firestore.rules

// NOTE: to deploy only these rules run
// `firebase deploy --only firestore:rules`

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // by default lock out all client access to all documents
    match /{document=**} {
      allow read, write: if false;
    }

    match /sources/{source}/resources/{document=**} {
      // allows anonymous user to get the resource structure
      allow read: if true;
    }

    //
    //  -----------  Student Work -------------
    //

    function teacherOfContext() {
      return request.auth.token.user_type == 'teacher'
        && request.auth.token.class_hash == resource.data.context_id
        && request.auth.token.platform_id == resource.data.platform_id;
    }

    function researcherOfContext() {
      return request.auth.token.user_type == 'researcher'
        && request.auth.token.class_hash == resource.data.context_id
        && request.auth.token.platform_id == resource.data.platform_id;
    }

    // Check if answer has been explicitly shared by the owner of the answer (shared_with: context) and
    // if the user who is trying to read the answer is member of the same context as the author.
    function answerSharedAndMemberOfContext() {
      return request.auth.token.class_hash == resource.data.context_id
        && request.auth.token.platform_id == resource.data.platform_id
        && resource.data.shared_with == "context";
    }

    // Note: this conditional is used in read rules, which do not require a
    // matching context_id, so the context_id is not enforced here
    function learnerOwner(res) {
      return request.auth.token.user_type == 'learner'
        && string(request.auth.token.platform_user_id) == string(res.data.platform_user_id)
        && request.auth.token.platform_id == res.data.platform_id;
    }

    // Check for researchers: users with a class_hash and target_user_id
    function researcherOfOwner(res) {
      return request.auth.token.user_type == 'user'
        && string(request.auth.token.target_user_id) == string(res.data.platform_user_id)
        && request.auth.token.class_hash == res.data.context_id
        && request.auth.token.platform_id == res.data.platform_id;
    }

    function notChangingIdentifyingProps() {
      // Make sure the learner isn't changing the document's identifying properties
      return string(request.resource.data.platform_user_id) == string(request.auth.token.platform_user_id)
        && request.resource.data.platform_id == request.auth.token.platform_id
        // no changing the document's context outside of the learner's context
        && request.resource.data.context_id == request.auth.token.class_hash
        // no changing the document's context from what it was before
        // this could only happen if learner got access to an existing document in a different context
        && request.resource.data.context_id == resource.data.context_id;
        // This implicitly also means that
        // request.auth.token.class_hash == resource.data.context_id
    }

    // Check the owner of the request.resource and
    // enforce the context_id matches the auth info
    function learnerOwnerCreate() {
      return learnerOwner(request.resource)
        // the platform_id is checked in the learnerOwner check
        && request.auth.token.class_hash == request.resource.data.context_id;
    }

    function anonymousCreate() {
      return ('run_key' in request.resource.data)
        && request.resource.data.run_key.size() > 10
        // Make sure anonymous answers don't have platform_ids
        && !('platform_id' in request.resource.data);
    }

    // Anyone can read any anonymous docs with a valid run_key
    function anonymousRead() {
      return ('run_key' in resource.data)
        && resource.data.run_key.size() > 10
    }

    function anonymousUpdate() {
      return ('run_key' in resource.data)
        && resource.data.run_key.size() > 10
        // Make sure they can't change the run key of an existing document
        && resource.data.run_key == request.resource.data.run_key
        // Make sure anonymous answers don't have platform_ids
        && !('platform_id' in request.resource.data);
    }

    function studentWorkCreate() {
      return anonymousCreate()
        || learnerOwnerCreate();
    }

    function studentWorkRead() {
      return anonymousRead()
        || teacherOfContext()
        || researcherOfContext()
        || answerSharedAndMemberOfContext()
        || learnerOwner(resource)
        || researcherOfOwner(resource);
    }

    function studentWorkUpdate() {
      return anonymousUpdate()
        || (learnerOwner(resource) && notChangingIdentifyingProps());
    }

    match /sources/{source}/answers/{document=**} {
      allow create: if studentWorkCreate();
      allow read: if studentWorkRead();
      allow update: if studentWorkUpdate();
    }

    match /sources/{source}/plugin_states/{document=**} {
      allow create: if studentWorkCreate();
      allow read: if studentWorkRead();
      allow update: if studentWorkUpdate();
    }

    match /sources/{source}/ap_runs/{document=**} {
      allow create: if studentWorkCreate();
      allow read: if studentWorkRead();
      allow update: if studentWorkUpdate();
    }


