firebase.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
  	
    match /chats/{chat} {
    	allow read: if user() != null && chatContainsUser(chat)
    	allow update: if user() != null && chatContainsUser(chat)
      allow create
    }
    
    match /users/{user} {
      allow read: if user() != null
      allow create: if user() != null && ownsDoc(user)
      allow update: if user() != null && (ownsDoc(user) || 
      (requestChangesOnlyTheseFields(["friends", "incomingRequests", "outgoingRequests", "chats"]) 
      && canChangeFriend(user)))
    }

    function user(){
      return request.auth
    }

    function userData(){
      return get(/databases/$(database)/documents/users/$(user().uid)).data
    }
    
    function chatData(chat){
      return get(/databases/$(database)/documents/chats/$(chat)).data
    }

    function ownsDoc(id){
      return user().uid == id
    }

    function isFriendsWith(id){
      return userData().friends.hasAll([id])
    }
    
    // Checks if the request user is part of a chat 💬
    function chatContainsUser(chat){
    	return chatData(chat).users.hasAll([user().uid])
    }
    
    // A user can write to documents of other users only if:
    // 1. They are friends with the user who owns the document 
    // that they are trying to write to
    // 2. They are only changing the "friends" field or the "incomingRequests" field. 
    // (This isn't being checked here but is above on line 9)
    // 3. The only element added or removed from these lists is the ID
    // of the user (Can't remove other people from your friends' friends list)
    function canChangeFriend(docID){
    	// This stops users from adding themselves (or someone else) 
    	// to somebody else's friends list without a friend request 
    	// (That would be quite bad 👽)
    	let friends = [];
    	let requestFriends = requestData().friends;
    	let friendsDiff = arrayDiff(friends, requestFriends);
      
    	let addingSelfToFriendsValidly =
    	changedData().hasAll(["friends"]) == false ||
    	resource.data.outgoingRequests.toSet().hasAll(friendsDiff); 
      // 👆 Do the users that are being added to this friends' list already
      //  have a friend request?
      
      let addingChatToFriendValidly =
      changedData().hasAll(["chats"]) == false ||
      (isAddingButNotRemoving("chats") && isFriendsWith(docID));
      
      let isUpdatingIncomingRequestsProperly = 
      isAddingSelfToField("incomingRequests", user().uid) ||
      isRemovingSelfFromField("incomingRequests", user().uid);
		      
    	return addingSelfToFriendsValidly && addingChatToFriendValidly && 
      (isUpdatingIncomingRequestsProperly &&
      isRemovingSelfFromField("outgoingRequests", user().uid));
    }
    
    // Checks if the request is only adding the 
    // request user to the list, and nothing else.
    function isAddingSelfToField(fieldName, userID){
    	let oldList = resource.data[fieldName];
      let newList = requestData()[fieldName];
      
      let sizeMatches = newList.size() == oldList.size() + 1;
      return newList.size() == oldList.size() || // The field (🐈) did not change
      sizeMatches && arrayDiff(newList, oldList) == [userID].toSet();
    }
    
    function isRemovingSelfFromField(fieldName, userID){
    	let oldList = resource.data[fieldName];
      let newList = requestData()[fieldName];
      
      let sizeMatches = newList.size() == oldList.size() - 1;
      return newList.size() == oldList.size() || // The field (🐈) did not change
      (sizeMatches && arrayDiff(oldList, newList) == [userID].toSet());
    }
    
    function isAddingButNotRemoving(fieldName){
      let oldList = resource.data[fieldName];
      let newList = requestData()[fieldName];
      
      return newList.hasAll(oldList);
    }
    
    function arrayDiff(arr1, arr2){
      return arr1.toSet().difference(arr2.toSet());
    }
    
    function requestData(){
  		return request.resource.data;
		}
    
    function changedData(){
    	return requestData().diff(resource.data).affectedKeys()
    }
    
    function requestChangesOnlyTheseFields(fields){
    	return changedData().hasOnly(fields);
    }
  }
}