firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /games/{gameId} {
      function isOwner(request, resource) {
        return request.auth != null && request.auth.uid == resource.data.ownerId;
      }

      function isShortCodeSearch(resource) {
        return resource.data.state == "waitingForPlayers" && resource.data.shortCode != null
      }

      allow list: if isOwner(request, resource) || isShortCodeSearch(resource);
      allow write: if isOwner(request, resource);
      allow get: if true;

      match /players/{playerId} {
        allow read: if true;
        allow write: if get(/databases/$(database)/documents/games/$(gameId)).data.state == "waitingForPlayers";
      }

      match /questions/{questionId} {
        allow read: if true;
        // could check the game's ownerId in the future
        allow write: if request.auth != null;
      }

      match /answers/{answerId} {
        allow read: if true;
        allow write: if get(/databases/$(database)/documents/games/$(gameId)).data.state == "showingQuestion";
      }
    }
  }
}