@edgedev/create-edge-app 1.0.20 → 1.0.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/firestore.rules CHANGED
@@ -2,6 +2,29 @@ rules_version = '2';
2
2
  // #EDGE FIREBASE RULES START
3
3
  service cloud.firestore {
4
4
 
5
+ match /databases/{database}/documents/phone-auth/{phone} {
6
+ allow read: if false;
7
+ allow create: if false;
8
+ allow update: if false;
9
+ allow delete: if false;
10
+ }
11
+
12
+ match /databases/{database}/documents/topic-queue/{topic} {
13
+ allow read: if false;
14
+ allow create: if false;
15
+ allow update: if false;
16
+ allow delete: if false;
17
+ }
18
+
19
+
20
+ match /databases/{database}/documents/public-users/{user} {
21
+ allow read: if request.auth != null;
22
+ allow list: if request.auth != null;
23
+ allow create: if false;
24
+ allow update: if false;
25
+ allow delete: if false;
26
+ }
27
+
5
28
  match /databases/{database}/documents/events/{event} {
6
29
  allow read: if false;
7
30
  allow create: if false;
@@ -222,9 +245,15 @@ service cloud.firestore {
222
245
  }
223
246
  function checkPermission(collectionPath, permissionCheck) {
224
247
  let user = get(/databases/$(database)/documents/users/$(request.auth.uid)).data;
225
- let skipPaths = ["collection-data", "users", "staged-users", "events", "rule-helpers"];
248
+ let skipPaths = ["collection-data", "users", "staged-users", "events", "rule-helpers", "phone-auth", "public-users", "topic-queue"];
226
249
  let ruleHelper = get(/databases/$(database)/documents/rule-helpers/$(request.auth.uid)).data;
227
250
  return !(collectionPath in skipPaths) &&
251
+ !(permissionCheck == "write" &&
252
+ (
253
+ ("stripeCustomerId" in request.resource.data && (!("stripeCustomerId" in resource.data) || resource.data.stripeCustomerId != request.resource.data.stripeCustomerId)) ||
254
+ ("stripeSubscription" in request.resource.data && (!("stripeSubscription" in resource.data) || resource.data.stripeSubscription != request.resource.data.stripeSubscription))
255
+ )
256
+ ) &&
228
257
  request.auth != null &&
229
258
  collectionPath in ruleHelper &&
230
259
  "permissionCheckPath" in ruleHelper[collectionPath] &&
@@ -1 +1,294 @@
1
1
  rules_version = '2';
2
+ // #EDGE FIREBASE RULES START
3
+ service cloud.firestore {
4
+
5
+ match /databases/{database}/documents/events/{event} {
6
+ allow read: if false;
7
+ allow create: if false;
8
+ allow update: if false;
9
+ allow delete: if false;
10
+ }
11
+
12
+ match /databases/{database}/documents/rule-helpers/{helper} {
13
+ allow read: if false;
14
+ allow create: if request.auth.uid == request.resource.data.uid;
15
+ allow update: if request.auth.uid == request.resource.data.uid;
16
+ allow delete: if false;
17
+ }
18
+
19
+ match /databases/{database}/documents/users/{user} {
20
+ function readSelf() {
21
+ return resource == null ||
22
+ (
23
+ "userId" in resource.data &&
24
+ resource.data.userId == request.auth.uid
25
+ );
26
+ }
27
+
28
+ allow read: if readSelf();
29
+ allow create: if false;
30
+ allow update: if false;
31
+ allow delete: if false;
32
+ }
33
+
34
+ match /databases/{database}/documents/collection-data/{collectionPath} {
35
+ // TODO: these rules need tested.
