firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function isAdmin() {
      return exists(/databases/$(database)/documents/adminUsers/$(request.auth.uid))
    }
    match /states/{document=**} {
      allow read;
    }
    match /{path=**}/leaders/{leader} {
      allow read;
    }
    match /content/{document=**} {
      allow read;
      allow write: if isAdmin();
    }
    match /adminUsers/{adminId} {
      allow get: if request.auth.uid != null;
    }
    match /twitterAccounts/{document=**} {
      allow read: if isAdmin();
      allow write: if isAdmin();
    }
    match /userProfiles/{userUid} {
      allow read: if request.auth.uid == userUid;
      allow update: if request.auth.uid == userUid
                    && request.resource.data.email == resource.data.email;
    }
    match /userProfiles/{document=**} {
      allow read: if isAdmin();
    }
  }
}