firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    match /{document=**} {
      allow read, write: if isStriveAdmin(userId());
    }

    match /striveAdmin/{userId} {
      allow read: if isOwner(userId);
      allow write: if false;
    }

    function isStriveAdmin(userId) {
      return exists(/databases/$(database)/documents/striveAdmin/$(userId));
    }

    match /meta/version {
      allow read;
    }

    // collectionGroup query security rules
    match /{path=**}/{collection}/{doc} {
      allow read: if collection == "GStakeholders"
      allow read: if collection == "Spectators"
      allow read: if collection == "Supports"
    }

    match /miscellaneous/aggregation {
      allow read;
    }

    match /Users/{uid} {
      allow read;
      allow write: if isOwner(uid);

      match /Notifications/{notificationId} {
        allow read: if isOwner(uid)
        allow write: if isOwner(uid)
      }

      match /Spectators/{spectatorId} {
        allow read;
        allow create: if isSignedIn()
        allow write: if isOwner(spectatorId)
      }

      match /Exercises/{exerciseId} {
        allow read;
        allow write: if isOwner(uid)

        match /Entries/{entryId} {
          allow read: if isOwner(uid);
          allow write: if isOwner(uid);
        }
      }

      match /Personal/{userId} {
        allow get: if isOwner(uid)
        allow create: if isOwner(uid)
        allow update: if isOwner(uid) && isOnlyUpdatingAllowedPersonalFields()
      }

      function isOnlyUpdatingAllowedPersonalFields() {
        // Only "fcmTokens" can be updated.
        return isSignedIn()
          && isNotUpdatingId('uid', existingData().uid);
      }
    }

    // ===== GOALS ====
    match /Goals/{goalId} {

      allow read;
      allow create: if isSignedIn()
      allow update: if userIsGoalAdmin(goalId) || userIsGoalAchiever(goalId)
      allow delete: if userIsGoalAdmin(goalId)

      match /GStakeholders/{uid} {
        allow read;
        allow write: if userIsGoalAdmin(goalId) || isOwner(uid)

        match /Reminders/{id} {
          allow read: if isOwner(uid);
          allow write: if isOwner(uid);
        }
      }

      match /Milestones/{milestoneId} {
        allow read;
        allow write: if userIsGoalAdmin(goalId) || userIsGoalAchiever(goalId)
      }

      match /Story/{itemId} {
        allow read;
      }

      match /Posts/{postId} {
        allow read;
        allow create: if userIsGoalAdmin(goalId) || userIsGoalAchiever(goalId)
        allow update: if userIsGoalAdmin(goalId) || userIsGoalAchiever(goalId)
        allow delete: if userIsGoalAdmin(goalId) || userIsGoalAchiever(goalId)
      }

      match /Media/{mediaId} {
        allow read;
        allow create: if userIsGoalAdmin(goalId) || userIsGoalAchiever(goalId)
        allow update: if userIsGoalAdmin(goalId) || userIsGoalAchiever(goalId)
        allow delete: if userIsGoalAdmin(goalId) || userIsGoalAchiever(goalId)
      }

      match /Supports/{supportId} {
        allow read;
        allow create: if isSignedIn()
        allow update: if isSupporterOrRecipient(goalId, supportId)
        allow delete: if isSupporter(goalId, supportId)
      }

      match /InviteTokens/{tokenId} {
        allow read;
        allow create: if userIsGoalAdmin(goalId)
      }

      match /Comments/{commentId} {
        allow read;
        allow write: if isSignedIn();
      }

      match /ChatGPT/{messageId} {
        allow read;
        allow write: if isSignedIn();
      }
    }

    // ===== GOAL EVENTS ====
    match /GoalEvents/{eventId} {
      allow read;
    }

    // ===== INTEGRATIONS ====
    match /Strava/{stravaId} {
      allow read;
      allow update: if isIntegrationOwner(stravaId);
    }


    // FUNCTIONS
    function isSignedIn() {
      return request.auth != null;
    }

    function userId() {
      return request.auth.uid;
    }

    function isOwner(userId) {
      return request.auth.uid == userId;
    }

    function isIntegrationOwner(stravaId) {
      return getStravaIntegration(stravaId).userId == request.auth.uid
    }

    function existingData() {
      return resource.data;
    }

    function incomingData() {
      return request.resource.data;
    }

    function userIsGoalAdmin(goalId) {
      return getGoalStakeholder(goalId).isAdmin == true;
    }

    function userIsGoalAchiever(goalId) {
      return getGoalStakeholder(goalId).isAchiever == true;
    }

    function getStravaIntegration(stravaId) {
      return get(/databases/$(database)/documents/Strava/$(stravaId)).data
    }

    function getGoalStakeholder(goalId) {
      return get(/databases/$(database)/documents/Goals/$(goalId)/GStakeholders/$(request.auth.uid)).data
    }

    function isSupporter(goalId, supportId) {
      return getSupport(goalId, supportId).supporterId == request.auth.uid
    }

    function isSupporterOrRecipient(goalId, supportId) {
      return (getSupport(goalId, supportId).supporterId == request.auth.uid || getSupport(goalId, supportId).recipientId == request.auth.uid)
    }

    function getSupport(goalId, supportId) {
      return get(/databases/$(database)/documents/Goals/$(goalId)/Supports/$(supportId)).data
    }

    // We check that the field is not sent or if field sent is equal to actual
    function isNotUpdatingField(fieldName) {
      return ( !incomingData().keys().hasAll([fieldName]) || incomingData()[fieldName] == existingData()[fieldName] );
    }

    // Checks that the user is not trying to change document id
    function isNotUpdatingId(fieldName, value) {
			return ( !incomingData().keys().hasAll([fieldName]) ||  incomingData()[fieldName] == value );
    }

  }
}