2018-countdown-security-firestore

firestore.rules.js

service cloud.firestore {
  match /databases/{database}/documents {
    // Generic method that checks if the email of the currently authenticated user is contained in the admin collection
  	function isAdmin() {
      return request.auth != null
      	&& get(/databases/$(database)/documents/admins/adminList).data[request.auth.token.email] == true
      	&& request.auth.token.email_verified == true;
    }

    // The admin collection is in read only for the admins
    match /admins/{document=**} {
      allow read: if isAdmin();
      allow write, delete, update: if false;
    }

    // To update a planet, you have to be the user that create it or to be an admin. Everyone logged can read the data of a planet (because there is nothing critical in it)
    match /planets/{planetId} {
      allow update, delete: if request.auth.uid == planetId
        || isAdmin();
      allow read, create: if request.auth.uid != null;
    }
  }
}