firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function signedIn() {
      return request.auth.uid != null;
    }

    function isMyDoc(userId) {
      return request.auth.uid == userId;
    }

    match /users/{userId} {
      allow read, update, create: if signedIn() && isMyDoc(userId);
    }

    function userDoc(uid) {
      return get(/databases/$(database)/documents/users/$(uid));
    }

    function isAdmin(user) {
      return user.data.roles.admin == true;
    }

    function isEditor(user) {
      return user.data.roles.admin == true || user.data.roles.editor == true;
    }

    match /factions/{faction} {
      allow read;

      allow create: if signedIn() && isAdmin(userDoc(request.auth.uid));

      allow update: if signedIn() && isEditor(userDoc(request.auth.uid));
    }

    match /snapshots/{snapshot} {
      allow read;

      allow create: if signedIn() && isEditor(userDoc(request.auth.uid));
    }
  }
}