firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    function getLineDataFieldNames()
    {
      return [
        "can_read",
        "can_write",
        "disp_name",
        "tag_list",
        "hashed_read_pw",
        "hashed_write_pw",
        "time_multipl"
        ];
    }

    function hasAllLineDataFields(d)
    {
      return d.keys().hasAll(getLineDataFieldNames());
    }
    function hasOnlyLineDataFields(d)
    {
      return d.keys().hasOnly(getLineDataFieldNames());
    }
    function isValidLineDataFieldTypes(d)
    {
      return (
        d.can_read is list && d.can_read.size() > 0
        && d.can_write is list && d.can_write.size() > 0
        && d.disp_name is string
        && d.tag_list is list
        && d.hashed_read_pw is map
        && d.hashed_write_pw is map
        && d.time_multipl is int
      );
    }
    function can_access(allow_list, req_auth) {
      return ("" in allow_list || (req_auth != null && req_auth.uid in allow_list));
    }
    match /line/{LINE_ID} {
      allow read: if can_access(resource.data.can_read, request.auth);
      allow create: if
        request.auth != null
        && hasAllLineDataFields(request.resource.data)
        && hasOnlyLineDataFields(request.resource.data)
        && isValidLineDataFieldTypes(request.resource.data);
      allow update: if
        can_access(resource.data.can_write, request.auth)
        && hasOnlyLineDataFields(request.resource.data)
        && isValidLineDataFieldTypes(request.resource.data);
      // deleteはadmin-sdkでのみ許可

      function getLineData()
      {
        return get(path(["databases", database, "documents", "line", LINE_ID].join("/"))).data;
      }
      function getTimetableDataFieldNames()
      {
        return [
          "tags",
          "train_id",
          "sec_sys_train_id",
          "sec_sys_sta_pass_setting",
          "direction",
          "radio_ch",
          "line_color",
          "train_type",
          "dep_from_name",
          "dep_from_time",
          "dep_from_track_num",
          "work_to_name",
          "work_to_time",
          "work_to_track_num",
          "last_stop_name",
          "last_stop_time",
          "last_stop_track_num",
          "office_name",
          "work_number",
          "effected_date",
          "additional_info",
          "next_work"
        ];
      }
      function hasAllTimetableDataFields(d)
      {
        return d.keys().hasAll(getTimetableDataFieldNames());
      }
      function hasOnlyTimetableDataFields(d)
      {
        return d.keys().hasOnly(getTimetableDataFieldNames());
      }
      function isValidTimetableDataFieldTypes(d)
      {
        return (
          d.tags is list && d.tags.size() < 16
          && d.train_id is string && d.train_id.size() > 0 && d.train_id.size() < 128
          && d.sec_sys_train_id is string && d.sec_sys_train_id.size() < 128
          && d.sec_sys_sta_pass_setting is bool
          && d.direction is string && (d.direction == "Inbound" || d.direction == "Outbound")
          && d.radio_ch is string && d.radio_ch.size() < 16
          && d.line_color is string && d.line_color.matches("[0-9a-fA-F]{6}")
          && d.train_type is string && d.train_type.size() < 128
          && d.dep_from_name is string && d.dep_from_name.size() < 256
          && d.dep_from_time is timestamp
          && d.dep_from_track_num is string && d.dep_from_track_num.size() < 64
          && d.work_to_name is string && d.work_to_name.size() < 256
          && d.work_to_time is timestamp
          && d.work_to_track_num is string && d.work_to_track_num.size() < 64
          && d.last_stop_name is string && d.last_stop_name.size() < 256
          && d.last_stop_time is timestamp
          && d.last_stop_track_num is string && d.last_stop_track_num.size() < 64
          && d.office_name is string && d.office_name.size() < 128
          && d.work_number is string && d.work_number.size() < 128
          && d.effected_date is timestamp
          && d.additional_info is string && d.additional_info.size() < 1024
          && (d.next_work is path || d.next_work == null)
        );
      }

      match /timetables/{TIMETABLE_ID} {
        allow read: if can_access(getLineData().can_read, request.auth);
        allow create: if
          can_access(getLineData().can_write, request.auth)
          && hasAllTimetableDataFields(request.resource.data)
          && hasOnlyTimetableDataFields(request.resource.data)
          && isValidTimetableDataFieldTypes(request.resource.data);
        allow update: if
          can_access(getLineData().can_write, request.auth)
          && hasOnlyTimetableDataFields(request.resource.data)
          && isValidTimetableDataFieldTypes(request.resource.data);

        function getStationDataFieldNames()
        {
          return [
            "full_name",
            "name_len_4",
            "location",
            "required_time_to_this_sta",
            "arrive_time",
            "departure_time",
            "is_pass",
            "arr_symbol",
            "dep_symbol",
            "track_num",
            "run_in_limit",
            "run_out_limit",
            "sta_work",
            "sta_color"
          ];
        }
        function hasAllStationDataFields(d)
        {
          return d.keys().hasAll(getStationDataFieldNames());
        }
        function hasOnlyStationDataFields(d)
        {
          return d.keys().hasOnly(getStationDataFieldNames());
        }
        function isValidStationDataFieldTypes(d)
        {
          return (
            d.full_name is string && d.full_name.size() > 0 && d.full_name.size() < 256
            && d.name_len_4 is string && d.name_len_4.size() > 0 && d.full_name.size() < 64
            && d.location is number
            && d.required_time_to_this_sta is int && d.required_time_to_this_sta >= 0
            && d.arrive_time is timestamp
            && d.departure_time is timestamp
            && d.is_pass is bool
            && d.arr_symbol is string && d.arr_symbol.size() < 16
            && d.dep_symbol is string && d.dep_symbol.size() < 16
            && d.track_num is string && d.track_num.size() < 64
            && d.run_in_limit is int && d.run_in_limit >= 0
            && d.run_out_limit is int && d.run_out_limit >= 0
            && d.sta_work is string && d.sta_work.size() < 64
            && d.sta_color is string && d.sta_color.matches("[0-9a-fA-F]{6}")
          );
        }

        match /stations/{STATION_ID} {
          allow read: if can_access(getLineData().can_read, request.auth);
          allow create: if
            can_access(getLineData().can_write, request.auth)
            && hasAllStationDataFields(request.resource.data)
            && hasOnlyStationDataFields(request.resource.data)
            && isValidStationDataFieldTypes(request.resource.data);
          allow update: if
            can_access(getLineData().can_write, request.auth)
            && hasOnlyStationDataFields(request.resource.data)
            && isValidStationDataFieldTypes(request.resource.data);
          allow delete: if can_access(getLineData().can_write, request.auth);
        }
      }
    }
  }
}