firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
      allow read, write: if false;

      match /libraries/{library} {
        allow create, delete, list: if false;
        allow get;
        allow update: if library in request.auth.token.librariesJoined && (library in request.auth.token.permissions.MANAGE_LIBRARY || library in request.auth.token.librariesOwned);
      }

      match /libraries/{library}/books/{book} {
        allow get, list: if library in request.auth.token.librariesJoined;
        allow create, update: if library in request.auth.token.librariesJoined && (library in request.auth.token.permissions.MANAGE_BOOKS || library in request.auth.token.librariesOwned);
        allow delete: if false;
      }

      match /{path=**}/copies/{copy} {
        allow list: if resource.data.libraryID in request.auth.token.librariesJoined;
      }

      match /libraries/{library}/books/{book}/copies/{copy} {
        allow get: if library in request.auth.token.librariesJoined;
        allow create, update, delete: if library in request.auth.token.librariesJoined && (library in request.auth.token.permissions.MANAGE_BOOKS || library in request.auth.token.librariesOwned);
      }

      match /libraries/{library}/books/{book}/reviews/{review} {
        allow read: if library in request.auth.token.librariesJoined;
        allow delete: if library in request.auth.token.librariesJoined && (library in request.auth.token.permissions.MANAGE_BOOKS);
      }

      match /libraries/{library}/checkouts/{checkout} {
        allow get: if library in request.auth.token.librariesJoined && (request.auth.uid == resource.data.userID || library in request.auth.token.permissions.MANAGE_CHECKOUTS || library in request.auth.token.librariesOwned);
        allow list: if library in request.auth.token.librariesJoined && (library in request.auth.token.permissions.MANAGE_CHECKOUTS || library in request.auth.token.librariesOwned);
        allow update: if library in request.auth.token.librariesJoined && (library in request.auth.token.permissions.MANAGE_CHECKOUTS || library in request.auth.token.librariesOwned);
        allow create, delete: if false;
      }

      match /libraries/{library}/users/{user} {
        allow get: if request.auth.uid == user || library in request.auth.token.permissions.MANAGE_USERS || library in request.auth.token.librariesOwned;
        allow list: if library in request.auth.token.librariesJoined && (resource.data.uid == request.auth.uid || library in request.auth.token.permissions.MANAGE_USERS || library in request.auth.token.permissions.CHECK_OUT || library in request.auth.token.librariesOwned);
        allow create, delete: if false;
        allow update: if library in request.auth.token.librariesJoined && ((library in request.auth.token.permissions.MANAGE_USERS && user != request.auth.uid) || library in request.auth.token.librariesOwned);
      }

      match /libraries/{library}/joinRequests/{joinRequest} {
        allow create: if request.auth != null;
        allow delete, update: if false;
        allow get: if joinRequest == request.auth.uid || library in request.auth.token.librariesJoined && (library in request.auth.token.permissions.MANAGE_USERS || library in request.auth.token.librariesOwned);
        allow list: if library in request.auth.token.librariesJoined && (library in request.auth.token.permissions.MANAGE_USERS || library in request.auth.token.librariesOwned);
      }

      match /libraries/{library}/statistics/{statistic} {
        allow write, list: if false;
        allow get: if library in request.auth.token.librariesJoined && (library in request.auth.token.permissions.MANAGE_LIBRARY || library in request.auth.token.librariesOwned);
      }
  }
}