firestore.rules

rules_version = '2';

function isUpdateRestrictedToField(request, field) {
    return request.resource.data.diff(resource.data).affectedKeys().hasOnly([field]);
}

function role(name) {
  return get(/databases/$(database)/documents/roles/$(name)).data
}

service cloud.firestore {
  match /databases/{database}/documents {
    match /config/{configFile} {
      allow read: if true;
      allow write: if request.auth.uid != null;
    }
    match /users/{userId} {
      allow read: if true;
      allow write: if request.auth.uid == userId;

      match /visits/{venueId} {
        allow read: if true;
        allow write: if request.auth.uid == userId;
      }
    }
    match /userprivate/{userId} {
      allow read,write: if request.auth.uid == userId;
    }
    match /chatsv3/{chatId} {
      allow write, read: if request.auth.uid != null;
    }
    match /privatechats/{userId}/{restOfPath=**} {
      allow create: if request.auth.uid != null && request.resource.data.from == request.auth.uid;
      allow read: if request.auth.uid != null && userId == request.auth.uid;
      allow update: if request.auth.uid != null && isUpdateRestrictedToField(request, 'isRead');
    }
    match /experiences/{experienceId}/{restOfPath=**} {
      allow read: if true;
      allow write: if request.auth.uid != null;
    }
    match /faq/{faqId} {
      allow read: if true;
    }
    match /marketingemails/{emailId} {
      allow read: if request.auth.uid != null;
      allow write: if true;
    }
    match /venues/{venue} {
      allow read: if true;

      function venueData() {
        return get(/databases/$(database)/documents/venues/$(venue)).data
      }

      match /events/{event} {
        allow read: if true;
        allow write: if request.auth.uid in venueData().owners;
      }
      match /chats/{restOfPath=**} {
        allow read,create: if request.auth.uid != null;
        allow update: if (request.auth.uid in role('admin').users || request.auth.uid in venueData().owners) &&
          isUpdateRestrictedToField(request, 'deleted');
      }
      match /access/{method} {
        allow read, write: if false;
      }
      match /accessgranted/{userId} {
        allow read, write: if false;
      }
    }
    match /customers/{userId} {
      allow read: if false;
      allow write: if false;
    }
    match /purchases/{restOfPath=**} {
      allow read,write: if true;
    }
    match /roles/{roleId} {
      allow read: if true;
      allow write: if false;
    }
  }
}