Spaces:
Running
Running
| rules_version = '2'; | |
| service cloud.firestore { | |
| match /databases/{database}/documents { | |
| // Default deny all | |
| match /{document=**} { | |
| allow read, write: if false; | |
| } | |
| function isSignedIn() { | |
| return request.auth != null; | |
| } | |
| function isValidId(id) { | |
| return id is string && id.size() > 0 && id.size() <= 128 && id.matches('^[a-zA-Z0-9_\\-]+$'); | |
| } | |
| function isAdmin() { | |
| return isSignedIn() && ( | |
| request.auth.token.email == 'bizcaustin@gmail.com' || | |
| request.auth.token.email == 'xaustino@hotmail.com' | |
| ); | |
| } | |
| function isOwner(userId) { | |
| return isSignedIn() && request.auth.uid == userId; | |
| } | |
| // User profiles | |
| match /users/{userId} { | |
| allow read: if isOwner(userId) || isAdmin(); | |
| allow create: if isOwner(userId) && | |
| request.resource.data.uid == userId && | |
| request.resource.data.email is string && | |
| request.resource.data.email.size() <= 256 && | |
| request.resource.data.role in ['trustee', 'co_trustee', 'counsel', 'fiduciary', 'viewer']; | |
| allow update: if (isOwner(userId) || isAdmin()) && | |
| request.resource.data.uid == resource.data.uid; | |
| allow delete: if isAdmin(); | |
| } | |
| // Consolidated court case registry | |
| match /cases/{caseId} { | |
| allow read: if isSignedIn(); | |
| allow create, update: if isSignedIn() && ( | |
| isAdmin() || | |
| (request.resource.data.caseNumber is string && request.resource.data.court is string) | |
| ); | |
| allow delete: if isAdmin(); | |
| } | |
| // Digital Signatures | |
| match /signatures/{signatureId} { | |
| allow read: if isSignedIn(); | |
| allow create: if isSignedIn() && | |
| request.resource.data.uid == request.auth.uid && | |
| request.resource.data.tabId is string && | |
| request.resource.data.pqcHash is string && | |
| request.resource.data.signedAt is string; | |
| allow update, delete: if isAdmin(); | |
| } | |
| // Court Filings & Presentments | |
| match /filings/{filingId} { | |
| allow read: if isSignedIn(); | |
| allow create: if isSignedIn() && | |
| request.resource.data.uid == request.auth.uid && | |
| request.resource.data.recipientCourt is string && | |
| request.resource.data.docketNumber is string; | |
| allow update, delete: if isAdmin(); | |
| } | |
| // Google Workspace Activity Ledger | |
| match /workspace_activity/{activityId} { | |
| allow read: if isSignedIn() && (resource.data.uid == request.auth.uid || isAdmin()); | |
| allow create: if isSignedIn() && | |
| request.resource.data.uid == request.auth.uid && | |
| request.resource.data.action is string; | |
| allow update, delete: if isAdmin(); | |
| } | |
| } | |
| } | |