firestore.rules

service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if false;
    }
    // This function allows us to look at AuthZ (Authorization) roles within our database, to see who is allowed for activities.
    function getRole(role) {
      return get(/databases/$(database)/documents/users/$(request.auth.uid)).data.roles[role]
    }
    // Users
    match /users/{userId} {
      allow read: if request.auth.uid != null;
      allow create: if request.resource.data.roles.keys().hasAny(['admin', 'editor']) == false;
      allow update: if request.resource.data.roles.keys().hasAny(['admin', 'editor']) == false
      							|| resource.data.roles.keys().hasAny(['admin', 'editor']) == true;
    }
    match /config/{configId}{
      allow read: if true;
    }

    match /books/{bookId}{
      allow create: if getRole('admin') == true;
      allow read: if true;
      allow update: if getRole('editor') == true || getRole('admin') == true;
      allow delete: if getRole('admin') == true;

      match /chapters/{chapterId}{
        allow create: if getRole('admin') == true;
        allow read: if true;
        allow update: if getRole('editor') == true || getRole('admin') == true;
        allow delete: if getRole('admin') == true;

        match /pages/{pageId}{
          allow create: if getRole('admin') == true;
          allow read: if true;
          allow update: if getRole('editor') == true || getRole('admin') == true;
          allow delete: if getRole('admin') == true;
        }
      }
    }
    match /authors/{authorId}{
        allow create: if getRole('admin') == true;
        allow read: if true;
        allow update: if getRole('editor') == true || getRole('admin') == true;
        allow delete: if getRole('admin') == true;
    }
    match /graphicnovels/{gnId}{
        allow create: if getRole('admin') == true;
        allow read: if true;
        allow update: if getRole('editor') == true || getRole('admin') == true;
        allow delete: if getRole('admin') == true;
    }
  }
}