@edgedev/firebase 1.6.3 → 1.7.1

package/edgeFirebase.ts

@@ -1,5 +1,5 @@
 import { initializeApp } from "firebase/app";
-import { reactive, computed } from "vue";
+import { reactive } from "vue";
 import {
   getFirestore,
   collection,
@@ -95,27 +95,44 @@ interface UserDataObject {
   meta: object;
   roles: role[];
   specialPermissions: specialPermission[];
+  stagedDocId: string;
 }
 
 interface newUser {
-  email: string;
   roles: role[];
   specialPermissions: specialPermission[];
   meta: object;
-}
-
-
-interface userMeta extends newUser {
-  docId: string;
-  userId: string;
+  isTemplate?: boolean;
+  subCreate?: {
+    rootPath: string, // This must be a collection path (odd number of segments) since a document will be created and assigned to ther user here.
+    role: string,
+    dynamicDocumentField: string, // This is the field in the document that will be set by the value of "dynamicDocumentFieldValue" passed during registration, like "name"
+    documentStructure: {
+      [key: string]: any
+    }
+  };
 }
 
 interface userRegister {
   email: string;
   password: string;
   meta: object;
+  registrationCode: string;
+  dynamicDocumentFieldValue?: string;
 }
 
+
+interface RuleCheck {
+    permissionType: string;
+    permissionCheckPath: string; 
+    fullPath: string;
+    action: string;
+}
+
+// interface RuleCheck {
+//   [key: string]: RuleCheckItem | string;
+// }
+
 interface Credentials {
   email: string;
   password: string;
@@ -188,14 +205,9 @@ export const EdgeFirebase = class {
   public auth = null;
   public db = null;
 
-  private initUserMetaPermissions = async (): Promise<void> => {
-    updateDoc(doc(this.db, "users", this.user.email), {
-      userId: this.user.uid
-    });
+  private initUserMetaPermissions = async (docSnap): Promise<void> => {
     this.user.meta = {};
-    const docRef = doc(this.db, "users", this.user.email);
-    const docSnap = await getDoc(docRef);
-    if (docSnap) {
+    if (docSnap.exists()) {
       this.user.meta = docSnap.data().meta;
       const roles: role[] = [];
       if (docSnap.data().roles) {
@@ -219,44 +231,35 @@ export const EdgeFirebase = class {
         }
       }
       this.user.specialPermissions = specialPermissions;
+      this.user.stagedDocId = docSnap.data().stagedDocId;
     }
     this.stopSnapshot('userMeta')
     const metaUnsubscribe = onSnapshot(
-      doc(this.db, "users", this.user.email),
+      doc(this.db, "users", this.user.uid),
       (doc) => {
-        if (!doc.exists()) {
-          this.setUser({
-            email: this.user.email,
-            roles: [],
-            specialPermissions: [],
-            meta: {},
-          });
-          this.user.meta = {};
-        } else {
-          this.user.meta = doc.data().meta;
-          const roles: role[] = [];
-          if (doc.data().roles) {
-            for (const collectionPath in doc.data().roles) {
-              roles.push({
-                collectionPath,
-                role: doc.data().roles[collectionPath].role
-              });
-            }
+        this.user.meta = doc.data().meta;
+        const roles: role[] = [];
+        if (doc.data().roles) {
+          for (const collectionPath in doc.data().roles) {
+            roles.push({
+              collectionPath,
+              role: doc.data().roles[collectionPath].role
+            });
           }
-          this.user.roles = roles;
-
-          const specialPermissions: specialPermission[] = [];
-          if (doc.data().specialPermissions) {
-            for (const collectionPath in doc.data().specialPermissions) {
-              specialPermissions.push({
-                collectionPath,
-                permissions:
-                  doc.data().specialPermissions[collectionPath].permissions
-              });
-            }
+        }
+        this.user.roles = roles;
+
+        const specialPermissions: specialPermission[] = [];
+        if (doc.data().specialPermissions) {
+          for (const collectionPath in doc.data().specialPermissions) {
+            specialPermissions.push({
+              collectionPath,
+              permissions:
+                doc.data().specialPermissions[collectionPath].permissions
+            });
           }
-          this.user.specialPermissions = specialPermissions;
         }
+        this.user.specialPermissions = specialPermissions;
       }
     );
     this.unsubscibe.userMeta = metaUnsubscribe;
@@ -323,12 +326,25 @@ export const EdgeFirebase = class {
 
