blend-design-system/firestore.rules at dev · juspay/blend-design-system · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // ═══════════════════════════════════════════════════════════════════════════
    // ARCHITECTURE NOTE
    // ═══════════════════════════════════════════════════════════════════════════
    //
    // PostgreSQL (managed separately):
    //   - Users, Teams, Memberships
    //   - Roles, Permissions
    //   - Authentication
    //   - Fuzzy search
    //
    // Firestore (this file):
    //   - Brand configs (JSON blobs)
    //   - Branches
    //   - Versions (immutable)
    //   - Snapshots
    //
    // ═══════════════════════════════════════════════════════════════════════════

    // ── Branches ──────────────────────────────────────────────────────────────
    // Structure:
    //   /branches/{branchId}                        ← brand config
    //   /branches/{branchId}/versions/{versionId}   ← published versions
    //   /branches/{branchId}/snapshots/{snapshotId} ← auto-saved drafts
    //
    // Security:
    //   - Authenticated users can read all branches
    //   - Branch owner (user uid) can write
    //   - Team members can write based on role (checked via owner.teamId)
    // ────────────────────────────────────────────────────────────────────────

    match /branches/{branchId} {
      // Read: Any authenticated user
      allow read: if request.auth != null;

      // Create: Any authenticated user
      allow create: if
        request.auth != null &&
        request.resource.data.keys().hasAll(['id', 'name', 'owner', 'brandConfig']);

      // Update: Owner only (team access checked in app layer)
      allow update: if
        request.auth != null &&
        resource.data.owner.uid == request.auth.uid;

      // Delete: Owner only
      allow delete: if
        request.auth != null &&
        resource.data.owner.uid == request.auth.uid;

      // Published versions (immutable)
      match /versions/{versionId} {
        allow read: if request.auth != null;
        allow create: if
          request.auth != null &&
          get(/databases/$(database)/documents/branches/$(branchId)).data.owner.uid == request.auth.uid;
        allow update, delete: if false;
      }

      // Auto-saved snapshots
      match /snapshots/{snapshotId} {
        allow read: if request.auth != null;
        allow create, update, delete: if
          request.auth != null &&
          get(/databases/$(database)/documents/branches/$(branchId)).data.owner.uid == request.auth.uid;
      }
    }

    // ── Telemetry (existing) ─────────────────────────────────────────────────

    match /blend-telemetry/{repoId} {
      allow create, update: if
        request.auth != null &&
        request.resource.data.keys().hasAll(['repoId', 'repoName', 'lastUpdated']) &&
        request.resource.data.repoId == repoId &&
        request.resource.data.repoId is string &&
        request.resource.data.repoName is string &&
        request.resource.data.repoId.size() <= 400 &&
        request.resource.data.repoName.size() <= 400 &&
        request.resource.data.size() <= 20;
      allow read, delete: if false;
    }

    match /blend-telemetry/{repoId}/runs/{runId} {
      allow create: if
        request.auth != null &&
        request.resource.data.keys().hasAll([
          'repoId', 'repoName', 'generatedAt',
          'adoptionRate', 'totalComponentsUsed'
        ]) &&
        request.resource.data.repoId == repoId &&
        request.resource.data.repoId is string &&
        request.resource.data.repoName is string &&
        request.resource.data.generatedAt is string &&
        request.resource.data.adoptionRate is number &&
        request.resource.data.totalComponentsUsed is number &&
        request.resource.data.repoId.size() <= 400 &&
        request.resource.data.repoName.size() <= 400 &&
        request.resource.data.size() <= 50;
      allow read, delete: if false;
    }

    // Deny everything else
    match /{document=**} {
      allow read, write: if false;
    }
  }
}