Security Rules — az utolsó vonal

rules_version = '2';                       // always 2 on new projects

service cloud.firestore {                  // which service
  match /databases/{database}/documents {  // root

    match /posts/{postId} {                // collection + doc
      allow read:   if true;               // anyone can read
      allow create: if request.auth != null;
      allow update: if request.auth.uid == resource.data.authorId;
      allow delete: if request.auth.token.role == 'admin';
    }
  }
}

match /users/{uid} {
  allow read, write: if request.auth.uid == uid;
}

match /tenants/{tid}/orders/{oid} {
  allow read: if request.auth.token.tenantId == tid;
}

match /tenants/{tid}/{document=**} {
  allow read: if request.auth.token.tenantId == tid;
}

match /tenants/{tid} {
  // Only members can read the tenant doc
  allow read: if isMember(tid);

  match /orders/{oid} {
    allow read: if isMember(tid);
    allow write: if isAdmin(tid);
  }

  match /products/{pid} {
    allow read: if isMember(tid);
    allow write: if isAdmin(tid);
  }
}

match /orders/{oid} {
  // CREATE — no resource yet, only request.resource
  allow create: if request.auth != null
             && request.resource.data.userId == request.auth.uid
             && request.resource.data.status == 'pending';

  // UPDATE — both resource (old) and request.resource (new)
  allow update: if resource.data.userId == request.auth.uid                 // owner only
             && request.resource.data.userId == resource.data.userId;       // userId must not change

  // DELETE — only resource is present
  allow delete: if resource.data.userId == request.auth.uid;
}

// Anyone signed in
allow read: if request.auth != null;

// Only this specific user
allow read: if request.auth.uid == resource.data.ownerId;

// Only verified-email users
allow read: if request.auth.token.email_verified == true;

match /admin/{document=**} {
  allow read, write: if request.auth.token.role == 'admin';
}

match /tenants/{tid}/{document=**} {
  allow read, write: if request.auth.token.tenantId == tid
                  && request.auth.token.role in ['admin', 'member'];
}

// The field exists and is a string
request.resource.data.title is string

// The field is a number between 0 and 1000
request.resource.data.price is number
&& request.resource.data.price >= 0
&& request.resource.data.price <= 1000

// The field exists at all
request.resource.data.keys().hasAll(['title', 'price'])

// Only these fields may be present (no extras)
request.resource.data.keys().hasOnly(['title', 'price', 'authorId'])

// Title between 5 and 200 characters
request.resource.data.title.size() >= 5
&& request.resource.data.title.size() <= 200

// Email regex
request.resource.data.email.matches('^[^@]+@[^@]+\\.[^@]+$')

// Slug format
request.resource.data.slug.matches('^[a-z0-9]+(-[a-z0-9]+)*$')

match /orders/{oid} {
  allow update: if request.auth != null
             && request.resource.data.userId == resource.data.userId
             && request.resource.data.createdAt == resource.data.createdAt
             && request.resource.data.tenantId == resource.data.tenantId;
}

// Only the 'status' and 'updatedAt' fields may change
allow update: if request.resource.data.diff(resource.data)
                .affectedKeys()
                .hasOnly(['status', 'updatedAt']);

match /tenants/{tid}/orders/{oid} {
  // Only if the user is a member of the tenant (member doc exists)
  allow read: if exists(/databases/$(database)/documents/tenants/$(tid)/members/$(request.auth.uid));

  // Only if the member is in the admin role
  allow write: if get(/databases/$(database)/documents/tenants/$(tid)/members/$(request.auth.uid))
                .data.role == 'admin';
}

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    // --- Helper functions ---
    function isSignedIn() {
      return request.auth != null;
    }

    function isOwner(userId) {
      return isSignedIn() && request.auth.uid == userId;
    }

    function hasRole(role) {
      return isSignedIn() && request.auth.token.role == role;
    }

    function isMember(tid) {
      return isSignedIn() && request.auth.token.tenantId == tid;
    }

    function unchanged(field) {
      return request.resource.data[field] == resource.data[field];
    }

    // --- Rules ---
    match /tenants/{tid}/orders/{oid} {
      allow read:   if isMember(tid);
      allow create: if isMember(tid)
                 && request.resource.data.userId == request.auth.uid;
      allow update: if isMember(tid)
                 && unchanged('userId')
                 && unchanged('createdAt');
      allow delete: if hasRole('admin');
    }
  }
}

import { initializeTestEnvironment, assertSucceeds, assertFails } from '@firebase/rules-unit-testing';
import { setDoc, doc, getDoc } from 'firebase/firestore';
import fs from 'node:fs';

let testEnv: Awaited<ReturnType<typeof initializeTestEnvironment>>;

beforeAll(async () => {
  testEnv = await initializeTestEnvironment({
    projectId: 'demo-project',
    firestore: { rules: fs.readFileSync('firestore.rules', 'utf8') },
  });
});

afterAll(() => testEnv.cleanup());
beforeEach(() => testEnv.clearFirestore());

describe('orders/{oid}', () => {
  it('only the owner can read', async () => {
    // Seed: order belonging to usr_alice
    await testEnv.withSecurityRulesDisabled(async (ctx) => {
      await setDoc(doc(ctx.firestore(), 'orders/ord_001'), {
        userId: 'usr_alice', total: 12990,
      });
    });

    // Alice can read
    const alice = testEnv.authenticatedContext('usr_alice').firestore();
    await assertSucceeds(getDoc(doc(alice, 'orders/ord_001')));

    // Bob cannot
    const bob = testEnv.authenticatedContext('usr_bob').firestore();
    await assertFails(getDoc(doc(bob, 'orders/ord_001')));

    // Anonymous cannot
    const guest = testEnv.unauthenticatedContext().firestore();
    await assertFails(getDoc(doc(guest, 'orders/ord_001')));
  });
});

match /notes/{noteId} {
  allow read, update, delete: if isOwner(resource.data.userId);
  allow create: if isOwner(request.resource.data.userId);
}

match /articles/{articleId} {
  allow read:   if true;                       // public
  allow create: if hasRole('editor') || hasRole('admin');
  allow update: if hasRole('editor') || hasRole('admin');
  allow delete: if hasRole('admin');
}

match /tenants/{tid}/{document=**} {
  allow read:  if isMember(tid);
  allow write: if isMember(tid);
}

// Tenant-bound member list needs its own rule
match /tenants/{tid}/members/{uid} {
  allow read:  if isMember(tid);
  allow write: if isMember(tid) && hasRole('admin');
}

match /posts/{postId} {
  allow read: if resource.data.deletedAt == null
           || hasRole('admin');    // admin sees everything
}

match /items/{itemId} {
  allow create: if request.resource.data.createdAt == request.time
             && request.resource.data.updatedAt == request.time;

  allow update: if unchanged('createdAt')
             && request.resource.data.updatedAt == request.time;
}

match /profiles/{uid} {
  allow read:  if true;
  allow write: if isOwner(uid);
}

match /{document=**} {
  allow read, write: if true;     // EVERYTHING is open!
}

// WRONG: on update this checks the old userId, but the client may send a new one
allow update: if resource.data.userId == request.auth.uid;

// RIGHT: check that the old userId matches AND the new one didn't change
allow update: if resource.data.userId == request.auth.uid
           && unchanged('userId');

// Every read = +1 read — a 100-doc list means +100 reads!
allow read: if get(/databases/$(database)/documents/users/$(request.auth.uid))
             .data.subscription == 'pro';

// RIGHT: put subscription into a custom claim — Rules read it for free
allow read: if request.auth.token.subscription == 'pro';