firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function isSuper(request) {
      return request.auth.token.admin == true
    }
    function isOperator(request) {
      return request.auth.token.operator == true
    }

    function isAdmin(request) {
      return request.auth.uid != null && request.auth.token.email != null
    }

    function isPhoneUser(request) {
      return request.auth.uid != null && request.auth.token.phone_number != null
    }
    function isLiffUser(request) {
      return request.auth.uid != null && request.auth.token.liffId != null
    }
    function isUser(request) {
      return isPhoneUser(request) || isLiffUser(request)
    }

    function isOwner(resource, request) {
      return resource.data.uid == request.auth.uid;
    }
    function isOwnersSubAccount(resource, request) {
      return resource.data.uid == request.auth.token.parentUid;
    }
    function isNewOwner(request) {
      return request.resource.data.uid == request.auth.uid;
    }
    function isFromUser(resource, request) {
      return resource.data.fromUid == request.auth.uid;
    }
    function isResuaurantOwner(resource, request) {
      return resource.data.ownerUid == request.auth.uid;
    }

    function isRestaurantOwner(restaurantId, request) {
      return get(/databases/$(database)/documents/restaurants/$(restaurantId)).data.uid == request.auth.uid;
    }
    function isSmaregiOwner(contractId, request) {
      return get(/databases/$(database)/documents/smaregi/$(contractId)).data.uid == request.auth.uid;
    }
    function isRestaurantSubAccount(restaurantId, request) {
      let parantUid = get(/databases/$(database)/documents/restaurants/$(restaurantId)).data.uid;
      return (restaurantId in get(/databases/$(database)/documents/admins/$(parantUid)/children/$(request.auth.uid)).data.restaurantLists) && parantUid == request.auth.token.parentUid;
    }
    // for mo
    function hasGroupIdInAuth (request) {
      return (request.auth.token.keys().hasAll(['groupId', 'parentUid']))
    }
    function hasGroup (groupId, restaurantId) {
      let parantRestaurantId = get(/databases/$(database)/documents/groups/$(groupId)).data.restaurantId;
      return parantRestaurantId == restaurantId;
    }
    function isRestaurantGroupSubAccount(restaurantId, request) {
      return hasGroupIdInAuth(request) && hasGroup(request.auth.token.groupId, restaurantId);
    }
    function isGroupOwnerForOrder(resource, request) {
      return isGroupOwner(resource.data.ownerUid, request);
    }
    function isGroupOwner(userId, request) {
      return get(/databases/$(database)/documents/admins/$(userId)/groups/data).data.groupId == request.auth.token.groupId
    }
    function isGroupOwner2(groupId, request) {
      return get(/databases/$(database)/documents/groups/$(groupId)).data.ownerId == request.auth.uid && request.auth.token.groupId == groupId
    }
    function isUndefined(data, field) {
      return !data.keys().hasAll([field]);
    }
    function phoneHashUser(hashId, groupId, request) {
      return hashing.sha256([groupId, request.auth.token.phone_number].join(":")).toHexString() == hashId.upper();
    }
    
    // restaurantInfo
    function isUndefinedRestaurantParams(request) {
      return isUndefined(request.resource.data, 'isEC') &&
             isUndefined(request.resource.data, 'onTheList') &&
             isUndefined(request.resource.data, 'inMoIndex') &&
             isUndefined(request.resource.data, 'enableMoPickup') &&
             isUndefined(request.resource.data, 'groupId');
    }
    function notUpdateRestaurantParams(resource, request) {
      return (isUndefined(request.resource.data, 'isEC')  || request.resource.data.isEC == resource.data.isEC) &&
             (isUndefined(request.resource.data, 'onTheList')  || request.resource.data.onTheList == resource.data.onTheList) || (request.resource.data.onTheList == false) &&      
             (isUndefined(request.resource.data, 'inMoIndex')  || request.resource.data.inMoIndex == resource.data.inMoIndex) &&      
             (isUndefined(request.resource.data, 'enableMoPickup') || request.resource.data.enableMoPickup == resource.data.enableMoPickup) &&
             (isUndefined(request.resource.data, 'groupId') || request.resource.data.groupId == resource.data.groupId) ;
    }
    function notUpdatePaymentParams(resource, request) {
      return request.resource.data.stripe == resource.data.stripe || isUndefined(request.resource.data, ['stripe']);
    }

