firestore.rules

rules_version='2';

service cloud.firestore {
  match /databases/{database}/documents {



    // **************  Reusable functions ********************
    function isAuthenticated() {
      return request.auth.uid !=null;
    }

    function isAdmin() {
       return isAuthenticated() &&
          get( /databases/$(database)/documents/users/$(request.auth.uid)).data.isAdmin == true;
     }

    function isDarCreator() {
       return isAuthenticated() &&
          get( /databases/$(database)/documents/users/$(request.auth.uid)).data.isDarCreator == true;
     }

    function isActivated() {
       return isAuthenticated() &&
          get( /databases/$(database)/documents/users/$(request.auth.uid)).data.isActivated == true;
     }

    function isDarStakeholder(did)  {
      return request.auth.uid in  get( /databases/$(database)/documents/dars/$(did)).data.darUserIndexes.isStakeholder ;
     }

    function isDarOwner(did)  {
      return request.auth.uid in  get( /databases/$(database)/documents/dars/$(did)).data.darUserIndexes.isOwner   ;
     }

    function isDarEvaluator(did)  {
      return request.auth.uid in  get( /databases/$(database)/documents/dars/$(did)).data.darUserIndexes.isEvaluator   ;
     }

    function isDarReader(did)  {
      return request.auth.uid in  get( /databases/$(database)/documents/dars/$(did)).data.darUserIndexes.isReader   ;
     }

    function isDarVoter(did)  {
      return request.auth.uid in  get( /databases/$(database)/documents/dars/$(did)).data.darUserIndexes.isVoter   ;
     }

     function isDarStatus(did,darStatus) {
        return get( /databases/$(database)/documents/dars/$(did)).data.darStatus == darStatus;  
     }

     
    function updatingField(field) {
      return (field in request.resource.data) && resource.data[field] != request.resource.data[field];
      // or  (but need to call differently) i.e. updatingFields(['email','displayName'])
      // But will stick with the first option
      //return request.resource.data.keys().hasAny(field);
    }

     function isDarUserConfirmationUpdate() {
       // Check that only confirmation  properties are being updated
       return (!updatingField("email") 
        && !updatingField("displayName") 
        && !updatingField("solutionVote") 
        && !updatingField("isEvaluator") 
        && !updatingField("isReader") 
        && !updatingField("isOwner") 
        && !updatingField("isStakeholder") 
        && !updatingField("isVoter") 
       ) ;
     }

     function isDarUserVoteUpdate() {
       // Check that only voting  properties are being updated
       return (!updatingField("email") 
        && !updatingField("displayName") 
        && !updatingField("confirmed") 
        && !updatingField("confirmComment") 
        && !updatingField("isEvaluator") 
        && !updatingField("isReader") 
        && !updatingField("isOwner") 
        && !updatingField("isStakeholder") 
        && !updatingField("isVoter") 
       ) ;
     }

    function isDarStatusUpdate() {
       // Check that only dar status is being updated
      // return true;
       return (!updatingField("title") && 
        !updatingField("description") && 
        !updatingField("dateCreated") && 
        !updatingField("dateTargeted") && 
        !updatingField("dateClosed") && 
        !updatingField("tid") && 
        !updatingField("cause") && 
        !updatingField("darMethod") && 
        !updatingField("risks") && 
        !updatingField("constraints") && 
        !updatingField("dsid") && 
        !updatingField("darUserIndexes")
       ) ;
     }

    function isDarDSIDUpdate() {
      // Check that only dar dsid is being updated
      // return true;
       return (!updatingField("title") && 
        !updatingField("description") && 
        !updatingField("dateCreated") && 
        !updatingField("dateTargeted") && 
        !updatingField("dateClosed") && 
        !updatingField("tid") && 
        !updatingField("cause") && 
        !updatingField("darMethod") && 
        !updatingField("risks") && 
        !updatingField("constraints") && 
        !updatingField("darStatus") && 
        !updatingField("darUserIndexes")
       ) ;
     }
    
