talksik
20 lines
774 B
Plaintext
20 lines
774 B
Plaintext
rules_version = '2';
|
|
service cloud.firestore {
|
|
match /databases/{database}/documents {
|
|
|
|
// Per-human membership mirror maintained by Orion's service account.
|
|
// Locked from clients so the membership list cannot leak or be mutated.
|
|
match /humans/{humanId} {
|
|
allow read, write: if false;
|
|
}
|
|
|
|
// Particles: caller must be a current member of the network in the path.
|
|
// get() on the mirror is cached across rule evaluations within a single
|
|
// request, so this costs 1 billed read per request regardless of query size.
|
|
match /networks/{networkId}/children/{particleId=**} {
|
|
allow read, write: if request.auth != null
|
|
&& networkId in get(/databases/$(database)/documents/humans/$(request.auth.uid)).data.networks;
|
|
}
|
|
}
|
|
}
|