 
 
-  private startUserMetaSync = async (): Promise<void> => {
+  private startUserMetaSync = async (docSnap): Promise<void> => {
     await this.startCollectionPermissionsSync()
-    await this.initUserMetaPermissions();
+    await this.initUserMetaPermissions(docSnap);
     this.user.loggedIn = true;
   };
 
+  private waitForUser = async(): Promise<void> => {
+    //On registration may take a second for user to be created
+    const docRef = doc(this.db, "users", this.user.uid);
+    const docSnap = await getDoc(docRef);
+    if (docSnap.exists()) {
+      this.startUserMetaSync(docSnap);
+    } else {
+      setTimeout(() => {
+          this.waitForUser();
+      }, 1000);
+    }
+  }
+
   private setOnAuthStateChanged = (): void => {
     onAuthStateChanged(this.auth, (userAuth) => {
       if (userAuth) {
@@ -336,7 +352,7 @@ export const EdgeFirebase = class {
         this.user.uid = userAuth.uid;
         this.user.logInError = false;
         this.user.logInErrorMessage = "";
-        this.startUserMetaSync();
+        this.waitForUser();
       } else {
         this.user.email = "";
         this.user.uid = null;
@@ -346,11 +362,17 @@ export const EdgeFirebase = class {
       }
     });
   };
-
   public registerUser = async (
     userRegister: userRegister
   ): Promise<actionResponse> => {
-    const userRef = doc(this.db, "users", userRegister.email);
+    if (!Object.prototype.hasOwnProperty.call(userRegister, 'registrationCode') || userRegister.registrationCode === "") {
+      return this.sendResponse({
+        success: false,
+        message: "Registration code is required.",
+        meta: {}
+      });
+    }
+    const userRef = doc(this.db, "staged-users", userRegister.registrationCode);
     const userSnap = await getDoc(userRef);
     if (userSnap.exists()) {
       const user = userSnap.data();
@@ -361,29 +383,52 @@ export const EdgeFirebase = class {
           meta: {}
         });
       } else {
-        createUserWithEmailAndPassword(
+        if (user.isTemplate  && Object.prototype.hasOwnProperty.call("subCreate", user) &&  Object.values(user.subCreate).length > 0) {
+          if (!Object.prototype.hasOwnProperty.call(userRegister, 'dynamicDocumentFieldValue') || userRegister.dynamicDocumentFieldValue === "") {
+            return this.sendResponse({
+              success: false,
+              message: "Dynamic document field value is required for registration when template user has subCreate.",
+              meta: {}
+            });
+         }
+        }
+        // TODO: check if user is already registered, if so return error with auth
+        const response = await createUserWithEmailAndPassword(
           this.auth,
           userRegister.email,
           userRegister.password
-        ).then(() => {
-          const metaUpdate = {};
-          for (const [key, value] of Object.entries(userRegister.meta)) {
-            metaUpdate["meta." + key] = value;
-          }
-          if (Object.keys(metaUpdate).length > 0) {
-            updateDoc(doc(this.db, "users", this.user.email), metaUpdate);
+        );
+
+        let metaUpdate = {};
+        if (Object.prototype.hasOwnProperty.call(userRegister, 'meta')) {
+          metaUpdate = userRegister.meta;
+        }else{
+          metaUpdate = user.meta;
+        }
+
+        let stagedUserUpdate: {userId?: string, templateUserId?: string, dynamicDocumentFieldValue?: string, uid: string, meta: unknown, templateMeta?: unknown} = {userId: response.user.uid, uid: response.user.uid, meta: metaUpdate}
+        if (user.isTemplate) {
+          stagedUserUpdate = {templateUserId: response.user.uid, uid: response.user.uid, meta: user.meta, templateMeta: metaUpdate}
+          if (Object.prototype.hasOwnProperty.call(userRegister, 'dynamicDocumentFieldValue')) {
+            stagedUserUpdate = {templateUserId: response.user.uid, uid: response.user.uid, dynamicDocumentFieldValue: userRegister.dynamicDocumentFieldValue, meta: user.meta, templateMeta: metaUpdate}
           }
-          return this.sendResponse({
-            success: true,
-            message: "",
-            meta: {}
-          });
+        }
+        const initRoleHelper = {uid: response.user.uid}
+        initRoleHelper["edge-assignment-helper"] = {permissionType: "roles"}
+        await setDoc(doc(this.db, "rule-helpers", response.user.uid), initRoleHelper);
+        await updateDoc(doc(this.db, "staged-users/" + userRegister.registrationCode), stagedUserUpdate)
+        
+        return this.sendResponse({
+          success: true,
+          message: "",
+          meta: {}
         });
+        
       }
     } else {
       return this.sendResponse({
         success: false,
-        message: "User doesn't exist",
+        message: "Registration code not valid.",
         meta: {}
       });
     }
@@ -453,10 +498,12 @@ export const EdgeFirebase = class {
     }
   };
 
