firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read: if request.auth != null
      	&& request.auth.token.admin == true;
    }

    match /posts/{post} {
      allow read;
      allow write: if request.auth != null
        && request.auth.token.admin == true
        && request.resource.data.keys().hasOnly(['content', 'date', 'imageUrl', 'title'])
        && request.resource.data.content is string
        && request.resource.data.date is timestamp
        && request.resource.data.imageUrl is string
        && request.resource.data.title is string;
      allow delete: if request.auth != null
      	&& request.auth.token.admin == true;
    }

    match /residents/{resident} {
      allow read: if request.auth != null
          && (request.auth.token.psy == true || request.auth.uid == resource.data.accountID);
      allow create, update: if request.auth != null
        && request.auth.token.admin == true
        && request.resource.data.keys().hasOnly(['accountID', 'birthDate', 'firstName', 'gender', 'isVisible', 'lastName'])
        && request.resource.data.accountID is string
        && request.resource.data.birthDate is timestamp
        && request.resource.data.firstName is string
        && request.resource.data.gender is string
        && request.resource.data.isVisible is bool
        && request.resource.data.lastName is string;

      match /reports/{report} {
        allow read: if request.auth != null && request.auth.token.psy == true;
        allow read: if request.auth != null
        	&& get(/databases/$(database)/documents/residents/$(resident)).data.accountID == request.auth.uid;
        allow create: if request.auth != null
          && (request.auth.token.admin == true || request.auth.token.psy == true)
          && request.resource.data.keys().hasOnly(['angry', 'comments', 'date', 'health', 'lonely', 'mood',  'rested', 'sad', 'wellFed'])
          && request.resource.data.angry is bool
          && request.resource.data.comments is string
          && request.resource.data.date is timestamp
          && request.resource.data.health is int
          && request.resource.data.health >= 1
          && request.resource.data.health <= 5
          && request.resource.data.lonely is bool
          && request.resource.data.mood is int
          && request.resource.data.mood >= 1
          && request.resource.data.mood <= 5
          && request.resource.data.rested is bool
          && request.resource.data.sad is bool
          && request.resource.data.wellFed is bool;
      }
    }

    match /stats/{statistic} {
      allow write: if request.auth != null
        && (request.auth.token.admin == true || request.auth.token.psy == true);
    }
  }
}