firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    function signedIn() {
      return request.auth != null;
    }

    function owns(uid) {
      return signedIn() && request.auth.uid == uid;
    }

    function validHandle(handle) {
      return handle is string
        && handle.size() >= 3
        && handle.size() <= 30
        && handle.matches('^[a-z0-9]+(-[a-z0-9]+)*$')
        && !(handle in [
          'acceptable-use', 'api', 'auth', 'cookies', 'dashboard', 'docs',
          'forgot-password', 'legal', 'login', 'onboarding', 'privacy',
          'report', 'security', 'self-host', 'settings', 'sign-in', 'sign-up',
          'sponsor', 'support', 'terms'
        ]);
    }

    function validGitHubUsername(username) {
      return username is string
        && username.size() >= 1
        && username.size() <= 39
        && username.matches('^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$')
        && !username.matches('.*--.*');
    }

    function validActivityTitle(title) {
      return title is string
        && title.size() >= 1
        && title.size() <= 60
        && title.matches('.*[^[:space:]].*');
    }

    function validRepositoryName(name) {
      return name is string
        && name.size() >= 1
        && name.size() <= 140;
    }

    function validRepositoryNames(names) {
      return names is list
        && names.size() <= 5
        && (names.size() < 1 || validRepositoryName(names[0]))
        && (names.size() < 2 || validRepositoryName(names[1]))
        && (names.size() < 3 || validRepositoryName(names[2]))
        && (names.size() < 4 || validRepositoryName(names[3]))
        && (names.size() < 5 || validRepositoryName(names[4]));
    }

    function validRepositorySelection(repositories) {
      return repositories is map
        && repositories.keys().hasOnly(['mode', 'names'])
        && repositories.keys().hasAll(['mode', 'names'])
        && repositories.mode is string
        && repositories.mode in ['recent', 'include', 'exclude']
        && validRepositoryNames(repositories.names);
    }

    function validCommitActivity(commits) {
      return commits is map
        && commits.keys().hasOnly([
          'enabled', 'title', 'limit', 'showRepository', 'showDate'
        ])
        && commits.keys().hasAll([
          'enabled', 'title', 'limit', 'showRepository', 'showDate'
        ])
        && commits.enabled is bool
        && validActivityTitle(commits.title)
        && commits.limit is int
        && commits.limit >= 1
        && commits.limit <= 10
        && commits.showRepository is bool
        && commits.showDate is bool;
    }

    function validCodingActivity(coding) {
      return coding is map
        && coding.keys().hasOnly([
          'enabled', 'title', 'windowDays', 'showContributionCount',
          'showHeatmap', 'showMonthLabels', 'showWeekdayLabels',
          'showLegend', 'showYearSelector', 'showLanguages'
        ])
        && coding.keys().hasAll([
          'enabled', 'title', 'windowDays', 'showContributionCount',
          'showHeatmap', 'showMonthLabels', 'showWeekdayLabels',
          'showLegend', 'showYearSelector', 'showLanguages'
        ])
        && coding.enabled is bool
        && validActivityTitle(coding.title)
        && coding.windowDays is int
        && coding.windowDays in [7, 14, 30]
        && coding.showContributionCount is bool
        && coding.showHeatmap is bool
        && coding.showMonthLabels is bool
        && coding.showWeekdayLabels is bool
        && coding.showLegend is bool
        && coding.showYearSelector is bool
        && coding.showLanguages is bool;
    }

    function validDeveloperActivity(activity) {
      return activity is map
        && activity.keys().hasOnly([
          'enabled', 'githubUsername', 'placement', 'repositories', 'commits', 'coding'
        ])
        && activity.keys().hasAll([
          'enabled', 'githubUsername', 'placement', 'repositories', 'commits', 'coding'
        ])
        && activity.enabled is bool
        && activity.githubUsername is string
        && activity.githubUsername.size() <= 39
        && (activity.githubUsername == ''
          || validGitHubUsername(activity.githubUsername))
        && (!activity.enabled || validGitHubUsername(activity.githubUsername))
        && activity.placement is string
        && activity.placement in ['before-links', 'after-links']
        && validRepositorySelection(activity.repositories)
        && validCommitActivity(activity.commits)
        && validCodingActivity(activity.coding)
        && (!activity.enabled
          || (!activity.commits.enabled && !activity.coding.enabled)
          || activity.repositories.mode != 'include'
          || activity.repositories.names.size() > 0);
    }