36
+ function getRolePermission(role, collection, permissionCheck) {
37
+ let pathCollectionPermissions = get(/databases/$(database)/documents/collection-data/$(collection)).data;
38
+ let defaultPermissions = get(/databases/$(database)/documents/collection-data/-default-).data;
39
+ return (role in pathCollectionPermissions && pathCollectionPermissions[role][permissionCheck]) ||
40
+ (role in defaultPermissions && defaultPermissions[role][permissionCheck]);
41
+ }
42
+ function canAssign() {
43
+ let user = get(/databases/$(database)/documents/users/$(request.auth.uid)).data;
44
+ let ruleHelper = get(/databases/$(database)/documents/rule-helpers/$(request.auth.uid)).data['edge-assignment-helper'];
45
+ return collectionPath.matches("^" + ruleHelper[collectionPath].permissionCheckPath + ".*$") &&
46
+ (
47
+ "specialPermissions" in user &&
48
+ ruleHelper[collectionPath].permissionCheckPath in user.specialPermissions &&
49
+ "assign" in user.specialPermissions[ruleHelper[collectionPath].permissionCheckPath] &&
50
+ user.specialPermissions[ruleHelper[collectionPath].permissionCheckPath]["assign"]
51
+ ) ||
52
+ (
53
+ "roles" in user &&
54
+ ruleHelper[collectionPath].permissionCheckPath in user.roles &&
55
+ "role" in user.roles[ruleHelper[collectionPath].permissionCheckPath] &&
56
+ getRolePermission(user.roles[ruleHelper[collectionPath].permissionCheckPath].role, collectionPath, "assign")
57
+ );
58
+ }
59
+ allow read: if request.auth != null; // All signed in users can read collection-data
60
+ allow create: if canAssign();
61
+ allow update: if canAssign();
62
+ allow delete: if canAssign();
63
+ }
64
+
65
+ match /databases/{database}/documents/staged-users/{user} {
66
+
67
+ function canUpdate() {
68
+ let user = get(/databases/$(database)/documents/users/$(request.auth.uid)).data;
69
+ let ruleHelper = get(/databases/$(database)/documents/rule-helpers/$(request.auth.uid)).data;
70
+
71
+ return (
72
+ request.auth.uid == request.resource.data.uid &&
73
+ (
74
+ (
75
+ (
76
+ request.resource.data.userId == resource.data.userId ||
77
+ resource.data.userId == ""
78
+ ) &&
79
+ (
80
+ request.resource.data.userId == request.auth.uid ||
81
+ request.resource.data.templateUserId == request.auth.uid
82
+ )
83
+ ) ||
84
+ (
85
+ request.resource.data.userId == resource.data.userId &&
86
+ "edge-assignment-helper" in ruleHelper &&
87
+ permissionUpdatesCheck(user, ruleHelper, "roles") &&
88
+ permissionUpdatesCheck(user, ruleHelper, "specialPermssions")
89
+ )
90
+ )
91
+ );
92
+
93
+ }
94
+
95
+
96
+ function permissionUpdatesCheck(user, ruleHelper, permissionType) {
97
+ return !(permissionType in request.resource.data) ||
98
+ (
99
+ resource.data.userId == request.auth.uid &&
100
+ request.resource.data[permissionType].keys().hasOnly(resource.data[permissionType].keys())
101
+ ) ||
102
+ (
103
+ resource.data.userId != request.auth.uid &&
104
+ permissionCheck(permissionType, user, ruleHelper)
105
+ );
106
+ }
107
+ function permissionCheck(permissionType, user, ruleHelper) {
108
+ let lastPathUpdated = ruleHelper["edge-assignment-helper"].fullPath;
109
+ let permissionCheckPath = ruleHelper["edge-assignment-helper"].permissionCheckPath;
110
+ return request.resource.data[permissionType].diff(resource.data[permissionType]).affectedKeys().size() == 0 ||
111
+ (
112
+ request.resource.data[permissionType].diff(resource.data[permissionType]).affectedKeys().size() == 1 &&
113
+ request.resource.data[permissionType].diff(resource.data[permissionType]).affectedKeys() == [lastPathUpdated].toSet() &&
114
+ (
115
+ permissionCheckPath == "-" ||
116
+ lastPathUpdated.matches("^" + permissionCheckPath + ".*$")
117
+ ) &&
118
+ (
119
+ (
120
+ "roles" in user &&
121
