firestore.rules

rules_version = '2';
service cloud.firestore {

  match /databases/{database}/documents {

    function signedIn() {
      return request != null && request.auth != null && request.auth.uid != null;
    }

    match /games/{gameId} {

      allow read: if true;
      allow create: if signedIn()
      allow update, delete: if signedIn() && request.auth.uid in resource.data.hosts;

      match /messages/{messagesId} {
        allow read: if true;
        allow write: if signedIn();
      }

      match /players/{playerId} {
        allow read: if true;
        allow write: if request.auth.uid == playerId;
      }

    }

    match /quizzes/{quizId} {

      function isHost() {
        return signedIn() && request.auth.uid in get(/databases/$(database)/documents/games/$(quizId)).data.hosts
      }

      allow read: if signedIn();
      allow write: if isHost();

      match /rounds/{roundId} {

        allow read: if signedIn();
        allow write: if isHost();

        match /results/{resultId} {
          allow read: if signedIn();
        }

        match /questions/{questionId} {
          allow read: if signedIn();
          allow write: if isHost();

          match /choices/{choiceId} {
            allow read: if isHost();
            allow write: if isHost();
          }

          match /answers/{answerId} {
            allow read: if signedIn();
            allow write: if signedIn();
          }

        }

      }

    }

    match /users/{userId} {
      allow read: if true;
      allow write: if request.auth.uid == userId;
    }

  }

}