firestore.rules

rules_version = '2';
service cloud.firestore {

  match /databases/{database}/documents {

    function isPremiumSubscriber(request) {
      return 'stripeRole' in request.auth.token ? request.auth.token.stripeRole == 'premium' : false;
    }

    function getOrganization(organizationId) {
        return exists(/databases/$(database)/documents/organizations/$(organizationId)) ? get(/databases/$(database)/documents/organizations/$(organizationId)) : null;
    }

    function getRecurringMeeting(recurringMeetingId) {
        return get(/databases/$(database)/documents/recurringMeetingLinks/$(recurringMeetingId));
    }

    match /rooms/{roomId} {
      allow get: if isAccessAllowed(request);
      allow list: if request.auth.uid in resource.data.memberIds;
      allow update: if isAccessAllowed(request) && !isUpdatingSubscriptionMetadata(request, resource);
      allow delete: if false;
      allow create: if isAccessAllowed(request);

      function isUpdatingSubscriptionMetadata(request, resource) {
        return request.resource.data.diff(resource.data).affectedKeys().hasAny(['subscriptionMetadata'])
      }

      function isAccessAllowed(request) {
        let meta = hasMetadataSet() ? getAuthorizationMetadata().data : {};

        let isPasswordProtected = meta.get('passwordProtectionEnabled', false);
        let organizationOnlyProtectedId = meta.get('organizationProtection', false);

        let roomAccessValue = isPasswordProtected ? hasSavedPasswordAccessForUserId(request) ? getPasswordAccessForUserId(request) : {} : {};
        let isExpired = 'expiresAt' in roomAccessValue ? roomAccessValue.expiresAt < request.time : false;
        let isHashMatching = 'hash' in roomAccessValue ? roomAccessValue.hash == getPasswordHash() : false;
      
        return request.auth != null && (
            !isPasswordProtected || 
            (
              !isExpired &&
              isHashMatching
            )
          ) && (
            (organizationOnlyProtectedId == '' || organizationOnlyProtectedId == false || organizationOnlyProtectedId == null) || (
              request.auth.uid in getOrganization(organizationOnlyProtectedId).data.memberIds
            )
          );
      }

      function hasMetadataSet() {
        return exists(/databases/$(database)/documents/rooms/$(roomId)/metadata/authorization);
      }

      function getAuthorizationMetadata() {
        return get(/databases/$(database)/documents/rooms/$(roomId)/metadata/authorization);
      }
    
      function getRoom() {
        return get(/databases/$(database)/documents/rooms/$(roomId));
      }

      function getPasswordHash() {
        return exists(/databases/$(database)/documents/rooms/$(roomId)/metadata/passwordProtection) ? 
        get(/databases/$(database)/documents/rooms/$(roomId)/metadata/passwordProtection).data.value : '';
      }

      function hasSavedPasswordAccessForUserId(request) {
        return exists(/databases/$(database)/documents/rooms/$(roomId)/metadata/passwordProtection/accessList/$(request.auth.uid));
      }

      function getPasswordAccessForUserId(request) {
        return get(/databases/$(database)/documents/rooms/$(roomId)/metadata/passwordProtection/accessList/$(request.auth.uid)).data;
      }

      match /metadata/authorization {
        allow write: if request.auth.uid == getRoom().data.createdById;
        allow read: if true;
      }

      match /metadata/passwordProtection {
        allow write: if false;
        allow read: if isAccessAllowed(request);
      }

      match /metadata/memberStatus {
        allow write, read: if isAccessAllowed(request);
      }

      match /summaries/{summaryId} {
        allow write: if false;
        allow read: if isAccessAllowed(request);
      }

      match /reactions/{reactionId} {
        allow read, write: if isAccessAllowed(request);
      }
    }

    match /userDetails/{userId} {
      allow read, write: if request.auth.uid == userId;

      match /integrations/{integrationName} {
        allow read, write: if request.auth.uid == userId;
      }

      match /cardSets/{cardSetId} {
        allow read, write: if request.auth.uid == userId;
      }

      match /meteredUsage/{usageId} {
        allow read: if request.auth.uid == userId;
        allow write: if false;
      }
    }

    match /userPreferences/{userId} {
      allow read, write: if request.auth.uid == userId; 
    }

    match /userProfiles/{userId} {
      allow get: if true;
      allow list, update, create, delete: if false;
    }

    match /organizations/{organizationId} {
      allow read: if request.auth.uid in resource.data.memberIds;
      allow write: if request.auth.uid == request.resource.data.createdById;
      allow update: if request.auth.uid == resource.data.createdById;
                                                                                     
      match /memberInvitations/{invitationId} {
        allow read, write: if request.auth.uid in getOrganization(organizationId).data.memberIds;
      }
    }

    match /recurringMeetingLinks/{linkId} {
      allow get: if !('organizationId' in resource.data) || request.auth.uid in getOrganization(resource.data.organizationId).data.memberIds;
      allow list: if request.auth.uid == resource.data.createdById;
      allow write: if request.auth.uid == request.resource.data.createdById;
      allow update: if request.auth.uid == resource.data.createdById;

      match /createdRooms/{roomId} {
        allow read: if !('organizationId' in resource.data) || request.auth.uid in getOrganization(getRecurringMeeting(linkId).data.organizationId).data.memberIds;
        allow write: if false;
      }
    }
    
    match /invitations/{invitationId} {
      allow write: if request.auth.uid == request.resource.data.invitedBy;
      allow read: if false;
    }

    match /authSessions/{sessionId} {
      allow list, update, delete, create, get: if false;
    }

     match /feedbacks/{feedbackId} {
      allow write, read: if request.auth.uid == request.resource.data.userId;
    }

    match /customers/{uid} {
      allow read, write: if request.auth.uid == uid;

      match /checkout_sessions/{id} {
        allow read: if request.auth.uid == uid;
        allow write: if request.auth.uid == uid && (!('creditCount' in request.resource.data.metadata) || request.resource.data.metadata.creditCount > 100)
      }
      match /subscriptions/{id} {
        allow read: if request.auth.uid == uid;
      }
    }

    match /products/{id} {
      allow read: if true;

      match /prices/{id} {
        allow read: if true;
      }

      match /tax_rates/{id} {
        allow read: if true;
      }
    }
  }
}