firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    function isManager() {
      return request.auth.uid != null && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.permissions.manager == true
    }

    function validateNewUser() {
      return request.resource.data.permissions.user == true && request.resource.data.permissions.manager == false
    }
    match /admin/{document=**} {
      allow read, write: if isManager()
    }
    match /pupils/{pupil} {
      allow create: if true
      allow read, write: if isManager()
    }
    match /tutors/{tutor} {
      allow create: if true
      allow read, write: if isManager()
    }
    match /lessons/{lesson} {
      allow create: if true
      allow read, write: if isManager()
    }
    match /users/{uid} {
      allow create: if request.auth.uid == uid && validateNewUser()
      allow read: if request.auth.uid == uid

      match /data/{property} {
        allow read, write: if request.auth != null
      }
    }
  }
}