firestore.rules

// ===============================================================
// Assumed Data Model
// ===============================================================
//
// This security rules file assumes the following data structures:
//
// Collection: /collections/{collectionId}
// Document ID: auto-generated
// Fields:
//   - ownerId: string (required, immutable) - The UID of the user who owns this collection
//   - title: string (required, min: 1, max: 100) - The title of the collection
//   - description: string (optional, max: 500) - A brief description of the collection
//   - createdAt: number (required, immutable) - Timestamp of creation
//
// Article: /articles/{articleId}
// Document ID: auto-generated
// Fields:
//   - ownerId: string (required, immutable) - The UID of the user who owns this article
//   - title: string (required, min: 1, max: 200) - The title of the article
//   - url: string (required, isValidUrl) - The original URL of the article
//   - author: string (optional, max: 100) - The author of the article
//   - publicationDate: string (optional, max: 100) - The publication date of the article
//   - content: string (required, max: 1000000) - The extracted Markdown content
//   - collectionId: string (required, immutable) - The ID of the parent collection
//   - isBookmarked: bool (optional) - Whether the article is bookmarked
//   - tags: list (optional, max: 20 items, each max: 50 chars) - List of tags
//   - createdAt: number (required, immutable) - Timestamp of creation
//
// Highlight: /highlights/{highlightId}
// Document ID: auto-generated
// Fields:
//   - ownerId: string (required, immutable) - The UID of the user who owns this highlight
//   - articleId: string (required, immutable) - The ID of the article this highlight belongs to
//   - text: string (required, min: 1, max: 5000) - The highlighted text
//   - createdAt: number (required, immutable) - Timestamp of creation
//
// Note: /notes/{noteId}
// Document ID: auto-generated
// Fields:
//   - ownerId: string (required, immutable) - The UID of the user who owns this note
//   - type: string (required, enum: ['note', 'question', 'comment']) - The type of note
//   - content: string (required, min: 1, max: 5000) - The text content of the note
//   - articleId: string (required, immutable) - The ID of the article this note belongs to
//   - createdAt: number (required, immutable) - Timestamp of creation
//
// ===============================================================

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // ===============================================================
    // Helper Functions
    // ===============================================================

    function isAuthenticated() {
      return request.auth != null;
    }

    function isOwner(ownerId) {
      return isAuthenticated() && request.auth.uid == ownerId;
    }

    function isAdmin() {
      return isAuthenticated() &&
        (get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin' ||
          (request.auth.token.email == "christopherpowell@precisionga.com" && request.auth.token.email_verified == true) ||
          (request.auth.token.email == "cpowell1687@gmail.com" && request.auth.token.email_verified == true));
    }

    function hasRequiredFields(fields) {
      return request.resource.data.keys().hasAll(fields);
    }

    function hasOnlyAllowedFields(fields) {
      return request.resource.data.keys().hasOnly(fields);
    }

    function areImmutableFieldsUnchanged(fields) {
      return !request.resource.data.diff(resource.data).affectedKeys().hasAny(fields);
    }

    function isValidUrl(url) {
      return url is string && (url.matches("^https://.*") || url.matches("^http://.*"));
    }

    function isValidStringLength(field, minLen, maxLen) {
      return request.resource.data[field] is string &&
        request.resource.data[field].size() >= minLen &&
        request.resource.data[field].size() <= maxLen;
    }

    function isValidOptionalString(field, minLen, maxLen) {
      return !(field in request.resource.data) ||
        request.resource.data[field] == null ||
        (request.resource.data[field] is string &&
          request.resource.data[field].size() >= minLen &&
          request.resource.data[field].size() <= maxLen);
    }

    function isValidList(field, maxSize, maxItemSize) {
      return !(field in request.resource.data) ||
        (request.resource.data[field] is list &&
          request.resource.data[field].size() <= maxSize &&
          request.resource.data[field].all(item, item is string && item.size() <= maxItemSize));
    }

