Automatic rule generation

ShishKabab · ShishKabab · commit f8c983d9cf6e · 2019-12-30T13:31:10.000+01:00
diff --git a/.gitmodules b/.gitmodules
@@ -1,3 +1,30 @@
 [submodule "firebase/functions/src/external/memex-common"]
 	path = firebase/functions/src/external/memex-common
 	url = https://github.com/WorldBrain/memex-common.git
+[submodule "external/@worldbrain/memex-common"]
+	path = external/@worldbrain/memex-common
+	url = https://github.com/WorldBrain/memex-common.git
+[submodule "external/@worldbrain/memex-storage"]
+	path = external/@worldbrain/memex-storage
+	url = https://github.com/WorldBrain/memex-storage.git
+[submodule "external/@worldbrain/storex"]
+	path = external/@worldbrain/storex
+	url = https://github.com/WorldBrain/storex.git
+[submodule "external/@worldbrain/storex-backend-dexie"]
+	path = external/@worldbrain/storex-backend-dexie
+	url = https://github.com/WorldBrain/storex-backend-dexie.git
+[submodule "external/@worldbrain/storex-backend-firestore"]
+	path = external/@worldbrain/storex-backend-firestore
+	url = https://github.com/WorldBrain/storex-backend-firestore.git
+[submodule "external/@worldbrain/storex-pattern-modules"]
+	path = external/@worldbrain/storex-pattern-modules
+	url = https://github.com/WorldBrain/storex-pattern-modules.git
+[submodule "external/@worldbrain/storex-sync"]
+	path = external/@worldbrain/storex-sync
+	url = https://github.com/WorldBrain/storex-sync.git
+[submodule "external/user-logic"]
+	path = external/user-logic
+	url = https://github.com/ShishKabab/user-logic.git
+[submodule "external/simple-signalling"]
+	path = external/simple-signalling
+	url = https://github.com/WorldBrain/simple-signalling.git
diff --git a/external/@worldbrain/memex-common b/external/@worldbrain/memex-common
@@ -0,0 +1 @@
+Subproject commit 4c0fee93d9e1c17ece4ec9c65cc21f5f421d09e6
diff --git a/external/@worldbrain/memex-storage b/external/@worldbrain/memex-storage
@@ -0,0 +1 @@
+Subproject commit 78d0e12a95bceaaca5018aefe95a62c7bd91b4ec
diff --git a/external/@worldbrain/storex b/external/@worldbrain/storex
@@ -0,0 +1 @@
+Subproject commit e4dac715a5c33b5b7bb34f2895a07626c768680b
diff --git a/external/@worldbrain/storex-backend-dexie b/external/@worldbrain/storex-backend-dexie
@@ -0,0 +1 @@
+Subproject commit 20b2c2ba0f42b3ff7985136759077accb5273939
diff --git a/external/@worldbrain/storex-backend-firestore b/external/@worldbrain/storex-backend-firestore
@@ -0,0 +1 @@
+Subproject commit 872258da9891066bebe4b7598ec18acd25b3df2c
diff --git a/external/@worldbrain/storex-pattern-modules b/external/@worldbrain/storex-pattern-modules
@@ -0,0 +1 @@
+Subproject commit 877909b37c81e59b7743b0ee3c3160dfa5fe69dd
diff --git a/external/@worldbrain/storex-sync b/external/@worldbrain/storex-sync
@@ -0,0 +1 @@
+Subproject commit 0f6f30a566b9697885d8522491e4506da76f46b3
diff --git a/external/simple-signalling b/external/simple-signalling
@@ -0,0 +1 @@
+Subproject commit 78915c8c5c8246e0715c792971ca8ea62e4f3dd7
diff --git a/external/user-logic b/external/user-logic
@@ -0,0 +1 @@
+Subproject commit bd055b8fa0600b94437179b5ea5b9b766cd68a7a
diff --git a/firebase/database.rules.json b/firebase/database.rules.json
@@ -4,21 +4,21 @@
       "$id": {
         ".read": true,
         ".write": true,
-        ".validate": "data.child('created').val() != null || newData.child('created').val() == now",
         ".indexOn": [
-          "updated"
+          "created"
         ],
+        ".validate": "data.child('created').val() != null || newData.child('created').val() == now",
         "firstQueue": {
           "$message": {
             ".validate": "data.val() == null && newData.isString() && newData.val().length < 10240"
-          },
+          }
         },
         "secondQueue": {
           "$message": {
             ".validate": "data.val() == null && newData.isString() && newData.val().length < 10240"
-          },
+          }
         }
       }
     }
   }
-}
+}
diff --git a/firebase/firestore.rules b/firebase/firestore.rules
@@ -2,87 +2,61 @@ service cloud.firestore {
     match /databases/{database}/documents {
         match /sharedSyncLogDeviceInfo/{userId} {
             match /devices/{sharedSyncLogDeviceInfo} {
-                allow list: if
+                allow list: if 
                   // Ownership rules
                   request.auth.uid == userId
                 ;
-                allow get: if
+                allow get: if 
                   // Ownership rules
                   request.auth.uid == userId
                 ;
-                allow create: if
+                allow create: if 
                   // Type checks
