firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    function isSignedIn() {
      return request.auth != null;
    }

    function isAdmin() {
      return isSignedIn()
        && exists(/databases/$(database)/documents/users/$(request.auth.uid))
        && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin';
    }

    // Users can read everyone's public profile, but only edit their own.
    // Admins can edit anything.
    match /users/{uid} {
      allow read: if isSignedIn();
      allow create: if isSignedIn() && request.auth.uid == uid
        && request.resource.data.role == 'user';
      allow update: if isSignedIn() && (
        request.auth.uid == uid
          && request.resource.data.role == resource.data.role  // can't self-promote
        || isAdmin()
      );
      allow delete: if isAdmin();
    }

    // Events: public read, admin write.
    match /events/{slug} {
      allow read: if true;
      allow write: if isAdmin();
    }

    // Leaderboard configs: public read, admin write.
    match /leaderboards/{id} {
      allow read: if true;
      allow write: if isAdmin();
    }

    // Per-user extras (bonus points etc): admin write, everyone read.
    match /userExtras/{uid} {
      allow read: if true;
      allow write: if isAdmin();
    }
  }
}