firestore.rules

rules_version = '2';
service cloud.firestore {
  function signedIn(userId) {
    return request.auth != null && request.auth.uid == userId;
  }
  function isValidTreePlan() {
    let plan = request.auth.token.plan;
    let treeType = request.resource.data.get('planId', null);
    return treeType == null || treeType == "basic" || plan == treeType
  }
  match /databases/{database}/documents {
    match /plans/{userId} {
      allow read: if signedIn(userId);
    }
    match /trees/{treeId} {
      allow read, write: if true;
    }
    match /users/{userId} {
      allow read, write: if signedIn(userId);
    }
    match /users/{userId}/trees/{treeId} {
      allow read, update: if signedIn(userId);
      allow create: if signedIn(userId) && isValidTreePlan();
    }
    match /users/{userId}/proTrees/{treeId} {
      allow read, update: if signedIn(userId);
      allow create: if signedIn(userId) && request.auth.token.plan == "pro";
    }
    match /subscriptions/{userId} {
      allow read, write: if signedIn(userId) && request.auth.token.email_verified;
    }
    match /{document=**} {
      allow read, write: if false
    }
  }
}