motorsignal
/
MotorSignal-App
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Harden Firestore ride ownership and stable identity rules

This commit is contained in:
bponders12-cell 2026-09-01 21:00:17 -04:00
parent de516d023e
commit 38dc8bfc14
1 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
firestore.rules
View File

@ -28,6 +28,19 @@ service cloud.firestore {
]); ]);
} }
function validRideCreate(userId, rideId) {
return ownsUser(userId)
&& request.resource.data.ownerId == userId
&& request.resource.data.id == rideId;
}
function validRideUpdate(userId) {
return ownsUser(userId)
&& resource.data.ownerId == userId
&& request.resource.data.ownerId == resource.data.ownerId
&& request.resource.data.id == resource.data.id;
}
match /users/{userId} { match /users/{userId} {
allow create: if validUserCreate(userId); allow create: if validUserCreate(userId);
allow read: if ownsUser(userId); allow read: if ownsUser(userId);
@ -35,7 +48,10 @@ service cloud.firestore {
allow delete: if ownsUser(userId); allow delete: if ownsUser(userId);
match /rides/{rideId} { match /rides/{rideId} {
allow read, write: if ownsUser(userId); allow create: if validRideCreate(userId, rideId);
allow update: if validRideUpdate(userId);
allow read, delete: if ownsUser(userId) && resource.data.ownerId == userId;
match /events/{eventId} { match /events/{eventId} {
allow read, write: if ownsUser(userId); allow read, write: if ownsUser(userId);
} }