firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // setup functions to make consistent

    // is the request from the user requesting the
  	function isRequestingUser(userId) {
      return request.auth.uid == userId;
    }
    // is the user admin
    function isAdmin() {
      return get(/databases/$(database)/documents/users/$(request.auth.uid)).data.isAdmin == true;
    }
    // is the user a reader of the data
    function isReader() {
      return get(/databases/$(database)/documents/users/$(request.auth.uid)).data.isReader == true;
    }
    // helper to check if they are updating something important
    function notUpdating(field) {
      return !(field in request.resource.data) || (resource.data[field] && resource.data[field] == request.resource.data[field])
    }
    // there is no invalid change if not changing the private things here
    function noInvalidDataChange() {
    	return (!('isAdmin' in request.resource.data) || false == request.resource.data['isAdmin'])
             && (!('isReader' in request.resource.data) || false == request.resource.data['isReader']);
          // && notUpdating('forbiddenData');
    }
    // Allow public read access to user data, but only content owners can write
    match /users/{userId}/{documents=**} {
	    allow read, delete: if isRequestingUser(userId) || isAdmin();
      // Disallow the creation of users with active subscriptions / admin rights
      allow update : if (noInvalidDataChange() && isRequestingUser(userId)) || isAdmin();
      allow create: if noInvalidDataChange() && isRequestingUser(userId);
    }
    // Allow public read access to user data, but only admins can create and edit
    match /item_categories/{categoryId}/{documents=**} {
      allow create, write, delete, update : if isAdmin();
	    allow read : if isReader();
    }
    // Allow public read access to user data, but only admins can create and edit
    match /items/{categoryId}/{documents=**} {
      allow create, write, delete, update : if isAdmin();
	    allow read : if isReader();
    }
    // Allow public read access to user data, but only admins can create and edit
    match /quantities/{categoryId}/{documents=**} {
      allow create, write, delete, update : if isAdmin();
	    allow read : if isReader();
    }
    // Allow public write access to track activity, but only admins can read
    match /activity/{documents=**} {
      allow create : if isReader();
      allow read, delete, update : if isAdmin();
    }
  }
}