-  setUserMeta = async (meta: unknown): Promise<actionResponse> => {
+  public setUserMeta = async (meta: unknown): Promise<actionResponse> => {
+    //TODO: Change setUserMeta to also be used by someone with assign permissions and 
+    // add a permissionCheck here for it.
     for (const [key, value] of Object.entries(meta)) {
-      await updateDoc(doc(this.db, "users/" + this.user.email), {
-        ["meta." + key]: value
+      await updateDoc(doc(this.db, "staged-users/" + this.user.stagedDocId), {
+        ["meta." + key]: value, uid: this.user.uid
       });
     }
     return this.sendResponse({
@@ -466,31 +513,31 @@ export const EdgeFirebase = class {
     });
   };
 
-  public removeUser = async (email: string): Promise<actionResponse> => {
+  public removeUser = async (docId: string): Promise<actionResponse> => {
     const removedFrom = [];
-    const userRef = doc(this.db, "users", email);
+    const userRef = doc(this.db, "users", docId);
     const userSnap = await getDoc(userRef);
     if (userSnap.data().roles) {
       for (const collectionPath in userSnap.data().roles) {
-        const canAssign = this.permissionCheck(
+        const canAssign = await this.permissionCheck(
           "assign",
           collectionPath.replaceAll("-", "/")
         );
         if (canAssign) {
-          await this.removeUserRoles(email, collectionPath.replaceAll("-", "/"));
+          await this.removeUserRoles(docId, collectionPath.replaceAll("-", "/"));
           removedFrom.push(collectionPath.replaceAll("-", "/"));
         }
       }
     }
     if (userSnap.data().specialPermissions) {
       for (const collectionPath in userSnap.data().specialPermissions) {
-        const canAssign = this.permissionCheck(
+        const canAssign = await this.permissionCheck(
           "assign",
           collectionPath.replaceAll("-", "/")
         );
         if (canAssign) {
           this.removeUserSpecialPermissions(
-            email,
+            docId,
             collectionPath.replaceAll("-", "/")
           );
           removedFrom.push(collectionPath.replaceAll("-", "/"));
@@ -511,8 +558,8 @@ export const EdgeFirebase = class {
       });
     }
   };
-
-  public setUser = async (newUser: newUser): Promise<actionResponse> => {
+  
+  public addUser = async (newUser: newUser): Promise<actionResponse> => {
     const canAssignRole = this.multiPermissionCheck(
       "assign",
       newUser.roles
@@ -522,30 +569,8 @@ export const EdgeFirebase = class {
       newUser.specialPermissions
     );
     if (canAssignRole.canDo && canAssignSpecialPermissions.canDo) {
-      const userRef = doc(this.db, "users", newUser.email);
-      const userSnap = await getDoc(userRef);
-      if (!userSnap.exists()) {
-        const userMeta: userMeta = {
-          docId: newUser.email,
-          userId: "",
-          email: newUser.email,
-          roles: newUser.roles,
-          specialPermissions: newUser.specialPermissions,
-          meta: newUser.meta
-        };
-        await this.generateUserMeta(userMeta);
-        return this.sendResponse({
-          success: true,
-          message: "",
-          meta: {}
-        });
-      } else {
-        return this.sendResponse({
-          success: false,
-          message: "User already exists",
-          meta: {}
-        });
-      }
+      const response = await this.generateUserMeta(newUser);
+      return this.sendResponse(response);
     } else {
       return this.sendResponse({
         success: false,
@@ -569,7 +594,7 @@ export const EdgeFirebase = class {
     //   canDo = false;
     // }
     for (const collection of collections) {
-      if (!(this.permissionCheck(action, collection.collectionPath))) {
+      if (!(this.permissionCheckOnly(action, collection.collectionPath))) {
         badCollectionPaths.push(collection.collectionPath);
         canDo = false;
       }
@@ -592,11 +617,52 @@ export const EdgeFirebase = class {
     return response;
   };
 
