/$(galleryID)).data;
        return gallery != null && "restrictedGallery" in resource.data && resource.data.restrictedGallery && uid in gallery.curators;
      }

      function isCuratorOfProjectInGallery(uid, galleryID) {
        let gallery = get(/databases/$(database)/documents/galleries/$(galleryID)).data;
        return gallery != null && (uid in gallery.curators);
      }

      allow create: if request.auth != null;
      // Projects are readable if:
      // 1) They are public
      // 2) The requestor is the owner or a collaborator
      // 3) The requestor is a curator or creator of the gallery that the project is in, or that gallery is public, and access to the project has not been restricted by its owner
      // 4) The requestor is a curator of the gallery that the project is in and access to the project is restricted
      allow read: if 
        (resource.data != null && 'public' in resource.data && resource.data.public) || 
        (resource.data != null && request.auth != null && 
          ( 
            ("mod" in request.auth.token && request.auth.token.mod) ||
            ('owner' in resource.data && resource.data.owner == request.auth.uid) || 
            ('collaborators' in resource.data && request.auth.uid in resource.data.collaborators) || 
            ('commenters' in resource.data && request.auth.uid in resource.data.commenters) ||
            ('viewers' in resource.data && request.auth.uid in resource.data.viewers) ||
            ('gallery' in resource.data && resource.data.gallery != null && (isInGalleryRestricted(request.auth.uid, resource.data.gallery) || isInGalleryNotRestricted(request.auth.uid, resource.data.gallery)))
          )
        );
      allow update: 
        if request.auth != null && 
          (
            resource.data.owner == request.auth.uid || 
            request.auth.uid in resource.data.collaborators || 
            ("mod" in request.auth.token && request.auth.token.mod) ||
            (resource.data.gallery != null && isCuratorOfProjectInGallery(request.auth.uid, resource.data.gallery))
          );
      allow delete: if request.auth != null && resource.data.owner == request.auth.uid;

      // Realtime CRDT updates for collaborative editing (#135). Each doc is
      // a small Yjs binary update (base64) emitted by one collaborator's
      // editor and consumed by all others. Anyone with read access to the
      // parent project can read its updates; only collaborators + owner
      // can append updates tagged with their own writer ID.
      //
      // Every field access on parent() is guarded with `'X' in parent()`
      // for the same reason the project-doc rule above guards every
      // field access on resource.data: pre-v5 project docs predate
      // `commenters` and `viewers`, and `request.auth.uid in null` is
      // a CEL evaluation error that fails closed but in a confusing
      // way. Guarding short-circuits cleanly before any null reach.
      match /updates/{updateID} {
        function parent() {
          return get(/databases/$(database)/documents/projects/$(project)).data;
        }
        allow read: if
          request.auth != null && (
            ("mod" in request.auth.token && request.auth.token.mod) ||
            ('owner' in parent() && parent().owner == request.auth.uid) ||
            ('collaborators' in parent() && request.auth.uid in parent().collaborators) ||
            ('commenters' in parent() && request.auth.uid in parent().commenters) ||
            ('viewers' in parent() && request.auth.uid in parent().viewers)
          );
        allow create: if
          request.auth != null && (
            ('owner' in parent() && parent().owner == request.auth.uid) ||
            ('collaborators' in parent() && request.auth.uid in parent().collaborators)
          );
        // Updates are immutable once written — compaction (Stage 5
        // follow-up: Cloud Function) replaces them by writing a new
        // snapshot to the parent doc and deleting consumed updates.
        allow update: if false;
        allow delete: if request.auth != null && (
          ('owner' in parent() && parent().owner == request.auth.uid) ||
          ("mod" in request.auth.token && request.auth.token.mod)
        );
      }

