firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
  function isManager(request, role) {
  	return role in get(/databases/$(database)/documents/users/$(request.auth.uid)).data.roles;
  }
  function isAdmin(request) {
		return get(/databases/$(database)/documents/users/$(request.auth.uid)).data.isAdmin == true;
	}
  function isAuthed(request) {
		return request.auth != null;
	}

   
    match /{path=**}/invites/{invite} {
    allow read;
    allow update;
    allow write, delete: if (isAuthed(request) && isAdmin(request)) || isManager(request, 'user_manager');
    }
    match /{path=**}/events/{event} {
    allow read;
    allow write, delete: if (isAuthed(request) && isAdmin(request)) || isManager(request, 'event_manager');
    }
    match /{path=**}/shifts/{shift} {
    allow read: if isAuthed(request);
    allow write, delete: if (isAuthed(request) && isAdmin(request)) || isManager(request, 'event_manager');
    }
    match /{path=**}/engagements/{engagement} {
    allow read: if isAuthed(request);
    allow update: if isAuthed(request);
    allow create, delete: if (isAuthed(request) && isAdmin(request)) || isManager(request, 'shift_manager');
    }
    match /{path=**}/studylines/{studyline} {
    allow read;
    allow write, delete: if isAuthed(request) && isAdmin(request);
    }
    match /{path=**}/users/{userId} {
    	allow read;
      allow create;
      allow update: if isAuthed(request) || isAdmin(request);
      allow delete: if isAuthed(request) && isAdmin(request);
    }
    match /{path=**}/settings/{settings} {
    	allow read;
      allow write, update, delete: if isAdmin(request);
    }
  }
  
	
}