firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    function isAuthenticated () {
      return request.auth != null
    }

    function isGuildOwner () {
      return isAuthenticated() && resource.data.ownerUid == request.auth.uid
    }

    function isAdmin () {
      return isAuthenticated() && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.admin == true
    }

    match /guilds/{guild} {
      allow create: if isAdmin();
      allow read;
      allow update: if isGuildOwner() || isAdmin();
      allow delete: if isAdmin();

      function isRedirectOwner () {
        return isAuthenticated() && get(/databases/$(database)/documents/guilds/$(guild)).data.ownerUid == request.auth.uid
      }

      match /redirects/{redirect} {
        allow read: if isRedirectOwner();
      }
    }
    
    match /{somePath=**}/redirects/{redirect} {
    	allow read: if isAdmin();
    }

    match /users/{userId} {
      allow read: if isAuthenticated() && request.auth.uid == userId;
    }
  }
}