firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
  	match /characters/{characterId} {
    	allow read: if true;
      allow create: if request.auth.uid != null;
	    allow write, delete: if request.auth.uid == resource.data.uid;
  	  allow update: if request.resource.data.diff(resource.data).affectedKeys().hasOnly(["campaignId", "worldId", "initiativeStatus"])     

      function checkIsOwner() {
      	let character = get(/databases/$(database)/documents/characters/$(characterId)).data;
        return character.uid == request.auth.uid;
      }
      
      match /tracks/{document=**} {
      	allow read: if true;
        allow update: if request.auth.uid != null;
        allow delete, create: if checkIsOwner();
      }
      match /{document=**} {
      	allow read: if true;
        allow write, delete: if checkIsOwner();
      }
    }
    match /campaigns/{campaignId} {
    	allow read, write, delete: if request.auth.uid != null;
        
    	match /{document=**} {
    		allow read, write, delete: if request.auth.uid != null;
      }
      
      match /game-log/{document=**} {
      	allow read: if true;
      }
    }
    match /worlds/{worldId} {
    	allow read: if true;
      allow create: if request.auth.uid != null;
      allow write: if request.auth.uid in resource.data.ownerIds;
      allow update: if request.resource.data.diff(resource.data).affectedKeys().hasOnly(["ownerIds", "campaignGuides"])     

      function checkIsOwner() {
      	let world = get(/databases/$(database)/documents/worlds/$(worldId)).data;
        return request.auth.uid in world.ownerIds || request.auth.uid in world.campaignGuides;
      }
      
      match /locations/{locationId} {
     		allow read, create, update: if true;
        allow delete: if checkIsOwner();
          
        match /private/{gmNotes} {
        	allow read, write: if checkIsOwner();
        }
        match /public/{notes} {
        	allow read, create, update: if true;
          allow delete: if checkIsOwner();
        }
      }
      match /lore/{loreId} {
     		allow read, create, update: if true;
        allow delete: if checkIsOwner();
          
        match /private/{gmNotes} {
        	allow read, write: if checkIsOwner();
        }
        match /public/{notes} {
        	allow read, create, update: if true;
          allow delete: if checkIsOwner();
        }
      }
      match /npcs/{locationId} {
        allow read, create, update: if true;
        allow delete: if checkIsOwner();
          
        match /private/{gmNotes} {
        	allow read, write: if checkIsOwner();
        }
        match /public/{notes} {
        	allow read, create, update: if true;
          allow delete: if checkIsOwner();
        }
      }
      match /sectors/{sectorId} {
     		allow read, create, update: if request.auth.uid != null;
        allow delete: if checkIsOwner();
          match /public/notes {
          	allow read, write: if request.auth.uid != null;
          }
          match /private/notes {
          	allow read, write: if checkIsOwner();
          }
        
        match /locations/{locationId} {
     			allow read, create, update: if request.auth.uid != null;
        	allow delete: if checkIsOwner();
          match /public/notes {
          	allow read, write: if request.auth.uid != null;
          }
          match /private/notes {
          	allow read, write: if checkIsOwner();
          }
        }
      }
    }
    match /homebrew/homebrew {
      function checkIsHomebrewOwner(homebrewId) {
        let homebrew = get(/databases/$(database)/documents/homebrew/homebrew/collections/$(homebrewId)).data;
        return request.auth.uid in homebrew.editors;
      }

      match /collections/{homebrewId} {
        allow read: if true;
        allow create: if request.auth.uid != null;
        allow update: if (request.auth.uid in resource.data.editors && !request.resource.data.diff(resource.data).affectedKeys().hasAny(["creator", "editors"])) || (request.auth.uid != null && request.resource.data.diff(resource.data).affectedKeys().hasOnly(["viewers"]));
				allow delete: if (request.auth.uid == resource.data.creator);
      }

      match /stats/{statId} {
        allow read: if true;
        allow create: if request.auth.uid != null;
        allow write: if checkIsHomebrewOwner(resource.data.collectionId);
      }

      match /condition_meters/{conditionMeterId} {
        allow read: if true;
        allow create: if request.auth.uid != null;
        allow write: if checkIsHomebrewOwner(resource.data.collectionId);
      }

      match /non_linear_meters/{meterId} {
        allow read: if true;
        allow create: if request.auth.uid != null;
        allow write: if checkIsHomebrewOwner(resource.data.collectionId);
      }

      match /impacts/{impactCategoryId} {
        allow read: if true;
        allow create: if request.auth.uid != null;
        allow write: if checkIsHomebrewOwner(resource.data.collectionId);
      }

      match /legacy_tracks/{legacyTrackId} {
        allow read: if true;
        allow create: if request.auth.uid != null;
        allow write: if checkIsHomebrewOwner(resource.data.collectionId);
      }

      match /oracle_tables/{oracleTableId} {
        allow read: if true;
        allow create: if request.auth.uid != null;
        allow write: if checkIsHomebrewOwner(resource.data.collectionId);
      }

      match /oracle_collections/{oracleCollectionId} {
        allow read: if true;
        allow create: if request.auth.uid != null;
        allow write: if checkIsHomebrewOwner(resource.data.collectionId);
      }

      match /move_categories/{moveCategoryId} {
        allow read: if true;
        allow create: if request.auth.uid != null;
        allow write: if checkIsHomebrewOwner(resource.data.collectionId);
      }

      match /moves/{moveId} {
        allow read: if true;
        allow create: if request.auth.uid != null;
        allow write: if checkIsHomebrewOwner(resource.data.collectionId);
      }

      match /asset_collections/{assetCollectionId} {
        allow read: if true;
        allow create: if request.auth.uid != null;
        allow write: if checkIsHomebrewOwner(resource.data.collectionId);
      }

      match /assets/{assetId} {
        allow read: if true;
        allow create: if request.auth.uid != null;
        allow write: if checkIsHomebrewOwner(resource.data.collectionId);
      }
      match /editorInviteKeys/{inviteKeyId} {
        allow read, write: if false;
      }
    }
    match /users/{userId} {
    	allow read: if true;
    	allow write: if userId == request.auth.uid;

      match /custom-oracles/{document=**} {
        allow read: if true;
        allow write, delete: if userId == request.auth.uid;
      }
      match /custom-moves/{document=**} {
        allow read: if true;
        allow write, delete: if userId == request.auth.uid;
      }
      match /settings/{document=**} {
      	allow read, write, delete: if userId == request.auth.uid;
      }
    }
    match /{document=**} {
      allow read, write: if false;
    }
  }
}