firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    function isAdmin() {
      return request.auth != null && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.isAdmin;
    }

    function isAuthenticated() {
      return request.auth != null;
    }

    function documentFieldsCheckOut(requiredFields, optionalFields) {
      let allFields = requiredFields.concat(optionalFields);
      return request.resource.data.keys().hasAll(requiredFields) && request.resource.data.keys().hasOnly(allFields);
    }
    
    function editOnlyChangesField(allowedFields) {
      let affectedKeys = request.resource.data.diff(resource.data).affectedKeys();
      return affectedKeys.hasOnly(allowedFields);
    }

    function userFieldsTypeValidate(docData) {
      return docData.uid is string &&
      docData.about is string &&
      docData.batch is string &&
      docData.branch is string &&
      docData.contact is string &&
      docData.cvLink is string &&
      docData.email is string &&
      docData.fbId is string &&
      docData.instaId is string &&
      docData.isAdmin is bool &&
      docData.isMember is bool &&
      docData.linkedinId is string &&
      docData.name is string &&
      docData.position is string &&
      docData.profileImageUrl is string &&
      docData.quote is string;
    }

    function projectFieldsTypeValidate(docData) {
      return docData.date is string &&
      docData.description is string &&
      docData.fileUrl is string &&
      docData.link is string &&
      docData.name is string &&
      docData.progress is string &&
      docData.projectImg is list &&
      docData.projectImg[0] is string &&
      docData.teamMembers is list &&
      docData.teamMembers[0] is map &&
      docData.teamMembers[0]['linkedinId'] is string &&
      docData.teamMembers[0]['member'] is string;
    }

    function contributorFieldsTypeValidate(docData) {
      return docData.amount is string &&
      docData.date is string &&
      docData.description is string &&
      docData.name is string &&
      docData.representativeImg is string;
    }

    function feedbackFieldsTypeValidate(docData) {
      return docData.dateTime is string &&
      docData.feedback is string &&
      docData.isMember is bool;
    }
    
    function pushTokenFieldsTypeValidate(docData) {
      return docData.androidId is string &&
      docData.createdAt is timestamp &&
      docData.deviceToken is string &&
      docData.platform is string;
    }

    function notificationFieldsTypeValidate(docData) {
      return docData.date is string &&
      docData.link is string &&
      docData.msg is string &&
      docData.title is string;
    }

    function eventFieldsTypeValidate(docData) {
      return docData.date is string &&
      docData.details is string &&
      docData.endTime is string &&
      docData.eventName is string &&
      docData.place is string &&
      docData.posterURL is string &&
      docData.regFormLink is string &&
      docData.isFeatured is bool &&
      docData.startTime is string;
    }

    function downloadFieldsTypeValidate(docData) {
      return docData.items is list &&
      docData.items[0] is map &&
      docData.items[0]['file'] is string &&
      docData.items[0]['name'] is string &&
      docData.items[0]['size'] is string &&
      docData.items[0]['url'] is string &&
      docData.name is string;
    }

    function newsFieldsTypeValidate(docData) {
      return docData.date is string &&
      docData.link is string &&
      docData.notice is string &&
      docData.notification is string &&
      docData.timestamp is number &&
      docData.title is string;
    }

    function roboconFieldsTypeValidate(docData) {
      return docData.about is string &&
      docData.gallery is list &&
      docData.gallery[0] is string &&
      docData.image is string &&
      docData.introduction is string &&
      docData.title is string &&
      docData.video is string;
    }

    function robovoyageFieldsTypeValidate(docData) {
      return docData.about is string &&
      docData.gallery is list &&
      docData.gallery[0] is string &&
      docData.image is string &&
      docData.introduction is string &&
      docData.title is string &&
      docData.video is string;
    }

    function memberFieldsTypeValidate(docData) {
      return docData.timestamp is number &&
      docData.course is string &&
      docData.email is string &&
      docData.paymentStatus is bool &&
      docData.enrollmentNumber is string &&
      docData.facultyNumber is string &&
      docData.mobile is string &&
      docData.name is string &&
      docData.registrationNumber is string
    }

    // Collection Access Rules
    match /users/{userId} {
      allow read;
      allow create: if isAuthenticated() && ( (request.resource.data.uid == request.auth.uid) && (userId == request.auth.uid) ) && documentFieldsCheckOut(["uid", "about", "batch", "branch", "contact", "cvLink", "email", "fbId", "instaId", "interests", "isAdmin", "isMember", "linkedinId", "name", "position", "profileImageUrl", "quote"], []) && userFieldsTypeValidate(request.resource.data);
      allow update: if isAuthenticated() && (isAdmin() || userId == request.auth.uid) && editOnlyChangesField(["about", "batch", "branch", "contact", "cvLink", "fbId", "instaId", "interests", "linkedinId", "name", "position", "profileImageUrl", "quote"]) && userFieldsTypeValidate(request.resource.data);
    }

    match /currentTeam/{singleId} {
      allow read;
    }

    match /contributors/{contributorsId} {
      allow read;
      allow create: if isAdmin() && documentFieldsCheckOut(["amount", "date", "description", "name", "representativeImg"], []) && contributorFieldsTypeValidate(request.resource.data);
      allow update: if isAdmin() && editOnlyChangesField(["amount", "date", "description", "name", "representativeImg"]) && contributorFieldsTypeValidate(request.resource.data);
    }

