firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    match /permissions/{userId} {
      allow read, write: if request.auth != null && get(/databases/$(database)/documents/permissions/$(request.auth.uid)).data.isAdmin == true;
    }

    match /agendaItems/{agendaId} {
      allow read;
      allow write: if request.auth != null && get(/databases/$(database)/documents/permissions/$(request.auth.uid)).data.isAdmin == true;

      match /testimonies/{testimonyId} {
        allow read;
        allow create: if request.auth != null;
      }
    }

    // applies to collection group queries
    match /{path=**}/testimonies/{testimonyId} {
      allow read: if resource.data.userId == request.auth.uid;
    }

    match /users/{userId} {
      allow read, update: if request.auth != null && request.auth.uid == userId;
    }

  }
}