firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function isAdmin() {
      return request.auth != null && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin';
    }


  	match /{document=**} {
      allow read, write: if false;
    }

    match /branches/{docId} {
      allow read, write: if isAdmin();
    }


    match /orgs/{orgId} {
      function belongsToOrg() {
        return orgId in get(/databases/$(database)/documents/users/$(request.auth.uid)).data.orgs;
      }

      allow read: if isAdmin() || belongsToOrg();
      allow write: if isAdmin();

      match /environments/{envId} {
        allow read: if isAdmin() || belongsToOrg();
        allow write: if isAdmin();


        match /services/{serviceId} {
          allow read: if isAdmin() || belongsToOrg();
          allow write: if isAdmin()

          match /deployments/{deploymentId} {
            allow read: if isAdmin() || belongsToOrg();
            allow write: if isAdmin()
          }
        }
      }
    }

    match /users/{userId} {
      allow read: if request.auth != null && request.auth.uid == userId;
    }

    match /pullRequests/{prId} {
      allow read: if isAdmin();
    }

    match /authors/{authorId} {
      allow read: if isAdmin();

      match /pullRequests/{prId} {
        allow read: if isAdmin();
      }
    }
  }
}