firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /businesses/{document=**} {
    	allow read: if request.auth.uid != null;
      allow write: if request.auth.uid == resource.data.createdBy.uid || isAdmin();
    }
    match /events/{document=**} {
      allow read: if isAdmin();      
	    allow write: if request.auth.uid != null;
    }
    match /projects/{document=**} {
      allow read, write: if isAdmin() || isReferrer();      
    }
    match /students/{userId}/{document=**} {
      allow read: if request.auth.uid == userId || isAdmin() || isReferrer() || isBusiness();
      allow write: if request.auth.uid == userId || isAdmin();
    }
		match /users/{userId}/{document=**} {
      allow read: if request.auth.uid == userId || isAdmin();
			allow write: if request.auth.uid == userId
    }
    
    function getUserData(){
      return get(/databases/$(database)/documents/users/$(request.auth.uid)).data;
    }
    function isAdmin(){
      return getUserData().role == 'admin';
    }
    function isReferrer(){
      return getUserData().role == 'referrer';
    }
    function isStudent(){
      return getUserData().role == 'student';
    }
    function isBusiness(){
      return getUserData().role == 'business';
    }
  }
}