UrbanRobot/firebase_rules.json at master · saoc90/UrbanRobot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
{
    "rules": {
        /* unternehmen, read alle Personen des Unternehmens, write alle admins des Unternehmens */
        "unternehmen": {
            "$company": {
                ".read": "root.child('users').child(auth.uid).child('company').val()===$company",
                ".write": "(root.child('users').child(auth.uid).child('company').val()===$company && root.child('users').child(auth.uid).child('role').val()==='admin') || root.child('admins').hasChild(auth.uid)",
                ".validate": "newData.hasChildren(['id','name','users'])",
                "$id": {
                    "id": {
                        ".validate": "newData.isString() && newData.val() === $id"
                    },
                    "name": {
                        ".validate": "newData.isString()"
                    },
                    "users": {
                        "$cmpuid": {
                            ".validate": "newData.hasChildren(['email','isDeleted','role','uid'])",
                            "email": {
                                ".validate": "newData.isString()"
                            },
                            "isDeleted": {
                                ".validate": "newData.isBoolean()"
                            },
                            "role": {
                                ".validate": "newData.isString() && (newData.val()==='admin' || newData.val()==='inventor' || newData.val()==='visitor' || newData.val()==='administrator')"
                            },
                            "uid": {
                                ".validate": "newData.isString()"
                            },
                            "$other": {
                                ".validate": false
                            }
                        }
                    } /*,  --bug beim Anlegen von neuen Benutzern
                    "$other": {
                        ".validate": false
                    }*/
                },
                "isDeactivated": {
                    ".validate": "newData.isBoolean()"
                }
            }
        },
        /* unternehmenObj, read alle Personen des Unternehmens, write alle admins */
        /* unternehmenObj/lastScan,scanRequested,scandata write alle inventors */
        "unternehmenObj": {
            "$company": {
                ".read": "root.child('users').child(auth.uid).child('company').val()===$company",
                ".write": "root.child('users').child(auth.uid).child('company').val()===$company && root.child('users').child(auth.uid).child('role').val()==='admin'",
                "lastScan": {
                    ".write": "root.child('users').child(auth.uid).child('company').val()===$company && root.child('users').child(auth.uid).child('role').val()==='inventor'",
                    "clientCountDiff": {
                        ".validate": "newData.isNumber()"
                    },
                    "timeStamp": {
                        ".validate": "newData.isString()"
                    },
                    "inventory": {
                        ".validate": true
                    },
                    "hasFailed": {
                        ".validate": "newData.isBoolean()"
                    },
                    "$other": {
                        ".validate": false
                    }
                },
                "scanRequested": {
                    ".write": "root.child('users').child(auth.uid).child('company').val()===$company && root.child('users').child(auth.uid).child('role').val()==='inventor'",
                    ".validate": "newData.isNumber() || newData.isBoolean()"
                },
                "scandata": {
                    ".write": "root.child('users').child(auth.uid).child('company').val()===$company && root.child('users').child(auth.uid).child('role').val()==='inventor'"
                },
                "systemStatus": {
                    ".write": "root.child('users').child(auth.uid).child('company').val()===$company && root.child('users').child(auth.uid).child('role').val()==='inventor'",
                    "scanErrors": {
                        ".validate": "newData.isNumber()"
                    },
                    "scans": {
                        ".validate": "newData.isNumber()"
                    },
                    "systemLoad": {
                        ".validate": "newData.isNumber()"
                    },
                    "systemStatus": {
                        ".validate": "newData.isString()"
                    },
                    "$other": {
                        ".validate": false
                    }
                }
            }
        },
        /* users */
        "users": {
            "$uid": {
                ".read": "auth.uid === $uid || root.child('users').child(auth.uid).child('company').val()===root.child('users').child($uid).child('company').val()",
                ".write": "auth.uid === $uid || (root.child('users').child(auth.uid).child('company').val()===newData.child('company').val() && root.child('users').child(auth.uid).child('role').val()==='admin')",
                ".validate": "newData.hasChildren(['company','role','uid'])",
                "company": {
                    ".validate": "newData.isString()"
                },
                "role": {
                    ".validate": "newData.isString() && (newData.val()==='admin' || newData.val()==='inventor' || newData.val()==='visitor' || newData.val()==='administrator')"
                },
                "uid": {
                    ".validate": "newData.isString() && newData.val()===$uid"
                },
                "$other": {
                    ".validate": false
                }
            }
        },
        /* admin (god) Benutzer, werden von Hand zugewiesen und haben Zugriff auf _alles_ */
        ".read": "root.child('admins').hasChild(auth.uid)",
        ".write": "root.child('admins').hasChild(auth.uid)"
    }
}