firestore.rules

service cloud.firestore {
  match /databases/{database}/documents {
    // Make sure the uid of the requesting user matches name of the user
    // document. The wildcard expression {userId} makes the userId variable
    // available in rules.
    match /users/{userID} {

     function isCoach() {
       return exists(/databases/$(database)/documents/coaches/$(request.auth.uid)/athletes/$(userID)) && get(/databases/$(database)/documents/coaches/$(request.auth.uid)/athletes/$(userID)).data.accepted == true;
      }

      allow read: if resource.data.privacy == 'public';
      allow read: if isCoach() == true;
      allow read, write: if request.auth.uid == userID;
      allow create: if request.auth.uid != null;

        match /events/{eventID} {
          allow read: if resource.data.privacy == 'public';
          allow read: if isCoach() == true;
          allow read, write: if request.auth.uid == userID;
          function eventData() {
            return get(/databases/$(database)/documents/users/$(userID)/events/$(eventID)).data
          }

          match /activities/{activityID} {
            allow read: if eventData().privacy == 'public'
            allow read: if isCoach() == true;
            allow read, write: if request.auth.uid == userID;
            match /streams/{streamID} {
              allow read: if eventData().privacy == 'public'
              allow read: if isCoach() == true;
              allow read, write: if request.auth.uid == userID;
            }
          }

          match /metaData/{document=**} {
            allow read: if request.auth.uid == userID;
          }
        }


        match /meta/{document=**} {
          allow read: if request.auth.uid == userID;
        }
    }


    match /suuntoAppAccessTokens/{userID} {
      allow read, write: if request.auth.uid == userID && request.auth.token.firebase.sign_in_provider != 'anonymous';
       match /tokens/{document=**} {
          allow read, write: if request.auth.uid == userID && request.auth.token.firebase.sign_in_provider != 'anonymous';
       }
    }

    match /COROSAPIAccessTokens/{userID} {
      allow read, write: if request.auth.uid == userID && request.auth.token.firebase.sign_in_provider != 'anonymous';
       match /tokens/{document=**} {
          allow read, write: if request.auth.uid == userID && request.auth.token.firebase.sign_in_provider != 'anonymous';
       }
    }

    match /garminHealthAPITokens/{userID} {
      allow read, write: if request.auth.uid == userID && request.auth.token.firebase.sign_in_provider != 'anonymous';
    }

    match /garminHealthAPIActivityQueue/{userID} {
      allow read, write: if false;
    }

    match /COROSAPIWorkoutQueue/{userID} {
      allow read, write: if false;
    }

    match /COROSAPIHistoryImportWorkoutQueue/{userID} {
      allow read, write: if false;
    }

    match /suuntoAppWorkoutQueue/{userID} {
       allow read, write: if false;
    }

    match /suuntoAppHistoryImportActivityQueue/{userID} {
         allow read, write: if false;
    }


    // @todo perhaps restrict to user ID
    match /userAccountPrivileges/{document=**} {
      allow write: if false;
      allow read: if true;
    }


    match /coaches/{userID} {
      allow read, write: if request.auth.uid == userID && request.auth.token.firebase.sign_in_provider != 'anonymous';
       match /athletes/{athleteUserID} {
          allow read,delete: if request.auth.uid == userID && request.auth.token.firebase.sign_in_provider != 'anonymous';
          allow read, write: if request.auth.uid == athleteUserID && request.auth.token.firebase.sign_in_provider != 'anonymous';
       }
    }
  }
}

service firebase.storage {
  match /b/{bucket}/o {
    match /assets/{allPaths=**} {
       allow read;
    }
  }
}