    //
    //  -----------  User Settings -------------
    //

    // This is a collection in which teachers can write their own documents
    //
    // Security: the path here is what restricts access. But we are only checking
    //   the user_id. The source in this case is based on the platform_id so
    //   we might be able to extend the rule to check that.
    //
    match /sources/{source}/user_settings/{user_id}/resource_link/{document=**} {
      allow read, create, update: if request.auth.token.user_type == 'teacher' &&
        string(request.auth.token.platform_user_id) == string(user_id);
    }

    // This let us test the report settings with fake portal data:
    match /sources/fake.portal/user_settings/1/resource_link/1 {
      allow read, create, update: if true;
    }

    //
    //  -----------  Feedback -------------
    //

    // Note: the feedback documents use camelCase instead of snake_case like the
    //   student work documents

    // Security: teachers can create feedback documents for any student in their
    //   authorized platform. These documents are required to have the teacher's
    //   authorized contextId in them, but when students list their feedbacks
    //   they do not include the contextId.

    function authorizedContext(res) {
      return request.auth.token.platform_id == res.data.platformId
        && request.auth.token.class_hash == res.data.contextId;
    }

    function authorizedStudent() {
      return string(request.auth.token.platform_user_id) == string(resource.data.platformStudentId)
        && request.auth.token.platform_id == resource.data.platformId;
    }

    function authorizedTarget() {
      return string(request.auth.token.target_user_id) == string(resource.data.platformStudentId)
        && request.auth.token.platform_id == resource.data.platformId;
    }

    // Make sure teachers can only create feedbacks in their current context
    function feedbackCreate() {
      return request.auth.token.user_type == 'teacher'
        && authorizedContext(request.resource);
    }

    // learners can only read feedbacks directed at them
    // teachers and researchers can read all feedbacks in their context
    // users need a context and target and can only read feedback in that context for that target
    // Note: this isn't used for feedback settings
    function feedbackRead() {
      return (request.auth.token.user_type == 'teacher' && authorizedContext(resource))
        || (request.auth.token.user_type == 'researcher' && authorizedContext(resource))
        || (request.auth.token.user_type == 'learner' && authorizedStudent())
        || (request.auth.token.user_type == 'user' && authorizedTarget() && authorizedContext(resource)) ;
    }

    // Make sure the teacher can't change the identifying properties of
    // platformId and contextId
    // Make sure the teacher can't update documents that don't match their
    // current authorized platformId and contextId
    function feedbackUpdate() {
      return request.auth.token.user_type == 'teacher'
        && authorizedContext(resource)
        && authorizedContext(request.resource);
    }

    match /sources/{source}/question_feedbacks/{document=**} {
      allow create: if feedbackCreate();
      allow read: if feedbackRead();
      allow update: if feedbackUpdate();
    }

    match /sources/{source}/activity_feedbacks/{document=**} {
      allow create: if feedbackCreate();
      allow read: if feedbackRead();
      allow update: if feedbackUpdate();
    }

    match /sources/{source}/feedback_settings/{document=**} {
      allow create: if feedbackCreate();
      // Anyone can read the settings if they are authorized for the context
      allow read: if authorizedContext(resource);
      allow update: if feedbackUpdate();
    }

    // This let us test the report feedback with fake portal data:
    match /sources/fake.authoring.system/question_feedbacks/{document=**} {
      allow read, create, update: if true;
    }
    match /sources/fake.authoring.system/activity_feedbacks/{document=**} {
      allow read, create, update: if true;
    }
    match /sources/fake.authoring.system/feedback_settings/{document=**} {
      allow read, create, update: if true;
    }
  }
}