Bug Fixes

Author: epodol

firestore.rules

@@ -37,7 +37,8 @@ service cloud.firestore {
   }
 
       match /libraries/{library}/checkouts/{checkout} {
-        allow get, list: if library in request.auth.token.librariesJoined && (library in request.auth.token.permissions.CHECK_OUT || library in request.auth.token.permissions.MANAGE_CHECKOUTS || library in request.auth.token.librariesOwned);
+        allow get: if library in request.auth.token.librariesJoined && request.auth.uid == resource.data.userID;
+        allow list: if library in request.auth.token.librariesJoined && (library in request.auth.token.permissions.CHECK_OUT || library in request.auth.token.permissions.MANAGE_CHECKOUTS || library in request.auth.token.librariesOwned);
         allow update: if library in request.auth.token.librariesJoined && (library in request.auth.token.permissions.MANAGE_CHECKOUTS || library in request.auth.token.librariesOwned);
         allow create, delete: if false;
       }

functions/package-lock.json

@@ -23,7 +23,7 @@
     "node-fetch": "^3.2.10"
   },
   "devDependencies": {
-    "firebase-functions-test": "^2.2.0",
+    "firebase-functions-test": "^2.3.0",
     "jest": "^28.1.3"
   },
   "private": true

functions/package.json

@@ -31,7 +31,7 @@ const checkinBook = functions
     }
 
     if (
-      !context.auth.token.permissions.CHECK_IN.includes(data.libraryID) &&
+      !context.auth.token.permissions?.CHECK_IN?.includes(data.libraryID) &&
       !context.auth.token.librariesOwned.includes(data.libraryID)
     ) {
       throw new functions.https.HttpsError(

functions/src/checkouts/checkinBook.ts

@@ -33,7 +33,7 @@ const checkoutBook = functions
     }
 
     if (
-      !context.auth.token.permissions.CHECK_OUT.includes(data.libraryID) &&
+      !context.auth.token?.permissions?.CHECK_OUT?.includes(data.libraryID) &&
       !context.auth.token.librariesOwned.includes(data.libraryID)
     ) {
       throw new functions.https.HttpsError(

functions/src/checkouts/checkoutBook.ts

@@ -41,8 +41,6 @@ const approveUser = functions
       );
     }
 
-    console.log(data, typeof data.expiration);
-
     // Type Verification
     if (
       typeof data.firstName !== 'string' ||
@@ -116,12 +114,9 @@ const approveUser = functions
         const userClaims = user.customClaims;
 
         const newLibrariesJoined = [];
-        if (userClaims && Array.isArray(userClaims?.librariesJoined)) {
-          newLibrariesJoined.push(userClaims.librariesJoined);
-          newLibrariesJoined.push(data.libraryID);
-        } else {
-          newLibrariesJoined.push(data.libraryID);
-        }
+        if (userClaims && Array.isArray(userClaims?.librariesJoined))
+          newLibrariesJoined.push(...userClaims.librariesJoined);
+        newLibrariesJoined.push(data.libraryID);
 
         getAuth()
           .setCustomUserClaims(data.uid, {