firestore.rules

rules_version = '2';

/*
Important notes:
 - Write perms: write, create, update, delete
 - Read perms: read, get, list


*/

service cloud.firestore {
  match /databases/{database}/documents {
  
  	//NEVER DISABLE __VERSION ACCEESS
    match /__VERSION/{document=**} {
      allow read;
    }
    //NEVER DISABLE __VERSION ACCEESS
    
    match /configs/mobile-app {
      allow read;
    }
    match /devices/{document=**} {
      allow read, write;
    }
    match /countdowns/{document=**} {
      allow read;
    }
    match /events/{document=**} {
      allow read;
    }
    match /sponsors/{document=**} {
      allow read;
    }
    match /past-notifications/{document=**} {
      allow get;
    }
    match /valid-attributes/{document=**} {
      allow read;
    }
    match /users/{userId} {
      allow read: if request.auth != null
      allow write: if request.auth != null && request.auth.uid == userId
      
      match /attributes/{attribute} {
      allow read: if request.auth != null && request.auth.uid == userId
      }
    }
    match /teams/{team_id} {
      allow read: if request.auth != null
      
      match /confidential/{document=**} {
        allow read: if request.auth != null && request.auth.uid != null && request.auth.uid != "" && 
        	// Get the team entered in the user's firestore document
        	get(/databases/$(database)/documents/users/$(request.auth.uid)).data.team
          ==
          // Get the team they are trying to access
          /databases/$(database)/documents/teams/$(team_id)
      }
    }
  }
}