rules.json

{
	"rules": {
		// set defaults to no reads and no writes unless you're an Administrator
		".read": "auth.isAdmin === true",
		".write": "auth.isAdmin === true",

		"system_settings": {
			".read": true
		},
		
		"user_profiles": {
			".read": true,
			".write": "auth.isStaff === true",

			"$userId": {
				".read": "auth.id == $userId",
				// we need to temporarily allow Arch mods to edit users since we don't have a full list of faculty,
				// staff, and students in the system yet. Once we have that data in place, we can move the isArchMod
				// half of this .write rule down into the archProjects child
				".write": "auth.id == $userId || auth.isArchMod === true",
				//".validate": "newData.hasChildren(['fname', 'lname'])", // we can add this back after we settle the above situation with Arch

				// validate specific entries
				"fname": {
					".validate": "newData.isString()"
				},
				"lname": {
					".validate": "newData.isString()"
				},
				"pid": {
					// Panther ID is intentionally stored as a string instead of a number. Think of it like a
					// username, we're never going to perform any numerical additions or subtractions with it
					".validate": "newData.isString()"
				},
				"lastActivity": {
					// timestamp in milliseconds, used to check if the user has ever logged in before (if not, we create a profile for them)
					// and can also be used for one-time code executions or announcement broadcasts (if the user hasn't logged on since
					// [date/time when something important happened], execute some code or show the user an announcement about it)
					".validate": "newData.isNumber()"
				},
				"rsvps": {
					"$eventID": {
						// no rules
					}
				},
				"attendance": {
					".write": "auth.isEventMod === true || auth.isStaff === true",
				},
				"comments": {
					"$commentID": {
						".validate": "newData.isBoolean()"
					}
				},
				"points": {
					"$commentId": {
						".validate": "newData.isBoolean()"
					}
				},
				"archProjects": {
					"$projectId": {
						".validate": "newData.isBoolean()"
					}
				},
				"volunteerHours": {
					"$volunteerId": {
						".validate": "newData.isBoolean()"
					}
				},
				"shirtSize": {
					".read": true,
					".write": true
				},

				// prevents any extra children (we only want the fields that are explicitly identified here)
				"$other": {
					".validate": false
				}
			}
		},

		"events": {
			// anyone can read event info, but only Event moderators can add new events and edit
			// any of the details
			".read": true,
			".write": "auth.isEventMod === true",
			"$eventId": {
				"name": {
					".validate": "newData.isString()"
				},
				"desc": {
					".validate": "newData.isString()"
				},
				"types": {
					// no rules
				},
				"options": {
					// no rules
				},
				"date": {
					// events must have a start & end date, and start date must come before its end date
					".validate": "newData.hasChildren(['starts', 'ends']) && newData.child('starts').val() < newData.child('ends').val()",

					"starts": {
						".validate": "newData.isNumber()"
					},
					"ends": {
						".validate": "newData.isNumber()"
					}
				},
				"location": {
					".validate": "newData.hasChild('name')",

					"lng": {
						".validate": "newData.isNumber()"
					},
					"lat": {
						".validate": "newData.isNumber()"
					},
					"name": {
						".validate": "newData.isString()"
					}
				},
				"comments": {
					// anyone can comment on an event
					".write": true,
					"$commentId": {
						".validate": "newData.isBoolean()"
					}
				},
				"rsvps": {
					// anyone can RSVP to an event
					".write": true,
					"$userId": {
						// no rules
					}
				},
				"attendance": {
					".write": "auth.isEventMod === true || auth.isStaff === true",
				},

				// prevents any extra children (we only want the fields that are explicitly identified here)
				"$other": {
					".validate": false
				}
			}
		},

		"courses": {
			".read": true,
			".write": true
		},
		
		"careers": {
			".read": true,
			".write": true
		},

		"comments": {
			"$commentID": {
				".read": true,
				".write": "auth.id == newData.child('author').val()", // ensure author of comment is current user
				".validate": "newData.hasChildren(['author', 'date', 'content'])",

				// validate specific properties
				"author": {
					".validate": "newData.isString()"
				},
				"date": {
					".validate": "newData.isNumber()"
				},
				"content": {
					".validate": "newData.isString()"
				},
				"points": {
					".read": true,
					".write": true
				},
				"parent": {
					".validate": "newData.isString() && root.child('comments').hasChild(newData.val())"
				},
				"children": {
					".write": true,
					"$childId": {
						".validate": "newData.isBoolean()"
					}
				},

				// prevents any extra children (we only want the fields that are explicitly identified here)
				"$other": {
					".validate": false
				}
			}
		},

		"arch": {
			".read": true,
			".write": true
		},

		"furc": {
			".read": true,
			".write": true
		},

		"volunteerHours": {
			".read": true,
			".write": true
		}
	}
}