firestore.rules

rules_version = '2';

service cloud.firestore {


  match /databases/{database}/documents {

    // TODO: assign users from admin app an admin role

    // true if the admin is not anonymous
    function registeredAdmin() {
      return get(/databases/$(database)/documents/admins/$(request.auth.uid)).data.isAnonymous == false;
    }

    // true if the admin is signed in anonymously and has free experiments left
    function guestWithFreeExperiments() {
      return get(/databases/$(database)/documents/admins/$(request.auth.uid)).data.isAnonymous == true && get(/databases/$(database)/documents/admins/$(request.auth.uid)).data.experimentCount < get(/databases/$(database)/documents/settings/generalSettings).data.freeExperimentCount;
    }

    // only everyone to read the general settings, don't allow any writes
    match /settings/generalSettings {
      allow read: if request.auth != null;
    }

    // only allow admin to access their own admin document
    match /admins/{adminId} {
      allow read, write: if request.auth != null && adminId == request.auth.uid;
    }

    match /experiments/{experimentDocId} {
      // allow admin to create a new experiment either if they are registered (unlimited) or if they have a free experiment left
      allow create: if registeredAdmin() || guestWithFreeExperiments();
      // allow only an admin to update or delete an experiment that they created themselves
      allow update, delete: if request.auth != null && request.auth.uid == resource.data.adminUid;
      // allow all signed in users and admins to read experiments
      allow read: if request.auth != null;

      // 
      match /users/{userId} {
        allow read, write: if true; //request.auth != null && resource.parent.data.adminUid == request.auth.uid; //get(/databases/$(database)/documents/experiments/$(experimentDocId)).data.adminUid == request.auth.uid;
      }
    }
  }
}