firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
		match /{document=**} {
    	allow read, write: if false;
    }

    function isAuthenticated() {
      return request.auth.uid != null;
    }

    function isEmailVerified() {
      return request.auth.token.email_verified;
    }

    function matchesAuthId(userId) {
      return request.auth.uid == userId;
    }

    function isAdmin() {
    	return request.auth.uid in get(/databases/$(database)/documents/roles/admin).data.members;
    }

    match /openApis/{apiId} {
      // Everyone can read the interface descriptions
      allow get, list: if isAuthenticated();
      allow create: if isAdmin() || matchesAuthId(request.resource.data.createdBy);
      allow update, delete: if isAdmin() || matchesAuthId(resource.data.createdBy);
    }

    match /asyncApis/{apiId} {
      // Everyone can read the interface descriptions
      allow get, list: if isAuthenticated();
      allow create: if isAdmin() || matchesAuthId(request.resource.data.createdBy);
      allow update, delete: if isAdmin() || matchesAuthId(resource.data.createdBy);
    }

    match /asyncApiMappings/{mappingId} {
      // Everyone can read the mapping descriptions
      allow get, list: if isAuthenticated();
      allow create: if isAdmin() || matchesAuthId(request.resource.data.createdBy);
      allow delete: if isAdmin() || matchesAuthId(resource.data.createdBy);
    }

    match /openApiMappings/{mappingId} {
      // Everyone can read the mapping descriptions
      allow get, list: if isAuthenticated();
      allow create: if isAdmin() || matchesAuthId(request.resource.data.createdBy);
      allow delete: if isAdmin() || matchesAuthId(resource.data.createdBy);
    }

    match /attributeNodes/{attributeId} {
      // Everyone can read the mapping descriptions
      allow get, list: if isAuthenticated();
      allow create, update: if isAuthenticated();
      allow delete: if isAdmin();
    }

    match /tasks/{taskId} {
      // Everyone can read the tasks
      allow get, list: if isAuthenticated();
      allow create: if isAdmin();
      allow update, delete: if isAdmin();
    }

    match /task-reports/{reportId} {
      // Everyone can read the interface descriptions
      allow get, list, update, delete: if isAdmin();
      allow create: if isAdmin() || matchesAuthId(request.resource.data.createdBy);
    }
  }
}