firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{uid} {
      allow create: if
        request.auth.uid == uid &&
        !exists(/databases/$(database)/documents/users/$(request.auth.uid)) &&
        !request.resource.data.keys().hasAny(["connectedUser"])
      allow read: if
        request.auth != null
      allow update: if
        request.auth.uid == uid &&
        !request.resource.data.keys().hasAny(["connectedUser"])
      allow delete: if
        false
    }
    match /users/{uid}/private/{privateDoc=**} {
      allow read, write: if
        request.auth.uid == uid
    }
    match /movieReactions/{id} {
      allow create: if
        request.auth != null &&
        exists(/databases/$(database)/documents/users/$(request.auth.uid)) &&
        request.resource.data.owner == request.auth.uid
      allow read: if
        request.auth.uid == resource.data.owner ||
        get(/databases/$(database)/documents/users/$(request.auth.uid)).data.connectedUser == resource.data.owner
      allow update: if
        request.auth.uid == resource.data.owner &&
        request.resource.data.owner == resource.data.owner &&
        request.resource.data.createdAt == resource.data.createdAt
      allow delete: if
        request.auth.uid == resource.data.owner
    }
    match /connectionRequests/{uid} {
        allow create: if
          request.auth != null &&
          request.resource.data.keys().hasAll(["sender", "receiver", "status"]) &&
          exists(/databases/$(database)/documents/users/$(request.resource.data.receiver)) &&
          exists(/databases/$(database)/documents/users/$(request.resource.data.sender)) &&
          (
            !get(/databases/$(database)/documents/users/$(request.resource.data.sender)).data.keys().hasAny(["connectedUser"]) ||
            get(/databases/$(database)/documents/users/$(request.resource.data.sender)).data.connectedUser != request.resource.data.receiver
          ) &&
          request.auth.uid == request.resource.data.sender &&
          request.resource.data.status == "PENDING" &&
          request.auth.uid != request.resource.data.receiver
        allow read: if
          resource.data.receiver == request.auth.uid ||
          resource.data.sender == request.auth.uid
        allow update: if
          resource.data.receiver == request.auth.uid &&
          request.resource.data.status == "ACCEPTED" &&
          request.resource.data.keys().hasOnly(["sender", "receiver", "status"]) &&
          request.resource.data.receiver == resource.data.receiver &&
          request.resource.data.sender == resource.data.sender
        allow delete: if
          resource.data.receiver == request.auth.uid ||
          resource.data.sender == request.auth.uid
    }
    match /movies/{movie=**} {
      allow write: if
        false
      allow read: if
        request.auth != null
    }
    match /genres/{genre=**} {
      allow read, write: if
        false
    }
    match /regions/{region=**} {
      allow read, write: if
        false
    }
  }
}