firestore.rules

rules_version = '2';

service cloud.firestore {

  function authenticated() {
    return request.auth.token != null;
  }

  function admin() {
    return authenticated() && request.auth.token.role == 'admin';
  }

  match /databases/{database}/documents {

    match /admins/{adminId} {
      allow get: if adminId == request.auth.uid || admin();
      allow list: if admin();
      allow update: if (
          adminId == request.auth.uid &&
          !request.resource.data.diff(resource.data).affectedKeys().hasAny(['role', 'createdOn'])
        ) || admin();
      allow delete: if adminId == request.auth.uid || admin();
    }

    match /users/{userId} {
      allow get: if userId == request.auth.uid || admin();
      allow list: if admin();
      allow update: if admin();
      allow delete: if userId == request.auth.uid || admin();
    }

    match /releases/{releaseId} {
      allow write, read: if admin();
    }

    match /release-history/{releaseId} {
      allow write, read: if admin();
    }

    match /coupons/{document=**} {
      allow read: if true;
      allow write: if admin();
    }

    match /customers/{customer} {
      allow read: if admin() || ((authenticated() && request.auth.uid == customer));
      // TODO: Allow only updating of some fields
      allow write: if admin() || ((authenticated() && request.auth.uid == customer));
    }

    match /products/{document=**} {
      allow read: if true;
      allow write: if admin();

      match /reviews/{review} {
      	allow read: if true;
        allow write: if admin();
      }
    }

    match /blog-articles/{document} {
      allow read: if true;
      allow write: if admin();

      match /blog-comments/{comment} {
        allow list: if true || admin();
        allow get: if admin();
        allow create: if admin() || (
          authenticated() &&
          request.resource.data.author == request.auth.uid &&
          request.resource.data.keys().hasOnly(
            ['author', 'authorName', 'comment', 'createdOn']
          )
        );
        allow update: if admin() || (
          request.resource.data.author == request.auth.uid &&
          request.resource.data.diff(resource.data).affectedKeys().hasOnly(['comment', 'authorName'])
        );
        allow delete: if admin() || (resource.data.author == request.auth.uid);
      }
    }

    match /blog-categories/{document} {
      allow read: if true;
      allow write: if admin();
    }

    match /blog-authors/{document} {
      allow read: if true;
      allow write: if admin();
    }

    match /email-templates/{document=**} {
      allow read, write: if admin();
    }

    match /email-template-layouts/{document=**} {
      allow read, write: if admin();
    }

    match /tags/{document} {
      allow read: if true;
      allow write: if admin();
    }

    match /products/{document} {
      allow read: if true;
      allow write: if admin();
    }

    match /coupons/{document} {
      allow read: if admin()
      allow write: if admin();
    }

    match /discounts/{document} {
      allow read: if true;
      allow write: if admin();
    }    

    match /orders/{document} {
      allow read: if admin() || (authenticated() && request.auth.uid == resource.data.customer);
      allow write: if admin();
    }

    match /categories/{document} {
      allow read: if true;
      allow write: if admin();
    }

    match /pages/{id=**} {
      allow read: if true;
      allow write: if admin();
    }    

    match /sections/{id=**} {
      allow read: if true;
      allow write: if admin();
    }

    match /templates/{id=**} {
      allow read: if true;
      allow write: if admin();
    }

    match /popups/{id=**} {
      allow read: if true;
      allow write: if admin();
    }

    match /layouts/{id=**} {
      allow read: if true;
      allow write: if admin();
    }

    match /notification-channels/{id=**} {
      allow read: if admin();
      allow write: if admin();
    }

    match /cms-notifications/{id=**} {
      allow read: if admin();
      allow write: if admin();
    }

    match /notifications/{id=**} {
      allow read: if admin();
      allow write: if admin();
    }

    match /forms/{form} {
      allow read, write: if admin();

      match /form-responses/{id} {
        allow read: if admin();
        allow write: if true;
      }
    }

    match /{document=**} {
      allow read, write: if false;
    }
  }
}