firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // // Rules for questions collection
    match /orgs/{orgId}/questions/{questionId} {

      // Users can read messages only from their org
      allow read: if request.auth != null && 
      request.auth.token.orgId == orgId &&
      request.auth.token.isOwner == true;

      // // Allow creating a new question with current timestamp and non-empty content
      // allow create, write: if request.auth != null && // User is authenticated 
      // request.auth.uid == get(request.resource.data.user).id && // User field is the same as their userId
      // request.resource.data.orgId == request.auth.token.orgId && // orgId is the same as in their token
      // request.resource.data.timestamp == request.time && // timestamp is the same as the request time
      // request.resource.data.question is string && // question is a string
      // request.resource.data.question != '' && // question is not empty
      // request.time > getLastCreationTime() + duration.value(300, 's'); // Check if 5 minutes (300 seconds) have passed since last question

      // Allow owner to mark a question as read 
      allow update: if request.auth != null &&
      request.auth.token.orgId == orgId &&
      request.auth.token.isOwner == true &&
      request.resource.data.hasRead == true &&
      request.resource.data.diff(resource.data).affectedKeys().hasOnly(['hasRead']);

      // No one can delete a question
      allow delete: if false;
    }

    // This rule assumes that you have a control document with the last creation timestamp
  // function getLastCreationTime() {
    //   let userDoc = get(/databases/$(database)/documents/users/$(request.auth.uid));
    //   // If lastQuestionTime is undefined, return a default value (e.g., beginning of Unix time)
    //   return 'lastQuestionTime' in userDoc ? userDoc.data.lastQuestionTime : timestamp.date(1970, 1, 1);
    // }

    // Match the settings collection
    match /orgs/{orgId}/settings/display {
      // Allow anyone to read selected question
      allow read, get: if true;

      // Allow only the owner to write the selected question
      allow write: if request.auth != null &&
      request.auth.token.orgId == orgId &&  
      request.auth.token.isOwner == true &&
      request.resource.data.diff(resource.data).affectedKeys().hasOnly(['question']);
    }

    match /orgs/{orgId}/settings/app {
      // Allow anyone to read app org settings
      allow read, get: if true;

      // Allow only the owner to write app org settings
      allow write: if request.auth != null &&
      request.auth.token.orgId == orgId &&  
      request.auth.token.isOwner == true &&
      request.resource.data.diff(resource.data).affectedKeys().hasOnly(['canAskQuestions']);
    }

    // Rules for the Users Collection
  // match /users/{userId} {
    //   // only allow read for same user
    //   allow read: if request.auth != null && 
    //   request.auth.uid == userId;

    //   allow update, create: if false; 
    // }

    // Default rule 
    // Deny read/write access to all other documents by default
    match /{document=**} {
      allow read, write, create, delete: if false;
    }
  }
}