firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Make sure the uid of the requesting user matches name of the user document
    // The wildcard {userId} gives us access to that value in a function
    match /users/{userId}/{document=**} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    } 
    match /events/{id} {
      // public, read-only 
      allow read: if true;
      allow write: if false;
    }
    match /generalCourts/{document=**} {
      // public, read-only 
      allow read: if true;
      allow write: if false;
    }
    match /billTracker/{document=**} {
      // public, read-only 
      allow read: if true;
      allow write: if false;
    }
    match /profiles/{uid} {
      function validUser() { // is the user the same as the profile?
        return request.auth.uid == uid
      }

      function doesNotChangeRole() { 
        return !request.resource.data.diff(resource.data).affectedKeys().hasAny(['role'])
      }
      function doesNotChangeNextDigestAt() {
        // Only admins/automatic processes should be able to change the
        // email digest notification times
        return !request.resource.data.diff(resource.data).affectedKeys().hasAny(['nextDigestAt'])
      }
      function doesNotChangePhoneVerified() {
        // Only the completePhoneVerification cloud function (Admin SDK) sets phoneVerified
        return !request.resource.data.diff(resource.data).affectedKeys().hasAny(['phoneVerified'])
      }
      // either the change doesn't include the public field, 
      // or the user is a base user (i.e. not an org)
      function validPublicChange() {
        return !request.resource.data.diff(resource.data).affectedKeys().hasAny(['public'])
          || request.auth.token.get("role", "user") == "user"
      }

      // Always visible to the user and public if `public` is true.
      allow read: if resource.data.public || request.auth.uid == uid
      // Only normal "user" roles & admins can toggle visibility.
      allow create: if validUser() && request.resource.data.role == 'user' && request.resource.data.public == false
      

      // Always readable and writable to admins
      allow read, write: if request.auth.token.get("role", "user") == "admin"

      // Allow users to make updates except to delete their profile or set the role field.
      // Only admins can delete a user profile or set the user role field. 
      allow update: if validUser() && doesNotChangeRole() && validPublicChange() && doesNotChangeNextDigestAt() && doesNotChangePhoneVerified()
    }
    // Allow querying publications individually or with a collection group.
    match /{path=**}/publishedTestimony/{id} {

      // public, read-only. all for admin
      allow read: if true
      allow read, write: if request.auth.token.get("role", "user") == "admin"

    }
    match /reports/{rid} {

      // Anyone can report
      allow create: if true
      // Only admins can do anything with it
      allow read, write: if request.auth.token.get("role", "user") == "admin"
    }
    
    // Admin-managed news collection used by the admin UI and public news page
    match /news/{nid} {
      allow read: if true;
      allow write: if request.auth.token.get("role", "user") == "admin";
    }
    match /users/{uid} {
      allow read, write: if request.auth.token.get("role", "user") == "admin"
      match /draftTestimony/{id} {
        // private, only accessible by the user 
        allow read, write: if request.auth.uid == uid
      }
      match /userNotificationFeed/{id} {
        // TODO: do not allow users to modify content, only view status.
        // private, only accessible by the user
        allow read, write: if request.auth.uid == uid
      }
      match /users/{uid}/activeTopicSubscriptions/{topicName} {
        allow read, write: if debug(request.auth.uid == uid);
      }
      match /archivedTestimony/{id} {
        // Publicly readable, for posterity.
        allow read: if true 
        allow read, write: if request.auth.token.get("role", "user") == "admin"
      }
    }
    match /ballotQuestions/{id} {
      allow read: if true;
      allow write: if false;
    }
    match /lobbyingRegistrants/{id} {
      allow read: if true;
      allow write: if false;
    }
    match /lobbyingFilings/{id} {
      allow read: if true;
      allow write: if false;
    }
    match /lobbyingMeta/{id} {
      allow read: if true;
      allow write: if false;
    }
    match /transcriptions/{tid} {
      // public, read-only
      allow read: if true
      allow write: if false
      
      // public, read-only
      match /utterances/{uid} {
        allow read: if true
        allow write: if false
      }

      // public, read-only
      match /paragraphs/{pid} {
        allow read: if true
        allow write: if false
      }
    }
  }
}