refactor(admin): remove hardcoded email and dynamically resolve admin privileges via Firestore Admins collection

2026-09-14 11:44:04 +02:00
parent 2f2170573d
commit fb91666402
3 changed files with 65 additions and 15 deletions
@@ -10,7 +10,8 @@ service cloud.firestore {
    function isAdmin() {
      return request.auth != null && (
        request.auth.token.admin == true ||
-        request.auth.token.email == 'nicolas@gruber.info'
+        exists(/databases/$(database)/documents/Admins/$(request.auth.uid)) ||
+        (request.auth.token.email != null && exists(/databases/$(database)/documents/Admins/$(request.auth.token.email)))
      );
    }

@@ -22,6 +23,12 @@ service cloud.firestore {
      );
    }

+    // Admins-Sammlung: Angemeldete Nutzer können prüfen, nur Admins schreiben
+    match /Admins/{adminDoc} {
+      allow read: if isAuthenticated();
+      allow write: if isAdmin();
+    }
+
    // Öffentliche Sammlungen: News, Mängel (Issues) & Ideen (CitizensForum)
    match /{collection}/{document=**} {
      // Jeder darf News, Mängel & Ideen öffentlich lesen