firestore.rules

rules_version = '2';

// To pick the right project: `firebase projects:list`, then `firebase use <project-name>`
// To deploy: `firebase deploy --only firestore:rules`
service cloud.firestore {
  match /databases/{database}/documents {

    function isAdmin() {
      return request.auth.token.email in [
        'akrolsmir@gmail.com',
        'jahooma@gmail.com',
        'taowell@gmail.com',
        'abc.sinclair@gmail.com',
        'manticmarkets@gmail.com',
        'iansphilips@gmail.com',
        'd4vidchee@gmail.com',
        'ingawei@gmail.com',
        'marshall@pol.rs',
        'politics@manifold.markets',
        'ai@manifold.markets'
      ]
    }

    match /private-users/{userId} {
      allow read: if userId == request.auth.uid || isAdmin();
      allow update: if (userId == request.auth.uid || isAdmin())
                       && request.resource.data.diff(resource.data).affectedKeys()
                         .hasOnly(['email', 'apiKey', 'notificationPreferences', 'twitchInfo', 'pushToken', 'rejectedPushNotificationsOn', 'blockedUserIds', 'blockedContractIds', 'blockedGroupSlugs','interestedInPushNotifications', 'hasSeenAppBannerInNotificationsOn', 'installedAppPlatforms','lastPromptedToEnablePushNotifications', 'paymentInfo']);
      // Symmetric block rules
      allow update: if (request.auth != null || isAdmin())
                       && request.resource.data.diff(resource.data).affectedKeys()
                         .hasOnly(['blockedByUserIds'])
                       && request.resource.data.blockedByUserIds.toSet().difference(resource.data.blockedByUserIds.toSet()).hasOnly([request.auth.uid]);

      allow delete: if (userId == request.auth.uid || isAdmin());
    }

    match /contracts/{contractId} {
      allow read: if isAdmin()
      // allow read if contract is not private
      allow read: if resource.data.visibility!='private';                                              
      allow update: if request.resource.data.diff(resource.data).affectedKeys()
                                                                 .hasOnly(['description', 'question', 'coverImageUrl'])
                       && resource.data.creatorId == request.auth.uid;
      allow update: if isAdmin();
      allow delete: if request.resource.data.creatorId == request.auth.uid || isAdmin();
    }

    match /refresh-all-clients/{id} {
      allow read;
    }
  }
}