firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{user} {
      allow read: if true;
      allow write: if false;
    }

    match /boards/{board} {
      function userOwnsBoard() {
        let isAuthed = request.auth != null;
        let isOwner = request.auth.uid == get(/databases/$(database)/documents/boards/$(board)).data.owner;

        return isAuthed && isOwner;
   	 	}

      function userIsEditor() {
        let isAuthed = request.auth != null;
        let isEditor = exists(/databases/$(database)/documents/boards/$(board)/permissions/$(request.auth.uid)) && get(/databases/$(database)/documents/boards/$(board)/permissions/$(request.auth.uid)).data.role == 'editor';

        return isAuthed && isEditor;
      }

      function hasPerms() {
        return userOwnsBoard() || userIsEditor()
      }

      allow create: if request.auth != null && request.auth.uid == request.resource.data.owner;
      allow read: if request.auth != null;
      allow update, delete: if hasPerms();

      match /categories/{category} {
        allow read: if request.auth != null;
        allow write: if hasPerms();
      }

      match /questions/{question} {
        allow read, write: if hasPerms();
      }
    }
  }
}