colabor/firestore.rules at main · gracious-tech/colabor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

rules_version = '2';

service cloud.firestore {
    match /databases/{database}/documents {

        match /fundraisers/{fundraiser} {

            // Allow create if user will be one of the owners
            allow create: if request.auth.uid in request.resource.data.owners;

            // Allow read if user is one of the owners
            allow read: if request.auth.uid in resource.data.owners;

            // Util for subcollections to check if user is an owner of parent fundraiser
            function is_owner(){
                return request.auth.uid in get(/databases/$(database)/documents/fundraisers/$(fundraiser)).data.owners;
            }

            match /pledges/{pledge} {
                allow read: if is_owner();
                allow write: if is_owner();
            }

            match /contacts/{contact} {
                allow read: if is_owner();
                allow write: if is_owner();
            }

            match /payments/{payment} {
                allow read: if is_owner();
                allow write: if is_owner();
            }

            match /statements/{statement} {
                allow read: if is_owner();
                allow write: if is_owner();
            }

            match /statements/{statement}/items/{item} {
                allow read: if is_owner();
                allow write: if is_owner();
            }
        }
    }
}