firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Matches any document in the 'tasks' collection or subcollections.
    match /tasks/{userId}/{document=**} {
      //allow read, write
      allow read, write: if request.auth.uid == userId;
    }

    match /adHocDocs/{document=**} {
      allow read: if request.auth.uid != null;
    }

    match /orgs/{org} {
      //allow read, write
      allow create: if request.auth.uid != null;
      allow read, update: if request.auth.uid in resource.data.users;
      allow delete: if request.auth.uid in resource.data.superAdmins;
    }

    // Match any document in the 'models' collection or subcollections
    match /models/{model}/{document=**} {
      allow create: if request.auth.uid != null;
      allow read, update: if request.auth.uid in resource.data.editors.users;
      allow delete: if request.auth.uid in resource.data.owners.users;
      allow read: if resource.data.isPublic == true;
    
      // Match any document in a model's nodes collection
      match /nodes/{node} {
        allow read, write: if request.auth.uid in get(/databases/$(database)/documents/models/$(model)).data.editors.users;
      }
    }

    match /actions/{action}  {
      //allow read, write if user is in action's org
      allow write: if userInOrg(request.resource.data.orgId);
      allow read, write: if userInOrg(resource.data.orgId);
    }

    match /users/{userId} {
      allow update, delete: if request.auth.uid == userId;
      allow read, create: if request.auth.uid != null;
    }

    match /chats/{chatId} {
      allow create: if userInOrg(request.resource.data.orgId);
      allow read, update;
      allow update, read: if resource.data.membersOnly == false && userInOrg(resource.data.orgId);
      allow update, read: if request.auth.uid in get(/databases/$(database)/documents/chats/$(chatId)).data.members;
    }

    function userInOrg(orgId) {
      return request.auth.uid in get(/databases/$(database)/documents/orgs/$(orgId)).data.users;
    }

  }
}