+ getRolePermission(user.roles[permissionCheckPath].role, permissionCheckPath, "assign")
122
+ ) ||
123
+ (
124
+ "specialPermissions" in user &&
125
+ permissionCheckPath in user.specialPermissions &&
126
+ "assign" in user.specialPermissions[permissionCheckPath] &&
127
+ user.specialPermissions[permissionCheckPath]["assign"]
128
+ )
129
+ )
130
+ );
131
+ }
132
+
133
+ function canAssign(user, ruleHelper) {
134
+ return request.auth != null &&
135
+ "edge-assignment-helper" in ruleHelper &&
136
+ (
137
+ (
138
+ "roles" in user &&
139
+ ruleHelper["edge-assignment-helper"].permissionCheckPath in user.roles &&
140
+ getRolePermission(user.roles[ruleHelper["edge-assignment-helper"].permissionCheckPath].role, ruleHelper["edge-assignment-helper"].permissionCheckPath, 'assign')
141
+ ) ||
142
+ (
143
+ "specialPermissions" in user &&
144
+ ruleHelper["edge-assignment-helper"].permissionCheckPath in user.specialPermissions &&
145
+ "assign" in user.specialPermissions[ruleHelper["edge-assignment-helper"].permissionCheckPath] &&
146
+ user.specialPermissions[ruleHelper["edge-assignment-helper"].permissionCheckPath]["assign"]
147
+ )
148
+ )
149
+ }
150
+
151
+ function canAssignSubCreatePath(user, ruleHelper) {
152
+ let permissionCheckPath = ruleHelper["edge-assignment-helper"].permissionCheckPath;
153
+ return (
154
+ !("subCreate" in request.resource.data) ||
155
+ (
156
+ "subCreate" in request.resource.data &&
157
+ request.resource.data.subCreate.keys().size() == 0
158
+ )
159
+ )||
160
+ (
161
+ permissionCheckPath == "-" ||
162
+ request.resource.data.subCreate.rootPath.matches("^" + permissionCheckPath + ".*$")
163
+ ) &&
164
+ (
165
+ (
166
+ "roles" in user &&
167
+ permissionCheckPath in user.roles &&
168
+ getRolePermission(user.roles[permissionCheckPath].role, permissionCheckPath, "assign")
169
+ ) ||
170
+ (
171
+ "specialPermissions" in user &&
172
+ permissionCheckPath in user.specialPermissions &&
173
+ "assign" in user.specialPermissions[permissionCheckPath] &&
174
+ user.specialPermissions[permissionCheckPath]["assign"]
175
+ )
176
+ )
177
+
178
+ }
179
+
180
+ function canList() {
181
+ let user = get(/databases/$(database)/documents/users/$(request.auth.uid)).data;
182
+ let ruleHelper = get(/databases/$(database)/documents/rule-helpers/$(request.auth.uid)).data;
183
+ return canAssign(user, ruleHelper);
184
+ }
185
+
186
+ function canCreate() {
187
+ let user = get(/databases/$(database)/documents/users/$(request.auth.uid)).data;
188
+ let ruleHelper = get(/databases/$(database)/documents/rule-helpers/$(request.auth.uid)).data;
189
+ return noPermissionData() && canAssign(user, ruleHelper) && canAssignSubCreatePath(user, ruleHelper);
190
+ }
191
+
192
+ function noPermissionData() {
193
+ return request.resource.data.roles.size() == 0 && request.resource.data.specialPermissions.size() == 0;
194
+ }
195
+
196
+ function getRolePermission(role, collection, permissionCheck) {
197
+ let pathCollectionPermissions = get(/databases/$(database)/documents/collection-data/$(collection)).data;
198
+ let defaultPermissions = get(/databases/$(database)/documents/collection-data/-default-).data;
199
+ return (role in pathCollectionPermissions && pathCollectionPermissions[role][permissionCheck]) ||
200
+ (role in defaultPermissions && defaultPermissions[role][permissionCheck]);
201
+ }
202
+
203
+ function canGet () {
204
+ return resource == null ||
205
+ ("userId" in resource.data && resource.data.userId == "") ||
206
+ ("userId" in resource.data && resource.data.userId == request.auth.uid) ||
207
+ canAssign(get(/databases/$(database)/documents/users/$(request.auth.uid)).data, get(/databases/$(database)/documents/rule-helpers/$(request.auth.uid)).data);
208
+ }
209