-  private permissionCheck = (
-    action: action,
-    collectionPath: string
-  ): boolean => {
-    const collection = collectionPath.split("/");
+  private setRuleHelper = async(collectionPath: string, action): Promise<void> => {
+    const collection = collectionPath.replaceAll("-", "/").split("/");
+    let ruleKey = collectionPath.replaceAll("/", "-");
+    if (action === "assign") {
+      ruleKey = "edge-assignment-helper";
+    }
+    let index = collection.length;
+    const ruleCheck: RuleCheck =  { permissionType: "", permissionCheckPath: "", fullPath: collectionPath.replaceAll("/", "-"), action };
+   
+    while (index > 0) {
+      const collectionArray = JSON.parse(JSON.stringify(collection));
+      const permissionCheck = collectionArray.splice(0, index).join("-");
+      const role = this.user.roles.find(
+        (r) => r.collectionPath === permissionCheck
+      );
+      if (role) {
+        ruleCheck.permissionCheckPath = permissionCheck;
+        ruleCheck.permissionType = "roles";
+      }
+      const specialPermission = this.user.specialPermissions.find(
+        (r) => r.collectionPath === permissionCheck
+      );
+      if (specialPermission) {
+        ruleCheck.permissionCheckPath = permissionCheck;
+        ruleCheck.permissionType = "specialPermissions";
+      }
+      index--;
+    }
+    const rootRole = this.user.roles.find((r) => r.collectionPath === "-");
+    if (rootRole) {
+      ruleCheck.permissionCheckPath = "-";
+      ruleCheck.permissionType = "roles";
+    }
+    const rootSpecialPermission = this.user.specialPermissions.find(
+      (r) => r.collectionPath === "-"
+    );
+    if (rootSpecialPermission) {
+      ruleCheck.permissionCheckPath = "-";
+      ruleCheck.permissionType = "specialPermissions";
+    }
+    const check = {[ruleKey]: ruleCheck,  uid: this.user.uid };
+    await setDoc(doc(this.db, "rule-helpers", this.user.uid), check, { merge: true });
+  }
+
+  public permissionCheckOnly = (action: action, collectionPath: string): boolean => {
+    const collection = collectionPath.replaceAll("-", "/").split("/");
     let index = collection.length;
     let permissionData = {};
     permissionData = {
@@ -644,6 +710,17 @@ export const EdgeFirebase = class {
       }
     }
     return permissionData[action];
+  }
+
+  public permissionCheck = async(
+    action: action,
+    collectionPath: string,
+  ): Promise<boolean> => {
+    const check = this.permissionCheckOnly(action, collectionPath);
+    if (check) {
+      await this.setRuleHelper(collectionPath, action);
+    }
+    return check;
   };
 
   private getCollectionPermissions = (
@@ -672,48 +749,78 @@ export const EdgeFirebase = class {
     };
   };
 
-  private generateUserMeta = async (userMeta: userMeta): Promise<void> => {
+  private generateUserMeta = async (userMeta: newUser): Promise<actionResponse> => {
     const roles: role[] = userMeta.roles;
     const specialPermissions: specialPermission[] = userMeta.specialPermissions;
     delete userMeta.roles;
     delete userMeta.specialPermissions;
 
