firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // This rule allows anyone on the internet to view, edit, and delete
    // all data in your Firestore database. It is useful for getting
    // started, but it is configured to expire after 30 days because it
    // leaves your app open to attackers. At that time, all client
    // requests to your Firestore database will be denied.
    //
    // Make sure to write security rules for your app before that time, or else
    // your app will lose access to your Firestore database
    // match /{document=**} {
    //   allow read, write: if request.time < timestamp.date(2020, 6, 9);
    // }

    match /users/{userId}/{document=**} {
      allow read, write: if request.auth.uid == userId
    }
    
    match /items/{document=**} {
      allow read: if resource.data.author == request.auth.uid || resource.data.isShared;
      allow update, delete: if resource.data.author == request.auth.uid;
      allow create: if request.resource.data.author == request.auth.uid;
    }
    
    match /quickieCategories/{category} {
    	allow read: if resource.data.author == request.auth.uid;
      allow create: if request.resource.data.author == request.auth.uid;
    }
    
    match /quickieCategories/{category}/quickies/{document=**} {
    	allow read, create: if request.auth != null && request.auth.uid == get(/databases/$(database)/documents/quickieCategories/$(category)).data.author;
    }
  }
}