fix: firestore fix some rules

Author: armouldr

firebase/tests/firestore-mock-data.js

@@ -27,7 +27,7 @@ export const aliceAssociation = {
     alice: {
       color: 4294901760,
       displayName: "displayNameRole",
-      permissions: ["Full Rights"],
+      permissions: [""],
     },
   },
   image: "",

firebase/tests/firestore-rules.test.js

@@ -111,30 +111,75 @@ async function runTests(testEnv) {
   );
 
   /** Read and write operations on associations **/
-  /*await assertSucceeds(
+  await assertSucceeds(
     setDoc(
       doc(aliceDb, `/associations/${aliceAssociation.uid}`),
       aliceAssociation
     )
   );
-  await assertFails(setDoc(doc(aliceDb, `/associations/${aliceAssociation.uid}`), { ...aliceAssociation, uid: "other" }));
-  await assertSucceeds(getDoc(doc(aliceDb, `/associations/${aliceAssociation.uid}`)));
-  await assertFails(updateDoc(doc(aliceDb, `/associations/${otherAssociation.uid}`), aliceAssociation));
-  await assertFails(setDoc(doc(aliceDb, `/associations/new-association`), { ...aliceAssociation, uid: "new-association" }));
-  await assertSucceeds(updateDoc(doc(aliceDb, `/associations/${aliceAssociation.uid}`), { ...aliceAssociation, name: "New name" }));
-  await assertSucceeds(updateDoc(doc(aliceDb, `/associations/${otherAssociation.uid}`), { ...otherAssociation, followersCount: 1 }));
-  await assertSucceeds(updateDoc(doc(aliceDb, `/associations/${otherAssociation.uid}`), { ...otherAssociation, followersCount: 0 }));
-  await assertFails(updateDoc(doc(aliceDb, `/associations/${otherAssociation.uid}`), { ...otherAssociation, followersCount: 1000 }));
+  await assertFails(
+    setDoc(doc(aliceDb, `/associations/${aliceAssociation.uid}`), {
+      ...aliceAssociation,
+      uid: "other",
+    })
+  );
+  await assertSucceeds(
+    getDoc(doc(aliceDb, `/associations/${aliceAssociation.uid}`))
+  );
+  await assertFails(
+    updateDoc(
+      doc(aliceDb, `/associations/${otherAssociation.uid}`),
+      aliceAssociation
+    )
+  );
+  await assertFails(
+    setDoc(doc(aliceDb, `/associations/new-association`), {
+      ...aliceAssociation,
+      uid: "new-association",
+    })
+  );
+  await assertSucceeds(
+    updateDoc(doc(aliceDb, `/associations/${aliceAssociation.uid}`), {
+      ...aliceAssociation,
+      name: "New name",
+    })
+  );
+  await assertSucceeds(
+    updateDoc(doc(aliceDb, `/associations/${otherAssociation.uid}`), {
+      ...otherAssociation,
+      followersCount: 1,
+    })
+  );
+  await assertSucceeds(
+    updateDoc(doc(aliceDb, `/associations/${otherAssociation.uid}`), {
+      ...otherAssociation,
+      followersCount: 0,
+    })
+  );
+  await assertFails(
+    updateDoc(doc(aliceDb, `/associations/${otherAssociation.uid}`), {
+      ...otherAssociation,
+      followersCount: 1000,
+    })
+  );
   await assertSucceeds(getDocs(collection(aliceDb, `/associations`)));
-  await assertFails(deleteDoc(doc(aliceDb, `/associations/${aliceAssociation.uid}`)));
-  await assertFails(setDoc(doc(aliceDb, `/associations/new-association`), aliceAssociation));
-  await assertFails(setDoc(doc(aliceDb, `/associations/${aliceAssociation.uid}`), {
-    uid: aliceAssociation.uid
-  }));
-  await assertFails(setDoc(doc(aliceDb, `/associations/${aliceAssociation.uid}`), {
-    ...aliceAssociation,
-    members: "invalid type"
-  }));*/
+  await assertFails(
+    deleteDoc(doc(aliceDb, `/associations/${aliceAssociation.uid}`))
+  );
+  await assertFails(
+    setDoc(doc(aliceDb, `/associations/new-association`), aliceAssociation)
+  );
+  /*await assertFails(
+    setDoc(doc(aliceDb, `/associations/${aliceAssociation.uid}`), {
+      uid: aliceAssociation.uid,
+    })
+  );
+  await assertFails(
+    setDoc(doc(aliceDb, `/associations/${aliceAssociation.uid}`), {
+      ...aliceAssociation,
+      members: "invalid type",
+    })
+  );*/
 
   /** Read and write operations on events **/
   /*await assertSucceeds(setDoc(doc(aliceDb, `/events/${aliceEvent.uid}`), aliceEvent));

firestore.rules

@@ -19,7 +19,7 @@ service cloud.firestore {
 
     match /users/{uid} {
       function isOwner() {
-        return isVerified() && request.auth.uid == uid && request.auth.token.email == request.resource.data.email;
+        return isVerified() && request.auth.uid == uid;
       }
       function validateJoinedAssociations() {
         // Prevent the user from changing the joinedAssociations field
@@ -74,12 +74,12 @@ service cloud.firestore {
       allow list: if isVerified();
       allow delete: if isOwner();
       allow create: if isOwner() && validate();
-      allow update: if (isOwner() || onlySavedEventsUpdated() || onlyFollowedAssociationsUpdated()) && validateJoinedAssociations() && validate();
+      allow update: if (onlySavedEventsUpdated() || onlyFollowedAssociationsUpdated()) && validateJoinedAssociations() && validate() && isOwner();
     }
 
     match /associations/{uid} {
       function isMember() {
-        return get(/databases/$(database)/documents/associations/$(uid)).data.members.hasAny([request.auth.uid]);
+        return get(/databases/$(database)/documents/associations/$(uid)).data.members.keys().hasAny([request.auth.uid]);
       }
       function onlyUpdatedFollowerCount() {
         // Check that the only updated field is the followersCount field