firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    match /{document=**} {
      match /posts/{postId} {
      	allow read;
      }
    }

    match /calls/{document=**} { //webRTC calls
      allow read, write: if true;
    }
    match /users/{userId} {
      allow read;
      allow create: if 
      debug(
        isValidUser(debug(userId)));
    }
    match /usernames/{username} {
      allow read: if request.auth != null;
      allow create: if isValidUsername(username);
    }
    match /users/{userId}/posts/{postId} {
      allow read;
      allow create: if canCreatePost(userId); 
      allow update: if canUpdatePost(userId);
      allow delete: if request.auth.uid == userId;
    }
    function canCreatePost(userId) {
      let isOwnerOrAdmin = request.auth.uid == userId || isAdmin();
      let username = get(/databases/$(database)/documents/users/$(request.auth.uid)).data.username;
      return isOwnerOrAdmin && isValidContent;
    }
    function canUpdatePost(userId) {
      let isOwnerOrAdmin = request.auth.uid == userId || isAdmin();
      let doesNotUpdateForbidden = !request.resource.data.diff(resource.data).affectedKeys().hasAny(['uid', 'username']);
      return isOwnerOrAdmin && doesNotUpdateForbidden;
    }
    function isAdmin() {
      let adminUsernames = ["calvin"];
      let username = get(/databases/$(database)/documents/users/$(request.auth.uid)).data.username;
      return adminUsernames.hasAny([username]);
    }
    function isValidUser(userId) {
      let isOwner = request.auth.uid == userId;
      let username = request.resource.data.username;
      let createdValidUsername = existsAfter(/databases/$(database)/documents/usernames/$(username));
      
      return isOwner && createdValidUsername;
    }
    function isValidUsername(username) {
      let isOwner = request.auth.uid == request.resource.data.uid;
      let isValidLength = username.size() >= 3 && username.size() <= 15;
      let isValidUserDoc = getAfter(/databases/$(database)/documents/users/$(request.auth.uid)).data.username == username;
      
      return isOwner && isValidLength && isValidUserDoc;     
    }
    
  }
  
}