digital-platform/storage/storage.rules at develop · warrensearle/digital-platform · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
rules_version = '2';

service firebase.storage {
  function userIsAuthenticated() {
    return request.auth.uid != null;
  }

  function currentUser() {
    return request.auth.uid;
  }

  function userIsJAC() {
    return request.auth.token.email.matches('(.*@judicialappointments|.*@justice)[.](digital|gov[.]uk)');
    //return request.auth.token.email_verified
      //&& request.auth.token.email.matches('.*@judicialappointments[.](digital|gov[.]uk)')
  }
  function isOkForDownload() {
    // 'request.resource' is available when writing, but when reading you must use 'resource' directly.
    // ref: https://stackoverflow.com/questions/48401943/firebase-storage-rules-custommetadata-not-working
    return resource.metadata == null || resource.metadata.status == null || resource.metadata.status != 'infected';
  }
  function isOkForUpload() {
    return request.resource.size > 0
      && request.resource.size <= 2 * 1024 * 1024
      && request.resource.name.matches('.*\\.(pdf|docx|doc|odt|txt|fodt|xlsx)');
  }

  match /b/{bucket}/o {
    match /exercise/{exerciseId}/{fileName} {
      allow read: if isOkForDownload();
      allow write: if userIsAuthenticated() && userIsJAC() && isOkForUpload();
    }
    match /exercise/{exerciseId}/user/{userId}/{fileName} {
      allow read: if userIsAuthenticated() && userIsJAC() && isOkForDownload();
      allow read: if userIsAuthenticated() && currentUser() == userId && isOkForDownload();
      allow write: if userIsAuthenticated() && currentUser() == userId && isOkForUpload();
      allow write: if userIsAuthenticated() && userIsJAC() && isOkForUpload();
    }
    match /exercise/{exerciseId}/application/{applicationId}/assessor/{userId}/{fileName} {
      allow read: if userIsAuthenticated() && userIsJAC() && isOkForDownload();
      allow read: if userIsAuthenticated() && currentUser() == userId && isOkForDownload();
      allow write: if userIsAuthenticated() && currentUser() == userId && isOkForUpload();
    }
    match /exercise/{exerciseId}/application/{applicationId}/assessor/jac/{fileName} {
      allow read: if userIsAuthenticated() && userIsJAC() && isOkForDownload();
      allow write: if userIsAuthenticated() && userIsJAC() && isOkForUpload();
    }
    match /exercise/{exerciseId}/application/{applicationId}/jac/{fileName} {
      allow read: if userIsAuthenticated() && userIsJAC() && isOkForDownload();
      allow write: if userIsAuthenticated() && userIsJAC() && isOkForUpload();
    }
    match /exercise/{exerciseId}/qualifying-tests/{qualifyingTestId}/{fileName} {
      allow write: if userIsAuthenticated() && userIsJAC() && isOkForUpload();
    }
  }
}