      // Presence: one doc per collaborator's clientID, with their caret
      // position and a heartbeat lastSeen. Readable by anyone with project
      // read access; only the writer can write/delete their own doc.
      match /presence/{clientID} {
        function parent() {
          return get(/databases/$(database)/documents/projects/$(project)).data;
        }
        allow read: if
          request.auth != null && (
            ('public' in parent() && parent().public) ||
            ('owner' in parent() && parent().owner == request.auth.uid) ||
            ('collaborators' in parent() && request.auth.uid in parent().collaborators) ||
            ('commenters' in parent() && request.auth.uid in parent().commenters) ||
            ('viewers' in parent() && request.auth.uid in parent().viewers)
          );
        allow write: if
          request.auth != null && (
            ('owner' in parent() && parent().owner == request.auth.uid) ||
            ('collaborators' in parent() && request.auth.uid in parent().collaborators)
          ) && 'userID' in request.resource.data
            && request.resource.data.userID == request.auth.uid;
        allow delete: if
          request.auth != null && (
            ('userID' in resource.data && resource.data.userID == request.auth.uid) ||
            ('owner' in parent() && parent().owner == request.auth.uid)
          );
      }
    }
    match /creators/{uid} {
      allow read, write: if request.auth != null && request.auth.uid == uid;
    }
    match /galleries/{gallery} {
      allow create: if request.auth != null;
      // Public galleries can be read, as can private ones if the creator is a curator, creator, or a how to viewer.
      allow read: if (resource.data != null && "public" in resource.data && resource.data.public) || (
        request.auth != null && (
          ("curators" in resource.data && request.auth.uid in resource.data.curators) || 
          ("creators" in resource.data && request.auth.uid in resource.data.creators) || 
          (
            "howToExpandedVisibility" in resource.data && 
            "howToViewersFlat" in resource.data && 
            resource.data.howToExpandedVisibility && 
            request.auth.uid in resource.data.howToViewersFlat
          )
        )
      );
      
      allow update: 
        if request.auth != null && 
          // Curators can update anything
          // Creators can't update public status or creator or curator list.
          (
            request.auth.uid in resource.data.curators || 
            (
              request.auth.uid in resource.data.creators && 
              request.resource.data.public == resource.data.public && 
              request.resource.data.curators == resource.data.curators && 
              request.resource.data.creators == resource.data.creators
            )
          );
      allow delete: if request.auth != null && request.auth.uid in resource.data.curators;
    }
    match /chats/{chat} {
      // Anyone logged in can create chats
      allow create: if request.auth != null;
      // Participants can read, update, and delete chats
      allow read, update, delete: if request.auth != null && (resource == null || (resource.data != null && request.auth.uid in resource.data.participants));
    }
    match /classes/{class} {
      function isTeacher() { 
        return "teacher" in request.auth.token && request.auth.token.teacher; 
      }

      // Only teachers can create classes
      allow create: if request.auth != null && isTeacher();
      // Students and teachers can read classes
      allow get: if request.auth != null && resource.data != null && (
        ("learners" in resource.data && request.auth.uid in resource.data.learners) || 
        ("teachers" in resource.data && request.auth.uid in resource.data.teachers)
      );
      allow list: if request.auth != null;
      // Only teachers of a class can update and delete classes
      allow update, delete: if request.auth != null && isTeacher() && (resource.data != null && request.auth.uid in resource.data.teachers);
    }
    match /characters/{character} {
      // Anyone logged in can create characters
      allow create: if request.auth != null;
      // Allowed if it doesn't exist or this is the owner asking, Owners or ownerless characters can be read
      allow read: 
        if resource == null ||
          ("public" in resource.data && resource.data.public) || 
          (request.auth != null && 
            (
              ("owner" in resource.data && request.auth.uid == resource.data.owner) ||
              ("collaborators" in resource.data && request.auth.uid in resource.data.collaborators)
            )
          );
      // Only owners can update or delete.
      allow update: if request.auth.uid == resource.data.owner || ("collaborators" in resource.data && request.auth.uid in resource.data.collaborators);
      allow delete: if request.auth.uid == resource.data.owner;
    }
    match /feedback/{id} {
      // Anyone can see feedback
      allow read: if true;
      // Anyone logged in can create feedback
      allow create: if request.auth != null;
      // Only the creator can read, update, or delete their feedback; anyone can vote on the feedback though
      allow update, delete: if request.auth != null && (request.auth.uid == resource.data.creator || ("mod" in request.auth.token && request.auth.token.mod) || request.resource.data.diff(resource.data).affectedKeys().hasOnly(["votes"]));
    }
    match /howtos/{id} {
      function isGalleryPublic(galleryID) {
        let gallery = get(/databases/$(database)/documents/galleries/$(galleryID)).data;
        return gallery != null && "public" in gallery && gallery.public;
      }

