firestore.rules

service cloud.firestore {
  match /databases/{database}/documents {
    match /tanam/{siteId} {
      allow read: if hasAnyRole();
      allow write: if isAtLeastAdmin();

      match /document-types/{typeId} {
        allow read: if hasAnyRole();
        allow write: if isAtLeastAdmin();
      }

      match /documents/{documentId} {
        allow read: if hasAnyRole();
        allow write: if isAtLeastAdmin();

        match /revisions/{revisionId} {
          allow read: if hasAnyRole();
          allow write: if false;
        }
      }

      match /files/{fileId} {
        allow read: if hasAnyRole();
        allow write: if isPublisher();
      }

			match /notifications/{notificationId} {
        allow read: if isAtLeastAdmin();
        allow write: if isAtLeastAdmin();
      }

      match /themes/{document=**} {
        allow read: if hasAnyRole();
        allow write: if isAtLeastAdmin();
      }

      match /users/{document=**} {
        allow read, write: if isAtLeastAdmin();
      }

       match /user-roles/{document=**} {
        allow read, write: if isAtLeastAdmin();
      }

      match /users/{userId} {
        allow read: if isSignedInAs(userId);
        allow write: if isSignedInAs(userId);
      }

      function hasUserRole(role) {
        return isSignedIn() && role in request.auth.token.tanam[siteId];
      }

      function hasAnyRole() {
        return isSignedIn() && request.auth.token.tanam[siteId].size() > 0;
      }

			function isSuperAdmin() {
        return hasUserRole("superAdmin");
      }

      function isAtLeastAdmin() {
        return isSuperAdmin() || hasUserRole("admin");
      }

      function isPublisher() {
        return isAtLeastAdmin() || hasUserRole("publisher");
      }
    }

    function isSignedIn() {
      return request.auth != null;
    }

    function isSignedInAs(uid) {
      return isSignedIn() && request.auth.uid == uid;
    }
  }
}