firestore.rules

service cloud.firestore {
  match /databases/{database}/documents {
    match /items/{id} {
      allow get: if resource == null || isUser(getDoc().createdBy);
      allow list: if isUser(getDoc().createdBy);
      allow create: if isItem(getDocInc(), id);
      allow update: if isItem(getDocInc(), id);
      allow delete: if isUser(getDoc().createdBy);
    }
    match /tags/{id} {
      allow get: if resource == null || isUser(getDoc().createdBy);
      allow list: if isUser(getDoc().createdBy);
      allow create: if isTag(getDocInc(), id);
      allow update: if isTag(getDocInc(), id);
      allow delete: if false;
    }
    match /notifications/{id} {
      allow get: if resource == null || isUser(getDoc().userId);
      allow list: if isUser(getDoc().userId);
      allow create: if isUser(getDocInc().userId);
      allow update: if isNotification(getDocInc(), id);
      allow delete: if isUser(getDoc().userId);
    }
    match /roadmapBricks/{id} {
      allow get: if resource == null || isAuthenticated();
      allow list: if isAuthenticated();
      allow create: if isRoadmapBrick(getDocInc(), id);
      allow update: if isRoadmapBrick(getDocInc(), id);
      allow delete: if canDeleteRoadmapBrick(getDoc());
    }
    match /users/{id} {
      allow get: if resource == null || isUser(id);
      allow list: if false;
      allow create: if false;
      allow update: if isUserDoc(getDocInc(), id);
      allow delete: if false;
    }
    match /counterItems/{id} {
      allow get: if resource == null || isUser(id);
    }
    match /counterNewFinished/{id} {
      allow get: if resource == null || isUser(getDoc().userId);
    }
  }
}

function isItem(doc, id) {
  return
  		// doc.size() == 7
  		// && doc.url is string && doc.url.size() > 0
  		// && ((doc.title is string && doc.title.size() > 0) || doc.title == null)
  		// && ((doc.description is string && doc.description.size() > 0) || doc.description == null)
  		// && doc.type is string && doc.type in ["video", "article", "profile", "website"]
  		// && doc.status is string && doc.status in ["new", "inProgress", "done"]
  		// &&
      isUser(doc.createdBy)
      // && doc.createdAt is timestamp
}

function isTag(doc, id) {
  return
  		// doc.size() == 7
  		// && doc.url is string && doc.url.size() > 0
  		// && ((doc.title is string && doc.title.size() > 0) || doc.title == null)
  		// && ((doc.description is string && doc.description.size() > 0) || doc.description == null)
  		// && doc.type is string && doc.type in ["video", "article", "profile", "website"]
  		// && doc.status is string && doc.status in ["new", "inProgress", "done"]
  		// &&
      isUser(doc.createdBy)
      // && doc.createdAt is timestamp
}

function isNotification(doc, id) {
  return
  		// doc.size() == 7
  		// && doc.url is string && doc.url.size() > 0
  		// && ((doc.title is string && doc.title.size() > 0) || doc.title == null)
  		// && ((doc.description is string && doc.description.size() > 0) || doc.description == null)
  		// && doc.type is string && doc.type in ["video", "article", "profile", "website"]
  		// && doc.status is string && doc.status in ["new", "inProgress", "done"]
  		// &&
      isUser(doc.userId)
      // && doc.createdAt is timestamp
}

function isRoadmapBrick(doc, id) {
  return true;
  		// doc.size() == 7
  		// && doc.url is string && doc.url.size() > 0
  		// && ((doc.title is string && doc.title.size() > 0) || doc.title == null)
  		// && ((doc.description is string && doc.description.size() > 0) || doc.description == null)
  		// && doc.type is string && doc.type in ["video", "article", "profile", "website"]
  		// && doc.status is string && doc.status in ["new", "inProgress", "done"]
  		// &&
      // isUser(doc.createdBy)
      // && doc.createdAt is timestamp
}

function isUserDoc(doc, id) {
  return
  		// doc.size() == 7
  		// && doc.url is string && doc.url.size() > 0
  		// && ((doc.title is string && doc.title.size() > 0) || doc.title == null)
  		// && ((doc.description is string && doc.description.size() > 0) || doc.description == null)
  		// && doc.type is string && doc.type in ["video", "article", "profile", "website"]
  		// && doc.status is string && doc.status in ["new", "inProgress", "done"]
  		// &&
      isUser(id)
      // && doc.createdAt is timestamp
}

function canDeleteRoadmapBrick(doc) {
	return isAdmin() || (isUser(doc.createdBy) && doc.type != "feature" && doc.status == "new");
}

function isAdmin() {
	return getAuth().uid == "carcBWjBqlNUY9V2ekGQAZdwlTf2"; // Anton's id
}

// RESOURCE DATA ACCESS - START
// Returns existing document data
function getDoc(){
  return resource.data
}
// Returns incoming document data (for create & update operations)
function getDocInc(){
  return request.resource.data
}
// RESOURCE DATA ACCESS - END

// AUTH - START
function getAuth() {
  return request.auth
}
function isAuthenticated() {
  return getAuth() != null;
}
function isUser(userId) {
  return getAuth().uid == userId;
}
// AUTH - END

// USER ACCESS FUNCTIONS - START
function getUserRoleInOrganization(organizationId){
  return frGet(/organizations/$(organizationId)).roles[getAuth().uid];
}
function getUserRoleInLocation(locationId){
  return frGet(/locations/$(locationId)).roles[getAuth().uid];
}
function isUserInOrganization(organizationId) {
  return getUserRoleInOrganization(organizationId) in ['powerUser', 'user'];
}
function isUserInLocation(locationId) {
  return getUserRoleInLocation(locationId) in ['powerUser', 'user'];
}
function doesUserHasRoleInOrganization(organizationId, role) {
  return getUserRoleInOrganization(organizationId) == role;
}
function doesUserHasRoleInLocation(locationId, role) {
  return getUserRoleInLocation(locationId) == role;
}
function doesUserHasAccess(organizationId, locationId) {
  return isUserInOrganization(organizationId) && isUserInLocation(locationId)
}
// USER ACCESS FUNCTIONS - END

// LIST PARAMS - START
function reqLimitForList() {
  return request.query.limit <= 20
}
// LIST PARAMS - END

// HELPERS - START
function frGet(path) {
  return get(/databases/$(database)/documents/$(path)).data;
}
function frGetAfter(path) {
  return getAFter(/databases/$(database)/documents/$(path)).data;
}
function frExists(path) {
  return exists(/databases/$(database)/documents/$(path));
}

function isCreatedAtValid (entity) {
  return entity.createdAt is timestamp && entity.createdAt <= request.time;
}
function isCreatedByValid (entity) {
  return entity.createdBy is string && entity.createdBy == getAuth().uid;
}
// HELPERS - END