cloud.firestore.rules

// resource only exists when reading from DB
// request.resource only exists when writing to DB (reading from the user)

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    match /games/{game} {
      allow read: if true;
      allow create, update, delete: if isLoggedIn() && isMemberAndDocumentOwnerOrAdmin()
    }
    match /tags/{tag} {
      allow read: if true;
      allow create, update, delete: if isLoggedIn() && isMemberAndDocumentOwnerOrAdmin()
    }

    function isLoggedIn() {
      return request.auth != null;
    }

    function isDocumentOwner() {
      return getResourceData().authorUid == request.auth.uid;
    }

    function isAdmin() {
      return request.auth.token.admin == true;
    }

    function isMember() {
      return request.auth.token.member == true;
    }

    function isMemberAndDocumentOwnerOrAdmin() {
      return isAdmin() || (isMember() && isDocumentOwner());
    }

    function getResourceData() {
      return resource == null ? request.resource.data : resource.data
    }
  }
}