      function isRequestorOwnerCollaborator(uid) {
        return resource.data != null && (("creator" in resource.data && uid == resource.data.creator) || ("collaborators" in resource.data && uid in resource.data.collaborators));
      }

      function isRequestorCuratorCollaborator(uid, galleryID) {
        let gallery = get(/databases/$(database)/documents/galleries/$(galleryID)).data;
        return gallery != null && (("curators" in gallery && uid in gallery.curators) || ("creators" in gallery && uid in gallery.creators));
      }

      function isRequestorCurator(uid, galleryID) {
        let gallery = get(/databases/$(database)/documents/galleries/$(galleryID)).data;
        return gallery != null && "curators" in gallery && uid in gallery.curators;
      }

      function isRequestorViewer(uid) {
        return 
          "scopeOverwrite" in resource.data &&
          !resource.data.scopeOverwrite &&
          "viewersFlat" in resource.data && 
          uid in resource.data.viewersFlat;
      }

      allow create: if request.auth != null && "galleryId" in request.resource.data && isRequestorCuratorCollaborator(request.auth.uid, request.resource.data.galleryId);
      // Published how-tos are readable if:
      // 1) the gallery the how-to is in is public
      // 2) the requestor is the owner or a collaborator
      // 3) the requestor is a curator or collaborator of the gallery the how-to is in
      // 4) the requestor is a viewer of the gallery the how-to is in
      // Unpublished how-tos (drafts) are only readable by the creator and collaborators
      allow read: 
        if resource.data != null && (
          (request.auth != null && "mod" in request.auth.token && request.auth.token.mod) ||
          ('isPublic' in resource.data && resource.data.isPublic) ||
          isRequestorOwnerCollaborator(request.auth.uid) ||
          ('galleryId' in resource.data && isGalleryPublic(resource.data.galleryId)) ||
          ("published" in resource.data && resource.data.published && (
            ('galleryId' in resource.data && isRequestorCuratorCollaborator(request.auth.uid, resource.data.galleryId)) ||
            isRequestorViewer(request.auth.uid)
          ))
        );

      allow update: 
      // How-tos can be updated if:
      // 0) a moderator
      // 1) owner or collaborator
      // 2) curator of the gallery the how-to is in
      // we also allow updating the social interactions of a how-to as long as the user can view it (viewer, owner, collaborator, gallery curator or collaborator)
      // and updating xcoord, ycoord by how-to owner/collaborator and gallery curator/collaborator
        if request.auth != null && 
          (
            ("mod" in request.auth.token && request.auth.token.mod) ||
            isRequestorOwnerCollaborator(request.auth.uid) ||
            ("galleryId" in request.resource.data && isRequestorCurator(request.auth.uid, request.resource.data.galleryId)) ||
            ('galleryId' in request.resource.data && 
              (
                (
                  isRequestorCuratorCollaborator(request.auth.uid, request.resource.data.galleryId) || 
                  isRequestorOwnerCollaborator(request.auth.uid)
                ) && 
                request.resource.data.diff(resource.data).affectedKeys().hasOnly(["xcoord", "ycoord"])
              ) ||
              (
                request.resource.data.diff(resource.data).affectedKeys().hasOnly(["social"]) && 
                (
                  isRequestorViewer(request.auth.uid) || 
                  isRequestorCuratorCollaborator(request.auth.uid, request.resource.data.galleryId) || 
                  isRequestorOwnerCollaborator(request.auth.uid)
                )
              )  
            )
          );
      allow delete: if request.auth != null && (resource.data.creator == request.auth.uid || isRequestorCurator(request.auth.uid, resource.data.galleryId));
    }
  }
}