Merge branch 'develop'

Author: fcamblor

.gitignore

@@ -0,0 +1,2 @@
+node_modules/
+

cloud/firebase.json

@@ -14,6 +14,10 @@
       ]
     }
   ],
+  "firestore": [{
+    "database": "default",
+    "rules": "firestore/firestore.default.rules"
+  }],
   "emulators": {
     "auth": {
       "port": 9099
@@ -30,6 +34,7 @@
     "singleProjectMode": true
   },
   "hosting": {
+    "site": "voxxrin-v3",
     "public": "hosting/public",
     "ignore": [
       "firebase.json",
@@ -38,12 +43,9 @@
     ],
     "rewrites": [
       {
-        "source": "**",
+        "source": "!(/assets/**|/favicon.*|/sw.js|/manifest.webmanifest)",
         "destination": "/index.html"
       }
     ]
-  },
-  "hosting:voxxrin-v3": {
-    "site": "voxxrin-v3"
   }
 }

cloud/firestore/firestore.default.rules

@@ -0,0 +1,123 @@
+rules_version = '2';
+service cloud.firestore {
+  match /databases/{database}/documents {
+    function iAm(userId) { return request != null && request.auth != null && request.auth.uid == userId }
+    function onlyAllowedUpdatedFields(allowedFieldNames) {
+      return allowedFieldNames != null
+        && request != null
+        && request.resource != null
+        && request.resource.data != null
+        && resource != null
+        && resource.data != null
+        && resource.data.diff(request.resource.data).affectedKeys().hasOnly(allowedFieldNames)
+    }
+
+    // By default, prevent reads & writes on any node
+    match /{document=**} {
+      allow read, write: if false;
+    }
+
+    match /event-family-tokens/{familyId} {
+      allow read, write: if false;
+    }
+
+    match /public-tokens/{publicSecretToken} {
+      allow get: if true;
+      allow list, write: if false;
+    }
+
+    match /crawlers/{crawlerId} {
+      allow read, write: if false;
+    }
+
+    match /schema-migrations/self {
+      allow read, write: if false;
+    }
+
+    match /events/{event} {
+      allow read: if true;
+      allow write: if false;
+
+      match /days/{dayId} {
+        allow read: if true;
+        allow write: if false;
+      }
+
+      match /event-descriptor/self {
+        allow get: if true;
+        allow list, write: if false;
+      }
+
+      match /talksStats/{talkId} {
+        allow read: if true;
+        allow write: if false;
+      }
+
+      match /organizer-space/{secretOrganizerToken} {
+        allow get: if true;
+        allow list, write: if false;
+
+        match /ratings/self {
+          allow read, write: if false;
+        }
+      }
+
+      match /last-updates/self {
+        allow get: if true;
+        allow list, write: if false;
+      }
+
+      match /talks/{talkId} {
+        allow read: if true;
+        allow write: if false;
+
+        match /feedbacks-access/{secretFeedbackViewerToken} {
+          allow get: if true;
+          allow list, write: if false;
+
+          match /feedbacks/{userPublicToken} {
+          	allow read: if true;
+          	allow write: if false;
+          }
+        }
+      }
+    }
+
+    match /users/{userId} {
+      allow list, create, delete: if false;
+    	allow get: if iAm(userId);
+    	allow update: if iAm(userId) && onlyAllowedUpdatedFields(["userLastConnection"]);
+
+      match /preferences/self {
+        allow get, create, update: if iAm(userId);
+        allow delete, list: if false;
+      }
+      match /tokens-wallet/self {
+        allow get, create, update: if iAm(userId);
+        allow delete, list: if false;
+      }
+      match /events/{eventId} {
+        allow get, list, create, update: if iAm(userId);
+        allow delete: if false;
+
+        match /__computed/self {
+          allow get: if true;
+          allow list, write: if false;
+        }
+        match /talksNotes/{talkId} {
+          allow get, list, create, update: if iAm(userId);
+          allow delete: if false;
+        }
+        match /days/{dayId} {
+          allow get, list, create, update: if iAm(userId);
+          allow delete: if false;
+
+          match /feedbacks/self {
+            allow get, create, update: if iAm(userId);
+            allow list, delete: if false;
+          }
+        }
+      }
+    }
+  }
+}