De Altruists Admin

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // Authorised admins only
    function isAdmin() {
      return request.auth != null && request.auth.token.email in [
        '[email protected]',
        '[email protected]',
        '[email protected]'
      ];
    }

    // Any signed-in user
    function isSignedIn() {
      return request.auth != null;
    }

    // ANNOUNCEMENTS: public read, admin write
    match /announcements/{id} {
      allow read: if true;
      allow create, update, delete: if isAdmin();
    }

    // VIDEOS: public read, admin write
    match /videos/{id} {
      allow read: if true;
      allow create, update, delete: if isAdmin();
    }

    // BLOG POSTS: public read, admin write
    match /blogposts/{id} {
      allow read: if true;
      allow create, update, delete: if isAdmin();
    }

    // REVIEWS: approved ones are public, anyone can submit
    match /reviews/{id} {
      allow read: if resource.data.approved == true || isAdmin();
      allow create: if isSignedIn()
        && request.resource.data.approved == false
        && request.resource.data.stars >= 1
        && request.resource.data.stars <= 5
        && request.resource.data.text.size() <= 1000;
      allow update, delete: if isAdmin();
    }

    // COMMENTS: approved ones are public, anyone can submit
    match /comments/{id} {
      allow read: if resource.data.approved == true || isAdmin();
      allow create: if request.resource.data.approved == false
        && request.resource.data.message.size() <= 2000;
      allow update, delete: if isAdmin();
    }

    // ENQUIRIES: private — admin only
    match /enquiries/{id} {
      allow read, update, delete: if isAdmin();
      allow create: if request.resource.data.details.size() <= 3000;
    }

    // Deny everything else
    match /{document=**} {
      allow read, write: if false;
    }
  }
}