    match /feedbacks/{feedbacksId} {
      allow read: if isAdmin();
      allow create: if documentFieldsCheckOut(["dateTime", "feedback", "isMember"], []) && feedbackFieldsTypeValidate(request.resource.data) && feedbackFieldsTypeValidate(request.resource.data);
      allow update: if false;
    }

    match /keys/{keyId} {
      allow read: if isAdmin();
    }

    match /projects/{projectsId} {
      allow read;
      allow create: if isAdmin() && documentFieldsCheckOut(["date", "description", "fileUrl", "link", "name", "progress", "projectImg", "teamMembers"], []) && projectFieldsTypeValidate(request.resource.data);
      allow update: if isAdmin() && editOnlyChangesField(["date", "description", "fileUrl", "link", "name", "progress", "projectImg", "teamMembers"]) && projectFieldsTypeValidate(request.resource.data);
    }

    match /pushTokens/{pushTokensId} {
      allow read: if isAdmin();
      allow create: if documentFieldsCheckOut(["androidId", "createdAt", "deviceToken", "platform"], []) && pushTokenFieldsTypeValidate(request.resource.data);
      allow update: if editOnlyChangesField(["androidId", "createdAt", "deviceToken", "platform"]) && request.resource.data.androidId == resource.data.androidId && pushTokenFieldsTypeValidate(request.resource.data);
    }

    match /teams/{teamsId} {
      allow read;
      allow create, update: if false;
    }

    match /tutorials/{tutorialsId} {
      allow read;
      allow create, update: if false;
    }

    match /notifications/{notificationsId} {
      allow read;
      allow create: if isAdmin() && documentFieldsCheckOut(["date", "link", "msg", "title"], []) && notificationFieldsTypeValidate(request.resource.data);
      allow update: if isAdmin() && editOnlyChangesField(["date", "link", "msg", "title"]) && notificationFieldsTypeValidate(request.resource.data);
      allow delete: if isAdmin();
    }

    match /events/{eventsId} {
      allow read;
      allow create: if isAdmin() && documentFieldsCheckOut(["date", "details", "endTime", "eventName", "place", "posterURL", "regFormLink", "startTime", "isFeatured"], []) && eventFieldsTypeValidate(request.resource.data);
      allow update: if isAdmin() && editOnlyChangesField(["date", "details", "endTime", "eventName", "place", "posterURL", "regFormLink", "startTime", "isFeatured"]) && eventFieldsTypeValidate(request.resource.data);
      allow delete: if isAdmin();
    }

    match /downloads/{downloadsId} {
      allow read;
    	allow create: if isAdmin() && documentFieldsCheckOut(["items", "name"], []) && downloadFieldsTypeValidate(request.resource.data);
      allow update: if isAdmin() && editOnlyChangesField(["items", "name"]) && downloadFieldsTypeValidate(request.resource.data);
    }

    match /news/{newsId} {
      allow read;
      allow create: if isAdmin() && documentFieldsCheckOut(["date", "link", "notice", "notification", "timestamp", "title"], ["sent"]) && newsFieldsTypeValidate(request.resource.data);
      allow update: if isAdmin() && editOnlyChangesField(["date", "link", "notice", "notification", "sent", "timestamp", "title"]) && newsFieldsTypeValidate(request.resource.data);
      allow delete: if isAdmin();
    }

    match /robocon/{roboconId} {
      allow read;
      allow create:if isAdmin() && documentFieldsCheckOut(["about", "gallery", "image", "introduction", "title", "video"], []) && roboconFieldsTypeValidate(request.resource.data); 
      allow update: if isAdmin() && editOnlyChangesField(["about", "gallery", "image", "introduction", "title", "video"]) && roboconFieldsTypeValidate(request.resource.data); 
    }

    match /robovoyage/{robovoyageId} {
      allow read;
      allow create:if isAdmin() && documentFieldsCheckOut(["about", "gallery", "image", "introduction", "title", "video"], []) && robovoyageFieldsTypeValidate(request.resource.data); 
      allow update: if isAdmin() && editOnlyChangesField(["about", "gallery", "image", "introduction", "title", "video"]) && robovoyageFieldsTypeValidate(request.resource.data); 
    }

    match /members/{membersId} {
      allow read, delete: if isAdmin();
      allow create: if documentFieldsCheckOut(['timestamp', 'course', 'email', 'paymentStatus', 'enrollmentNumber', 'facultyNumber', 'mobile', 'name', 'registrationNumber'], []) && memberFieldsTypeValidate(request.resource.data);
      allow update: if isAdmin() && editOnlyChangesField(['timestamp', 'course', 'email', 'paymentStatus', 'enrollmentNumber', 'facultyNumber', 'mobile', 'name', 'registrationNumber']) && memberFieldsTypeValidate(request.resource.data);
    }

    match /facultyNumbers/{facultyNumbersId} {
      allow read, create;
      allow delete, update: if isAdmin();
    }

    // Overall default Access
    match /{multisegment=**} {
      allow read: if isAdmin();
      allow create, update, delete: if false;
    }

  }
}