firestore.rule

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
  
    function haveRole(role) {
      return get(/databases/$(database)/documents/users/$(request.auth.uid)).data.roles[role] == true
    }

    function isAuthorized() {
      return request.auth.uid != null
    }
  
    function isOwner() {
      return request.auth.uid == resource.data.createdBy.userId
    }
  
    match /unit/{doc} {
    	allow read;
      allow write: if false;
    }  

    match /material/{doc} {
    	allow read;
      allow write: if isAuthorized();
          //subcollection 
          match /revisions/{revisionId} {
            allow read;
            allow write: if isAuthorized();
        }
    }

    match /materialTr/{doc} {
    	allow read;
      allow write: if isAuthorized();
          //subcollection 
          match /revisions/{revisionId} {
            allow read;
            allow write: if isAuthorized();
        }
    }

    match /lastEvents/{doc} {
    	allow read;
    	allow write: if isAuthorized();
    }
    
   match /user/{userId} {
      allow create: if isAuthorized();
      allow read, update: if request.auth.uid == userId; 
    }
  }
}