firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read: if request.auth != null
    }

    match /configs/{document=**} {
      allow read;
    }

    match /profiles/{uid} {
      allow write: if
      	request.auth.uid == uid ||
      	get(/databases/$(database)/documents/profiles/$(request.auth.uid)).data.isAdmin == true
    }

    match /votes/{year}/{week}/{uid} {
      allow write: if request.auth.uid == uid
    }

    match /years/{year}/weeks/{week}/votes/{document=**} {
      allow write: if
      	/databases/$(database)/documents/profiles/$(request.auth.uid) ==
        request.resource.data.voter &&
        request.resource.data.year == int(year) &&
        request.resource.data.week == int(week)
      allow delete: if
      	/databases/$(database)/documents/profiles/$(request.auth.uid) ==
        resource.data.voter &&
        resource.data.year == int(year) &&
        resource.data.week == int(week)
    }

    match /attendances/{date}/attendances/{uid} {
      allow write: if request.auth.uid == uid
    }

    match /preferences/{uid} {
      allow write: if request.auth.uid == uid
    }

    match /configs/web {
      allow write: if get(/databases/$(database)/documents/profiles/$(request.auth.uid)).data.isAdmin == true
    }
  }
}