                   (!('sharedUntil' in request.resource.data.keys()) || request.resource.data.sharedUntil is timestamp) &&
-
-
-                  // Validation rules
-                  ((!('sharedUntil' in request.resource.data)) || (request.resource.data.sharedUntil == request.time)) &&
-
-
+                
+                
                   // Ownership rules
                   request.auth.uid == userId
                 ;
-                allow update: if
+                allow update: if 
+                  // Type checks
+                  (!('sharedUntil' in request.resource.data.keys()) || request.resource.data.sharedUntil is timestamp) &&
+                
+                
                   // Ownership rules
                   request.auth.uid == userId
                 ;
-                allow delete: if
+                allow delete: if 
                   // Ownership rules
                   request.auth.uid == userId
                 ;
             }
         }
         match /sharedSyncLogEntryBatch/{userId} {
             match /entries/{sharedSyncLogEntryBatch} {
-                allow list: if
+                allow list: if 
                   // Ownership rules
                   request.auth.uid == userId
                 ;
-                allow get: if
+                allow get: if 
                   // Ownership rules
                   request.auth.uid == userId
                 ;
-                allow create: if
+                allow create: if 
                   // Type checks
                   request.resource.data.deviceId is string &&
                   request.resource.data.sharedOn is timestamp &&
                   request.resource.data.data is string &&
-
-
-                  // Ownership rules
-                  request.auth.uid == userId
-                ;
-                allow delete: if
-                  // Ownership rules
-                  request.auth.uid == userId
-                ;
-            }
-        }
-        match /sharedSyncLogSeenEntry/{userId} {
-            match /entries/{sharedSyncLogSeenEntry} {
-                allow list: if
-                  // Ownership rules
-                  request.auth.uid == userId
-                ;
-                allow get: if
-                  // Ownership rules
-                  request.auth.uid == userId
-                ;
-                allow create: if
-                  // Type checks
-                  request.resource.data.creatorDeviceId is string &&
-                  request.resource.data.retrieverDeviceId is string &&
-                  request.resource.data.createdOn is timestamp &&
-
-
+                
+                
                   // Ownership rules
                   request.auth.uid == userId
                 ;
-                allow delete: if
+                allow delete: if 
                   // Ownership rules
                   request.auth.uid == userId
                 ;
             }
         }
     }
-}
+}
diff --git a/package.json b/package.json
@@ -4,11 +4,24 @@
   "main": "lib/index.js",
   "private": true,
   "scripts": {
-    "firebase": "cd firebase && firebase"
+    "firebase": "cd firebase && firebase",
+    "generate-rules": "TS_NODE_PROJECT=tsconfig.json ts-node -r tsconfig-paths/register tools/generate-rules.ts ./firebase/"
   },
   "dependencies": {
+    "firebase": "^7.6.1"
   },
   "devDependencies": {
-    "firebase-tools": "^7.0.0"
+    "@josephg/resolvable": "^1.0.0",
+    "@types/node": "^13.1.1",
+    "dexie": "^2.0.4",
+    "dexie-mongoify": "^1.3.0",
+    "fake-indexeddb": "^3.0.0",
+    "firebase-tools": "^7.0.0",
+    "object-path": "^0.11.4",
+    "pluralize": "^8.0.0",
+    "randombytes": "^2.1.0",
+    "ts-node": "^8.5.4",
+    "tsconfig-paths": "^3.9.0",
+    "typescript": "^3.7.4"
   }
 }
diff --git a/tools/generate-rules.ts b/tools/generate-rules.ts
@@ -0,0 +1,65 @@
+import fs from 'fs'
+import path from 'path'
+import firebase from 'firebase'
+import { getSignallingRules } from 'simple-signalling/lib/firebase'
+import StorageManager, { StorageBackend } from '@worldbrain/storex'
+import { DexieStorageBackend } from '@worldbrain/storex-backend-dexie'
+import inMemory from '@worldbrain/storex-backend-dexie/lib/in-memory'
+import { FirestoreStorageBackend } from '@worldbrain/storex-backend-firestore'
+import { generateRulesAstFromStorageModules } from '@worldbrain/storex-backend-firestore/lib/security-rules'
+import { serializeRulesAST } from '@worldbrain/storex-backend-firestore/lib/security-rules/ast';
+import { SharedSyncLogStorage } from '@worldbrain/storex-sync/lib/shared-sync-log/storex'
+import { registerModuleMapCollections } from '@worldbrain/storex-pattern-modules'
+
