firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // Security Functions
    function isSignedIn() {
      return request.auth != null;
    }
    function isSignedInWithUser(userId) {
      return request.auth.uid == userId;
    }
    function hasRole(role) {
      return request.auth.token.role == role;
    }
    function hasAnyRole(roles) {
      return request.auth.token.role in roles;
    }
    function hasPermission(permission) {
      return hasRole('custom') && permission in request.auth.token.permissions;
    }
    function hasAnyPermission(permissions) {
      return hasRole('custom') && request.auth.token.permissions.hasAny(permissions);
    }

    // Spaces
    match /spaces/{spaceId} {
      allow read: if isSignedIn() && hasAnyRole(['custom','admin']);
      allow write: if isSignedIn() && (hasRole('admin') || hasPermission('SPACE_MANAGEMENT'));

      // Translations
      match /translations/{translationId} {
        allow read: if isSignedIn() && (hasRole('admin') || hasPermission('TRANSLATION_READ'));
        allow create: if isSignedIn() && (hasRole('admin') || hasPermission('TRANSLATION_CREATE'));
        allow update: if isSignedIn() && (hasRole('admin') || hasPermission('TRANSLATION_UPDATE'));
        allow delete: if isSignedIn() && (hasRole('admin') || hasPermission('TRANSLATION_DELETE'));
      }

      // Schemas
      match /schemas/{schemaId} {
        allow read: if isSignedIn() && (hasRole('admin') || hasAnyPermission(['SCHEMA_READ','CONTENT_READ']));
        allow create: if isSignedIn() && (hasRole('admin') || hasPermission('SCHEMA_CREATE'));
        allow update: if isSignedIn() && (hasRole('admin') || hasPermission('SCHEMA_UPDATE'));
        allow delete: if isSignedIn() && (hasRole('admin') || hasPermission('SCHEMA_DELETE'));
      }

      // Content
      match /contents/{contentId} {
        allow read: if isSignedIn() && (hasRole('admin') || hasPermission('CONTENT_READ'));
        allow create: if isSignedIn() && (hasRole('admin') || hasPermission('CONTENT_CREATE'));
        allow update: if isSignedIn() && (hasRole('admin') || hasPermission('CONTENT_UPDATE'));
        allow delete: if isSignedIn() && (hasRole('admin') || hasPermission('CONTENT_DELETE'));
      }

      // Assets
      match /assets/{assetId} {
        allow read: if isSignedIn() && (hasRole('admin') || hasAnyPermission(['ASSET_READ','CONTENT_READ']));
        allow create: if isSignedIn() && (hasRole('admin') || hasPermission('ASSET_CREATE'));
        allow update: if isSignedIn() && (hasRole('admin') || hasPermission('ASSET_UPDATE'));
        allow delete: if isSignedIn() && (hasRole('admin') || hasPermission('ASSET_DELETE'));
      }

      // Tasks
      match /tasks/{taskId} {
        allow read: if isSignedIn() && (hasRole('admin') || hasAnyPermission(['ASSET_IMPORT','ASSET_EXPORT','CONTENT_IMPORT','CONTENT_EXPORT','SCHEMA_IMPORT','SCHEMA_EXPORT','TRANSLATION_IMPORT','TRANSLATION_EXPORT']));
        allow create: if isSignedIn() && (hasRole('admin') || hasAnyPermission(['ASSET_IMPORT','ASSET_EXPORT','CONTENT_IMPORT','CONTENT_EXPORT','SCHEMA_IMPORT','SCHEMA_EXPORT','TRANSLATION_IMPORT','TRANSLATION_EXPORT']));
        allow update: if isSignedIn() && (hasRole('admin') || hasAnyPermission(['ASSET_IMPORT','ASSET_EXPORT','CONTENT_IMPORT','CONTENT_EXPORT','SCHEMA_IMPORT','SCHEMA_EXPORT','TRANSLATION_IMPORT','TRANSLATION_EXPORT']));
        allow delete: if isSignedIn() && (hasRole('admin') || hasAnyPermission(['ASSET_IMPORT','ASSET_EXPORT','CONTENT_IMPORT','CONTENT_EXPORT','SCHEMA_IMPORT','SCHEMA_EXPORT','TRANSLATION_IMPORT','TRANSLATION_EXPORT']));
      }

      // Tokens
      match /tokens/{tokenId} {
        allow read: if isSignedIn() && (hasRole('admin') || hasPermission('SPACE_MANAGEMENT'));
        allow write: if isSignedIn() && (hasRole('admin') || hasPermission('SPACE_MANAGEMENT'));
      }

      // Plugins
      match /plugins/{pluginId} {
        allow read: if isSignedIn() && (hasRole('admin') || hasPermission('SPACE_MANAGEMENT'));
        allow write: if isSignedIn() && (hasRole('admin') || hasPermission('SPACE_MANAGEMENT'));
      }
    }

    // Users
    match /users/{userId} {
      allow read: if isSignedIn() && ( isSignedInWithUser(userId) || (hasRole('admin') || hasPermission('USER_MANAGEMENT')));
      allow write: if isSignedIn() && (hasRole('admin') || hasPermission('USER_MANAGEMENT'));
    }

    // Configs
    match /configs/{configId} {
      allow read: if isSignedIn() && (hasRole('admin') || hasPermission('SETTINGS_MANAGEMENT'));
      allow write: if isSignedIn() && (hasRole('admin') || hasPermission('SETTINGS_MANAGEMENT'));
    }

    match /{document=**} {
      allow read: if isSignedIn() && hasAnyRole(['custom','admin']);
      allow write: if isSignedIn() && hasRole('admin');
    }
  }
}