firestore.rules

service cloud.firestore {
  match /databases/{database}/documents {

    match /tanam-types/{typeId} {
      allow read: if hasAnyRole();
      allow write: if isAtLeastAdmin();
    }

    match /tanam-users/{uid} {
      allow read: if isSignedInAs(uid);
      // Delete and create must be done manually
      allow update: if isSignedInAs(uid) && request.resource.data.role == resource.data.role;
    }

    match /tanam-documents/{documentId} {
      allow read: if hasAnyRole();
      allow write: if isPublisher();

      match /revisions/{revisionId} {
        allow read: if hasAnyRole();
        allow write: if false;
      }
    }

    function hasUserRole(role) {
      return isSignedIn() && role == request.auth.token.tanamRole;
    }

    function hasAnyRole() {
      return isSignedIn() && request.auth.token.tanamRole != null;
    }

    function isAtLeastAdmin() {
      return hasUserRole("admin");
    }

    function isPublisher() {
      return isAtLeastAdmin() || hasUserRole("publisher");
    }

    function isSignedIn() {
      return request.auth != null;
    }

    function isSignedInAs(uid) {
      return isSignedIn() && request.auth.uid == uid;
    }
  }
}