    match /users/{userId} {
      allow read, write: if request.auth.uid == userId;
      
      match /private/profile {
        allow read: if request.auth.uid == userId;
        allow write: if request.auth.uid == userId
          && request.resource.data.phoneNumber == request.auth.token.phone_number;
      }
      match /address/data {
        allow read, write: if request.auth.uid == userId; // Only the person can r/w.
        allow read, write: if false; // paranoia
      }
      match /owner/{ownerId}/readonly/stripe {
        allow read: if request.auth.uid == userId && (resource.data.updatedAt + duration.value(180, 'd')) > request.time;
      }
      match /system/{document=**} {
        allow read, write: if false;
      }
      match /reviews/{restaurantId} {
        allow read: if request.auth.uid == userId;
        allow write: if request.auth.uid == userId && request.resource.data.restaurantId == restaurantId;
      }
      match /groups/{groupId}/reviews/{restaurantId} {
        allow read: if request.auth.uid == userId;
        allow write: if request.auth.uid == userId && request.resource.data.restaurantId == restaurantId;
      }
      match /promotionHistories/{promotionId} {
        allow read: if request.auth.uid == userId;
      }
    }

    match /adminConfigs/{userId} {
      // Note: we don't want to allow the user to "update"
      allow create: if request.auth.uid == userId && isUndefined(request.resource.data, 'admin')
              && isUndefined(request.resource.data, 'operator');
      allow read: if request.auth.uid == userId;
      allow update: if request.auth.uid == userId;
    }
    match /adminConfigs/{userId}/restaurants/{restaurantId} {
      // Note: we don't want to allow the user to "update"
      allow create: if request.auth.uid == userId && isUndefined(request.resource.data, 'admin')
              && isUndefined(request.resource.data, 'operator');
      allow read: if request.auth.uid == userId;
      allow update: if request.auth.uid == userId;
    }
    match /admins/{userId} {
      // Note: we don't want to allow the user to "update"
      allow create: if request.auth.uid == userId && isUndefined(request.resource.data, 'admin')
              && isUndefined(request.resource.data, 'operator');
      allow read: if request.auth.uid == userId;
      allow read: if isSuper(request);
      allow read: if isAdmin(request) && request.auth.token.parentUid == userId // for sub
      allow read: if isGroupOwner(userId, request)

      allow write: if isSuper(request);
      
      match /public/RestaurantLists {
        allow read: if true;
        allow write: if request.auth.uid == userId;
        allow write: if isSuper(request);
      }
      match /public/payment {
        allow read: if true;
        allow write: if request.auth.uid == userId && notUpdatePaymentParams(resource, request);
        allow write: if isSuper(request);
      }
      match /private/profile {
        allow read: if request.auth.uid == userId;
        allow create: if request.auth.uid == userId
          && request.resource.data.email == request.auth.token.email;
        allow update: if request.auth.uid == userId;
      }
      match /private/smaregi {
        allow read, write: if request.auth.uid == userId;
        allow read: if isSuper(request);
      }
      match /private/notification {
        allow read, write: if request.auth.uid == userId;
        allow read: if isSuper(request);
      }
      match /private/notification {
        allow read: if request.auth.token.parentUid  == userId
      }
      match /children/{childId} {
        allow read, write: if request.auth.uid == userId;
        allow read: if request.auth.uid == childId;
      }

