firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function isOwner(res) {
      return res.data.createdBy == request.auth.uid
    }
    function isOwnerOrPublic(res) {
      return isOwner(res) || res.data.public == true
    }
    function isCollaborator(res) {
      return res.data.collaborators[request.auth.uid] == true
    }
    match /users/{userId} {
      allow read, write: if request.auth.uid == userId;
    }
    match /users_public/{userId} {
      allow read;
      allow write: if request.auth.uid == userId;
    }
    match /projects/{projectId} {
      allow create: if isOwner(request.resource);
      allow read: if isOwner(resource) || isCollaborator(resource);
      allow write: if isOwner(resource) || isCollaborator(resource);
      match /{allChildren=**} {
        allow read: if isOwner(get(/databases/$(database)/documents/projects/$(projectId)))
          || isCollaborator(get(/databases/$(database)/documents/projects/$(projectId)));
        allow write: if request.auth != null;
      }
    }
    match /actionTemplates/{templateId} {
      allow create: if isOwner(request.resource);
      allow read: if isOwnerOrPublic(resource);
      allow write: if isOwner(resource);
      match /{allChildren=**} {
        allow read: if isOwnerOrPublic(get(/databases/$(database)/documents/actionTemplates/$(templateId)));
        allow write: if isOwnerOrPublic(get(/databases/$(database)/documents/actionTemplates/$(templateId)));
      }
    }
  }
}