Source

{
  "constants": {
    "AGENT_ADDRESS": "4gX3qYcFzxeZR11Cq8R1NHAT4sHtkvWDirdtRVAdS5ow",
    "AGENT_ADDRESS_BOUND": true
  },
  "auth": {
    "anonymous": true
  },
  "pastes/$id": {
    "description": "A paste. Readable only by its owners and by the public api function (which serves /<id> to anyone with the link), so nobody can list pastes. Past createdAt + ttl nobody can read it. A burn paste is marked opened (once only, so exactly one reader gets it) and deleted by the api function on its first view. An encrypted paste holds only ciphertext; the key lives in the link's #fragment.",
    "fields": {
      "content": "String",
      "title": "String",
      "language": "String",
      "ttl": "UInt!",
      "burn": "Bool!",
      "encrypted": "Bool!",
      "opened": "Bool",
      "createdBy": "String!",
      "createdAt": "UInt!"
    },
    "rules": {
      "read": "@user.id != null && (@data.ttl == 0 || @data.createdAt + @data.ttl > @time.now) && (@user.id == @const.BOUNDED_PUBLIC_PRINCIPAL_API || get(/pastes/$id/owners/@user.id) != null)",
      "create": "@user.id != null && get(/pastes/$id) == null && @StringUtils.length($id) == 12 && @newData.createdBy == @user.id && @newData.createdAt <= @time.now && @newData.opened == false && (@newData.ttl == 0 || (@newData.ttl >= 60 && @newData.ttl <= 31536000)) && @StringUtils.length(@newData.content) >= 1 && @StringUtils.length(@newData.content) <= 720000 && @StringUtils.length(@newData.title) <= 200 && @StringUtils.length(@newData.language) <= 24 && getAfter(/pastes/$id/owners/@user.id) != null && getAfter(/pastekeys/$id) != null",
      "update": "@user.id != null && (@data.ttl == 0 || @data.createdAt + @data.ttl > @time.now) && ((get(/pastes/$id/owners/@user.id) != null && @newData.opened == @data.opened && @StringUtils.length(@newData.content) >= 1 && @StringUtils.length(@newData.content) <= 720000 && @StringUtils.length(@newData.title) <= 200 && @StringUtils.length(@newData.language) <= 24) || (@user.id == @const.BOUNDED_PUBLIC_PRINCIPAL_API && @data.burn == true && @data.opened == false && @newData.opened == true && @newData.content == @data.content))",
      "delete": "@user.id != null && (get(/pastes/$id/owners/@user.id) != null || (@user.id == @const.BOUNDED_PUBLIC_PRINCIPAL_API && @data.burn == true && @data.opened == true))"
    }
  },
  "pastes/$id/owners/$userId": {
    "description": "Someone who may edit or delete the paste: its creator, or anyone who presented the paste's owner key (the admin link).",
    "fields": {
      "at": "UInt!"
    },
    "rules": {
      "read": "@user.id != null && (@user.id == $userId || @user.id == @const.BOUNDED_PUBLIC_PRINCIPAL_API)",
      "create": "@user.id != null && @user.id == $userId && @newData.at <= @time.now && ((get(/pastes/$id) == null && getAfter(/pastes/$id).createdBy == @user.id) || (get(/pastes/$id) != null && getAfter(/pasteclaims/$id/c/@user.id).key == get(/pastekeys/$id).key))",
      "update": "false",
      "delete": "false"
    }
  },
  "pastekeys/$id": {
    "description": "The paste's owner key. Only the api function can read it, to check keys; owners carry it in their admin link.",
    "fields": {
      "key": "String!"
    },
    "rules": {
      "read": "@user.id == @const.BOUNDED_PUBLIC_PRINCIPAL_API",
      "create": "@user.id != null && get(/pastes/$id) == null && getAfter(/pastes/$id).createdBy == @user.id && @StringUtils.length(@newData.key) >= 20",
      "update": "false",
      "delete": "false"
    }
  },
  "pasteclaims/$id/c/$userId": {
    "description": "A key someone presents to become an owner. Never readable.",
    "fields": {
      "key": "String"
    },
    "rules": {
      "read": "false",
      "create": "@user.id != null && @user.id == $userId",
      "update": "@user.id != null && @user.id == $userId",
      "delete": "false"
    }
  },
  "functions": {
    "api": {
      "auth": "true",
      "entry": "functions/api.ts",
      "public": true,
      "methods": [
        "GET",
        "POST",
        "PATCH",
        "DELETE"
      ],
      "cors": "passthrough"
    }
  }
}