firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
  
    function isAuthed() {
      return (request.auth != null) && (request.auth.token.email_verified == true);
    }
    
    function isAdmin(accountId) {
      return isAuthed() && get(/databases/$(database)/documents/accounts/$(accountId)/accountUsers/$(request.auth.uid)).data.role == "admin";
    }
    
  	// auth tokens
  	match /authTokens/{documents=**} {
      allow write: if false;
      allow read: if false;
    }

    // accounts
    match /accounts/{accountId} {
      function accountExists() {
        return exists(/databases/$(database)/documents/accounts/$(accountId));
      }
      
    	allow read: if isAdmin(accountId) || !accountExists();
      allow create: if isAdmin(accountId);
      allow update: if isAdmin(accountId);
      allow delete: if isAdmin(accountId);

			match /accountUsers/{accountUser} {      
        allow read: if isAdmin(accountId);
        allow create: if isAuthed() && !accountExists();
        allow update: if isAdmin(accountId);
        allow delete: if isAdmin(accountId);
      }
      
      match /{documents=**} {
        allow read: if isAdmin(accountId);
        allow write: if isAdmin(accountId);
      }
   	}
    
    // users
    match /users/{userId} {
    	function isUser () {
      	return userId == request.auth.uid;
      }
    	allow read: if isUser();
      allow create: if isAuthed();
      allow update: if isUser();
      allow delete: if isUser();
    }
  }
}