-    const docRef = doc(this.db, "users", userMeta.docId);
-    const docSnap = await getDoc(docRef);
-    const docData = docSnap.data();
-    const canWrite = this.permissionCheck("write", "users");
-    if (!docData || canWrite) {
-      await setDoc(doc(this.db, "users", userMeta.docId), userMeta);
+    let isTemplate = false
+    if (Object.prototype.hasOwnProperty.call(userMeta, "isTemplate") && userMeta.isTemplate) {
+      isTemplate = true
     }
+
+    let subCreate = {}
+    if (Object.prototype.hasOwnProperty.call(userMeta, "subCreate")) {
+      if (userMeta.subCreate.rootPath.split("-").length % 2==0){
+        return {
+          success: false,
+          message: "subCreate.rootPath must contain an odd number of segments.",
+          meta: {}
+        }
+     }
+      const canAssign = await this.permissionCheck("assign", userMeta.subCreate.rootPath)
+      if (canAssign) {
+         subCreate = userMeta.subCreate
+      } else {
+        return {
+          success: false,
+          message: "You do not have assign permission to '" + userMeta.subCreate.rootPath + "'",
+          meta: {}
+        }
+      }
+    }
+
+    const onlyMeta = { meta: userMeta.meta, userId:  "", uid: this.user.uid, roles:{}, specialPermissions:{}, isTemplate, subCreate };
+
+    const docRef =  await addDoc(collection(this.db, "staged-users"), onlyMeta );
     for (const role of roles) {
-      await this.storeUserRoles(userMeta.docId, role.collectionPath, role.role);
+      await this.storeUserRoles(docRef.id, role.collectionPath, role.role);
     }
     for (const specialPermission of specialPermissions) {
       await this.storeUserSpecialPermissions(
-        userMeta.docId,
+        docRef.id,
         specialPermission.collectionPath,
         specialPermission.permissions
       );
     }
+    return {
+      success: true,
+      message: "",
+      meta: {}
+    }
   };
 
-  // Composable to logout
   public logOut = (): void => {
-    signOut(this.auth)
-      .then(() => {
-        Object.keys(this.unsubscibe).forEach((key) => {
-          if (this.unsubscibe[key] instanceof Function) {
-            this.unsubscibe[key]();
-            this.unsubscibe[key] = null;
-          }
-        });
-      })
-      .catch(() => {
-        // Do nothing
-      });
+    for (const key of Object.keys(this.unsubscibe)) {
+      if (this.unsubscibe[key] instanceof Function) {
+        this.unsubscibe[key]();
+        this.unsubscibe[key] = null;
+      }
+    }
+    signOut(this.auth).then(() => {
+      this.user.uid = null;
+      this.user.email = "";
+      this.user.loggedIn = false;
+      this.user.logInError = false;
+      this.user.logInErrorMessage = "";
+      this.user.meta = {};
+      this.user.roles = [];
+      this.user.specialPermissions = [];
+      this.user.stagedDocId = null;
+    })
   };
 
-  // Composable to login and set persistence
   public logIn = (credentials: Credentials): void => {
     this.logOut();
     signInWithEmailAndPassword(
@@ -757,22 +864,33 @@ export const EdgeFirebase = class {
     meta: {},
     roles: [],
     specialPermissions: [],
+    stagedDocId: null,
   });
 
   public state = reactive({
     collectionPermissions: {},
     users: {},
+    registrationCode: "",
+    registrationMeta: {},
   });
 
   public getDocData = async (
     collectionPath: string,
     docId: string
   ): Promise<{ [key: string]: unknown }> => {
-    const docRef = doc(this.db, collectionPath, docId);
-    const docSnap = await getDoc(docRef);
-    const docData = docSnap.data();
-    docData.docId = docSnap.id;
-    return docData;
+    const canRead = await this.permissionCheck("read", collectionPath + "/" + docId);
+    if (canRead) {
+      const docRef = doc(this.db, collectionPath, docId);
+      const docSnap = await getDoc(docRef);
+      const docData = docSnap.data();
+      docData.docId = docSnap.id;
+      return docData;
+    }
+    return {
+      success: false,
+      message: "Permission Denied",
+      meta: {}
+    }
   };
 
   private collectionExists = (
@@ -789,25 +907,27 @@ export const EdgeFirebase = class {
     last: DocumentData | null = null
   ): Promise<StaticDataResult> => {
     const data: object = {};
+    let nextLast: DocumentData | null = null;
+    const canRead = await this.permissionCheck("read", collectionPath);
+    if (canRead) {
+      const q = this.getQuery(collectionPath, queryList, orderList, max, last);
 
-    const q = this.getQuery(collectionPath, queryList, orderList, max, last);
-
-    const docs = await getDocs(q);
-
-    const nextLast: DocumentData = docs.docs[docs.docs.length - 1];
-    docs.forEach((doc) => {
-      const item = doc.data();
-      item.docId = doc.id;
-      data[doc.id] = item;
-    });
+      const docs = await getDocs(q);
 
