firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read: if get(/databases/$(database)/documents/permissions/$(request.auth.uid)).data.role == "reader"
                  || get(/databases/$(database)/documents/permissions/$(request.auth.uid)).data.role == "performer"
                  || get(/databases/$(database)/documents/permissions/$(request.auth.uid)).data.role == "editor";
      allow read, write: if get(/databases/$(database)/documents/permissions/$(request.auth.uid)).data.role == "admin";
    }
    match /setlists/{setlist} {
      allow create, update: if get(/databases/$(database)/documents/permissions/$(request.auth.uid)).data.role == "performer"
                            || get(/databases/$(database)/documents/permissions/$(request.auth.uid)).data.role == "editor";
      allow delete: if get(/databases/$(database)/documents/permissions/$(request.auth.uid)).data.role == "editor"
                    || get(/databases/$(database)/documents/permissions/$(request.auth.uid)).data.role == "performer" && request.auth.uid == resource.data.creator;
    }
    match /songs/{song} {
      allow write: if get(/databases/$(database)/documents/permissions/$(request.auth.uid)).data.role == "editor";
    }
    match /registrations/{user} {
      allow create: if request.auth.uid != '';
    }
    match /permissions/{user} {
      allow write: if get(/databases/$(database)/documents/permissions/$(request.auth.uid)).data.role == "admin"
                   && request.auth.uid != '' && request.auth.token.email_verified;
    }
    match /users/{user} {
      allow read, write: if request.auth.uid != '' && user == request.auth.uid && request.auth.token.email_verified;
    }
    match /config/{category} {
      allow read: if request.auth.uid != '';
    }
  }
}