firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // check users was invited
    function isInvited() {
      return request.auth != null && exists(/databases/$(database)/documents/invite/$(request.auth.token.email)) && request.auth.token.email_verified;
    }
    // check user is moderator
    function isModer() {
      return request.auth != null && exists(/databases/$(database)/documents/users/$(request.auth.uid)) && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.moderator == true;
    }
    // check user is administrator
    function isAdmin() {
      return request.auth != null && exists(/databases/$(database)/documents/users/$(request.auth.uid)) && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.admin == true;
    }
    // check self profile
    function isUserSelf(userId) {
      return request.auth != null && exists(/databases/$(database)/documents/invite/$(request.auth.token.email)) && request.auth.token.email_verified && request.auth.uid == userId;
    }
    // Items
    // read, create - invited users
    // update - admins, moders
    // delete - admins
    match /items/{itemId} {
      allow read, create: if isInvited();
      allow update: if isModer() || isAdmin();
      allow delete : if isAdmin();
    }
    // Items Links
    // read, create - invited users
    // update - admins, moders
    // delete - admins
    match /items_links/{linkId} {
      allow read, create: if isInvited();
      allow update: if isModer() || isAdmin();
      allow delete : if isAdmin();
    }
    // Profile
    // read, create - invited users
    // update - self / admins
    // delete - admins
    match /profile/{userId} {
      allow read, create: if isInvited();
      allow update: if isUserSelf(userId) || isAdmin();
      allow delete: if isAdmin();
    }
    // Admin Users
    // crud - admins
    match /users/{userId} {
      allow read: if isAdmin() || isModer() && request.auth.uid == userId;
      allow create, update, delete: if false;
    }
    // Invite user
    // read - sended invites
    // create - invited users
    // update, delete - admins
    match /invite/{email} {
      allow read: if isInvited() && (email == request.auth.token.email || resource.data.invite == request.auth.uid);
      allow create: if isInvited();
      allow update, delete: if isAdmin();
    }
  }
}