|
| 1 | +rules_version = '2'; |
| 2 | +service cloud.firestore { |
| 3 | + match /databases/{database}/documents { |
| 4 | + |
| 5 | + // =============================================================== |
| 6 | + // Assumed Data Model |
| 7 | + // =============================================================== |
| 8 | + // Collection: households/{householdId} |
| 9 | + // Document ID: auto-generated or owner's uid |
| 10 | + // Fields: |
| 11 | + // - ownerId: string (required) |
| 12 | + // - cookEmail: string (optional) |
| 13 | + // |
| 14 | + // Collection: households/{householdId}/inventory |
| 15 | + // Document ID: auto-generated or custom string |
| 16 | + // Fields: |
| 17 | + // - name: string (required, max 100 chars) |
| 18 | + // - nameHi: string (optional, max 100 chars) |
| 19 | + // - category: string (required, max 50 chars) |
| 20 | + // - status: string (required, 'in-stock', 'low', 'out') |
| 21 | + // - icon: string (required, max 10 chars) |
| 22 | + // - lastUpdated: string (optional, ISO date) |
| 23 | + // - updatedBy: string (optional, 'owner', 'cook') |
| 24 | + // - verificationNeeded: boolean (optional) |
| 25 | + // - anomalyReason: string (optional, max 500 chars) |
| 26 | + // - defaultQuantity: string (optional, max 50 chars) |
| 27 | + // - requestedQuantity: string (optional, max 50 chars) |
| 28 | + // |
| 29 | + // Collection: households/{householdId}/meals |
| 30 | + // Document ID: YYYY-MM-DD string |
| 31 | + // Fields: |
| 32 | + // - morning: string (optional, max 1000 chars) |
| 33 | + // - evening: string (optional, max 1000 chars) |
| 34 | + // - notes: string (optional, max 1000 chars) |
| 35 | + // - leftovers: string (optional, max 1000 chars) |
| 36 | + // |
| 37 | + // Collection: households/{householdId}/logs |
| 38 | + // Document ID: auto-generated |
| 39 | + // Fields: |
| 40 | + // - itemId: string (required, max 100 chars) |
| 41 | + // - itemName: string (required, max 100 chars) |
| 42 | + // - oldStatus: string (required, 'in-stock', 'low', 'out', '') |
| 43 | + // - newStatus: string (required, 'in-stock', 'low', 'out') |
| 44 | + // - timestamp: string (required, ISO date) |
| 45 | + // - role: string (required, 'owner', 'cook') |
| 46 | + // =============================================================== |
| 47 | + |
| 48 | + function isAuthenticated() { |
| 49 | + return request.auth != null; |
| 50 | + } |
| 51 | + |
| 52 | + function isOwner(householdId) { |
| 53 | + return isAuthenticated() && |
| 54 | + get(/databases/$(database)/documents/households/$(householdId)).data.ownerId == request.auth.uid; |
| 55 | + } |
| 56 | + |
| 57 | + function isCook(householdId) { |
| 58 | + return isAuthenticated() && |
| 59 | + get(/databases/$(database)/documents/households/$(householdId)).data.cookEmail == request.auth.token.email; |
| 60 | + } |
| 61 | + |
| 62 | + function isHouseholdMember(householdId) { |
| 63 | + return isOwner(householdId) || isCook(householdId); |
| 64 | + } |
| 65 | + |
| 66 | + function isValidString(val, minLen, maxLen) { |
| 67 | + return val is string && val.size() >= minLen && val.size() <= maxLen; |
| 68 | + } |
| 69 | + |
| 70 | + function isValidOptionalString(val, minLen, maxLen) { |
| 71 | + return val == null || (val is string && val.size() >= minLen && val.size() <= maxLen); |
| 72 | + } |
| 73 | + |
| 74 | + function isValidInventoryItem(data) { |
| 75 | + return data.keys().hasAll(['name', 'category', 'status', 'icon']) && |
| 76 | + isValidString(data.name, 1, 100) && |
| 77 | + isValidString(data.category, 1, 50) && |
| 78 | + data.status in ['in-stock', 'low', 'out'] && |
| 79 | + isValidString(data.icon, 1, 10) && |
