storage.rules

/**
 * Copyright 2024 The Ground Authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     https://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {

    /**
     * Returns true iff the user is signed in.
     */
    function isSignedIn() {
      return request.auth != null;
    }

    /**
     * Returns the survey with the specified id.
     */
    function getSurvey(surveyId) {
      return firestore.get(/databases/(default)/documents/surveys/$(surveyId)).data;
    }

    /**
     * Returns true iff all authenticated users can read and contribute
     * data to the specified survey.
     */
    function isUnlistedOrPublic(survey) {
      return survey["8"] in [
        2 /* UNLISTED */,
        3 /* PUBLIC */
      ];
    }

    /**
     * Returns true if the current user has one of the specified roles in the
     * given survey.
     */
    function isOneOf(survey, roles) {
     return survey["4"][request.auth.token.email] in roles;
    }

    /**
     * Returns true iff the user with the user's email can read the specified
     * survey.
     */
    function canViewSurvey(surveyId) {
      let survey = getSurvey(surveyId);
      return survey != null && isSignedIn() &&
        (isUnlistedOrPublic(survey) || survey["4"][request.auth.token.email] != null);
    }

    /**
     * Returns true iff the current user with the given email can contribute LOIs
     * and submissions to the specified survey.
     */
    function canCollectData(surveyId) {
      let survey = getSurvey(surveyId);
      return survey != null && isSignedIn() &&
        (isUnlistedOrPublic(survey) || isOneOf(survey, [
          2 /* DATA_COLLECTOR */,
          3 /* SURVEY_ORGANIZER */
        ]));
    }

    match /temp/{userId}/{allPaths=**} {
      // Only the owning user can read their own temporary files.
      allow read: if isSignedIn() && request.auth.uid == userId;
    }

    match /offline-imagery/{allPaths=**} {
      // All authenticated users can read.
      allow read: if isSignedIn();
    }
    
    match /user-media/surveys/{surveyId}/{allPaths=**} {
      // Only users with permission to access the survey can read media.
      allow read: if canViewSurvey(surveyId);

      // Only users with permission to contribute data to the survey can create/update media.
      allow create, write: if canCollectData(surveyId);
    }
  }
}