firestore.rules

rules_version = '2';

service cloud.firestore {
	match /databases/{database}/documents {

		function checkTeam(data,auth,eventID) {
			let valid = auth != null && data != null && data.lead == auth.uid &&
				data.name.matches("^[a-zA-Z0-9]+$") && data.repo.matches("^https://github.com/[^/]+/[^/]+$");

			return valid &&
				!exists(/databases/$(database)/documents/users/$(auth.uid)/teams/$(eventID));
		}

		match /users/{doc} {
			allow write: if request.auth.uid == doc &&
				(!("uid" in request.resource.data) || request.resource.data.uid == resource.data.uid);
			allow read: if true;
		}
    	match /users/{doc}/teams/{event} {
    		allow read: if true;
    		allow write: if request.auth.uid == doc
    	}

		match /events/{eventID} {
			allow read: if true;

			match /teams/{teamID} {
				allow read: if true;
				allow write: if checkTeam(request.resource.data, request.auth,eventID);
			}
		}

		match /{doc=**} {
			allow read, write: if request.auth != null &&
			request.auth.token != null &&
			request.auth.token.admin;
		}
	}
}