firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      // users with isAdmin == true can read and write to any document 
      allow read, write: if request.auth != null && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.isAdmin == true
    }
    match /users/{user} {
      allow read, delete: if request.auth != null && request.auth.uid == user
      allow update: if request.auth != null && request.auth.uid == user
                    // users can't change their own isAdmin field
                    && !request.resource.data.diff(resource.data).affectedKeys().hasAny(['isAdmin']);                                 
      match /credentialrequests/{credreq} {
        allow read, write: if request.auth != null && request.auth.uid == user;
      }
      match /notifications/{notification} {
        // TODO: tighten this up after moving notifications to the backend
        allow read, write: if request.auth != null
      }
    }
    match /conversations/{conversation} {
      // TODO: tighten this up after moving more of the logic to the backend
      allow read, write: if request.auth != null
      match /arguments/{argument} {
        allow read, write: if request.auth != null
        match /reviews/{review} {
            allow read, write: if request.auth != null
        }
        match /ai/{cache} {
            allow read, write: if request.auth != null
        }
      }
    }
  }
}