firestore.rules

/**
 * Copyright 2020 The Ground Authors.
 *
 * Licensed under the Apache License, Version 2.0 (the 'License');
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     https://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an 'AS IS' BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

rules_version = '2';

 // Define access rules for Firestore collections and documents.
 service cloud.firestore {
  match /databases/{database}/documents {

    /**
     * Fetches and returns the survey with the specified id.
     */
    function getSurvey(surveyId) {
      let doc = get(/databases/$(database)/documents/surveys/$(surveyId));
      return doc == null ? null : doc.data;
    }

    /**
     * Returns true iff all authenticated users can read and contribute
     * data to the specified survey.
     */
    function isUnlistedOrPublic(survey) {
      return survey["8"] in [
        2 /* UNLISTED */,
        3 /* PUBLIC */
      ];
    }

    /**
     * Returns true iff data collectors can see each others' data.
     */
    function canViewDataCollectedByOthers(survey) {
      return survey["9"] == 2 /* ALL_SURVEY_PARTICIPANTS */
    }

    /**
     * Returns the current user's role in the given survey.
     */
    function getRole(survey) {
      // Get role from `acl` nested object (field 4).
      return survey["4"][request.auth.token.email];
    }

    /**
     * Returns the regular expression matching emails granted access.
     */
    function getPassRegexp() {
      let doc = get(/databases/$(database)/documents/passlist/regexp);
      return doc == null ? null : doc.data.regexp;
    }

    /**
     * Returns true iff the user's email is listed in the passlist or allowed via regex.
     */
    function isPasslisted() {
      let regexp = getPassRegexp();
      return (regexp != null && request.auth.token.email.matches(regexp))
        || exists(/databases/$(database)/documents/passlist/$(request.auth.token.email));
    }

    /**
     * Returns true iff the user is authenticated.
     */
    function isSignedIn() {
      return request.auth != null;
    }

    /**
     * Returns true iff the user with the user's email can read the specified
     * survey.
     */
    function canViewSurvey(survey) {
      return survey != null && isSignedIn() &&
        (isUnlistedOrPublic(survey) || getRole(survey) != null);
    }

    /**
    * Returns true iff user can see each other's lois in the specified
    * survey.
    */
    function canViewLoi(survey, loi) {
      return canViewSurvey(survey) && (isLoiOwner(loi) || canViewDataCollectedByOthers(survey));
    }

    /**
    * Returns true iff user can see each other's submissions in the specified
    * survey.
    */
    function canViewSubmission(survey, submission) {
      return canViewSurvey(survey) && 
        (isSubmissionOwner(submission) || canViewDataCollectedByOthers(survey));
    }

    /**
     * Returns true if the current user has one of the specified roles in the
     * given survey.
     */
    function isOneOf(survey, roles) {
     return survey["4"][request.auth.token.email] in roles;
    }

    /**
     * Returns true if the current user is signed in and has the `SURVEY_ORGANIZER` role
     * in the specified survey. Note that this include survey owners, since they are
     * assigned this role by default.
     */
    function canManageSurvey(survey) {
      return survey != null && isSignedIn() && isOneOf(survey, [
        3 /* SURVEY_ORGANIZER */
      ]);
    }

    /**
     * Returns true iff the current user has the ADMIN user type.
     */
    function isAdmin() {
      let userDoc = get(/databases/$(database)/documents/users/$(request.auth.uid));
      return userDoc != null && userDoc.data.userType == "ADMIN";
    }

    /**
     * Returns true iff the incoming survey data does not set general_access to PUBLIC,
     * or the current user is an admin.
     */
    function canSetGeneralAccess() {
      return request.resource.data["8"] != 3 /* PUBLIC */ || isAdmin();
    }

    /**
     * Returns true iff the current user with the given email can contribute LOIs
     * and submissions to the specified survey.
     */
    function canCollectData(survey) {
      return survey != null && isSignedIn() &&
        (isUnlistedOrPublic(survey) || isOneOf(survey, [
          2 /* DATA_COLLECTOR */,
          3 /* SURVEY_ORGANIZER */
        ]));
    }

    /**
     * Returns true iff the current user is the owner of the specified LOI.
     */
    function isLoiOwner(loi) {
      return loi['5'] == request.auth.uid;
    }

    /**
     * Returns true iff the current user is the owner of the specified submission.
     */
    function isSubmissionOwner(submission) {
      return submission['5'] == request.auth.uid;
    }

    // Allow users to create and update their own profiles in the db, and for all signed in
    // users to see each others' profiles..
    match /users/{userId} {
      allow read: if isSignedIn();
      allow write: if userId == request.auth.uid;
    }

    // All users need to be able to read the passlist for rules to work.
    match /passlist/{entry} {
      // TODO(#1602): Replace "regexp" with simple pattern matching.
      allow read: if isSignedIn() && entry in ['regexp', request.auth.token.email];
    }

    // Apply passlist and survey-level ACLs to survey documents.
    match /surveys/{surveyId} {
      allow create: if isSignedIn() && isPasslisted() && canSetGeneralAccess();
      allow read: if canViewSurvey(resource.data);
      allow update: if canManageSurvey(getSurvey(surveyId)) && canSetGeneralAccess();
      allow delete: if canManageSurvey(getSurvey(surveyId));
    }

    // Allow all signed in users to access Terms of Service and other config.
    match /config/{id} {
      allow read: if isSignedIn();
    }

    // Apply survey-level permissions to LOI documents.
    match /surveys/{surveyId}/lois/{loiId} {
      // Allow if user is owner of the new LOI and can collect data.
      allow create: if isLoiOwner(request.resource.data) && canCollectData(getSurvey(surveyId));
      // Allow if user has read access to the survey and the LOI.
      allow get: if canViewLoi(getSurvey(surveyId), resource.data);
      // Allow all survey users to list LOIs.
      allow list: if canViewSurvey(getSurvey(surveyId));
      // Allow if user is owner of the existing LOI and can collect data, or can manage survey.
      allow update, delete: if (isLoiOwner(resource.data) && canCollectData(getSurvey(surveyId))) || canManageSurvey(getSurvey(surveyId));
    }

    // Apply survey-level permissions to submission documents.
    match /surveys/{surveyId}/submissions/{submissionId} {
      // Allow if user is owner of the new submission and can collect data.
      allow create: if isSubmissionOwner(request.resource.data) && canCollectData(getSurvey(surveyId));
      // Allow if user has read access to the survey and the submission.
      allow get: if canViewSubmission(getSurvey(surveyId), resource.data);
      // Allow all survey users to list submissions.
      allow list: if canViewSurvey(getSurvey(surveyId));
      // Allow if user is owner of the existing submission and can collect data, or can manage survey.
      allow update, delete: if (isSubmissionOwner(resource.data) && canCollectData(getSurvey(surveyId))) || canManageSurvey(getSurvey(surveyId));
    }

    // Apply survey-level permissions to job documents.
    match /surveys/{surveyId}/jobs/{jobId} {
      // Allow if user has read access to the survey.
      allow read: if canViewSurvey(getSurvey(surveyId));
      // Allow if user can manage survey.
      allow write: if canManageSurvey(getSurvey(surveyId));
    }
  }
}