firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function isGlobalAdmin(email) {
      let adminUser = get(/databases/$(database)/documents/admins/$(email)).data;
      return 'is_global_admin' in adminUser && adminUser.is_global_admin;
    }

    function isGlobalAnalyst(email) {
      let adminUser = get(/databases/$(database)/documents/admins/$(email)).data;
      return 'is_global_analyst' in adminUser && adminUser.is_global_analyst;
    }

    function canAccessPayment(token, recipientId) {
      let recipient = get(/databases/$(database)/documents/recipients/$(recipientId)).data;
      return 'phone_number' in token && token.phone_number == ("+" + string(recipient.mobile_money_phone.phone));
    }

    match /{document=**} {
      allow read, write: if isGlobalAdmin(request.auth.token.email);
    }

    match /{document=**} {
      allow read: if isGlobalAnalyst(request.auth.token.email);
    }

    match /events/{data} {
      allow read, write: if request.auth != null;
    }

    match /events-users/{data} {
      allow read, write: if request.auth != null;
    }

    match /exchange-rates/{data} {
      allow read: if true;
    }

    match /recipients/{recipientId} {
      // Recipients mobile app access
      allow read, update: if 'phone_number' in request.auth.token && request.auth.token.phone_number == ("+" + string(resource.data.mobile_money_phone.phone))

      match /payments/{paymentId} {
          allow read, update: if canAccessPayment(request.auth.token, recipientId);
      }

      match /messages/{messageId} {
          allow read, update: if canAccessPayment(request.auth.token, recipientId);
      }

      match /surveys/{surveyId} {
        allow read, update: if request.auth.token.email == resource.data.access_email;
        allow read: if canAccessPayment(request.auth.token, recipientId);
      }
    }

    // recipients app access to organisations, for now check only if authenticated
    match /organisations/{data} {
      allow read: if request.auth != null
    }

    match /transparency-stats/{data} {
      allow read: if true;
    }

    match /users/{data=**} {
      allow read, write: if request.auth.uid == resource.data.auth_user_id;
    }

    match /users/{userId}/{data=**} {
      allow read, write: if request.auth.uid == get(/databases/$(database)/documents/users/$(userId)).data.auth_user_id;
    }

    match /users/{data=**} {
      allow read: if isGlobalAdmin(request.auth.token.email) || isGlobalAnalyst(request.auth.token.email);
      allow write: if isGlobalAdmin(request.auth.token.email);
    }

    match /world-development-indicators/{data} {
      allow read: if true;
    }
  }

  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if false;
    }
  }
}