firestore.rules

rules_version = '2';

//service cloud.firestore {
//
//  match /databases/{database}/documents {
//
//    match /{document=**} {
//      allow read: if true;
//      allow write: if true;
//    }
//
//  }
//
//}

service cloud.firestore {

  match /databases/{database}/documents {

    function isAdmin() {

      return isAuthenticated() &&
             'admin' in request.auth.token &&
             request.auth.token.admin == true;

    }

    function isAuthenticated() {

      return request.auth.uid != null;

    }

    function isKnownUser() {

      return isAuthenticated() &&
             exists(/databases/$(database)/documents/users/$(request.auth.uid));

    }

    function isNonEmptyString(fieldName) {

      return request.resource.data[fieldName] is string &&
             request.resource.data[fieldName].size() > 0;

    }

    function isValidCourse() {

      return request.resource.data.seqNo is number &&
             request.resource.data.seqNo >= 0 &&
             isNonEmptyString("url");

    }

    match /courses/{courseId} {

      allow read: if isKnownUser();

      allow create, update: if isValidCourse() && isAdmin();

      allow delete: if isAdmin();

      match /lessons/{lessonId} {

        allow read: if isAuthenticated();

      }

    }

    match /{path=**}/lessons/{lessonId} {

      allow read: if isKnownUser();

    }

  }

}