    // ===============================================================
    // Domain Validators
    // ===============================================================

    function isValidCollection(data) {
      return hasRequiredFields(['ownerId', 'title', 'createdAt']) &&
        hasOnlyAllowedFields(['ownerId', 'title', 'description', 'createdAt']) &&
        data.ownerId == request.auth.uid &&
        data.title is string && data.title.size() >= 1 && data.title.size() <= 100 &&
        (!( 'description' in data) || (data.description is string && data.description.size() <= 500)) &&
        data.createdAt is number;
    }

    function isValidArticle(data) {
      return hasRequiredFields(['ownerId', 'title', 'url', 'content', 'collectionId', 'createdAt']) &&
        hasOnlyAllowedFields(['ownerId', 'title', 'url', 'content', 'collectionId', 'isBookmarked', 'tags', 'createdAt', 'author', 'publicationDate', 'status']) &&
        data.ownerId == request.auth.uid &&
        data.title is string && data.title.size() >= 1 && data.title.size() <= 200 &&
        (data.url == "" || isValidUrl(data.url)) &&
        isValidOptionalString('author', 0, 100) &&
        isValidOptionalString('publicationDate', 0, 100) &&
        data.content is string && data.content.size() <= 1000000 &&
        data.collectionId is string &&
        (!( 'isBookmarked' in data) || data.isBookmarked is bool) &&
        (!( 'status' in data) || data.status in ['active', 'deleted']) &&
        isValidList('tags', 20, 50) &&
        data.createdAt is number;
    }

    function isValidHighlight(data) {
      return hasRequiredFields(['ownerId', 'articleId', 'text', 'createdAt']) &&
        hasOnlyAllowedFields(['ownerId', 'articleId', 'text', 'createdAt']) &&
        data.ownerId == request.auth.uid &&
        data.articleId is string &&
        data.text is string && data.text.size() >= 1 && data.text.size() <= 5000 &&
        data.createdAt is number;
    }

    function isValidNote(data) {
      return hasRequiredFields(['ownerId', 'type', 'content', 'articleId', 'createdAt']) &&
        hasOnlyAllowedFields(['ownerId', 'type', 'content', 'articleId', 'createdAt']) &&
        data.ownerId == request.auth.uid &&
        data.type in ['note', 'question', 'comment'] &&
        data.content is string && data.content.size() >= 1 && data.content.size() <= 5000 &&
        data.articleId is string &&
        data.createdAt is number;
    }

    // ===============================================================
    // Rules
    // ===============================================================

    match /collections/{collectionId} {
      allow read: if isOwner(resource.data.ownerId) || isAdmin();
      allow create: if isAuthenticated() && isValidCollection(request.resource.data);
      allow update: if isOwner(resource.data.ownerId) && isValidCollection(request.resource.data) && areImmutableFieldsUnchanged(['ownerId', 'createdAt']);
      allow delete: if isOwner(resource.data.ownerId) || isAdmin();
    }

    match /articles/{articleId} {
      allow read: if isOwner(resource.data.ownerId) || isAdmin();
      allow create: if isAuthenticated() && isValidArticle(request.resource.data);
      allow update: if isOwner(resource.data.ownerId) && isValidArticle(request.resource.data) && areImmutableFieldsUnchanged(['ownerId', 'createdAt', 'collectionId']);
      allow delete: if isOwner(resource.data.ownerId) || isAdmin();
    }

    match /notes/{noteId} {
      allow read: if isOwner(resource.data.ownerId) || isAdmin();
      allow create: if isAuthenticated() && isValidNote(request.resource.data);
      allow update: if isOwner(resource.data.ownerId) && isValidNote(request.resource.data) && areImmutableFieldsUnchanged(['ownerId', 'createdAt', 'articleId']);
      allow delete: if isOwner(resource.data.ownerId) || isAdmin();
    }

    match /highlights/{highlightId} {
      allow read: if isOwner(resource.data.ownerId) || isAdmin();
      allow create: if isAuthenticated() && isValidHighlight(request.resource.data);
      allow update: if isOwner(resource.data.ownerId) && isValidHighlight(request.resource.data) && areImmutableFieldsUnchanged(['ownerId', 'createdAt', 'articleId']);
      allow delete: if isOwner(resource.data.ownerId) || isAdmin();
    }

    match /users/{userId} {
      allow read: if isOwner(userId) || isAdmin();
      allow create: if isAuthenticated() && isOwner(userId) && request.resource.data.role == 'user';
      allow update: if isOwner(userId) && request.resource.data.role == resource.data.role;
      allow delete: if isAdmin();
    }

    // Default deny
    match /{path=**} {
      allow read, write: if false;
    }
  }
}