Replace passlist regexp with @Domain doc-id entries (#2523)

Author: rfontanarosa

firestore/firestore.rules

@@ -55,20 +55,15 @@ rules_version = '2';
     }
 
     /**
-     * Returns the regular expression matching emails granted access.
-     */
-    function getPassRegexp() {
-      let doc = get(/databases/$(database)/documents/passlist/regexp);
-      return doc == null ? null : doc.data.regexp;
-    }
-
-    /**
-     * Returns true iff the user's email is listed in the passlist or allowed via regex.
+     * Returns true iff the user's email is granted access by the passlist:
+     * either by an exact-email entry (`passlist/<email>`) or by a domain-wide
+     * entry (`passlist/@<domain>`).
      */
     function isPasslisted() {
-      let regexp = getPassRegexp();
-      return (regexp != null && request.auth.token.email.matches(regexp))
-        || exists(/databases/$(database)/documents/passlist/$(request.auth.token.email));
+      let email = request.auth.token.email;
+      let domain = email.split('@')[1];
+      return exists(/databases/$(database)/documents/passlist/$(email))
+        || exists(/databases/$(database)/documents/passlist/@$(domain));
     }
 
     /**
@@ -172,10 +167,11 @@ rules_version = '2';
       allow write: if userId == request.auth.uid;
     }
 
-    // All users need to be able to read the passlist for rules to work.
+    // Users may only read their own passlist entry. Domain-wide entries
+    // (`@<domain>`) are evaluated via `exists()` in rules and the client and
+    // must not be readable by signed-in users (would leak allowed domains).
     match /passlist/{entry} {
-      // TODO(#1602): Replace "regexp" with simple pattern matching.
-      allow read: if isSignedIn() && entry in ['regexp', request.auth.token.email];
+      allow read: if isSignedIn() && entry == request.auth.token.email;
     }
 
     // Apply passlist and survey-level ACLs to survey documents.

functions/src/on-create-passlist-entry.spec.ts

@@ -87,4 +87,14 @@ describe('onCreatePasslistEntry()', () => {
     expect(mailServiceMock.sendMail).toHaveBeenCalled();
     expect(mailServiceMock.sendMail).toHaveBeenCalledWith(mail);
   });
+
+  it('skips email for domain-wide passlist entry', async () => {
+    mockFirestore.doc('config/mail').set({ server: serverConfig });
+    mockFirestore.doc('config/mail/templates/passlisted').set(mail);
+    await onCreatePasslistEntryHandler({
+      data: newDocumentSnapshot({}) as QueryDocumentSnapshot,
+      params: { entryId: '@example.com' },
+    } as any);
+    expect(getMailServiceMock).not.toHaveBeenCalled();
+  });
 });

functions/src/on-create-passlist-entry.ts

@@ -34,6 +34,11 @@ export async function onCreatePasslistEntryHandler(
 ) {
   const entryId = event.params.entryId;
 
+  // Domain-wide entries (`@<domain>`) are not user mailboxes, so skip mail.
+  if (typeof entryId === 'string' && entryId.startsWith('@')) {
+    return;
+  }
+
   const db = getDatastore();
 
   const template = await db.fetchMailTemplate('passlisted');

web/src/app/services/data-store/data-store.service.ts

@@ -479,38 +479,27 @@ export class DataStoreService {
   }
 
   /**
-   * Returns a promise resolving to true if the user's email is either
-   * explicitly listed as a document ID in the 'passlist' collection or
-   * matches the regular expression stored in the 'passlist/regexp' document.
+   * Returns a promise resolving to true if the user's email is granted access
+   * by the passlist: either an exact-email entry (`passlist/<email>`) or a
+   * domain-wide entry (`passlist/@<domain>`).
    *
    * @param userEmail The email of the user to check against the passlist.
    */
   async isPasslisted(userEmail: string): Promise<boolean> {
-    const docSnapshot = await runInInjectionContext(this.injector, () =>
+    const emailSnapshot = await runInInjectionContext(this.injector, () =>
       getDoc(doc(this.db, 'passlist', userEmail))
     );
 
-    if (docSnapshot.exists()) return true;
+    if (emailSnapshot.exists()) return true;
 
-    const regexpSnapshot = await runInInjectionContext(this.injector, () =>
-      getDoc(doc(this.db, 'passlist', 'regexp'))
-    );
-
-    if (regexpSnapshot.exists()) {
-      const regexpData = regexpSnapshot.data() as
-        | { regexp?: string }
-        | undefined;
-
-      const regexpString = regexpData?.regexp;
-
-      if (regexpString) {
-        const regex = new RegExp(regexpString);
+    const domain = userEmail.split('@')[1];
+    if (!domain) return false;
 
-        return regex.test(userEmail);
-      }
-    }
+    const domainSnapshot = await runInInjectionContext(this.injector, () =>
+      getDoc(doc(this.db, 'passlist', `@${domain}`))
+    );
 
-    return false;
+    return domainSnapshot.exists();
   }
 
   private toLocationsOfInterest(