RUXAILAB/storage.rules at develop · ruxailab/RUXAILAB · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    function signedIn() {
      return request.auth != null;
    }

    function currentUser() {
      return firestore.get(
        /databases/(default)/documents/users/$(request.auth.uid)
      );
    }

    function isSuperAdmin() {
      return signedIn() &&
        currentUser().data != null &&
        currentUser().data.accessLevel == 0;
    }

    function study(studyId) {
      return firestore.get(
        /databases/(default)/documents/tests/$(studyId)
      ).data;
    }

    function roleFor(studyId) {
      return signedIn() &&
        study(studyId).studyRoleMap is map &&
        request.auth.uid in study(studyId).studyRoleMap
          ? study(studyId).studyRoleMap[request.auth.uid]
          : null;
    }

    function canAccessStorage(studyId) {
      return signedIn() && (
        isSuperAdmin() ||
        study(studyId).testAdmin.userDocId == request.auth.uid ||
        roleFor(studyId) == 0
      );
    }

    function isPublicStudy(studyId) {
      return study(studyId).get('isPublic', false) == true;
    }

    function canAnswerStudy(studyId, userId) {
      let studyData = study(studyId);
      let role = roleFor(studyId);
      return signedIn() && userId == request.auth.uid && (
        isPublicStudy(studyId) ||
        (studyData.get('testType', '') == 'USER' &&
          (role == 5 ||
            (role == 3 && studyData.get('subType', '') == 'USER_MODERATED'))) ||
        (studyData.get('testType', '') in ['HEURISTIC', 'CARD_SORTING'] &&
          role == 1) ||
        (studyData.get('testType', '') == 'FOCUS_GROUP' && role == 1)
      );
    }

    function canAnswerModeratedStudy(studyId, userId) {
      let studyData = study(studyId);
      return signedIn() && userId == request.auth.uid &&
        studyData.get('testType', '') == 'USER' &&
        studyData.get('subType', '') == 'USER_MODERATED' &&
        roleFor(studyId) == 3;
    }

    function canEditStudy(studyId) {
      return signedIn() && (
        isSuperAdmin() ||
        study(studyId).testAdmin.userDocId == request.auth.uid ||
        roleFor(studyId) in [0, 4]
      );
    }

    function isFocusGroupStudy(studyId) {
      return study(studyId).testType == 'FOCUS_GROUP';
    }

    function canEditHeuristicAssets(studyId, userId) {
      return signedIn() && userId.matches('heuristic_.*') &&
        study(studyId).get('testType', '') == 'HEURISTIC' &&
        roleFor(studyId) in [0, 4];
    }

    // Focus Group roles (studyRoleMap scale): 0 facilitator, 1 participant,
    // 3 observer, 4 co-facilitator. All of them may view a presented stimulus.
    function canViewFocusGroupStimulus(studyId) {
      return signedIn() && isFocusGroupStudy(studyId) &&
        roleFor(studyId) in [0, 1, 3, 4];
    }

    match /tests/{studyId}/{userId}/{allPaths=**} {
      allow read: if canAccessStorage(studyId) ||
        canEditHeuristicAssets(studyId, userId) ||
        (userId.matches('stimulus_.*') && canViewFocusGroupStimulus(studyId)) ||
        canAnswerStudy(studyId, userId) ||
        canAnswerModeratedStudy(studyId, userId);

      allow create, update: if
        canAccessStorage(studyId) ||
        canEditHeuristicAssets(studyId, userId) ||
        (userId.matches('stimulus_.*') && canEditStudy(studyId)) ||
        canAnswerStudy(studyId, userId) ||
        canAnswerModeratedStudy(studyId, userId);
      allow delete: if false;
    }

    match /template-csv/{fileName} {
      allow read: if signedIn();
      allow write: if false;
    }

    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}