+ allow get: if canGet();
210
+ allow list: if canList();
211
+ allow create: if canCreate();
212
+ allow update: if canUpdate();
213
+ allow delete: if false // TODO if isTemplate is true... can delete... otherwise users never deleted just removed from collection paths
214
+ }
215
+
216
+ match /databases/{database}/documents/{seg1} {
217
+ function getRolePermission(role, collection, permissionCheck) {
218
+ let pathCollectionPermissions = get(/databases/$(database)/documents/collection-data/$(collection)).data;
219
+ let defaultPermissions = get(/databases/$(database)/documents/collection-data/-default-).data;
220
+ return (role in pathCollectionPermissions && pathCollectionPermissions[role][permissionCheck]) ||
221
+ (role in defaultPermissions && defaultPermissions[role][permissionCheck]);
222
+ }
223
+ function checkPermission(collectionPath, permissionCheck) {
224
+ let user = get(/databases/$(database)/documents/users/$(request.auth.uid)).data;
225
+ let skipPaths = ["collection-data", "users", "staged-users", "events", "rule-helpers"];
226
+ let ruleHelper = get(/databases/$(database)/documents/rule-helpers/$(request.auth.uid)).data;
227
+ return !(collectionPath in skipPaths) &&
228
+ request.auth != null &&
229
+ collectionPath in ruleHelper &&
230
+ "permissionCheckPath" in ruleHelper[collectionPath] &&
231
+ (
232
+ ruleHelper[collectionPath].permissionCheckPath == "-" ||
233
+ collectionPath.matches("^" + ruleHelper[collectionPath].permissionCheckPath + ".*$")
234
+ ) &&
235
+ (
236
+ (
237
+ "roles" in user &&
238
+ ruleHelper[collectionPath].permissionCheckPath in user.roles &&
239
+ getRolePermission(user.roles[ruleHelper[collectionPath].permissionCheckPath].role, ruleHelper[collectionPath].permissionCheckPath, permissionCheck)
240
+ ) ||
241
+ (
242
+ "specialPermissions" in user &&
243
+ ruleHelper[collectionPath].permissionCheckPath in user.specialPermissions &&
244
+ permissionCheck in user.specialPermissions[ruleHelper[collectionPath].permissionCheckPath] &&
245
+ user.specialPermissions[ruleHelper[collectionPath].permissionCheckPath][permissionCheck]
246
+ )
247
+ );
248
+ }
249
+ match /{seg2} {
250
+ allow get: if checkPermission(seg1 + "-" + seg2, "read");
251
+ allow list: if checkPermission(seg1, "read");
252
+ allow create: if request.auth.uid == request.resource.data.uid && checkPermission(seg1, "write");
253
+ allow update: if request.auth.uid == request.resource.data.uid && checkPermission(seg1 + "-" + seg2, "write");
254
+ allow delete: if checkPermission(seg1, "delete");
255
+ match /{seg3} {
256
+ allow get: if checkPermission(seg1 + "-" + seg2 + "-" + seg3, "read");
257
+ allow list: if checkPermission(seg1 + "-" + seg2, "read");
258
+ allow create: if request.auth.uid == request.resource.data.uid && checkPermission(seg1 + "-" + seg2, "write");
259
+ allow update: if request.auth.uid == request.resource.data.uid && checkPermission(seg1 + "-" + seg2 + "-" + seg3, "write");
260
+ allow delete: if checkPermission(seg1 + "-" + seg2, "delete");
261
+ match /{seg4} {
262
+ allow get: if checkPermission(seg1 + "-" + seg2 + "-" + seg3 + "-" + seg4, "read");
263
+ allow list: if checkPermission(seg1 + "-" + seg2 + "-" + seg3, "read");
264
+ allow create: if request.auth.uid == request.resource.data.uid && checkPermission(seg1 + "-" + seg2 + "-" + seg3, "write");
265
+ allow update: if request.auth.uid == request.resource.data.uid && checkPermission(seg1 + "-" + seg2 + "-" + seg3 + "-" + seg4, "write");
266
+ allow delete: if checkPermission(seg1 + "-" + seg2 + "-" + seg3, "delete");
267
+
268
+ match /{seg5} {
269
+ allow get: if checkPermission(seg1 + "-" + seg2 + "-" + seg3 + "-" + seg4 + "-" + seg5, "read");
270