    // Nested link/section item walks exceed Firestore's 1000-expression cap on
    // real profiles. Owners are gated by auth + publish checks; sanitizeProfile
    // enforces shape/URLs before write.
    function validHttpsUrl(value) {
      return value is string
        && value.size() >= 1
        && value.size() <= 2048
        && value.matches('^https://[^[:space:]]+$')
        && !value.matches('^https://[^/]*@.*');
    }

    function validSections(sections) {
      return sections is list && sections.size() <= 12;
    }

    function validLinks(links) {
      return links is list && links.size() <= 50;
    }

    function validSocials(socials) {
      return socials is map
        && socials.keys().hasOnly([
          'github', 'gitlab', 'linkedin', 'x', 'youtube', 'instagram', 'tiktok',
          'facebook', 'threads', 'bluesky', 'mastodon', 'discord', 'twitch',
          'reddit', 'medium', 'hashnode', 'devto', 'stackoverflow', 'codepen',
          'codesandbox', 'dribbble', 'behance', 'figma', 'npm', 'producthunt',
          'telegram', 'whatsapp', 'spotify', 'soundcloud', 'apple_music',
          'patreon', 'kofi', 'buymeacoffee', 'calendly', 'calcom', 'email',
          'website'
        ])
        && socials.size() <= 37;
    }

    function validProfile(uid) {
      return request.resource.data.keys().hasOnly([
          'ownerUid', 'handle', 'displayName', 'role', 'bio', 'avatarUrl',
          'ogImageUrl', 'location', 'availability', 'theme', 'accent', 'published',
          'socials', 'sections', 'links', 'developerActivity', 'updatedAt'
        ])
        && request.resource.data.keys().hasAll([
          'ownerUid', 'handle', 'displayName', 'role', 'bio', 'theme',
          'accent', 'published', 'socials', 'links', 'updatedAt'
        ])
        && request.resource.data.ownerUid == uid
        && validHandle(request.resource.data.handle)
        && request.resource.data.displayName is string
        && request.resource.data.displayName.size() >= 1
        && request.resource.data.displayName.size() <= 60
        && request.resource.data.role is string
        && request.resource.data.role.size() <= 100
        && request.resource.data.bio is string
        && request.resource.data.bio.size() <= 240
        && (!('avatarUrl' in request.resource.data)
          || validHttpsUrl(request.resource.data.avatarUrl))
        && (!('ogImageUrl' in request.resource.data)
          || validHttpsUrl(request.resource.data.ogImageUrl))
        && (!('location' in request.resource.data)
          || (request.resource.data.location is string
            && request.resource.data.location.size() <= 80))
        && (!('availability' in request.resource.data)
          || (request.resource.data.availability is string
            && request.resource.data.availability.size() <= 90))
        && request.resource.data.theme in ['terminal', 'paper', 'midnight', 'mono', 'slate', 'ember', 'ocean', 'noir']
        && request.resource.data.accent is string
        && request.resource.data.accent.matches('^#[0-9a-fA-F]{6}$')
        && request.resource.data.published is bool
        && validSocials(request.resource.data.socials)
        && (!('sections' in request.resource.data)
          || validSections(request.resource.data.sections))
        && (!('developerActivity' in request.resource.data)
          || validDeveloperActivity(request.resource.data.developerActivity))
        && validLinks(request.resource.data.links)
        && request.resource.data.updatedAt == request.time;
    }

    function validHandleClaim(handle) {
      return request.resource.data.keys().hasOnly(['uid', 'updatedAt'])
        && request.resource.data.keys().hasAll(['uid', 'updatedAt'])
        && request.resource.data.uid == request.auth.uid
        && request.resource.data.updatedAt == request.time
        && validHandle(handle);
    }

    function canPublishProfile() {
      return request.auth.token.email_verified == true
        && exists(/databases/$(database)/documents/users/$(request.auth.uid))
        && hasCompleteTermsRecord(
          get(/databases/$(database)/documents/users/$(request.auth.uid)).data
        );
    }

