Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix/firestore security rules #317

Closed
wants to merge 4 commits into from
Closed

Fix/firestore security rules #317

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
86f335e
fix: update security rules to account for new features
Redd87 Dec 18, 2024
f38c195
test: update mock data for new firestore rules
Redd87 Dec 18, 2024
51ca211
fix: fix types, add onlyUpdateSaved and eventUserPicture
Redd87 Dec 18, 2024
c35a9c5
refactor: change variable names
Redd87 Dec 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 14 additions & 2 deletions firebase/tests/firestore-mock-data.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,10 @@ export const aliceAssociation = {
description: "Description",
followersCount: 0,
members: ["alice"],
roles: [],
image: "",
events: [],
principalEmailAddress: "alice@gmail.com"
};

export const aliceEvent = {
Expand All @@ -36,14 +38,18 @@ export const aliceEvent = {
description: "Description",
catchyDescription: "Catchy description",
price: 0.0,
date: new Date(),
startDate: new Date(),
endDate: new Date(),
location: {
name: "Location",
address: "Address",
latitude: 0.0,
longitude: 0.0,
},
types: ["OTHER"],
maxNumberOfPlaces: -1,
numberOfSaved: 0,
eventPictures: []
};

export const otherUser = {
Expand All @@ -69,14 +75,18 @@ export const otherEvent = {
description: "Description",
catchyDescription: "Catchy description",
price: 0.0,
date: new Date(),
startDate: new Date(),
endDate: new Date(),
location: {
name: "Location",
address: "Address",
latitude: 0.0,
longitude: 0.0,
},
types: ["OTHER"],
maxNumberOfPlaces: -1,
numberOfSaved: 0,
eventPictures: []
};

export const otherAssociation = {
Expand All @@ -88,8 +98,10 @@ export const otherAssociation = {
description: "Description",
followersCount: 0,
members: ["other"],
roles: [],
image: "",
events: [],
principalEmailAddress: "otherassociation@gmail.com"
};

export async function setupFirestore(testEnv) {
Expand Down
57 changes: 50 additions & 7 deletions firestore.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ service cloud.firestore {
}
function validate() {
// Check that the association document has the correct fields
let fields = ['uid', 'url', 'name', 'fullName', 'category', 'description', 'followersCount', 'members', 'image', 'events'];
let fields = ['uid', 'url', 'name', 'fullName', 'category', 'description', 'followersCount', 'members', 'roles', 'image', 'events', 'principalEmailAddress'];
let hasCorrectNumberOfFields = request.resource.data.size() == fields.size();
let hasCorrectFields = request.resource.data.keys().hasAll(fields);

Expand All @@ -86,9 +86,11 @@ service cloud.firestore {
request.resource.data.description is string &&
request.resource.data.followersCount is int &&
request.resource.data.followersCount >= 0 &&
request.resource.data.members is list &&
request.resource.data.members is map &&
request.resource.data.roles is map &&
request.resource.data.image is string &&
request.resource.data.events is list;
request.resource.data.events is list &&
request.resource.data.principalEmailAddress is string;
}

allow read: if isVerified();
Expand All @@ -104,9 +106,21 @@ service cloud.firestore {
get(/databases/$(database)/documents/users/$(request.auth.uid)).data.joinedAssociations
);
}
function onlyUpdateSaved() {
// Check that the only updated field is the numberOfSaved field
// and that it was only incremented or decremented by 1
let newCount = request.resource.data.numberOfSaved;
let oldCount = resource.data.numberOfSaved;

let affectedKeys = request.resource.data.diff(resource.data).affectedKeys();
let onlySavedChanged = affectedKeys.hasOnly(['numberOfSaved']);

return onlySavedChanged && (newCount == oldCount || newCount == oldCount + 1 || newCount == oldCount - 1);
}

function validate() {
// Check that the event document has the correct fields
let fields = ['uid', 'title', 'organisers', 'taggedAssociations', 'image', 'description', 'catchyDescription', 'price', 'date', 'location', 'types'];
let fields = ['uid', 'title', 'organisers', 'taggedAssociations', 'image', 'description', 'catchyDescription', 'price', 'startDate', 'endDate', 'location', 'types', 'maxNumberOfPlaces', 'numberOfSaved', 'eventPictures'];
let hasCorrectNumberOfFields = request.resource.data.size() == fields.size();
let hasCorrectFields = request.resource.data.keys().hasAll(fields);

Expand All @@ -123,12 +137,18 @@ service cloud.firestore {
request.resource.data.catchyDescription.size() <= 100 &&
request.resource.data.price is number &&
request.resource.data.price >= 0 &&
request.resource.data.date is timestamp &&
request.resource.data.startDate is timestamp &&
request.resource.data.endDate is timestamp &&
request.resource.data.location is map &&
request.resource.data.location.latitude is number &&
request.resource.data.location.longitude is number &&
request.resource.data.location.name is string &&
request.resource.data.types is list;
request.resource.data.types is list &&
request.resource.data.maxNumberOfPlaces is int &&
request.resource.data.maxNumberOfPlaces >= -1 &&
request.resource.data.numberOfSaved is int &&
request.resource.data.numberOfSaved >= 0 &&
request.resource.data.eventPictures is list;
}

allow read: if isVerified();
Expand All @@ -139,8 +159,31 @@ service cloud.firestore {

// To update or delete an event, the user must be an
// organiser in the existing event document
allow update: if isEventOrganiser(resource.data.organisers) && validate();
allow update: if (isEventOrganiser(resource.data.organisers) || onlyUpdateSaved()) && validate();
allow delete: if isEventOrganiser(resource.data.organisers);
}

match /eventUserPicture/{uid} {
function isAuthor() {
return isVerified() && request.auth.uid == uid;
}

function validate() {
// Check that the eventUserPicture document has the correct fields
let fields = ['uid', 'image', 'author', 'likes'];
let hasCorrectNumberOfFields = request.resource.data.size() == fields.size();
let hasCorrectFields = request.resource.data.keys().hasAll(fields);

return hasCorrectNumberOfFields && hasCorrectFields &&
request.resource.data.uid == uid &&
request.resource.data.image is string &&
request.resource.data.author is string &&
request.resource.data.likes is list;
}
allow read: if isVerified();
allow create: if isVerified() && validate();
allow update: if isAuthor() && validate();
allow delete: if isAuthor();
}
}
}
Loading