firestore.rules

service cloud.firestore {
  match /databases/{database}/documents {

    function isAdmin() {
      return exists(/databases/$(database)/documents/admins/$(request.auth.uid));
    }

    function isGuide() {
      return exists(/databases/$(database)/documents/guides/$(request.auth.uid));
    }

    function isCreator() {
      return resource.data.creator != null &&
      	(request.auth.uid == resource.data.creator.data.id || request.auth.uid == resource.data.creator.id);
    }

    function isUserAssignee() {
    	return resource.data.assignee != null &&
      	(request.auth.uid == resource.data.assignee.data.id || request.auth.uid == resource.data.assignee.id);
    }

    function isUserAssigneeOrCreator() {
    	return isCreator() || isUserAssignee();
    }

    function isTaskUnassigned() {
      return (request.resource.data.keys().hasAll(['assignee'])
      && !resource.data.keys().hasAll(['assignee']));
    }

    match /tasks/{anyTask} {
    	allow read: if request.auth != null;
      // Allow create for admins and guides
      allow create: if request.auth != null && (isAdmin() || isGuide());
      // Uncomment the following to allow create for all
      // allow create: if request.auth != null;
      // Uncomment the following to allow unassigned task to be assigned by all
      //allow update: if request.auth != null && (isAdmin() || isGuide() || isUserAssigneeOrCreator() || isTaskUnassigned());
      allow update: if request.auth != null && (isAdmin() || isGuide() || isUserAssigneeOrCreator());
      allow delete: if request.auth != null && (isAdmin() || isCreator());
    }


    match /comments/{anyComment} {
      allow read: if request.auth != null;
      allow create: if request.auth != null;
      allow update: if request.auth != null && isCreator();
      allow delete: if request.auth != null && isCreator();
    }

    match /users/{userId} {
      allow read: if request.auth != null; // Auth users can read
      allow write: if userId == request.auth.uid;
    }

    match /admins/{anyAdmin} {
      allow read: if request.auth != null;
    }

    match /guides/{anyGuide} {
      allow read: if request.auth != null;
    }

    match /colors/{anyColor} {
    	allow create: if request.auth != null;
      allow read: if request.auth != null;
      allow update: if request.auth != null && isAdmin();
      allow delete: if request.auth != null && isAdmin();
    }

    match /labels/{anyLabel} {
    	allow create: if request.auth != null;
      allow read: if request.auth != null;
      allow update: if request.auth != null && (isAdmin() || isGuide());
      allow delete: if request.auth != null && (isAdmin() || isGuide());
    }

    match /projects/{anyLabel} {
    	allow create: if request.auth != null && isAdmin();
      allow read: if request.auth != null;
      allow update: if request.auth != null && isAdmin();
      allow delete: if request.auth != null && isAdmin();
    }
  }
}