firestore.rules

rules_version = '2';
service cloud.firestore {

  function userIsAuthenticated() {
    return request.auth.uid != null;
  }

  function currentUser() {
    return request.auth.uid;
  }

  function userIsJAC() {
    return request.auth.token.email.matches('(.*@judicialappointments|.*@justice)[.](digital|gov[.]uk)');
    // return request.auth.token.email_verified
    //   && request.auth.token.email.matches('(.*@judicialappointments|.*@justice)[.](digital|gov[.]uk)');
  }

  function userHasEmail(email) {
    return request.auth.token.email.lower() == email.lower();
    //return request.auth.token.email_verified
      //&& request.auth.token.email.lower() == email.lower();
  }

  function fieldHasValue(data, field, value) {
    return !(field in data) || data[field] == value;
  }

  // function notChanged(field) {
  //   return !(field in request.resource.data)
  //     || resource.data[field] == request.resource.data[field]
  // }

  match /databases/{database}/documents {

    match /{document=**} {
      allow read: if false;
      allow write: if false;
    }

    match /exercises/{exerciseId} {
      allow read: if userIsAuthenticated() && userIsJAC();
      allow write: if userIsAuthenticated() && userIsJAC();

      match /reports/{reportId} {
        allow read: if userIsAuthenticated() && userIsJAC();
      }
    }

    match /notifications/{notificationId} {
      allow read: if userIsAuthenticated() && userIsJAC();
      // allow write: if userIsAuthenticated() && userIsJAC();
    }

    match /notes/{noteId} {
      allow read: if userIsAuthenticated() && userIsJAC();
      allow write: if userIsAuthenticated() && userIsJAC();
    }

    match /panels/{panelId} {
      allow read: if userIsAuthenticated() && userIsJAC();
      allow write: if userIsAuthenticated() && userIsJAC();
    }

    match /meta/stats {
      allow read: if userIsAuthenticated() && userIsJAC();
      // Admin users can increment stats.exercisesCount by 1
      allow update: if userIsAuthenticated() && userIsJAC() && request.resource.data.exercisesCount == resource.data.exercisesCount + 1;
    }

    match /settings/services {
      allow read: if userIsAuthenticated() && userIsJAC();
      allow update: if userIsAuthenticated() && userIsJAC();
    }

    match /vacancies/{vacancyId} {
      allow read: if true;
      allow write: if false;

      // allow candidate to update vacancy meta/stats.applicationsCount
      match /meta/stats {
        allow read: if userIsAuthenticated();
        allow create: if userIsAuthenticated() && request.resource.data.applicationsCount == 1;
        allow update: if userIsAuthenticated() && request.resource.data.applicationsCount == resource.data.applicationsCount + 1;
      }

    }

    match /candidates/{candidateId} {
  		// Users can read & write to their own candidate document
      allow get, create, update: if request.auth.uid == candidateId;

      // Allow JAC to read and write
      allow read, write: if userIsAuthenticated() && userIsJAC();

      match /documents/{documentId} {
        allow get, create, update: if request.auth.uid == candidateId &&
          documentId in ['personalDetails', 'characterInformation', 'equalityAndDiversitySurvey'];
        allow read, write: if userIsAuthenticated() && userIsJAC();
      }
    }

    match /{path=**}/documents/{documentId} {
      allow read: if userIsAuthenticated() && userIsJAC();
    }

    function exerciseIsOpen(exerciseId) {
      let applicationOpenDate = get(/databases/$(database)/documents/exercises/$(exerciseId)).data.applicationOpenDate;
      let applicationCloseDate = get(/databases/$(database)/documents/exercises/$(exerciseId)).data.applicationCloseDate;
      return applicationOpenDate <= request.time
				&& request.resource.data.get("dateExtension", applicationCloseDate) > request.time;
    }
    function exerciseNeedsMoreInformation(exerciseId) {
      let exercise = get(/databases/$(database)/documents/exercises/$(exerciseId)).data;
      return exercise.keys().hasAll(['_applicationContent'])
        && exercise._applicationContent.keys().hasAll(['_currentStep'])
        && exercise._applicationContent._currentStep.step in exercise._applicationContent
        && exercise._applicationContent[exercise._applicationContent._currentStep.step].keys().size() > 0;
    }

    match /applications/{applicationId} {
      // allow admins full read access to all applications
      allow read: if userIsAuthenticated() && userIsJAC();

      // Allow existing records which belong to the current user
      allow read: if resource.data.userId == currentUser();

      // Allow new records if they will belong to the current user, are draft and the exercise is open
      allow create: if request.resource.data.userId == currentUser() &&
        request.resource.data.status == "draft" &&
        exerciseIsOpen(request.resource.data.exerciseId);

