firestore.rules

rules_version = '2';

// To pick the right project: `firebase projects:list`, then `firebase use <project-name>`
// To deploy: `firebase deploy --only firestore:rules`
service cloud.firestore {
  match /databases/{database}/documents {

    function isAdmin() {
      return request.auth.token.email in [
        'akrolsmir@gmail.com',
        'jahooma@gmail.com',
        'taowell@gmail.com',
        'abc.sinclair@gmail.com',
        'manticmarkets@gmail.com',
        'iansphilips@gmail.com',
        'd4vidchee@gmail.com',
        'ingawei@gmail.com',
        'marshall@pol.rs',
        'politics@manifold.markets',
        'ai@manifold.markets'
      ]
    }

    match /users/{userId} {
      allow read;
      allow update: if isAdmin();
      allow update:
      if userId == request.auth.uid
        && request.resource.data.diff(resource.data).affectedKeys()
        .hasOnly(['bio', 'website', 'twitterHandle', 'discordHandle', 'shouldShowWelcome', 'hasSeenContractFollowModal', 'homeSections', 'optOutBetWarnings', 'hasSeenLoanModal', 'isAdvancedTrader']);
      // delete user rules
      allow update: if userId == request.auth.uid
        && request.resource.data.diff(resource.data).affectedKeys().hasOnly(['userDeleted', 'isBannedFromPosting'])
        && request.resource.data.userDeleted == true
        && request.resource.data.isBannedFromPosting == true;
      // User referral rules
      allow update: if userId == request.auth.uid
                         && request.resource.data.diff(resource.data).affectedKeys()
                          .hasOnly(['referredByUserId', 'referredByContractId', 'referredByGroupId'])
                          // only one referral allowed per user
                          && !("referredByUserId" in resource.data)
                          // user can't refer themselves
                          && !(userId == request.resource.data.referredByUserId);
                          // quid pro quos enabled (only once though so nbd) - bc I can't make this work:
                          // && (get(/databases/$(database)/documents/users/$(request.resource.data.referredByUserId)).referredByUserId == resource.data.id);
      match /events/{eventId} {
        allow create: if (request.auth == null && userId == 'NO_USER') || userId == request.auth.uid;
        allow read: if userId == request.auth.uid || userId == '_';
      }

    }

  	match /{somePath=**}/portfolioHistory/{portfolioHistoryId} {
      allow read;
    }

    match /private-users/{userId} {
      allow read: if userId == request.auth.uid || isAdmin();
      allow update: if (userId == request.auth.uid || isAdmin())
                       && request.resource.data.diff(resource.data).affectedKeys()
                         .hasOnly(['email', 'apiKey', 'notificationPreferences', 'twitchInfo', 'pushToken', 'rejectedPushNotificationsOn', 'blockedUserIds', 'blockedContractIds', 'blockedGroupSlugs','interestedInPushNotifications', 'hasSeenAppBannerInNotificationsOn', 'installedAppPlatforms','lastPromptedToEnablePushNotifications', 'paymentInfo']);
      // Symmetric block rules
      allow update: if (request.auth != null || isAdmin())
                       && request.resource.data.diff(resource.data).affectedKeys()
                         .hasOnly(['blockedByUserIds'])
                       && request.resource.data.blockedByUserIds.toSet().difference(resource.data.blockedByUserIds.toSet()).hasOnly([request.auth.uid]);

      allow delete: if (userId == request.auth.uid || isAdmin());
    }

    match /contracts/{contractId} {
      allow read: if isAdmin()
      // allow read if contract is not private
      allow read: if resource.data.visibility!='private';                                              
      allow update: if request.resource.data.diff(resource.data).affectedKeys()
                                                                 .hasOnly(['description', 'question', 'coverImageUrl'])
                       && resource.data.creatorId == request.auth.uid;
      allow update: if isAdmin();
      allow delete: if request.resource.data.creatorId == request.auth.uid || isAdmin();
    }

    match /{somePath=**}/bets/{betId} {
      allow read;
    }

    match /{somePath=**}/liquidity/{liquidityId} {
      allow read;
    }

    match /{somePath=**}/answers/{answerId} {
      allow read;
    }

    match /{somePath=**}/answersCpmm/{answerId} {
      allow read;
    }

    match /txns/{txnId} {
      allow read;
    }

    match /refresh-all-clients/{id} {
      allow read;
    }
  }
}