Merge pull request #404 from mapswipe/hotfix-firebase-db-rules-tutorial

adjust rules and add test #403

Author: Hagellach37

firebase/database.rules.json

@@ -11,7 +11,9 @@
         ".write": false,
         ".read": "
           // all users can query by status
-        	(auth != null  && query.orderByChild == 'status' && query.equalTo == 'active')
+          (auth != null  && query.orderByChild == 'status' && query.equalTo == 'active')
+          ||
+          (auth != null  && query.orderByChild == 'status' && query.equalTo == 'build_area_tutorial' && query.limitToFirst == 1)
           ||
           // only team members can query by their own teamId
           (auth != null && query.orderByChild == 'teamId' &&
@@ -135,4 +137,4 @@
       }
     }
   }
-}
+}

mapswipe_workers/tests/integration/test_firebase_db_rules.py

@@ -200,6 +200,11 @@ def setUp(self):
                 f'orderBy="teamId"&equalTo="{self.team_id_b}"&limitToFirst=20',
             ],
             [f"/v2/projects/{self.private_project_id_b}/status", ""],
+            # query for tutorial
+            [
+                f"/v2/projects",
+                f'orderBy="status"&equalTo="build_area_tutorial"&limitToFirst=1',
+            ],
             # teams
             [f"/v2/teams/{self.team_id}", ""],
             [f"/v2/teams/{self.team_id}/teamName", ""],
@@ -252,6 +257,7 @@ def test_access_as_normal_user(self):
             (False, False),  # private project status attribute
             (False, False),  # private project b query
             (False, False),  # private project b status attribute
+            (True, False),  # build area tutorial query
             (False, False),  # team
             (False, False),  # teamName
             (False, False),  # teamToken
@@ -294,6 +300,7 @@ def test_access_as_team_member(self):
             (True, False),  # private project status
             (False, False),  # private project b query
             (False, False),  # private project b status
+            (True, False),  # build area tutorial query
             (False, False),  # team
             (True, False),  # teamName
             (False, False),  # teamToken
@@ -337,6 +344,7 @@ def test_access_as_project_manager(self):
             (True, True),  # private project status
             (True, False),  # private project b query
             (True, True),  # private project b status
+            (True, False),  # build area tutorial query
             (True, True),  # team
             (True, True),  # teamName
             (True, True),  # teamToken