      // Allow updates on records which belong, and will continue to belong, to the current user
      // But only if the application is in 'draft' state and exercise is open
      allow update: if resource.data.userId == currentUser() &&
        request.resource.data.userId == currentUser() &&
        (
          (  // draft application for an open vacancy
            resource.data.status == "draft" &&
            request.resource.data.status in ['draft', 'applied'] &&
            exerciseIsOpen(resource.data.exerciseId)
          )
          ||
          (  // current application with more info requested
            resource.data.status == "applied" && request.resource.data.status == "applied" &&  // remains in applied status
            exerciseNeedsMoreInformation(resource.data.exerciseId)
          )
          ||
          (  // consent form information is requested
           resource.data.status in ["draft", "applied"] && request.resource.data.status in ["draft", "applied"] &&
           resource.data.characterChecks.status == "requested" &&
           request.resource.data.characterChecks.status in ["requested", "completed"]
           )
        );

      // allow JAC admins to edit an application @TODO restrict what can be changed and by which role
      allow update: if userIsAuthenticated() && userIsJAC();
    }

    match /applicationRecords/{applicationId} {

      // allow admins full read access to all applicationRecords
      allow read: if userIsAuthenticated() && userIsJAC();

      // allow admins full write access to all applicationRecords
      allow write: if userIsAuthenticated() && userIsJAC();

    }

    match /logs/login/{id}/{logId} {
      // allow candidates update their own logs
      allow read, write: if userIsAuthenticated() && currentUser() == id;
      allow read: if userIsAuthenticated() && userIsJAC();
    }

    // allow any logged in user to create event log entries
    // but only allow JAC users to read them

    match /logs/{type}/events/{eventId} {
      allow create: if userIsAuthenticated();
      allow read: if userIsAuthenticated() && userIsJAC();
    }

    match /assessments/{assessmentId} {
      // allow admins full read and update permission
      allow read: if userIsAuthenticated() && userIsJAC();
      allow update, create: if userIsAuthenticated() && userIsJAC();

      // allow assessor to read and update own documents
      allow read: if userIsAuthenticated() && userHasEmail(resource.data.assessor.email);
      allow update: if userIsAuthenticated() && userHasEmail(resource.data.assessor.email) &&
        (!('id' in resource.data.assessor) || resource.data.assessor.id == request.resource.data.assessor.id) &&
        (!('id' in request.resource.data.assessor) || request.resource.data.assessor.id == currentUser()) &&
        resource.data.assessor.email == request.resource.data.assessor.email &&
        resource.data.status == 'pending' &&
        request.resource.data.status == 'completed';
        // TODO allow uploads after the due date but before the hard limit resource.data.dueDate >= request.time;
    }

    match /qualifyingTests/{qualifyingTestId} {
      // allow admins read, create and update permission
      allow read: if userIsAuthenticated() && userIsJAC();
      allow create: if userIsAuthenticated() && userIsJAC();
      allow update: if userIsAuthenticated() && userIsJAC();
      allow delete: if userIsAuthenticated() && userIsJAC();  // TODO only super admins
    }

    match /qualifyingTestReports/{qualifyingTestReportId} {
      // allow admins read, create and update permission
      allow read: if userIsAuthenticated() && userIsJAC();
      allow create: if userIsAuthenticated() && userIsJAC();
      allow update: if userIsAuthenticated() && userIsJAC();
      allow delete: if userIsAuthenticated() && userIsJAC();  // TODO only super admins
    }

    match /qualifyingTestResponses/{qualifyingTestResponseId} {
      // allow admins read and create/update permission
      allow read, update: if userIsAuthenticated() && userIsJAC();

      // allow candidate to read their own document
      allow read: if userIsAuthenticated()
        && (
          fieldHasValue(resource.data.candidate, 'id', currentUser())
          || fieldHasValue(resource.data.candidate, 'email', request.auth.token.email)
        );

      // allow candidates to update their own document
      // @TODO but only the responses field and only if within allowed duration from start time
      allow update: if (
          fieldHasValue(resource.data.candidate, 'id', currentUser())
          || fieldHasValue(resource.data.candidate, 'email', request.auth.token.email)
        )
        && request.resource.data.candidate.id == currentUser();
    }

    match /invitations/{invitationId} {
      // allow admins to read and write invitations
      allow read, write: if userIsAuthenticated() && userIsJAC();

      // allow candidates to read and update their own invitations
      allow read, update: if userIsAuthenticated() && (
        fieldHasValue(resource.data.candidate, 'id', currentUser())
        || fieldHasValue(resource.data.candidate, 'email', request.auth.token.email)
      );
    }

  }
}