firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
  	function isSignedIn() {
    	return request.auth.uid != null
    }
    
    // Make sure the request has only the specified allowed fields    
    function editingAllowedFields(allowed) {
        let editedKeys = request.resource.data.diff(resource.data).affectedKeys();
        return editedKeys.hasOnly(allowed);
    }
    
    match /events/{eventID} {
    	allow read: if true;
      
      // Organizers can create requests only with their own consumer_id
      allow create: if request.resource.data.consumer_id == request.auth.uid && isSignedIn()

      // Address can't be changed after event creation
      allow update: if request.resource.data.address == resource.data.address && isSignedIn()

			// Only allow guests to edit these fields
    	allow update: if editingAllowedFields(["arrivedProviderSpaces", "interestedProviders", "departedProviderSpaces"])
  	}
    
    match /users/{userID} {
    	// Anyone is allowed to read the users database
    	allow read: if true
      
    	// Allow users to write only to their own doc
    	allow write: if request.auth.uid == userID
    }
  }
}