+async function createStorage() {
+    const localBackend = new DexieStorageBackend({ dbName: 'tmp', idbImplementation: inMemory() })
+    const localStorageManager = new StorageManager({ backend: localBackend })
+
+    const serverBackend = { configure: () => { } } as any as StorageBackend
+    const serverStorageManager = new StorageManager({ backend: serverBackend })
+    const serverModules = {
+        sharedSyncLog: new SharedSyncLogStorage({ storageManager: serverStorageManager, autoPkType: 'string' })
+    }
+    registerModuleMapCollections(serverStorageManager.registry, serverModules)
+    await serverStorageManager.finishInitialization()
+
+    return {
+        local: {
+            manager: localStorageManager
+        },
+        server: {
+            manager: serverStorageManager,
+            modules: serverModules,
+        }
+    }
+}
+
+export async function main() {
+    const firebaseRootDir = process.argv[2]
+    if (!firebaseRootDir) {
+        throw new Error(`Please provide output file path as only argument`)
+    }
+    const firebaseConfig = JSON.parse(fs.readFileSync(path.join(firebaseRootDir, 'firebase.json')).toString())
+
+    const storage = await createStorage()
+    const firestoreRulesPath = path.join(firebaseRootDir, firebaseConfig['firestore']['rules'])
+    const ast = await generateRulesAstFromStorageModules(storage.server.modules as any, {
+        storageRegistry: storage.server.manager.registry
+    })
+    const serialized = serializeRulesAST(ast)
+    fs.writeFileSync(firestoreRulesPath, serialized)
+    console.log(`Firestore security rules successfully written to file '${firestoreRulesPath}'`)
+
+    const firebaseRulesPath = path.join(firebaseRootDir, firebaseConfig['database']['rules'])
+    const singallingCollectionName = 'signalling'
+    fs.writeFileSync(firebaseRulesPath, JSON.stringify({
+        "rules": {
+            [singallingCollectionName]: getSignallingRules()
+        }
+    }, null, 2))
+    console.log(`Real-time database security rules successfully written to file '${firebaseRulesPath}'`)
+}
+
+if (require.main === module) {
+    main()
+}
diff --git a/tsconfig.json b/tsconfig.json
@@ -0,0 +1,65 @@
+{
+  "compilerOptions": {
+    "baseUrl": ".",
+    "target": "es5",
+    "module": "CommonJS",
+    "moduleResolution": "node",
+    "strict": false,
+    "sourceMap": true,
+    "importHelpers": true,
+    "emitDecoratorMetadata": true,
+    "experimentalDecorators": true,
+    "allowSyntheticDefaultImports": true,
+    "esModuleInterop": true,
+    "downlevelIteration": true,
+    "outDir": "tmp",
+    "types": ["node"],
+    "paths": {
+      "@worldbrain/storex": ["external/@worldbrain/storex/ts"],
+      "@worldbrain/storex/lib/*": ["external/@worldbrain/storex/ts/*"],
+      "@worldbrain/storex-backend-dexie": [
+        "external/@worldbrain/storex-backend-dexie/ts"
+      ],
+      "@worldbrain/storex-backend-dexie/lib/*": [
+        "external/@worldbrain/storex-backend-dexie/ts/*"
+      ],
+      "@worldbrain/storex-backend-firestore": [
+        "external/@worldbrain/storex-backend-firestore/ts"
+      ],
+      "@worldbrain/storex-backend-firestore/lib/*": [
+        "external/@worldbrain/storex-backend-firestore/ts/*"
+      ],
+      "@worldbrain/storex-backend-typeorm": [
+        "external/@worldbrain/storex-backend-typeorm/ts"
+      ],
+      "@worldbrain/storex-backend-typeorm/lib/*": [
+        "external/@worldbrain/storex-backend-typeorm/ts/*"
+      ],
+      "@worldbrain/storex-pattern-modules": [
+        "external/@worldbrain/storex-pattern-modules/ts"
+      ],
+      "@worldbrain/storex-pattern-modules/lib/*": [
+        "external/@worldbrain/storex-pattern-modules/ts/*"
+      ],
+      "@worldbrain/memex-common": ["external/@worldbrain/memex-common/ts"],
+      "@worldbrain/memex-common/lib/*": [
+        "external/@worldbrain/memex-common/ts/*"
+      ],
+      "@worldbrain/memex-storage": ["external/@worldbrain/memex-storage/ts"],
+      "@worldbrain/memex-storage/lib/*": [
+        "external/@worldbrain/memex-storage/ts/*"
+      ],
+      "@worldbrain/storex-sync": ["external/@worldbrain/storex-sync/ts"],
+      "@worldbrain/storex-sync/lib/*": [
+        "external/@worldbrain/storex-sync/ts/*"
+      ],
+      "user-logic": ["external/user-logic/ts"],
+      "user-logic/lib/*": ["external/user-logic/ts/*"],
+      "simple-signalling": ["external/simple-signalling/ts"],
+      "simple-signalling/lib/*": ["external/simple-signalling/ts/*"]
+    },
+    "lib": ["es2017", "dom", "dom.iterable", "esnext.asynciterable"]
+  },
+  "include": ["./tools/**/*"],
+  "exclude": ["node_modules"]
+}
diff --git a/yarn.lock b/yarn.lock