+      nextLast = docs.docs[docs.docs.length - 1];
+      docs.forEach((doc) => {
+        const item = doc.data();
+        item.docId = doc.id;
+        data[doc.id] = item;
+      });
+    }
     return { data, next: nextLast };
   };
 
   // Class for wrapping a getSaticData to handle pagination
   get SearchStaticData() {
     const getStaticData = this.getStaticData;
-    const permissionCheck = this.permissionCheck;
+    const permissionCheckOnly = this.permissionCheckOnly;
     const sendResponse = this.sendResponse;
     return class {
       private collectionPath = "";
@@ -910,7 +1030,7 @@ export const EdgeFirebase = class {
         orderList: FirestoreOrderBy[] = [],
         max = 0
       ): Promise<actionResponse> => {
-        const canRead = permissionCheck("read", collectionPath);
+        const canRead = permissionCheckOnly("read", collectionPath);
 
         if (canRead) {
           this.collectionPath = collectionPath;
@@ -996,13 +1116,13 @@ export const EdgeFirebase = class {
     );
   };
 
-  public startSnapshot = (
+  public startSnapshot = async(
     collectionPath: string,
     queryList: FirestoreQuery[] = [],
     orderList: FirestoreOrderBy[] = [],
     max = 0
-  ): actionResponse => {
-    const canRead = this.permissionCheck("read", collectionPath);
+  ): Promise<actionResponse> => {
+    const canRead = await this.permissionCheck("read", collectionPath);
     this.data[collectionPath] = {};
     this.stopSnapshot(collectionPath);
     this.unsubscibe[collectionPath] = null;
@@ -1032,73 +1152,85 @@ export const EdgeFirebase = class {
     }
   };
 
-  public startUsersSnapshot = (collectionPath = ''): void => {
-    this.stopSnapshot('users')
-    this.state.users = {};
-    if (collectionPath) {
-      if (this.permissionCheck('assign', collectionPath)) {
-        const q = query(
-          collection(this.db, "users"),
-          where(
-            "collectionPaths",
-            "array-contains",
-            collectionPath.replaceAll('/', '-')
+  private usersSnapshotStarting = false;
+
+  public startUsersSnapshot = async(collectionPath = ''): Promise<void> => {
+    if (!this.usersSnapshotStarting) {
+      this.usersSnapshotStarting = true;
+      this.stopSnapshot("staged-users");
+      this.state.users = {};
+      if (collectionPath) {
+        const canAssign = await this.permissionCheck('assign', collectionPath);
+        if (canAssign) {
+          const q = query(
+            collection(this.db, "staged-users"),
+            where(
+              "collectionPaths",
+              "array-contains",
+              collectionPath.replaceAll('/', '-')
+            )
           )
-        )
-        const unsubscibe = onSnapshot(q, (querySnapshot) => {
-          const items = {};
-          querySnapshot.forEach((doc) => {
-            const user = doc.data();
-            const newRoles = [];
-            const newSpecialPermissions = [];
-
-            if (user.roles) {
-              const roles: role[] = Object.values(user.roles);
-              roles.forEach((role) => {
-                if (this.permissionCheck('assign', role.collectionPath)) {
-                  newRoles.push(role)
+          const unsubscibe = await onSnapshot(q, (querySnapshot) => {
+            const items = {};
+            querySnapshot.forEach((doc) => {
+              const user = doc.data();
+              const docId = doc.id;
+              const newRoles = [];
+              const newSpecialPermissions = [];
+
+              if (user.roles) {
+                const roles: role[] = Object.values(user.roles);
+                for (const role of roles) {
+                  if (this.permissionCheckOnly('assign', role.collectionPath)) {
+                    newRoles.push(role)
+                  }
                 }
-              });
-            }
-            if (user.specialPermissions) {
-              const permissions: specialPermission[] = Object.values(user.specialPermissions);
-              permissions.forEach(permission => {
-                if (this.permissionCheck('assign', permission.collectionPath)) {
-                  newSpecialPermissions.push(permission)
+              }
+              if (user.specialPermissions) {
+                const permissions: specialPermission[] = Object.values(user.specialPermissions);
+                for (const permission of permissions) {
+                  if (this.permissionCheckOnly('assign', permission.collectionPath)) {
+                    newSpecialPermissions.push(permission)
+                  }
                 }
-              });
-            }
-            const item = {
-              docId: user.docId,
-              email: user.email,
-              roles: newRoles,
-              specialPermissions: newSpecialPermissions,
-              meta: user.meta,
-              last_updated: user.last_updated,
-              userId: user.userId,
-              uid: user.uid
-            }
-            items[doc.id] = item;
+              }
+              const item = {
+                docId,
+                email: user.email,
+                roles: newRoles,
+                specialPermissions: newSpecialPermissions,
+                meta: user.meta,
+                last_updated: user.last_updated,
+                isTemplate: user.isTemplate,
+                subCreate: user.subCreate,
+                userId: user.userId,
+                uid: user.uid
+              }
+              items[doc.id] = item;
+            });
+            this.state.users = items;
           });
-          this.state.users = items;
-        });
-        this.unsubscibe.users = unsubscibe;
+          this.unsubscibe["staged-users"] = unsubscibe;
+        }
       }
-    }
+    };
+    this.usersSnapshotStarting = false;
   };
 
