gistfile1.txt

function hasUserGroup() {
    return exists(/databases/$(database)/documents/user_group/$(request.auth.uid));
}

function getUserGroup() {
    return get(/databases/$(database)/documents/user_group/$(request.auth.uid));
}

function isPermittedGroupWithinSet(allowedGroups, groups) {
    return allowedGroups != null && allowedGroups.hasAny(groups);
}

function isPermittedGroup(groupID) {
    return hasUserGroup() &&
           isPermittedGroupWithinSet(getUserGroup().data.groups, [groupID]) ||
           isPermittedGroupWithinSet(getUserGroup().data.invitations, [groupID]);
}

/**
 */
function isPermittedGroups(groups) {
    return hasUserGroup() &&
           isPermittedGroupWithinSet(getUserGroup().data.groups, groups) ||
           isPermittedGroupWithinSet(getUserGroup().data.invitations, groups);
}

function existsGroup() {
    return exists(/databases/$(database)/documents/group/$(resource.data.groupID));
}

function getGroup() {
    return get(/databases/$(database)/documents/group/$(resource.data.groupID));
}


// allows us to lookup the group by group_id and see if the visibility allows
// access or if the user is already in the group as a member.

// we can read/write if the group is public
allow read: if existsGroup() && ['public', 'protected'].hasAny([getGroup().data.visibility]);

// only allow members of this group to read which documents are
// contained here. Writes are not allowed because they are implemented
// via a cloud hook.
allow read: if existsGroup() && isPermittedGroup(resource.data.groupID);

// allow write if the user is the owner by looking at their profileID.
allow write: if hasProfileID() && getProfileID() == resource.data.profileID;