firestore.rules

rules_version = '2';
service cloud.firestore {
    match /databases/{database}/documents {
        function isUserAdmin() {
            return request.auth.uid != null
                && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == "admin";
        }

        match /users/{userId} {
            allow read: if request.auth != null && (request.auth.uid == userId || isUserAdmin());

            allow write: if false;

            match /collectedCards/{cardId} {
                allow read: if request.auth != null
                    && request.auth.uid == userId;

                allow write: if false;
            }
        }

        match /users-usernames/{username} {
            allow read: if request.auth != null;

            allow write: if false;
        }

        match /cards/{cardId} {
            allow read, update: if request.auth != null
                && isUserAdmin();

            allow write: if false;
        }

        match /cardSets/{cardSet} {
            allow read: if request.auth != null;

            allow write: if false;
        }

        match /ranking/{ranking} {
            allow read: if request.auth != null;

            allow write: if false;
        }

        match /guilds/{guild} {
            allow read: if request.auth != null;

            allow write: if false;
        }
    }
}