   public removeUserRoles = async (
-    email: string,
+    docId: string,
     collectionPath: string
   ): Promise<actionResponse> => {
-    const canAssign = this.permissionCheck("assign", collectionPath);
+    let canAssign = await this.permissionCheck("assign", collectionPath);
+    if (docId === this.user.stagedDocId) {
+      // User can remove themselves from any role
+      canAssign = true;
+    }
     if (canAssign) {
-      await updateDoc(doc(this.db, "users/" + email), {
+      await updateDoc(doc(this.db, "staged-users/" + docId), {
+        collectionPaths: arrayRemove(collectionPath.replaceAll("/", "-")),
         ["roles." + collectionPath.replaceAll("/", "-")]: deleteField()
       });
-      await updateDoc(doc(this.db, "users/" + email), {
-        collectionPaths: arrayRemove(collectionPath.replaceAll("/", "-"))
-      });
       return this.sendResponse({
         success: true,
         message: "",
@@ -1115,18 +1247,20 @@ export const EdgeFirebase = class {
   };
 
   public removeUserSpecialPermissions = async (
-    email: string,
+    docId: string,
     collectionPath: string
   ): Promise<actionResponse> => {
-    const canAssign = this.permissionCheck("assign", collectionPath);
+    let canAssign = await this.permissionCheck("assign", collectionPath);
+    if (docId === this.user.stagedDocId) {
+      // User can remove themselves from any special permission
+      canAssign = true;
+    }
     if (canAssign) {
-      await updateDoc(doc(this.db, "users/" + email), {
+      await updateDoc(doc(this.db, "staged-users/" + docId), {
+        collectionPaths: arrayRemove(collectionPath.replaceAll("/", "-")),
         ["specialPermissions." + collectionPath.replaceAll("/", "-")]:
           deleteField()
       });
-      await updateDoc(doc(this.db, "users/" + email), {
-        collectionPaths: arrayRemove(collectionPath.replaceAll("/", "-"))
-      });
       return this.sendResponse({
         success: true,
         message: "",
@@ -1143,11 +1277,11 @@ export const EdgeFirebase = class {
   };
 
   public storeUserSpecialPermissions = async (
-    email: string,
+    docId: string,
     collectionPath: string,
     permissions: permissions
   ): Promise<actionResponse> => {
-    const canAssign = this.permissionCheck("assign", collectionPath);
+    const canAssign = await this.permissionCheck("assign", collectionPath);
     if (canAssign) {
       const collectionExists = await this.collectionExists(collectionPath);
       if (collectionExists) {
@@ -1155,11 +1289,13 @@ export const EdgeFirebase = class {
           ["specialPermissions." + collectionPath.replaceAll("/", "-")]: {
             collectionPath: collectionPath.replaceAll("/", "-"),
             permissions
-          }
+          },
+          uid: this.user.uid
         };
-        await updateDoc(doc(this.db, "users/" + email), permissionItem);
-        await updateDoc(doc(this.db, "users/" + email), {
-          collectionPaths: arrayUnion(collectionPath.replaceAll("/", "-"))
+        await updateDoc(doc(this.db, "staged-users/" + docId), {
+          ...permissionItem,
+          collectionPaths: arrayUnion(collectionPath.replaceAll("/", "-")),
+          uid: this.user.uid
         });
         return this.sendResponse({
           success: true,
@@ -1184,12 +1320,11 @@ export const EdgeFirebase = class {
   };
 
