firestore-rules.txt

service cloud.firestore {
  function isAuthenticated() {
    return request.auth != null;
  }

   // Add uid of admin user 
  // This is temp solution for time being till fetching role from user document does not work
  function isAdmin() {
  	return isAuthenticated() && 
    			(request.auth.uid == '');
  }

  function isUserAuthenticated(userId) {
    return isAuthenticated() && request.auth.uid == userId;
  }


  match /databases/{database}/documents {

   match /{document=**} {
		allow read, write: if isAdmin();
		}
   
   match /users/{userId} {
     // get stat of played game with other user
      match /game_played_with/{otherUserId} {
          allow read: if isUserAuthenticated(userId);        
      }

      // only allow creating user document when no roles specified
      // only allow updating user document when roles are not altered
      // updating of user happen via API and rules have no effect on API 

       allow read: if isUserAuthenticated(userId); 
       allow create: if isUserAuthenticated(userId) && !request.resource.data.keys().hasAny(['roles']);         
    	 allow update: if isUserAuthenticated(userId) && 
       (!request.resource.data.keys().hasAny(['roles']) || (resource.data.roles == request.resource.data.roles));
    }
    
    match /categories {
      match /{document=**} {
        allow read;
      }
    }
    
    match /lists {
      match /{document=**} {
        allow read;
      }
    }
    
    match /questions {
      match /{document=**} {
          allow read: if isUserAuthenticated(resource.data.created_uid);
      }
  
      match /{questionId} {
          allow get: if isUserAuthenticated(request.auth.uid);
          match /reactions {
              match /{userId} {
                    allow get, create, update, delete: if isUserAuthenticated(userId); 
              }      
        }
      }
    }
    
   match /unpublished_questions {
      match /{document=**} {
        allow read, update: if isUserAuthenticated(resource.data.created_uid);
        allow create: if isUserAuthenticated(request.resource.data.created_uid);
      }
    }
    
    match /bulk_uploads {
      match /{document=**} {
        allow read, update: if isUserAuthenticated(resource.data.created_uid);
        allow create: if isUserAuthenticated(request.resource.data.created_uid);
      }
    }
    
    match /games {
      match /{document=**} {
        allow read: if isUserAuthenticated(request.user.uid) || isUserAuthenticated(resource.data.playerId_0) || isUserAuthenticated(resource.data.playerId_1) || isUserAuthenticated(resource.data.nextTurnPlayerId);
        
      }
    }
    
     match /subscription/{email} {
     // create rule with data size ensure that there only two keys allowed
     // keys().hasAny ensure that only email, and userId are allowed as field
     // resource == null ensure when document does not exist it returns 
     // does not throw permission denied error
         allow create: if request.resource.data.size() < 3 && request.resource.data.keys().hasAny(['email', 'userId']);
         allow get: if resource.data.email.lower() == email.lower() || resource == null;       
      }
      

     match /invitations {
      	match /{document=**} {
      	allow create: if isUserAuthenticated(request.resource.data.created_uid);
       // allow read, update: if request.auth.token.phone_number;
        allow read, update: if (resource.data.email == request.auth.token.phone_number)
        || (resource.data.email == request.auth.token.email);
        
        allow read: if (resource.data.created_uid == request.auth.uid)
        || (resource.data.email == request.auth.token.email);
      }
    }   
    
     match /leader_board_stats {
        match /{document=**} {
           allow read:  if true; 
       }
    }
    
    match /friends/{userId} {
         allow get: if isUserAuthenticated(userId);          
    }
    
    match /report_questions {
      match /{document=**} {
        allow read, update: if isUserAuthenticated(resource.data.created_uid);
        allow create: if isUserAuthenticated(request.resource.data.created_uid);        
    }
    }
    
      match /stats/system {   
        allow get: if true;     
    }
    
    match /social_share {
      match /{document=**} {
        allow read,update : if isUserAuthenticated(request.resource.data.created_uid);
        allow create: if isUserAuthenticated(request.resource.data.created_uid); 
    }
    }
    
    match /blogs {    
      match /{document=**} {
        allow read: if true;  
      }      
    }
    
    match /application_settings {    
      match /{document=**} {
        allow read:  if true; 
      }      
    }
    
    match /accounts/{userId} {    
      //only allow login user to read and get it
      // logged in user does not have rights to modify this document
      // document can only be modified by API , triggers
      allow read:  if isUserAuthenticated(userId);          
    }
    
    match /feedback {
      match /{document=**} {
        allow create: if true;
      }
    }
    
    match /countries {
      match /{document=**} {
        allow read;
      }
    }

    match /user_status/{userId} {    
      // only allow login user to read and get it
      // logged in user does not have rights to modify this document
      // document can only be modified by API , triggers
      allow get:  if isUserAuthenticated(userId);   
    }
    
  }
}