database.rules.json

{
  "rules": {
    ".read": false,
    ".write": false,
    "v2": {
      "announcement": {
        ".write": false,
        ".read": "auth != null"
      },
      "projects": {
        ".write": false,
        ".read": "
          // all users can query by status
          (auth != null  && query.orderByChild == 'status' && query.equalTo == 'active')
          ||
          (auth != null  && query.orderByChild == 'status' && query.equalTo == 'build_area_tutorial' && query.limitToFirst == 1)
          ||
          (auth != null  && query.orderByChild == 'status' && query.equalTo == 'completeness_tutorial' && query.limitToFirst == 1)
          ||
          // only team members can query by their own teamId
          (auth != null && query.orderByChild == 'teamId' &&
           query.equalTo == root.child('/v2/users/'+auth.uid+'/teamId').val())
          ||
          // project managers can read all
          (auth.token.projectManager === true)
        ",
        "$project_id": {
         // project managers can read/write all attributes
         ".write": "auth.token.projectManager === true",
         ".read": "
            // all users can read all public projects
            (data.child('teamId').exists() == false)
            ||
            // team members can read their projects
            (data.child('teamId').val() == root.child('/v2/users/'+auth.uid+'/teamId').val())
          "
        },
        ".indexOn": [
            "status",
            "isFeatured",
            "teamId",
            "projectTopicKey"
        ]
      },
      "projectDrafts": {
        // only project managers can write projectDrafts
        ".read": false,
        ".write": "auth.token.projectManager === true",
        ".indexOn": [
          "complete"
        ]
      },
      "tutorialDrafts": {
        // only project managers can write projectDrafts
        ".read": false,
        ".write": "auth.token.projectManager === true",
        ".indexOn": [
          "complete"
        ]
      },
      "groups": {
        ".write": false,
        ".read": "auth.token.projectManager === true",
        "$project_id": {
          ".read": "
            // everyone can read groups for public projects
            (root.child('/v2/projects/'+$project_id).hasChild('teamId') === false)
            ||
            (root.child('/v2/projects/'+$project_id+'/teamId').val() ==
             root.child('/v2/users/'+auth.uid+'/teamId').val())
          ",
          ".indexOn": [
            "finishedCount",
            "requiredCount"
          ]
        }
      },
      "tasks": {
        ".write": false,
        ".read": "auth.token.projectManager === true",
        "$project_id": {
          ".read": "
            // everyone can read groups for public projects
            (root.child('/v2/projects/'+$project_id).hasChild('teamId') === false)
            ||
            (root.child('/v2/projects/'+$project_id+'/teamId').val() ==
             root.child('/v2/users/'+auth.uid+'/teamId').val())
          "
        },
      },
      "teams": {
        ".write": false,
        // project managers can read all attributes
        ".read": "auth.token.projectManager === true",
        "$teamId": {
          ".write": "auth.token.projectManager === true",
          "teamName": {
            // team members read teamName
            ".read": "(root.child('/v2/users/'+auth.uid+'/teamId').val() === $teamId)"
            //".read": "auth != null"
          },
          ".indexOn": [
            "teamName"
          ]
        }
      },
      "results": {
        ".write": false,
        ".read": false,
        "$project_id": {
          "$group_id": {
            "$uid": {
              ".write": "
                // everyone can write results for public projects
                (root.child('/v2/projects/'+$project_id).hasChild('teamId') === false &&
                 auth.uid == $uid
                )
                ||
                (root.child('/v2/projects/'+$project_id+'/teamId').val() ==
                 root.child('/v2/users/'+auth.uid+'/teamId').val() &&
                 auth.uid == $uid
                )
              "
            }
          }
        }
      },
      "users": {
        ".read": true,
        ".write": false,
        "$uid": {
          "teamId": {
            ".write": false
          },
          "$other": {
            ".write": "auth != null && auth.uid == $uid"
          }
        },
        "userGroups": {
          ".write": "auth != null"
        },
        ".indexOn": [
          "created",
          "teamId",
          "usernameKey"
        ]
      },
      "OSMAccessToken": {
        "$uid": {
          ".read": "auth.uid === $uid",
          ".write": "auth.uid === $uid"
        }
      },
      "userGroups": {
        ".write": false,
        ".read": "auth != null",
        "$usergroup_id": {
          // Project managers can create new User Groups
          ".write": "auth.token.projectManager === true",
          "users": {
            // Logged in users can join group
            ".write": "auth != null"
            }
        },
        ".indexOn": [
          "nameKey",
        ],
      },
      "organisations": {
        ".write": "auth.token.projectManager === true",
        ".read": "auth != null",
        ".indexOn": [
          "nameKey",
        ],
      },
      "userGroupMembershipLogs": {
        ".write": "auth != null",
        ".read": "auth != null"
      }
    },
    // leaving this here, since version before v2 pull data from there
    "users": {
      "$uid": {
        ".read": "auth != null && auth.uid == $uid",
        ".write": "auth != null && auth.uid == $uid"
      }
    }
  }
}