55 lines
1.4 KiB
Plaintext
55 lines
1.4 KiB
Plaintext
rules_version = '2';
|
|
service cloud.firestore {
|
|
match /databases/{database}/documents {
|
|
function signedIn() {
|
|
return request.auth != null;
|
|
}
|
|
|
|
function ownsUser(userId) {
|
|
return signedIn() && request.auth.uid == userId;
|
|
}
|
|
|
|
// Every user-owned document is isolated by the Firebase UID. Cloudflare R2
|
|
// is protected separately by the Worker using the same Firebase ID token.
|
|
match /users/{userId} {
|
|
allow read, write: if ownsUser(userId);
|
|
|
|
match /rides/{rideId} {
|
|
allow read, write: if ownsUser(userId);
|
|
match /events/{eventId} {
|
|
allow read, write: if ownsUser(userId);
|
|
}
|
|
match /performance/{runId} {
|
|
allow read, write: if ownsUser(userId);
|
|
}
|
|
}
|
|
|
|
match /motorcycles/{motorcycleId} {
|
|
allow read, write: if ownsUser(userId);
|
|
}
|
|
|
|
match /trips/{tripId} {
|
|
allow read, write: if ownsUser(userId);
|
|
}
|
|
|
|
match /events/{eventId} {
|
|
allow read, write: if ownsUser(userId);
|
|
}
|
|
|
|
match /friends/{friendId} {
|
|
allow read, write: if ownsUser(userId);
|
|
}
|
|
}
|
|
|
|
// Future public/group collections must be added with explicit field-level
|
|
// authorization. Do not use a global recursive wildcard here.
|
|
match /groupRides/{groupRideId} {
|
|
allow read, write: if false;
|
|
}
|
|
|
|
match /{document=**} {
|
|
allow read, write: if false;
|
|
}
|
|
}
|
|
}
|