firestore.rules

service cloud.firestore {
  match /databases/{database}/documents {
    function ensureAuth() {
      return request.auth != null;
    }
  	function ensureUser(uid) {
			return ensureAuth() && uid == request.auth.uid;
    }
    function isInvolved(data) {
      return request.auth.uid in data.players;
    }

    match /decks/{deckId} {
      allow create: if false;
      allow update, delete: if resource.data.creator == request.auth.uid;
      allow read: if ensureAuth();
    }
    match /games/{gameId} {
      function isFinished() {
        return resource.data.isFinished == true;
      }
      function isInvolvedInGame() {
        return isInvolved(resource.data);
      }

      allow read: if ensureAuth() && isInvolvedInGame();
      allow write: if false;

      match /personal/{uid} {
        allow read: if ensureAuth() && ensureUser(uid);
        allow write: if false;
      }
      match /hidden/{uid} {
        allow read, write: if false;
      }
      match /actions/{actionId} {
        allow read: if ensureAuth() && isInvolvedInGame() && isFinished();
        allow write: if false;
      }
    }
    match /user-search/{uid} {
      allow write: if false;
      allow read: if ensureAuth();
    }
    match /lobby/{lobbyId} {
      allow create: if ensureAuth();
      allow update: if false;
      allow delete: if ensureAuth() && isInvolved(resource.data);
      allow read: if ensureAuth();
    }
    match /users/{uid} {
      function validUsername(username) {
      	return username.matches('^[a-zA-Z0-9][a-zA-Z0-9_]*([.][a-z0-9_]+)*$') == true;
      }

    	allow read: if ensureUser(uid);
      allow write: if ensureUser(uid)
                   && validUsername(request.resource.data.username);
    }
  }
}