firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
  	match /characters/{userId} {
    	allow read: if true;
      allow write, delete: if userId == request.auth.uid;
      match /{document=**} {
      	allow read: if true;
        allow update: if request.resource.data.diff(resource.data).affectedKeys().hasOnly(["campaignId", "initiativeStatus"])     
        allow write, delete: if userId == request.auth.uid
      }
    }
    match /campaigns/{document=**} {
    	allow read, write, delete: if true;
    }
    match /worlds/{worldId} {
    	allow read: if true;
      allow write: if request.auth.uid == resource.data.ownerId;
      
      function checkIsOwner() {
      	let world = get(/databases/$(database)/documents/worlds/$(worldId)).data;
        return world.ownerId == request.auth.uid;
      }
      
      match /locations/{locationId} {
     		allow read, create, update: if true;
        allow delete: if checkIsOwner();
          
        match /private/{gmNotes} {
        	allow read, write: if checkIsOwner();
        }
        match /public/{notes} {
        	allow read, create, update: if true;
          allow delete: if checkIsOwner();
        }
      }
      match /npcs/{locationId} {
        allow read, create, update: if true;
        allow delete: if checkIsOwner();
          
        match /private/{gmNotes} {
        	allow read, write: if checkIsOwner();
        }
        match /public/{notes} {
        	allow read, create, update: if true;
          allow delete: if checkIsOwner();
        }
      }
    }
    match /users/{userId} {
    	allow read: if true;
    	allow write: if userId == request.auth.uid && !request.resource.data.diff(resource.data).affectedKeys().hasAny(["isPremium"]);

      match /custom-oracles/{document=**} {
        allow read: if true;
        allow write, delete: if userId == request.auth.uid;
      }
      match /custom-moves/{document=**} {
        allow read: if true;
        allow write, delete: if userId == request.auth.uid;
      }
      match /settings/{document=**} {
      	allow read, write, delete: if userId == request.auth.uid;
      }
    }
    match /{document=**} {
      allow read, write: if false;
    }
  }
}