firestore.rules

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function getRoles() {
      return getRolesFor(request.auth.uid);
    }

    function getRolesFor(userId) {
      return get(/databases/$(database)/documents/users/$(userId)).data.roles;
    }

    function hasAnyRoles() {
      let roles = getRoles();
      return roles.student || roles.teacher || roles.admin;
    }

    match /users/{user} {
      allow read: if (request.auth.uid == resource.id) || hasAnyRoles();
      allow write: if (request.auth.uid == resource.id && request.resource.data.roles == resource.data.roles) || getRoles().admin;
    }

    match /passes/{pass} {
      allow read, update: if request.auth.uid == resource.data.issuer || request.auth.uid == resource.data.holder || getRoles().admin;
      allow create: if getRoles().student && request.resource.data.holder == request.auth.uid && getRolesFor(request.resource.data.issuer).teacher;
    }
  }
}