firestore.rules

service cloud.firestore {
  match /databases/{database}/documents {
    match /items/{item} {
      allow read: if request.auth.uid != null
	    	&& request.auth.uid == resource.data.userId;
      allow update, delete: if request.auth.uid != null
      allow create: if request.auth.uid != null
    }
    match /associations/{association} {
      allow read: if request.auth.uid != null
      	&& request.auth.uid == resource.data.userId;
      allow update, delete: if request.auth.uid != null
        && request.auth.uid == resource.data.userId;
      allow create: if request.auth.uid != null
    }
    match /users/{user} {
      allow read: if request.auth.uid != null
      allow create: if request.auth.uid != null
      allow update, delete: if request.auth.uid != null
    }
    match /shares/{list} {
      function isYours() {
        return request.auth.uid != null
          && request.auth.uid == resource.data.senderId
      }
      function isTheirs() {
        return request.auth.uid != null
          && request.auth.email == resource.data.requestedEmail
      }
      allow read: if request.auth.uid != null
      allow create: if request.auth.uid != null
      allow update, delete: if isYours() || isTheirs()
    }
}