    // Dar status values
    function dsDesign() {return 1}
    function dsEvaluate() {return 2}
    function dsVote() {return 3}
    function dsConfirm() {return 4}
    function dsClosed() {return 5}
    function dsDeleted() {return 6}

     function isValidNextDarStatus() {
       // design -> vote or evaluate
       // vote -> confirm or design
       // evaluate -> confirm or vote  or design
       // confirm -> close  or design
       //return true;
       // Note: Could also tighten up by using methodology but probably overkill (You have to be dar owner at least to do any weird workflows)

         return  (resource.data.darStatus == dsDesign() && (request.resource.data.darStatus == dsEvaluate() || request.resource.data.darStatus == dsVote() )) ||
            (resource.data.darStatus == dsVote() && (request.resource.data.darStatus == dsConfirm() || request.resource.data.darStatus == dsDesign() )) ||
             (resource.data.darStatus == dsEvaluate() && (request.resource.data.darStatus == dsVote() || request.resource.data.darStatus == dsConfirm() || request.resource.data.darStatus == dsDesign())) ||
            (resource.data.darStatus == dsConfirm() && (request.resource.data.darStatus == dsClosed() || request.resource.data.darStatus == dsDesign() )) ;
     }

    // ****** Document Access Rules

    // user document rules (Delete not allowed)

    // 1  Own user document:  read/write (except for updates to  isAdmin and isActivated properties)
    //                        special case is create   
    match /users/{user} {
      allow read , create:  if isAuthenticated() &&
                          user==request.auth.uid ;
      allow update: if isAuthenticated() &&
                      user==request.auth.uid &&
                      request.resource.data.isAdmin == resource.data.isAdmin &&
                      request.resource.data.isActivated == resource.data.isActivated;
    }

    // 2 isAdmin :  Other user documents  can read and write 
    // Note: Stonger read security may be needed if the user information
    // is to be locked down (i.e. only let users who are dar owners in the system to do reads.)
    match /users/{user} {
      allow read:  if isAuthenticated();
      allow write:  if isAdmin() &&
                          user!=request.auth.uid ;
    }

    // Team document rules
    // 
    match /teams/{team} {
      allow read:  if isAuthenticated();
      allow write:  if isAdmin() ;
    }

    // Dars document rules
    // !!!Add more conditions about status
    match /dars/{dar} {
      allow read:  if isAuthenticated();
      allow update:  if isAdmin() || 
          (isDarOwner(dar) && isDarStatus(dar,dsDesign())) ||
          (isDarOwner(dar) && isDarDSIDUpdate() && (isDarStatus(dar,dsEvaluate()) || isDarStatus(dar,dsVote()))) ||
          (isDarOwner(dar) && isDarStatusUpdate() && isValidNextDarStatus()) ;
      allow create:  if isAdmin() || isDarCreator();
      allow delete: if isAdmin(); 
    }
        
    // darsolutions document rules
    // 
    match /dars/{dar}/darSolutions/{dsid} {
      allow read:  if isAuthenticated();
      allow write: if isDarOwner(dar) || isAdmin()  
    }
        
    // darCriteria document rules
    // 
    match /dars/{dar}/darCriteria/{dcid} {
      allow read:  if isAuthenticated();
      allow write: if isDarOwner(dar) || isAdmin()  
    }

    // darUsers document rules
    // 
    match /dars/{dar}/darUsers/{duid} {
      allow read:  if isAuthenticated();
      allow update: if (isDarOwner(dar) ||
                        isAdmin()  ||
                        (isDarUserConfirmationUpdate() &&  isDarStakeholder(dar) && isDarStatus(dar,dsConfirm())) ||
                        (isDarUserVoteUpdate() &&  isDarVoter(dar) && isDarStatus(dar,dsVote())) 
                        )  
      allow create:  if isDarOwner(dar) || isAdmin() || isDarCreator();
      allow delete: if isDarOwner(dar) || isAdmin(); 
    }

    // darEvaluations document rules
    // 
    match /dars/{dar}/darSolutions/{dsid}/darEvaluations/{dcid} {
      allow read:  if isAuthenticated();
      allow update: if  isAdmin() || (isDarEvaluator(dar) && isDarStatus(dar,dsEvaluate())) ;
      allow create: if  isAdmin() || (isDarEvaluator(dar) && isDarStatus(dar,dsEvaluate())) ;
      allow delete: if  isAdmin() ;
    }

    // for the subcollection index
    match /{path=**}/darEvaluations/{dcid} {
      allow read:  if isAuthenticated();
    }

    // Let anyone read the youtubevideos documents (Used to populate the help component)
    match /YouTubeVideos/{youtubevideo} {
          allow read:  if true ;
        }
        

        

    // general rule - only logged on users can access any firestore document
    // match /{document=**} {
    //   allow read, write: if request.auth.uid != null;
    // }
  }
}