firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    // public collection is publicly accessible
    match /public/{publicId} {
      allow read, write: if true;
    }

    // analytics - only allow users to read
    // TODO: move to API to utilize cache
    match /analytics/{analyticId} {
      allow read: if true;
      allow write: if false;
     }

    // securities for authenticated users
    match /users/{userId} {
      allow read, write: if isOwner(userId) || isAdmin();

      match /pdfs/{pdfId} {
          allow read, write: if isOwner(userId) || isAdmin();
      }
    }

    // HELPER FUNCTIONS
    function isOwner(userId) {
      return request.auth != null && request.auth.uid == userId;
    }

    function isAdmin() {
      return request.auth.token.admin == true;
    }
  }
}