firestore.rules

rules_version = '2';
service cloud.firestore {
  function write() {
    return request.auth.token.role == 'write'
  }

  function read() {
    return request.auth.token.role == 'read'
  }

  function readOrWrite() {
    return write() || read()
  }

  match /databases/{database}/documents {

    match /settings/{setting} {
      allow read: if true;
      allow write: if write();
    }

    match /settings/templates/{document=**} {
      allow read: if readOrWrite();
      allow write: if write();
    }

    match /settings/template-data/{document=**} {
      allow read: if readOrWrite();
      allow write: if write();
    }

    match /products-en/{product=**} {
  	  allow read: if readOrWrite() || resource.data.active == true;
  	  allow write: if write();
    }

    match /categories-en/{category=**} {
      allow read: if true;
      allow write: if write();
    }

    match /discounts-en/{discount=**} {
      allow get: if true;
      allow list: if readOrWrite();
      allow write: if write();
    }

    match /sales-en/{sale=**} {
      allow get: if true;
      allow list: if readOrWrite();
      allow write: if write();
    }

    match /gift-cards/{document=**} {
  	  allow read: if readOrWrite();
  	  allow write: if write();
    }

    match /gift-cards-instances/{document=**} {
  	  allow read: if readOrWrite();
  	  allow write: if write();
    }

    match /reviews/{document=**} {
  	  allow read: if readOrWrite();
  	  allow write: if write();
    }

    match /orders/{order} {
      allow read: if readOrWrite() || resource.data.customerId == request.auth.uid;
      allow write: if write() || resource.data.customerId == request.auth.uid;
    }

    match /customers/{customer=**} {
      allow read: if readOrWrite() || resource.id == request.auth.uid;
      allow create: if write() || request.resource.id == request.auth.uid;
      allow read, list, update, delete: if write() || resource.id == request.auth.uid;
    }

    // match /reviews/{review} {
    //   allow read: if true;
    //   allow write, delete: if resource.data.customerId == request.auth.uid;
    // }
  }
}