| 80 | + (!('nameHi' in data) || isValidOptionalString(data.nameHi, 0, 100)) && |
| 81 | + (!('lastUpdated' in data) || data.lastUpdated is string) && |
| 82 | + (!('updatedBy' in data) || data.updatedBy in ['owner', 'cook']) && |
| 83 | + (!('verificationNeeded' in data) || data.verificationNeeded is bool) && |
| 84 | + (!('anomalyReason' in data) || isValidOptionalString(data.anomalyReason, 0, 500)) && |
| 85 | + (!('defaultQuantity' in data) || isValidOptionalString(data.defaultQuantity, 0, 50)) && |
| 86 | + (!('requestedQuantity' in data) || isValidOptionalString(data.requestedQuantity, 0, 50)); |
| 87 | + } |
| 88 | + |
| 89 | + function isValidMealPlan(data) { |
| 90 | + return (!('morning' in data) || isValidOptionalString(data.morning, 0, 1000)) && |
| 91 | + (!('evening' in data) || isValidOptionalString(data.evening, 0, 1000)) && |
| 92 | + (!('notes' in data) || isValidOptionalString(data.notes, 0, 1000)) && |
| 93 | + (!('leftovers' in data) || isValidOptionalString(data.leftovers, 0, 1000)); |
| 94 | + } |
| 95 | + |
| 96 | + function isValidPantryLog(data) { |
| 97 | + return data.keys().hasAll(['itemId', 'itemName', 'oldStatus', 'newStatus', 'timestamp', 'role']) && |
| 98 | + isValidString(data.itemId, 1, 100) && |
| 99 | + isValidString(data.itemName, 1, 100) && |
| 100 | + data.oldStatus in ['in-stock', 'low', 'out', ''] && |
| 101 | + data.newStatus in ['in-stock', 'low', 'out'] && |
| 102 | + data.timestamp is string && |
| 103 | + data.role in ['owner', 'cook']; |
| 104 | + } |
| 105 | + |
| 106 | + match /households/{householdId} { |
| 107 | + allow read: if isAuthenticated() && ( |
| 108 | + resource.data.ownerId == request.auth.uid || |
| 109 | + resource.data.cookEmail == request.auth.token.email |
| 110 | + ); |
| 111 | + |
| 112 | + allow create: if isAuthenticated() && |
| 113 | + request.resource.data.ownerId == request.auth.uid; |
| 114 | + |
| 115 | + allow update: if isAuthenticated() && |
| 116 | + resource.data.ownerId == request.auth.uid && |
| 117 | + request.resource.data.ownerId == resource.data.ownerId; |
| 118 | + |
| 119 | + allow delete: if isAuthenticated() && resource.data.ownerId == request.auth.uid; |
| 120 | + |
| 121 | + match /inventory/{itemId} { |
| 122 | + allow read: if isHouseholdMember(householdId); |
| 123 | + allow create: if isHouseholdMember(householdId) && isValidInventoryItem(request.resource.data); |
| 124 | + allow update: if isHouseholdMember(householdId) && isValidInventoryItem(request.resource.data); |
| 125 | + allow delete: if isOwner(householdId); |
| 126 | + } |
| 127 | + |
| 128 | + match /meals/{date} { |
| 129 | + allow read: if isHouseholdMember(householdId); |
| 130 | + allow create: if isOwner(householdId) && isValidMealPlan(request.resource.data); |
| 131 | + allow update: if isOwner(householdId) && isValidMealPlan(request.resource.data); |
| 132 | + allow delete: if isOwner(householdId); |
| 133 | + } |
| 134 | + |
| 135 | + match /logs/{logId} { |
| 136 | + allow read: if isHouseholdMember(householdId); |
| 137 | + allow create: if isHouseholdMember(householdId) && isValidPantryLog(request.resource.data); |
| 138 | + allow update: if false; // Logs are immutable |
| 139 | + allow delete: if isOwner(householdId); |
| 140 | + } |
| 141 | + } |
| 142 | + |
| 143 | + // Keep legacy users path for migration |
| 144 | + match /users/{userId} { |
| 145 | + allow read, write: if isAuthenticated() && request.auth.uid == userId; |
| 146 | + match /{document=**} { |
| 147 | + allow read, write: if isAuthenticated() && request.auth.uid == userId; |
| 148 | + } |
| 149 | + } |
| 150 | + } |
| 151 | +} |
0 commit comments