      match /system/{document=**} {
        allow read, write: if false;
      }
      match /messages/{messageId} {
        allow read: if request.auth.uid == userId;
      }
    }
    match /zipcode/{zipCode} {
      allow get: if true
    }
    match /owners/{ownerId} {
      // Note: we don't want to allow the user to "update"
      allow write: if request.auth.uid == ownerId && isUndefined(request.resource.data, 'admin')
              && isUndefined(request.resource.data, 'operator');
      allow read: if true
    }

    match /groups/{groupId} {
      allow read: if true;
      match /category/{category} {
        allow read: if true;
        match /subCategory/{subcategory} {
          allow read: if true;
        }      
      }      
      match /groupConfig/suspend {
        allow read: if true;
        allow write: if request.auth.token.groupId == groupId
      }
      match /promotions/{promotionId} {
        // TODO group promotion condition
        allow read: if true
        allow write: if isGroupOwner2(groupId, request);
      }
      match /users/{hashId}/promotionHistories/{promotionId} {
        allow read: if phoneHashUser(hashId, groupId, request)
      }
    }

    // Rules for collection group
    match /{path=**}/orders/{orderId} {
      allow read: if isSuper(request);
      allow read: if isOperator(request);
      allow read: if isOwner(resource, request);
      allow read: if isResuaurantOwner(resource, request);
      allow read: if isGroupOwnerForOrder(resource, request);
    }
    match /{path=**}/stripeLogs/{logId} {
      allow read: if isSuper(request);
    }
    match /{path=**}/private/{documentId} {
      allow read: if isSuper(request);
    }
    match /{path=**}/adminlogs/{documentId} {
      allow read: if isSuper(request);
    }
    match /{path=**}/reviews/{lineId} {
      allow read: if isSuper(request);
    }
    match /{path=**}/lines/{lineId} {
      allow read: if isOwner(resource, request);
    }

    match /{path=**}/messages/{messageId} {
      allow read: if isFromUser(resource, request);
    }

    match /{path=**}/subCategory/{subcategory} {
      allow read: if true;
    }
    match /{path=**}/promotionHistories/{historyId} {
      allow read: if resource.data.groupId == request.auth.token.groupId;
      allow read: if isAdmin(request) && isRestaurantOwner(resource.data.restaurantId, request)
      allow read: if isAdmin(request) && isRestaurantSubAccount(resource.data.restaurantId, request)
      allow delete: if isAdmin(request) && isRestaurantOwner(resource.data.restaurantId, request)
    }

    // End of Rules for collection group

    match /restaurants/{restaurantId} {
        allow read: if resource.data.publicFlag && !resource.data.deletedFlag; // everyone
        allow read: if isAdmin(request) && isOwner(resource, request);
        // allow read: if isAdmin(request) && isRestaurantSubAccount(restaurantId, request); TODO
        allow read: if isAdmin(request) && isOwnersSubAccount(resource, request);
        allow read: if isSuper(request);
        
        allow create: if isAdmin(request)
                        && request.resource.data.uid == request.auth.uid
                        && isUndefinedRestaurantParams(request);
        allow update: if isAdmin(request) && isOwner(resource, request)
                        && notUpdateRestaurantParams(resource, request);
        allow update: if isAdmin(request) && isRestaurantSubAccount(restaurantId, request)
                        && notUpdateRestaurantParams(resource, request);
        allow update: if isSuper(request);