    function hasNoTermsRecord(data) {
      return !data.keys().hasAny(['termsAcceptedAt', 'termsVersion']);
    }

    function hasCompleteTermsRecord(data) {
      return data.keys().hasAll(['termsAcceptedAt', 'termsVersion'])
        && data.termsAcceptedAt is timestamp
        && data.termsVersion is string
        && data.termsVersion.size() >= 1
        && data.termsVersion.size() <= 40;
    }

    function validNewTermsRecord(data) {
      return hasCompleteTermsRecord(data)
        && data.termsAcceptedAt == request.time;
    }

    function validTermsTransition() {
      return (
          hasNoTermsRecord(resource.data)
          && (
            hasNoTermsRecord(request.resource.data)
            || validNewTermsRecord(request.resource.data)
          )
        )
        || (
          hasCompleteTermsRecord(resource.data)
          && hasCompleteTermsRecord(request.resource.data)
          && request.resource.data.termsAcceptedAt == resource.data.termsAcceptedAt
          && request.resource.data.termsVersion == resource.data.termsVersion
        );
    }

    function validUser() {
      return request.resource.data.keys().hasOnly([
          'email', 'displayName', 'githubLogin', 'profileHandle',
          'developerActivity', 'termsAcceptedAt', 'termsVersion', 'updatedAt'
        ])
        && request.resource.data.keys().hasAll(['updatedAt'])
        && (!('email' in request.resource.data)
          || request.resource.data.email == null
          || (request.resource.data.email is string
            && request.resource.data.email.size() <= 320))
        && (!('displayName' in request.resource.data)
          || request.resource.data.displayName == null
          || (request.resource.data.displayName is string
            && request.resource.data.displayName.size() <= 100))
        && (!('githubLogin' in request.resource.data)
          || validGitHubUsername(request.resource.data.githubLogin))
        && (!('profileHandle' in request.resource.data)
          || validHandle(request.resource.data.profileHandle))
        && (!('developerActivity' in request.resource.data)
          || validDeveloperActivity(request.resource.data.developerActivity))
        && request.resource.data.updatedAt == request.time;
    }

    match /users/{uid} {
      allow read: if owns(uid);
      allow create: if owns(uid)
        && validUser()
        && validNewTermsRecord(request.resource.data);
      allow update: if owns(uid)
        && validUser()
        && validTermsTransition();
      // Account deletion runs through the recently-reauthenticated server
      // workflow so immutable acceptance records cannot be deleted/recreated.
      allow delete: if false;
    }

    match /profiles/{uid} {
      allow read: if resource.data.published == true || owns(uid);
      allow create, update: if owns(uid)
        && validProfile(uid)
        && (!request.resource.data.published || canPublishProfile());
      allow delete: if owns(uid);
    }

    match /handles/{handle} {
      allow read: if true;
      allow create: if signedIn()
        && canPublishProfile()
        && validHandleClaim(handle);
      allow update: if signedIn()
        && resource.data.uid == request.auth.uid
        && canPublishProfile()
        && validHandleClaim(handle);
      allow delete: if signedIn() && resource.data.uid == request.auth.uid;
    }

    match /reports/{reportId} {
      // Reports are submitted through the rate-limited server route. Public
      // Firestore writes invite spam and turn every visitor into a write API.
      allow read, create, update, delete: if false;
    }

    match /profileStats/{uid} {
      allow read: if owns(uid);
      // Click aggregation is server-owned. Public SDK writes made analytics
      // trivial to fabricate and opened an unbounded Firestore write surface.
      allow create, update: if false;
      allow delete: if owns(uid);
    }

    // Public GitHub contribution day map. Cache writes must come from a
    // trusted backend; browser/API-key writes let anyone poison public data.
    match /githubContributionCaches/{usernameKey} {
      allow read: if true;
      allow create, update: if false;
      allow delete: if false;
    }

    // Year-scoped language mixes for public GitHub activity. As above, only a
    // trusted backend may write these documents.
    match /githubLanguageCaches/{usernameKey} {
      allow read: if true;
      allow create, update: if false;
      allow delete: if false;
    }

    match /{document=**} {
      allow read, write: if false;
    }
  }
}