firestore.rules

service cloud.firestore {
  match /databases/{database}/documents {
  	function canCreate() {
    	return request.resource.data.owner == request.auth.token.email;
    }
    function canCreateTask() {
    	return request.auth.token.email in request.resource.data.owner;
    }
    function canReadWriteDelete() {
    	return request.auth.token.email in resource.data.owner || request.auth.token.email == resource.data.owner;
    }
    function canOperateOnEmailIdDocs(userEmail) {
    	return request.auth.token.email == userEmail;
    }
    function getGroupMembers(group){
    	return get(/databases/$(database)/documents/samwise-groups/$(group)).data.members
    }
    match /samwise-order-manager/{userEmail} {
    	allow create, read, write, delete: if canOperateOnEmailIdDocs(userEmail)
    }
    match /samwise-settings/{userEmail} {
    	allow create, read, write, delete: if canOperateOnEmailIdDocs(userEmail)
    }
    match /samwise-banner-message/{userEmail} {
    	allow create, read, write, delete: if canOperateOnEmailIdDocs(userEmail)
    }
  	match /samwise-tags/{tag} {
    	allow create: if canCreate()
    	allow read, write, delete: if canReadWriteDelete()
    }
  	match /samwise-tasks/{task} {
    	allow create: if canCreateTask()
        || request.auth.token.email in getGroupMembers(request.resource.data.group);
    	allow read, write, delete: if canReadWriteDelete()
      	|| request.auth.token.email in getGroupMembers(resource.data.group);
    }
  	match /samwise-subtasks/{task} {
    	allow create: if canCreate()
    	allow read, write, delete: if canReadWriteDelete()
    }
    match /samwise-groups/{group} {
      allow create: if request.auth.uid != null
      allow read, write, delete: if request.auth.token.email in resource.data.members
        || request.auth.token.email in resource.data.invitees
    }
    match /samwise-users/{user} {
      allow create: if canOperateOnEmailIdDocs(user);
      allow get: if canOperateOnEmailIdDocs(user)
          || request.auth.token.email.matches('.*@cornell[.]edu');
      allow write, delete: if canOperateOnEmailIdDocs(user);
    }
  }
}