DeXMart/firestore.rules at master · SplashCodeDex/DeXMart · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    // ── Global helpers ────────────────────────────────────────────────────────
    function isAuthenticated() {
      return request.auth != null;
    }

    function isOwner(userId) {
      return isAuthenticated() && request.auth.uid == userId;
    }

    // ── Legacy tenants root (read-only for migration period) ─────────────────
    // TODO: Remove after migrate-tenants-to-users.ts script has run in prod.
    match /tenants/{tenantId} {
      allow read: if isAuthenticated() && request.auth.token.tenantId == tenantId;
      allow write: if false; // Block all writes to legacy path
    }

    // ── B2C user-scoped data ──────────────────────────────────────────────────
    // All per-user data lives under users/{userId}/...
    // Only the authenticated user owning that userId may read or write.
    match /users/{userId} {
      allow read, write: if isOwner(userId);

      match /channels/{channelId} {
        allow read, write: if isOwner(userId);

        match /auth/{authId} {
          allow read, write: if isOwner(userId);
        }
      }

      match /agents/{agentId} {
        allow read, write: if isOwner(userId);

        match /channels/{channelId} {
          allow read, write: if isOwner(userId);

          match /auth/{authId} {
            allow read, write: if isOwner(userId);
          }
        }
      }

      match /users/{memberId} {
        allow read, write: if isOwner(userId);
      }

      match /groups/{groupId} {
        allow read, write: if isOwner(userId);
      }

      match /contacts/{contactId} {
        allow read, write: if isOwner(userId);
      }

      match /campaigns/{campaignId} {
        allow read, write: if isOwner(userId);
      }

      match /webhooks/{webhookId} {
        allow read, write: if isOwner(userId);
      }

      match /templates/{templateId} {
        allow read, write: if isOwner(userId);
      }

      match /analytics/{analyticsId} {
        allow read, write: if isOwner(userId);
      }

      match /learning/{learningId} {
        allow read, write: if isOwner(userId);
      }

      match /subscriptions/{subscriptionId} {
        allow read, write: if isOwner(userId);
      }

      match /moderation/{moderationId} {
        allow read, write: if isOwner(userId);
      }

      match /violations/{violationId} {
        allow read, write: if isOwner(userId);
      }

      match /audiences/{audienceId} {
        allow read, write: if isOwner(userId);
      }

      match /slots/{slotId} {
        allow read, write: if isOwner(userId);
      }

      match /members/{memberId} {
        allow read, write: if isOwner(userId);
      }

      // Catch-all for any other subcollections under users/{userId}
      match /{subcollection=**} {
        allow read, write: if isOwner(userId);
      }
    }

    // ── Public tenants lookup (subdomain → tenantId resolution) ──────────────
    match /tenants/{tenantId} {
      allow read: if true; // Public for subdomain lookup
    }
  }
}