firestore.rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    // Users can only read/write their own document
    match /users/{userId} {
      allow read, write: if request.auth.uid == userId;
    }

    // A user can create a corps if they don't have one, and can read/update if they are a member.
    match /corps/{corpsId} {
      allow read, update, delete: if get(/databases/$(database)/documents/users/$(request.auth.uid)).data.corpsId == corpsId;
      allow create: if !exists(/databases/$(database)/documents/users/$(request.auth.uid)) || get(/databases/$(database)/documents/users/$(request.auth.uid)).data.corpsId == null;
    }
    
    // A user can only read/delete their own invite.
    // Only an existing member of a corps can create an invite.
    match /invites/{email} {
      allow read: if request.auth.token.email == email;
      allow create: if get(/databases/$(database)/documents/users/$(request.auth.uid)).data.corpsId != null;
      allow delete: if request.auth.token.email == email;
    }
  }
}