+ allow list: if checkPermission(seg1 + "-" + seg2 + "-" + seg3 + "-" + seg4, "read");
271
+ allow create: if request.auth.uid == request.resource.data.uid && checkPermission(seg1 + "-" + seg2 + "-" + seg3 + "-" + seg4, "write");
272
+ allow update: if request.auth.uid == request.resource.data.uid && checkPermission(seg1 + "-" + seg2 + "-" + seg3 + "-" + seg4 + "-" + seg5, "write");
273
+ allow delete: if checkPermission(seg1 + "-" + seg2 + "-" + seg3 + "-" + seg4, "delete");
274
+ match /{seg6} {
275
+ allow get: if checkPermission(seg1 + "-" + seg2 + "-" + seg3 + "-" + seg4 + "-" + seg5 + "-" + seg6, "read");
276
+ allow list: if checkPermission(seg1 + "-" + seg2 + "-" + seg3 + "-" + seg4 + "-" + seg5, "read");
277
+ allow create: if request.auth.uid == request.resource.data.uid && checkPermission(seg1 + "-" + seg2 + "-" + seg3 + "-" + seg4 + "-" + seg5, "write");
278
+ allow update: if request.auth.uid == request.resource.data.uid && checkPermission(seg1 + "-" + seg2 + "-" + seg3 + "-" + seg4 + "-" + seg5 + "-" + seg6, "write");
279
+ allow delete: if checkPermission(seg1 + "-" + seg2 + "-" + seg3 + "-" + seg4 + "-" + seg5, "delete");
280
+ match /{seg7} {
281
+ allow get: if checkPermission(seg1 + "-" + seg2 + "-" + seg3 + "-" + seg4 + "-" + seg5 + "-" + seg6 + "-" + seg7, "read");
282
+ allow list: if checkPermission(seg1 + "-" + seg2 + "-" + seg3 + "-" + seg4 + "-" + seg5 + "-" + seg6, "read");
283
+ allow create: if request.auth.uid == request.resource.data.uid && checkPermission(seg1 + "-" + seg2 + "-" + seg3 + "-" + seg4 + "-" + seg5 + "-" + seg6, "write");
284
+ allow update: if request.auth.uid == request.resource.data.uid && checkPermission(seg1 + "-" + seg2 + "-" + seg3 + "-" + seg4 + "-" + seg5 + "-" + seg6 + "-" + seg7, "write");
285
+ allow delete: if checkPermission(seg1 + "-" + seg2 + "-" + seg3 + "-" + seg4 + "-" + seg5 + "-" + seg6, "delete");
286
+ }
287
+ }
288
+ }
289
+ }
290
+ }
291
+ }
292
+ }
293
+ }
294
+ // #EDGE FIREBASE RULES END
@@ -13,11 +13,14 @@
13
13
  },
14
14
  "main": "index.js",
15
15
  "dependencies": {
16
+ "@google-cloud/pubsub": "^4.0.6",
17
+ "crypto": "^1.0.1",
16
18
  "dotenv": "^16.3.1",
17
19
  "firebase-admin": "^10.0.2",
18
- "firebase-functions": "^4.2.1",
20
+ "firebase-functions": "^4.5.0",
19
21
  "form-data": "^4.0.0",
20
22
  "formidable-serverless": "^1.1.1",
23
+ "moment-timezone": "^0.5.43",
21
24
  "openai": "^4.11.1",
22
25
  "stripe": "^13.8.0",
23
26
  "twilio": "^4.18.0"
@@ -26,4 +29,4 @@
26
29
  "firebase-functions-test": "^0.2.0"
27
30
  },
28
31
  "private": true
29
- }
32
+ }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@edgedev/create-edge-app",
3
- "version": "1.0.20",
3
+ "version": "1.0.21",
4
4
  "description": "Create Edge Starter App",
5
5
  "bin": {
6
6
  "create-edge-app": "./bin/cli.js"
@@ -36,7 +36,7 @@
36
36
  "@capacitor/ios": "^5.4.1",
37
37
  "@capacitor/push-notifications": "^5.1.0",
38
38
  "@chenfengyuan/vue-number-input": "2",
39
- "@edgedev/firebase": "latest",
39
+ "@edgedev/firebase": "^2.0.20",
40
40
  "@vueuse/core": "^10.4.1",
41
41
  "maska": "^2.1.9",
42
42
  "vuetify": "^3.3.19"
@@ -1,5 +0,0 @@
1
- {
2
- "openai": {
3
- "api_key": "some-key-here"
4
- }
5
- }
@@ -1,21 +0,0 @@
1
- const functions = require('firebase-functions')
2
- const admin = require('firebase-admin')
3
-
4
- admin.initializeApp()
5
-
6
- const { onCall, HttpsError } = require('firebase-functions/v2/https')
7
- const { logger } = require('firebase-functions/v2')
8
- const { getFirestore } = require('firebase-admin/firestore')
9
- const twilio = require('twilio')
10
- const db = getFirestore()
11
-
12
- module.exports = {
13
- onCall,
14
- HttpsError,
15
- logger,
16
- getFirestore,
17
- functions,
18
- admin,
19
- twilio,
20
- db,
21
- }