Implementert Firebase backend konfigurasjon og Cloud Functions

2025-11-24 20:59:47 +01:00
parent 73f8775a46
commit f76b2e5c72
6 changed files with 535 additions and 0 deletions
@@ -0,0 +1,110 @@
+rules_version = '2';
+service cloud.firestore {
+  match /databases/{database}/documents {
+    
+    // ===== HJELPEFUNKSJONER =====
+    
+    function isAuthenticated() {
+      return request.auth != null;
+    }
+    
+    function getUserData() {
+      return get(/databases/$(database)/documents/users/$(request.auth.uid)).data;
+    }
+    
+    function isAdmin() {
+      return isAuthenticated() && 
+             getUserData().role in ['admin', 'systemAdmin'];
+    }
+    
+    function isSystemAdmin() {
+      return isAuthenticated() && 
+             getUserData().role == 'systemAdmin';
+    }
+    
+    function belongsToSameOrg(userId) {
+      return getUserData().organizationId == 
+             get(/databases/$(database)/documents/users/$(userId)).data.organizationId;
+    }
+    
+    function isOwner(userId) {
+      return isAuthenticated() && request.auth.uid == userId;
+    }
+    
+    // ===== BRUKERE =====
+    
+    match /users/{userId} {
+      // Les: Egen bruker eller admin i samme org
+      allow read: if isOwner(userId) || 
+                     (isAdmin() && belongsToSameOrg(userId));
+      
+      // Opprett: Kun ved registrering (håndteres av auth)
+      allow create: if isOwner(userId) || isAdmin();
+      
+      // Oppdater: Egen bruker (begrenset) eller admin
+      allow update: if isOwner(userId) || isAdmin();
+      
+      // Slett: Kun admin
+      allow delete: if isAdmin();
+    }
+    
+    // ===== TIMEREGISTRERINGER =====
+    
+    match /time_registrations/{registrationId} {
+      // Les: Egen registrering eller admin i samme org
+      allow read: if isAuthenticated() && 
+                     (resource.data.userId == request.auth.uid || 
+                      (isAdmin() && belongsToSameOrg(resource.data.userId)));
+      
+      // Opprett: Kun egne registreringer
+      allow create: if isAuthenticated() && 
+                       request.resource.data.userId == request.auth.uid &&
+                       request.resource.data.organizationId == getUserData().organizationId;
+      
+      // Oppdater: Egen registrering eller admin
+      allow update: if isAuthenticated() && 
+                       (resource.data.userId == request.auth.uid || isAdmin());
+      
+      // Slett: Kun admin
+      allow delete: if isAdmin();
+    }
+    
+    // ===== TARIFFPROFILER =====
+    
+    match /tariff_profiles/{profileId} {
+      // Les: Alle autentiserte brukere
+      allow read: if isAuthenticated();
+      
+      // Skriv: Kun admin
+      allow write: if isAdmin();
+    }
+    
+    // ===== AVVIK =====
+    
+    match /deviations/{deviationId} {
+      // Les: Egen avvik eller admin i samme org
+      allow read: if isAuthenticated() && 
+                     (resource.data.userId == request.auth.uid || 
+                      (isAdmin() && belongsToSameOrg(resource.data.userId)));
+      
+      // Opprett: Kun Cloud Functions
+      allow create: if false;
+      
+      // Oppdater: Admin (for kvittering)
+      allow update: if isAdmin();
+      
+      // Slett: Admin
+      allow delete: if isAdmin();
+    }
+    
+    // ===== AUDIT LOGS =====
+    
+    match /audit_logs/{logId} {
+      // Les: Kun systemadmin
+      allow read: if isSystemAdmin();
+      
+      // Skriv: Kun Cloud Functions
+      allow write: if false;
+    }
+  }
+}