   private storeUserRoles = async (
-    email: string,
+    docId: string,
     collectionPath: string,
     role: "admin" | "editor" | "writer" | "user"
   ): Promise<actionResponse> => {
-    const canAssign = this.permissionCheck("assign", collectionPath);
-
+    const canAssign = await this.permissionCheck("assign", collectionPath);
     if (canAssign) {
       if (role === "admin" || role === "user" || role === "editor" || role === "writer") {
         const collectionExists = await this.collectionExists(collectionPath);
@@ -1198,13 +1333,13 @@ export const EdgeFirebase = class {
             ["roles." + collectionPath.replaceAll("/", "-")]: {
               collectionPath: collectionPath.replaceAll("/", "-"),
               role
-            }
+            },
+            uid: this.user.uid
           };
-
-          await updateDoc(doc(this.db, "users/" + email), roleItem);
-          await updateDoc(doc(this.db, "users/" + email), {
-            collectionPaths: arrayUnion(collectionPath.replaceAll("/", "-"))
-          });
+          await updateDoc(doc(this.db, "staged-users/" + docId), {
+            ...roleItem,
+            collectionPaths: arrayUnion(collectionPath.replaceAll("/", "-")),
+            uid: this.user.uid } );
           return this.sendResponse({
             success: true,
             message: "",
@@ -1237,7 +1372,7 @@ export const EdgeFirebase = class {
   public removeCollectionPermissions = async (
     collectionPath: string,
   ): Promise<actionResponse> => {
-    const canAssign = this.permissionCheck("assign", collectionPath);
+    const canAssign = await this.permissionCheck("assign", collectionPath);
     if (canAssign) {
       await deleteDoc(doc(this.db, "collection-data", collectionPath.replaceAll("/", "-")));
       return this.sendResponse({
@@ -1259,8 +1394,7 @@ export const EdgeFirebase = class {
     role: "admin" | "editor" | "writer" | "user",
     permissions: permissions
   ): Promise<actionResponse> => {
-    const canAssign = this.permissionCheck("assign", collectionPath);
-    // TODO: check if collectionPath starts with "users" and deny if so
+    const canAssign = await this.permissionCheck("assign", collectionPath);
     if (canAssign) {
       if (role === "admin" || role === "editor" || role === "writer" || role === "user") {
         const currentTime = new Date().getTime();
@@ -1313,7 +1447,7 @@ export const EdgeFirebase = class {
     collectionPath: string,
     item: object,
   ): Promise<actionResponse> => {
-    const canWrite = this.permissionCheck("write", collectionPath);
+    const canWrite = await this.permissionCheck("write", collectionPath);
     if (!canWrite) {
       return this.sendResponse({
         success: false,
@@ -1330,7 +1464,7 @@ export const EdgeFirebase = class {
       }
       if (Object.prototype.hasOwnProperty.call(cloneItem, "docId")) {
         const docId = cloneItem.docId;
-        const canRead = this.permissionCheck("read", collectionPath);
+        const canRead = this.permissionCheckOnly("read", collectionPath);
         if (canRead) {
           if (Object.prototype.hasOwnProperty.call(this.data, collectionPath)) {
             this.data[collectionPath][docId] = cloneItem;
@@ -1347,7 +1481,7 @@ export const EdgeFirebase = class {
           collection(this.db, collectionPath),
           cloneItem
         );
-        const canRead = this.permissionCheck("read", collectionPath);
+        const canRead = this.permissionCheckOnly("read", collectionPath);
         if (canRead) {
           if (Object.prototype.hasOwnProperty.call(this.data, collectionPath)) {
             this.data[collectionPath][docRef.id] = cloneItem;
@@ -1371,7 +1505,7 @@ export const EdgeFirebase = class {
     collectionPath: string,
     docId: string
   ): Promise<actionResponse> => {
-    const canDelete = this.permissionCheck("delete", collectionPath);
+    const canDelete = await this.permissionCheck("delete", collectionPath);
     if (canDelete) {
       if (Object.prototype.hasOwnProperty.call(this.data, collectionPath)) {
         if (
@@ -1402,4 +1536,4 @@ export const EdgeFirebase = class {
       this.unsubscibe[collectionPath] = null;
     }
   };
-};
+};