        match /ec/postage {
          allow read: if true
          allow create: if isAdmin(request)
                          && request.resource.data.uid == request.auth.uid;
          allow update: if isAdmin(request) && isOwner(resource, request);
          allow update: if isAdmin(request) && isRestaurantSubAccount(restaurantId, request);
          allow update: if isSuper(request);
        }
        match /delivery/area {
          allow read: if true
          allow create: if isAdmin(request)
                          && request.resource.data.uid == request.auth.uid;
          allow update: if isAdmin(request) && isOwner(resource, request);
          allow update: if isAdmin(request) && isRestaurantSubAccount(restaurantId, request);
          allow update: if isSuper(request);
        }
        match /private/notifications {
          allow read, write: if isAdmin(request) && isRestaurantOwner(restaurantId, request);
          allow read, write: if isAdmin(request) && isRestaurantSubAccount(restaurantId, request);
        }
        match /private/printer {
          allow read, write: if isAdmin(request) && isRestaurantOwner(restaurantId, request);
          allow read, update: if isSuper(request);
        }
        match /private/line {
          allow read, write: if isAdmin(request) && isRestaurantOwner(restaurantId, request);
          allow read, update: if isSuper(request);
        }
        match /lineUsersData/{uid} {
          allow read: if isAdmin(request) && isRestaurantOwner(restaurantId, request);
          allow read: if isSuper(request);
        }
        match /printLog/{logId} {
          allow read: if isAdmin(request) && isRestaurantOwner(restaurantId, request);
          allow read: if isSuper(request);
        }
        match /userLog/{userId} {
          allow read: if isAdmin(request) && isRestaurantOwner(restaurantId, request);
          allow read: if isAdmin(request) && isRestaurantSubAccount(restaurantId, request);
          allow read: if isSuper(request);
          allow write: if false // only server side of function can write here (see functions/order.ts)
        }
        match /menus/{menuId} {
          allow read: if resource.data.publicFlag && !resource.data.deletedFlag; // everyone
          allow read: if isAdmin(request) && isRestaurantOwner(restaurantId, request);
          allow read: if isAdmin(request) && isRestaurantSubAccount(restaurantId, request);
          allow read: if isAdmin(request) && isRestaurantGroupSubAccount(restaurantId, request);
          allow read: if isSuper(request);

          allow write: if isAdmin(request) && isRestaurantOwner(restaurantId, request);
          allow write: if isAdmin(request) && isRestaurantSubAccount(restaurantId, request);
        }
        match /titles/{titleId} {
          allow read: if true
          allow write: if isAdmin(request) && isRestaurantOwner(restaurantId, request);
        }
        match /orders/{orderId} {
          allow read: if isSuper(request);
          allow read: if isOperator(request);
          allow create: if isPhoneUser(request)
                          && request.resource.data.status == 100
                          && request.resource.data.phoneNumber == request.auth.token.phone_number
                          && request.resource.data.uid == request.auth.uid;
          allow create: if isLiffUser(request)
                          && request.resource.data.status == 100
                          && request.resource.data.uid == request.auth.uid;
          allow read: if isAdmin(request)
                          && isRestaurantOwner(restaurantId, request);
          allow read: if isAdmin(request)
                          && isRestaurantSubAccount(restaurantId, request);
          allow read: if isUser(request) && isOwner(resource, request);
          allow delete: if isOwner(resource, request)
                          && resource.data.status == 200; // validated
          match /system/{document=**} {
            allow read, write: if false;
          }
          match /customer/data {
            allow read: if isSuper(request);
            allow write: if false // only server side of function can write here (see functions/order.ts and stripe/intent.ts)
            allow read: if isAdmin(request)
                            && isRestaurantOwner(restaurantId, request);
            allow read: if isAdmin(request)
                            && isRestaurantSubAccount(restaurantId, request);
            allow read: if isUser(request) && isOwner(resource, request);
          }
        }
        match /lines/{lineId} {
          allow read, write: if isRestaurantOwner(restaurantId, request);
          allow read, write: if isAdmin(request) && isRestaurantSubAccount(restaurantId, request);
        }
        match /liffCustomer/{uid} {
          allow read: if isRestaurantOwner(restaurantId, request);
          allow write: if uid == request.auth.uid && isNewOwner(request);
        }
        match /log/{datestr}/phoneLog/{orderId} {
          allow read: if isSuper(request);
        }

