database-rules.bolt

/**
 * Node Types
 */
type Request {
  beneficiary: String,       // Address or phone number for the request's beneficiary
  mobileOS: String | Null,
  dollarTxHash: String | Null,    // Transaction Hash for the executed Request
  goldTxHash: String | Null,
  escrowTxHash: String | Null,     
  status: RequestStatus,          // Request Status enum
  type: RequestType,               // Request Type enum
}

type Account {
  pk: String,                     // Account's private key
  address: String,                // Accounts's Address
  locked: Boolean,                // Lock status
}

/**
 * Leaf Node Types
 */

type RequestStatus extends String {
  validate() { 
    this == 'Pending' ||
    this == 'Working' ||
    this == 'Done'    ||
    this == 'Failed'
  }
}

type RequestType extends String {
  validate() {
    this == 'Faucet' ||
    this == 'Invite'
  }
}

/**
 * Node Paths
 */

path / {
  // Only admin access
  read() { false }
  write() { false }
}

path /{net} {
  // Only admin access
  read() { false }
  write() { false }
}

path /{net}/requests {
  // Only admin access
  read() { false }
  write() { false }
}

path /{net}/requests/{id} is Request {
  read() { true }
  write() { isAllowed(this) }
}

path /{net}/accounts/{account} is Account {
  // Only admin access
  read() { false }
  write() { false }
}

/**
 * Helper Functions
 */

isLoggedIn() { auth != null }

isNew(ref) { prior(ref) == null }

// uid of service_account_firebase_faucet@clabs.co is LFH1B0m3tqdWGSugIvM2EkjARVR2 on celo-faucet
// This account can be seen/modified at https://console.firebase.google.com/project/celo-faucet/authentication/users
//
// uid of service_account_firebase_faucet@clabs.co is ldA2DGvtgWP1xa8QFrtB7BYKc7l2 on celo-faucet-staging
// This account can be seen/modified at https://console.firebase.google.com/project/celo-faucet-staging/authentication/users
isAllowed(ref) {
  // TODO(ashishb): In the longer run, it would be better to choose only one uid based on whether
  // we are on staging network or the production network.
  return auth.uid == "LFH1B0m3tqdWGSugIvM2EkjARVR2" || auth.uid == "ldA2DGvtgWP1xa8QFrtB7BYKc7l2"
}