CollabCode/database.rules.secure.json at master · humancto/CollabCode · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
{
  "rules": {
    "sessions": {
      // Allow reading the entire sessions list
      ".read": true,
      // Allow write at root level for deletion (admin operations)
      ".write": true,

      "$sessionId": {
        // Anyone can read individual sessions (needed for candidates to join)
        ".read": true,

        // Session creation, modification and deletion rules
        ".write": true,

        // Structure validation
        ".validate": "$sessionId.matches(/^[0-9]{6}$/)",

        "users": {
          "$userId": {
            // Users can only write their own data
            ".write": true,
            ".validate": "newData.hasChildren(['name', 'timestamp'])"
          }
        },

        "firepad": {
          // Anyone in the session can edit code
          ".write": true
        },

        "terminated": {
          // Only allow setting terminated flag, not unsetting
          ".write": "!data.exists() && newData.child('terminated').val() === true"
        },

        "created": {
          // Timestamp can only be set once
          ".write": "!data.exists()"
        },

        "createdBy": {
          // Creator can only be set once
          ".write": "!data.exists()"
        },

        "interviewerNotes": {
          // Only authenticated users (interviewers) can read/write notes
          ".read": "auth != null || root.child('sessions').child($sessionId).child('createdBy').val() === 'Interviewer'",
          ".write": "auth != null || root.child('sessions').child($sessionId).child('createdBy').val() === 'Interviewer'",
          ".validate": "newData.hasChildren(['content', 'updatedAt', 'createdBy'])"
        }
      }
    }
  }
}