        match /pickup/stock/subCategory/{subCategory} {
          allow read: if true;
          allow write: if isAdmin(request)
                          && isRestaurantOwner(restaurantId, request);
          allow write: if isAdmin(request)
                          && isRestaurantSubAccount(restaurantId, request);
        }
        match /pickup/data/subCategory/{subCategory} {
          allow read: if true;
          allow write: if isAdmin(request)
                          && isRestaurantOwner(restaurantId, request);
          allow write: if isAdmin(request)
                          && isRestaurantSubAccount(restaurantId, request);
        }
        match /preOrder/data/subCategory/{subCategory} {
          allow read: if true;
          allow write: if isAdmin(request)
                          && isRestaurantOwner(restaurantId, request);
          allow write: if isAdmin(request)
                          && isRestaurantSubAccount(restaurantId, request);
        }

        match /promotions/{promotionId} {
          // TODO restaurant promotion condition
          allow read: if true
          allow write: if isAdmin(request)
                          && isRestaurantOwner(restaurantId, request);
        }
    }

    match /smaregi/{contractId} {
        allow read: if isAdmin(request) && isOwner(resource, request);
        allow write: if false // only server side of function can write here (see functions/smaregi.ts)
        match /stores/{storeId} {
            allow read: if isAdmin(request) && isSmaregiOwner(contractId, request) && isOwner(resource, request);
            allow write: if isAdmin(request) && isNewOwner(request) && isSmaregiOwner(contractId, request);
            allow delete: if isAdmin(request) && isSmaregiOwner(contractId, request);
            match /products/{prodcts} {
                allow create: if isAdmin(request) && isNewOwner(request) && isSmaregiOwner(contractId, request);
                allow read, update: if isAdmin(request) && isOwner(resource, request) && isSmaregiOwner(contractId, request);
                allow delete: if isAdmin(request) && isSmaregiOwner(contractId, request);
            }
            match /stocks/{prodcts} {
                allow read: if isAdmin(request) && isOwner(resource, request) && isSmaregiOwner(contractId, request);
                allow write: if false // only server side of function can update stock from smaregi (see T.B.D.)
            }
        }
    }
    match /smaregiData/{contractId}/stores/{storeId}/smaregiProducts/{productId} {
        allow read: if isAdmin(request) && isSmaregiOwner(contractId, request);
        allow write: if false // only server side of function can update stock from smaregi (see T.B.D.)
    }

    match /requestList/{restaurantId} {
      allow read, write: if isAdmin(request) && isRestaurantOwner(restaurantId, request);
      allow read: if isSuper(request);
    }
    
    match /liff/{indexId} {
      allow read: if true;
      allow write: if false;  // only set by hands

      match /secret/data {
        allow read: if false; // only server side of function can use this data.
        allow write: if false;
      }
    }

    match /link/{linkId}{
      allow read: if true;
      allow write: if false;
    }
    match /phoneLog/{year}/{month}/{id} {
      allow create: if true;
      allow update: if false;
      allow read: if false;
    }
    
    match /{path=**}/customer/{data} {
        allow read: if isSuper(request);
        allow read: if isAdmin(request)
                        && isRestaurantOwner(resource.data.restaurantId, request);
        allow read: if isAdmin(request)
                        && isRestaurantSubAccount(resource.data.restaurantId, request);
    }
    match /{path=**}/pageViewData/{data} {
        allow read: if isSuper(request);
        allow read: if isAdmin(request)
                        && isRestaurantOwner(resource.data.restaurantId, request);
    }
    match /{path=**}/phoneLog/{orderId} {
        allow read: if isSuper(request);
    }
    match /{path=**}/groups/{data} {
        allow read: if isSuper(request);
        allow read: if resource.data.groupId == request.auth.token.groupId;
    }
    match /{document=**} {
      allow read, write: if false;
    }
    
    // for map
    match /mobileMap/data/products/{id} {
      allow read: if true;
    }
  }
}