firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    match /games/{token} {
      allow get: if true
      allow list: if authenticated()
      allow update, delete: if isGameMaster(token)
      allow create: if request.auth.uid == request.resource.data.master.uid
    }

    match /games/{token}/players/{pid} {
      allow get, create, update, delete: if true
      allow list: if isGameMaster(token)
    }
    
    match /players/{playerId} {
      allow create, read: if true
    }

    match /config/{config=**} {
      allow read: if true
    }

    function isGameMaster(token) {
      return request.auth.uid == get(/databases/$(database)/documents/games/$(token)).data.master.uid
    }

    function authenticated() {
      return request.auth != null
    }

    function matchUid(uid) {
      return authenticated() && request.auth.uid == uid
    }

    match /users/{uid} {
      allow create: if matchUid(uid)

      match /messages/{mid} {
        allow create: if authenticated() && request.resource.data.sender == request.auth.uid
      }
    }
  }
}